From 5da6eaa8afa4cf77aeeda9e8d7212aa7ed6ae3a5 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Tue, 4 Aug 2026 12:05:47 +0100
Subject: [PATCH 001/344] sqlite: prevent database close during callbacks

Co-authored-by: Asroy Cristian Sitorus <asroycristiansitorus@gmail.com>
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64743
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node_sqlite.cc                     | 42 +++++++++++++++++++++-----
 src/node_sqlite.h                      | 18 +++++++++++
 test/parallel/test-sqlite-udf-close.js | 39 ++++++++++++++++++++++++
 3 files changed, 92 insertions(+), 7 deletions(-)
 create mode 100644 test/parallel/test-sqlite-udf-close.js

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 272e6ffd0aeb..038af9812f9e 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -349,6 +349,7 @@ class CustomAggregate {
                                Global<Function> CustomAggregate::*mptr) {
     CustomAggregate* self =
         static_cast<CustomAggregate*>(sqlite3_user_data(ctx));
+    CallbackDepthGuard guard(self->db_);
     Environment* env = self->env_;
     Isolate* isolate = env->isolate();
     auto agg = self->GetAggregate(ctx);
@@ -395,12 +396,18 @@ class CustomAggregate {
       return;
     }
 
+    if (!self->db_->IsOpen()) {
+      THROW_ERR_INVALID_STATE(env, "database is not open");
+      return;
+    }
+
     agg->value.Reset(isolate, ret);
   }
 
   static inline void xValueBase(sqlite3_context* ctx, bool is_final) {
     CustomAggregate* self =
         static_cast<CustomAggregate*>(sqlite3_user_data(ctx));
+    CallbackDepthGuard guard(self->db_);
     Environment* env = self->env_;
     Isolate* isolate = env->isolate();
     auto agg = self->GetAggregate(ctx);
@@ -426,6 +433,9 @@ class CustomAggregate {
                .ToLocal(&result)) {
         self->db_->SetIgnoreNextSQLiteError(true);
         sqlite3_result_error(ctx, "", 0);
+      } else if (!self->db_->IsOpen()) {
+        THROW_ERR_INVALID_STATE(env, "database is not open");
+        return;
       }
     } else {
       result = Local<Value>::New(isolate, agg->value);
@@ -457,6 +467,10 @@ class CustomAggregate {
         auto fn = start_v.As<Function>();
         MaybeLocal<Value> retval =
             fn->Call(env_->context(), Null(isolate), 0, nullptr);
+        if (!db_->IsOpen()) {
+          THROW_ERR_INVALID_STATE(env_, "database is not open");
+          return nullptr;
+        }
         if (!retval.ToLocal(&start_v)) {
           db_->SetIgnoreNextSQLiteError(true);
           sqlite3_result_error(ctx, "", 0);
@@ -669,6 +683,7 @@ void UserDefinedFunction::xFunc(sqlite3_context* ctx,
                                 sqlite3_value** argv) {
   UserDefinedFunction* self =
       static_cast<UserDefinedFunction*>(sqlite3_user_data(ctx));
+  CallbackDepthGuard guard(self->db_);
   Environment* env = self->env_;
   Isolate* isolate = env->isolate();
   auto recv = Undefined(isolate);
@@ -700,6 +715,12 @@ void UserDefinedFunction::xFunc(sqlite3_context* ctx,
 
   MaybeLocal<Value> retval =
       fn->Call(env->context(), recv, argc, js_argv.data());
+
+  if (!self->db_->IsOpen()) {
+    THROW_ERR_INVALID_STATE(env, "database is not open");
+    return;
+  }
+
   Local<Value> result;
   if (!retval.ToLocal(&result)) {
     // Ignore the SQLite error because a JavaScript exception is pending.
@@ -1433,6 +1454,8 @@ void DatabaseSync::Close(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, db->IsInCallback(), "database cannot be closed while in a callback");
   db->FinalizeStatements();
   db->DeleteSessions();
   int r = sqlite3_close_v2(db->connection_);
@@ -2381,13 +2404,17 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
   BaseObjectPtr<DatabaseSync> guard(db);
 
   ArrayBufferViewContents<uint8_t> buf(args[0]);
-  int r = sqlite3changeset_apply(
-      db->connection_,
-      buf.length(),
-      const_cast<void*>(static_cast<const void*>(buf.data())),
-      context.filterCallback ? xFilter : nullptr,
-      xConflict,
-      static_cast<void*>(&context));
+  int r;
+  {
+    CallbackDepthGuard guard(db);
+    r = sqlite3changeset_apply(
+        db->connection_,
+        buf.length(),
+        const_cast<void*>(static_cast<const void*>(buf.data())),
+        context.filterCallback ? xFilter : nullptr,
+        xConflict,
+        static_cast<void*>(&context));
+  }
   if (r == SQLITE_OK) {
     args.GetReturnValue().Set(true);
     return;
@@ -2522,6 +2549,7 @@ int DatabaseSync::AuthorizerCallback(void* user_data,
                                      const char* param3,
                                      const char* param4) {
   DatabaseSync* db = static_cast<DatabaseSync*>(user_data);
+  CallbackDepthGuard guard(db);
   Environment* env = db->env();
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 48463b215cb3..9046b022eea4 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -229,6 +229,10 @@ class DatabaseSync : public BaseObject {
   void SetIgnoreNextSQLiteError(bool ignore);
   bool ShouldIgnoreSQLiteError();
 
+  void IncrementCallbackDepth() { ++callback_depth_; }
+  void DecrementCallbackDepth() { --callback_depth_; }
+  bool IsInCallback() const { return callback_depth_ > 0; }
+
   SET_MEMORY_INFO_NAME(DatabaseSync)
   SET_SELF_SIZE(DatabaseSync)
 
@@ -242,6 +246,7 @@ class DatabaseSync : public BaseObject {
   bool enable_load_extension_;
   sqlite3* connection_;
   bool ignore_next_sqlite_error_;
+  int callback_depth_ = 0;
 
   std::set<BackupJob*> backups_;
   std::unordered_set<Session*> sessions_;
@@ -401,6 +406,19 @@ class SQLTagStore : public BaseObject {
   friend class StatementExecutionHelper;
 };
 
+class CallbackDepthGuard {
+ public:
+  explicit CallbackDepthGuard(DatabaseSync* db) : db_(db) {
+    db_->IncrementCallbackDepth();
+  }
+  ~CallbackDepthGuard() { db_->DecrementCallbackDepth(); }
+  CallbackDepthGuard(const CallbackDepthGuard&) = delete;
+  CallbackDepthGuard& operator=(const CallbackDepthGuard&) = delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
 class UserDefinedFunction {
  public:
   UserDefinedFunction(Environment* env,
diff --git a/test/parallel/test-sqlite-udf-close.js b/test/parallel/test-sqlite-udf-close.js
new file mode 100644
index 000000000000..86794029b457
--- /dev/null
+++ b/test/parallel/test-sqlite-udf-close.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const assert = require('node:assert');
+const { test } = require('node:test');
+const { DatabaseSync } = require('node:sqlite');
+
+for (const method of ['all', 'get', 'run', 'iterate']) {
+  test(`database.close() from a UDF during statement.${method}()`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER);
+      INSERT INTO data VALUES (1), (2), (3);
+    `);
+
+    db.function('close_db', (value) => {
+      db.close();
+      return value;
+    });
+
+    const statement = db.prepare('SELECT close_db(value) FROM data');
+    assert.throws(() => {
+      if (method === 'iterate') {
+        for (const row of statement.iterate()) {
+          assert.ok(row);
+        }
+      } else {
+        statement[method]();
+      }
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: 'database cannot be closed while in a callback',
+    });
+
+    assert.strictEqual(db.isOpen, true);
+    db.close();
+  });
+}

From 2dd7d4c56fa7b6bd3a31c1c64b78ac6f467f29fe Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 4 Aug 2026 13:52:01 +0200
Subject: [PATCH 002/344] tools: add ./tools/nix/pkcs11.nix to nix-changes.yml

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64967
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/nix-changes.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index ef05b0bfc8ed..84c4337bab19 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -78,7 +78,6 @@ jobs:
 
       - name: Compute requisites before change
         shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-        # TODO(panva): add `// import ./tools/nix/pkcs11.nix {}` once landed
         run: |
           git reset HEAD^ --hard
           nix-store --query --references "$(
@@ -88,6 +87,7 @@ jobs:
                 ++ builtins.attrValues (
                   { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
                   // import ./tools/nix/openssl-matrix.nix {}
+                  // import ./tools/nix/pkcs11.nix {}
                 )")" \
           | xargs nix-store --realise \
           | xargs nix-store --query --requisites \

From 8f4ee7eda56981c092da3719e1f81a160057ece0 Mon Sep 17 00:00:00 2001
From: Tim Perry <pimterry@gmail.com>
Date: Wed, 29 Jul 2026 15:02:25 +0200
Subject: [PATCH 003/344] tls: drop hand-rolled TLS client hello parser

This existed for 'resumeSession', which needed to do an async lookup
though SSL_CTX_sess_set_get_cb is sync-only. Nowadays both OpenSSL &
BoringSSL have an early ClientHello callback for suspend/resume to
handle this properly, so it was redundant, in addition to being
complicated and generally a bit fragile & scary.

This PR switches to use the modern OpenSSL/BoringSSL mechanisms for this
and drops the client hello parser & related infrastructure completely.

In addition, there's a new test here, covering a fixed bug: the hello
parser silently dropped fragmented hellos, which we now do handle
correctly.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64827
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 lib/internal/tls/wrap.js                      |   9 +-
 node.gyp                                      |  52 ----
 src/crypto/README.md                          |  41 ++-
 src/crypto/crypto_clienthello-inl.h           |  90 -------
 src/crypto/crypto_clienthello.cc              | 238 ------------------
 src/crypto/crypto_clienthello.h               | 131 ----------
 src/crypto/crypto_context.cc                  |   8 +
 src/crypto/crypto_context.h                   |   6 +
 src/crypto/crypto_tls.cc                      | 177 +++++++------
 src/crypto/crypto_tls.h                       |  26 +-
 test/cctest/test_crypto_clienthello.cc        | 133 ----------
 test/fuzzers/fuzz_ClientHelloParser.cc        |  16 --
 .../test-tls-client-hello-fragmented.js       |  75 ++++++
 .../test-tls-clienthello-sync-write.js        |  53 ++++
 14 files changed, 283 insertions(+), 772 deletions(-)
 delete mode 100644 src/crypto/crypto_clienthello-inl.h
 delete mode 100644 src/crypto/crypto_clienthello.cc
 delete mode 100644 src/crypto/crypto_clienthello.h
 delete mode 100644 test/cctest/test_crypto_clienthello.cc
 delete mode 100644 test/fuzzers/fuzz_ClientHelloParser.cc
 create mode 100644 test/parallel/test-tls-client-hello-fragmented.js
 create mode 100644 test/parallel/test-tls-clienthello-sync-write.js

diff --git a/lib/internal/tls/wrap.js b/lib/internal/tls/wrap.js
index c1e7fbcae338..51fea0e99614 100644
--- a/lib/internal/tls/wrap.js
+++ b/lib/internal/tls/wrap.js
@@ -262,8 +262,8 @@ function loadSession(hello) {
       return owner.destroy(new ERR_SOCKET_CLOSED());
 
     owner._handle.loadSession(session);
-    // Session is loaded. End the parser to allow handshaking to continue.
-    owner._handle.endParser();
+    // Session is loaded. Let the handshake continue.
+    owner._handle.clientHelloDone();
   }
 
   if (hello.sessionId.length <= 0 ||
@@ -281,8 +281,8 @@ function loadSession(hello) {
     // Sessions with tickets can be resumed directly from the ticket, no server
     // session storage is necessary.
     // Without a call to a resumeSession listener, a session will never be
-    // loaded, so end the parser to allow handshaking to continue.
-    owner._handle.endParser();
+    // loaded, so let the handshake continue.
+    owner._handle.clientHelloDone();
   }
 }
 
@@ -970,7 +970,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
     if (this.server) {
       if (this.server.listenerCount('resumeSession') > 0 ||
           this.server.listenerCount('newSession') > 0) {
-        // Also starts the client hello parser as a side effect.
         ssl.enableSessionCallbacks();
       }
       if (this.server.listenerCount('OCSPRequest') > 0)
diff --git a/node.gyp b/node.gyp
index e5d1bd4ef1a6..cf5e53d00d7e 100644
--- a/node.gyp
+++ b/node.gyp
@@ -406,7 +406,6 @@
       'src/crypto/crypto_rsa.cc',
       'src/crypto/crypto_spkac.cc',
       'src/crypto/crypto_util.cc',
-      'src/crypto/crypto_clienthello.cc',
       'src/crypto/crypto_dh.cc',
       'src/crypto/crypto_hash.cc',
       'src/crypto/crypto_keys.cc',
@@ -416,7 +415,6 @@
       'src/crypto/crypto_x509.cc',
       'src/crypto/crypto_argon2.h',
       'src/crypto/crypto_bio.h',
-      'src/crypto/crypto_clienthello-inl.h',
       'src/crypto/crypto_dh.h',
       'src/crypto/crypto_hmac.h',
       'src/crypto/crypto_kmac.h',
@@ -432,7 +430,6 @@
       'src/crypto/crypto_keygen.h',
       'src/crypto/crypto_scrypt.h',
       'src/crypto/crypto_tls.h',
-      'src/crypto/crypto_clienthello.h',
       'src/crypto/crypto_context.h',
       'src/crypto/crypto_ec.h',
       'src/crypto/crypto_pqc.h',
@@ -462,7 +459,6 @@
       'src/tracing/trace_event_legacy.h',
     ],
     'node_cctest_openssl_sources': [
-      'test/cctest/test_crypto_clienthello.cc',
       'test/cctest/test_node_crypto.cc',
       'test/cctest/test_node_crypto_env.cc',
     ],
@@ -1297,54 +1293,6 @@
         }],
       ],
     }, # fuzz_env
-    { # fuzz_ClientHelloParser.cc
-      'target_name': 'fuzz_ClientHelloParser',
-      'type': 'executable',
-      'dependencies': [
-        '<(node_lib_target_name)',
-      ],
-      'includes': [
-        'node.gypi'
-      ],
-      'include_dirs': [
-        'src',
-        'tools/msvs/genfiles',
-        'deps/v8/include',
-        'deps/cares/include',
-        'deps/uv/include',
-        'test/cctest',
-      ],
-      'defines': [
-        'NODE_ARCH="<(target_arch)"',
-        'NODE_PLATFORM="<(OS)"',
-        'NODE_WANT_INTERNALS=1',
-      ],
-      'sources': [
-        'test/fuzzers/fuzz_ClientHelloParser.cc',
-      ],
-      'conditions': [
-        [ 'node_shared_hdr_histogram=="false"', {
-          'dependencies': [
-            'deps/histogram/histogram.gyp:histogram',
-          ],
-        }],
-        [ 'node_shared_uvwasi=="false"', {
-          'dependencies': [ 'deps/uvwasi/uvwasi.gyp:uvwasi' ],
-          'include_dirs': [ 'deps/uvwasi/include' ],
-        }],
-        ['OS=="linux" or OS=="openharmony"', {
-          'ldflags': [ '-fsanitize=fuzzer' ]
-        }],
-        # Ensure that ossfuzz flag has been set and that we are on Linux
-        [ 'OS not in "linux openharmony" or ossfuzz!="true"', {
-          'type': 'none',
-        }],
-        # Avoid excessive LTO
-        ['enable_lto=="true"', {
-          'ldflags': [ '-fno-lto' ],
-        }],
-      ],
-    }, # fuzz_ClientHelloParser.cc
     { # fuzz_strings
       'target_name': 'fuzz_strings',
       'type': 'executable',
diff --git a/src/crypto/README.md b/src/crypto/README.md
index cc5093a385ca..ad06cf989276 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -30,27 +30,26 @@ throughout the rest of the code.
 The rest of the files are structured by their function, as detailed in the
 following table:
 
-| File (\*.h/\*.cc)    | Description                                                                |
-| -------------------- | -------------------------------------------------------------------------- |
-| `crypto_aes`         | AES Cipher support.                                                        |
-| `crypto_argon2`      | Argon2 key / bit generation implementation.                                |
-| `crypto_cipher`      | General Encryption/Decryption utilities.                                   |
-| `crypto_clienthello` | TLS/SSL client hello parser implementation. Used during SSL/TLS handshake. |
-| `crypto_context`     | Implementation of the `SecureContext` object.                              |
-| `crypto_dh`          | Diffie-Hellman Key Agreement implementation.                               |
-| `crypto_dsa`         | DSA (Digital Signature) Key Generation functions.                          |
-| `crypto_ec`          | Elliptic-curve cryptography implementation.                                |
-| `crypto_hash`        | Basic hash (e.g. SHA-256) functions.                                       |
-| `crypto_hkdf`        | HKDF (Key derivation) implementation.                                      |
-| `crypto_hmac`        | HMAC implementations.                                                      |
-| `crypto_keys`        | Utilities for using and generating secret, private, and public keys.       |
-| `crypto_pbkdf2`      | PBKDF2 key / bit generation implementation.                                |
-| `crypto_rsa`         | RSA Key Generation functions.                                              |
-| `crypto_scrypt`      | Scrypt key / bit generation implementation.                                |
-| `crypto_sig`         | General digital signature and verification utilities.                      |
-| `crypto_spkac`       | Netscape SPKAC certificate utilities.                                      |
-| `crypto_ssl`         | Implementation of the `SSLWrap` object.                                    |
-| `crypto_timing`      | Implementation of the TimingSafeEqual.                                     |
+| File (\*.h/\*.cc) | Description                                                          |
+| ----------------- | -------------------------------------------------------------------- |
+| `crypto_aes`      | AES Cipher support.                                                  |
+| `crypto_argon2`   | Argon2 key / bit generation implementation.                          |
+| `crypto_cipher`   | General Encryption/Decryption utilities.                             |
+| `crypto_context`  | Implementation of the `SecureContext` object.                        |
+| `crypto_dh`       | Diffie-Hellman Key Agreement implementation.                         |
+| `crypto_dsa`      | DSA (Digital Signature) Key Generation functions.                    |
+| `crypto_ec`       | Elliptic-curve cryptography implementation.                          |
+| `crypto_hash`     | Basic hash (e.g. SHA-256) functions.                                 |
+| `crypto_hkdf`     | HKDF (Key derivation) implementation.                                |
+| `crypto_hmac`     | HMAC implementations.                                                |
+| `crypto_keys`     | Utilities for using and generating secret, private, and public keys. |
+| `crypto_pbkdf2`   | PBKDF2 key / bit generation implementation.                          |
+| `crypto_rsa`      | RSA Key Generation functions.                                        |
+| `crypto_scrypt`   | Scrypt key / bit generation implementation.                          |
+| `crypto_sig`      | General digital signature and verification utilities.                |
+| `crypto_spkac`    | Netscape SPKAC certificate utilities.                                |
+| `crypto_ssl`      | Implementation of the `SSLWrap` object.                              |
+| `crypto_timing`   | Implementation of the TimingSafeEqual.                               |
 
 When new crypto protocols are added, they will be added into their own
 `crypto_` `*.h` and `*.cc` files.
diff --git a/src/crypto/crypto_clienthello-inl.h b/src/crypto/crypto_clienthello-inl.h
deleted file mode 100644
index 1b8a0c00c307..000000000000
--- a/src/crypto/crypto_clienthello-inl.h
+++ /dev/null
@@ -1,90 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
-#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include "crypto/crypto_clienthello.h"
-#include "util.h"
-
-namespace node {
-namespace crypto {
-inline ClientHelloParser::ClientHelloParser()
-    : state_(kEnded),
-      onhello_cb_(nullptr),
-      onend_cb_(nullptr),
-      cb_arg_(nullptr) {
-  Reset();
-}
-
-inline void ClientHelloParser::Reset() {
-  frame_len_ = 0;
-  body_offset_ = 0;
-  extension_offset_ = 0;
-  session_size_ = 0;
-  session_id_ = nullptr;
-  tls_ticket_size_ = -1;
-  tls_ticket_ = nullptr;
-  servername_size_ = 0;
-  servername_ = nullptr;
-}
-
-inline void ClientHelloParser::Start(ClientHelloParser::OnHelloCb onhello_cb,
-                                     ClientHelloParser::OnEndCb onend_cb,
-                                     void* cb_arg) {
-  if (!IsEnded())
-    return;
-  Reset();
-
-  CHECK_NOT_NULL(onhello_cb);
-
-  state_ = kWaiting;
-  onhello_cb_ = onhello_cb;
-  onend_cb_ = onend_cb;
-  cb_arg_ = cb_arg;
-}
-
-inline void ClientHelloParser::End() {
-  if (state_ == kEnded)
-    return;
-  state_ = kEnded;
-  if (onend_cb_ != nullptr) {
-    onend_cb_(cb_arg_);
-    onend_cb_ = nullptr;
-  }
-}
-
-inline bool ClientHelloParser::IsEnded() const {
-  return state_ == kEnded;
-}
-
-inline bool ClientHelloParser::IsPaused() const {
-  return state_ == kPaused;
-}
-
-}  // namespace crypto
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
diff --git a/src/crypto/crypto_clienthello.cc b/src/crypto/crypto_clienthello.cc
deleted file mode 100644
index 203289ae2911..000000000000
--- a/src/crypto/crypto_clienthello.cc
+++ /dev/null
@@ -1,238 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-#include "crypto/crypto_clienthello.h"  // NOLINT(build/include_inline)
-#include "crypto/crypto_clienthello-inl.h"
-
-namespace node {
-namespace crypto {
-void ClientHelloParser::Parse(const uint8_t* data, size_t avail) {
-  switch (state_) {
-    case kWaiting:
-      if (!ParseRecordHeader(data, avail))
-        break;
-      [[fallthrough]];
-    case kTLSHeader:
-      ParseHeader(data, avail);
-      break;
-    case kPaused:
-      // Just nop
-    case kEnded:
-      // Already ended, just ignore it
-      break;
-    default:
-      break;
-  }
-}
-
-
-bool ClientHelloParser::ParseRecordHeader(const uint8_t* data, size_t avail) {
-  // >= 5 bytes for header parsing
-  if (avail < 5)
-    return false;
-
-  if (data[0] == kChangeCipherSpec ||
-      data[0] == kAlert ||
-      data[0] == kHandshake ||
-      data[0] == kApplicationData) {
-    frame_len_ = (data[3] << 8) + data[4];
-    state_ = kTLSHeader;
-    body_offset_ = 5;
-  } else {
-    End();
-    return false;
-  }
-
-  // Sanity check (too big frame, or too small)
-  // Let OpenSSL handle it
-  if (frame_len_ >= kMaxTLSFrameLen) {
-    End();
-    return false;
-  }
-
-  return true;
-}
-
-
-void ClientHelloParser::ParseHeader(const uint8_t* data, size_t avail) {
-  ClientHello hello;
-
-  // We need at least six bytes (one byte for kClientHello, three bytes for the
-  // length of the handshake message, and two bytes for the protocol version).
-  // If the client sent a frame that suggests a smaller ClientHello, give up.
-  if (frame_len_ < 6) return End();
-
-  // >= 5 + frame size bytes for frame parsing
-  if (body_offset_ + frame_len_ > avail)
-    return;
-
-  // Check hello protocol version.  Protocol tuples that we know about:
-  //
-  // (3,1) TLS v1.0
-  // (3,2) TLS v1.1
-  // (3,3) TLS v1.2
-  //
-  // Note that TLS v1.3 uses a TLS v1.2 handshake so requires no specific
-  // support here.
-  if (data[body_offset_ + 4] != 0x03 ||
-      data[body_offset_ + 5] < 0x01 ||
-      data[body_offset_ + 5] > 0x03) {
-    return End();
-  }
-
-  if (data[body_offset_] == kClientHello) {
-    if (state_ == kTLSHeader) {
-      if (!ParseTLSClientHello(data, avail))
-        return End();
-    } else {
-      // We couldn't get here, but whatever
-      return End();
-    }
-
-    // Check if we overflowed (do not reply with any private data)
-    if (session_id_ == nullptr ||
-        session_size_ > 32 ||
-        session_id_ + session_size_ > data + avail) {
-      return End();
-    }
-  }
-
-  state_ = kPaused;
-  hello.session_id_ = session_id_;
-  hello.session_size_ = session_size_;
-  hello.has_ticket_ = tls_ticket_ != nullptr && tls_ticket_size_ != 0;
-  hello.servername_ = servername_;
-  hello.servername_size_ = static_cast<uint8_t>(servername_size_);
-  onhello_cb_(cb_arg_, hello);
-}
-
-
-void ClientHelloParser::ParseExtension(const uint16_t type,
-                                       const uint8_t* data,
-                                       size_t len) {
-  // NOTE: In case of anything we're just returning back, ignoring the problem.
-  // That's because we're heavily relying on OpenSSL to solve any problem with
-  // incoming data.
-  switch (type) {
-    case kServerName:
-      {
-        if (len < 2)
-          return;
-        uint32_t server_names_len = (data[0] << 8) + data[1];
-        if (server_names_len + 2 > len)
-          return;
-        for (size_t offset = 2; offset < 2 + server_names_len; ) {
-          if (offset + 3 > len)
-            return;
-          uint8_t name_type = data[offset];
-          if (name_type != kServernameHostname)
-            return;
-          uint16_t name_len = (data[offset + 1] << 8) + data[offset + 2];
-          offset += 3;
-          if (offset + name_len > len)
-            return;
-          servername_ = data + offset;
-          servername_size_ = name_len;
-          offset += name_len;
-        }
-      }
-      break;
-    case kTLSSessionTicket:
-      tls_ticket_size_ = len;
-      tls_ticket_ = data + len;
-      break;
-    default:
-      // Ignore
-      break;
-  }
-}
-
-
-bool ClientHelloParser::ParseTLSClientHello(const uint8_t* data, size_t avail) {
-  const uint8_t* body;
-
-  // Skip frame header, hello header, protocol version and random data
-  size_t session_offset = body_offset_ + 4 + 2 + 32;
-
-  if (session_offset + 1 >= avail)
-    return false;
-
-  body = data + session_offset;
-  session_size_ = *body;
-  session_id_ = body + 1;
-
-  size_t cipher_offset = session_offset + 1 + session_size_;
-
-  // Session OOB failure
-  if (cipher_offset + 1 >= avail)
-    return false;
-
-  uint16_t cipher_len =
-      (data[cipher_offset] << 8) + data[cipher_offset + 1];
-  size_t comp_offset = cipher_offset + 2 + cipher_len;
-
-  // Cipher OOB failure
-  if (comp_offset >= avail)
-    return false;
-
-  uint8_t comp_len = data[comp_offset];
-  size_t extension_offset = comp_offset + 1 + comp_len;
-
-  // Compression OOB failure
-  if (extension_offset > avail)
-    return false;
-
-  // No extensions present
-  if (extension_offset == avail)
-    return true;
-
-  size_t ext_off = extension_offset + 2;
-
-  // Parse known extensions
-  while (ext_off < avail) {
-    // Extension OOB
-    if (ext_off + 4 > avail)
-      return false;
-
-    uint16_t ext_type = (data[ext_off] << 8) + data[ext_off + 1];
-    uint16_t ext_len = (data[ext_off + 2] << 8) + data[ext_off + 3];
-    ext_off += 4;
-
-    // Extension OOB
-    if (ext_off + ext_len > avail)
-      return false;
-
-    ParseExtension(ext_type,
-                   data + ext_off,
-                   ext_len);
-
-    ext_off += ext_len;
-  }
-
-  // Extensions OOB failure
-  if (ext_off > avail)
-    return false;
-
-  return true;
-}
-
-}  // namespace crypto
-}  // namespace node
diff --git a/src/crypto/crypto_clienthello.h b/src/crypto/crypto_clienthello.h
deleted file mode 100644
index 3af08bc6475e..000000000000
--- a/src/crypto/crypto_clienthello.h
+++ /dev/null
@@ -1,131 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
-#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include <cstddef>  // size_t
-#include <cstdint>
-
-namespace node {
-namespace crypto {
-// Parse the client hello so we can do async session resumption. OpenSSL's
-// session resumption uses synchronous callbacks, see SSL_CTX_sess_set_get_cb
-// and get_session_cb.
-//
-// TLS1.3 handshakes masquerade as TLS1.2 session resumption, and to do this,
-// they always include a session_id in the ClientHello, making up a bogus value
-// if necessary. The parser can't know if its a bogus id, and will cause a
-// 'newSession' event to be emitted. This should do no harm, the id won't be
-// found, and the handshake will continue.
-class ClientHelloParser {
- public:
-  inline ClientHelloParser();
-
-  class ClientHello {
-   public:
-    inline uint8_t session_size() const { return session_size_; }
-    inline const uint8_t* session_id() const { return session_id_; }
-    inline bool has_ticket() const { return has_ticket_; }
-    inline uint8_t servername_size() const { return servername_size_; }
-    inline const uint8_t* servername() const { return servername_; }
-
-   private:
-    uint8_t session_size_;
-    const uint8_t* session_id_;
-    bool has_ticket_;
-    uint8_t servername_size_;
-    const uint8_t* servername_;
-
-    friend class ClientHelloParser;
-  };
-
-  typedef void (*OnHelloCb)(void* arg, const ClientHello& hello);
-  typedef void (*OnEndCb)(void* arg);
-
-  void Parse(const uint8_t* data, size_t avail);
-
-  inline void Reset();
-  inline void Start(OnHelloCb onhello_cb, OnEndCb onend_cb, void* cb_arg);
-  inline void End();
-  inline bool IsPaused() const;
-  inline bool IsEnded() const;
-
- private:
-  static const size_t kMaxTLSFrameLen = 16 * 1024 + 5;
-  static const size_t kMaxSSLExFrameLen = 32 * 1024;
-  static const uint8_t kServernameHostname = 0;
-  static const size_t kMinStatusRequestSize = 5;
-
-  enum ParseState {
-    kWaiting,
-    kTLSHeader,
-    kPaused,
-    kEnded
-  };
-
-  enum FrameType {
-    kChangeCipherSpec = 20,
-    kAlert = 21,
-    kHandshake = 22,
-    kApplicationData = 23,
-    kOther = 255
-  };
-
-  enum HandshakeType {
-    kClientHello = 1
-  };
-
-  enum ExtensionType {
-    kServerName = 0,
-    kTLSSessionTicket = 35
-  };
-
-  bool ParseRecordHeader(const uint8_t* data, size_t avail);
-  void ParseHeader(const uint8_t* data, size_t avail);
-  void ParseExtension(const uint16_t type,
-                      const uint8_t* data,
-                      size_t len);
-  bool ParseTLSClientHello(const uint8_t* data, size_t avail);
-
-  ParseState state_;
-  OnHelloCb onhello_cb_;
-  OnEndCb onend_cb_;
-  void* cb_arg_;
-  size_t frame_len_ = 0;
-  size_t body_offset_ = 0;
-  size_t extension_offset_ = 0;
-  uint8_t session_size_ = 0;
-  const uint8_t* session_id_ = nullptr;
-  uint16_t servername_size_ = 0;
-  const uint8_t* servername_ = nullptr;
-  uint16_t tls_ticket_size_ = -1;
-  const uint8_t* tls_ticket_ = nullptr;
-};
-
-}  // namespace crypto
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 5447de596f98..d6387a55bd78 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -1689,6 +1689,14 @@ void SecureContext::SetNewSessionCallback(NewSessionCb cb) {
   SSL_CTX_sess_set_new_cb(ctx_.get(), cb);
 }
 
+void SecureContext::SetClientHelloCallback(ClientHelloCb cb) {
+#ifdef OPENSSL_IS_BORINGSSL
+  SSL_CTX_set_select_certificate_cb(ctx_.get(), cb);
+#else
+  SSL_CTX_set_client_hello_cb(ctx_.get(), cb, nullptr);
+#endif
+}
+
 void SecureContext::SetGetSessionCallback(GetSessionCb cb) {
   SSL_CTX_sess_set_get_cb(ctx_.get(), cb);
 }
diff --git a/src/crypto/crypto_context.h b/src/crypto/crypto_context.h
index 95ddea4c262d..c65f553e40fd 100644
--- a/src/crypto/crypto_context.h
+++ b/src/crypto/crypto_context.h
@@ -35,6 +35,11 @@ class SecureContext final : public BaseObject {
   using KeylogCb = void (*)(const SSL*, const char*);
   using NewSessionCb = int (*)(SSL*, SSL_SESSION*);
   using SelectSNIContextCb = int (*)(SSL*, int*, void*);
+#ifdef OPENSSL_IS_BORINGSSL
+  using ClientHelloCb = ssl_select_cert_result_t (*)(const SSL_CLIENT_HELLO*);
+#else
+  using ClientHelloCb = int (*)(SSL*, int*, void*);
+#endif
 
   ~SecureContext() override;
 
@@ -74,6 +79,7 @@ class SecureContext final : public BaseObject {
 
   ncrypto::SSLPointer CreateSSL();
 
+  void SetClientHelloCallback(ClientHelloCb cb);
   void SetGetSessionCallback(GetSessionCb cb);
   void SetKeylogCallback(KeylogCb cb);
   void SetNewSessionCallback(NewSessionCb cb);
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index ce44ad15fa79..9981704fb34a 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -23,7 +23,6 @@
 #include <cstdio>
 #include "async_wrap-inl.h"
 #include "crypto/crypto_bio.h"
-#include "crypto/crypto_clienthello-inl.h"
 #include "crypto/crypto_common.h"
 #include "crypto/crypto_context.h"
 #include "crypto/crypto_util.h"
@@ -103,42 +102,43 @@ SSL_SESSION* GetSessionCallback(
   return w->ReleaseSession();
 }
 
-void OnClientHello(
-    void* arg,
-    const ClientHelloParser::ClientHello& hello) {
-  TLSWrap* w = static_cast<TLSWrap*>(arg);
-  Environment* env = w->env();
-  HandleScope handle_scope(env->isolate());
-  Context::Scope context_scope(env->context());
+// The TLS library invokes this before version negotiation and before session
+// or ticket resumption, which makes async session lookup possible. If required
+// the handshake is suspended here and resumed once JS has answered.
+#ifdef OPENSSL_IS_BORINGSSL
+ssl_select_cert_result_t EarlyClientHelloCallback(const SSL_CLIENT_HELLO* ch) {
+  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(ch->ssl));
+  if (!w->should_suspend_for_client_hello()) return ssl_select_cert_success;
 
-  Local<Object> hello_obj = Object::New(env->isolate());
-  Local<String> servername = (hello.servername() == nullptr)
-      ? String::Empty(env->isolate())
-      : OneByteString(env->isolate(),
-                      hello.servername(),
-                      hello.servername_size());
-  Local<Object> buf =
-      Buffer::Copy(
-          env,
-          reinterpret_cast<const char*>(hello.session_id()),
-          hello.session_size()).FromMaybe(Local<Object>());
+  const uint8_t* ext;
+  size_t ext_len;
+  bool has_ticket = SSL_early_callback_ctx_extension_get(
+                        ch, TLSEXT_TYPE_session_ticket, &ext, &ext_len) &&
+                    ext_len > 0;
 
-  if ((buf.IsEmpty() ||
-       hello_obj->Set(env->context(), env->session_id_string(), buf)
-           .IsNothing()) ||
-      hello_obj->Set(env->context(), env->servername_string(), servername)
-          .IsNothing() ||
-      hello_obj
-          ->Set(env->context(),
-                env->tls_ticket_string(),
-                Boolean::New(env->isolate(), hello.has_ticket()))
-          .IsNothing()) {
-    return;
-  }
+  return w->OnEarlyClientHello(ch->session_id, ch->session_id_len, has_ticket)
+             ? ssl_select_cert_success
+             : ssl_select_cert_retry;
+}
+#else
+int EarlyClientHelloCallback(SSL* s, int* al, void* arg) {
+  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
+  if (!w->should_suspend_for_client_hello()) return SSL_CLIENT_HELLO_SUCCESS;
+
+  const unsigned char* session_id;
+  size_t session_id_len = SSL_client_hello_get0_session_id(s, &session_id);
+
+  const unsigned char* ext;
+  size_t ext_len;
+  bool has_ticket = SSL_client_hello_get0_ext(
+                        s, TLSEXT_TYPE_session_ticket, &ext, &ext_len) == 1 &&
+                    ext_len > 0;
 
-  Local<Value> argv[] = { hello_obj };
-  w->MakeCallback(env->onclienthello_string(), arraysize(argv), argv);
+  return w->OnEarlyClientHello(session_id, session_id_len, has_ticket)
+             ? SSL_CLIENT_HELLO_SUCCESS
+             : SSL_CLIENT_HELLO_RETRY;
 }
+#endif
 
 void KeylogCallback(const SSL* s, const char* line) {
   TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
@@ -425,6 +425,7 @@ TLSWrap::TLSWrap(Environment* env,
   ssl_ = sc_->CreateSSL();
   CHECK(ssl_);
 
+  sc_->SetClientHelloCallback(EarlyClientHelloCallback);
   sc_->SetGetSessionCallback(GetSessionCallback);
   sc_->SetNewSessionCallback(NewSessionCallback);
 
@@ -473,6 +474,61 @@ void TLSWrap::NewSessionDoneCb() {
   Cycle();
 }
 
+// N.b. TLS1.3 ClientHellos carry a fake legacy_session_id (middlebox compat),
+// and so emit spurious 'resumeSession'/'newSession' events here.
+bool TLSWrap::OnEarlyClientHello(const unsigned char* session_id,
+                                 size_t session_id_len,
+                                 bool has_ticket) {
+  if (!hello_emitted_) {
+    hello_emitted_ = true;
+    Debug(this, "Scheduling onclienthello");
+
+    // The hello data is only valid inside the library callback, and JS must
+    // not run while we are on its stack: a handler that synchronously wrote
+    // to the socket would re-enter SSL mid-handshake. Copy what we need and
+    // emit from a fresh stack instead.
+    std::vector<unsigned char> id(session_id, session_id + session_id_len);
+    BaseObjectPtr<TLSWrap> strong_ref{this};
+    env()->SetImmediate(
+        [this, strong_ref, id = std::move(id), has_ticket](Environment* env) {
+          if (ssl_) EmitClientHello(id, has_ticket);
+        });
+  }
+  return hello_answered_;
+}
+
+void TLSWrap::EmitClientHello(const std::vector<unsigned char>& session_id,
+                              bool has_ticket) {
+  Debug(this, "Emitting onclienthello");
+  Environment* env = this->env();
+  HandleScope handle_scope(env->isolate());
+  Context::Scope context_scope(env->context());
+
+  Local<Object> hello_obj = Object::New(env->isolate());
+  Local<Object> buf =
+      Buffer::Copy(env,
+                   reinterpret_cast<const char*>(session_id.data()),
+                   session_id.size())
+          .FromMaybe(Local<Object>());
+
+  if ((buf.IsEmpty() ||
+       hello_obj->Set(env->context(), env->session_id_string(), buf)
+           .IsNothing()) ||
+      hello_obj
+          ->Set(env->context(),
+                env->tls_ticket_string(),
+                Boolean::New(env->isolate(), has_ticket))
+          .IsNothing()) {
+    // Continue the handshake unresumed rather than leaving it suspended.
+    hello_answered_ = true;
+    Cycle();
+    return;
+  }
+
+  Local<Value> argv[] = {hello_obj};
+  MakeCallback(env->onclienthello_string(), arraysize(argv), argv);
+}
+
 void TLSWrap::InitSSL() {
   // Initialize SSL – OpenSSL takes ownership of these.
   enc_in_ = NodeBIO::New(env()).release();
@@ -641,12 +697,6 @@ void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) {
 void TLSWrap::EncOut() {
   Debug(this, "Trying to write encrypted output");
 
-  // Ignore cycling data if ClientHello wasn't yet parsed
-  if (!hello_parser_.IsEnded()) {
-    Debug(this, "Returning from EncOut(), hello_parser_ active");
-    return;
-  }
-
   // Write in progress
   if (write_size_ != 0) {
     Debug(this, "Returning from EncOut(), write currently in progress");
@@ -785,11 +835,6 @@ void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
 
 void TLSWrap::ClearOut() {
   Debug(this, "Trying to read cleartext output");
-  // Ignore cycling data if ClientHello wasn't yet parsed
-  if (!hello_parser_.IsEnded()) {
-    Debug(this, "Returning from ClearOut(), hello_parser_ active");
-    return;
-  }
 
   // No reads after EOF
   if (eof_) {
@@ -912,11 +957,6 @@ void TLSWrap::ClearOut() {
 
 void TLSWrap::ClearIn() {
   Debug(this, "Trying to write cleartext input");
-  // Ignore cycling data if ClientHello wasn't yet parsed
-  if (!hello_parser_.IsEnded()) {
-    Debug(this, "Returning from ClearIn(), hello_parser_ active");
-    return;
-  }
 
   if (ssl_ == nullptr) {
     Debug(this, "Returning from ClearIn(), ssl_ == nullptr");
@@ -1181,20 +1221,7 @@ void TLSWrap::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
 
   // Commit the amount of data actually read into the peeked/allocated buffer
   // from the underlying stream.
-  NodeBIO* enc_in = NodeBIO::FromBIO(enc_in_);
-  enc_in->Commit(nread);
-
-  // Parse ClientHello first, if we need to. It's only parsed if session event
-  // listeners are used on the server side.  "ended" is the initial state, so
-  // can mean parsing was never started, or that parsing is finished. Either
-  // way, ended means we can give the buffered data to SSL.
-  if (!hello_parser_.IsEnded()) {
-    size_t avail = 0;
-    uint8_t* data = reinterpret_cast<uint8_t*>(enc_in->Peek(&avail));
-    CHECK_IMPLIES(data == nullptr, avail == 0);
-    Debug(this, "Passing %zu bytes to the hello parser", avail);
-    return hello_parser_.Parse(data, avail);
-  }
+  NodeBIO::FromBIO(enc_in_)->Commit(nread);
 
   // Cycle OpenSSL's state
   Cycle();
@@ -1253,15 +1280,6 @@ void TLSWrap::EnableSessionCallbacks(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
   CHECK_NOT_NULL(wrap->ssl_);
   wrap->enable_session_callbacks();
-
-  // Clients don't use the HelloParser.
-  if (wrap->is_client())
-    return;
-
-  NodeBIO::FromBIO(wrap->enc_in_)->set_initial(kMaxHelloLength);
-  wrap->hello_parser_.Start(OnClientHello,
-                            OnClientHelloParseEnd,
-                            wrap);
 }
 
 void TLSWrap::EnableKeylogCallback(const FunctionCallbackInfo<Value>& args) {
@@ -1336,7 +1354,7 @@ void TLSWrap::Destroy() {
 void TLSWrap::EnableCertCb(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
-  wrap->WaitForCertCb(OnClientHelloParseEnd, wrap);
+  wrap->WaitForCertCb(ResumeAfterCertCb, wrap);
 }
 
 void TLSWrap::WaitForCertCb(CertCb cb, void* arg) {
@@ -1344,9 +1362,9 @@ void TLSWrap::WaitForCertCb(CertCb cb, void* arg) {
   cert_cb_arg_ = arg;
 }
 
-void TLSWrap::OnClientHelloParseEnd(void* arg) {
+void TLSWrap::ResumeAfterCertCb(void* arg) {
   TLSWrap* c = static_cast<TLSWrap*>(arg);
-  Debug(c, "OnClientHelloParseEnd()");
+  Debug(c, "ResumeAfterCertCb()");
   c->Cycle();
 }
 
@@ -2033,10 +2051,11 @@ void TLSWrap::ExportKeyingMaterial(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(buffer);
 }
 
-void TLSWrap::EndParser(const FunctionCallbackInfo<Value>& args) {
+void TLSWrap::ClientHelloDone(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
-  w->hello_parser_.End();
+  w->hello_answered_ = true;
+  w->Cycle();
 }
 
 void TLSWrap::Renegotiate(const FunctionCallbackInfo<Value>& args) {
@@ -2214,10 +2233,10 @@ void TLSWrap::Initialize(
   t->Inherit(AsyncWrap::GetConstructorTemplate(env));
 
   SetProtoMethod(isolate, t, "certCbDone", CertCbDone);
+  SetProtoMethod(isolate, t, "clientHelloDone", ClientHelloDone);
   SetProtoMethod(isolate, t, "destroySSL", DestroySSL);
   SetProtoMethod(isolate, t, "enableCertCb", EnableCertCb);
   SetProtoMethod(isolate, t, "enableALPNCb", EnableALPNCb);
-  SetProtoMethod(isolate, t, "endParser", EndParser);
   SetProtoMethod(isolate, t, "enableKeylogCallback", EnableKeylogCallback);
   SetProtoMethod(isolate, t, "enableSessionCallbacks", EnableSessionCallbacks);
   SetProtoMethod(isolate, t, "enableTrace", EnableTrace);
@@ -2285,10 +2304,10 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetWriteQueueSize);
 
   registry->Register(CertCbDone);
+  registry->Register(ClientHelloDone);
   registry->Register(DestroySSL);
   registry->Register(EnableCertCb);
   registry->Register(EnableALPNCb);
-  registry->Register(EndParser);
   registry->Register(EnableKeylogCallback);
   registry->Register(EnableSessionCallbacks);
   registry->Register(EnableTrace);
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index 87063b50bb74..61f773b9c609 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -25,7 +25,6 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include "crypto/crypto_context.h"
-#include "crypto/crypto_clienthello.h"
 
 #include "async_wrap.h"
 #include "stream_wrap.h"
@@ -66,6 +65,11 @@ class TLSWrap : public AsyncWrap,
   inline bool is_cert_cb_running() const { return cert_cb_running_; }
   inline bool is_waiting_cert_cb() const { return cert_cb_ != nullptr; }
   inline bool has_session_callbacks() const { return session_callbacks_; }
+  // We need to suspend the ClientHello only for server session id
+  // callbacks, and only on the first pass.
+  inline bool should_suspend_for_client_hello() const {
+    return is_server() && session_callbacks_ && !hello_answered_;
+  }
   inline void set_cert_cb_running(bool on = true) { cert_cb_running_ = on; }
   inline void set_awaiting_new_session(bool on = true) {
     awaiting_new_session_ = on;
@@ -105,6 +109,12 @@ class TLSWrap : public AsyncWrap,
   // Called by the done() callback of the 'newSession' event.
   void NewSessionDoneCb();
 
+  // Schedules 'onclienthello'; returns false to suspend the handshake until
+  // clientHelloDone(). The emit itself must not run on the library's stack.
+  bool OnEarlyClientHello(const unsigned char* session_id,
+                          size_t session_id_len,
+                          bool has_ticket);
+
   // Implement MemoryRetainer:
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(TLSWrap)
@@ -122,9 +132,6 @@ class TLSWrap : public AsyncWrap,
 
   static constexpr int kClearOutChunkSize = 16384;
 
-  // Maximum number of bytes for hello parser
-  static constexpr int kMaxHelloLength = 16384;
-
   // Usual ServerHello + Certificate size
   static constexpr int kInitialClientBufferLength = 4096;
 
@@ -140,6 +147,8 @@ class TLSWrap : public AsyncWrap,
   }
 
   void WaitForCertCb(CertCb cb, void* arg);
+  void EmitClientHello(const std::vector<unsigned char>& session_id,
+                       bool has_ticket);
 
   TLSWrap(Environment* env,
           v8::Local<v8::Object> obj,
@@ -180,6 +189,7 @@ class TLSWrap : public AsyncWrap,
   static int SelectSNIContextCallback(SSL* s, int* ad, void* arg);
 
   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void ClientHelloDone(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void DestroySSL(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableCertCb(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableALPNCb(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -188,7 +198,6 @@ class TLSWrap : public AsyncWrap,
   static void EnableSessionCallbacks(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableTrace(const v8::FunctionCallbackInfo<v8::Value>& args);
-  static void EndParser(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void ExportKeyingMaterial(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetALPNNegotiatedProto(
@@ -215,7 +224,7 @@ class TLSWrap : public AsyncWrap,
   static void IsSessionReused(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void LoadSession(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void NewSessionDone(const v8::FunctionCallbackInfo<v8::Value>& args);
-  static void OnClientHelloParseEnd(void* arg);
+  static void ResumeAfterCertCb(void* arg);
   static void Receive(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Renegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void RequestOCSP(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -257,7 +266,6 @@ class TLSWrap : public AsyncWrap,
   Kind kind_;
   ncrypto::SSLSessionPointer next_sess_;
   ncrypto::SSLPointer ssl_;
-  ClientHelloParser hello_parser_;
   v8::Global<v8::ArrayBufferView> ocsp_response_;
   BaseObjectPtr<SecureContext> sni_context_;
   BaseObjectPtr<SecureContext> sc_;
@@ -274,6 +282,10 @@ class TLSWrap : public AsyncWrap,
 
   bool session_callbacks_ = false;
   bool awaiting_new_session_ = false;
+  // 'onclienthello' has been emitted for this connection.
+  bool hello_emitted_ = false;
+  // JS has answered it by calling clientHelloDone().
+  bool hello_answered_ = false;
   bool in_dowrite_ = false;
   bool started_ = false;
   bool shutdown_ = false;
diff --git a/test/cctest/test_crypto_clienthello.cc b/test/cctest/test_crypto_clienthello.cc
deleted file mode 100644
index 870857cf9061..000000000000
--- a/test/cctest/test_crypto_clienthello.cc
+++ /dev/null
@@ -1,133 +0,0 @@
-#include "crypto/crypto_clienthello-inl.h"
-#include "gtest/gtest.h"
-
-// If the test is being compiled with an address sanitizer enabled, it should
-// catch the memory violation, so do not use a guard page.
-#ifdef __SANITIZE_ADDRESS__
-#define NO_GUARD_PAGE
-#elif defined(__has_feature)
-#if __has_feature(address_sanitizer)
-#define NO_GUARD_PAGE
-#endif
-#endif
-
-// If the test is running without an address sanitizer, see if we can use
-// mprotect() or VirtualProtect() to cause a segmentation fault when spatial
-// safety is violated.
-#if !defined(NO_GUARD_PAGE)
-#ifdef __linux__
-#include <sys/mman.h>
-#include <unistd.h>
-#if defined(_SC_PAGE_SIZE) && defined(PROT_NONE) && defined(PROT_READ) &&      \
-    defined(PROT_WRITE)
-#define USE_MPROTECT
-#endif
-#elif defined(_WIN32) && defined(_MSC_VER)
-#include <Windows.h>
-#include <memoryapi.h>
-#define USE_VIRTUALPROTECT
-#endif
-#endif
-
-#if defined(USE_MPROTECT)
-size_t GetPageSize() {
-  int page_size = sysconf(_SC_PAGE_SIZE);
-  CHECK_GE(page_size, 1);
-  return page_size;
-}
-#elif defined(USE_VIRTUALPROTECT)
-size_t GetPageSize() {
-  SYSTEM_INFO system_info;
-  GetSystemInfo(&system_info);
-  return system_info.dwPageSize;
-}
-#endif
-
-template <size_t N>
-class OverrunGuardedBuffer {
- public:
-  OverrunGuardedBuffer() {
-#if defined(USE_MPROTECT) || defined(USE_VIRTUALPROTECT)
-    size_t page = GetPageSize();
-    CHECK_GE(page, N);
-#endif
-#ifdef USE_MPROTECT
-    // Place the packet right before a guard page, which, when accessed, causes
-    // a segmentation fault.
-    alloc_base = static_cast<uint8_t*>(aligned_alloc(page, 2 * page));
-    CHECK_NOT_NULL(alloc_base);
-    uint8_t* second_page = alloc_base + page;
-    CHECK_EQ(mprotect(second_page, page, PROT_NONE), 0);
-    data_base = second_page - N;
-#elif defined(USE_VIRTUALPROTECT)
-    // On Windows, it works almost the same way.
-    alloc_base = static_cast<uint8_t*>(
-        VirtualAlloc(nullptr, 2 * page, MEM_COMMIT, PAGE_READWRITE));
-    CHECK_NOT_NULL(alloc_base);
-    uint8_t* second_page = alloc_base + page;
-    DWORD old_prot;
-    CHECK_NE(VirtualProtect(second_page, page, PAGE_NOACCESS, &old_prot), 0);
-    CHECK_EQ(old_prot, PAGE_READWRITE);
-    data_base = second_page - N;
-#else
-    // Place the packet in a regular allocated buffer. The bug causes undefined
-    // behavior, which might crash the process, and when it does not, address
-    // sanitizers and valgrind will catch it.
-    alloc_base = static_cast<uint8_t*>(malloc(N));
-    CHECK_NOT_NULL(alloc_base);
-    data_base = alloc_base;
-#endif
-  }
-
-  OverrunGuardedBuffer(const OverrunGuardedBuffer& other) = delete;
-  OverrunGuardedBuffer& operator=(const OverrunGuardedBuffer& other) = delete;
-
-  ~OverrunGuardedBuffer() {
-#if defined(USE_MPROTECT) || defined(USE_VIRTUALPROTECT)
-    size_t page = GetPageSize();
-#endif
-#ifdef USE_VIRTUALPROTECT
-    VirtualFree(alloc_base, 2 * page, MEM_RELEASE);
-#else
-#ifdef USE_MPROTECT
-    // Revert page protection such that the memory can be free()'d.
-    uint8_t* second_page = alloc_base + page;
-    CHECK_EQ(mprotect(second_page, page, PROT_READ | PROT_WRITE), 0);
-#endif
-    free(alloc_base);
-#endif
-  }
-
-  uint8_t* data() {
-    return data_base;
-  }
-
- private:
-  uint8_t* alloc_base;
-  uint8_t* data_base;
-};
-
-// Test that ClientHelloParser::ParseHeader() does not blindly trust the client
-// to send a valid frame length and subsequently does not read out-of-bounds.
-TEST(NodeCrypto, ClientHelloParserParseHeaderOutOfBoundsRead) {
-  using node::crypto::ClientHelloParser;
-
-  // This is the simplest packet triggering the bug.
-  const uint8_t packet[] = {0x16, 0x03, 0x01, 0x00, 0x00};
-  OverrunGuardedBuffer<sizeof(packet)> buffer;
-  memcpy(buffer.data(), packet, sizeof(packet));
-
-  // Let the ClientHelloParser parse the packet. This should not lead to a
-  // segmentation fault or to undefined behavior.
-  node::crypto::ClientHelloParser parser;
-  bool end_cb_called = false;
-  parser.Start([](void* arg, auto hello) { GTEST_FAIL(); },
-               [](void* arg) {
-                 bool* end_cb_called = static_cast<bool*>(arg);
-                 EXPECT_FALSE(*end_cb_called);
-                 *end_cb_called = true;
-               },
-               &end_cb_called);
-  parser.Parse(buffer.data(), sizeof(packet));
-  EXPECT_TRUE(end_cb_called);
-}
diff --git a/test/fuzzers/fuzz_ClientHelloParser.cc b/test/fuzzers/fuzz_ClientHelloParser.cc
deleted file mode 100644
index 87d7ae5e303e..000000000000
--- a/test/fuzzers/fuzz_ClientHelloParser.cc
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * A fuzzer focused on node::crypto::ClientHelloParser.
- */
-
-#include <stdlib.h>
-#include "crypto/crypto_clienthello-inl.h"
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  node::crypto::ClientHelloParser parser;
-  bool end_cb_called = false;
-  parser.Start([](void* arg, auto hello) { },
-               [](void* arg) { },
-               &end_cb_called);
-  parser.Parse(data, size);
-  return 0;
-}
diff --git a/test/parallel/test-tls-client-hello-fragmented.js b/test/parallel/test-tls-client-hello-fragmented.js
new file mode 100644
index 000000000000..690482e73dc5
--- /dev/null
+++ b/test/parallel/test-tls-client-hello-fragmented.js
@@ -0,0 +1,75 @@
+'use strict';
+
+// A ClientHello split across several TLS records must still emit
+// 'resumeSession'.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const net = require('net');
+const tls = require('tls');
+
+const options = {
+  key: fixtures.readKey('rsa_private.pem'),
+  cert: fixtures.readKey('rsa_cert.crt'),
+};
+
+// Capture a real ClientHello record so the replayed bytes are well-formed.
+function captureClientHello(callback) {
+  let hello = Buffer.alloc(0);
+  const collector = net.createServer((socket) => {
+    socket.on('data', (chunk) => {
+      hello = Buffer.concat([hello, chunk]);
+      if (hello.length < 5 || hello.length < 5 + hello.readUInt16BE(3)) return;
+      socket.destroy();
+      collector.close(() => callback(hello));
+    });
+  });
+  collector.listen(0, common.mustCall(() => {
+    tls.connect({ port: collector.address().port, rejectUnauthorized: false })
+      .on('error', () => {});
+  }));
+}
+
+captureClientHello(common.mustCall((hello) => {
+  assert.strictEqual(hello[0], 22);
+
+  // Split partway through the fixed-size header, before the session ID.
+  const body = hello.subarray(5);
+  const split = 20;
+  assert.ok(body.length > split);
+
+  const record = (payload) => Buffer.concat([
+    Buffer.from([22, hello[1], hello[2],
+                 payload.length >> 8, payload.length & 0xff]),
+    payload,
+  ]);
+
+  const server = tls.createServer(options);
+  server.on('tlsClientError', () => {});  // The replay never completes.
+
+  server.listen(0, common.mustCall(() => {
+    const client = net.connect(server.address().port, common.mustCall(() => {
+      client.write(record(body.subarray(0, split)));
+      setTimeout(() => client.write(record(body.subarray(split))), 10);
+    }));
+    client.on('error', () => {});
+
+    // Fail fast: a missing event stalls the handshake rather than erroring.
+    const guard = setTimeout(() => {
+      throw new Error('resumeSession was not emitted');
+    }, common.platformTimeout(10000));
+
+    server.on('resumeSession', common.mustCall((id, callback) => {
+      clearTimeout(guard);
+      assert.ok(id.length > 0);
+      callback(null, null);
+      client.destroy();
+      server.close();
+    }));
+  }));
+}));
diff --git a/test/parallel/test-tls-clienthello-sync-write.js b/test/parallel/test-tls-clienthello-sync-write.js
new file mode 100644
index 000000000000..4b7fcc541f0c
--- /dev/null
+++ b/test/parallel/test-tls-clienthello-sync-write.js
@@ -0,0 +1,53 @@
+'use strict';
+
+// Writing to a server TLSSocket synchronously from inside a 'resumeSession'
+// handler, while the handshake is still waiting on the ClientHello, must not
+// break the connection; the data must be delivered once the handshake ends.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { EventEmitter } = require('events');
+const fixtures = require('../common/fixtures');
+const net = require('net');
+const tls = require('tls');
+
+const secureContext = tls.createSecureContext({
+  key: fixtures.readKey('rsa_private.pem'),
+  cert: fixtures.readKey('rsa_cert.crt'),
+});
+
+const fakeServer = new EventEmitter();
+fakeServer.getTicketKeys = () => null;
+
+let serverSocket;
+fakeServer.on('resumeSession', common.mustCall((id, callback) => {
+  serverSocket.write('from-mid-handshake');
+  callback(null, null);
+}));
+
+const server = net.createServer(common.mustCall((raw) => {
+  serverSocket = new tls.TLSSocket(raw, {
+    isServer: true,
+    secureContext,
+    server: fakeServer,
+  });
+  serverSocket.on('error', common.mustNotCall());
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    client.on('data', common.mustCall((data) => {
+      assert.strictEqual(data.toString(), 'from-mid-handshake');
+      client.end();
+      server.close();
+    }));
+  }));
+  client.on('error', common.mustNotCall());
+}));

From 1864175435a0d49277773b671f51e47f04c33667 Mon Sep 17 00:00:00 2001
From: Tim Perry <pimterry@gmail.com>
Date: Mon, 3 Aug 2026 15:37:03 +0200
Subject: [PATCH 004/344] tls: don't trigger SNICallback or OCSPRequest from
 the TLS lib stack

Both events (backed by oncertcb) could potentially write to the socket
synchronously, re-entering SSL mid-handshake and breaking the
connection, so we defer them just like the new 'resumeSession'
behaviour.

Also fixes a small bug in the error path of EmitClientHello, which now
bails out more aggressively instead of resuming handshakes in a V8
teardown scenario.

Co-authored-by: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64827
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 src/crypto/crypto_tls.cc                    | 68 +++++++++++++--------
 src/crypto/crypto_tls.h                     |  4 ++
 test/parallel/test-tls-certcb-sync-write.js | 49 +++++++++++++++
 3 files changed, 96 insertions(+), 25 deletions(-)
 create mode 100644 test/parallel/test-tls-certcb-sync-write.js

diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 9981704fb34a..8ef74aee2d0e 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -218,32 +218,18 @@ int SSLCertCallback(SSL* s, void* arg) {
     // handshake will continue after certcb is done.
     return -1;
 
-  Environment* env = w->env();
-  HandleScope handle_scope(env->isolate());
-  Context::Scope context_scope(env->context());
   w->set_cert_cb_running();
 
-  Local<Object> info = Object::New(env->isolate());
+  // The view points into SSL-owned memory, so copy it before deferring.
+  std::string servername;
+  if (auto name = SSLPointer::GetServerName(s)) servername = *name;
 
-  auto servername = SSLPointer::GetServerName(s);
-  Local<String> servername_str =
-      !servername.has_value()
-          ? String::Empty(env->isolate())
-          : OneByteString(env->isolate(), servername.value());
-
-  Local<Value> ocsp = Boolean::New(
-      env->isolate(), SSL_get_tlsext_status_type(s) == TLSEXT_STATUSTYPE_ocsp);
+  w->ScheduleCertCb(std::move(servername),
+                    SSL_get_tlsext_status_type(s) == TLSEXT_STATUSTYPE_ocsp);
 
-  if (info->Set(env->context(), env->servername_string(), servername_str)
-          .IsNothing() ||
-      info->Set(env->context(), env->ocsp_request_string(), ocsp).IsNothing()) {
-    return 1;
-  }
-
-  Local<Value> argv[] = { info };
-  w->MakeCallback(env->oncertcb_string(), arraysize(argv), argv);
-
-  return w->is_cert_cb_running() ? -1 : 1;
+  // Suspend handshake with SSL_ERROR_WANT_X509_LOOKUP, and handshake will
+  // continue after certcb is done.
+  return -1;
 }
 
 int SelectALPNCallback(
@@ -519,9 +505,7 @@ void TLSWrap::EmitClientHello(const std::vector<unsigned char>& session_id,
                 env->tls_ticket_string(),
                 Boolean::New(env->isolate(), has_ticket))
           .IsNothing()) {
-    // Continue the handshake unresumed rather than leaving it suspended.
-    hello_answered_ = true;
-    Cycle();
+    // An exception is pending, so don't re-enter SSL or JS to resume.
     return;
   }
 
@@ -529,6 +513,40 @@ void TLSWrap::EmitClientHello(const std::vector<unsigned char>& session_id,
   MakeCallback(env->onclienthello_string(), arraysize(argv), argv);
 }
 
+// As with the ClientHello, JS must not run on the library's stack: 'oncertcb'
+// handlers synchronously call back into the handle to resume the handshake.
+void TLSWrap::ScheduleCertCb(std::string servername, bool ocsp) {
+  Debug(this, "Scheduling oncertcb");
+  BaseObjectPtr<TLSWrap> strong_ref{this};
+  env()->SetImmediate(
+      [this, strong_ref, servername = std::move(servername), ocsp](
+          Environment* env) {
+        if (ssl_) EmitCertCb(servername, ocsp);
+      });
+}
+
+void TLSWrap::EmitCertCb(const std::string& servername, bool ocsp) {
+  Debug(this, "Emitting oncertcb");
+  Environment* env = this->env();
+  HandleScope handle_scope(env->isolate());
+  Context::Scope context_scope(env->context());
+
+  Local<Object> info = Object::New(env->isolate());
+  if (info->Set(env->context(),
+                env->servername_string(),
+                OneByteString(env->isolate(), servername))
+          .IsNothing() ||
+      info->Set(env->context(),
+                env->ocsp_request_string(),
+                Boolean::New(env->isolate(), ocsp))
+          .IsNothing()) {
+    return;
+  }
+
+  Local<Value> argv[] = {info};
+  MakeCallback(env->oncertcb_string(), arraysize(argv), argv);
+}
+
 void TLSWrap::InitSSL() {
   // Initialize SSL – OpenSSL takes ownership of these.
   enc_in_ = NodeBIO::New(env()).release();
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index 61f773b9c609..a5ded3392915 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -115,6 +115,9 @@ class TLSWrap : public AsyncWrap,
                           size_t session_id_len,
                           bool has_ticket);
 
+  // Schedules 'oncertcb'. The handshake stays suspended until certCbDone().
+  void ScheduleCertCb(std::string servername, bool ocsp);
+
   // Implement MemoryRetainer:
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(TLSWrap)
@@ -149,6 +152,7 @@ class TLSWrap : public AsyncWrap,
   void WaitForCertCb(CertCb cb, void* arg);
   void EmitClientHello(const std::vector<unsigned char>& session_id,
                        bool has_ticket);
+  void EmitCertCb(const std::string& servername, bool ocsp);
 
   TLSWrap(Environment* env,
           v8::Local<v8::Object> obj,
diff --git a/test/parallel/test-tls-certcb-sync-write.js b/test/parallel/test-tls-certcb-sync-write.js
new file mode 100644
index 000000000000..caf591d669f4
--- /dev/null
+++ b/test/parallel/test-tls-certcb-sync-write.js
@@ -0,0 +1,49 @@
+'use strict';
+
+// Writing to a server TLSSocket synchronously from inside an SNICallback,
+// while the handshake is still waiting on the certificate callback, must not
+// break the connection; the data must be delivered once the handshake ends.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const net = require('net');
+const tls = require('tls');
+
+const secureContext = tls.createSecureContext({
+  key: fixtures.readKey('rsa_private.pem'),
+  cert: fixtures.readKey('rsa_cert.crt'),
+});
+
+let serverSocket;
+const server = net.createServer(common.mustCall((raw) => {
+  serverSocket = new tls.TLSSocket(raw, {
+    isServer: true,
+    secureContext,
+    SNICallback: common.mustCall((servername, callback) => {
+      assert.strictEqual(servername, 'localhost');
+      serverSocket.write('from-mid-handshake');
+      callback(null, null);
+    }),
+  });
+  serverSocket.on('error', common.mustNotCall());
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    servername: 'localhost',
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    client.on('data', common.mustCall((data) => {
+      assert.strictEqual(data.toString(), 'from-mid-handshake');
+      client.end();
+      server.close();
+    }));
+  }));
+  client.on('error', common.mustNotCall());
+}));

From 044402cf0e2499572c428f76f4ce7679ebeccc28 Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Tue, 4 Aug 2026 20:33:13 +0800
Subject: [PATCH 005/344] src: use UTF-8 for task runner filesystem paths

Use ConvertPathToUTF8() instead of path::string() when passing
filesystem paths to Node and libuv interfaces. This prevents paths
containing characters outside the active Windows code page from being
corrupted or rejected.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64868
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 src/node_task_runner.cc        | 25 ++++++++++----------
 test/parallel/test-node-run.js | 42 ++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 12 deletions(-)

diff --git a/src/node_task_runner.cc b/src/node_task_runner.cc
index 22c02e83e12e..2b3e005abf34 100644
--- a/src/node_task_runner.cc
+++ b/src/node_task_runner.cc
@@ -123,7 +123,7 @@ void ProcessRunner::SetEnvironmentVariables() {
   // Add NODE_RUN_PACKAGE_JSON_PATH environment variable to the environment to
   // indicate which package.json is being processed.
   env_vars_.push_back("NODE_RUN_PACKAGE_JSON_PATH=" +
-                      package_json_path_.string());
+                      ConvertPathToUTF8(package_json_path_));
 
   env_ = std::unique_ptr<char*[]>(new char*[env_vars_.size() + 1]);
   options_.env = env_.get();
@@ -206,7 +206,7 @@ void ProcessRunner::OnExit(int64_t exit_status, int term_signal) {
 
 void ProcessRunner::Run() {
   // keeps the string alive until destructor
-  cwd_ = package_json_path_.parent_path().string();
+  cwd_ = ConvertPathToUTF8(package_json_path_.parent_path());
   options_.cwd = cwd_.c_str();
   if (int r = uv_spawn(loop_, &process_, &options_)) {
     fprintf(stderr, "Error: %s\n", uv_strerror(r));
@@ -228,14 +228,14 @@ FindPackageJson(const std::filesystem::path& cwd) {
     // Append "path/node_modules/.bin" to the env var, if it is a directory.
     auto node_modules_bin = directory_path / "node_modules" / ".bin";
     if (std::filesystem::is_directory(node_modules_bin)) {
-      path_env_var += node_modules_bin.string() + env_var_separator;
+      path_env_var += ConvertPathToUTF8(node_modules_bin) + env_var_separator;
     }
 
     if (raw_content.empty()) {
       package_json_path = directory_path / "package.json";
       // This is required for Windows because std::filesystem::path::c_str()
       // returns wchar_t* on Windows, and char* on other platforms.
-      std::string contents = package_json_path.string();
+      std::string contents = ConvertPathToUTF8(package_json_path);
       USE(ReadFileSync(&raw_content, contents.c_str()) > 0);
     }
   }
@@ -258,7 +258,7 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
   if (!package_json.has_value()) {
     fprintf(stderr,
             "Can't find package.json for directory %s\n",
-            cwd.string().c_str());
+            ConvertPathToUTF8(cwd).c_str());
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
   }
@@ -274,7 +274,7 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
   simdjson::ondemand::object main_object;
 
   if (json_parser.iterate(raw_json).get(document)) {
-    fprintf(stderr, "Can't parse %s\n", path.string().c_str());
+    fprintf(stderr, "Can't parse %s\n", ConvertPathToUTF8(path).c_str());
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
   }
@@ -283,9 +283,9 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
     if (root_error == simdjson::error_code::INCORRECT_TYPE) {
       fprintf(stderr,
               "Root value unexpected not an object for %s\n\n",
-              path.string().c_str());
+              ConvertPathToUTF8(path).c_str());
     } else {
-      fprintf(stderr, "Can't parse %s\n", path.string().c_str());
+      fprintf(stderr, "Can't parse %s\n", ConvertPathToUTF8(path).c_str());
     }
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
@@ -294,8 +294,9 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
   // If package_json object doesn't have "scripts" field, throw an error.
   simdjson::ondemand::object scripts_object;
   if (main_object["scripts"].get_object().get(scripts_object)) {
-    fprintf(
-        stderr, "Can't find \"scripts\" field in %s\n", path.string().c_str());
+    fprintf(stderr,
+            "Can't find \"scripts\" field in %s\n",
+            ConvertPathToUTF8(path).c_str());
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
   }
@@ -309,13 +310,13 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
               "Script \"%.*s\" is unexpectedly not a string for %s\n\n",
               static_cast<int>(command_id.size()),
               command_id.data(),
-              path.string().c_str());
+              ConvertPathToUTF8(path).c_str());
     } else {
       fprintf(stderr,
               "Missing script: \"%.*s\" for %s\n\n",
               static_cast<int>(command_id.size()),
               command_id.data(),
-              path.string().c_str());
+              ConvertPathToUTF8(path).c_str());
       fprintf(stderr, "Available scripts are:\n");
 
       // Reset the object to iterate over it again
diff --git a/test/parallel/test-node-run.js b/test/parallel/test-node-run.js
index e24117f6b165..7c1f6609f6f1 100644
--- a/test/parallel/test-node-run.js
+++ b/test/parallel/test-node-run.js
@@ -5,8 +5,11 @@ common.requireNoPackageJSONAbove();
 
 const { it, describe } = require('node:test');
 const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
 
 const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
 const envSuffix = common.isWindows ? '-windows' : '';
 
 describe('node --run [command]', () => {
@@ -201,6 +204,45 @@ describe('node --run [command]', () => {
     assert.strictEqual(child.code, 0);
   });
 
+  it('handles package paths outside the active Windows code page',
+     { skip: !common.isWindows }, async () => {
+       tmpdir.refresh();
+
+       const projectDir = path.join(tmpdir.path, 'node-run-\u{20BB7}');
+       const packageJsonPath = path.join(projectDir, 'package.json');
+       const nodeModulesBin = path.join(projectDir, 'node_modules', '.bin');
+       const checkScript = path.join(projectDir, 'check.js');
+
+       fs.mkdirSync(nodeModulesBin, { recursive: true });
+       fs.writeFileSync(packageJsonPath, JSON.stringify({
+         scripts: {
+           unicode: `"${process.execPath}" check.js`,
+         },
+       }));
+       fs.writeFileSync(checkScript, `
+         'use strict';
+         console.log(JSON.stringify({
+           cwd: process.cwd(),
+           packageJsonPath: process.env.NODE_RUN_PACKAGE_JSON_PATH,
+           path: process.env.PATH,
+         }));
+       `);
+
+       const child = await common.spawnPromisified(
+         process.execPath,
+         [ '--run', 'unicode'],
+         { cwd: projectDir },
+       );
+
+       assert.strictEqual(child.stderr, '');
+       assert.strictEqual(child.code, 0);
+
+       const output = JSON.parse(child.stdout);
+       assert.strictEqual(output.cwd, projectDir);
+       assert.strictEqual(output.packageJsonPath, packageJsonPath);
+       assert.strictEqual(output.path.split(path.delimiter)[0], nodeModulesBin);
+     });
+
   it('returns error on unparsable file', async () => {
     const child = await common.spawnPromisified(
       process.execPath,

From 5cac7c2c5566564c5f821a8b9cb7602a2431c308 Mon Sep 17 00:00:00 2001
From: Yilong Li <burningdian@gmail.com>
Date: Tue, 4 Aug 2026 21:21:11 +0800
Subject: [PATCH 006/344] ffi: reuse libffi call plans
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Precompute a libffi call plan for each fixed signature on x86-64
System V and reuse it from the generic and SharedBuffer invokers. This
avoids repeating argument-placement work for every call.

Continue to use ffi_call() with libffi older than 3.7, on other ABIs,
and when plan allocation fails.

Signed-off-by: umuoy1 <burningdian@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64958
Fixes: https://github.com/nodejs/node/issues/64562
Refs: https://github.com/libffi/libffi/commit/3cc6beb7d404e12d3458461d76557b79795816ff
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 benchmark/ffi/invoke-function.js | 79 ++++++++++++++++++++++++++++++++
 src/ffi/fast.cc                  | 24 ++++++++--
 src/node_ffi.cc                  | 37 +++++++++++----
 src/node_ffi.h                   | 29 ++++++++++--
 4 files changed, 152 insertions(+), 17 deletions(-)
 create mode 100644 benchmark/ffi/invoke-function.js

diff --git a/benchmark/ffi/invoke-function.js b/benchmark/ffi/invoke-function.js
new file mode 100644
index 000000000000..ae8d5b2ef795
--- /dev/null
+++ b/benchmark/ffi/invoke-function.js
@@ -0,0 +1,79 @@
+'use strict';
+
+const assert = require('node:assert');
+const common = require('../common.js');
+const { libraryPath, ensureFixtureLibrary } = require('./common.js');
+
+// Measure the invocation (call) path for signatures that bypass V8 Fast API
+// and use libffi through FFIFunction::Invoke(). On x86-64 System V with
+// libffi >= 3.7, Invoke() reuses a precomputed call plan that avoids repeating
+// argument-placement work on every call. This benchmark quantifies the
+// per-call benefit.
+//
+// Signatures chosen to bypass both V8 Fast API and keep native work minimal:
+// - call_int_callback (null): 'function' type forces the generic path; null
+//   pointer triggers the early return in C so native computation is negligible.
+//   From libffi's perspective this is a register-only plan (2 pointer-sized
+//   args both fit in GP registers on x86-64 System V).
+// - sum_8_i32: 8 GP args exceed the x86-64 Fast API register cap (6), forcing
+//   the generic path. From libffi's perspective 6 args go in registers and 2
+//   spill to the stack, exercising a stack-spilled plan.
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  symbol: ['call_int_callback', 'sum_8_i32'],
+}, {
+  flags: ['--experimental-ffi', '--no-warnings'],
+});
+
+ensureFixtureLibrary();
+
+function main({ n, symbol }) {
+  const ffi = require('node:ffi');
+
+  if (symbol === 'call_int_callback') {
+    // 'function' type bypasses Fast API (IsFastCallEligible rejects it).
+    // Pass 0n (null function pointer) so the native function returns -1
+    // immediately without invoking any callback, keeping per-call overhead
+    // dominated by the FFI call machinery itself.
+    const { lib, functions } = ffi.dlopen(libraryPath, {
+      call_int_callback: { return: 'i32', arguments: ['function', 'i32'] },
+    });
+
+    try {
+      // Verify the null-pointer early return.
+      assert.strictEqual(functions.call_int_callback(0n, 7), -1);
+
+      bench.start();
+      for (let i = 0; i < n; ++i)
+        functions.call_int_callback(0n, 21);
+      bench.end(n);
+    } finally {
+      lib.close();
+    }
+  } else {
+    // 8 integer args exceed the x86-64 SysV GP register cap (6), which makes
+    // CreateFastFFIMetadata reject the signature. Calls go through the
+    // SharedBuffer or generic invoker into FFIFunction::Invoke().
+    const { lib, functions } = ffi.dlopen(libraryPath, {
+      sum_8_i32: {
+        return: 'i32',
+        arguments: [
+          'i32', 'i32', 'i32', 'i32',
+          'i32', 'i32', 'i32', 'i32',
+        ],
+      },
+    });
+
+    const fn = functions.sum_8_i32;
+
+    assert.strictEqual(fn(1, 2, 3, 4, 5, 6, 7, 8), 36);
+
+    bench.start();
+    for (let i = 0; i < n; ++i)
+      fn(1, 2, 3, 4, 5, 6, 7, 14);
+    bench.end(n);
+
+    lib.close();
+  }
+}
diff --git a/src/ffi/fast.cc b/src/ffi/fast.cc
index ca9a5715724b..80ee49e08b28 100644
--- a/src/ffi/fast.cc
+++ b/src/ffi/fast.cc
@@ -192,13 +192,31 @@ bool SignatureNeedsFastBufferInvoke(const FFIFunction& fn) {
           IsBufferTypeName(fn.arg_type_names[0]));
 }
 
+namespace {
+
+std::shared_ptr<FFIFunction> CloneForFastMetadata(
+    const std::shared_ptr<FFIFunction>& fn) {
+  // Fast metadata only needs the native target and signature. In particular,
+  // its temporary clone must not borrow the original function's cif or plan.
+  auto clone = std::make_shared<FFIFunction>();
+  clone->closed = fn->closed;
+  clone->ptr = fn->ptr;
+  clone->args = fn->args;
+  clone->return_type = fn->return_type;
+  clone->arg_type_names = fn->arg_type_names;
+  clone->return_type_name = fn->return_type_name;
+  return clone;
+}
+
+}  // namespace
+
 std::shared_ptr<FFIFunction> CloneWithRawPointerArgNames(
     const std::shared_ptr<FFIFunction>& fn) {
   // The primary Fast API entrypoint receives pointer-compatible values as
   // BigInts after the JS wrapper has converted strings, nullish values, and
   // memory-backed objects. A secondary entrypoint handles the monomorphic
   // memory-backed case without extracting the pointer in JS.
-  auto clone = std::make_shared<FFIFunction>(*fn);
+  auto clone = CloneForFastMetadata(fn);
   for (std::string& name : clone->arg_type_names) {
     if (IsBufferTypeName(name)) {
       name = "pointer";
@@ -209,10 +227,10 @@ std::shared_ptr<FFIFunction> CloneWithRawPointerArgNames(
 
 std::shared_ptr<FFIFunction> CloneWithFastBufferArgNames(
     const std::shared_ptr<FFIFunction>& fn) {
-  // Reuse the same native target and libffi metadata, but describe the JS
+  // Reuse the same native target and signature metadata, but describe the JS
   // argument as `buffer` so CreateFastFFIMetadata() emits a trampoline that
   // receives a V8 value and calls node_ffi_fast_buffer_data().
-  auto clone = std::make_shared<FFIFunction>(*fn);
+  auto clone = CloneForFastMetadata(fn);
   for (std::string& name : clone->arg_type_names) {
     if (IsPointerTypeName(name)) {
       name = "buffer";
diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 6cce5e38e8e3..26a8f5a610cb 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -42,6 +42,17 @@ using v8::Value;
 
 namespace ffi {
 
+void FFIFunction::Invoke(void* result, void** values) {
+#if defined(NODE_FFI_HAS_FAST_CALL_PLAN)
+  if (call_plan != nullptr) {
+    ffi_call_plan_invoke(call_plan.get(), FFI_FN(ptr), result, values);
+    return;
+  }
+#endif
+
+  ffi_call(&cif, FFI_FN(ptr), result, values);
+}
+
 void FFIFunctionInfo::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("sb_backing", sb_backing);
 }
@@ -146,14 +157,12 @@ Maybe<DynamicLibrary::PreparedFunction> DynamicLibrary::PrepareFunction(
 
     should_cache_symbol = symbols_.find(name) == symbols_.end();
 
-    fn = std::make_shared<FFIFunction>(
-        FFIFunction{.closed = false,
-                    .ptr = ptr,
-                    .cif = {},
-                    .args = args,
-                    .return_type = return_type,
-                    .arg_type_names = std::move(arg_type_names),
-                    .return_type_name = std::move(return_type_name)});
+    fn = std::make_shared<FFIFunction>();
+    fn->ptr = ptr;
+    fn->args = std::move(args);
+    fn->return_type = return_type;
+    fn->arg_type_names = std::move(arg_type_names);
+    fn->return_type_name = std::move(return_type_name);
 
     ffi_status status = ffi_prep_cif(&fn->cif,
                                      FFI_DEFAULT_ABI,
@@ -178,6 +187,14 @@ Maybe<DynamicLibrary::PreparedFunction> DynamicLibrary::PrepareFunction(
       return {};
     }
 
+#if defined(NODE_FFI_HAS_FAST_CALL_PLAN)
+    // Allocation failure is non-fatal. Invoke() falls back to ffi_call().
+    ffi_call_plan* call_plan = ffi_call_plan_alloc(&fn->cif);
+    if (call_plan != nullptr) {
+      fn->call_plan.reset(call_plan);
+    }
+#endif
+
     should_cache_function = true;
   } else {
     fn = existing->second;
@@ -552,7 +569,7 @@ void DynamicLibrary::InvokeFunction(const FunctionCallbackInfo<Value>& args) {
     result = Malloc(GetFFIReturnValueStorageSize(fn->return_type));
   }
 
-  ffi_call(&fn->cif, FFI_FN(fn->ptr), result, ffi_args.data());
+  fn->Invoke(result, ffi_args.data());
 
   // Return result back to Javascript
   ToJSReturnValue(env, args, fn->return_type, result);
@@ -611,7 +628,7 @@ void DynamicLibrary::InvokeFunctionSB(const FunctionCallbackInfo<Value>& args) {
   alignas(8) uint8_t result_storage[kSBResultStorageSize] = {0};
   void* result = (fn->return_type != &ffi_type_void) ? result_storage : nullptr;
 
-  ffi_call(&fn->cif, FFI_FN(fn->ptr), result, ffi_args.data());
+  fn->Invoke(result, ffi_args.data());
 
   if (result != nullptr) {
     WriteFFIReturnToBuffer(fn->return_type, result, buffer, 0);
diff --git a/src/node_ffi.h b/src/node_ffi.h
index a55cb74fc619..07bd0163db75 100644
--- a/src/node_ffi.h
+++ b/src/node_ffi.h
@@ -14,20 +14,41 @@
 #include <unordered_map>
 #include <vector>
 
+// libffi only accelerates reusable call plans on x86-64 System V. Other
+// targets implement the API by calling ffi_call(), which adds no benefit.
+#if defined(FFI_VERSION_NUMBER) && FFI_VERSION_NUMBER >= 30700 &&              \
+    defined(__x86_64__) && !defined(__ILP32__) && !defined(X86_WIN64) &&       \
+    !defined(_WIN32)
+#define NODE_FFI_HAS_FAST_CALL_PLAN 1
+#endif
+
 namespace node::ffi {
 
 class DynamicLibrary;
 struct FFIFunction;
 
 struct FFIFunction {
-  bool closed;
+  FFIFunction() = default;
+  FFIFunction(const FFIFunction&) = delete;
+  FFIFunction& operator=(const FFIFunction&) = delete;
+  FFIFunction(FFIFunction&&) = delete;
+  FFIFunction& operator=(FFIFunction&&) = delete;
 
-  void* ptr;
-  ffi_cif cif;
+  bool closed = false;
+
+  void* ptr = nullptr;
+  ffi_cif cif = {};
   std::vector<ffi_type*> args;
-  ffi_type* return_type;
+  ffi_type* return_type = nullptr;
   std::vector<std::string> arg_type_names;
   std::string return_type_name;
+#if defined(NODE_FFI_HAS_FAST_CALL_PLAN)
+  // The plan borrows cif, so it must remain uniquely owned by this instance.
+  std::unique_ptr<ffi_call_plan, decltype(&ffi_call_plan_free)> call_plan{
+      nullptr, ffi_call_plan_free};
+#endif
+
+  void Invoke(void* result, void** values);
 };
 
 class FFIFunctionInfo final : public BaseObject {

From 74a3e91bb72185a8c643017a940a92444dfadef4 Mon Sep 17 00:00:00 2001
From: Paul Bouchon <mail@bitpshr.net>
Date: Tue, 4 Aug 2026 11:03:13 -0400
Subject: [PATCH 007/344] test: prefer in-memory databases in sqlite tests

Several SQLite tests created temporary file databases through a
`nextDb()` helper even though they only exercise SQL behavior and never
rely on filesystem persistence. Switch those to `:memory:`, which is
faster and drops the temporary-file bookkeeping. Tests that depend on an
on-disk or shared database keep using files: the constructor, open() and
backup() cases, the timeout and cross-worker suites, and the WAL
journal-mode PRAGMA.

Refs: https://github.com/nodejs/node/issues/64665
Signed-off-by: Paul Bouchon <mail@bitpshr.net>
PR-URL: https://github.com/nodejs/node/pull/64701
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 test/parallel/test-sqlite-data-types.js       | 19 ++--
 test/parallel/test-sqlite-named-parameters.js | 17 +---
 test/parallel/test-sqlite-statement-sync.js   | 87 +++++++++----------
 test/parallel/test-sqlite-transactions.js     | 13 +--
 .../test-sqlite-typed-array-and-data-view.js  | 11 +--
 test/parallel/test-sqlite.js                  |  5 +-
 6 files changed, 54 insertions(+), 98 deletions(-)

diff --git a/test/parallel/test-sqlite-data-types.js b/test/parallel/test-sqlite-data-types.js
index 26af15a777d2..5e51f17733c5 100644
--- a/test/parallel/test-sqlite-data-types.js
+++ b/test/parallel/test-sqlite-data-types.js
@@ -1,22 +1,13 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('data binding and mapping', () => {
   test('supported data types', (t) => {
     const u8a = new TextEncoder().encode('a☃b☃c');
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE types(
@@ -83,7 +74,7 @@ suite('data binding and mapping', () => {
   });
 
   test('large strings are bound correctly', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, text TEXT) STRICT;'
@@ -118,7 +109,7 @@ suite('data binding and mapping', () => {
   });
 
   test('unsupported data types', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -153,7 +144,7 @@ suite('data binding and mapping', () => {
 
   test('throws when binding a BigInt that is too large', (t) => {
     const max = 9223372036854775807n; // Largest 64-bit signed integer value.
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -173,7 +164,7 @@ suite('data binding and mapping', () => {
   });
 
   test('statements are unbound on each call', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
diff --git a/test/parallel/test-sqlite-named-parameters.js b/test/parallel/test-sqlite-named-parameters.js
index db8f46e6b6ce..2fd6fb0da1c3 100644
--- a/test/parallel/test-sqlite-named-parameters.js
+++ b/test/parallel/test-sqlite-named-parameters.js
@@ -1,21 +1,12 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('named parameters', () => {
   test('throws on unknown named parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -32,7 +23,7 @@ suite('named parameters', () => {
   });
 
   test('bare named parameters are supported', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -47,7 +38,7 @@ suite('named parameters', () => {
   });
 
   test('duplicate bare named parameters are supported', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -62,7 +53,7 @@ suite('named parameters', () => {
   });
 
   test('bare named parameters throw on ambiguous names', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index b3a1dc434537..c353c8035c5f 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -2,17 +2,8 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync, StatementSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('StatementSync() constructor', () => {
   test('StatementSync cannot be constructed directly', (t) => {
@@ -27,7 +18,7 @@ suite('StatementSync() constructor', () => {
 
 suite('StatementSync.prototype.get()', () => {
   test('executes a query and returns undefined on no results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.strictEqual(stmt.get(), undefined);
@@ -36,7 +27,7 @@ suite('StatementSync.prototype.get()', () => {
   });
 
   test('executes a query and returns the first result', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.strictEqual(stmt.get(), undefined);
@@ -48,7 +39,7 @@ suite('StatementSync.prototype.get()', () => {
   });
 
   test('executes a query that returns special columns', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const stmt = db.prepare('SELECT 1 as __proto__, 2 as constructor, 3 as toString');
     t.assert.deepStrictEqual(stmt.get(), { __proto__: null, ['__proto__']: 1, constructor: 2, toString: 3 });
@@ -80,14 +71,14 @@ suite('StatementSync.prototype.get()', () => {
 
 suite('StatementSync.prototype.all()', () => {
   test('executes a query and returns an empty array on no results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.all(), []);
   });
 
   test('executes a query and returns all results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.run(), { changes: 0, lastInsertRowid: 0 });
@@ -133,7 +124,7 @@ suite('StatementSync.prototype.all()', () => {
 
 suite('StatementSync.prototype.iterate()', () => {
   test('executes a query and returns an empty iterator on no results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     const iter = stmt.iterate();
@@ -143,7 +134,7 @@ suite('StatementSync.prototype.iterate()', () => {
   });
 
   test('executes a query and returns all results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.run(), { changes: 0, lastInsertRowid: 0 });
@@ -299,7 +290,7 @@ suite('StatementSync.prototype.iterate()', () => {
 
 suite('StatementSync.prototype.run()', () => {
   test('executes a query and returns change metadata', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE storage(key TEXT, val TEXT);
@@ -311,7 +302,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite throws when trying to bind too many parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -329,7 +320,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite defaults to NULL for unbound parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
@@ -366,7 +357,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite defaults unbound ?NNN parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
@@ -385,7 +376,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('binds ?NNN params by position', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
@@ -398,7 +389,7 @@ suite('StatementSync.prototype.run()', () => {
 
 suite('StatementSync.prototype.sourceSQL', () => {
   test('equals input SQL', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -412,7 +403,7 @@ suite('StatementSync.prototype.sourceSQL', () => {
 
 suite('StatementSync.prototype.expandedSQL', () => {
   test('equals expanded SQL', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -431,7 +422,7 @@ suite('StatementSync.prototype.expandedSQL', () => {
 
 suite('StatementSync.prototype.setReadBigInts()', () => {
   test('BigInts support can be toggled', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -464,7 +455,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -480,7 +471,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
   });
 
   test('BigInt is required for reading large integers', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const bad = db.prepare(`SELECT ${Number.MAX_SAFE_INTEGER} + 1`);
     t.assert.throws(() => {
@@ -500,7 +491,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
 
 suite('StatementSync.prototype.setReturnArrays()', () => {
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -518,7 +509,7 @@ suite('StatementSync.prototype.setReturnArrays()', () => {
 
 suite('StatementSync.prototype.get() with array output', () => {
   test('returns array row when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -538,7 +529,7 @@ suite('StatementSync.prototype.get() with array output', () => {
 
   test('returns array rows with BigInts when both flags are set', (t) => {
     const expected = [1n, 9007199254740992n];
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE big_data(id INTEGER, big_num INTEGER);
@@ -557,7 +548,7 @@ suite('StatementSync.prototype.get() with array output', () => {
 
 suite('StatementSync.prototype.all() with array output', () => {
   test('returns array rows when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -598,7 +589,7 @@ suite('StatementSync.prototype.all() with array output', () => {
       9,
       'text3',
     ];
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE wide_table(
@@ -623,7 +614,7 @@ suite('StatementSync.prototype.all() with array output', () => {
 
 suite('StatementSync.prototype.iterate() with array output', () => {
   test('iterates array rows when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -692,7 +683,7 @@ suite('StatementSync.prototype.iterate() with array output', () => {
 
 suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
   test('bare named parameter support can be toggled', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -718,7 +709,7 @@ suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -736,7 +727,7 @@ suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
 
 suite('options.readBigInts', () => {
   test('BigInts are returned when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -749,7 +740,7 @@ suite('options.readBigInts', () => {
   });
 
   test('numbers are returned when input is false', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -762,7 +753,7 @@ suite('options.readBigInts', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -777,7 +768,7 @@ suite('options.readBigInts', () => {
   });
 
   test('setReadBigInts can override prepare option', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -794,7 +785,7 @@ suite('options.readBigInts', () => {
 
 suite('options.returnArrays', () => {
   test('arrays are returned when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -810,7 +801,7 @@ suite('options.returnArrays', () => {
   });
 
   test('objects are returned when input is false', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -826,7 +817,7 @@ suite('options.returnArrays', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;'
@@ -841,7 +832,7 @@ suite('options.returnArrays', () => {
   });
 
   test('setReturnArrays can override prepare option', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -859,7 +850,7 @@ suite('options.returnArrays', () => {
   });
 
   test('all() returns arrays when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -879,7 +870,7 @@ suite('options.returnArrays', () => {
   });
 
   test('iterate() returns arrays when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -901,7 +892,7 @@ suite('options.returnArrays', () => {
 
 suite('options.allowBareNamedParameters', () => {
   test('bare named parameters are allowed when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -918,7 +909,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('bare named parameters throw when input is false', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -937,7 +928,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -955,7 +946,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('setAllowBareNamedParameters can override prepare option', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
diff --git a/test/parallel/test-sqlite-transactions.js b/test/parallel/test-sqlite-transactions.js
index 50b47829aca0..963e7126a101 100644
--- a/test/parallel/test-sqlite-transactions.js
+++ b/test/parallel/test-sqlite-transactions.js
@@ -1,21 +1,12 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('manual transactions', () => {
   test('a transaction is committed', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(
@@ -42,7 +33,7 @@ suite('manual transactions', () => {
   });
 
   test('a transaction is rolled back', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(
diff --git a/test/parallel/test-sqlite-typed-array-and-data-view.js b/test/parallel/test-sqlite-typed-array-and-data-view.js
index 71d7b181a3d7..2d5269be09b7 100644
--- a/test/parallel/test-sqlite-typed-array-and-data-view.js
+++ b/test/parallel/test-sqlite-typed-array-and-data-view.js
@@ -1,17 +1,8 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 const arrayBuffer = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]).buffer;
 const TypedArrays = [
@@ -32,7 +23,7 @@ const TypedArrays = [
 suite('StatementSync with TypedArray/DataView', () => {
   for (const [displayName, TypedArray] of TypedArrays) {
     test(displayName, (t) => {
-      const db = new DatabaseSync(nextDb());
+      const db = new DatabaseSync(':memory:');
       t.after(() => { db.close(); });
       db.exec('CREATE TABLE test (data BLOB)');
       // insert
diff --git a/test/parallel/test-sqlite.js b/test/parallel/test-sqlite.js
index ebbcd27d1345..b7b65f1258f0 100644
--- a/test/parallel/test-sqlite.js
+++ b/test/parallel/test-sqlite.js
@@ -36,7 +36,7 @@ suite('accessing the node:sqlite module', () => {
 });
 
 test('ERR_SQLITE_ERROR is thrown for errors originating from SQLite', (t) => {
-  const db = new DatabaseSync(nextDb());
+  const db = new DatabaseSync(':memory:');
   t.after(() => { db.close(); });
   const setup = db.exec(`
     CREATE TABLE test(
@@ -86,6 +86,7 @@ test('sqlite constants are defined', (t) => {
 });
 
 test('PRAGMAs are supported', (t) => {
+  // WAL journal mode requires an on-disk database.
   const db = new DatabaseSync(nextDb());
   t.after(() => { db.close(); });
   t.assert.deepStrictEqual(
@@ -218,7 +219,7 @@ suite('SQL APIs enabled at build time', () => {
   });
 
   test('dbstat is enabled', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     db.exec(`
       CREATE TABLE t1 (key INTEGER PRIMARY KEY);

From 312f0c6a7e421a40e6168e7451d078d686c0d274 Mon Sep 17 00:00:00 2001
From: Ryuhei Shima <65934663+islandryu@users.noreply.github.com>
Date: Wed, 5 Aug 2026 00:03:32 +0900
Subject: [PATCH 008/344] build: add host toolset to perfetto_sdk

Signed-off-by: islandryu <shimaryuhei@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64751
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 deps/perfetto/perfetto.gyp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/deps/perfetto/perfetto.gyp b/deps/perfetto/perfetto.gyp
index 3836f3424cbd..083d0b386dd2 100644
--- a/deps/perfetto/perfetto.gyp
+++ b/deps/perfetto/perfetto.gyp
@@ -9,6 +9,7 @@
     {
       'target_name': 'perfetto_sdk',
       'type': 'static_library',
+      'toolsets': ['host', 'target'],
       'include_dirs': [ 'sdk' ],
       'direct_dependent_settings': {
         # Use like `#include "perfetto.h"`

From b98294b57d28e3c205bbd41ff4592e39a8ae6e44 Mon Sep 17 00:00:00 2001
From: Junsoo Ha <35479251+ganjanggejang@users.noreply.github.com>
Date: Wed, 5 Aug 2026 00:58:10 +0900
Subject: [PATCH 009/344] ffi: support SharedArrayBuffer in getRawPointer

Signed-off-by: Junsoo Ha <junsoo2018@naver.com>
PR-URL: https://github.com/nodejs/node/pull/64864
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/ffi.md              |  2 +-
 src/ffi/data.cc             | 10 ++++++----
 test/ffi/test-ffi-memory.js |  7 +++++++
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/doc/api/ffi.md b/doc/api/ffi.md
index 9df2a9789d98..09b78d64fc68 100644
--- a/doc/api/ffi.md
+++ b/doc/api/ffi.md
@@ -714,7 +714,7 @@ available storage. This function does not allocate memory on its own.
 added: v26.1.0
 -->
 
-* `source` {Buffer|ArrayBuffer|ArrayBufferView}
+* `source` {Buffer|ArrayBuffer|SharedArrayBuffer|ArrayBufferView}
 * Returns: {bigint}
 
 Returns the raw memory address of JavaScript-managed byte storage.
diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 726edc5cd2dc..73b575395c8c 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -739,7 +739,8 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() < 1) {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
@@ -758,9 +759,10 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
     store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
     offset = args[0].As<ArrayBufferView>()->ByteOffset();
   } else {
-    THROW_ERR_INVALID_ARG_TYPE(env,
-                               "The first argument must be a Buffer, "
-                               "ArrayBuffer, or ArrayBufferView");
+    THROW_ERR_INVALID_ARG_TYPE(
+        env,
+        "The first argument must be a Buffer, "
+        "ArrayBuffer, SharedArrayBuffer, or ArrayBufferView");
     return;
   }
 
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index adc5a8539491..f17f56c410f8 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -125,18 +125,25 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
   const buffer = Buffer.from([1, 2, 3]);
   const arrayBuffer = new Uint8Array([4, 5, 6, 7]).buffer;
   const view = new Uint8Array(arrayBuffer, 2);
+  const sharedArrayBuffer = new SharedArrayBuffer(4);
+  const sharedView = new Uint8Array(sharedArrayBuffer, 2);
 
   const bufferPointer = ffi.getRawPointer(buffer);
   const arrayBufferPointer = ffi.getRawPointer(arrayBuffer);
   const viewPointer = ffi.getRawPointer(view);
+  const sharedArrayBufferPointer = ffi.getRawPointer(sharedArrayBuffer);
+  const sharedViewPointer = ffi.getRawPointer(sharedView);
 
   assert.strictEqual(typeof bufferPointer, 'bigint');
   assert.strictEqual(typeof arrayBufferPointer, 'bigint');
   assert.strictEqual(typeof viewPointer, 'bigint');
+  assert.strictEqual(typeof sharedArrayBufferPointer, 'bigint');
+  assert.strictEqual(typeof sharedViewPointer, 'bigint');
 
   assert.strictEqual(bufferPointer, symbols.pointer_to_usize(buffer));
   assert.strictEqual(arrayBufferPointer, symbols.pointer_to_usize(arrayBuffer));
   assert.strictEqual(viewPointer, arrayBufferPointer + 2n);
+  assert.strictEqual(sharedViewPointer, sharedArrayBufferPointer + 2n);
 });
 
 test('ffi exportString and exportBuffer copy data into native memory', () => {

From be313012e4918b395c2435a8370750744cf55bb2 Mon Sep 17 00:00:00 2001
From: agape1225 <49804691+agape1225@users.noreply.github.com>
Date: Wed, 5 Aug 2026 00:58:27 +0900
Subject: [PATCH 010/344] doc: use ffi.suffix in permission example

The `--allow-ffi` example in cli.md hard-coded the Linux-only `.so`
extension. node:ffi already exposes `suffix` for exactly this case,
and doc/api/ffi.md's own examples use it. Do the same here.

Assisted-by: Claude Sonnet 5
Signed-off-by: agape1225 <49804691+agape1225@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64914
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/cli.md | 4 ++--
 doc/node.1     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 58b9ab0b36b7..1a497808d935 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -208,8 +208,8 @@ starting Node.js. The [`node:ffi`][] module also requires the
 Example:
 
 ```js
-const { DynamicLibrary } = require('node:ffi');
-const lib = new DynamicLibrary('mylib.so');
+const { DynamicLibrary, suffix } = require('node:ffi');
+const lib = new DynamicLibrary(`./mylib.${suffix}`);
 ```
 
 ```console
diff --git a/doc/node.1 b/doc/node.1
index e1fb3fe74586..b7e4d0a429a2 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -126,8 +126,8 @@ starting Node.js. The \fBnode:ffi\fR module also requires the
 \fB--experimental-ffi\fR flag and is only available in builds with FFI support.
 Example:
 .Bd -literal
-const { DynamicLibrary } = require('node:ffi');
-const lib = new DynamicLibrary('mylib.so');
+const { DynamicLibrary, suffix } = require('node:ffi');
+const lib = new DynamicLibrary(`./mylib.${suffix}`);
 .Ed
 .Bd -literal
 $ node --permission --experimental-ffi index.js

From 4c8d8afa999549df59b25e59374110cd51ee72b7 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 4 Aug 2026 17:58:42 +0200
Subject: [PATCH 011/344] tools: remove `true` from branch name for auto-update
 automation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64961
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 .github/workflows/tools.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index 0008b0478f55..4e44737c116b 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -336,7 +336,7 @@ jobs:
         # no-op if the base branch is already up-to-date.
         with:
           token: ${{ secrets.GH_USER_TOKEN }}
-          branch: actions/${{ github.ref_name == 'main' || format('{0}/', github.ref_name) }}tools-update-${{ matrix.id }}  # Custom branch *just* for this Action.
+          branch: actions/${{ github.ref_name != 'main' && format('{0}/', github.ref_name) || '' }}tools-update-${{ matrix.id }}  # Custom branch *just* for this Action.
           delete-branch: true
           commit-message: ${{ env.COMMIT_MSG }}
           labels: ${{ matrix.label }}

From f0140d7ebd2e98b3bb7b8b63c90ddb024d4254bf Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 4 Aug 2026 18:34:32 +0200
Subject: [PATCH 012/344] tools: store "default" OpenSSL version in
 `openssl-matrix.nix`

To help with automating keeping in sync with the bundled version.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64962
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 tools/dep_updaters/update-nixpkgs-pin.sh | 25 ++++++++++++++++++++++--
 tools/nix/openssl-matrix.nix             |  5 ++++-
 tools/nix/pkcs11.nix                     |  2 +-
 tools/nix/sharedLibDeps.nix              |  2 +-
 4 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh
index eb5fde1526ab..3463d9fc2137 100755
--- a/tools/dep_updaters/update-nixpkgs-pin.sh
+++ b/tools/dep_updaters/update-nixpkgs-pin.sh
@@ -26,6 +26,14 @@ TMP_FILE=$(mktemp)
 sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
 mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
 
+# === Update openssl-matrix.nix ===
+# When bumping the pin, we want to update the openssl-matrix.nix file to keep the list in sync nixpkgs
+# i.e. add newly added release lines, remove newly dropped release lines), and make sure the "openssl"
+# attribute still refers to the same release line as the bundled version in deps/openssl/.
+
+OPENSSL_MAJOR=$(awk -F= '/^MAJOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat")
+OPENSSL_MINOR=$(awk -F= '/^MINOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat")
+
 nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
   let
     pkgs = import <nixpkgs> {};
@@ -33,15 +41,24 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
       (n: builtins.match \"openssl_[0-9]+(_[0-9]+)?\" n != null)
       (builtins.attrNames pkgs);
     extraMatrixAttrs = [ \"boringssl\" ];
+    default = builtins.head (builtins.filter (n:
+      let
+        inherit (pkgs.lib) versions;
+        t = builtins.tryEval pkgs.\${n};
+        v = if t.success then builtins.tryEval t.value.version else t;
+        majorVersion = pkgs.lib.optionalString v.success (versions.major v.value);
+        minorVersion = pkgs.lib.optionalString v.success (versions.minor v.value);
+      in
+        majorVersion == ''$OPENSSL_MAJOR'' && minorVersion == ''$OPENSSL_MINOR'') opensslAttrs);
     attrs = builtins.filter
       (n:
         let t = builtins.tryEval pkgs.\${n}; in
-        t.success && (builtins.tryEval t.value.version).success
+        n != default && t.success && (builtins.tryEval t.value.version).success
       )
       (opensslAttrs ++ extraMatrixAttrs);
   in
   {
-    inherit attrs;
+    inherit attrs default;
     permittedInsecurePackages = builtins.map (attr: pkgs.\${attr}.name) (
       builtins.filter (attr: (pkgs.\${attr}.meta.insecure)) attrs
     );
@@ -53,6 +70,10 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
 }:
 
 {
+  # "default" OpenSSL release line, should be kept in sync with the bundled version:
+  openssl = pkgs.\(.default);
+
+  # Other OpenSSL variants we want to test for:
   inherit (pkgs)
     \(.attrs | sort | join("\n    "))
     ;
diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index 36978c5d4efc..8c62cae81196 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -5,11 +5,14 @@
 }:
 
 {
+  # "default" OpenSSL release line, should be kept in sync with the bundled version:
+  openssl = pkgs.openssl_3_5;
+
+  # Other OpenSSL variants we want to test for:
   inherit (pkgs)
     boringssl
     openssl_1_1
     openssl_3
-    openssl_3_5
     openssl_3_6
     openssl_4_0
     ;
diff --git a/tools/nix/pkcs11.nix b/tools/nix/pkcs11.nix
index eb6165b7bd99..748d3d4de0ed 100644
--- a/tools/nix/pkcs11.nix
+++ b/tools/nix/pkcs11.nix
@@ -10,7 +10,7 @@
   # pkcs11-provider is dlopen'd into the libcrypto Node.js itself links, so it
   # has to be built against that very OpenSSL. SoftHSM links OpenSSL too;
   # building it against the same one keeps a single libcrypto in the process.
-  openssl ? (import ./sharedLibDeps.nix { inherit pkgs; }).openssl,
+  openssl ? (import ./openssl-matrix.nix { inherit pkgs; }).openssl,
 
   pin ? "1234",
 }:
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 11ad545587f8..788e9efedeb8 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -48,7 +48,7 @@
   ffi = pkgs.libffiReal;
 })
 // (pkgs.lib.optionalAttrs withSSL ({
-  openssl = (import ./openssl-matrix.nix { inherit pkgs; }).openssl_3_5;
+  inherit (import ./openssl-matrix.nix { inherit pkgs; }) openssl;
 }))
 // (pkgs.lib.optionalAttrs withTemporal {
   inherit (pkgs) temporal_capi;

From 9c282c4532d5df2750ffe4e30cceb97e6709d0b5 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 4 Aug 2026 10:15:37 -0700
Subject: [PATCH 013/344] ffi: accept pointer BigInts in multi-argument fast
 calls

convertPointerArg ended with an unconditional getRawPointer call for
buffer and arraybuffer types, rejecting BigInt addresses that the
single-argument fast path and ToFFIArgument both accept. Drop the
fallback; hasPointerMemoryArg already converts memory-backed values,
and null, undefined, and strings are handled earlier.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/64964
Fixes: https://github.com/nodejs/node/issues/64963
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/ffi/fast-api.js     |  5 ++---
 test/ffi/test-ffi-fast-buffer.js | 33 ++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/lib/internal/ffi/fast-api.js b/lib/internal/ffi/fast-api.js
index 44e4c3a04e0f..486a119a2e07 100644
--- a/lib/internal/ffi/fast-api.js
+++ b/lib/internal/ffi/fast-api.js
@@ -169,9 +169,8 @@ function convertPointerArg(type, value, stringState, index) {
   if (hasPointerMemoryArg(type, value)) {
     return getRawPointer(value);
   }
-  if (needsRawPointerConversion(type)) {
-    return getRawPointer(value);
-  }
+  // Pointer-like values (e.g. BigInt addresses) are passed through, matching
+  // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
   return value;
 }
 
diff --git a/test/ffi/test-ffi-fast-buffer.js b/test/ffi/test-ffi-fast-buffer.js
index 97d8a3c9b852..e4399ee8ee47 100644
--- a/test/ffi/test-ffi-fast-buffer.js
+++ b/test/ffi/test-ffi-fast-buffer.js
@@ -133,3 +133,36 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
     lib.close();
   }
 });
+
+test('multi-argument buffer signatures accept pointer BigInts', () => {
+  const { lib, functions } = ffi.dlopen(libraryPath, {
+    sum_buffer: { arguments: ['buffer', 'u64'], return: 'u64' },
+    fill_buffer: { arguments: ['arraybuffer', 'u64', 'u32'], return: 'void' },
+  });
+
+  try {
+    const bytes = Buffer.from([1, 2, 3, 4]);
+    const pointer = ffi.getRawPointer(bytes);
+    const length = BigInt(bytes.length);
+
+    // The two-argument wrapper must treat a raw address like the buffer it
+    // came from, matching both the single-argument fast path and the slow
+    // paths in src/ffi/types.cc.
+    assert.strictEqual(functions.sum_buffer(pointer, length), 10n);
+    assert.strictEqual(functions.sum_buffer(bytes, length), 10n);
+    assert.strictEqual(functions.sum_buffer(0n, length), 0n);
+    assert.strictEqual(functions.sum_buffer(null, length), 0n);
+
+    // The three-argument wrapper must forward the address to real memory
+    // instead of rejecting it.
+    functions.fill_buffer(pointer, length, 7);
+    assert.deepStrictEqual(bytes, Buffer.from([7, 7, 7, 7]));
+
+    // Still accepted once the call has been optimized.
+    for (let i = 0; i < 100_000; i++) {
+      assert.strictEqual(functions.sum_buffer(pointer, length), 28n);
+    }
+  } finally {
+    lib.close();
+  }
+});

From e73f74738d192f0c7bf1dd86afd9fa7bd8e65814 Mon Sep 17 00:00:00 2001
From: Jihwan <hanityx@gmail.com>
Date: Wed, 5 Aug 2026 03:32:44 +0900
Subject: [PATCH 014/344] test_runner: fix env option validation

Signed-off-by: hanityx <hanityx@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64865
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
---
 lib/internal/test_runner/runner.js | 2 +-
 test/parallel/test-runner-run.mjs  | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/internal/test_runner/runner.js b/lib/internal/test_runner/runner.js
index 4bfce346a592..a5a53e44d29a 100644
--- a/lib/internal/test_runner/runner.js
+++ b/lib/internal/test_runner/runner.js
@@ -910,7 +910,7 @@ function run(options = kEmptyObject) {
   }
 
   if (env != null) {
-    validateObject(env);
+    validateObject(env, 'options.env');
 
     if (isolation === 'none') {
       throw new ERR_INVALID_ARG_VALUE('options.env', env, 'is not supported with isolation=\'none\'');
diff --git a/test/parallel/test-runner-run.mjs b/test/parallel/test-runner-run.mjs
index b6eb6b6af518..c6b888432cf8 100644
--- a/test/parallel/test-runner-run.mjs
+++ b/test/parallel/test-runner-run.mjs
@@ -673,6 +673,14 @@ describe('require(\'node:test\').run', { concurrency: true }, () => {
         }));
     });
 
+    it('should only allow object in options.env', () => {
+      [Symbol(), [], () => {}, 0, 1, 0n, 1n, '', '1', true, false]
+        .forEach((env) => assert.throws(() => run({ files: [], env }), {
+          code: 'ERR_INVALID_ARG_TYPE',
+          message: /The "options\.env" property must be of type object\./
+        }));
+    });
+
     it('should not allow files and globPatterns used together', () => {
       assert.throws(() => run({ files: ['a.js'], globPatterns: ['*.js'] }), {
         code: 'ERR_INVALID_ARG_VALUE'

From 6deeef1801b55c80b87aaf0199a774529fbdbea7 Mon Sep 17 00:00:00 2001
From: Chengzhong Wu <legendecas@gmail.com>
Date: Tue, 4 Aug 2026 15:10:36 -0400
Subject: [PATCH 015/344] build: enable perfetto updater

Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64966
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
---
 .github/workflows/tools.yml           | 9 +++++++++
 tools/dep_updaters/update-perfetto.sh | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index 4e44737c116b..e80b65315a4a 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -35,6 +35,7 @@ on:
           - nghttp2
           - nghttp3
           - ngtcp2
+          - perfetto
           - postject
           - root-certificates
           - simdjson
@@ -237,6 +238,14 @@ jobs:
               cat temp-output
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
+          - id: perfetto
+            subsystem: deps
+            label: dependencies
+            run: |
+              ./tools/dep_updaters/update-perfetto.sh > temp-output
+              cat temp-output
+              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
+              rm temp-output
           - id: postject
             subsystem: deps,test
             label: test
diff --git a/tools/dep_updaters/update-perfetto.sh b/tools/dep_updaters/update-perfetto.sh
index 516d7d6aa63b..493a8f8c57d1 100755
--- a/tools/dep_updaters/update-perfetto.sh
+++ b/tools/dep_updaters/update-perfetto.sh
@@ -57,7 +57,7 @@ echo "$NEW_VERSION" > perfetto/VERSION
 curl -sL -o "perfetto/LICENSE" "https://raw.githubusercontent.com/google/perfetto/refs/tags/$PERFETTO_REF/LICENSE"
 
 # Remove C API headers. Only keep C++ API headers.
-rm perfetto/sdk/perfetto_c.h perfetto/sdk/perfetto_c.cc
+rm -f perfetto/sdk/perfetto_c.h perfetto/sdk/perfetto_c.cc
 
 echo "Copying existing gyp files"
 cp "$DEPS_DIR/perfetto/perfetto.gyp" "$WORKSPACE/perfetto"

From bc6b630e21c1b174d492d0722bd22b50ad735e9a Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Wed, 5 Aug 2026 10:17:00 +0800
Subject: [PATCH 016/344] buffer: treat detached ArrayBuffers as empty

Treat detached ArrayBuffers and Buffer or TypedArray views backed by
them as zero-length inputs in buffer.isUtf8() and buffer.isAscii(). Both
functions now return true for these inputs, consistent with other empty
inputs.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64504
Fixes: https://github.com/nodejs/node/issues/64503
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/buffer.md                    | 14 ++++++-
 src/node_buffer.cc                   | 56 +++++-----------------------
 test/parallel/test-buffer-isascii.js | 23 ++++++++----
 test/parallel/test-buffer-isutf8.js  | 23 ++++++++----
 4 files changed, 51 insertions(+), 65 deletions(-)

diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 64802f07f76a..212e0899e0b8 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5317,6 +5317,11 @@ npx codemod@latest @nodejs/buffer-atob-btoa
 added:
   - v19.6.0
   - v18.15.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64504
+    description: Detached `ArrayBuffer`s and views backed by them are treated
+                 as empty.
 -->
 
 * `input` {Buffer | ArrayBuffer | TypedArray} The input to validate.
@@ -5325,7 +5330,7 @@ added:
 This function returns `true` if `input` contains only valid ASCII-encoded data,
 including the case in which `input` is empty.
 
-Throws if the `input` is a detached array buffer.
+A detached `ArrayBuffer`, or a `TypedArray` backed by one, is treated as empty.
 
 ### `buffer.isUtf8(input)`
 
@@ -5333,6 +5338,11 @@ Throws if the `input` is a detached array buffer.
 added:
   - v19.4.0
   - v18.14.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64504
+    description: Detached `ArrayBuffer`s and views backed by them are treated
+                 as empty.
 -->
 
 * `input` {Buffer | ArrayBuffer | TypedArray} The input to validate.
@@ -5341,7 +5351,7 @@ added:
 This function returns `true` if `input` contains only valid UTF-8-encoded data,
 including the case in which `input` is empty.
 
-Throws if the `input` is a detached array buffer.
+A detached `ArrayBuffer`, or a `TypedArray` backed by one, is treated as empty.
 
 ### `buffer.INSPECT_MAX_BYTES`
 
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index 19c28609660d..29aeedd68f48 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -1360,31 +1360,17 @@ void FastSwap64(Local<Value> receiver,
 
 static CFunction fast_swap64(CFunction::Make(FastSwap64));
 
-struct ValidationResult {
-  bool is_valid;
-  bool was_detached;
-};
-
-static ValidationResult ValidateUtf8(Local<Value> value) {
+static bool ValidateUtf8(Local<Value> value) {
   ArrayBufferViewContents<char> abv(value);
-  bool was_detached = abv.WasDetached();
-  return {!was_detached && simdutf::validate_utf8(abv.data(), abv.length()),
-          was_detached};
+  return abv.length() == 0 || simdutf::validate_utf8(abv.data(), abv.length());
 }
 
 static void IsUtf8(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
   CHECK(args[0]->IsTypedArray() || args[0]->IsArrayBuffer() ||
         args[0]->IsSharedArrayBuffer());
 
-  const ValidationResult result = ValidateUtf8(args[0]);
-  if (result.was_detached) {
-    return node::THROW_ERR_INVALID_STATE(
-        env, "Cannot validate on a detached buffer");
-  }
-
-  args.GetReturnValue().Set(result.is_valid);
+  args.GetReturnValue().Set(ValidateUtf8(args[0]));
 }
 
 static bool FastIsUtf8(Local<Value> receiver,
@@ -1393,40 +1379,23 @@ static bool FastIsUtf8(Local<Value> receiver,
                        FastApiCallbackOptions& options) {
   TRACK_V8_FAST_API_CALL("buffer.isUtf8");
   HandleScope scope(options.isolate);
-
-  const ValidationResult result = ValidateUtf8(value);
-  if (result.was_detached) {
-    node::THROW_ERR_INVALID_STATE(options.isolate,
-                                  "Cannot validate on a detached buffer");
-    return false;
-  }
-  return result.is_valid;
+  return ValidateUtf8(value);
 }
 
 static CFunction fast_is_utf8(CFunction::Make(FastIsUtf8));
 
-static ValidationResult ValidateAscii(Local<Value> value) {
+static bool ValidateAscii(Local<Value> value) {
   ArrayBufferViewContents<char> abv(value);
-  bool was_detached = abv.WasDetached();
-  return {
-      !was_detached &&
-          !simdutf::validate_ascii_with_errors(abv.data(), abv.length()).error,
-      was_detached};
+  return abv.length() == 0 ||
+         !simdutf::validate_ascii_with_errors(abv.data(), abv.length()).error;
 }
 
 static void IsAscii(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
   CHECK(args[0]->IsTypedArray() || args[0]->IsArrayBuffer() ||
         args[0]->IsSharedArrayBuffer());
 
-  const ValidationResult result = ValidateAscii(args[0]);
-  if (result.was_detached) {
-    return node::THROW_ERR_INVALID_STATE(
-        env, "Cannot validate on a detached buffer");
-  }
-
-  args.GetReturnValue().Set(result.is_valid);
+  args.GetReturnValue().Set(ValidateAscii(args[0]));
 }
 
 static bool FastIsAscii(Local<Value> receiver,
@@ -1435,14 +1404,7 @@ static bool FastIsAscii(Local<Value> receiver,
                         FastApiCallbackOptions& options) {
   TRACK_V8_FAST_API_CALL("buffer.isAscii");
   HandleScope scope(options.isolate);
-
-  const ValidationResult result = ValidateAscii(value);
-  if (result.was_detached) {
-    node::THROW_ERR_INVALID_STATE(options.isolate,
-                                  "Cannot validate on a detached buffer");
-    return false;
-  }
-  return result.is_valid;
+  return ValidateAscii(value);
 }
 
 static CFunction fast_is_ascii(CFunction::Make(FastIsAscii));
diff --git a/test/parallel/test-buffer-isascii.js b/test/parallel/test-buffer-isascii.js
index b9468ca13359..48cc96a17d61 100644
--- a/test/parallel/test-buffer-isascii.js
+++ b/test/parallel/test-buffer-isascii.js
@@ -30,13 +30,20 @@ assert.strictEqual(isAscii(Buffer.from([])), true);
 });
 
 {
-  // Test with detached array buffers
-  const arrayBuffer = new ArrayBuffer(1024);
+  // Detached array buffers and views are treated as empty.
+  const arrayBuffer = new ArrayBuffer(1);
+  const typedArray = new Uint8Array(arrayBuffer);
+  typedArray[0] = 0xff;
+  const inputs = [
+    arrayBuffer,
+    typedArray,
+    Buffer.from(arrayBuffer),
+  ];
+  for (const input of inputs) {
+    assert.strictEqual(isAscii(input), false);
+  }
   structuredClone(arrayBuffer, { transfer: [arrayBuffer] });
-  assert.throws(
-    () => { isAscii(arrayBuffer); },
-    {
-      code: 'ERR_INVALID_STATE'
-    }
-  );
+  for (const input of inputs) {
+    assert.strictEqual(isAscii(input), true);
+  }
 }
diff --git a/test/parallel/test-buffer-isutf8.js b/test/parallel/test-buffer-isutf8.js
index 204db3e6a5fe..151fc0baf4ae 100644
--- a/test/parallel/test-buffer-isutf8.js
+++ b/test/parallel/test-buffer-isutf8.js
@@ -74,13 +74,20 @@ assert.strictEqual(isUtf8(Buffer.from([])), true);
 });
 
 {
-  // Test with detached array buffers
-  const arrayBuffer = new ArrayBuffer(1024);
+  // Detached array buffers and views are treated as empty.
+  const arrayBuffer = new ArrayBuffer(1);
+  const typedArray = new Uint8Array(arrayBuffer);
+  typedArray[0] = 0xff;
+  const inputs = [
+    arrayBuffer,
+    typedArray,
+    Buffer.from(arrayBuffer),
+  ];
+  for (const input of inputs) {
+    assert.strictEqual(isUtf8(input), false);
+  }
   structuredClone(arrayBuffer, { transfer: [arrayBuffer] });
-  assert.throws(
-    () => { isUtf8(arrayBuffer); },
-    {
-      code: 'ERR_INVALID_STATE'
-    }
-  );
+  for (const input of inputs) {
+    assert.strictEqual(isUtf8(input), true);
+  }
 }

From b6fa9c1819b2f6968420be63b1c395d654ce9e46 Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Wed, 5 Aug 2026 10:17:26 +0800
Subject: [PATCH 017/344] tools: sync mk-ca-bundle.pl with curl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.

Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64753
Fixes: https://github.com/nodejs/node/issues/64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 src/node_root_certs.h |  33 +++
 tools/mk-ca-bundle.pl | 529 ++++++++++++++++++++++++++----------------
 2 files changed, 358 insertions(+), 204 deletions(-)

diff --git a/src/node_root_certs.h b/src/node_root_certs.h
index 48d2fc5cb7d1..517dc8814c6d 100644
--- a/src/node_root_certs.h
+++ b/src/node_root_certs.h
@@ -118,6 +118,39 @@
 "WD9f\n"
 "-----END CERTIFICATE-----",
 
+/* Izenpe.com */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIF8TCCA9mgAwIBAgIQALC3WhZIX7/hy/WL1xnmfTANBgkqhkiG9w0BAQsFADA4MQswCQYD\n"
+"VQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6ZW5wZS5jb20wHhcN\n"
+"MDcxMjEzMTMwODI4WhcNMzcxMjEzMDgyNzI1WjA4MQswCQYDVQQGEwJFUzEUMBIGA1UECgwL\n"
+"SVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6ZW5wZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4IC\n"
+"DwAwggIKAoICAQDJ03rKDx6sp4boFmVqscIbRTJxldn+EFvMr+eleQGPicPK8lVx93e+d5Tz\n"
+"cqQsRNiekpsUOqHnJJAKClaOxdgmlOHZSOEtPtoKct2jmRXagaKH9HtuJneJWK3W6wyyQXpz\n"
+"bm3benhB6QiIEn6HLmYRY2xU+zydcsC8Lv/Ct90NduM61/e0aL6i9eOBbsFGb12N4E3GVFWJ\n"
+"GjMxCrFXuaOKmMPsOzTFlUFpfnXCPCDFYbpRR6AgkJOhkEvzTnyFRVSa0QUmQbC1TR0zvsQD\n"
+"yCV8wXDbO/QJLVQnSKwv4cSsPsjLkkxTOTcj7NMB+eAJRE1NZMDhDVqHIrytG6P+JrUV86f8\n"
+"hBnp7KGItERphIPzidF0BqnMC9bC3ieFUCbKF7jJeodWLBoBHmy+E60QrLUk9TiRodZL2vG7\n"
+"0t5HtfG8gfZZa88ZU+mNFctKy6lvROUbQc/hhqfK0GqfvEyNBjNaooXlkDWgYlwWTvDjovoD\n"
+"GrQscbNYLN57C9saD+veIR8GdwYDsMnvmfzAuU8Lhij+0rnq49qlw0dpEuDb8PYZi+17cNcC\n"
+"1u2HGCgsBCRMd+RIihrGO5rUD8r6ddIBQFqNeb+Lz0vPqhbBleStTIo+F5HUsWLlguWABKQD\n"
+"fo2/2n+iD5dPDNMN+9fR5XJ+HMh3/1uaD7euBUbl8agW7EekFwIDAQABo4H2MIHzMIGwBgNV\n"
+"HREEgagwgaWBD2luZm9AaXplbnBlLmNvbaSBkTCBjjFHMEUGA1UECgw+SVpFTlBFIFMuQS4g\n"
+"LSBDSUYgQTAxMzM3MjYwLVJNZXJjLlZpdG9yaWEtR2FzdGVpeiBUMTA1NSBGNjIgUzgxQzBB\n"
+"BgNVBAkMOkF2ZGEgZGVsIE1lZGl0ZXJyYW5lbyBFdG9yYmlkZWEgMTQgLSAwMTAxMCBWaXRv\n"
+"cmlhLUdhc3RlaXowDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE\n"
+"FB0cZQ6o8iV7tJHP5LGx5r1VdGwFMA0GCSqGSIb3DQEBCwUAA4ICAQB4pgwWSp9MiDrAyw6l\n"
+"Fn2fuUhfGI8NYjb2zRlrrKvV9pF9rnHzP7MOeIWblaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9\n"
+"fbgakEyrkgPH7UIBzg/YsfqikuFgba56awmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJO\n"
+"ubv5vr8qhT/AQKM6WfxZSzwoJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m\n"
+"5hzkQiCeR7Csg1lwLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Py\n"
+"e6kfLqCTVyvehQP5aTfLnnhqBbTFMXiJ7HqnheG5ezzevh55hM6fcA5ZwjUukCox2eRFekGk\n"
+"LhObNA5me0mrZJfQRsN5nXJQY6aYWwa9SG3YOYNw6DXwBdGqvOPbyALqfP2C2sJbUjWumDqt\n"
+"ujWTI6cfSN01RpiyEGjkpTHCClguGYEQyVB1/OpaFs4R1+7vUIgtYf8/QnMFlEPVjjxOAToZ\n"
+"pR9GTnfQXeWBIiGH/pR9hNiTrdZoQ0iy2+tzJOeRf1SktoA+naM8THLCV8Sg1Mw4J87VBp6i\n"
+"SNnpn86CcDaTmjvfliHjWbcM2pE38P1ZWrOZyGlsQyYBNWNgVYkDOnXYukrZVP/u3oDYLdE4\n"
+"1V4tC5h9Pmzb/CaIxw==\n"
+"-----END CERTIFICATE-----",
+
 /* Go Daddy Root Certificate Authority - G2 */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIDxTCCAq2gAwIBAgIBADANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMxEDAOBgNV\n"
diff --git a/tools/mk-ca-bundle.pl b/tools/mk-ca-bundle.pl
index 4057c808bc60..6763ac52bf20 100755
--- a/tools/mk-ca-bundle.pl
+++ b/tools/mk-ca-bundle.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl -w
+#!/usr/bin/env perl
 # ***************************************************************************
 # *                                  _   _ ____  _
 # *  Project                     ___| | | |  _ \| |
@@ -6,11 +6,11 @@
 # *                            | (__| |_| |  _ <| |___
 # *                             \___|\___/|_| \_\_____|
 # *
-# * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
+# * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 # *
 # * This software is licensed as described in the file COPYING, which
 # * you should have received as part of this distribution. The terms
-# * are also available at http://curl.haxx.se/docs/copyright.html.
+# * are also available at https://curl.se/docs/copyright.html.
 # *
 # * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 # * copies of the Software, and permit persons to whom the Software is
@@ -19,6 +19,8 @@
 # * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 # * KIND, either express or implied.
 # *
+# * SPDX-License-Identifier: curl
+# *
 # ***************************************************************************
 # This Perl script creates a fresh ca-bundle.crt file for use with libcurl.
 # It downloads certdata.txt from Mozilla's source tree (see URL below),
@@ -34,156 +36,165 @@
 use Getopt::Std;
 use MIME::Base64;
 use strict;
-use vars qw($opt_h $opt_i $opt_l $opt_p $opt_q $opt_s $opt_t $opt_v $opt_w);
+use warnings;
+use vars qw($opt_h $opt_i $opt_l $opt_m $opt_p $opt_q $opt_s $opt_t $opt_v $opt_w);
 use List::Util;
 use Text::Wrap;
 
 # If the OpenSSL commandline is not in search path you can configure it here!
 my $openssl = 'openssl';
 
-my $version = '1.25';
+my $version = '1.33';
 
 $opt_w = 72; # default base64 encoded lines length
 
-# default cert types to include in the output (default is to include CAs which may issue SSL server certs)
+# default cert types to include in the output (default is to include CAs which
+# may issue SSL server certs)
 my $default_mozilla_trust_purposes = "SERVER_AUTH";
 my $default_mozilla_trust_levels = "TRUSTED_DELEGATOR";
 $opt_p = $default_mozilla_trust_purposes . ":" . $default_mozilla_trust_levels;
 
 my @valid_mozilla_trust_purposes = (
-  "DIGITAL_SIGNATURE",
-  "NON_REPUDIATION",
-  "KEY_ENCIPHERMENT",
-  "DATA_ENCIPHERMENT",
-  "KEY_AGREEMENT",
-  "KEY_CERT_SIGN",
-  "CRL_SIGN",
-  "SERVER_AUTH",
-  "CLIENT_AUTH",
-  "CODE_SIGNING",
-  "EMAIL_PROTECTION",
-  "IPSEC_END_SYSTEM",
-  "IPSEC_TUNNEL",
-  "IPSEC_USER",
-  "TIME_STAMPING",
-  "STEP_UP_APPROVED"
+    "DIGITAL_SIGNATURE",
+    "NON_REPUDIATION",
+    "KEY_ENCIPHERMENT",
+    "DATA_ENCIPHERMENT",
+    "KEY_AGREEMENT",
+    "KEY_CERT_SIGN",
+    "CRL_SIGN",
+    "SERVER_AUTH",
+    "CLIENT_AUTH",
+    "CODE_SIGNING",
+    "EMAIL_PROTECTION",
+    "IPSEC_END_SYSTEM",
+    "IPSEC_TUNNEL",
+    "IPSEC_USER",
+    "TIME_STAMPING",
+    "STEP_UP_APPROVED"
 );
 
 my @valid_mozilla_trust_levels = (
-  "TRUSTED_DELEGATOR",    # CAs
-  "NOT_TRUSTED",          # Don't trust these certs.
-  "MUST_VERIFY_TRUST",    # This explicitly tells us that it ISN'T a CA but is otherwise ok. In other words, this should tell the app to ignore any other sources that claim this is a CA.
-  "TRUSTED"               # This cert is trusted, but only for itself and not for delegates (i.e. it is not a CA).
+    "TRUSTED_DELEGATOR",    # CAs
+    "NOT_TRUSTED",          # Do not trust these certs.
+    "MUST_VERIFY_TRUST",    # This explicitly tells us that it IS NOT a CA but is
+                            # otherwise ok. In other words, this should tell the
+                            # app to ignore any other sources that claim this is
+                            # a CA.
+    "TRUSTED"               # This cert is trusted, but only for itself and not
+                            # for delegates (i.e. it is not a CA).
 );
 
-my $default_signature_algorithms = $opt_s = "MD5";
+my $default_signature_algorithms = $opt_s = "SHA256";
 
 my @valid_signature_algorithms = (
-  "MD5",
-  "SHA1",
-  "SHA256",
-  "SHA384",
-  "SHA512"
+    "SHA256",
+    "SHA384",
+    "SHA512"
 );
 
 $0 =~ s@.*(/|\\)@@;
 $Getopt::Std::STANDARD_HELP_VERSION = 1;
-getopts('bd:fhilnp:qs:tuvw:');
-
-if ($opt_i) {
-  print ("=" x 78 . "\n");
-  print "Script Version                   : $version\n";
-  print "Perl Version                     : $]\n";
-  print "Operating System Name            : $^O\n";
-  print "Getopt::Std.pm Version           : ${Getopt::Std::VERSION}\n";
-  print "MIME::Base64.pm Version          : ${MIME::Base64::VERSION}\n";
-  print ("=" x 78 . "\n");
+getopts('hilmp:qs:tvw:');
+
+if($opt_i) {
+    print ("=" x 78 . "\n");
+    print "Script Version                   : $version\n";
+    print "Perl Version                     : $]\n";
+    print "Operating System Name            : $^O\n";
+    print "Getopt::Std.pm Version           : ${Getopt::Std::VERSION}\n";
+    print "MIME::Base64.pm Version          : ${MIME::Base64::VERSION}\n";
+    print ("=" x 78 . "\n");
 }
 
 sub HELP_MESSAGE() {
-  print "Usage:\t${0} [-i] [-l] [-p<purposes:levels>] [-q] [-s<algorithms>] [-t] [-v] [-w<l>] [<outputfile>]\n";
-  print "\t-i\tprint version info about used modules\n";
-  print "\t-l\tprint license info about certdata.txt\n";
-  print wrap("\t","\t\t", "-p\tlist of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels. (default: $default_mozilla_trust_purposes:$default_mozilla_trust_levels)"), "\n";
-  print "\t\t  Valid purposes are:\n";
-  print wrap("\t\t    ","\t\t    ", join( ", ", "ALL", @valid_mozilla_trust_purposes ) ), "\n";
-  print "\t\t  Valid levels are:\n";
-  print wrap("\t\t    ","\t\t    ", join( ", ", "ALL", @valid_mozilla_trust_levels ) ), "\n";
-  print "\t-q\tbe really quiet (no progress output at all)\n";
-  print wrap("\t","\t\t", "-s\tcomma separated list of certificate signatures/hashes to output in plain text mode. (default: $default_signature_algorithms)\n");
-  print "\t\t  Valid signature algorithms are:\n";
-  print wrap("\t\t    ","\t\t    ", join( ", ", "ALL", @valid_signature_algorithms ) ), "\n";
-  print "\t-t\tinclude plain text listing of certificates\n";
-  print "\t-v\tbe verbose and print out processed CAs\n";
-  print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n";
-  exit;
+    print "Usage:\t${0} [-i] [-l] [-m] [-p<purposes:levels>] [-q] [-s<algorithms>] [-t] [-v] [-w<l>] [<outputfile>]\n";
+    print "\t-i\tprint version info about used modules\n";
+    print "\t-l\tprint license info about certdata.txt\n";
+    print "\t-m\tinclude meta data in output\n";
+    print wrap("\t","\t\t", "-p\tlist of Mozilla trust purposes and levels for certificates to include in output. " .
+          "Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels. " .
+          "(default: $default_mozilla_trust_purposes:$default_mozilla_trust_levels)"), "\n";
+    print "\t\t  Valid purposes are:\n";
+    print wrap("\t\t    ","\t\t    ", join(", ", "ALL", @valid_mozilla_trust_purposes)), "\n";
+    print "\t\t  Valid levels are:\n";
+    print wrap("\t\t    ","\t\t    ", join(", ", "ALL", @valid_mozilla_trust_levels)), "\n";
+    print "\t-q\tbe really quiet (no progress output at all)\n";
+    print wrap("\t","\t\t", "-s\tcomma separated list of certificate signatures/hashes to output in plain text mode. (default: $default_signature_algorithms)\n");
+    print "\t\t  Valid signature algorithms are:\n";
+    print wrap("\t\t    ","\t\t    ", join(", ", "ALL", @valid_signature_algorithms)), "\n";
+    print "\t-t\tinclude plain text listing of certificates\n";
+    print "\t-v\tbe verbose and print out processed CAs\n";
+    print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n";
+    exit;
 }
 
 sub VERSION_MESSAGE() {
-  print "${0} version ${version} running Perl ${]} on ${^O}\n";
+    print "${0} version ${version} running Perl ${]} on ${^O}\n";
 }
 
-HELP_MESSAGE() if ($opt_h);
+HELP_MESSAGE() if($opt_h);
 
 sub report($@) {
-  my $output = shift;
+    my $output = shift;
 
-  print STDERR $output . "\n" unless $opt_q;
+    print STDERR $output . "\n" unless $opt_q;
 }
 
 sub is_in_list($@) {
-  my $target = shift;
+    my $target = shift;
 
-  return defined(List::Util::first { $target eq $_ } @_);
+    return defined(List::Util::first { $target eq $_ } @_);
 }
 
-# Parses $param_string as a case insensitive comma separated list with optional whitespace
-# validates that only allowed parameters are supplied
+# Parses $param_string as a case insensitive comma separated list with optional
+# whitespace validates that only allowed parameters are supplied
 sub parse_csv_param($$@) {
-  my $description = shift;
-  my $param_string = shift;
-  my @valid_values = @_;
-
-  my @values = map {
-    s/^\s+//;  # strip leading spaces
-    s/\s+$//;  # strip trailing spaces
-    uc $_      # return the modified string as upper case
-  } split( ',', $param_string );
-
-  # Find all values which are not in the list of valid values or "ALL"
-  my @invalid = grep { !is_in_list($_,"ALL",@valid_values) } @values;
-
-  if ( scalar(@invalid) > 0 ) {
-    # Tell the user which parameters were invalid and print the standard help message which will exit
-    print "Error: Invalid ", $description, scalar(@invalid) == 1 ? ": " : "s: ", join( ", ", map { "\"$_\"" } @invalid ), "\n";
-    HELP_MESSAGE();
-  }
+    my $description = shift;
+    my $param_string = shift;
+    my @valid_values = @_;
+
+    my @values = map {
+        s/^\s+//;  # strip leading spaces
+        s/\s+$//;  # strip trailing spaces
+        uc $_      # return the modified string as upper case
+    } split(',', $param_string);
+
+    # Find all values which are not in the list of valid values or "ALL"
+    my @invalid = grep { !is_in_list($_, "ALL", @valid_values) } @values;
+
+    if(scalar(@invalid) > 0) {
+        # Tell the user which parameters were invalid and print the standard help
+        # message which also exits
+        print "Error: Invalid ", $description, scalar(@invalid) == 1 ? ": " : "s: ", join(", ", map { "\"$_\"" } @invalid), "\n";
+        HELP_MESSAGE();
+    }
 
-  @values = @valid_values if ( is_in_list("ALL",@values) );
+    @values = @valid_values if(is_in_list("ALL", @values));
 
-  return @values;
+    return @values;
 }
 
-if ( $opt_p !~ m/:/ ) {
-  print "Error: Mozilla trust identifier list must include both purposes and levels\n";
-  HELP_MESSAGE();
+if($opt_p !~ m/:/) {
+    print "Error: Mozilla trust identifier list must include both purposes and levels\n";
+    HELP_MESSAGE();
 }
 
-(my $included_mozilla_trust_purposes_string, my $included_mozilla_trust_levels_string) = split( ':', $opt_p );
-my @included_mozilla_trust_purposes = parse_csv_param( "trust purpose", $included_mozilla_trust_purposes_string, @valid_mozilla_trust_purposes );
-my @included_mozilla_trust_levels = parse_csv_param( "trust level", $included_mozilla_trust_levels_string, @valid_mozilla_trust_levels );
+(my $included_mozilla_trust_purposes_string, my $included_mozilla_trust_levels_string) = split(':', $opt_p);
+my @included_mozilla_trust_purposes = parse_csv_param("trust purpose", $included_mozilla_trust_purposes_string, @valid_mozilla_trust_purposes);
+my @included_mozilla_trust_levels = parse_csv_param("trust level", $included_mozilla_trust_levels_string, @valid_mozilla_trust_levels);
 
-my @included_signature_algorithms = parse_csv_param( "signature algorithm", $opt_s, @valid_signature_algorithms );
+my @included_signature_algorithms = parse_csv_param("signature algorithm", $opt_s, @valid_signature_algorithms);
 
 sub should_output_cert(%) {
-  my %trust_purposes_by_level = @_;
+    my %trust_purposes_by_level = @_;
 
-  foreach my $level (@included_mozilla_trust_levels) {
-    # for each level we want to output, see if any of our desired purposes are included
-    return 1 if ( defined( List::Util::first { is_in_list( $_, @included_mozilla_trust_purposes ) } @{$trust_purposes_by_level{$level}} ) );
-  }
+    foreach my $level (@included_mozilla_trust_levels) {
+        # for each level we want to output, see if any of our desired purposes are
+        # included
+        return 1 if(defined(List::Util::first { is_in_list($_, @included_mozilla_trust_purposes) } @{$trust_purposes_by_level{$level}}));
+    }
 
-  return 0;
+    return 0;
 }
 
 my $crt = $ARGV[0] || dirname(__FILE__) . '/../src/node_root_certs.h';
@@ -191,132 +202,242 @@ (%)
 
 my $stdout = $crt eq '-';
 
-if( $stdout ) {
-    open(CRT, '> -') or die "Couldn't open STDOUT: $!\n";
+if($stdout) {
+    open(CRT, '> -') or die "Could not open STDOUT: $!\n";
 } else {
-    open(CRT,">$crt.~") or die "Couldn't open $crt.~: $!\n";
+    open(CRT, ">", "$crt.~") or die "Could not open $crt.~: $!\n";
 }
 
 my $caname;
 my $certnum = 0;
 my $skipnum = 0;
 my $start_of_cert = 0;
-
-open(TXT,"$txt") or die "Couldn't open $txt: $!\n";
+my $main_block = 0;
+my $main_block_name;
+my $trust_block = 0;
+my $trust_block_name;
+my @precert;
+my $cka_value;
+my $valid = 0;
+
+open(TXT, $txt) or die "Could not open $txt: $!\n";
 print CRT "#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS\n";
-while (<TXT>) {
-  if (/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
-    print CRT;
-    print if ($opt_l);
-    while (<TXT>) {
-      print CRT;
-      print if ($opt_l);
-      last if (/\*\*\*\*\* END LICENSE BLOCK \*\*\*\*\*/);
+while(<TXT>) {
+    if(/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
+        print CRT;
+        print if($opt_l);
+        while(<TXT>) {
+            print CRT;
+            print if($opt_l);
+            last if(/\*\*\*\*\* END LICENSE BLOCK \*\*\*\*\*/);
+        }
+        next;
     }
-  }
-  next if /^#|^\s*$/;
-  chomp;
-  if (/^CVS_ID\s+\"(.*)\"/) {
-    print CRT "/* $1 */\n";
-  }
-
-  # this is a match for the start of a certificate
-  if (/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) {
-    $start_of_cert = 1
-  }
-  if ($start_of_cert && /^CKA_LABEL UTF8 \"(.*)\"/) {
-    $caname = $1;
-  }
-  my %trust_purposes_by_level;
-  if ($start_of_cert && /^CKA_VALUE MULTILINE_OCTAL/) {
-    my $data;
-    while (<TXT>) {
-      last if (/^END/);
-      chomp;
-      my @octets = split(/\\/);
-      shift @octets;
-      for (@octets) {
-        $data .= chr(oct);
-      }
+    # The input file format consists of blocks of Mozilla objects.
+    # The blocks are separated by blank lines but may be related.
+    elsif(/^\s*$/) {
+        $main_block = 0;
+        $trust_block = 0;
+        next;
     }
-    # scan forwards until the trust part
-    while (<TXT>) {
-      last if (/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/);
-      chomp;
+    # Each certificate has a main block.
+    elsif(/^# Certificate "(.*)"/) {
+        (!$main_block && !$trust_block) or die "Unexpected certificate block";
+        $main_block = 1;
+        $main_block_name = $1;
+        # Reset all other certificate variables.
+        $trust_block = 0;
+        $trust_block_name = "";
+        $valid = 0;
+        $start_of_cert = 0;
+        $caname = "";
+        $cka_value = "";
+        undef @precert;
+        next;
     }
-    # now scan the trust part to determine how we should trust this cert
-    while (<TXT>) {
-      last if (/^#/);
-      if (/^CKA_TRUST_([A-Z_]+)\s+CK_TRUST\s+CKT_NSS_([A-Z_]+)\s*$/) {
-        if ( !is_in_list($1,@valid_mozilla_trust_purposes) ) {
-          report "Warning: Unrecognized trust purpose for cert: $caname. Trust purpose: $1. Trust Level: $2";
-        } elsif ( !is_in_list($2,@valid_mozilla_trust_levels) ) {
-          report "Warning: Unrecognized trust level for cert: $caname. Trust purpose: $1. Trust Level: $2";
-        } else {
-          push @{$trust_purposes_by_level{$2}}, $1;
+    # Each certificate's main block is followed by a trust block.
+    elsif(/^# Trust for (?:Certificate )?"(.*)"/) {
+        (!$main_block && !$trust_block) or die "Unexpected trust block";
+        $trust_block = 1;
+        $trust_block_name = $1;
+        if($main_block_name ne $trust_block_name) {
+            die "cert name \"$main_block_name\" != trust name \"$trust_block_name\"";
+        }
+        next;
+    }
+    # Ignore other blocks.
+    #
+    # There is a documentation comment block, a BEGINDATA block, and a bunch of
+    # blocks starting with "# Explicitly Distrust <certname>".
+    #
+    # The latter is for certificates that have already been removed and are not
+    # included. Not all explicitly distrusted certificates are ignored at this
+    # point, only those without an actual certificate.
+    elsif(!$main_block && !$trust_block) {
+        next;
+    }
+    elsif(/^#/) {
+        # The commented lines in a main block are plaintext metadata that describes
+        # the certificate. Issuer, Subject, Fingerprint, etc.
+        if($main_block) {
+            push @precert, s{^#}{//}r if not /^#$/;
+            if(/^# Not Valid After : (.*)/) {
+                my $stamp = $1;
+                use Time::Piece;
+                # Not Valid After : Thu Sep 30 14:01:15 2021
+                my $t = Time::Piece->strptime($stamp, "%a %b %d %H:%M:%S %Y");
+                my $delta = ($t->epoch - time()); # negative means no longer valid
+                if($delta < 0) {
+                    $skipnum++;
+                    report "Skipping: $main_block_name is not valid anymore" if($opt_v);
+                    $valid = 0;
+                }
+                else {
+                    $valid = 1;
+                }
+            }
         }
-      }
+        next;
+    }
+    elsif(!$valid) {
+        next;
     }
 
-    if ( !should_output_cert(%trust_purposes_by_level) ) {
-      $skipnum ++;
-    } elsif ($caname =~ /TrustCor/) {
-      $skipnum ++;
-    } else {
-      my $encoded = MIME::Base64::encode_base64($data, '');
-      $encoded =~ s/(.{1,${opt_w}})/"$1\\n"\n/g;
-      my $pem = "\"-----BEGIN CERTIFICATE-----\\n\"\n"
-              . $encoded
-              . "\"-----END CERTIFICATE-----\",\n";
-      print CRT "\n/* $caname */\n";
-
-      my $maxStringLength = length($caname);
-      if ($opt_t) {
-        foreach my $key (keys %trust_purposes_by_level) {
-           my $string = $key . ": " . join(", ", @{$trust_purposes_by_level{$key}});
-           $maxStringLength = List::Util::max( length($string), $maxStringLength );
-           print CRT $string . "\n";
+    chomp;
+
+    if($main_block) {
+        if(/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) {
+            !$start_of_cert or die "Duplicate CKO_CERTIFICATE object";
+            $start_of_cert = 1;
+            next;
+        }
+        elsif(!$start_of_cert) {
+            next;
+        }
+        elsif(/^CKA_LABEL UTF8 \"(.*)\"/) {
+            ($caname eq "") or die "Duplicate CKA_LABEL attribute";
+            $caname = $1;
+            if($caname ne $main_block_name) {
+                die "caname \"$caname\" != cert name \"$main_block_name\"";
+            }
+            next;
         }
-      }
-      if (!$opt_t) {
-        print CRT $pem;
-      } else {
-        my $pipe = "";
-        foreach my $hash (@included_signature_algorithms) {
-          $pipe = "|$openssl x509 -" . $hash . " -fingerprint -noout -inform PEM";
-          if (!$stdout) {
-            $pipe .= " >> $crt.~";
-            close(CRT) or die "Couldn't close $crt.~: $!";
-          }
-          open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
-          print TMP $pem;
-          close(TMP) or die "Couldn't close openssl pipe: $!";
-          if (!$stdout) {
-            open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!";
-          }
+        elsif(/^CKA_VALUE MULTILINE_OCTAL/) {
+            ($cka_value eq "") or die "Duplicate CKA_VALUE attribute";
+            while(<TXT>) {
+                last if(/^END/);
+                chomp;
+                my @octets = split(/\\/);
+                shift @octets;
+                for(@octets) {
+                    $cka_value .= chr(oct);
+                }
+            }
+            next;
+        }
+        else {
+            next;
+        }
+    }
+
+    if(!$trust_block || !$start_of_cert || $caname eq "" || $cka_value eq "") {
+        die "Certificate extraction failed";
+    }
+
+    my %trust_purposes_by_level;
+
+    if(/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/) {
+        # now scan the trust part to determine how we should trust this cert
+        while(<TXT>) {
+            if(/^\s*$/) {
+                $trust_block = 0;
+                last;
+            }
+            if(/^CKA_TRUST_([A-Z_]+)\s+CK_TRUST\s+CKT_NSS_([A-Z_]+)\s*$/) {
+                if(!is_in_list($1, @valid_mozilla_trust_purposes)) {
+                    report "Warning: Unrecognized trust purpose for cert: $caname. Trust purpose: $1. Trust Level: $2";
+                } elsif(!is_in_list($2, @valid_mozilla_trust_levels)) {
+                    report "Warning: Unrecognized trust level for cert: $caname. Trust purpose: $1. Trust Level: $2";
+                } else {
+                    push @{$trust_purposes_by_level{$2}}, $1;
+                }
+            }
         }
-        $pipe = "|$openssl x509 -text -inform PEM";
-        if (!$stdout) {
-          $pipe .= " >> $crt.~";
-          close(CRT) or die "Couldn't close $crt.~: $!";
+
+        # Sanity check that an explicitly distrusted certificate only has trust
+        # purposes with a trust level of NOT_TRUSTED.
+        #
+        # Certificate objects that are explicitly distrusted are in a certificate
+        # block that starts # Certificate "Explicitly Distrust(ed) <certname>",
+        # where "Explicitly Distrust(ed) " was prepended to the original cert name.
+        if($caname =~ /distrust/i ||
+             $main_block_name =~ /distrust/i ||
+             $trust_block_name =~ /distrust/i) {
+            my @levels = keys %trust_purposes_by_level;
+            if(scalar(@levels) != 1 || $levels[0] ne "NOT_TRUSTED") {
+                die "\"$caname\" must have all trust purposes at level NOT_TRUSTED.";
+            }
         }
-        open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
-        print TMP $pem;
-        close(TMP) or die "Couldn't close openssl pipe: $!";
-        if (!$stdout) {
-          open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!";
+
+        if(!should_output_cert(%trust_purposes_by_level)) {
+            $skipnum ++;
+            report "Skipping: $caname lacks acceptable trust level" if($opt_v);
+        } elsif($caname =~ /TrustCor/) {
+            $skipnum ++;
+        } else {
+            my $encoded = MIME::Base64::encode_base64($cka_value, '');
+            $encoded =~ s/(.{1,${opt_w}})/"$1\\n"\n/g;
+            my $pem = "\"-----BEGIN CERTIFICATE-----\\n\"\n"
+                    . $encoded
+                    . "\"-----END CERTIFICATE-----\",\n";
+            print CRT "\n/* $caname */\n";
+            if($opt_t) {
+                foreach my $key (sort keys %trust_purposes_by_level) {
+                    my $string = $key . ": " . join(", ", @{$trust_purposes_by_level{$key}});
+                    print CRT $string . "\n";
+                }
+            }
+            if($opt_m) {
+                print CRT for @precert;
+            }
+            if(!$opt_t) {
+                print CRT $pem;
+            } else {
+                my $pipe = "";
+                foreach my $hash (@included_signature_algorithms) {
+                    $pipe = "|$openssl x509 -" . $hash . " -fingerprint -noout -inform PEM";
+                    if(!$stdout) {
+                        $pipe .= " >> $crt.~";
+                        close(CRT) or die "Could not close $crt.~: $!";
+                    }
+                    open(TMP, $pipe) or die "Could not open openssl pipe: $!";
+                    print TMP $pem;
+                    close(TMP) or die "Could not close openssl pipe: $!";
+                    if(!$stdout) {
+                        open(CRT, ">>", "$crt.~") or die "Could not open $crt.~: $!";
+                    }
+                }
+                $pipe = "|$openssl x509 -text -inform PEM";
+                if(!$stdout) {
+                    $pipe .= " >> $crt.~";
+                    close(CRT) or die "Could not close $crt.~: $!";
+                }
+                open(TMP, $pipe) or die "Could not open openssl pipe: $!";
+                print TMP $pem;
+                close(TMP) or die "Could not close openssl pipe: $!";
+                if(!$stdout) {
+                    open(CRT, ">>", "$crt.~") or die "Could not open $crt.~: $!";
+                }
+            }
+            report "Processed: $caname" if($opt_v);
+            $certnum++;
         }
-      }
-      report "Parsing: $caname" if ($opt_v);
-      $certnum ++;
-      $start_of_cert = 0;
     }
-  }
 }
 print CRT "#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS\n";
-close(TXT) or die "Couldn't close $txt: $!\n";
-close(CRT) or die "Couldn't close $crt.~: $!\n";
-unless( $stdout ) {
+close(TXT) or die "Could not close $txt: $!\n";
+close(CRT) or die "Could not close $crt.~: $!\n";
+unless($stdout) {
     rename "$crt.~", $crt or die "Failed to rename $crt.~ to $crt: $!\n";
 }
 report "Done ($certnum CA certs processed, $skipnum skipped).";

From 3b8a0bacaac74b1dc6443392ad161fc94804e28e Mon Sep 17 00:00:00 2001
From: Yilong Li <burningdian@gmail.com>
Date: Wed, 5 Aug 2026 12:37:14 +0800
Subject: [PATCH 018/344] doc: correct default highWaterMark values

File write streams inherit the default byte-stream highWaterMark.
The fixed 16 KiB value became stale when that default changed.
Also document the Windows-specific byte-stream default.

Signed-off-by: umuoy1 <burningdian@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64617
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 doc/api/fs.md     | 13 +++++++++++--
 doc/api/stream.md | 14 ++++++++++----
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index dea508929fe2..c7ee7c12ada0 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -323,6 +323,9 @@ fd.createReadStream({ start: 90, end: 99 });
 <!-- YAML
 added: v16.11.0
 changes:
+  - version: v22.0.0
+    pr-url: https://github.com/nodejs/node/pull/52037
+    description: bump default highWaterMark.
   - version:
     - v21.0.0
     - v20.10.0
@@ -335,7 +338,8 @@ changes:
   * `autoClose` {boolean} **Default:** `true`
   * `emitClose` {boolean} **Default:** `true`
   * `start` {integer}
-  * `highWaterMark` {number} **Default:** `16384`
+  * `highWaterMark` {number} **Default:** See
+    [`stream.getDefaultHighWaterMark()`][].
   * `flush` {boolean} If `true`, the underlying file descriptor is flushed
     prior to closing it. **Default:** `false`.
 * Returns: {fs.WriteStream}
@@ -3055,6 +3059,9 @@ If `options` is a string, then it specifies the encoding.
 <!-- YAML
 added: v0.1.31
 changes:
+  - version: v22.0.0
+    pr-url: https://github.com/nodejs/node/pull/52037
+    description: bump default highWaterMark.
   - version:
     - v21.0.0
     - v20.10.0
@@ -3112,7 +3119,8 @@ changes:
   * `start` {integer}
   * `fs` {Object|null} **Default:** `null`
   * `signal` {AbortSignal|null} **Default:** `null`
-  * `highWaterMark` {number} **Default:** `16384`
+  * `highWaterMark` {number} **Default:** See
+    [`stream.getDefaultHighWaterMark()`][].
   * `flush` {boolean} If `true`, the underlying file descriptor is flushed
     prior to closing it. **Default:** `false`.
 * Returns: {fs.WriteStream}
@@ -9334,6 +9342,7 @@ the file contents.
 [`minimatch`]: https://github.com/isaacs/minimatch
 [`node:stream/iter`]: stream_iter.md
 [`statfs.bsize`]: #statfsbsize
+[`stream.getDefaultHighWaterMark()`]: stream.md#streamgetdefaulthighwatermarkobjectmode
 [`stream/iter pipeTo()`]: stream_iter.md#pipetosource-transforms-writer-options
 [`stream/iter pull()`]: stream_iter.md#pullsource-transforms-options
 [`stream/iter pullSync()`]: stream_iter.md#pullsyncsource-transforms
diff --git a/doc/api/stream.md b/doc/api/stream.md
index e83fbda8879a..0000df868664 100644
--- a/doc/api/stream.md
+++ b/doc/api/stream.md
@@ -3643,13 +3643,18 @@ reader.read().then(({ value, done }) => {
 added:
   - v19.9.0
   - v18.17.0
+changes:
+  - version: v22.0.0
+    pr-url: https://github.com/nodejs/node/pull/52037
+    description: bump default highWaterMark.
 -->
 
 * `objectMode` {boolean}
 * Returns: {integer}
 
-Returns the default highWaterMark used by streams.
-Defaults to `65536` (64 KiB), or `16` for `objectMode`.
+Returns the default highWaterMark used by streams. Defaults to `16` for
+`objectMode`. For byte streams, it defaults to `65536` (64 KiB) on non-Windows
+platforms and `16384` (16 KiB) on Windows.
 
 ### `stream.setDefaultHighWaterMark(objectMode, value)`
 
@@ -3779,7 +3784,7 @@ changes:
 * `options` {Object}
   * `highWaterMark` {number} Buffer level when
     [`stream.write()`][stream-write] starts returning `false`. **Default:**
-    `65536` (64 KiB), or `16` for `objectMode` streams.
+    See [`stream.getDefaultHighWaterMark()`][].
   * `decodeStrings` {boolean} Whether to encode `string`s passed to
     [`stream.write()`][stream-write] to `Buffer`s (with the encoding
     specified in the [`stream.write()`][stream-write] call) before passing
@@ -4153,7 +4158,7 @@ changes:
 * `options` {Object}
   * `highWaterMark` {number} The maximum [number of bytes][hwm-gotcha] to store
     in the internal buffer before ceasing to read from the underlying resource.
-    **Default:** `65536` (64 KiB), or `16` for `objectMode` streams.
+    **Default:** See [`stream.getDefaultHighWaterMark()`][].
   * `encoding` {string} If specified, then buffers will be decoded to
     strings using the specified encoding. **Default:** `null`.
   * `objectMode` {boolean} Whether this stream should behave
@@ -5094,6 +5099,7 @@ contain multi-byte characters.
 [`stream.cork()`]: #writablecork
 [`stream.duplexPair()`]: #streamduplexpairoptions
 [`stream.finished()`]: #streamfinishedstream-options-callback
+[`stream.getDefaultHighWaterMark()`]: #streamgetdefaulthighwatermarkobjectmode
 [`stream.pipe()`]: #readablepipedestination-options
 [`stream.pipeline()`]: #streampipelinesource-transforms-destination-callback
 [`stream.uncork()`]: #writableuncork

From a293dbf0e15531745c34c5eadc297d43966ada74 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Tue, 4 Aug 2026 22:36:44 -0700
Subject: [PATCH 019/344] src: update repeated use strings to env

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64760
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 src/crypto/crypto_context.cc |  9 +++------
 src/crypto/crypto_ec.cc      |  8 ++++----
 src/crypto/crypto_keys.cc    | 26 ++++++++++----------------
 src/crypto/crypto_util.cc    | 10 +++-------
 src/crypto/crypto_util.h     |  2 +-
 src/env_properties.h         | 17 ++++++++++++++++-
 src/node_ffi.cc              |  2 +-
 src/permission/permission.cc |  8 ++++----
 8 files changed, 42 insertions(+), 40 deletions(-)

diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index d6387a55bd78..0f61767cdbbe 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -2255,12 +2255,9 @@ void SecureContext::GetCertificateCompressionAlgorithms(
   Environment* env = Environment::GetCurrent(args);
   LocalVector<Value> algs(env->isolate());
 #ifdef NODE_OPENSSL_HAS_CERT_COMP
-  if (BIO_f_zlib() != nullptr)
-    algs.push_back(FIXED_ONE_BYTE_STRING(env->isolate(), "zlib"));
-  if (BIO_f_brotli() != nullptr)
-    algs.push_back(FIXED_ONE_BYTE_STRING(env->isolate(), "brotli"));
-  if (BIO_f_zstd() != nullptr)
-    algs.push_back(FIXED_ONE_BYTE_STRING(env->isolate(), "zstd"));
+  if (BIO_f_zlib() != nullptr) algs.push_back(env->zlib_string());
+  if (BIO_f_brotli() != nullptr) algs.push_back(env->brotli_string());
+  if (BIO_f_zstd() != nullptr) algs.push_back(env->zstd_string());
 #endif
   args.GetReturnValue().Set(
       Array::New(env->isolate(), algs.data(), algs.size()));
diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
index 388931c11e79..b08d4b7a9106 100644
--- a/src/crypto/crypto_ec.cc
+++ b/src/crypto/crypto_ec.cc
@@ -520,16 +520,16 @@ bool ExportJWKEcKey(Environment* env,
   const int nid = EC_GROUP_get_curve_name(group);
   switch (nid) {
     case NID_X9_62_prime256v1:
-      crv_name = FIXED_ONE_BYTE_STRING(env->isolate(), "P-256");
+      crv_name = env->p256_string();
       break;
     case NID_secp256k1:
-      crv_name = FIXED_ONE_BYTE_STRING(env->isolate(), "secp256k1");
+      crv_name = env->secp256k1_string();
       break;
     case NID_secp384r1:
-      crv_name = FIXED_ONE_BYTE_STRING(env->isolate(), "P-384");
+      crv_name = env->p384_string();
       break;
     case NID_secp521r1:
-      crv_name = FIXED_ONE_BYTE_STRING(env->isolate(), "P-521");
+      crv_name = env->p521_string();
       break;
     default: {
       THROW_ERR_CRYPTO_JWK_UNSUPPORTED_CURVE(
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index d8bdc93deff8..b4e3aa72292f 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -1796,8 +1796,7 @@ BaseObjectPtr<BaseObject> NativeKeyObject::KeyObjectTransferData::Deserialize(
     return {};
 
   Local<Function> key_ctor;
-  Local<Value> arg = FIXED_ONE_BYTE_STRING(env->isolate(),
-                                           "internal/crypto/keys");
+  Local<Value> arg = env->internal_crypto_keys_string();
   if (env->builtin_module_require()
           ->Call(context, Null(env->isolate()), 1, &arg)
           .IsEmpty()) {
@@ -1875,7 +1874,7 @@ MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
   if (!KeyObjectHandle::Create(env, data).ToLocal(&handle)) return {};
 
   if (env->crypto_internal_cryptokey_constructor().IsEmpty()) {
-    Local<Value> arg = FIXED_ONE_BYTE_STRING(isolate, "internal/crypto/keys");
+    Local<Value> arg = env->internal_crypto_keys_string();
     if (env->builtin_module_require()
             ->Call(context, Null(isolate), 1, &arg)
             .IsEmpty()) {
@@ -2017,7 +2016,6 @@ Maybe<void> NativeCryptoKey::FinalizeTransferRead(
   }
   CHECK(bundle_v->IsObject());
   Local<Object> bundle = bundle_v.As<Object>();
-  Isolate* isolate = env()->isolate();
   Local<Object> obj = object();
 
   // The partially-initialized object produced by
@@ -2025,23 +2023,21 @@ Maybe<void> NativeCryptoKey::FinalizeTransferRead(
   CHECK(obj->GetInternalField(kAlgorithmField).As<Value>()->IsUndefined());
 
   Local<Value> algorithm_v;
-  if (!bundle->Get(context, FIXED_ONE_BYTE_STRING(isolate, "algorithm"))
-           .ToLocal(&algorithm_v)) {
+  if (!bundle->Get(context, env()->algorithm_string()).ToLocal(&algorithm_v)) {
     return Nothing<void>();
   }
   CHECK(algorithm_v->IsObject());
   obj->SetInternalField(kAlgorithmField, algorithm_v);
 
   Local<Value> usages_v;
-  if (!bundle->Get(context, FIXED_ONE_BYTE_STRING(isolate, "usages"))
-           .ToLocal(&usages_v)) {
+  if (!bundle->Get(context, env()->usages_string()).ToLocal(&usages_v)) {
     return Nothing<void>();
   }
   CHECK(usages_v->IsUint32());
   usages_mask_ = usages_v.As<Uint32>()->Value();
 
   Local<Value> extractable_v;
-  if (!bundle->Get(context, FIXED_ONE_BYTE_STRING(isolate, "extractable"))
+  if (!bundle->Get(context, env()->extractable_string())
            .ToLocal(&extractable_v)) {
     return Nothing<void>();
   }
@@ -2054,21 +2050,19 @@ Maybe<void> NativeCryptoKey::FinalizeTransferRead(
 Maybe<bool> NativeCryptoKey::CryptoKeyTransferData::FinalizeTransferWrite(
     Local<Context> context, v8::ValueSerializer* serializer) {
   Isolate* isolate = Isolate::GetCurrent();
+  Environment* env = Environment::GetCurrent(isolate);
   CHECK(!algorithm_.IsEmpty());
   Local<Object> bundle = Object::New(isolate);
   Local<Value> algorithm_v = PersistentToLocal::Strong(algorithm_);
-  if (bundle
-          ->Set(
-              context, FIXED_ONE_BYTE_STRING(isolate, "algorithm"), algorithm_v)
-          .IsNothing() ||
+  if (bundle->Set(context, env->algorithm_string(), algorithm_v).IsNothing() ||
       bundle
           ->Set(context,
-                FIXED_ONE_BYTE_STRING(isolate, "usages"),
+                env->usages_string(),
                 Uint32::NewFromUnsigned(isolate, usages_mask_))
           .IsNothing() ||
       bundle
           ->Set(context,
-                FIXED_ONE_BYTE_STRING(isolate, "extractable"),
+                env->extractable_string(),
                 v8::Boolean::New(isolate, extractable_))
           .IsNothing()) {
     return Nothing<bool>();
@@ -2094,7 +2088,7 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
   // Make sure internal/crypto/keys has been loaded so that the
   // CryptoKey constructor is registered with the Environment.
   Isolate* isolate = env->isolate();
-  Local<Value> arg = FIXED_ONE_BYTE_STRING(isolate, "internal/crypto/keys");
+  Local<Value> arg = env->internal_crypto_keys_string();
   if (env->builtin_module_require()
           ->Call(context, Null(isolate), 1, &arg)
           .IsEmpty()) {
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 080f2cf51cec..7c3e4b7ab5fe 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -267,7 +267,7 @@ MaybeLocal<Value> cryptoErrorListToException(Environment* env,
   // If there are no errors, it is likely a bug but we will return
   // an error anyway.
   if (errors.empty()) {
-    return Exception::Error(FIXED_ONE_BYTE_STRING(env->isolate(), "Ok"));
+    return Exception::Error(env->ok_string());
   }
 
   // The last error in the list is the one that will be used as the
@@ -778,13 +778,9 @@ MaybeLocal<Value> CreateWebCryptoJobError(Environment* env,
   CHECK(domexception_ctor->IsFunction());
 
   Local<Object> options = Object::New(isolate);
-  if (options
-          ->Set(context,
-                FIXED_ONE_BYTE_STRING(isolate, "name"),
-                FIXED_ONE_BYTE_STRING(isolate, "OperationError"))
+  if (options->Set(context, env->name_string(), env->operationerror_string())
           .IsNothing() ||
-      options->Set(context, FIXED_ONE_BYTE_STRING(isolate, "cause"), cause)
-          .IsNothing()) {
+      options->Set(context, env->cause_string(), cause).IsNothing()) {
     return {};
   }
 
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index 76afc3dd24a3..308e8fccba59 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -477,7 +477,7 @@ class CryptoJob : public AsyncWrap, public ThreadPoolWork {
     {
       node::errors::TryCatchScope try_catch(env);
       if (value->IsObject()) {
-        then_key = FIXED_ONE_BYTE_STRING(env->isolate(), "then");
+        then_key = env->then_string();
         v8::Local<v8::Object> object = value.As<v8::Object>();
         v8::Maybe<bool> has_own_then =
             object->HasOwnProperty(context, then_key);
diff --git a/src/env_properties.h b/src/env_properties.h
index 26fab56b2649..513f5875a8d2 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -82,6 +82,7 @@
   V(__dirname_string, "__dirname")                                             \
   V(ack_string, "ack")                                                         \
   V(address_string, "address")                                                 \
+  V(algorithm_string, "algorithm")                                             \
   V(aliases_string, "aliases")                                                 \
   V(allow_bare_named_params_string, "allowBareNamedParameters")                \
   V(allow_unknown_named_params_string, "allowUnknownNamedParameters")          \
@@ -93,6 +94,7 @@
   V(backup_string, "backup")                                                   \
   V(base_string, "base")                                                       \
   V(base_url_string, "baseURL")                                                \
+  V(brotli_string, "brotli")                                                   \
   V(buffer_string, "buffer")                                                   \
   V(bytes_parsed_string, "bytesParsed")                                        \
   V(bytes_read_string, "bytesRead")                                            \
@@ -100,6 +102,7 @@
   V(cached_data_produced_string, "cachedDataProduced")                         \
   V(cached_data_rejected_string, "cachedDataRejected")                         \
   V(cached_data_string, "cachedData")                                          \
+  V(cause_string, "cause")                                                     \
   V(change_string, "change")                                                   \
   V(changes_string, "changes")                                                 \
   V(chunks_sent_since_last_write_string, "chunksSentSinceLastWrite")           \
@@ -180,6 +183,7 @@
   V(exponent_string, "exponent")                                               \
   V(exports_string, "exports")                                                 \
   V(external_stream_string, "_externalStream")                                 \
+  V(extractable_string, "extractable")                                         \
   V(family_string, "family")                                                   \
   V(fatal_exception_string, "_fatalException")                                 \
   V(fd_string, "fd")                                                           \
@@ -215,6 +219,7 @@
   V(ignore_string, "ignore")                                                   \
   V(inherit_string, "inherit")                                                 \
   V(input_string, "input")                                                     \
+  V(internal_crypto_keys_string, "internal/crypto/keys")                       \
   V(inverse_string, "inverse")                                                 \
   V(ipv4_string, "IPv4")                                                       \
   V(ipv6_string, "IPv6")                                                       \
@@ -264,6 +269,7 @@
   V(node_string, "node")                                                       \
   V(object_string, "Object")                                                   \
   V(ocsp_request_string, "OCSPRequest")                                        \
+  V(ok_string, "ok")                                                           \
   V(oncertcb_string, "oncertcb")                                               \
   V(onchange_string, "onchange")                                               \
   V(onclienthello_string, "onclienthello")                                     \
@@ -287,10 +293,14 @@
   V(onwrite_string, "onwrite")                                                 \
   V(ongracefulclosecomplete_string, "ongracefulclosecomplete")                 \
   V(openssl_error_stack, "opensslErrorStack")                                  \
+  V(operationerror_string, "OperationError")                                   \
   V(options_string, "options")                                                 \
   V(original_string, "original")                                               \
   V(output_string, "output")                                                   \
   V(overlapped_string, "overlapped")                                           \
+  V(p256_string, "P-256")                                                      \
+  V(p384_string, "P-384")                                                      \
+  V(p521_string, "P-521")                                                      \
   V(parse_error_string, "Parse Error")                                         \
   V(password_string, "password")                                               \
   V(path_string, "path")                                                       \
@@ -333,6 +343,7 @@
   V(return_arrays_string, "returnArrays")                                      \
   V(return_string, "return")                                                   \
   V(salt_length_string, "saltLength")                                          \
+  V(secp256k1_string, "secp256k1")                                             \
   V(search_string, "search")                                                   \
   V(servername_string, "servername")                                           \
   V(session_id_string, "sessionId")                                            \
@@ -361,6 +372,7 @@
   V(syscall_string, "syscall")                                                 \
   V(table_string, "table")                                                     \
   V(target_string, "target")                                                   \
+  V(then_string, "then")                                                       \
   V(thread_id_string, "threadId")                                              \
   V(thread_name_string, "threadName")                                          \
   V(tls_group_string, "TLSGroup")                                              \
@@ -379,6 +391,7 @@
   V(uid_string, "uid")                                                         \
   V(unknown_string, "<unknown>")                                               \
   V(url_string, "url")                                                         \
+  V(usages_string, "usages")                                                   \
   V(username_string, "username")                                               \
   V(value_string, "value")                                                     \
   V(verify_error_string, "verifyError")                                        \
@@ -388,7 +401,9 @@
   V(wrap_string, "wrap")                                                       \
   V(writable_string, "writable")                                               \
   V(write_host_object_string, "_writeHostObject")                              \
-  V(write_queue_size_string, "writeQueueSize")
+  V(write_queue_size_string, "writeQueueSize")                                 \
+  V(zlib_string, "zlib")                                                       \
+  V(zstd_string, "zstd")
 
 #define PER_ISOLATE_TEMPLATE_PROPERTIES(V)                                     \
   V(a_record_template, v8::DictionaryTemplate)                                 \
diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 26a8f5a610cb..638ad4feafdf 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -1210,7 +1210,7 @@ Local<FunctionTemplate> DynamicLibrary::GetConstructorTemplate(
         DynamicLibrary::kInternalFieldCount);
 
     tmpl->InstanceTemplate()->SetAccessorProperty(
-        FIXED_ONE_BYTE_STRING(isolate, "path"),
+        env->path_string(),
         FunctionTemplate::New(env->isolate(), DynamicLibrary::GetPath),
         Local<FunctionTemplate>(),
         attributes);
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index cf1174d85fa1..919edd0821fd 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -265,11 +265,11 @@ bool Permission::is_scope_granted(Environment* env,
             v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
         const char* perm_str = PermissionToString(permission);
         msg->Set(context,
-                 FIXED_ONE_BYTE_STRING(isolate, "permission"),
+                 env->permission_string(),
                  v8::String::NewFromUtf8(isolate, perm_str).ToLocalChecked())
             .Check();
         msg->Set(context,
-                 FIXED_ONE_BYTE_STRING(isolate, "resource"),
+                 env->resource_string(),
                  v8::String::NewFromUtf8(isolate,
                                          res.data(),
                                          v8::NewStringType::kNormal,
@@ -335,11 +335,11 @@ void Permission::Drop(Environment* env,
           v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
       const char* perm_str = PermissionToString(scope);
       msg->Set(context,
-               FIXED_ONE_BYTE_STRING(isolate, "permission"),
+               env->permission_string(),
                v8::String::NewFromUtf8(isolate, perm_str).ToLocalChecked())
           .Check();
       msg->Set(context,
-               FIXED_ONE_BYTE_STRING(isolate, "resource"),
+               env->resource_string(),
                v8::String::NewFromUtf8(isolate,
                                        param.data(),
                                        v8::NewStringType::kNormal,

From 1a63416b1abb4ac2e1d026b21687ad4656e35c83 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Wed, 5 Aug 2026 11:19:53 +0100
Subject: [PATCH 020/344] url: handle unparsable serialized URLs in setters

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64651
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 src/node_url.cc                               |  6 ++++-
 .../test-whatwg-url-custom-setters.js         | 26 +++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/node_url.cc b/src/node_url.cc
index 75aaf468f508..9553942496f8 100644
--- a/src/node_url.cc
+++ b/src/node_url.cc
@@ -443,8 +443,12 @@ void BindingData::Update(const FunctionCallbackInfo<Value>& args) {
   Utf8Value new_value(isolate, args[2].As<String>());
 
   std::string_view new_value_view = new_value.ToStringView();
+  // A serialized URL is not always reparsable: the IDNA encoder can emit a
+  // host label that the decoder rejects. Fail the update instead of crashing.
   auto out = ada::parse<ada::url_aggregator>(input.ToStringView());
-  CHECK(out);
+  if (!out) {
+    return args.GetReturnValue().Set(false);
+  }
 
   bool result{true};
 
diff --git a/test/parallel/test-whatwg-url-custom-setters.js b/test/parallel/test-whatwg-url-custom-setters.js
index b98bf5d8d3b3..061ccf6f4480 100644
--- a/test/parallel/test-whatwg-url-custom-setters.js
+++ b/test/parallel/test-whatwg-url-custom-setters.js
@@ -39,6 +39,32 @@ const additionalTestCases =
   }
 }
 
+// The parser can produce a serialization it rejects when parsing it back: a
+// Unicode host encodes to an `xn--xn--` label that the punycode decoder turns
+// down. Setters reparse `href`, so the failure must not take the process down.
+// Implementations backed by ICU accept that label, and ada does too as of
+// https://github.com/ada-url/idna/pull/72, so this URL round-trips once that
+// lands here and the setters below apply as usual.
+test(function() {
+  const url = new URL('http:\u{1F600}xn-');
+  const setters = {
+    hostname: 'example.com',
+    host: 'example.com:8080',
+    protocol: 'https:',
+    pathname: '/path',
+    search: '?search',
+    hash: '#hash',
+    port: '8080',
+    username: 'username',
+    password: 'password',
+  };
+
+  for (const [property, value] of Object.entries(setters)) {
+    url[property] = value;
+    assert_equals(typeof url.href, 'string', `Setting ${property} does not crash`);
+  }
+}, 'URL: setting properties with an unparsable serialized URL');
+
 {
   const url = new URL('http://example.com/');
   const obj = {

From 0cf79931bb6dfad487619453e2ea0d62298573df Mon Sep 17 00:00:00 2001
From: kyungrae2002 <148605113+kyungrae2002@users.noreply.github.com>
Date: Wed, 5 Aug 2026 19:20:04 +0900
Subject: [PATCH 021/344] doc: document ArrayBuffer support in pbkd2Sync

Signed-off-by: kyungrae <kyungrae2002@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64976
Refs: https://github.com/nodejs/node/pull/35093
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 doc/api/crypto.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 1f2f6acd73e5..70292635c835 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -5229,6 +5229,10 @@ negative performance implications for some applications; see the
 <!-- YAML
 added: v0.9.3
 changes:
+  - version: v15.0.0
+    pr-url: https://github.com/nodejs/node/pull/35093
+    description: The password and salt arguments can also be ArrayBuffer
+                 instances.
   - version: v14.0.0
     pr-url: https://github.com/nodejs/node/pull/30578
     description: The `iterations` parameter is now restricted to positive
@@ -5243,8 +5247,8 @@ changes:
                  from `binary` to `utf8`.
 -->
 
-* `password` {string|Buffer|TypedArray|DataView}
-* `salt` {string|Buffer|TypedArray|DataView}
+* `password` {string|ArrayBuffer|Buffer|TypedArray|DataView}
+* `salt` {string|ArrayBuffer|Buffer|TypedArray|DataView}
 * `iterations` {number}
 * `keylen` {number}
 * `digest` {string}

From 4299cd5897266e89385cb2ab5e6eec482b1764a1 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Wed, 5 Aug 2026 06:57:32 -0700
Subject: [PATCH 022/344] util: add non-throwing MIMEType.parse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Similar to `URL.parse(...)`, the `MIMEType.parse(...)` API will
return `null` if the input cannot be parsed as opposed to throwing
the way the constructor does.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64965
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 doc/api/util.md                   | 12 ++++++++++++
 lib/internal/data_url.js          |  9 ++-------
 lib/internal/inspector/network.js | 13 +++----------
 lib/internal/mime.js              | 30 ++++++++++++++++++++++++------
 test/parallel/test-mime-api.js    | 14 ++++++++++++++
 5 files changed, 55 insertions(+), 23 deletions(-)

diff --git a/doc/api/util.md b/doc/api/util.md
index bf61e9f89322..e35e78982bb0 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -1896,6 +1896,18 @@ console.log(JSON.stringify(myMIMES));
 // Prints: ["image/png", "image/gif"]
 ```
 
+### `MIMEType.parse(string)`
+
+<!--
+added: REPLACEME
+-->
+
+* `string` {string} The input MIME to parse
+* Returns: {MIMEType|null}
+
+Attempts to parse the given `string` as a MIMEType. If the string cannot be
+parsed, `null` is returned.
+
 ## Class: `util.MIMEParams`
 
 <!-- YAML
diff --git a/lib/internal/data_url.js b/lib/internal/data_url.js
index 3b8a82ba08d1..0aea5030ecad 100644
--- a/lib/internal/data_url.js
+++ b/lib/internal/data_url.js
@@ -117,13 +117,8 @@ function dataURLProcessor(dataURL) {
   // mimeType.
   // 14. If mimeTypeRecord is failure, then set
   // mimeTypeRecord to text/plain;charset=US-ASCII.
-  let mimeTypeRecord;
-
-  try {
-    mimeTypeRecord = new MIMEType(mimeType);
-  } catch {
-    mimeTypeRecord = new MIMEType('text/plain;charset=US-ASCII');
-  }
+  const mimeTypeRecord = MIMEType.parse(mimeType) ||
+      new MIMEType('text/plain;charset=US-ASCII');
 
   // 15. Return a new data: URL struct whose MIME
   // type is mimeTypeRecord and body is body.
diff --git a/lib/internal/inspector/network.js b/lib/internal/inspector/network.js
index ddd5b4750bee..e9ebd05c6627 100644
--- a/lib/internal/inspector/network.js
+++ b/lib/internal/inspector/network.js
@@ -52,16 +52,9 @@ function getNextRequestId() {
 };
 
 function sniffMimeType(contentType) {
-  let mimeType;
-  let charset;
-  try {
-    const mimeTypeObj = new MIMEType(contentType);
-    mimeType = StringPrototypeToLowerCase(mimeTypeObj.essence || '');
-    charset = StringPrototypeToLowerCase(mimeTypeObj.params.get('charset') || '');
-  } catch {
-    mimeType = '';
-    charset = '';
-  }
+  const mimeTypeObj = MIMEType.parse(contentType);
+  const mimeType = StringPrototypeToLowerCase(mimeTypeObj?.essence || '');
+  const charset = StringPrototypeToLowerCase(mimeTypeObj?.params.get('charset') || '');
 
   return {
     __proto__: null,
diff --git a/lib/internal/mime.js b/lib/internal/mime.js
index 0c5bbc3325aa..bb368a36aa56 100644
--- a/lib/internal/mime.js
+++ b/lib/internal/mime.js
@@ -10,9 +10,11 @@ const {
   StringPrototypeIndexOf,
   StringPrototypeSlice,
   StringPrototypeToLowerCase,
+  Symbol,
   SymbolIterator,
 } = primordials;
 const {
+  ERR_ILLEGAL_CONSTRUCTOR,
   ERR_INVALID_MIME_SYNTAX,
 } = require('internal/errors').codes;
 
@@ -22,6 +24,8 @@ const NOT_HTTP_QUOTED_STRING_CODE_POINT = /[^\t\u0020-~\u0080-\u00FF]/g;
 const END_BEGINNING_WHITESPACE = /[^\r\n\t ]|$/;
 const START_ENDING_WHITESPACE = /[\r\n\t ]*$/;
 
+const kNoThrow = Symbol('kNoThrow');
+
 function toASCIILower(str) {
   // eslint-disable-next-line no-control-regex
   if (!/[^\x00-\x7f]/.test(str)) return StringPrototypeToLowerCase(str);
@@ -39,7 +43,7 @@ function toASCIILower(str) {
 const SOLIDUS = '/';
 const SEMICOLON = ';';
 
-function parseTypeAndSubtype(str) {
+function parseTypeAndSubtype(str, noThrow = null) {
   // Skip only HTTP whitespace from start
   let position = SafeStringPrototypeSearch(str, END_BEGINNING_WHITESPACE);
   // read until '/'
@@ -50,6 +54,7 @@ function parseTypeAndSubtype(str) {
   const invalidTypeIndex = SafeStringPrototypeSearch(trimmedType,
                                                      NOT_HTTP_TOKEN_CODE_POINT);
   if (trimmedType === '' || invalidTypeIndex !== -1 || typeEnd === -1) {
+    if (noThrow === kNoThrow) return null;
     throw new ERR_INVALID_MIME_SYNTAX('type', str, invalidTypeIndex);
   }
   // skip type and '/'
@@ -72,6 +77,7 @@ function parseTypeAndSubtype(str) {
   const invalidSubtypeIndex = SafeStringPrototypeSearch(trimmedSubtype,
                                                         NOT_HTTP_TOKEN_CODE_POINT);
   if (trimmedSubtype === '' || invalidSubtypeIndex !== -1) {
+    if (noThrow === kNoThrow) return null;
     throw new ERR_INVALID_MIME_SYNTAX('subtype', str, invalidSubtypeIndex);
   }
   const subtype = toASCIILower(trimmedSubtype);
@@ -335,12 +341,24 @@ class MIMEType {
   #type;
   #subtype;
   #parameters;
-  constructor(string) {
+  constructor(string, noThrowSymbol = null) {
     string = `${string}`;
-    const data = parseTypeAndSubtype(string);
-    this.#type = data[0];
-    this.#subtype = data[1];
-    this.#parameters = instantiateMimeParams(StringPrototypeSlice(string, data[2]));
+    // noThrowSymbol can be null or kNoThrow, but not any other value
+    if (noThrowSymbol != null && noThrowSymbol !== kNoThrow) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    const data = parseTypeAndSubtype(string, noThrowSymbol);
+    if (data != null) {
+      this.#type = data[0];
+      this.#subtype = data[1];
+      this.#parameters = instantiateMimeParams(StringPrototypeSlice(string, data[2]));
+    }
+  }
+
+  // Like the constructor, but returns null instead of throwing on invalid input.
+  static parse(string) {
+    const mt = new MIMEType(string, kNoThrow);
+    return mt.type ? mt : null;
   }
 
   get type() {
diff --git a/test/parallel/test-mime-api.js b/test/parallel/test-mime-api.js
index dffead31850b..5cab3f9cf2af 100644
--- a/test/parallel/test-mime-api.js
+++ b/test/parallel/test-mime-api.js
@@ -185,3 +185,17 @@ assert.throws(() => params.set('x', `x${NOT_HTTP_QUOTED_STRING_CODE_POINT}`), /p
   assert.strictEqual(params.has('foo'), false);
   assert.deepStrictEqual([...params], []);
 }
+
+{
+  // Non-throwing MimeType.parse, works for valid
+  const mime = MIMEType.parse('text/plain;Charset=value');
+  assert.strictEqual(mime.params.get('Charset'), 'value');
+  assert.strictEqual(mime.params.get('charset'), 'value');
+  assert.strictEqual(mime.params.get('CHARSET'), 'value');
+  assert.strictEqual(mime.params.has('Charset'), true);
+  assert.strictEqual(`${mime.params}`, 'charset=value');
+
+  // Returns null on Invalid
+  const invalidMime = MIMEType.parse('text plain');
+  assert.strictEqual(invalidMime, null);
+}

From 28cad47cefb0c5e869e7f58bbb9c6e0fa6bb671a Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Wed, 5 Aug 2026 09:57:43 -0400
Subject: [PATCH 023/344] test: update WPT for WebCryptoAPI to 82c3d9069c

PR-URL: https://github.com/nodejs/node/pull/64977
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .../wpt/WebCryptoAPI/WEB_FEATURES.yml         |    5 +-
 .../derive_bits_keys/cfrg_curves.js           |  128 ++
 .../derive_bits_keys/cfrg_curves_bits.js      |  224 +---
 .../cfrg_curves_bits_curve25519.https.any.js  |    2 +
 ...urves_bits_curve448.tentative.https.any.js |    2 +
 .../derive_bits_keys/cfrg_curves_keys.js      |  221 +---
 .../cfrg_curves_keys_curve25519.https.any.js  |    2 +
 ...urves_keys_curve448.tentative.https.any.js |    2 +
 .../WebCryptoAPI/derive_bits_keys/derive.js   |  169 +++
 .../wpt/WebCryptoAPI/derive_bits_keys/ecdh.js |   79 ++
 .../derive_bits_keys/ecdh_bits.https.any.js   |    3 +
 .../derive_bits_keys/ecdh_bits.js             |  232 +---
 .../derive_bits_keys/ecdh_fixtures.js         |   32 +
 .../derive_bits_keys/ecdh_keys.https.any.js   |    3 +
 .../derive_bits_keys/ecdh_keys.js             |  211 +---
 .../derive_bits_keys/hkdf.https.any.js        |    1 +
 .../wpt/WebCryptoAPI/derive_bits_keys/hkdf.js |  315 +----
 .../wpt/WebCryptoAPI/derive_bits_keys/kdf.js  |  209 ++++
 .../derive_bits_keys/pbkdf2.https.any.js      |    1 +
 .../WebCryptoAPI/derive_bits_keys/pbkdf2.js   |  298 +----
 .../digest/cshake.tentative.https.any.js      |  115 +-
 .../WebCryptoAPI/digest/digest.https.any.js   |  134 +--
 .../wpt/WebCryptoAPI/digest/digest.js         |   92 ++
 .../WebCryptoAPI/digest/digest_test_data.js   |   25 +
 .../kangarootwelve.tentative.https.any.js     |  172 +--
 .../digest/sha3.tentative.https.any.js        |  109 +-
 .../digest/turboshake.tentative.https.any.js  |  169 +--
 .../wpt/WebCryptoAPI/digest/xof_digest.js     |  146 +++
 .../encap_decap_bits.tentative.https.any.js   |    4 +-
 .../encap_decap_keys.tentative.https.any.js   |    4 +-
 .../wpt/WebCryptoAPI/encrypt_decrypt/aes.js   |    8 +-
 .../encrypt_decrypt/aes_cbc.https.any.js      |    1 +
 .../encrypt_decrypt/aes_cbc_vectors.js        |   56 +-
 .../encrypt_decrypt/aes_common_fixtures.js    |   57 +
 .../encrypt_decrypt/aes_ctr.https.any.js      |    1 +
 .../encrypt_decrypt/aes_ctr_vectors.js        |   56 +-
 .../encrypt_decrypt/aes_gcm.https.any.js      |    1 +
 .../aes_gcm_256_iv.https.any.js               |    1 +
 .../aes_gcm_256_iv_fixtures.js                |   62 +-
 .../encrypt_decrypt/aes_gcm_96_iv_fixtures.js |   62 +-
 .../aes_ocb.tentative.https.any.js            |    1 +
 .../encrypt_decrypt/aes_ocb_fixtures.js       |   59 +-
 .../wpt/WebCryptoAPI/encrypt_decrypt/rsa.js   |   20 +-
 .../encrypt_decrypt/rsa_oaep.https.any.js     |    1 +
 .../encrypt_decrypt/rsa_vectors.js            |    5 +-
 .../generateKey/algorithm_registry.js         |   36 +
 .../wpt/WebCryptoAPI/generateKey/failures.js  |   46 +-
 .../generateKey/failures_AES-CBC.https.any.js |    1 +
 .../generateKey/failures_AES-CTR.https.any.js |    1 +
 .../generateKey/failures_AES-GCM.https.any.js |    1 +
 .../generateKey/failures_AES-KW.https.any.js  |    1 +
 .../failures_AES-OCB.tentative.https.any.js   |    1 +
 .../generateKey/failures_ECDH.https.any.js    |    1 +
 .../generateKey/failures_ECDSA.https.any.js   |    1 +
 .../generateKey/failures_Ed25519.https.any.js |    1 +
 .../failures_Ed448.tentative.https.any.js     |    1 +
 .../generateKey/failures_HMAC.https.any.js    |    1 +
 .../failures_ML-DSA.tentative.https.any.js    |    1 +
 .../failures_ML-KEM.tentative.https.any.js    |    1 +
 .../failures_RSA-OAEP.https.any.js            |    1 +
 .../generateKey/failures_RSA-PSS.https.any.js |    1 +
 .../failures_RSASSA-PKCS1-v1_5.https.any.js   |    1 +
 .../generateKey/failures_X25519.https.any.js  |    1 +
 .../failures_X448.tentative.https.any.js      |    1 +
 ...s_chacha20_poly1305.tentative.https.any.js |    1 +
 .../failures_kmac.tentative.https.any.js      |    1 +
 .../wpt/WebCryptoAPI/generateKey/successes.js |   40 +-
 .../successes_AES-CBC.https.any.js            |    1 +
 .../successes_AES-CTR.https.any.js            |    1 +
 .../successes_AES-GCM.https.any.js            |    1 +
 .../generateKey/successes_AES-KW.https.any.js |    1 +
 .../successes_AES-OCB.tentative.https.any.js  |    1 +
 .../generateKey/successes_ECDH.https.any.js   |    1 +
 .../generateKey/successes_ECDSA.https.any.js  |    1 +
 .../successes_Ed25519.https.any.js            |    1 +
 .../successes_Ed448.tentative.https.any.js    |    1 +
 .../generateKey/successes_HMAC.https.any.js   |    1 +
 .../successes_ML-DSA.tentative.https.any.js   |    1 +
 .../successes_ML-KEM.tentative.https.any.js   |    1 +
 .../successes_RSA-OAEP.https.any.js           |    1 +
 .../successes_RSA-PSS.https.any.js            |    1 +
 .../successes_RSASSA-PKCS1-v1_5.https.any.js  |    1 +
 .../generateKey/successes_X25519.https.any.js |    1 +
 .../successes_X448.tentative.https.any.js     |    1 +
 ...s_chacha20_poly1305.tentative.https.any.js |    1 +
 .../successes_kmac.tentative.https.any.js     |    1 +
 .../wpt/WebCryptoAPI/getRandomValues.any.js   |    2 +-
 .../ML-DSA_importKey.tentative.https.any.js   |    3 +-
 .../ML-DSA_importKey_fixtures.js              |  404 +------
 .../import_export/ML-KEM_importKey.js         |  130 --
 .../ML-KEM_importKey.tentative.https.any.js   |    2 +-
 .../import_export/ec_importKey.https.any.js   |   52 +-
 .../ec_importKey_failures_ECDH.https.any.js   |    1 +
 .../ec_importKey_failures_ECDSA.https.any.js  |    1 +
 .../ec_importKey_failures_fixtures.js         |  239 +---
 .../import_export/importKey_failures.js       |    9 +-
 .../{ML-DSA_importKey.js => ml_importKey.js}  |    1 +
 .../okp_importKey_Ed25519.https.any.js        |    1 +
 ...okp_importKey_Ed448.tentative.https.any.js |    1 +
 .../okp_importKey_X25519.https.any.js         |    1 +
 .../okp_importKey_X448.tentative.https.any.js |    1 +
 ...kp_importKey_failures_Ed25519.https.any.js |    1 +
 ...tKey_failures_Ed448.tentative.https.any.js |    1 +
 ...okp_importKey_failures_X25519.https.any.js |    1 +
 ...rtKey_failures_X448.tentative.https.any.js |    1 +
 .../okp_importKey_failures_fixtures.js        |  477 +-------
 .../import_export/okp_importKey_fixtures.js   |   59 +-
 .../sign_verify/ecdsa.https.any.js            |    1 +
 .../wpt/WebCryptoAPI/sign_verify/ecdsa.js     |  721 ++----------
 .../wpt/WebCryptoAPI/sign_verify/eddsa.js     |  341 +-----
 .../sign_verify/eddsa_curve25519.https.any.js |    1 +
 .../eddsa_curve448.tentative.https.any.js     |    1 +
 .../sign_verify/hmac.https.any.js             |    1 +
 .../wpt/WebCryptoAPI/sign_verify/hmac.js      |  499 +-------
 .../wpt/WebCryptoAPI/sign_verify/kmac.js      |  601 +---------
 .../sign_verify/kmac.tentative.https.any.js   |    1 +
 .../wpt/WebCryptoAPI/sign_verify/mac.js       |  514 ++++++++
 .../wpt/WebCryptoAPI/sign_verify/mldsa.js     | 1042 +----------------
 .../sign_verify/mldsa.tentative.https.any.js  |    2 +
 .../WebCryptoAPI/sign_verify/mldsa_vectors.js |  391 +------
 .../wpt/WebCryptoAPI/sign_verify/rsa.js       |  667 ++---------
 .../sign_verify/rsa_pkcs.https.any.js         |    2 +
 .../sign_verify/rsa_pkcs_vectors.js           |    5 +-
 .../sign_verify/rsa_pss.https.any.js          |    2 +
 .../sign_verify/rsa_pss_vectors.js            |    5 +-
 .../wpt/WebCryptoAPI/sign_verify/signature.js |  368 ++++++
 .../supports-modern.tentative.https.any.js    |   67 +-
 .../supports.tentative.https.any.js           |   60 +-
 .../wpt/WebCryptoAPI/util/ec_key_fixtures.js  |   50 +
 .../fixtures/wpt/WebCryptoAPI/util/helpers.js |  133 ++-
 .../WebCryptoAPI/util/mldsa_key_fixtures.js   |  394 +++++++
 .../wpt/WebCryptoAPI/util/okp_key_fixtures.js |   58 +
 .../wpt/WebCryptoAPI/util/rsa_key_fixtures.js |    6 +
 .../wpt/WebCryptoAPI/util/supports.js         |   74 ++
 .../wrapKey_unwrapKey.https.any.js            |    4 +-
 .../wrapKey_unwrapKey_vectors.js              |   44 +-
 test/fixtures/wpt/versions.json               |    2 +-
 137 files changed, 3182 insertions(+), 7923 deletions(-)
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_fixtures.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/kdf.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/digest/digest.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/digest/digest_test_data.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/digest/xof_digest.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_common_fixtures.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
 delete mode 100644 test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.js
 rename test/fixtures/wpt/WebCryptoAPI/import_export/{ML-DSA_importKey.js => ml_importKey.js} (98%)
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/sign_verify/mac.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/sign_verify/signature.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/util/ec_key_fixtures.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/util/mldsa_key_fixtures.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/util/okp_key_fixtures.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/util/rsa_key_fixtures.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/util/supports.js

diff --git a/test/fixtures/wpt/WebCryptoAPI/WEB_FEATURES.yml b/test/fixtures/wpt/WebCryptoAPI/WEB_FEATURES.yml
index 6f47b86ed48f..036774d5563e 100644
--- a/test/fixtures/wpt/WebCryptoAPI/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/WebCryptoAPI/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: web-cryptography
-  files: '**'
+rules:
+- "**": [web-cryptography]
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves.js
new file mode 100644
index 000000000000..25113bfe04a1
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves.js
@@ -0,0 +1,128 @@
+async function defineCfrgTests(algorithmName, operation) {
+    const subtle = self.crypto.subtle;
+    const isDeriveBits = operation === "deriveBits";
+
+    kSmallOrderPoint[algorithmName].forEach(test => {
+        promise_test(async() => {
+            let privateKey;
+            let publicKey;
+            let derived;
+            let error;
+
+            try {
+                privateKey = await subtle.importKey(
+                    "pkcs8",
+                    pkcs8[algorithmName],
+                    {name: algorithmName},
+                    false,
+                    ["deriveBits", "deriveKey"]
+                );
+                publicKey = await subtle.importKey(
+                    "spki",
+                    test.vector,
+                    {name: algorithmName},
+                    false,
+                    []
+                );
+                derived = isDeriveBits
+                    ? await subtle.deriveBits(
+                        {name: algorithmName, public: publicKey},
+                        privateKey,
+                        8 * sizes[algorithmName]
+                    )
+                    : await subtle.deriveKey(
+                        {name: algorithmName, public: publicKey},
+                        privateKey,
+                        {name: "HMAC", hash: "SHA-256", length: 256},
+                        true,
+                        ["sign", "verify"]
+                    );
+            } catch (caught) {
+                error = caught;
+            }
+
+            assert_not_equals(privateKey, undefined, "Private key should be valid.");
+            assert_not_equals(publicKey, undefined, "Public key should be valid.");
+            assert_not_equals(error, undefined, "Operation should fail.");
+            assert_equals(
+                error.name,
+                "OperationError",
+                "Should throw correct error, not " + error.name + ": " + error.message + "."
+            );
+            assert_equals(derived, undefined, "Operation succeeded, but should not have.");
+        }, algorithmName +
+            (isDeriveBits ? " key derivation" : " deriveBits") +
+            " checks for all-zero value result with a key of order " + test.order);
+    });
+
+    if (!isDeriveBits) {
+        promise_test(async() => {
+            const key = await subtle.generateKey(
+                {name: algorithmName},
+                true,
+                ["deriveKey", "deriveBits"]
+            );
+            const derived = await subtle.deriveKey(
+                {name: algorithmName, public: key.publicKey},
+                key.privateKey,
+                {name: "HMAC", hash: "SHA-256", length: 256},
+                true,
+                ["sign", "verify"]
+            );
+            assert_not_equals(derived, undefined, "Key derivation failed.");
+        }, "Key derivation using a " + algorithmName + " generated keys.");
+    }
+
+    const noUsage = isDeriveBits ? ["deriveKey"] : ["deriveBits"];
+    const [
+        privateKey,
+        noUsagePrivateKey,
+        publicKey,
+        ecdhPublicKey,
+    ] = await Promise.all([
+        subtle.importKey(
+            "pkcs8",
+            pkcs8[algorithmName],
+            {name: algorithmName},
+            false,
+            ["deriveBits", "deriveKey"]
+        ),
+        subtle.importKey(
+            "pkcs8",
+            pkcs8[algorithmName],
+            {name: algorithmName},
+            false,
+            noUsage
+        ),
+        subtle.importKey(
+            "spki",
+            spki[algorithmName],
+            {name: algorithmName},
+            false,
+            []
+        ),
+        subtle.importKey(
+            "spki",
+            ecSPKI,
+            {name: "ECDH", namedCurve: "P-256"},
+            false,
+            []
+        ),
+    ]);
+
+    registerDeriveTests({
+        operation,
+        algorithmName,
+        mixedCaseName: algorithmName.toLowerCase(),
+        size: sizes[algorithmName],
+        derivation: derivations[algorithmName],
+        privateKey,
+        publicKey,
+        noUsagePrivateKey,
+        invalidPublicKeys: [{
+            name: algorithmName + " mismatched algorithms",
+            key: ecdhPublicKey,
+        }],
+        missingPublicLabel: algorithmName + " missing public property",
+    });
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits.js
index 1406e8bf0a19..c3826a295e62 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits.js
@@ -1,227 +1,7 @@
 function define_tests_25519() {
-    return define_tests("X25519");
+    return defineCfrgTests("X25519", "deriveBits");
 }
 
 function define_tests_448() {
-    return define_tests("X448");
-}
-
-function define_tests(algorithmName) {
-  // May want to test prefixed implementations.
-  var subtle = self.crypto.subtle;
-
-  // Verify the derive functions perform checks against the all-zero value results,
-  // ensuring small-order points are rejected.
-  // https://www.rfc-editor.org/rfc/rfc7748#section-6.1
-  {
-      kSmallOrderPoint[algorithmName].forEach(function(test) {
-          promise_test(async() => {
-              let derived;
-              let privateKey;
-              let publicKey;
-              try {
-                  privateKey = await subtle.importKey("pkcs8", pkcs8[algorithmName],
-                                                  {name: algorithmName},
-                                                  false, ["deriveBits", "deriveKey"]);
-                  publicKey = await subtle.importKey("spki", test.vector,
-                                                 {name: algorithmName},
-                                                 false, [])
-                  derived = await subtle.deriveBits({name: algorithmName, public: publicKey}, privateKey, 8 * sizes[algorithmName]);
-              } catch (err) {
-                  assert_true(privateKey !== undefined, "Private key should be valid.");
-                  assert_true(publicKey !== undefined, "Public key should be valid.");
-                  assert_equals(err.name, "OperationError", "Should throw correct error, not " + err.name + ": " + err.message + ".");
-              }
-              assert_equals(derived, undefined, "Operation succeeded, but should not have.");
-          }, algorithmName + " key derivation checks for all-zero value result with a key of order " + test.order);
-      });
-  }
-
-  return importKeys(pkcs8, spki, sizes)
-  .then(function(results) {
-      publicKeys = results.publicKeys;
-      privateKeys = results.privateKeys;
-      noDeriveBitsKeys = results.noDeriveBitsKeys;
-      ecdhKeys = results.ecdhKeys;
-
-      {
-          // Basic success case
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: publicKeys[algorithmName]}, privateKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_true(equalBuffers(derivation, derivations[algorithmName]), "Derived correct bits");
-              }, function(err) {
-                  assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " good parameters");
-
-          // Case insensitivity check
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName.toLowerCase(), public: publicKeys[algorithmName]}, privateKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_true(equalBuffers(derivation, derivations[algorithmName]), "Derived correct bits");
-              }, function(err) {
-                  assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " mixed case parameters");
-
-          // Shorter than entire derivation per algorithm
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: publicKeys[algorithmName]}, privateKeys[algorithmName], 8 * sizes[algorithmName] - 32)
-              .then(function(derivation) {
-                  assert_true(equalBuffers(derivation, derivations[algorithmName], 8 * sizes[algorithmName] - 32), "Derived correct bits");
-              }, function(err) {
-                  assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " short result");
-
-          // Non-multiple of 8
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: publicKeys[algorithmName]}, privateKeys[algorithmName], 8 * sizes[algorithmName] - 11)
-              .then(function(derivation) {
-                  assert_true(equalBuffers(derivation, derivations[algorithmName], 8 * sizes[algorithmName] - 11), "Derived correct bits");
-              }, function(err) {
-                  assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " non-multiple of 8 bits");
-
-          // Errors to test:
-
-          // - missing public property TypeError
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName}, privateKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_unreached("deriveBits succeeded but should have failed with TypeError");
-              }, function(err) {
-                  assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " missing public property");
-
-          // - Non CryptoKey public property TypeError
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: {message: "Not a CryptoKey"}}, privateKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_unreached("deriveBits succeeded but should have failed with TypeError");
-              }, function(err) {
-                  assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " public property of algorithm is not a CryptoKey");
-
-          // - wrong algorithm
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: ecdhKeys[algorithmName]}, privateKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " mismatched algorithms");
-
-          // - No deriveBits usage in baseKey InvalidAccessError
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: publicKeys[algorithmName]}, noDeriveBitsKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " no deriveBits usage for base key");
-
-          // - Use public key for baseKey InvalidAccessError
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: publicKeys[algorithmName]}, publicKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " base key is not a private key");
-
-          // - Use private key for public property InvalidAccessError
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: privateKeys[algorithmName]}, privateKeys[algorithmName], 8 * sizes[algorithmName])
-              .then(function(derivation) {
-                  assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " public property value is a private key");
-
-          // - Use secret key for public property InvalidAccessError
-          promise_test(function(test) {
-              return subtle.generateKey({name: "AES-CBC", length: 128}, true, ["encrypt", "decrypt"])
-              .then(function(secretKey) {
-                  return subtle.deriveBits({name: algorithmName, public: secretKey}, privateKeys[algorithmName], 8 * sizes[algorithmName])
-                  .then(function(derivation) {
-                      assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-                  }, function(err) {
-                      assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                  });
-              });
-          }, algorithmName + " public property value is a secret key");
-
-          // - Length greater than possible for particular curves OperationError
-          promise_test(function(test) {
-              return subtle.deriveBits({name: algorithmName, public: publicKeys[algorithmName]}, privateKeys[algorithmName], 8 * sizes[algorithmName] + 8)
-              .then(function(derivation) {
-                  assert_unreached("deriveBits succeeded but should have failed with OperationError");
-              }, function(err) {
-                  assert_equals(err.name, "OperationError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " asking for too many bits");
-      }
-  });
-
-  function importKeys(pkcs8, spki, sizes) {
-      var privateKeys = {};
-      var publicKeys = {};
-      var noDeriveBitsKeys = {};
-      var ecdhPublicKeys = {};
-
-      var promises = [];
-      {
-          var operation = subtle.importKey("pkcs8", pkcs8[algorithmName],
-                                          {name: algorithmName},
-                                          false, ["deriveBits", "deriveKey"])
-                          .then(function(key) {
-                              privateKeys[algorithmName] = key;
-                            }, function (err) {
-                              privateKeys[algorithmName] = null;
-                          });
-          promises.push(operation);
-      }
-      {
-          var operation = subtle.importKey("pkcs8", pkcs8[algorithmName],
-                                          {name: algorithmName},
-                                          false, ["deriveKey"])
-                          .then(function(key) {
-                              noDeriveBitsKeys[algorithmName] = key;
-                            }, function (err) {
-                              noDeriveBitsKeys[algorithmName] = null;
-                          });
-          promises.push(operation);
-      }
-      {
-          var operation = subtle.importKey("spki", spki[algorithmName],
-                                          {name: algorithmName},
-                                          false, [])
-                          .then(function(key) {
-                              publicKeys[algorithmName] = key;
-                            }, function (err) {
-                              publicKeys[algorithmName] = null;
-                          });
-          promises.push(operation);
-      }
-      {
-          var operation = subtle.importKey("spki", ecSPKI,
-                                           {name: "ECDH", namedCurve: "P-256"},
-                                           false, [])
-                          .then(function(key) {
-                              ecdhPublicKeys[algorithmName] = key;
-                          });
-      }
-      return Promise.all(promises)
-             .then(function(results) {return {privateKeys: privateKeys, publicKeys: publicKeys, noDeriveBitsKeys: noDeriveBitsKeys, ecdhKeys: ecdhPublicKeys}});
-  }
-
+    return defineCfrgTests("X448", "deriveBits");
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve25519.https.any.js
index 5684d7624076..b42565208874 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve25519.https.any.js
@@ -1,6 +1,8 @@
 // META: title=WebCryptoAPI: deriveKey() Using ECDH with CFRG Elliptic Curves
 // META: script=../util/helpers.js
 // META: script=cfrg_curves_bits_fixtures.js
+// META: script=derive.js
+// META: script=cfrg_curves.js
 // META: script=cfrg_curves_bits.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js
index 5e482ef0b9d8..cda5ba87fba0 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js
@@ -1,6 +1,8 @@
 // META: title=WebCryptoAPI: deriveKey() Using ECDH with CFRG Elliptic Curves
 // META: script=../util/helpers.js
 // META: script=cfrg_curves_bits_fixtures.js
+// META: script=derive.js
+// META: script=cfrg_curves.js
 // META: script=cfrg_curves_bits.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys.js
index cefc45ac6929..1989c55c903f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys.js
@@ -1,224 +1,7 @@
 function define_tests_25519() {
-    return define_tests("X25519");
+    return defineCfrgTests("X25519", "deriveKey");
 }
 
 function define_tests_448() {
-    return define_tests("X448");
-}
-
-function define_tests(algorithmName) {
-  // May want to test prefixed implementations.
-  var subtle = self.crypto.subtle;
-
-  // Verify the derive functions perform checks against the all-zero value results,
-  // ensuring small-order points are rejected.
-  // https://www.rfc-editor.org/rfc/rfc7748#section-6.1
-  // TODO: The spec states that the check must be done on use, but there is discussion about doing it on import.
-  // https://github.com/WICG/webcrypto-secure-curves/pull/13
-  {
-      kSmallOrderPoint[algorithmName].forEach(function(test) {
-          promise_test(async() => {
-              let derived;
-              let privateKey;
-              let publicKey;
-              try {
-                  privateKey = await subtle.importKey("pkcs8", pkcs8[algorithmName],
-                                                  {name: algorithmName},
-                                                  false, ["deriveBits", "deriveKey"]);
-                  publicKey = await subtle.importKey("spki", test.vector,
-                                                 {name: algorithmName},
-                                                 false, [])
-                  derived = await subtle.deriveKey({name: algorithmName, public: publicKey}, privateKey,
-                                                   {name: "HMAC", hash: "SHA-256", length: 256}, true,
-                                                   ["sign", "verify"]);
-              } catch (err) {
-                  assert_false(privateKey === undefined, "Private key should be valid.");
-                  assert_false(publicKey === undefined, "Public key should be valid.");
-                  assert_equals(err.name, "OperationError", "Should throw correct error, not " + err.name + ": " + err.message + ".");
-              }
-              assert_equals(derived, undefined, "Operation succeeded, but should not have.");
-          }, algorithmName + " deriveBits checks for all-zero value result with a key of order " + test.order);
-      });
-  }
-
-  // Ensure the keys generated by each algorithm are valid for key derivation.
-  {
-      promise_test(async() => {
-          let derived;
-          try {
-              let key = await subtle.generateKey({name: algorithmName}, true, ["deriveKey", "deriveBits"]);
-              derived = await subtle.deriveKey({name: algorithmName, public: key.publicKey}, key.privateKey, {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"]);
-          } catch (err) {
-              assert_unreached("Threw an unexpected error: " + err.toString() + " -");
-          }
-          assert_false (derived === undefined, "Key derivation failed.");
-      }, "Key derivation using a " + algorithmName + " generated keys.");
-  }
-
-  return importKeys(pkcs8, spki, sizes)
-  .then(function(results) {
-      publicKeys = results.publicKeys;
-      privateKeys = results.privateKeys;
-      noDeriveKeyKeys = results.noDeriveKeyKeys;
-      ecdhKeys = results.ecdhKeys;
-
-      {
-          // Basic success case
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName, public: publicKeys[algorithmName]}, privateKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_true(equalBuffers(exportedKey, derivations[algorithmName], 8 * exportedKey.length), "Derived correct key");
-              }, function(err) {
-                  assert_unreached("deriveKey failed with error " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " good parameters");
-
-          // Case insensitivity check
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName.toLowerCase(), public: publicKeys[algorithmName]}, privateKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_true(equalBuffers(exportedKey, derivations[algorithmName], 8 * exportedKey.length), "Derived correct key");
-              }, function(err) {
-                  assert_unreached("deriveKey failed with error " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " mixed case parameters");
-          // Errors to test:
-
-          // - missing public property TypeError
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName}, privateKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_unreached("deriveKey succeeded but should have failed with TypeError");
-              }, function(err) {
-                  assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " missing public property");
-
-          // - Non CryptoKey public property TypeError
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName, public: {message: "Not a CryptoKey"}}, privateKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_unreached("deriveKey succeeded but should have failed with TypeError");
-              }, function(err) {
-                  assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " public property of algorithm is not a CryptoKey");
-
-          // - wrong algorithm
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName, public: ecdhKeys[algorithmName]}, privateKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " mismatched algorithms");
-
-          // - No deriveKey usage in baseKey InvalidAccessError
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName, public: publicKeys[algorithmName]}, noDeriveKeyKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " no deriveKey usage for base key");
-
-          // - Use public key for baseKey InvalidAccessError
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName, public: publicKeys[algorithmName]}, publicKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " base key is not a private key");
-
-          // - Use private key for public property InvalidAccessError
-          promise_test(function(test) {
-              return subtle.deriveKey({name: algorithmName, public: privateKeys[algorithmName]}, privateKeys[algorithmName], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-              .then(function(exportedKey) {
-                  assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-              }, function(err) {
-                  assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-              });
-          }, algorithmName + " public property value is a private key");
-
-          // - Use secret key for public property InvalidAccessError
-          promise_test(function(test) {
-              return subtle.generateKey({name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-              .then(function(secretKey) {
-                  return subtle.deriveKey({name: algorithmName, public: secretKey}, privateKeys[algorithmName], {name: "AES-CBC", length: 256}, true, ["sign", "verify"])
-                  .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                  .then(function(exportedKey) {
-                      assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-                  }, function(err) {
-                      assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                  });
-              });
-          }, algorithmName + " public property value is a secret key");
-      }
-  });
-
-  function importKeys(pkcs8, spki, sizes) {
-      var privateKeys = {};
-      var publicKeys = {};
-      var noDeriveKeyKeys = {};
-      var ecdhPublicKeys = {};
-
-      var promises = [];
-      {
-          var operation = subtle.importKey("pkcs8", pkcs8[algorithmName],
-                                          {name: algorithmName},
-                                          false, ["deriveBits", "deriveKey"])
-                          .then(function(key) {
-                              privateKeys[algorithmName] = key;
-                          }, function (err) {
-                            privateKeys[algorithmName] = null;
-                          });
-          promises.push(operation);
-      }
-      {
-          var operation = subtle.importKey("pkcs8", pkcs8[algorithmName],
-                                          {name: algorithmName},
-                                          false, ["deriveBits"])
-                          .then(function(key) {
-                              noDeriveKeyKeys[algorithmName] = key;
-                          }, function (err) {
-                            noDeriveKeyKeys[algorithmName] = null;
-                          });
-          promises.push(operation);
-      }
-      {
-          var operation = subtle.importKey("spki", spki[algorithmName],
-                                          {name: algorithmName},
-                                          false, [])
-                          .then(function(key) {
-                              publicKeys[algorithmName] = key;
-                          }, function (err) {
-                            publicKeys[algorithmName] = null;
-                          });
-          promises.push(operation);
-      }
-      {
-          var operation = subtle.importKey("spki", ecSPKI,
-                                           {name: "ECDH", namedCurve: "P-256"},
-                                           false, [])
-                          .then(function(key) {
-                              ecdhPublicKeys[algorithmName] = key;
-                          });
-      }
-
-      return Promise.all(promises)
-             .then(function(results) {return {privateKeys: privateKeys, publicKeys: publicKeys, noDeriveKeyKeys: noDeriveKeyKeys, ecdhKeys: ecdhPublicKeys}});
-  }
-
+    return defineCfrgTests("X448", "deriveKey");
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js
index 8bcc201d4e95..683ae21bac9f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js
@@ -1,6 +1,8 @@
 // META: title=WebCryptoAPI: deriveKey() Using ECDH with CFRG Elliptic Curves
 // META: script=../util/helpers.js
 // META: script=cfrg_curves_bits_fixtures.js
+// META: script=derive.js
+// META: script=cfrg_curves.js
 // META: script=cfrg_curves_keys.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js
index 0ed3954ac200..38a5ce1db5b2 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js
@@ -1,6 +1,8 @@
 // META: title=WebCryptoAPI: deriveKey() Using ECDH with CFRG Elliptic Curves
 // META: script=../util/helpers.js
 // META: script=cfrg_curves_bits_fixtures.js
+// META: script=derive.js
+// META: script=cfrg_curves.js
 // META: script=cfrg_curves_keys.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
new file mode 100644
index 000000000000..16c9ec6407bb
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
@@ -0,0 +1,169 @@
+function registerDeriveTests(options) {
+    const {
+        operation,
+        algorithmName,
+        testName = algorithmName,
+        mixedCaseName,
+        size,
+        derivation,
+        privateKey,
+        publicKey,
+        noUsagePrivateKey,
+        invalidPublicKeys,
+        missingPublicLabel,
+    } = options;
+    const subtle = self.crypto.subtle;
+    const isDeriveBits = operation === "deriveBits";
+    const derivedKeyAlgorithm = {name: "HMAC", hash: "SHA-256", length: 256};
+    const derivedKeyUsages = ["sign", "verify"];
+
+    function derive(name, publicKey, baseKey, length = 8 * size, keyOptions = {}) {
+        const algorithm = {name, public: publicKey};
+        if (isDeriveBits) {
+            return subtle.deriveBits(algorithm, baseKey, length);
+        }
+
+        return subtle.deriveKey(
+            algorithm,
+            baseKey,
+            keyOptions.algorithm || derivedKeyAlgorithm,
+            true,
+            keyOptions.usages || derivedKeyUsages
+        ).then(key => subtle.exportKey("raw", key));
+    }
+
+    function assertDerived(result, length) {
+        if (isDeriveBits) {
+            assert_true(equalBuffers(result, derivation, length), "Derived correct bits");
+        } else {
+            assert_array_equals(
+                new Uint8Array(result),
+                derivation.slice(0, 32),
+                "Derived correct key"
+            );
+        }
+    }
+
+    function successTest(name, algorithm, length = 8 * size) {
+        promise_test(() => {
+            return derive(algorithm, publicKey, privateKey, length).then(
+                result => assertDerived(result, length),
+                error => assert_unreached(
+                    operation + " failed with error " + error.name + ": " + error.message
+                )
+            );
+        }, name);
+    }
+
+    function failureTest(name, expectedError, deriveOperation) {
+        promise_test(() => {
+            return Promise.resolve().then(deriveOperation).then(
+                () => assert_unreached(
+                    operation + " succeeded but should have failed with " + expectedError
+                ),
+                error => assert_equals(
+                    error.name,
+                    expectedError,
+                    "Should throw correct error, not " + error.name + ": " + error.message
+                )
+            );
+        }, name);
+    }
+
+    successTest(testName + " good parameters", algorithmName);
+    successTest(testName + " mixed case parameters", mixedCaseName);
+
+    if (isDeriveBits) {
+        successTest(testName + " short result", algorithmName, 8 * size - 32);
+        successTest(
+            testName + " non-multiple of 8 bits",
+            algorithmName,
+            8 * size - 11
+        );
+    }
+
+    failureTest(missingPublicLabel, "TypeError", () => {
+        return subtle[operation](
+            {name: algorithmName},
+            privateKey,
+            ...(isDeriveBits
+                ? [8 * size]
+                : [derivedKeyAlgorithm, true, derivedKeyUsages])
+        );
+    });
+
+    failureTest(
+        testName + " public property of algorithm is not a CryptoKey",
+        "TypeError",
+        () => derive(algorithmName, {message: "Not a CryptoKey"}, privateKey)
+    );
+
+    invalidPublicKeys.forEach(test => {
+        failureTest(
+            test.name,
+            "InvalidAccessError",
+            () => derive(algorithmName, test.key, privateKey)
+        );
+    });
+
+    failureTest(
+        testName + " no " + operation + " usage for base key",
+        "InvalidAccessError",
+        () => derive(algorithmName, publicKey, noUsagePrivateKey)
+    );
+
+    failureTest(
+        testName + " base key is not a private key",
+        "InvalidAccessError",
+        () => derive(algorithmName, publicKey, publicKey)
+    );
+
+    failureTest(
+        testName + " public property value is a private key",
+        "InvalidAccessError",
+        () => derive(algorithmName, privateKey, privateKey)
+    );
+
+    promise_test(async() => {
+        const secretKey = isDeriveBits
+            ? await subtle.generateKey(
+                {name: "AES-CBC", length: 128},
+                true,
+                ["encrypt", "decrypt"]
+            )
+            : await subtle.generateKey(
+                derivedKeyAlgorithm,
+                true,
+                derivedKeyUsages
+            );
+        const keyOptions = isDeriveBits ? {} : {
+            algorithm: {name: "AES-CBC", length: 256},
+            usages: ["sign", "verify"],
+        };
+
+        return derive(
+            algorithmName,
+            secretKey,
+            privateKey,
+            8 * size,
+            keyOptions
+        ).then(
+            () => assert_unreached(
+                operation + " succeeded but should have failed with InvalidAccessError"
+            ),
+            error => assert_equals(
+                error.name,
+                "InvalidAccessError",
+                "Should throw correct error, not " + error.name + ": " + error.message
+            )
+        );
+    }, testName + " public property value is a secret key");
+
+    if (isDeriveBits) {
+        failureTest(
+            testName + " asking for too many bits",
+            "OperationError",
+            () => derive(algorithmName, publicKey, privateKey, 8 * size + 8)
+        );
+    }
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
new file mode 100644
index 000000000000..99039f250c2c
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
@@ -0,0 +1,79 @@
+async function defineEcdhTests(operation) {
+    const subtle = self.crypto.subtle;
+    const fixtures = getEcdhTestFixtures();
+    const curves = Object.keys(fixtures.sizes);
+    const keys = {};
+
+    await Promise.all(curves.map(async namedCurve => {
+        const algorithm = {name: "ECDH", namedCurve};
+        const noUsage = operation === "deriveBits" ? ["deriveKey"] : ["deriveBits"];
+        const [
+            privateKey,
+            noUsagePrivateKey,
+            publicKey,
+            ecdsaKeyPair,
+        ] = await Promise.all([
+            subtle.importKey(
+                "pkcs8",
+                fixtures.pkcs8[namedCurve],
+                algorithm,
+                false,
+                ["deriveBits", "deriveKey"]
+            ),
+            subtle.importKey(
+                "pkcs8",
+                fixtures.pkcs8[namedCurve],
+                algorithm,
+                false,
+                noUsage
+            ),
+            subtle.importKey(
+                "spki",
+                fixtures.spki[namedCurve],
+                algorithm,
+                false,
+                []
+            ),
+            subtle.generateKey(
+                {name: "ECDSA", namedCurve},
+                false,
+                ["sign", "verify"]
+            ),
+        ]);
+
+        keys[namedCurve] = {
+            privateKey,
+            noUsagePrivateKey,
+            publicKey,
+            ecdsaKeyPair,
+        };
+    }));
+
+    curves.forEach(namedCurve => {
+        const otherCurve = namedCurve === "P-256" ? "P-384" : "P-256";
+        const key = keys[namedCurve];
+        registerDeriveTests({
+            operation,
+            algorithmName: "ECDH",
+            testName: namedCurve,
+            mixedCaseName: "EcDh",
+            size: fixtures.sizes[namedCurve],
+            derivation: fixtures.derivations[namedCurve],
+            privateKey: key.privateKey,
+            publicKey: key.publicKey,
+            noUsagePrivateKey: key.noUsagePrivateKey,
+            invalidPublicKeys: [
+                {
+                    name: namedCurve + " mismatched curves",
+                    key: keys[otherCurve].publicKey,
+                },
+                {
+                    name: namedCurve +
+                        " public property of algorithm is not an ECDSA public key",
+                    key: key.ecdsaKeyPair.publicKey,
+                },
+            ],
+            missingPublicLabel: namedCurve + " missing public curve",
+        });
+    });
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.https.any.js
index 58a0cecd5efe..38058d6ce723 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.https.any.js
@@ -1,5 +1,8 @@
 // META: title=WebCryptoAPI: deriveBits() Using ECDH
 // META: script=../util/helpers.js
+// META: script=ecdh_fixtures.js
+// META: script=derive.js
+// META: script=ecdh.js
 // META: script=ecdh_bits.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.js
index 8e79909020d3..bbe48b5e2859 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_bits.js
@@ -1,233 +1,3 @@
-
 function define_tests() {
-    // May want to test prefixed implementations.
-    var subtle = self.crypto.subtle;
-
-    var pkcs8 = {
-        "P-521": new Uint8Array([48, 129, 238, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 129, 214, 48, 129, 211, 2, 1, 1, 4, 66, 1, 166, 126, 211, 33, 145, 90, 100, 170, 53, 155, 125, 100, 141, 220, 38, 24, 250, 142, 141, 24, 103, 232, 247, 24, 48, 177, 13, 37, 237, 40, 145, 250, 241, 47, 60, 126, 117, 66, 26, 46, 162, 100, 249, 169, 21, 50, 13, 39, 79, 225, 71, 7, 66, 185, 132, 233, 107, 152, 145, 32, 129, 250, 205, 71, 141, 161, 129, 137, 3, 129, 134, 0, 4, 0, 32, 157, 72, 63, 40, 102, 104, 129, 198, 100, 31, 58, 18, 111, 64, 15, 81, 228, 101, 17, 112, 254, 103, 140, 117, 232, 87, 18, 226, 134, 138, 220, 133, 8, 36, 153, 123, 235, 240, 188, 130, 180, 48, 40, 166, 210, 236, 23, 119, 202, 69, 39, 159, 114, 6, 163, 234, 139, 92, 210, 7, 63, 73, 62, 69, 0, 12, 181, 76, 58, 90, 202, 162, 104, 197, 103, 16, 66, 136, 120, 217, 139, 138, 251, 246, 138, 97, 33, 83, 99, 40, 70, 216, 7, 233, 38, 114, 105, 143, 27, 156, 97, 29, 231, 211, 142, 52, 205, 108, 115, 136, 144, 146, 197, 110, 82, 214, 128, 241, 223, 208, 146, 184, 122, 200, 239, 159, 243, 200, 251, 72]),
-        "P-256": new Uint8Array([48, 129, 135, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 109, 48, 107, 2, 1, 1, 4, 32, 15, 247, 79, 232, 241, 202, 175, 97, 92, 206, 241, 29, 217, 53, 114, 87, 98, 217, 216, 65, 236, 186, 185, 94, 170, 38, 68, 123, 52, 100, 245, 113, 161, 68, 3, 66, 0, 4, 140, 96, 11, 44, 102, 25, 45, 97, 158, 39, 210, 37, 107, 59, 151, 118, 178, 141, 30, 5, 246, 13, 234, 189, 98, 174, 123, 154, 211, 157, 224, 217, 59, 4, 102, 109, 199, 119, 14, 126, 207, 13, 211, 203, 203, 211, 110, 221, 107, 94, 220, 153, 81, 7, 55, 161, 237, 104, 46, 205, 112, 244, 10, 47]),
-        "P-384": new Uint8Array([48, 129, 182, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 129, 158, 48, 129, 155, 2, 1, 1, 4, 48, 248, 113, 165, 102, 101, 137, 193, 74, 87, 71, 38, 62, 248, 91, 49, 156, 192, 35, 219, 110, 53, 103, 108, 61, 120, 30, 239, 139, 5, 95, 207, 190, 134, 250, 13, 6, 208, 86, 181, 25, 95, 177, 50, 58, 248, 222, 37, 179, 161, 100, 3, 98, 0, 4, 241, 25, 101, 223, 125, 212, 89, 77, 4, 25, 197, 8, 100, 130, 163, 184, 38, 185, 121, 127, 155, 224, 189, 13, 16, 156, 158, 30, 153, 137, 193, 185, 169, 43, 143, 38, 159, 152, 225, 122, 209, 132, 186, 115, 193, 247, 151, 98, 175, 69, 175, 129, 65, 96, 38, 66, 218, 39, 26, 107, 176, 255, 235, 12, 180, 71, 143, 207, 112, 126, 102, 26, 166, 214, 205, 245, 21, 73, 200, 140, 63, 19, 11, 233, 232, 32, 31, 111, 106, 9, 244, 24, 90, 175, 149, 196])
-    };
-
-    var spki = {
-        "P-521": new Uint8Array([48, 129, 155, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 129, 134, 0, 4, 0, 238, 105, 249, 71, 21, 215, 1, 233, 226, 1, 19, 51, 212, 244, 249, 108, 186, 125, 145, 248, 139, 17, 43, 175, 117, 207, 9, 204, 31, 138, 202, 151, 97, 141, 169, 56, 152, 34, 210, 155, 111, 233, 153, 106, 97, 32, 62, 247, 82, 183, 113, 232, 149, 143, 196, 103, 123, 179, 119, 133, 101, 171, 96, 214, 237, 0, 222, 171, 103, 97, 137, 91, 147, 94, 58, 211, 37, 251, 133, 73, 229, 111, 19, 120, 106, 167, 63, 136, 162, 236, 254, 64, 147, 52, 115, 216, 174, 242, 64, 196, 223, 215, 213, 6, 242, 44, 221, 14, 85, 85, 143, 63, 191, 5, 235, 247, 239, 239, 122, 114, 215, 143, 70, 70, 155, 132, 72, 242, 110, 39, 18]),
-        "P-256": new Uint8Array([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 154, 116, 32, 120, 126, 95, 77, 105, 211, 232, 34, 114, 115, 1, 109, 56, 224, 71, 129, 133, 223, 127, 238, 156, 142, 103, 60, 202, 211, 79, 126, 128, 254, 49, 141, 182, 221, 107, 119, 218, 99, 32, 165, 246, 151, 89, 9, 68, 23, 177, 52, 239, 138, 139, 116, 193, 101, 4, 57, 198, 115, 0, 90, 61]),
-        "P-384": new Uint8Array([48, 118, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 98, 0, 4, 145, 130, 45, 194, 175, 89, 193, 143, 91, 103, 248, 13, 246, 26, 38, 3, 194, 168, 240, 179, 192, 175, 130, 45, 99, 194, 121, 112, 26, 130, 69, 96, 64, 68, 1, 221, 233, 165, 110, 229, 39, 87, 234, 139, 199, 72, 212, 200, 43, 83, 55, 180, 141, 123, 101, 88, 58, 61, 87, 36, 56, 136, 0, 54, 186, 198, 115, 15, 66, 202, 82, 120, 150, 107, 213, 242, 30, 134, 226, 29, 48, 197, 166, 208, 70, 62, 197, 19, 221, 80, 159, 252, 220, 175, 31, 245])
-    };
-
-    var sizes = {
-        "P-521": 66,
-        "P-256": 32,
-        "P-384": 48
-    };
-
-    var derivations = {
-        "P-521": new Uint8Array([0, 156, 43, 206, 87, 190, 128, 173, 171, 59, 7, 56, 91, 142, 89, 144, 235, 125, 111, 222, 189, 176, 27, 243, 83, 113, 164, 246, 7, 94, 157, 40, 138, 193, 42, 109, 254, 3, 170, 87, 67, 188, 129, 112, 157, 73, 168, 34, 148, 2, 25, 182, 75, 118, 138, 205, 82, 15, 161, 54, 142, 160, 175, 141, 71, 93]),
-        "P-256": new Uint8Array([14, 143, 60, 77, 177, 178, 162, 131, 115, 90, 0, 220, 87, 31, 26, 232, 151, 28, 227, 35, 250, 17, 131, 137, 203, 95, 65, 196, 59, 61, 181, 161]),
-        "P-384": new Uint8Array([224, 189, 107, 206, 10, 239, 140, 164, 136, 56, 166, 226, 252, 197, 126, 103, 185, 197, 232, 134, 12, 95, 11, 233, 218, 190, 197, 62, 69, 78, 24, 160, 161, 116, 196, 136, 136, 162, 100, 136, 17, 91, 45, 201, 241, 223, 165, 45])
-    };
-
-    return importKeys(pkcs8, spki, sizes)
-    .then(function(results) {
-        publicKeys = results.publicKeys;
-        privateKeys = results.privateKeys;
-        ecdsaKeyPairs = results.ecdsaKeyPairs;
-        noDeriveBitsKeys = results.noDeriveBitsKeys;
-
-        Object.keys(sizes).forEach(function(namedCurve) {
-            // Basic success case
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: publicKeys[namedCurve]}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_true(equalBuffers(derivation, derivations[namedCurve]), "Derived correct bits");
-                }, function(err) {
-                    assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " good parameters");
-
-            // Case insensitivity check
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "EcDh", public: publicKeys[namedCurve]}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_true(equalBuffers(derivation, derivations[namedCurve]), "Derived correct bits");
-                }, function(err) {
-                    assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " mixed case parameters");
-
-            // Shorter than entire derivation per algorithm
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: publicKeys[namedCurve]}, privateKeys[namedCurve], 8 * sizes[namedCurve] - 32)
-                .then(function(derivation) {
-                    assert_true(equalBuffers(derivation, derivations[namedCurve], 8 * sizes[namedCurve] - 32), "Derived correct bits");
-                }, function(err) {
-                    assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " short result");
-
-            // Non-multiple of 8
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: publicKeys[namedCurve]}, privateKeys[namedCurve], 8 * sizes[namedCurve] - 11)
-                .then(function(derivation) {
-                    assert_true(equalBuffers(derivation, derivations[namedCurve], 8 * sizes[namedCurve] - 11), "Derived correct bits");
-                }, function(err) {
-                    assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " non-multiple of 8 bits");
-
-            // Errors to test:
-
-            // - missing public property TypeError
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH"}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with TypeError");
-                }, function(err) {
-                    assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " missing public curve");
-
-            // - Non CryptoKey public property TypeError
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: {message: "Not a CryptoKey"}}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with TypeError");
-                }, function(err) {
-                    assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " public property of algorithm is not a CryptoKey");
-
-            // - wrong named curve
-            promise_test(function(test) {
-                publicKey = publicKeys["P-256"];
-                if (namedCurve === "P-256") {
-                    publicKey = publicKeys["P-384"];
-                }
-                return subtle.deriveBits({name: "ECDH", public: publicKey}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " mismatched curves");
-
-            // - not ECDH public property InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: ecdsaKeyPairs[namedCurve].publicKey}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " public property of algorithm is not an ECDSA public key");
-
-            // - No deriveBits usage in baseKey InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: publicKeys[namedCurve]}, noDeriveBitsKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " no deriveBits usage for base key");
-
-            // - Use public key for baseKey InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: publicKeys[namedCurve]}, publicKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " base key is not a private key");
-
-            // - Use private key for public property InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: privateKeys[namedCurve]}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " public property value is a private key");
-
-            // - Use secret key for public property InvalidAccessError
-            promise_test(function(test) {
-                return subtle.generateKey({name: "AES-CBC", length: 128}, true, ["encrypt", "decrypt"])
-                .then(function(secretKey) {
-                    return subtle.deriveBits({name: "ECDH", public: secretKey}, privateKeys[namedCurve], 8 * sizes[namedCurve])
-                    .then(function(derivation) {
-                        assert_unreached("deriveBits succeeded but should have failed with InvalidAccessError");
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                    });
-                });
-            }, namedCurve + " public property value is a secret key");
-
-            // - Length greater than 256, 384, 521 for particular curves OperationError
-            promise_test(function(test) {
-                return subtle.deriveBits({name: "ECDH", public: publicKeys[namedCurve]}, privateKeys[namedCurve], 8 * sizes[namedCurve] + 8)
-                .then(function(derivation) {
-                    assert_unreached("deriveBits succeeded but should have failed with OperationError");
-                }, function(err) {
-                    assert_equals(err.name, "OperationError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " asking for too many bits");
-        });
-    });
-
-    function importKeys(pkcs8, spki, sizes) {
-        var privateKeys = {};
-        var publicKeys = {};
-        var ecdsaKeyPairs = {};
-        var noDeriveBitsKeys = {};
-
-        var promises = [];
-        Object.keys(pkcs8).forEach(function(namedCurve) {
-            var operation = subtle.importKey("pkcs8", pkcs8[namedCurve],
-                                            {name: "ECDH", namedCurve: namedCurve},
-                                            false, ["deriveBits", "deriveKey"])
-                            .then(function(key) {
-                                privateKeys[namedCurve] = key;
-                            }, function (err) {
-                                privateKeys[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-        Object.keys(pkcs8).forEach(function(namedCurve) {
-            var operation = subtle.importKey("pkcs8", pkcs8[namedCurve],
-                                            {name: "ECDH", namedCurve: namedCurve},
-                                            false, ["deriveKey"])
-                            .then(function(key) {
-                                noDeriveBitsKeys[namedCurve] = key;
-                            }, function (err) {
-                                noDeriveBitsKeys[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-        Object.keys(spki).forEach(function(namedCurve) {
-            var operation = subtle.importKey("spki", spki[namedCurve],
-                                            {name: "ECDH", namedCurve: namedCurve},
-                                            false, [])
-                            .then(function(key) {
-                                publicKeys[namedCurve] = key;
-                            }, function (err) {
-                                publicKeys[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-        Object.keys(sizes).forEach(function(namedCurve) {
-            var operation = subtle.generateKey({name: "ECDSA", namedCurve: namedCurve}, false, ["sign", "verify"])
-                            .then(function(keyPair) {
-                                ecdsaKeyPairs[namedCurve] = keyPair;
-                            }, function (err) {
-                                ecdsaKeyPairs[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-
-        return Promise.all(promises)
-               .then(function(results) {return {privateKeys: privateKeys, publicKeys: publicKeys, ecdsaKeyPairs: ecdsaKeyPairs, noDeriveBitsKeys: noDeriveBitsKeys}});
-    }
-
+    return defineEcdhTests("deriveBits");
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_fixtures.js
new file mode 100644
index 000000000000..46539d548da7
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_fixtures.js
@@ -0,0 +1,32 @@
+function getEcdhTestFixtures() {
+    var pkcs8 = {
+        "P-521": new Uint8Array([48, 129, 238, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 129, 214, 48, 129, 211, 2, 1, 1, 4, 66, 1, 166, 126, 211, 33, 145, 90, 100, 170, 53, 155, 125, 100, 141, 220, 38, 24, 250, 142, 141, 24, 103, 232, 247, 24, 48, 177, 13, 37, 237, 40, 145, 250, 241, 47, 60, 126, 117, 66, 26, 46, 162, 100, 249, 169, 21, 50, 13, 39, 79, 225, 71, 7, 66, 185, 132, 233, 107, 152, 145, 32, 129, 250, 205, 71, 141, 161, 129, 137, 3, 129, 134, 0, 4, 0, 32, 157, 72, 63, 40, 102, 104, 129, 198, 100, 31, 58, 18, 111, 64, 15, 81, 228, 101, 17, 112, 254, 103, 140, 117, 232, 87, 18, 226, 134, 138, 220, 133, 8, 36, 153, 123, 235, 240, 188, 130, 180, 48, 40, 166, 210, 236, 23, 119, 202, 69, 39, 159, 114, 6, 163, 234, 139, 92, 210, 7, 63, 73, 62, 69, 0, 12, 181, 76, 58, 90, 202, 162, 104, 197, 103, 16, 66, 136, 120, 217, 139, 138, 251, 246, 138, 97, 33, 83, 99, 40, 70, 216, 7, 233, 38, 114, 105, 143, 27, 156, 97, 29, 231, 211, 142, 52, 205, 108, 115, 136, 144, 146, 197, 110, 82, 214, 128, 241, 223, 208, 146, 184, 122, 200, 239, 159, 243, 200, 251, 72]),
+        "P-256": new Uint8Array([48, 129, 135, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 109, 48, 107, 2, 1, 1, 4, 32, 15, 247, 79, 232, 241, 202, 175, 97, 92, 206, 241, 29, 217, 53, 114, 87, 98, 217, 216, 65, 236, 186, 185, 94, 170, 38, 68, 123, 52, 100, 245, 113, 161, 68, 3, 66, 0, 4, 140, 96, 11, 44, 102, 25, 45, 97, 158, 39, 210, 37, 107, 59, 151, 118, 178, 141, 30, 5, 246, 13, 234, 189, 98, 174, 123, 154, 211, 157, 224, 217, 59, 4, 102, 109, 199, 119, 14, 126, 207, 13, 211, 203, 203, 211, 110, 221, 107, 94, 220, 153, 81, 7, 55, 161, 237, 104, 46, 205, 112, 244, 10, 47]),
+        "P-384": new Uint8Array([48, 129, 182, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 129, 158, 48, 129, 155, 2, 1, 1, 4, 48, 248, 113, 165, 102, 101, 137, 193, 74, 87, 71, 38, 62, 248, 91, 49, 156, 192, 35, 219, 110, 53, 103, 108, 61, 120, 30, 239, 139, 5, 95, 207, 190, 134, 250, 13, 6, 208, 86, 181, 25, 95, 177, 50, 58, 248, 222, 37, 179, 161, 100, 3, 98, 0, 4, 241, 25, 101, 223, 125, 212, 89, 77, 4, 25, 197, 8, 100, 130, 163, 184, 38, 185, 121, 127, 155, 224, 189, 13, 16, 156, 158, 30, 153, 137, 193, 185, 169, 43, 143, 38, 159, 152, 225, 122, 209, 132, 186, 115, 193, 247, 151, 98, 175, 69, 175, 129, 65, 96, 38, 66, 218, 39, 26, 107, 176, 255, 235, 12, 180, 71, 143, 207, 112, 126, 102, 26, 166, 214, 205, 245, 21, 73, 200, 140, 63, 19, 11, 233, 232, 32, 31, 111, 106, 9, 244, 24, 90, 175, 149, 196])
+    };
+
+    var spki = {
+        "P-521": new Uint8Array([48, 129, 155, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 129, 134, 0, 4, 0, 238, 105, 249, 71, 21, 215, 1, 233, 226, 1, 19, 51, 212, 244, 249, 108, 186, 125, 145, 248, 139, 17, 43, 175, 117, 207, 9, 204, 31, 138, 202, 151, 97, 141, 169, 56, 152, 34, 210, 155, 111, 233, 153, 106, 97, 32, 62, 247, 82, 183, 113, 232, 149, 143, 196, 103, 123, 179, 119, 133, 101, 171, 96, 214, 237, 0, 222, 171, 103, 97, 137, 91, 147, 94, 58, 211, 37, 251, 133, 73, 229, 111, 19, 120, 106, 167, 63, 136, 162, 236, 254, 64, 147, 52, 115, 216, 174, 242, 64, 196, 223, 215, 213, 6, 242, 44, 221, 14, 85, 85, 143, 63, 191, 5, 235, 247, 239, 239, 122, 114, 215, 143, 70, 70, 155, 132, 72, 242, 110, 39, 18]),
+        "P-256": new Uint8Array([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 154, 116, 32, 120, 126, 95, 77, 105, 211, 232, 34, 114, 115, 1, 109, 56, 224, 71, 129, 133, 223, 127, 238, 156, 142, 103, 60, 202, 211, 79, 126, 128, 254, 49, 141, 182, 221, 107, 119, 218, 99, 32, 165, 246, 151, 89, 9, 68, 23, 177, 52, 239, 138, 139, 116, 193, 101, 4, 57, 198, 115, 0, 90, 61]),
+        "P-384": new Uint8Array([48, 118, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 98, 0, 4, 145, 130, 45, 194, 175, 89, 193, 143, 91, 103, 248, 13, 246, 26, 38, 3, 194, 168, 240, 179, 192, 175, 130, 45, 99, 194, 121, 112, 26, 130, 69, 96, 64, 68, 1, 221, 233, 165, 110, 229, 39, 87, 234, 139, 199, 72, 212, 200, 43, 83, 55, 180, 141, 123, 101, 88, 58, 61, 87, 36, 56, 136, 0, 54, 186, 198, 115, 15, 66, 202, 82, 120, 150, 107, 213, 242, 30, 134, 226, 29, 48, 197, 166, 208, 70, 62, 197, 19, 221, 80, 159, 252, 220, 175, 31, 245])
+    };
+
+    var sizes = {
+        "P-521": 66,
+        "P-256": 32,
+        "P-384": 48
+    };
+
+    var derivations = {
+        "P-521": new Uint8Array([0, 156, 43, 206, 87, 190, 128, 173, 171, 59, 7, 56, 91, 142, 89, 144, 235, 125, 111, 222, 189, 176, 27, 243, 83, 113, 164, 246, 7, 94, 157, 40, 138, 193, 42, 109, 254, 3, 170, 87, 67, 188, 129, 112, 157, 73, 168, 34, 148, 2, 25, 182, 75, 118, 138, 205, 82, 15, 161, 54, 142, 160, 175, 141, 71, 93]),
+        "P-256": new Uint8Array([14, 143, 60, 77, 177, 178, 162, 131, 115, 90, 0, 220, 87, 31, 26, 232, 151, 28, 227, 35, 250, 17, 131, 137, 203, 95, 65, 196, 59, 61, 181, 161]),
+        "P-384": new Uint8Array([224, 189, 107, 206, 10, 239, 140, 164, 136, 56, 166, 226, 252, 197, 126, 103, 185, 197, 232, 134, 12, 95, 11, 233, 218, 190, 197, 62, 69, 78, 24, 160, 161, 116, 196, 136, 136, 162, 100, 136, 17, 91, 45, 201, 241, 223, 165, 45])
+    };
+
+    return {
+        pkcs8: pkcs8,
+        spki: spki,
+        sizes: sizes,
+        derivations: derivations,
+    };
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.https.any.js
index 6464dacfe3aa..f9d0da921d52 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.https.any.js
@@ -1,5 +1,8 @@
 // META: title=WebCryptoAPI: deriveKey() Using ECDH
 // META: script=../util/helpers.js
+// META: script=ecdh_fixtures.js
+// META: script=derive.js
+// META: script=ecdh.js
 // META: script=ecdh_keys.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.js
index 8c3d2aeb5a49..c4ee495aa6ff 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh_keys.js
@@ -1,212 +1,3 @@
-
 function define_tests() {
-    // May want to test prefixed implementations.
-    var subtle = self.crypto.subtle;
-
-    var pkcs8 = {
-        "P-521": new Uint8Array([48, 129, 238, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 129, 214, 48, 129, 211, 2, 1, 1, 4, 66, 1, 166, 126, 211, 33, 145, 90, 100, 170, 53, 155, 125, 100, 141, 220, 38, 24, 250, 142, 141, 24, 103, 232, 247, 24, 48, 177, 13, 37, 237, 40, 145, 250, 241, 47, 60, 126, 117, 66, 26, 46, 162, 100, 249, 169, 21, 50, 13, 39, 79, 225, 71, 7, 66, 185, 132, 233, 107, 152, 145, 32, 129, 250, 205, 71, 141, 161, 129, 137, 3, 129, 134, 0, 4, 0, 32, 157, 72, 63, 40, 102, 104, 129, 198, 100, 31, 58, 18, 111, 64, 15, 81, 228, 101, 17, 112, 254, 103, 140, 117, 232, 87, 18, 226, 134, 138, 220, 133, 8, 36, 153, 123, 235, 240, 188, 130, 180, 48, 40, 166, 210, 236, 23, 119, 202, 69, 39, 159, 114, 6, 163, 234, 139, 92, 210, 7, 63, 73, 62, 69, 0, 12, 181, 76, 58, 90, 202, 162, 104, 197, 103, 16, 66, 136, 120, 217, 139, 138, 251, 246, 138, 97, 33, 83, 99, 40, 70, 216, 7, 233, 38, 114, 105, 143, 27, 156, 97, 29, 231, 211, 142, 52, 205, 108, 115, 136, 144, 146, 197, 110, 82, 214, 128, 241, 223, 208, 146, 184, 122, 200, 239, 159, 243, 200, 251, 72]),
-        "P-256": new Uint8Array([48, 129, 135, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 109, 48, 107, 2, 1, 1, 4, 32, 15, 247, 79, 232, 241, 202, 175, 97, 92, 206, 241, 29, 217, 53, 114, 87, 98, 217, 216, 65, 236, 186, 185, 94, 170, 38, 68, 123, 52, 100, 245, 113, 161, 68, 3, 66, 0, 4, 140, 96, 11, 44, 102, 25, 45, 97, 158, 39, 210, 37, 107, 59, 151, 118, 178, 141, 30, 5, 246, 13, 234, 189, 98, 174, 123, 154, 211, 157, 224, 217, 59, 4, 102, 109, 199, 119, 14, 126, 207, 13, 211, 203, 203, 211, 110, 221, 107, 94, 220, 153, 81, 7, 55, 161, 237, 104, 46, 205, 112, 244, 10, 47]),
-        "P-384": new Uint8Array([48, 129, 182, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 129, 158, 48, 129, 155, 2, 1, 1, 4, 48, 248, 113, 165, 102, 101, 137, 193, 74, 87, 71, 38, 62, 248, 91, 49, 156, 192, 35, 219, 110, 53, 103, 108, 61, 120, 30, 239, 139, 5, 95, 207, 190, 134, 250, 13, 6, 208, 86, 181, 25, 95, 177, 50, 58, 248, 222, 37, 179, 161, 100, 3, 98, 0, 4, 241, 25, 101, 223, 125, 212, 89, 77, 4, 25, 197, 8, 100, 130, 163, 184, 38, 185, 121, 127, 155, 224, 189, 13, 16, 156, 158, 30, 153, 137, 193, 185, 169, 43, 143, 38, 159, 152, 225, 122, 209, 132, 186, 115, 193, 247, 151, 98, 175, 69, 175, 129, 65, 96, 38, 66, 218, 39, 26, 107, 176, 255, 235, 12, 180, 71, 143, 207, 112, 126, 102, 26, 166, 214, 205, 245, 21, 73, 200, 140, 63, 19, 11, 233, 232, 32, 31, 111, 106, 9, 244, 24, 90, 175, 149, 196])
-    };
-
-    var spki = {
-        "P-521": new Uint8Array([48, 129, 155, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 129, 134, 0, 4, 0, 238, 105, 249, 71, 21, 215, 1, 233, 226, 1, 19, 51, 212, 244, 249, 108, 186, 125, 145, 248, 139, 17, 43, 175, 117, 207, 9, 204, 31, 138, 202, 151, 97, 141, 169, 56, 152, 34, 210, 155, 111, 233, 153, 106, 97, 32, 62, 247, 82, 183, 113, 232, 149, 143, 196, 103, 123, 179, 119, 133, 101, 171, 96, 214, 237, 0, 222, 171, 103, 97, 137, 91, 147, 94, 58, 211, 37, 251, 133, 73, 229, 111, 19, 120, 106, 167, 63, 136, 162, 236, 254, 64, 147, 52, 115, 216, 174, 242, 64, 196, 223, 215, 213, 6, 242, 44, 221, 14, 85, 85, 143, 63, 191, 5, 235, 247, 239, 239, 122, 114, 215, 143, 70, 70, 155, 132, 72, 242, 110, 39, 18]),
-        "P-256": new Uint8Array([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 154, 116, 32, 120, 126, 95, 77, 105, 211, 232, 34, 114, 115, 1, 109, 56, 224, 71, 129, 133, 223, 127, 238, 156, 142, 103, 60, 202, 211, 79, 126, 128, 254, 49, 141, 182, 221, 107, 119, 218, 99, 32, 165, 246, 151, 89, 9, 68, 23, 177, 52, 239, 138, 139, 116, 193, 101, 4, 57, 198, 115, 0, 90, 61]),
-        "P-384": new Uint8Array([48, 118, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 98, 0, 4, 145, 130, 45, 194, 175, 89, 193, 143, 91, 103, 248, 13, 246, 26, 38, 3, 194, 168, 240, 179, 192, 175, 130, 45, 99, 194, 121, 112, 26, 130, 69, 96, 64, 68, 1, 221, 233, 165, 110, 229, 39, 87, 234, 139, 199, 72, 212, 200, 43, 83, 55, 180, 141, 123, 101, 88, 58, 61, 87, 36, 56, 136, 0, 54, 186, 198, 115, 15, 66, 202, 82, 120, 150, 107, 213, 242, 30, 134, 226, 29, 48, 197, 166, 208, 70, 62, 197, 19, 221, 80, 159, 252, 220, 175, 31, 245])
-    };
-
-    var sizes = {
-        "P-521": 66,
-        "P-256": 32,
-        "P-384": 48
-    };
-
-    var derivations = {
-        "P-521": new Uint8Array([0, 156, 43, 206, 87, 190, 128, 173, 171, 59, 7, 56, 91, 142, 89, 144, 235, 125, 111, 222, 189, 176, 27, 243, 83, 113, 164, 246, 7, 94, 157, 40, 138, 193, 42, 109, 254, 3, 170, 87, 67, 188, 129, 112, 157, 73, 168, 34, 148, 2, 25, 182, 75, 118, 138, 205, 82, 15, 161, 54, 142, 160, 175, 141, 71, 93]),
-        "P-256": new Uint8Array([14, 143, 60, 77, 177, 178, 162, 131, 115, 90, 0, 220, 87, 31, 26, 232, 151, 28, 227, 35, 250, 17, 131, 137, 203, 95, 65, 196, 59, 61, 181, 161]),
-        "P-384": new Uint8Array([224, 189, 107, 206, 10, 239, 140, 164, 136, 56, 166, 226, 252, 197, 126, 103, 185, 197, 232, 134, 12, 95, 11, 233, 218, 190, 197, 62, 69, 78, 24, 160, 161, 116, 196, 136, 136, 162, 100, 136, 17, 91, 45, 201, 241, 223, 165, 45])
-    };
-
-    return importKeys(pkcs8, spki, sizes)
-    .then(function(results) {
-        publicKeys = results.publicKeys;
-        privateKeys = results.privateKeys;
-        ecdsaKeyPairs = results.ecdsaKeyPairs;
-        noDeriveKeyKeys = results.noDeriveKeyKeys;
-
-        Object.keys(sizes).forEach(function(namedCurve) {
-            // Basic success case
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "ECDH", public: publicKeys[namedCurve]}, privateKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_true(equalBuffers(exportedKey, derivations[namedCurve], 8 * exportedKey.length), "Derived correct key");
-                }, function(err) {
-                    assert_unreached("deriveKey failed with error " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " good parameters");
-
-            // Case insensitivity check
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "EcDh", public: publicKeys[namedCurve]}, privateKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_true(equalBuffers(exportedKey, derivations[namedCurve], 8 * exportedKey.length), "Derived correct key");
-                }, function(err) {
-                    assert_unreached("deriveKey failed with error " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " mixed case parameters");
-            // Errors to test:
-
-            // - missing public property TypeError
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "ECDH"}, privateKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_unreached("deriveKey succeeded but should have failed with TypeError");
-                }, function(err) {
-                    assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " missing public curve");
-
-            // - Non CryptoKey public property TypeError
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "ECDH", public: {message: "Not a CryptoKey"}}, privateKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_unreached("deriveKey succeeded but should have failed with TypeError");
-                }, function(err) {
-                    assert_equals(err.name, "TypeError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " public property of algorithm is not a CryptoKey");
-
-            // - wrong named curve
-            promise_test(function(test) {
-                publicKey = publicKeys["P-256"];
-                if (namedCurve === "P-256") {
-                    publicKey = publicKeys["P-384"];
-                }
-                return subtle.deriveKey({name: "ECDH", public: publicKey}, privateKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " mismatched curves");
-
-            // - not ECDH public property InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "ECDH", public: ecdsaKeyPairs[namedCurve].publicKey}, privateKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " public property of algorithm is not an ECDSA public key");
-
-            // - No deriveKey usage in baseKey InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "ECDH", public: publicKeys[namedCurve]}, noDeriveKeyKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " no deriveKey usage for base key");
-
-            // - Use public key for baseKey InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "ECDH", public: publicKeys[namedCurve]}, publicKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " base key is not a private key");
-
-            // - Use private key for public property InvalidAccessError
-            promise_test(function(test) {
-                return subtle.deriveKey({name: "ECDH", public: privateKeys[namedCurve]}, privateKeys[namedCurve], {name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                .then(function(exportedKey) {
-                    assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                });
-            }, namedCurve + " public property value is a private key");
-
-            // - Use secret key for public property InvalidAccessError
-            promise_test(function(test) {
-                return subtle.generateKey({name: "HMAC", hash: "SHA-256", length: 256}, true, ["sign", "verify"])
-                .then(function(secretKey) {
-                    return subtle.deriveKey({name: "ECDH", public: secretKey}, privateKeys[namedCurve], {name: "AES-CBC", length: 256}, true, ["sign", "verify"])
-                    .then(function(key) {return crypto.subtle.exportKey("raw", key);})
-                    .then(function(exportedKey) {
-                        assert_unreached("deriveKey succeeded but should have failed with InvalidAccessError");
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should throw correct error, not " + err.name + ": " + err.message);
-                    });
-                });
-            }, namedCurve + " public property value is a secret key");
-        });
-    });
-
-    function importKeys(pkcs8, spki, sizes) {
-        var privateKeys = {};
-        var publicKeys = {};
-        var ecdsaKeyPairs = {};
-        var noDeriveKeyKeys = {};
-
-        var promises = [];
-        Object.keys(pkcs8).forEach(function(namedCurve) {
-            var operation = subtle.importKey("pkcs8", pkcs8[namedCurve],
-                                            {name: "ECDH", namedCurve: namedCurve},
-                                            false, ["deriveBits", "deriveKey"])
-                            .then(function(key) {
-                                privateKeys[namedCurve] = key;
-                            }, function (err) {
-                                privateKeys[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-        Object.keys(pkcs8).forEach(function(namedCurve) {
-            var operation = subtle.importKey("pkcs8", pkcs8[namedCurve],
-                                            {name: "ECDH", namedCurve: namedCurve},
-                                            false, ["deriveBits"])
-                            .then(function(key) {
-                                noDeriveKeyKeys[namedCurve] = key;
-                            }, function (err) {
-                                noDeriveKeyKeys[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-        Object.keys(spki).forEach(function(namedCurve) {
-            var operation = subtle.importKey("spki", spki[namedCurve],
-                                            {name: "ECDH", namedCurve: namedCurve},
-                                            false, [])
-                            .then(function(key) {
-                                publicKeys[namedCurve] = key;
-                            }, function (err) {
-                                publicKeys[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-        Object.keys(sizes).forEach(function(namedCurve) {
-            var operation = subtle.generateKey({name: "ECDSA", namedCurve: namedCurve}, false, ["sign", "verify"])
-                            .then(function(keyPair) {
-                                ecdsaKeyPairs[namedCurve] = keyPair;
-                            }, function (err) {
-                                ecdsaKeyPairs[namedCurve] = null;
-                            });
-            promises.push(operation);
-        });
-
-        return Promise.all(promises)
-               .then(function(results) {return {privateKeys: privateKeys, publicKeys: publicKeys, ecdsaKeyPairs: ecdsaKeyPairs, noDeriveKeyKeys: noDeriveKeyKeys}});
-    }
-
+    return defineEcdhTests("deriveKey");
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.https.any.js
index 3879ddb14b90..b283f2ba7920 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.https.any.js
@@ -6,6 +6,7 @@
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
 // META: script=hkdf_vectors.js
+// META: script=kdf.js
 // META: script=hkdf.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.js
index 08e8c0c89746..a090169836e5 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/hkdf.js
@@ -1,278 +1,63 @@
-
 function define_tests() {
-    // May want to test prefixed implementations.
-    var subtle = self.crypto.subtle;
-
-    // hkdf2_vectors sets up test data with the correct derivations for each
-    // test case.
-    var testData = getTestData();
-    var derivedKeys = testData.derivedKeys;
-    var salts = testData.salts;
-    var derivations = testData.derivations;
-    var infos = testData.infos;
-
-    // What kinds of keys can be created with deriveKey? The following:
-    var derivedKeyTypes = testData.derivedKeyTypes;
-
-    return setUpBaseKeys(derivedKeys)
-    .then(function(allKeys) {
-        // We get several kinds of base keys. Normal ones that can be used for
-        // derivation operations, ones that lack the deriveBits usage, ones
-        // that lack the deriveKeys usage, and one key that is for the wrong
-        // algorithm (not HKDF in this case).
-        var baseKeys = allKeys.baseKeys;
-        var noBits = allKeys.noBits;
-        var noKey = allKeys.noKey;
-        var wrongKey = allKeys.wrongKey;
-
-        // Test each combination of derivedKey size, salt size, hash function,
-        // and number of iterations. The derivations object is structured in
-        // that way, so navigate it to run tests and compare with correct results.
-        Object.keys(derivations).forEach(function(derivedKeySize) {
-            Object.keys(derivations[derivedKeySize]).forEach(function(saltSize) {
-                Object.keys(derivations[derivedKeySize][saltSize]).forEach(function(hashName) {
-                    Object.keys(derivations[derivedKeySize][saltSize][hashName]).forEach(function(infoSize) {
-                        var testName = derivedKeySize + " derivedKey, " + saltSize + " salt, " + hashName + ", with " + infoSize + " info";
-                        var algorithm = {name: "HKDF", salt: salts[saltSize], info: infos[infoSize], hash: hashName};
-
-                        // Check for correct deriveBits result
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits(algorithm, baseKeys[derivedKeySize], 256)
-                            .then(function(derivation) {
-                                assert_true(equalBuffers(derivation, derivations[derivedKeySize][saltSize][hashName][infoSize]), "Derived correct key");
-                            }, function(err) {
-                                assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-                            });
-                        }, testName);
-
-                        // 0 length
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits(algorithm, baseKeys[derivedKeySize], 0)
-                            .then(function(derivation) {
-                                assert_equals(derivation.byteLength, 0, "Derived correctly empty key");
-                            }, function(err) {
-                                assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
-                            });
-                        }, testName + " with 0 length");
-
-                        // Check for correct deriveKey results for every kind of
-                        // key that can be created by the deriveKeys operation.
-                        derivedKeyTypes.forEach(function(derivedKeyType) {
-                            var testName = "Derived key of type ";
-                            Object.keys(derivedKeyType.algorithm).forEach(function(prop) {
-                                testName += prop + ": " + derivedKeyType.algorithm[prop] + " ";
-                            });
-                            testName += " using " + derivedKeySize + " derivedKey, " + saltSize + " salt, " + hashName + ", with " + infoSize + " info";
-
-                            // Test the particular key derivation.
-                            subsetTest(promise_test, function(test) {
-                                return subtle.deriveKey(algorithm, baseKeys[derivedKeySize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    // Need to export the key to see that the correct bits were set.
-                                    return subtle.exportKey("raw", key)
-                                    .then(function(buffer) {
-                                        assert_true(equalBuffers(buffer, derivations[derivedKeySize][saltSize][hashName][infoSize].slice(0, derivedKeyType.algorithm.length/8)), "Exported key matches correct value");
+    return runKdfTests({
+        name: "HKDF",
+        getBaseKeyData: function(testData) {
+            return testData.derivedKeys;
+        },
+        registerTests: function(context) {
+            var subtle = context.subtle;
+            var testData = context.testData;
+            var derivations = testData.derivations;
+            var salts = testData.salts;
+            var infos = testData.infos;
+
+            Object.keys(derivations).forEach(function(derivedKeySize) {
+                Object.keys(derivations[derivedKeySize]).forEach(function(saltSize) {
+                    Object.keys(derivations[derivedKeySize][saltSize]).forEach(function(hashName) {
+                        Object.keys(derivations[derivedKeySize][saltSize][hashName]).forEach(function(infoSize) {
+                            var testName = derivedKeySize + " derivedKey, " + saltSize + " salt, " + hashName + ", with " + infoSize + " info";
+                            var testCase = {
+                                name: testName,
+                                keyName: derivedKeySize,
+                                hash: hashName,
+                                algorithm: {name: "HKDF", salt: salts[saltSize], info: infos[infoSize], hash: hashName},
+                                expected: derivations[derivedKeySize][saltSize][hashName][infoSize]
+                            };
+
+                            context.registerCase(testCase, function() {
+                                subsetTest(promise_test, function(test) {
+                                    return subtle.deriveBits({name: "HKDF", info: infos[infoSize], hash: hashName}, context.keys.baseKeys[derivedKeySize], 0)
+                                    .then(function(derivation) {
+                                        assert_equals(derivation.byteLength, 0, "Derived even with missing salt");
                                     }, function(err) {
-                                        assert_unreached("Exporting derived key failed with error " + err.name + ": " + err.message);
+                                        assert_equals(err.name, "TypeError", "deriveBits missing salt correctly threw OperationError: " + err.message);
                                     });
-                                }, function(err) {
-                                    assert_unreached("deriveKey failed with error " + err.name + ": " + err.message);
-
-                                });
-                            }, testName);
-
-                            // Test various error conditions for deriveKey:
+                                }, testName + " with missing salt");
 
-                            // - illegal name for hash algorithm (NotSupportedError)
-                            var badHash = hashName.substring(0, 3) + hashName.substring(4);
-                            subsetTest(promise_test, function(test) {
-                                var badAlgorithm = {name: "HKDF", salt: salts[saltSize], hash: badHash, info: algorithm.info};
-                                return subtle.deriveKey(badAlgorithm, baseKeys[derivedKeySize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    assert_unreached("bad hash name should have thrown an NotSupportedError");
-                                }, function(err) {
-                                    assert_equals(err.name, "NotSupportedError", "deriveKey with bad hash name correctly threw NotSupportedError: " + err.message);
-                                });
-                            }, testName + " with bad hash name " + badHash);
-
-                            // - baseKey usages missing "deriveKey" (InvalidAccessError)
-                            subsetTest(promise_test, function(test) {
-                                return subtle.deriveKey(algorithm, noKey[derivedKeySize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    assert_unreached("missing deriveKey usage should have thrown an InvalidAccessError");
-                                }, function(err) {
-                                    assert_equals(err.name, "InvalidAccessError", "deriveKey with missing deriveKey usage correctly threw InvalidAccessError: " + err.message);
-                                });
-                            }, testName + " with missing deriveKey usage");
-
-                            // - baseKey algorithm does not match HKDF (InvalidAccessError)
-                            subsetTest(promise_test, function(test) {
-                                return subtle.deriveKey(algorithm, wrongKey, derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    assert_unreached("wrong (ECDH) key should have thrown an InvalidAccessError");
-                                }, function(err) {
-                                    assert_equals(err.name, "InvalidAccessError", "deriveKey with wrong (ECDH) key correctly threw InvalidAccessError: " + err.message);
-                                });
-                            }, testName + " with wrong (ECDH) key");
-
-                        });
-
-                        // Test various error conditions for deriveBits below:
-
-                        // missing salt (TypeError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "HKDF", info: infos[infoSize], hash: hashName}, baseKeys[derivedKeySize], 0)
-                            .then(function(derivation) {
-                                assert_equals(derivation.byteLength, 0, "Derived even with missing salt");
-                            }, function(err) {
-                                assert_equals(err.name, "TypeError", "deriveBits missing salt correctly threw OperationError: " + err.message);
-                            });
-                        }, testName + " with missing salt");
-
-                        // missing info (TypeError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "HKDF", salt: salts[saltSize], hash: hashName}, baseKeys[derivedKeySize], 0)
-                            .then(function(derivation) {
-                                assert_equals(derivation.byteLength, 0, "Derived even with missing info");
-                            }, function(err) {
-                                assert_equals(err.name, "TypeError", "deriveBits missing info correctly threw OperationError: " + err.message);
-                            });
-                        }, testName + " with missing info");
-
-                        // length not multiple of 8 (OperationError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits(algorithm, baseKeys[derivedKeySize], 44)
-                            .then(function(derivation) {
-                                assert_unreached("non-multiple of 8 length should have thrown an OperationError");
-                            }, function(err) {
-                                assert_equals(err.name, "OperationError", "deriveBits with non-multiple of 8 length correctly threw OperationError: " + err.message);
-                            });
-                        }, testName + " with non-multiple of 8 length");
-
-                        // - illegal name for hash algorithm (NotSupportedError)
-                        var badHash = hashName.substring(0, 3) + hashName.substring(4);
-                        subsetTest(promise_test, function(test) {
-                            var badAlgorithm = {name: "HKDF", salt: salts[saltSize], hash: badHash, info: algorithm.info};
-                            return subtle.deriveBits(badAlgorithm, baseKeys[derivedKeySize], 256)
-                            .then(function(derivation) {
-                                assert_unreached("bad hash name should have thrown an NotSupportedError");
-                            }, function(err) {
-                                assert_equals(err.name, "NotSupportedError", "deriveBits with bad hash name correctly threw NotSupportedError: " + err.message);
-                            });
-                        }, testName + " with bad hash name " + badHash);
-
-                        // - baseKey usages missing "deriveBits" (InvalidAccessError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits(algorithm, noBits[derivedKeySize], 256)
-                            .then(function(derivation) {
-                                assert_unreached("missing deriveBits usage should have thrown an InvalidAccessError");
-                            }, function(err) {
-                                assert_equals(err.name, "InvalidAccessError", "deriveBits with missing deriveBits usage correctly threw InvalidAccessError: " + err.message);
-                            });
-                        }, testName + " with missing deriveBits usage");
-
-                        // - baseKey algorithm does not match HKDF (InvalidAccessError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits(algorithm, wrongKey, 256)
-                            .then(function(derivation) {
-                                assert_unreached("wrong (ECDH) key should have thrown an InvalidAccessError");
-                            }, function(err) {
-                                assert_equals(err.name, "InvalidAccessError", "deriveBits with wrong (ECDH) key correctly threw InvalidAccessError: " + err.message);
+                                subsetTest(promise_test, function(test) {
+                                    return subtle.deriveBits({name: "HKDF", salt: salts[saltSize], hash: hashName}, context.keys.baseKeys[derivedKeySize], 0)
+                                    .then(function(derivation) {
+                                        assert_equals(derivation.byteLength, 0, "Derived even with missing info");
+                                    }, function(err) {
+                                        assert_equals(err.name, "TypeError", "deriveBits missing info correctly threw OperationError: " + err.message);
+                                    });
+                                }, testName + " with missing info");
                             });
-                        }, testName + " with wrong (ECDH) key");
-                    });
-                });
-
-                // - legal algorithm name but not digest one (e.g., PBKDF2) (NotSupportedError)
-                var nonDigestHash = "PBKDF2";
-                Object.keys(infos).forEach(function(infoSize) {
-                    var testName = derivedKeySize + " derivedKey, " + saltSize + " salt, " + nonDigestHash + ", with " + infoSize + " info";
-                    var algorithm = {name: "HKDF", salt: salts[saltSize], hash: nonDigestHash};
-                    if (infoSize !== "missing") {
-                        algorithm.info = infos[infoSize];
-                    }
-
-                    subsetTest(promise_test, function(test) {
-                        return subtle.deriveBits(algorithm, baseKeys[derivedKeySize], 256)
-                        .then(function(derivation) {
-                            assert_unreached("non-digest algorithm should have thrown an NotSupportedError");
-                        }, function(err) {
-                            assert_equals(err.name, "NotSupportedError", "deriveBits with non-digest algorithm correctly threw NotSupportedError: " + err.message);
                         });
-                    }, testName + " with non-digest algorithm " + nonDigestHash);
+                    });
 
-                    derivedKeyTypes.forEach(function(derivedKeyType) {
-                        var testName = "Derived key of type ";
-                        Object.keys(derivedKeyType.algorithm).forEach(function(prop) {
-                            testName += prop + ": " + derivedKeyType.algorithm[prop] + " ";
+                    var nonDigestHash = "PBKDF2";
+                    Object.keys(infos).forEach(function(infoSize) {
+                        var testName = derivedKeySize + " derivedKey, " + saltSize + " salt, " + nonDigestHash + ", with " + infoSize + " info";
+                        context.registerNonDigestCase({
+                            name: testName,
+                            keyName: derivedKeySize,
+                            hash: nonDigestHash,
+                            algorithm: {name: "HKDF", salt: salts[saltSize], hash: nonDigestHash, info: infos[infoSize]}
                         });
-                        testName += " using " + derivedKeySize + " derivedKey, " + saltSize + " salt, " + nonDigestHash + ", with " + infoSize + " info";
-
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveKey(algorithm, baseKeys[derivedKeySize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                            .then(function(derivation) {
-                                assert_unreached("non-digest algorithm should have thrown an NotSupportedError");
-                            }, function(err) {
-                                assert_equals(err.name, "NotSupportedError", "derivekey with non-digest algorithm correctly threw NotSupportedError: " + err.message);
-                            });
-                        }, testName);
                     });
-
                 });
-
             });
-        });
+        }
     });
-
-    // Deriving bits and keys requires starting with a base key, which is created
-    // by importing a derivedKey. setUpBaseKeys returns a promise that yields the
-    // necessary base keys.
-    function setUpBaseKeys(derivedKeys) {
-        var promises = [];
-
-        var baseKeys = {};
-        var noBits = {};
-        var noKey = {};
-        var wrongKey = null;
-
-        Object.keys(derivedKeys).forEach(function(derivedKeySize) {
-            var promise = subtle.importKey("raw", derivedKeys[derivedKeySize], {name: "HKDF"}, false, ["deriveKey", "deriveBits"])
-            .then(function(baseKey) {
-                baseKeys[derivedKeySize] = baseKey;
-            }, function(err) {
-                baseKeys[derivedKeySize] = null;
-            });
-            promises.push(promise);
-
-            promise = subtle.importKey("raw", derivedKeys[derivedKeySize], {name: "HKDF"}, false, ["deriveBits"])
-            .then(function(baseKey) {
-                noKey[derivedKeySize] = baseKey;
-            }, function(err) {
-                noKey[derivedKeySize] = null;
-            });
-            promises.push(promise);
-
-            promise = subtle.importKey("raw", derivedKeys[derivedKeySize], {name: "HKDF"}, false, ["deriveKey"])
-            .then(function(baseKey) {
-                noBits[derivedKeySize] = baseKey;
-            }, function(err) {
-                noBits[derivedKeySize] = null;
-            });
-            promises.push(promise);
-        });
-
-        var promise = subtle.generateKey({name: "ECDH", namedCurve: "P-256"}, false, ["deriveKey", "deriveBits"])
-        .then(function(baseKey) {
-            wrongKey = baseKey.privateKey;
-        }, function(err) {
-            wrongKey = null;
-        });
-        promises.push(promise);
-
-
-        return Promise.all(promises).then(function() {
-            return {baseKeys: baseKeys, noBits: noBits, noKey: noKey, wrongKey: wrongKey};
-        });
-    }
-
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/kdf.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/kdf.js
new file mode 100644
index 000000000000..ecbb3b4148f4
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/kdf.js
@@ -0,0 +1,209 @@
+function runKdfTests(options) {
+    var subtle = self.crypto.subtle;
+    var testData = getTestData();
+    var derivedKeyTypes = testData.derivedKeyTypes;
+
+    return setUpBaseKeys(options.getBaseKeyData(testData))
+    .then(function(allKeys) {
+        function derivedKeyTestName(derivedKeyType, caseName) {
+            var testName = "Derived key of type ";
+            Object.keys(derivedKeyType.algorithm).forEach(function(prop) {
+                testName += prop + ": " + derivedKeyType.algorithm[prop] + " ";
+            });
+            return testName + " using " + caseName;
+        }
+
+        function withHash(algorithm, hash) {
+            return Object.assign({}, algorithm, {hash: hash});
+        }
+
+        function registerCase(testCase, registerAdditionalBitsTests) {
+            var algorithm = testCase.algorithm;
+            var baseKey = allKeys.baseKeys[testCase.keyName];
+            var badHash = testCase.hash.substring(0, 3) + testCase.hash.substring(4);
+
+            subsetTest(promise_test, function(test) {
+                return subtle.deriveBits(algorithm, baseKey, 256)
+                .then(function(derivation) {
+                    assert_true(equalBuffers(derivation, testCase.expected), "Derived correct key");
+                }, function(err) {
+                    assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
+                });
+            }, testCase.name);
+
+            subsetTest(promise_test, function(test) {
+                return subtle.deriveBits(algorithm, baseKey, 0)
+                .then(function(derivation) {
+                    assert_equals(derivation.byteLength, 0, "Derived correctly empty key");
+                }, function(err) {
+                    assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
+                });
+            }, testCase.name + " with 0 length");
+
+            derivedKeyTypes.forEach(function(derivedKeyType) {
+                var testName = derivedKeyTestName(derivedKeyType, testCase.name);
+
+                subsetTest(promise_test, function(test) {
+                    return subtle.deriveKey(algorithm, baseKey, derivedKeyType.algorithm, true, derivedKeyType.usages)
+                    .then(function(key) {
+                        return subtle.exportKey("raw", key)
+                        .then(function(buffer) {
+                            assert_true(equalBuffers(buffer, testCase.expected.slice(0, derivedKeyType.algorithm.length/8)), "Exported key matches correct value");
+                        }, function(err) {
+                            assert_unreached("Exporting derived key failed with error " + err.name + ": " + err.message);
+                        });
+                    }, function(err) {
+                        assert_unreached("deriveKey failed with error " + err.name + ": " + err.message);
+                    });
+                }, testName);
+
+                subsetTest(promise_test, function(test) {
+                    return subtle.deriveKey(withHash(algorithm, badHash), baseKey, derivedKeyType.algorithm, true, derivedKeyType.usages)
+                    .then(function(key) {
+                        assert_unreached("bad hash name should have thrown an NotSupportedError");
+                    }, function(err) {
+                        assert_equals(err.name, "NotSupportedError", "deriveKey with bad hash name correctly threw NotSupportedError: " + err.message);
+                    });
+                }, testName + " with bad hash name " + badHash);
+
+                subsetTest(promise_test, function(test) {
+                    return subtle.deriveKey(algorithm, allKeys.noKey[testCase.keyName], derivedKeyType.algorithm, true, derivedKeyType.usages)
+                    .then(function(key) {
+                        assert_unreached("missing deriveKey usage should have thrown an InvalidAccessError");
+                    }, function(err) {
+                        assert_equals(err.name, "InvalidAccessError", "deriveKey with missing deriveKey usage correctly threw InvalidAccessError: " + err.message);
+                    });
+                }, testName + " with missing deriveKey usage");
+
+                subsetTest(promise_test, function(test) {
+                    return subtle.deriveKey(algorithm, allKeys.wrongKey, derivedKeyType.algorithm, true, derivedKeyType.usages)
+                    .then(function(key) {
+                        assert_unreached("wrong (ECDH) key should have thrown an InvalidAccessError");
+                    }, function(err) {
+                        assert_equals(err.name, "InvalidAccessError", "deriveKey with wrong (ECDH) key correctly threw InvalidAccessError: " + err.message);
+                    });
+                }, testName + " with wrong (ECDH) key");
+            });
+
+            if (registerAdditionalBitsTests !== undefined) {
+                registerAdditionalBitsTests();
+            }
+
+            subsetTest(promise_test, function(test) {
+                return subtle.deriveBits(algorithm, baseKey, 44)
+                .then(function(derivation) {
+                    assert_unreached("non-multiple of 8 length should have thrown an OperationError");
+                }, function(err) {
+                    assert_equals(err.name, "OperationError", "deriveBits with non-multiple of 8 length correctly threw OperationError: " + err.message);
+                });
+            }, testCase.name + " with non-multiple of 8 length");
+
+            subsetTest(promise_test, function(test) {
+                return subtle.deriveBits(withHash(algorithm, badHash), baseKey, 256)
+                .then(function(derivation) {
+                    assert_unreached("bad hash name should have thrown an NotSupportedError");
+                }, function(err) {
+                    assert_equals(err.name, "NotSupportedError", "deriveBits with bad hash name correctly threw NotSupportedError: " + err.message);
+                });
+            }, testCase.name + " with bad hash name " + badHash);
+
+            subsetTest(promise_test, function(test) {
+                return subtle.deriveBits(algorithm, allKeys.noBits[testCase.keyName], 256)
+                .then(function(derivation) {
+                    assert_unreached("missing deriveBits usage should have thrown an InvalidAccessError");
+                }, function(err) {
+                    assert_equals(err.name, "InvalidAccessError", "deriveBits with missing deriveBits usage correctly threw InvalidAccessError: " + err.message);
+                });
+            }, testCase.name + " with missing deriveBits usage");
+
+            subsetTest(promise_test, function(test) {
+                return subtle.deriveBits(algorithm, allKeys.wrongKey, 256)
+                .then(function(derivation) {
+                    assert_unreached("wrong (ECDH) key should have thrown an InvalidAccessError");
+                }, function(err) {
+                    assert_equals(err.name, "InvalidAccessError", "deriveBits with wrong (ECDH) key correctly threw InvalidAccessError: " + err.message);
+                });
+            }, testCase.name + " with wrong (ECDH) key");
+        }
+
+        function registerNonDigestCase(testCase) {
+            var baseKey = allKeys.baseKeys[testCase.keyName];
+
+            subsetTest(promise_test, function(test) {
+                return subtle.deriveBits(testCase.algorithm, baseKey, 256)
+                .then(function(derivation) {
+                    assert_unreached("non-digest algorithm should have thrown an NotSupportedError");
+                }, function(err) {
+                    assert_equals(err.name, "NotSupportedError", "deriveBits with non-digest algorithm correctly threw NotSupportedError: " + err.message);
+                });
+            }, testCase.name + " with non-digest algorithm " + testCase.hash);
+
+            derivedKeyTypes.forEach(function(derivedKeyType) {
+                subsetTest(promise_test, function(test) {
+                    return subtle.deriveKey(testCase.algorithm, baseKey, derivedKeyType.algorithm, true, derivedKeyType.usages)
+                    .then(function(derivation) {
+                        assert_unreached("non-digest algorithm should have thrown an NotSupportedError");
+                    }, function(err) {
+                        assert_equals(err.name, "NotSupportedError", "derivekey with non-digest algorithm correctly threw NotSupportedError: " + err.message);
+                    });
+                }, derivedKeyTestName(derivedKeyType, testCase.name));
+            });
+        }
+
+        options.registerTests({
+            subtle: subtle,
+            testData: testData,
+            derivedKeyTypes: derivedKeyTypes,
+            keys: allKeys,
+            registerCase: registerCase,
+            registerNonDigestCase: registerNonDigestCase,
+            derivedKeyTestName: derivedKeyTestName
+        });
+    });
+
+    function setUpBaseKeys(baseKeyData) {
+        var promises = [];
+        var baseKeys = {};
+        var noBits = {};
+        var noKey = {};
+        var wrongKey = null;
+
+        Object.keys(baseKeyData).forEach(function(keyName) {
+            var promise = subtle.importKey("raw", baseKeyData[keyName], {name: options.name}, false, ["deriveKey", "deriveBits"])
+            .then(function(baseKey) {
+                baseKeys[keyName] = baseKey;
+            }, function(err) {
+                baseKeys[keyName] = null;
+            });
+            promises.push(promise);
+
+            promise = subtle.importKey("raw", baseKeyData[keyName], {name: options.name}, false, ["deriveBits"])
+            .then(function(baseKey) {
+                noKey[keyName] = baseKey;
+            }, function(err) {
+                noKey[keyName] = null;
+            });
+            promises.push(promise);
+
+            promise = subtle.importKey("raw", baseKeyData[keyName], {name: options.name}, false, ["deriveKey"])
+            .then(function(baseKey) {
+                noBits[keyName] = baseKey;
+            }, function(err) {
+                noBits[keyName] = null;
+            });
+            promises.push(promise);
+        });
+
+        var promise = subtle.generateKey({name: "ECDH", namedCurve: "P-256"}, false, ["deriveKey", "deriveBits"])
+        .then(function(baseKey) {
+            wrongKey = baseKey.privateKey;
+        }, function(err) {
+            wrongKey = null;
+        });
+        promises.push(promise);
+
+        return Promise.all(promises).then(function() {
+            return {baseKeys: baseKeys, noBits: noBits, noKey: noKey, wrongKey: wrongKey};
+        });
+    }
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.js
index cc2ed9b9cef8..8d1299358575 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.js
@@ -12,6 +12,7 @@
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
 // META: script=pbkdf2_vectors.js
+// META: script=kdf.js
 // META: script=pbkdf2.js
 
 // Define subtests from a `promise_test` to ensure the harness does not
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.js
index 4d5b0137a387..57c19ae3f014 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.js
@@ -1,274 +1,64 @@
 function define_tests() {
-    // May want to test prefixed implementations.
-    var subtle = self.crypto.subtle;
-
-    // pbkdf2_vectors sets up test data with the correct derivations for each
-    // test case.
-    var testData = getTestData();
-    var passwords = testData.passwords;
-    var salts = testData.salts;
-    var derivations = testData.derivations;
-
-    // What kinds of keys can be created with deriveKey? The following:
-    var derivedKeyTypes = testData.derivedKeyTypes;
-
-    return setUpBaseKeys(passwords)
-    .then(function(allKeys) {
-        // We get several kinds of base keys. Normal ones that can be used for
-        // derivation operations, ones that lack the deriveBits usage, ones
-        // that lack the deriveKeys usage, and one key that is for the wrong
-        // algorithm (not PBKDF2 in this case).
-        var baseKeys = allKeys.baseKeys;
-        var noBits = allKeys.noBits;
-        var noKey = allKeys.noKey;
-        var wrongKey = allKeys.wrongKey;
-
-        // Test each combination of password size, salt size, hash function,
-        // and number of iterations. The derivations object is structured in
-        // that way, so navigate it to run tests and compare with correct results.
-        Object.keys(derivations).forEach(function(passwordSize) {
-            Object.keys(derivations[passwordSize]).forEach(function(saltSize) {
-                Object.keys(derivations[passwordSize][saltSize]).forEach(function(hashName) {
-                    Object.keys(derivations[passwordSize][saltSize][hashName]).forEach(function(iterations) {
-                        var testName = passwordSize + " password, " + saltSize + " salt, " + hashName + ", with " + iterations + " iterations";
-
-                        // Check for correct deriveBits result
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, baseKeys[passwordSize], 256)
-                            .then(function(derivation) {
-                                assert_true(equalBuffers(derivation, derivations[passwordSize][saltSize][hashName][iterations]), "Derived correct key");
-                            }, function(err) {
-                                assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
+    return runKdfTests({
+        name: "PBKDF2",
+        getBaseKeyData: function(testData) {
+            return testData.passwords;
+        },
+        registerTests: function(context) {
+            var subtle = context.subtle;
+            var testData = context.testData;
+            var derivations = testData.derivations;
+            var salts = testData.salts;
+
+            Object.keys(derivations).forEach(function(passwordSize) {
+                Object.keys(derivations[passwordSize]).forEach(function(saltSize) {
+                    Object.keys(derivations[passwordSize][saltSize]).forEach(function(hashName) {
+                        Object.keys(derivations[passwordSize][saltSize][hashName]).forEach(function(iterations) {
+                            var testName = passwordSize + " password, " + saltSize + " salt, " + hashName + ", with " + iterations + " iterations";
+                            context.registerCase({
+                                name: testName,
+                                keyName: passwordSize,
+                                hash: hashName,
+                                algorithm: {name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)},
+                                expected: derivations[passwordSize][saltSize][hashName][iterations]
                             });
-                        }, testName);
+                        });
 
-                        // 0 length
+                        var zeroIterationName = passwordSize + " password, " + saltSize + " salt, " + hashName + ", with 0 iterations";
+                        var zeroIterationAlgorithm = {name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: 0};
                         subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, baseKeys[passwordSize], 0)
+                            return subtle.deriveBits(zeroIterationAlgorithm, context.keys.baseKeys[passwordSize], 256)
                             .then(function(derivation) {
-                                assert_true(equalBuffers(derivation.byteLength, 0, "Derived correctly empty key"));
+                                assert_unreached("0 iterations should have thrown an error");
                             }, function(err) {
-                                assert_unreached("deriveBits failed with error " + err.name + ": " + err.message);
+                                assert_equals(err.name, "OperationError", "deriveBits with 0 iterations correctly threw OperationError: " + err.message);
                             });
-                        }, testName + " with 0 length");
+                        }, zeroIterationName);
 
-                        // Check for correct deriveKey results for every kind of
-                        // key that can be created by the deriveKeys operation.
-                        derivedKeyTypes.forEach(function(derivedKeyType) {
-                            var testName = "Derived key of type ";
-                            Object.keys(derivedKeyType.algorithm).forEach(function(prop) {
-                                testName += prop + ": " + derivedKeyType.algorithm[prop] + " ";
-                            });
-                            testName += " using " + passwordSize + " password, " + saltSize + " salt, " + hashName + ", with " + iterations + " iterations";
-
-                            // Test the particular key derivation.
-                            subsetTest(promise_test, function(test) {
-                                return subtle.deriveKey({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, baseKeys[passwordSize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    // Need to export the key to see that the correct bits were set.
-                                    return subtle.exportKey("raw", key)
-                                    .then(function(buffer) {
-                                        assert_true(equalBuffers(buffer, derivations[passwordSize][saltSize][hashName][iterations].slice(0, derivedKeyType.algorithm.length/8)), "Exported key matches correct value");
-                                    }, function(err) {
-                                        assert_unreached("Exporting derived key failed with error " + err.name + ": " + err.message);
-                                    });
-                                }, function(err) {
-                                    assert_unreached("deriveKey failed with error " + err.name + ": " + err.message);
-
-                                });
-                            }, testName);
-
-                            // Test various error conditions for deriveKey:
-
-                            // - illegal name for hash algorithm (NotSupportedError)
-                            var badHash = hashName.substring(0, 3) + hashName.substring(4);
+                        context.derivedKeyTypes.forEach(function(derivedKeyType) {
                             subsetTest(promise_test, function(test) {
-                                return subtle.deriveKey({name: "PBKDF2", salt: salts[saltSize], hash: badHash, iterations: parseInt(iterations)}, baseKeys[passwordSize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    assert_unreached("bad hash name should have thrown an NotSupportedError");
+                                return subtle.deriveKey(zeroIterationAlgorithm, context.keys.baseKeys[passwordSize], derivedKeyType.algorithm, true, derivedKeyType.usages)
+                                .then(function(derivation) {
+                                    assert_unreached("0 iterations should have thrown an error");
                                 }, function(err) {
-                                    assert_equals(err.name, "NotSupportedError", "deriveKey with bad hash name correctly threw NotSupportedError: " + err.message);
+                                    assert_equals(err.name, "OperationError", "derivekey with 0 iterations correctly threw OperationError: " + err.message);
                                 });
-                            }, testName + " with bad hash name " + badHash);
-
-                            // - baseKey usages missing "deriveKey" (InvalidAccessError)
-                            subsetTest(promise_test, function(test) {
-                                return subtle.deriveKey({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, noKey[passwordSize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    assert_unreached("missing deriveKey usage should have thrown an InvalidAccessError");
-                                }, function(err) {
-                                    assert_equals(err.name, "InvalidAccessError", "deriveKey with missing deriveKey usage correctly threw InvalidAccessError: " + err.message);
-                                });
-                            }, testName + " with missing deriveKey usage");
-
-                            // - baseKey algorithm does not match PBKDF2 (InvalidAccessError)
-                            subsetTest(promise_test, function(test) {
-                                return subtle.deriveKey({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, wrongKey, derivedKeyType.algorithm, true, derivedKeyType.usages)
-                                .then(function(key) {
-                                    assert_unreached("wrong (ECDH) key should have thrown an InvalidAccessError");
-                                }, function(err) {
-                                    assert_equals(err.name, "InvalidAccessError", "deriveKey with wrong (ECDH) key correctly threw InvalidAccessError: " + err.message);
-                                });
-                            }, testName + " with wrong (ECDH) key");
-
+                            }, context.derivedKeyTestName(derivedKeyType, zeroIterationName));
                         });
-
-                        // length not multiple of 8 (OperationError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, baseKeys[passwordSize], 44)
-                            .then(function(derivation) {
-                                assert_unreached("non-multiple of 8 length should have thrown an OperationError");
-                            }, function(err) {
-                                assert_equals(err.name, "OperationError", "deriveBits with non-multiple of 8 length correctly threw OperationError: " + err.message);
-                            });
-                        }, testName + " with non-multiple of 8 length");
-
-                        // - illegal name for hash algorithm (NotSupportedError)
-                        var badHash = hashName.substring(0, 3) + hashName.substring(4);
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: badHash, iterations: parseInt(iterations)}, baseKeys[passwordSize], 256)
-                            .then(function(derivation) {
-                                assert_unreached("bad hash name should have thrown an NotSupportedError");
-                            }, function(err) {
-                                assert_equals(err.name, "NotSupportedError", "deriveBits with bad hash name correctly threw NotSupportedError: " + err.message);
-                            });
-                        }, testName + " with bad hash name " + badHash);
-
-                        // - baseKey usages missing "deriveBits" (InvalidAccessError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, noBits[passwordSize], 256)
-                            .then(function(derivation) {
-                                assert_unreached("missing deriveBits usage should have thrown an InvalidAccessError");
-                            }, function(err) {
-                                assert_equals(err.name, "InvalidAccessError", "deriveBits with missing deriveBits usage correctly threw InvalidAccessError: " + err.message);
-                            });
-                        }, testName + " with missing deriveBits usage");
-
-                        // - baseKey algorithm does not match PBKDF2 (InvalidAccessError)
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: parseInt(iterations)}, wrongKey, 256)
-                            .then(function(derivation) {
-                                assert_unreached("wrong (ECDH) key should have thrown an InvalidAccessError");
-                            }, function(err) {
-                                assert_equals(err.name, "InvalidAccessError", "deriveBits with wrong (ECDH) key correctly threw InvalidAccessError: " + err.message);
-                            });
-                        }, testName + " with wrong (ECDH) key");
-                    });
-
-                    // Check that 0 iterations throws proper error
-                    subsetTest(promise_test, function(test) {
-                        return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: 0}, baseKeys[passwordSize], 256)
-                        .then(function(derivation) {
-                            assert_unreached("0 iterations should have thrown an error");
-                        }, function(err) {
-                            assert_equals(err.name, "OperationError", "deriveBits with 0 iterations correctly threw OperationError: " + err.message);
-                        });
-                    }, passwordSize + " password, " + saltSize + " salt, " + hashName + ", with 0 iterations");
-
-                    derivedKeyTypes.forEach(function(derivedKeyType) {
-                        var testName = "Derived key of type ";
-                        Object.keys(derivedKeyType.algorithm).forEach(function(prop) {
-                            testName += prop + ": " + derivedKeyType.algorithm[prop] + " ";
-                        });
-                        testName += " using " + passwordSize + " password, " + saltSize + " salt, " + hashName + ", with 0 iterations";
-
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveKey({name: "PBKDF2", salt: salts[saltSize], hash: hashName, iterations: 0}, baseKeys[passwordSize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                            .then(function(derivation) {
-                                assert_unreached("0 iterations should have thrown an error");
-                            }, function(err) {
-                                assert_equals(err.name, "OperationError", "derivekey with 0 iterations correctly threw OperationError: " + err.message);
-                            });
-                        }, testName);
                     });
-                });
-
-                // - legal algorithm name but not digest one (e.g., PBKDF2) (NotSupportedError)
-                var nonDigestHash = "PBKDF2";
-                [1, 1000, 100000].forEach(function(iterations) {
-                    var testName = passwordSize + " password, " + saltSize + " salt, " + nonDigestHash + ", with " + iterations + " iterations";
-
-                    subsetTest(promise_test, function(test) {
-                        return subtle.deriveBits({name: "PBKDF2", salt: salts[saltSize], hash: nonDigestHash, iterations: parseInt(iterations)}, baseKeys[passwordSize], 256)
-                        .then(function(derivation) {
-                            assert_unreached("non-digest algorithm should have thrown an NotSupportedError");
-                        }, function(err) {
-                            assert_equals(err.name, "NotSupportedError", "deriveBits with non-digest algorithm correctly threw NotSupportedError: " + err.message);
-                        });
-                    }, testName + " with non-digest algorithm " + nonDigestHash);
 
-                    derivedKeyTypes.forEach(function(derivedKeyType) {
-                        var testName = "Derived key of type ";
-                        Object.keys(derivedKeyType.algorithm).forEach(function(prop) {
-                            testName += prop + ": " + derivedKeyType.algorithm[prop] + " ";
+                    var nonDigestHash = "PBKDF2";
+                    [1, 1000, 100000].forEach(function(iterations) {
+                        var testName = passwordSize + " password, " + saltSize + " salt, " + nonDigestHash + ", with " + iterations + " iterations";
+                        context.registerNonDigestCase({
+                            name: testName,
+                            keyName: passwordSize,
+                            hash: nonDigestHash,
+                            algorithm: {name: "PBKDF2", salt: salts[saltSize], hash: nonDigestHash, iterations: parseInt(iterations)}
                         });
-                        testName += " using " + passwordSize + " password, " + saltSize + " salt, " + nonDigestHash + ", with " + iterations + " iterations";
-
-                        subsetTest(promise_test, function(test) {
-                            return subtle.deriveKey({name: "PBKDF2", salt: salts[saltSize], hash: nonDigestHash, iterations: parseInt(iterations)}, baseKeys[passwordSize], derivedKeyType.algorithm, true, derivedKeyType.usages)
-                            .then(function(derivation) {
-                                assert_unreached("non-digest algorithm should have thrown an NotSupportedError");
-                            }, function(err) {
-                                assert_equals(err.name, "NotSupportedError", "derivekey with non-digest algorithm correctly threw NotSupportedError: " + err.message);
-                            });
-                        }, testName);
                     });
-
                 });
-
             });
-        });
+        }
     });
-
-    // Deriving bits and keys requires starting with a base key, which is created
-    // by importing a password. setUpBaseKeys returns a promise that yields the
-    // necessary base keys.
-    function setUpBaseKeys(passwords) {
-        var promises = [];
-
-        var baseKeys = {};
-        var noBits = {};
-        var noKey = {};
-        var wrongKey = null;
-
-        Object.keys(passwords).forEach(function(passwordSize) {
-            var promise = subtle.importKey("raw", passwords[passwordSize], {name: "PBKDF2"}, false, ["deriveKey", "deriveBits"])
-            .then(function(baseKey) {
-                baseKeys[passwordSize] = baseKey;
-            }, function(err) {
-                baseKeys[passwordSize] = null;
-            });
-            promises.push(promise);
-
-            promise = subtle.importKey("raw", passwords[passwordSize], {name: "PBKDF2"}, false, ["deriveBits"])
-            .then(function(baseKey) {
-                noKey[passwordSize] = baseKey;
-            }, function(err) {
-                noKey[passwordSize] = null;
-            });
-            promises.push(promise);
-
-            promise = subtle.importKey("raw", passwords[passwordSize], {name: "PBKDF2"}, false, ["deriveKey"])
-            .then(function(baseKey) {
-                noBits[passwordSize] = baseKey;
-            }, function(err) {
-                noBits[passwordSize] = null;
-            });
-            promises.push(promise);
-        });
-
-        var promise = subtle.generateKey({name: "ECDH", namedCurve: "P-256"}, false, ["deriveKey", "deriveBits"])
-        .then(function(baseKey) {
-            wrongKey = baseKey.privateKey;
-        }, function(err) {
-            wrongKey = null;
-        });
-        promises.push(promise);
-
-
-        return Promise.all(promises).then(function() {
-            return {baseKeys: baseKeys, noBits: noBits, noKey: noKey, wrongKey: wrongKey};
-        });
-    }
-
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/cshake.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/digest/cshake.tentative.https.any.js
index 81793666294c..1bf78f581154 100644
--- a/test/fixtures/wpt/WebCryptoAPI/digest/cshake.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/cshake.tentative.https.any.js
@@ -1,23 +1,12 @@
 // META: title=WebCryptoAPI: digest() cSHAKE algorithms
 // META: script=../util/helpers.js
+// META: script=digest_test_data.js
+// META: script=digest.js
 // META: timeout=long
 
 var subtle = crypto.subtle; // Change to test prefixed implementations
 
-var sourceData = {
-  empty: new Uint8Array(0),
-  short: new Uint8Array([
-    21, 110, 234, 124, 193, 76, 86, 203, 148, 219, 3, 10, 74, 157, 149, 255,
-  ]),
-  medium: new Uint8Array([
-    182, 200, 249, 223, 100, 140, 208, 136, 183, 15, 56, 231, 65, 151, 177, 140,
-    184, 30, 30, 67, 80, 213, 11, 204, 184, 251, 90, 115, 121, 200, 123, 178,
-    227, 214, 237, 84, 97, 237, 30, 159, 54, 243, 64, 163, 150, 42, 68, 107,
-    129, 91, 121, 75, 75, 212, 58, 68, 3, 80, 32, 119, 178, 37, 108, 200, 7,
-    131, 127, 58, 172, 209, 24, 235, 75, 156, 43, 174, 184, 151, 6, 134, 37,
-    171, 172, 161, 147,
-  ]),
-};
+var sourceData = getDigestSourceData(false);
 
 // Test different output lengths for cSHAKE
 var digestLengths = [0, 256, 384, 512];
@@ -158,91 +147,19 @@ var digestedData = {
 };
 
 // Test cSHAKE digest algorithms with variable output lengths
-Object.keys(digestedData).forEach(function (alg) {
-  digestLengths.forEach(function (length) {
-    Object.keys(sourceData).forEach(function (size) {
-      promise_test(function (test) {
-        return crypto.subtle
-          .digest({ name: alg, outputLength: length }, sourceData[size])
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, digestedData[alg][length][size]),
-              'digest matches expected'
-            );
-          });
-      }, alg + ' with ' + length + ' bit output and ' + size + ' source data');
-
-      if (sourceData[size].length > 0) {
-        promise_test(function (test) {
-          var buffer = new Uint8Array(sourceData[size]);
-          // Alter the buffer before calling digest
-          buffer[0] = ~buffer[0];
-          return crypto.subtle
-            .digest({
-              get name() {
-                // Alter the buffer back while calling digest
-                buffer[0] = sourceData[size][0];
-                return alg;
-              },
-              outputLength: length
-            }, buffer)
-            .then(function (result) {
-              assert_true(
-                equalBuffers(result, digestedData[alg][length][size]),
-                'digest matches expected'
-              );
-            });
-        }, alg + ' with ' + length + ' bit output and ' + size + ' source data and altered buffer during call');
-
-        promise_test(function (test) {
-          var buffer = new Uint8Array(sourceData[size]);
-          var promise = crypto.subtle
-            .digest({ name: alg, outputLength: length }, buffer)
-            .then(function (result) {
-              assert_true(
-                equalBuffers(result, digestedData[alg][length][size]),
-                'digest matches expected'
-              );
-            });
-          // Alter the buffer after calling digest
-          buffer[0] = ~buffer[0];
-          return promise;
-        }, alg + ' with ' + length + ' bit output and ' + size + ' source data and altered buffer after call');
-
-        promise_test(function (test) {
-          var buffer = new Uint8Array(sourceData[size]);
-          return crypto.subtle
-            .digest({
-              get name() {
-                // Transfer the buffer while calling digest
-                buffer.buffer.transfer();
-                return alg;
-              },
-              outputLength: length
-            }, buffer)
-            .then(function (result) {
-              assert_true(
-                equalBuffers(result, digestedData[alg][length].empty),
-                'digest on transferred buffer should match result for empty buffer'
-              );
-            });
-        }, alg + ' with ' + length + ' bit output and ' + size + ' source data and transferred buffer during call');
-
-        promise_test(function (test) {
-          var buffer = new Uint8Array(sourceData[size]);
-          var promise = crypto.subtle
-            .digest({ name: alg, outputLength: length }, buffer)
-            .then(function (result) {
-              assert_true(
-                equalBuffers(result, digestedData[alg][length][size]),
-                'digest matches expected'
-              );
-            });
-          // Transfer the buffer after calling digest
-          buffer.buffer.transfer();
-          return promise;
-        }, alg + ' with ' + length + ' bit output and ' + size + ' source data and transferred buffer after call');
-      }
+runDigestTests(subtle, sourceData, function (size) {
+  var vectors = [];
+  Object.keys(digestedData).forEach(function (alg) {
+    digestLengths.forEach(function (length) {
+      vectors.push({
+        algorithm: {name: alg, outputLength: length},
+        expected: digestedData[alg][length][size],
+        emptyExpected: digestedData[alg][length].empty,
+        label: alg + ' with ' + length + ' bit output and ' +
+          size + ' source data',
+        mutations: true,
+      });
     });
   });
+  return vectors;
 });
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/digest.https.any.js b/test/fixtures/wpt/WebCryptoAPI/digest/digest.https.any.js
index 38ce85ec06cf..26711b2880d9 100644
--- a/test/fixtures/wpt/WebCryptoAPI/digest/digest.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/digest.https.any.js
@@ -1,19 +1,12 @@
 // META: title=WebCryptoAPI: digest()
 // META: script=../util/helpers.js
+// META: script=digest_test_data.js
+// META: script=digest.js
 // META: timeout=long
 
     var subtle = crypto.subtle; // Change to test prefixed implementations
 
-    var sourceData = {
-        empty: new Uint8Array(0),
-        short: new Uint8Array([21, 110, 234, 124, 193, 76, 86, 203, 148, 219, 3, 10, 74, 157, 149, 255]),
-        medium: new Uint8Array([182, 200, 249, 223, 100, 140, 208, 136, 183, 15, 56, 231, 65, 151, 177, 140, 184, 30, 30, 67, 80, 213, 11, 204, 184, 251, 90, 115, 121, 200, 123, 178, 227, 214, 237, 84, 97, 237, 30, 159, 54, 243, 64, 163, 150, 42, 68, 107, 129, 91, 121, 75, 75, 212, 58, 68, 3, 80, 32, 119, 178, 37, 108, 200, 7, 131, 127, 58, 172, 209, 24, 235, 75, 156, 43, 174, 184, 151, 6, 134, 37, 171, 172, 161, 147])
-    };
-
-    sourceData.long = new Uint8Array(1024 * sourceData.medium.byteLength);
-    for (var i=0; i<1024; i++) {
-        sourceData.long.set(sourceData.medium, i * sourceData.medium.byteLength);
-    }
+    var sourceData = getDigestSourceData(true);
 
     var digestedData = {
         "sha-1": {
@@ -43,105 +36,36 @@
     }
 
     // Try every combination of hash with source data size. Variations tested are
-    // hash name in upper, lower, or mixed case, and upper-case version with the
-    // source buffer altered after call.
-    Object.keys(sourceData).forEach(function(size) {
-        Object.keys(digestedData).forEach(function(alg) {
+    // hash name in upper, lower, or mixed case, plus buffer mutation and transfer.
+    runDigestTests(subtle, sourceData, function (size) {
+        var vectors = [];
+        Object.keys(digestedData).forEach(function (alg) {
             var upCase = alg.toUpperCase();
             var downCase = alg.toLowerCase();
-            var mixedCase = upCase.substr(0, 1) + downCase.substr(1);
-
-            promise_test(function(test) {
-                var promise = subtle.digest({name: upCase}, sourceData[size])
-                .then(function(result) {
-                    assert_true(equalBuffers(result, digestedData[alg][size]), "digest() yielded expected result for " + alg + ":" + size);
-                }, function(err) {
-                    assert_unreached("digest() threw an error for " + alg + ":" + size + " - " + err.message);
-                });
-
-                return promise;
-            }, upCase + " with " + size + " source data");
-
-            promise_test(function(test) {
-                var promise = subtle.digest({name: downCase}, sourceData[size])
-                .then(function(result) {
-                    assert_true(equalBuffers(result, digestedData[alg][size]), "digest() yielded expected result for " + alg + ":" + size);
-                }, function(err) {
-                    assert_unreached("digest() threw an error for " + alg + ":" + size + " - " + err.message);
-                });
-
-                return promise;
-            }, downCase + " with " + size + " source data");
-
-            promise_test(function(test) {
-                var promise = subtle.digest({name: mixedCase}, sourceData[size])
-                .then(function(result) {
-                    assert_true(equalBuffers(result, digestedData[alg][size]), "digest() yielded expected result for " + alg + ":" + size);
-                }, function(err) {
-                    assert_unreached("digest() threw an error for " + alg + ":" + size + " - " + err.message);
-                });
-
-                return promise;
-            }, mixedCase + " with " + size + " source data");
-
-            if (sourceData[size].length > 0) {
-                promise_test(function(test) {
-                    var copiedBuffer = copyBuffer(sourceData[size]);
-                    copiedBuffer[0] = 255 - copiedBuffer[0];
-                    var promise = subtle.digest({
-                        get name() {
-                            copiedBuffer[0] = sourceData[size][0];
-                            return upCase;
-                        }
-                    }, copiedBuffer)
-                    .then(function(result) {
-                        assert_true(equalBuffers(result, digestedData[alg][size]), "digest() yielded expected result for " + alg + ":" + size);
-                    }, function(err) {
-                        assert_unreached("digest() threw an error for " + alg + ":" + size + " - " + err.message);
-                    });
-                    return promise;
-                }, upCase + " with " + size + " source data and altered buffer during call");
-
-                promise_test(function(test) {
-                    var copiedBuffer = copyBuffer(sourceData[size]);
-                    var promise = subtle.digest({name: upCase}, copiedBuffer)
-                    .then(function(result) {
-                        assert_true(equalBuffers(result, digestedData[alg][size]), "digest() yielded expected result for " + alg + ":" + size);
-                    }, function(err) {
-                        assert_unreached("digest() threw an error for " + alg + ":" + size + " - " + err.message);
-                    });
-
-                    copiedBuffer[0] = 255 - copiedBuffer[0];
-                    return promise;
-                }, upCase + " with " + size + " source data and altered buffer after call");
-
-                promise_test(function(test) {
-                    var copiedBuffer = copyBuffer(sourceData[size]);
-                    copiedBuffer.buffer.transfer();
-                    return subtle.digest({name: upCase}, copiedBuffer)
-                    .then(function(result) {
-                        assert_true(equalBuffers(result, digestedData[alg].empty), "digest() on transferred buffer should yield result for empty buffer for " + alg + ":" + size);
-                    }, function(err) {
-                        assert_unreached("digest() threw an error for transferred buffer for " + alg + ":" + size + ": " + err.message);
-                    });
-                }, upCase + " with " + size + " source data and transferred buffer during call");
-
-                promise_test(function(test) {
-                    var copiedBuffer = copyBuffer(sourceData[size]);
-                    var promise = subtle.digest({name: upCase}, copiedBuffer)
-                    .then(function(result) {
-                        assert_true(equalBuffers(result, digestedData[alg][size]), "digest() yielded expected result for " + alg + ":" + size);
-                    }, function(err) {
-                        assert_unreached("digest() threw an error for " + alg + ":" + size + " - " + err.message);
-                    });
-
-                    copiedBuffer.buffer.transfer();
-                    return promise;
-                }, upCase + " with " + size + " source data and transferred buffer after call");
-            }
+            var mixedCase = upCase.slice(0, 1) + downCase.slice(1);
+            var expected = digestedData[alg][size];
+
+            vectors.push({
+                algorithm: {name: upCase},
+                expected: expected,
+                emptyExpected: digestedData[alg].empty,
+                label: upCase + " with " + size + " source data",
+                mutations: true,
+                transferBeforeCall: true,
+            });
+            vectors.push({
+                algorithm: {name: downCase},
+                expected: expected,
+                label: downCase + " with " + size + " source data",
+            });
+            vectors.push({
+                algorithm: {name: mixedCase},
+                expected: expected,
+                label: mixedCase + " with " + size + " source data",
+            });
         });
+        return vectors;
     });
-
     // Call digest() with bad algorithm names to get an error
     var badNames = ["AES-GCM", "RSA-OAEP", "PBKDF2", "AES-KW"];
     Object.keys(sourceData).forEach(function(size) {
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/digest.js b/test/fixtures/wpt/WebCryptoAPI/digest/digest.js
new file mode 100644
index 000000000000..9ef9c69a180b
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/digest.js
@@ -0,0 +1,92 @@
+function runDigestTests(subtle, sourceData, getVectors) {
+  function algorithmName(algorithm) {
+    return typeof algorithm === 'string' ? algorithm : algorithm.name;
+  }
+
+  function withNameGetter(algorithm, getter) {
+    var result = typeof algorithm === 'string' ? {} : { ...algorithm };
+    Object.defineProperty(result, 'name', {
+      enumerable: true,
+      get: getter,
+    });
+    return result;
+  }
+
+  Object.keys(sourceData).forEach(function (size) {
+    getVectors(size).forEach(function (vector) {
+      promise_test(function () {
+        return subtle.digest(vector.algorithm, sourceData[size])
+          .then(function (result) {
+            assert_true(
+              equalBuffers(result, vector.expected),
+              'digest matches expected'
+            );
+          });
+      }, vector.label);
+
+      if (!vector.mutations || sourceData[size].length === 0) {
+        return;
+      }
+
+      promise_test(function () {
+        var buffer = new Uint8Array(sourceData[size]);
+        buffer[0] = ~buffer[0];
+        var algorithm = withNameGetter(vector.algorithm, function () {
+          buffer[0] = sourceData[size][0];
+          return algorithmName(vector.algorithm);
+        });
+        return subtle.digest(algorithm, buffer).then(function (result) {
+          assert_true(
+            equalBuffers(result, vector.expected),
+            'digest matches expected'
+          );
+        });
+      }, vector.label + ' and altered buffer during call');
+
+      promise_test(function () {
+        var buffer = new Uint8Array(sourceData[size]);
+        var promise = subtle.digest(vector.algorithm, buffer)
+          .then(function (result) {
+            assert_true(
+              equalBuffers(result, vector.expected),
+              'digest matches expected'
+            );
+          });
+        buffer[0] = ~buffer[0];
+        return promise;
+      }, vector.label + ' and altered buffer after call');
+
+      promise_test(function () {
+        var buffer = new Uint8Array(sourceData[size]);
+        var algorithm = vector.transferBeforeCall
+          ? vector.algorithm
+          : withNameGetter(vector.algorithm, function () {
+              buffer.buffer.transfer();
+              return algorithmName(vector.algorithm);
+            });
+        if (vector.transferBeforeCall) {
+          buffer.buffer.transfer();
+        }
+        return subtle.digest(algorithm, buffer).then(function (result) {
+          assert_true(
+            equalBuffers(result, vector.emptyExpected),
+            'digest on transferred buffer should match result for empty buffer'
+          );
+        });
+      }, vector.label + ' and transferred buffer during call');
+
+      promise_test(function () {
+        var buffer = new Uint8Array(sourceData[size]);
+        var promise = subtle.digest(vector.algorithm, buffer)
+          .then(function (result) {
+            assert_true(
+              equalBuffers(result, vector.expected),
+              'digest matches expected'
+            );
+          });
+        buffer.buffer.transfer();
+        return promise;
+      }, vector.label + ' and transferred buffer after call');
+    });
+  });
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/digest_test_data.js b/test/fixtures/wpt/WebCryptoAPI/digest/digest_test_data.js
new file mode 100644
index 000000000000..f088e02a0870
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/digest_test_data.js
@@ -0,0 +1,25 @@
+function getDigestSourceData(includeLong) {
+  var sourceData = {
+    empty: new Uint8Array(0),
+    short: new Uint8Array([
+      21, 110, 234, 124, 193, 76, 86, 203, 148, 219, 3, 10, 74, 157, 149, 255,
+    ]),
+    medium: new Uint8Array([
+      182, 200, 249, 223, 100, 140, 208, 136, 183, 15, 56, 231, 65, 151, 177,
+      140, 184, 30, 30, 67, 80, 213, 11, 204, 184, 251, 90, 115, 121, 200, 123,
+      178, 227, 214, 237, 84, 97, 237, 30, 159, 54, 243, 64, 163, 150, 42, 68,
+      107, 129, 91, 121, 75, 75, 212, 58, 68, 3, 80, 32, 119, 178, 37, 108,
+      200, 7, 131, 127, 58, 172, 209, 24, 235, 75, 156, 43, 174, 184, 151, 6,
+      134, 37, 171, 172, 161, 147,
+    ]),
+  };
+
+  if (includeLong) {
+    sourceData.long = new Uint8Array(1024 * sourceData.medium.byteLength);
+    for (var i = 0; i < 1024; i++) {
+      sourceData.long.set(sourceData.medium, i * sourceData.medium.byteLength);
+    }
+  }
+
+  return sourceData;
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/kangarootwelve.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/digest/kangarootwelve.tentative.https.any.js
index 9f800b793787..0e38eb0542ad 100644
--- a/test/fixtures/wpt/WebCryptoAPI/digest/kangarootwelve.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/kangarootwelve.tentative.https.any.js
@@ -1,24 +1,10 @@
 // META: title=WebCryptoAPI: digest() KangarooTwelve algorithms
 // META: script=../util/helpers.js
+// META: script=xof_digest.js
 // META: timeout=long
 
 var subtle = crypto.subtle; // Change to test prefixed implementations
 
-// Generates a Uint8Array of length n by repeating the pattern 00 01 02 .. F9 FA.
-function ptn(n) {
-  var buf = new Uint8Array(n);
-  for (var i = 0; i < n; i++)
-    buf[i] = i % 251;
-  return buf;
-}
-
-function hexToBytes(hex) {
-  var bytes = new Uint8Array(hex.length / 2);
-  for (var i = 0; i < hex.length; i += 2)
-    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
-  return bytes;
-}
-
 // RFC 9861 Section 5 test vectors
 // [input, outputLengthBits, expected hex(, customization)]
 var kt128Vectors = [
@@ -182,143 +168,21 @@ var largeOutputTests = [
    '2752f3ccd855288efee5fcbb8b563069'],
 ];
 
-largeOutputTests.forEach(function (entry) {
-  var alg = entry[0];
-  var outputLength = entry[1];
-  var lastN = entry[2];
-  var expected = entry[3];
-
-  promise_test(function (test) {
-    return subtle
-      .digest({ name: alg, outputLength: outputLength }, new Uint8Array(0))
-      .then(function (result) {
-        var full = new Uint8Array(result);
-        var last = full.slice(full.length - lastN);
-        assert_true(
-          equalBuffers(last.buffer, hexToBytes(expected)),
-          'last ' + lastN + ' bytes of digest match expected'
-        );
-      });
-  }, alg + ' with ' + outputLength + ' bit output, verify last ' + lastN + ' bytes');
-});
-
-function customizationEqual(emptyDataVector, customization) {
-  return equalBuffers(customization ?? new Uint8Array(0), emptyDataVector[3] ?? new Uint8Array(0));
-}
-
-function outputLengthLessOrEqual(emptyDataVector, outputLength) {
-  return outputLength <= emptyDataVector[1];
-}
-
-var allVectors = {
-  KT128: kt128Vectors,
-  KT256: kt256Vectors,
-};
-
-Object.keys(allVectors).forEach(function (alg) {
-  var emptyDataVector = allVectors[alg][0];
-  allVectors[alg].forEach(function (vector, i) {
-    var input = vector[0];
-    var outputLength = vector[1];
-    var expected = vector[2];
-    var customization = vector[3];
-
-    var algorithmParams = { name: alg, outputLength: outputLength };
-    if (customization !== undefined)
-      algorithmParams.customization = customization;
-
-    var label = alg + ' vector #' + (i + 1) +
-      ' (' + outputLength + ' bit output, ' + input.length + ' byte input' +
-      (customization !== undefined ? ', C=' + customization.length + ' bytes' : '') + ')';
-
-    promise_test(function (test) {
-      return subtle
-        .digest(algorithmParams, input)
-        .then(function (result) {
-          assert_true(
-            equalBuffers(result, hexToBytes(expected)),
-            'digest matches expected'
-          );
-        });
-    }, label);
-
-    if (input.length > 0) {
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        // Alter the buffer before calling digest
-        buffer[0] = ~buffer[0];
-        return subtle
-          .digest({
-            get name() {
-              // Alter the buffer back while calling digest
-              buffer[0] = input[0];
-              return alg;
-            },
-            outputLength: outputLength,
-            customization: customization,
-          }, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, hexToBytes(expected)),
-              'digest matches expected'
-            );
-          });
-      }, label + ' and altered buffer during call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        var promise = subtle
-          .digest(algorithmParams, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, hexToBytes(expected)),
-              'digest matches expected'
-            );
-          });
-        // Alter the buffer after calling digest
-        buffer[0] = ~buffer[0];
-        return promise;
-      }, label + ' and altered buffer after call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        return subtle
-          .digest({
-            get name() {
-              // Transfer the buffer while calling digest
-              buffer.buffer.transfer();
-              return alg;
-            },
-            outputLength: outputLength,
-            customization: customization,
-          }, buffer)
-          .then(function (result) {
-            if (customizationEqual(emptyDataVector, customization) && outputLengthLessOrEqual(emptyDataVector, outputLength)) {
-              assert_true(
-                equalBuffers(result, Uint8Array.fromHex(emptyDataVector[2]).subarray(0, outputLength / 8)),
-                'digest on transferred buffer should match result for empty buffer'
-              );
-            } else {
-              assert_equals(result.byteLength, outputLength / 8,
-                'digest on transferred buffer should have correct output length');
-            }
-          });
-      }, label + ' and transferred buffer during call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        var promise = subtle
-          .digest(algorithmParams, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, hexToBytes(expected)),
-              'digest matches expected'
-            );
-          });
-        // Transfer the buffer after calling digest
-        buffer.buffer.transfer();
-        return promise;
-      }, label + ' and transferred buffer after call');
-    }
-  });
+runXofDigestTests(subtle, {
+  vectors: {
+    KT128: kt128Vectors,
+    KT256: kt256Vectors,
+  },
+  largeOutputTests: largeOutputTests,
+  parameterName: 'customization',
+  formatParameter: function (customization) {
+    return customization !== undefined ?
+      ', C=' + customization.length + ' bytes' : '';
+  },
+  parameterEquals: function (emptyDataVector, customization) {
+    return equalBuffers(
+      customization ?? new Uint8Array(0),
+      emptyDataVector[3] ?? new Uint8Array(0)
+    );
+  },
 });
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/sha3.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/digest/sha3.tentative.https.any.js
index f9f38eadc2c3..a6cafbb639f8 100644
--- a/test/fixtures/wpt/WebCryptoAPI/digest/sha3.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/sha3.tentative.https.any.js
@@ -1,28 +1,12 @@
 // META: title=WebCryptoAPI: digest() SHA-3 algorithms
 // META: script=../util/helpers.js
+// META: script=digest_test_data.js
+// META: script=digest.js
 // META: timeout=long
 
 var subtle = crypto.subtle; // Change to test prefixed implementations
 
-var sourceData = {
-  empty: new Uint8Array(0),
-  short: new Uint8Array([
-    21, 110, 234, 124, 193, 76, 86, 203, 148, 219, 3, 10, 74, 157, 149, 255,
-  ]),
-  medium: new Uint8Array([
-    182, 200, 249, 223, 100, 140, 208, 136, 183, 15, 56, 231, 65, 151, 177, 140,
-    184, 30, 30, 67, 80, 213, 11, 204, 184, 251, 90, 115, 121, 200, 123, 178,
-    227, 214, 237, 84, 97, 237, 30, 159, 54, 243, 64, 163, 150, 42, 68, 107,
-    129, 91, 121, 75, 75, 212, 58, 68, 3, 80, 32, 119, 178, 37, 108, 200, 7,
-    131, 127, 58, 172, 209, 24, 235, 75, 156, 43, 174, 184, 151, 6, 134, 37,
-    171, 172, 161, 147,
-  ]),
-};
-
-sourceData.long = new Uint8Array(1024 * sourceData.medium.byteLength);
-for (var i = 0; i < 1024; i++) {
-  sourceData.long.set(sourceData.medium, i * sourceData.medium.byteLength);
-}
+var sourceData = getDigestSourceData(true);
 
 var digestedData = {
   'SHA3-256': {
@@ -97,83 +81,14 @@ var digestedData = {
 };
 
 // Test SHA-3 digest algorithms
-Object.keys(sourceData).forEach(function (size) {
-  Object.keys(digestedData).forEach(function (alg) {
-    promise_test(function (test) {
-      return crypto.subtle
-        .digest(alg, sourceData[size])
-        .then(function (result) {
-          assert_true(
-            equalBuffers(result, digestedData[alg][size]),
-            'digest matches expected'
-          );
-        });
-    }, alg + ' with ' + size + ' source data');
-
-    if (sourceData[size].length > 0) {
-      promise_test(function (test) {
-        var buffer = new Uint8Array(sourceData[size]);
-        // Alter the buffer before calling digest
-        buffer[0] = ~buffer[0];
-        return crypto.subtle
-          .digest({
-            get name() {
-              // Alter the buffer back while calling digest
-              buffer[0] = sourceData[size][0];
-              return alg;
-            }
-          }, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, digestedData[alg][size]),
-              'digest matches expected'
-            );
-          });
-      }, alg + ' with ' + size + ' source data and altered buffer during call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(sourceData[size]);
-        var promise = crypto.subtle.digest(alg, buffer).then(function (result) {
-          assert_true(
-            equalBuffers(result, digestedData[alg][size]),
-            'digest matches expected'
-          );
-        });
-        // Alter the buffer after calling digest
-        buffer[0] = ~buffer[0];
-        return promise;
-      }, alg + ' with ' + size + ' source data and altered buffer after call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(sourceData[size]);
-        return crypto.subtle
-          .digest({
-            get name() {
-              // Transfer the buffer while calling digest
-              buffer.buffer.transfer();
-              return alg;
-            }
-          }, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, digestedData[alg].empty),
-              'digest on transferred buffer should match result for empty buffer'
-            );
-          });
-      }, alg + ' with ' + size + ' source data and transferred buffer during call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(sourceData[size]);
-        var promise = crypto.subtle.digest(alg, buffer).then(function (result) {
-          assert_true(
-            equalBuffers(result, digestedData[alg][size]),
-            'digest matches expected'
-          );
-        });
-        // Transfer the buffer after calling digest
-        buffer.buffer.transfer();
-        return promise;
-      }, alg + ' with ' + size + ' source data and transferred buffer after call');
-    }
+runDigestTests(subtle, sourceData, function (size) {
+  return Object.keys(digestedData).map(function (alg) {
+    return {
+      algorithm: alg,
+      expected: digestedData[alg][size],
+      emptyExpected: digestedData[alg].empty,
+      label: alg + ' with ' + size + ' source data',
+      mutations: true,
+    };
   });
 });
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/turboshake.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/digest/turboshake.tentative.https.any.js
index 243931cd1198..356e6987956c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/digest/turboshake.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/turboshake.tentative.https.any.js
@@ -1,24 +1,10 @@
 // META: title=WebCryptoAPI: digest() TurboSHAKE algorithms
 // META: script=../util/helpers.js
+// META: script=xof_digest.js
 // META: timeout=long
 
 var subtle = crypto.subtle; // Change to test prefixed implementations
 
-// Generates a Uint8Array of length n by repeating the pattern 00 01 02 .. F9 FA.
-function ptn(n) {
-  var buf = new Uint8Array(n);
-  for (var i = 0; i < n; i++)
-    buf[i] = i % 251;
-  return buf;
-}
-
-function hexToBytes(hex) {
-  var bytes = new Uint8Array(hex.length / 2);
-  for (var i = 0; i < hex.length; i += 2)
-    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
-  return bytes;
-}
-
 // RFC 9861 Section 5 test vectors
 // [input, outputLengthBits, expected hex(, domainSeparation)]
 var turboSHAKE128Vectors = [
@@ -155,143 +141,18 @@ var largeOutputTests = [
    '207265dccf2f43534e9c61ba0c9d1d75'],
 ];
 
-largeOutputTests.forEach(function (entry) {
-  var alg = entry[0];
-  var outputLength = entry[1];
-  var lastN = entry[2];
-  var expected = entry[3];
-
-  promise_test(function (test) {
-    return subtle
-      .digest({ name: alg, outputLength: outputLength }, new Uint8Array(0))
-      .then(function (result) {
-        var full = new Uint8Array(result);
-        var last = full.slice(full.length - lastN);
-        assert_true(
-          equalBuffers(last.buffer, hexToBytes(expected)),
-          'last ' + lastN + ' bytes of digest match expected'
-        );
-      });
-  }, alg + ' with ' + outputLength + ' bit output, verify last ' + lastN + ' bytes');
-});
-
-function domainSeparationEqual(emptyDataVector, domainSeparation) {
-  return (domainSeparation ?? 0x1f) === (emptyDataVector[3] ?? 0x1f);
-}
-
-function outputLengthLessOrEqual(emptyDataVector, outputLength) {
-  return outputLength <= emptyDataVector[1];
-}
-
-var allVectors = {
-  TurboSHAKE128: turboSHAKE128Vectors,
-  TurboSHAKE256: turboSHAKE256Vectors,
-};
-
-Object.keys(allVectors).forEach(function (alg) {
-  var emptyDataVector = allVectors[alg][0];
-  allVectors[alg].forEach(function (vector, i) {
-    var input = vector[0];
-    var outputLength = vector[1];
-    var expected = vector[2];
-    var domainSeparation = vector[3];
-
-    var algorithmParams = { name: alg, outputLength: outputLength };
-    if (domainSeparation !== undefined)
-      algorithmParams.domainSeparation = domainSeparation;
-
-    var label = alg + ' vector #' + (i + 1) +
-      ' (' + outputLength + ' bit output, ' + input.length + ' byte input' +
-      (domainSeparation !== undefined ? ', D=0x' + domainSeparation.toString(16) : '') + ')';
-
-    promise_test(function (test) {
-      return subtle
-        .digest(algorithmParams, input)
-        .then(function (result) {
-          assert_true(
-            equalBuffers(result, hexToBytes(expected)),
-            'digest matches expected'
-          );
-        });
-    }, label);
-
-    if (input.length > 0) {
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        // Alter the buffer before calling digest
-        buffer[0] = ~buffer[0];
-        return subtle
-          .digest({
-            get name() {
-              // Alter the buffer back while calling digest
-              buffer[0] = input[0];
-              return alg;
-            },
-            outputLength: outputLength,
-            domainSeparation: domainSeparation,
-          }, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, hexToBytes(expected)),
-              'digest matches expected'
-            );
-          });
-      }, label + ' and altered buffer during call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        var promise = subtle
-          .digest(algorithmParams, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, hexToBytes(expected)),
-              'digest matches expected'
-            );
-          });
-        // Alter the buffer after calling digest
-        buffer[0] = ~buffer[0];
-        return promise;
-      }, label + ' and altered buffer after call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        return subtle
-          .digest({
-            get name() {
-              // Transfer the buffer while calling digest
-              buffer.buffer.transfer();
-              return alg;
-            },
-            outputLength: outputLength,
-            domainSeparation: domainSeparation,
-          }, buffer)
-          .then(function (result) {
-            if (domainSeparationEqual(emptyDataVector, domainSeparation) && outputLengthLessOrEqual(emptyDataVector, outputLength)) {
-              assert_true(
-                equalBuffers(result, Uint8Array.fromHex(emptyDataVector[2]).subarray(0, outputLength / 8)),
-                'digest on transferred buffer should match result for empty buffer'
-              );
-            } else {
-              assert_equals(result.byteLength, outputLength / 8,
-                'digest on transferred buffer should have correct output length');
-            }
-          });
-      }, label + ' and transferred buffer during call');
-
-      promise_test(function (test) {
-        var buffer = new Uint8Array(input);
-        var promise = subtle
-          .digest(algorithmParams, buffer)
-          .then(function (result) {
-            assert_true(
-              equalBuffers(result, hexToBytes(expected)),
-              'digest matches expected'
-            );
-          });
-        // Transfer the buffer after calling digest
-        buffer.buffer.transfer();
-        return promise;
-      }, label + ' and transferred buffer after call');
-    }
-  });
+runXofDigestTests(subtle, {
+  vectors: {
+    TurboSHAKE128: turboSHAKE128Vectors,
+    TurboSHAKE256: turboSHAKE256Vectors,
+  },
+  largeOutputTests: largeOutputTests,
+  parameterName: 'domainSeparation',
+  formatParameter: function (domainSeparation) {
+    return domainSeparation !== undefined ?
+      ', D=0x' + domainSeparation.toString(16) : '';
+  },
+  parameterEquals: function (emptyDataVector, domainSeparation) {
+    return (domainSeparation ?? 0x1f) === (emptyDataVector[3] ?? 0x1f);
+  },
 });
diff --git a/test/fixtures/wpt/WebCryptoAPI/digest/xof_digest.js b/test/fixtures/wpt/WebCryptoAPI/digest/xof_digest.js
new file mode 100644
index 000000000000..f5ef5846b796
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/digest/xof_digest.js
@@ -0,0 +1,146 @@
+// Generates a Uint8Array of length n by repeating the pattern 00 01 02 .. F9 FA.
+function ptn(n) {
+  var buf = new Uint8Array(n);
+  for (var i = 0; i < n; i++)
+    buf[i] = i % 251;
+  return buf;
+}
+
+function runXofDigestTests(subtle, options) {
+  options.largeOutputTests.forEach(function (entry) {
+    var alg = entry[0];
+    var outputLength = entry[1];
+    var lastN = entry[2];
+    var expected = entry[3];
+
+    promise_test(function (test) {
+      return subtle
+        .digest({ name: alg, outputLength: outputLength }, new Uint8Array(0))
+        .then(function (result) {
+          var full = new Uint8Array(result);
+          var last = full.slice(full.length - lastN);
+          assert_true(
+            equalBuffers(last.buffer, hexStringToUint8Array(expected)),
+            'last ' + lastN + ' bytes of digest match expected'
+          );
+        });
+    }, alg + ' with ' + outputLength + ' bit output, verify last ' + lastN + ' bytes');
+  });
+
+  Object.keys(options.vectors).forEach(function (alg) {
+    var emptyDataVector = options.vectors[alg][0];
+    options.vectors[alg].forEach(function (vector, i) {
+      var input = vector[0];
+      var outputLength = vector[1];
+      var expected = vector[2];
+      var parameter = vector[3];
+
+      var algorithmParams = { name: alg, outputLength: outputLength };
+      if (parameter !== undefined)
+        algorithmParams[options.parameterName] = parameter;
+
+      var label = alg + ' vector #' + (i + 1) +
+        ' (' + outputLength + ' bit output, ' + input.length + ' byte input' +
+        options.formatParameter(parameter) + ')';
+
+      promise_test(function (test) {
+        return subtle
+          .digest(algorithmParams, input)
+          .then(function (result) {
+            assert_true(
+              equalBuffers(result, hexStringToUint8Array(expected)),
+              'digest matches expected'
+            );
+          });
+      }, label);
+
+      if (input.length > 0) {
+        promise_test(function (test) {
+          var buffer = new Uint8Array(input);
+          // Alter the buffer before calling digest
+          buffer[0] = ~buffer[0];
+          var duringCallParams = {
+            get name() {
+              // Alter the buffer back while calling digest
+              buffer[0] = input[0];
+              return alg;
+            },
+            outputLength: outputLength,
+          };
+          duringCallParams[options.parameterName] = parameter;
+          return subtle
+            .digest(duringCallParams, buffer)
+            .then(function (result) {
+              assert_true(
+                equalBuffers(result, hexStringToUint8Array(expected)),
+                'digest matches expected'
+              );
+            });
+        }, label + ' and altered buffer during call');
+
+        promise_test(function (test) {
+          var buffer = new Uint8Array(input);
+          var promise = subtle
+            .digest(algorithmParams, buffer)
+            .then(function (result) {
+              assert_true(
+                equalBuffers(result, hexStringToUint8Array(expected)),
+                'digest matches expected'
+              );
+            });
+          // Alter the buffer after calling digest
+          buffer[0] = ~buffer[0];
+          return promise;
+        }, label + ' and altered buffer after call');
+
+        promise_test(function (test) {
+          var buffer = new Uint8Array(input);
+          var duringCallParams = {
+            get name() {
+              // Transfer the buffer while calling digest
+              buffer.buffer.transfer();
+              return alg;
+            },
+            outputLength: outputLength,
+          };
+          duringCallParams[options.parameterName] = parameter;
+          return subtle
+            .digest(duringCallParams, buffer)
+            .then(function (result) {
+              if (
+                options.parameterEquals(emptyDataVector, parameter) &&
+                outputLength <= emptyDataVector[1]
+              ) {
+                assert_true(
+                  equalBuffers(
+                    result,
+                    hexStringToUint8Array(emptyDataVector[2])
+                      .subarray(0, outputLength / 8)
+                  ),
+                  'digest on transferred buffer should match result for empty buffer'
+                );
+              } else {
+                assert_equals(result.byteLength, outputLength / 8,
+                  'digest on transferred buffer should have correct output length');
+              }
+            });
+        }, label + ' and transferred buffer during call');
+
+        promise_test(function (test) {
+          var buffer = new Uint8Array(input);
+          var promise = subtle
+            .digest(algorithmParams, buffer)
+            .then(function (result) {
+              assert_true(
+                equalBuffers(result, hexStringToUint8Array(expected)),
+                'digest matches expected'
+              );
+            });
+          // Transfer the buffer after calling digest
+          buffer.buffer.transfer();
+          return promise;
+        }, label + ' and transferred buffer after call');
+      }
+    });
+  });
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
index 5a669753cd27..ffb78f7e5348 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
@@ -27,11 +27,11 @@ function define_bits_tests() {
         'encapsulateBits should return an object'
       );
       assert_true(
-        encapsulatedBits.hasOwnProperty('sharedKey'),
+        Object.hasOwn(encapsulatedBits, 'sharedKey'),
         'Result should have sharedKey property'
       );
       assert_true(
-        encapsulatedBits.hasOwnProperty('ciphertext'),
+        Object.hasOwn(encapsulatedBits, 'ciphertext'),
         'Result should have ciphertext property'
       );
       assert_true(
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
index 0a45c1fc4e9f..a482eafbb610 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
@@ -61,11 +61,11 @@ function define_key_tests() {
             'encapsulateKey should return an object'
           );
           assert_true(
-            encapsulatedKey.hasOwnProperty('sharedKey'),
+            Object.hasOwn(encapsulatedKey, 'sharedKey'),
             'Result should have sharedKey property'
           );
           assert_true(
-            encapsulatedKey.hasOwnProperty('ciphertext'),
+            Object.hasOwn(encapsulatedKey, 'ciphertext'),
             'Result should have ciphertext property'
           );
           assert_true(
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes.js
index 879a6efe257e..9caecf695cf7 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes.js
@@ -458,9 +458,7 @@ function run_test() {
     });
 
     promise_test(function() {
-        return Promise.all(all_promises)
-            .then(function() {done();})
-            .catch(function() {done();})
+        return Promise.all(all_promises).finally(done);
     }, "setup");
 
     // A test vector has all needed fields for encryption, EXCEPT that the
@@ -470,9 +468,7 @@ function run_test() {
     // Returns a Promise that yields an updated vector on success.
     function importVectorKey(vector, usages) {
         if (vector.key !== null) {
-            return new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
+            return Promise.resolve(vector);
         } else {
             return subtle.importKey(vector.algorithm.name.toUpperCase() === "AES-OCB" ? "raw-secret" : "raw", vector.keyBuffer, {name: vector.algorithm.name}, false, usages)
             .then(function(key) {
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc.https.any.js
index ec09aae5a954..9dcbfbdeccbf 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: encrypt() Using AES-CBC
 // META: script=../util/helpers.js
+// META: script=aes_common_fixtures.js
 // META: script=aes_cbc_vectors.js
 // META: script=aes.js
 // META: timeout=long
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc_vectors.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc_vectors.js
index 96445a96325a..28ef75fece62 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_cbc_vectors.js
@@ -12,59 +12,9 @@
 //     plaintext - the text to encrypt
 //     result - the expected result (usually just ciphertext, sometimes with added authentication)
 function getTestVectors() {
-    // Before we can really start, we need to fill a bunch of buffers with data
-    var plaintext = new Uint8Array([84, 104, 105, 115, 32, 115,
-        112, 101, 99, 105, 102, 105, 99, 97, 116, 105, 111, 110,
-        32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97, 32,
-        74, 97, 118, 97, 83, 99, 114, 105, 112, 116, 32, 65, 80,
-        73, 32, 102, 111, 114, 32, 112, 101, 114, 102, 111, 114,
-        109, 105, 110, 103, 32, 98, 97, 115, 105, 99, 32, 99, 114,
-        121, 112, 116, 111, 103, 114, 97, 112, 104, 105, 99, 32,
-        111, 112, 101, 114, 97, 116, 105, 111, 110, 115, 32, 105,
-        110, 32, 119, 101, 98, 32, 97, 112, 112, 108, 105, 99, 97,
-        116, 105, 111, 110, 115, 44, 32, 115, 117, 99, 104, 32, 97,
-        115, 32, 104, 97, 115, 104, 105, 110, 103, 44, 32, 115,
-        105, 103, 110, 97, 116, 117, 114, 101, 32, 103, 101, 110,
-        101, 114, 97, 116, 105, 111, 110, 32, 97, 110, 100, 32,
-        118, 101, 114, 105, 102, 105, 99, 97, 116, 105, 111, 110,
-        44, 32, 97, 110, 100, 32, 101, 110, 99, 114, 121, 112,
-        116, 105, 111, 110, 32, 97, 110, 100, 32, 100, 101, 99,
-        114, 121, 112, 116, 105, 111, 110, 46, 32, 65, 100, 100,
-        105, 116, 105, 111, 110, 97, 108, 108, 121, 44, 32, 105,
-        116, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97,
-        110, 32, 65, 80, 73, 32, 102, 111, 114, 32, 97, 112, 112,
-        108, 105, 99, 97, 116, 105, 111, 110, 115, 32, 116, 111,
-        32, 103, 101, 110, 101, 114, 97, 116, 101, 32, 97, 110,
-        100, 47, 111, 114, 32, 109, 97, 110, 97, 103, 101, 32, 116,
-        104, 101, 32, 107, 101, 121, 105, 110, 103, 32, 109, 97,
-        116, 101, 114, 105, 97, 108, 32, 110, 101, 99, 101, 115,
-        115, 97, 114, 121, 32, 116, 111, 32, 112, 101, 114, 102,
-        111, 114, 109, 32, 116, 104, 101, 115, 101, 32, 111, 112,
-        101, 114, 97, 116, 105, 111, 110, 115, 46, 32, 85, 115,
-        101, 115, 32, 102, 111, 114, 32, 116, 104, 105, 115, 32,
-        65, 80, 73, 32, 114, 97, 110, 103, 101, 32, 102, 114, 111,
-        109, 32, 117, 115, 101, 114, 32, 111, 114, 32, 115, 101,
-        114, 118, 105, 99, 101, 32, 97, 117, 116, 104, 101, 110,
-        116, 105, 99, 97, 116, 105, 111, 110, 44, 32, 100, 111,
-        99, 117, 109, 101, 110, 116, 32, 111, 114, 32, 99, 111,
-        100, 101, 32, 115, 105, 103, 110, 105, 110, 103, 44, 32,
-        97, 110, 100, 32, 116, 104, 101, 32, 99, 111, 110, 102,
-        105, 100, 101, 110, 116, 105, 97, 108, 105, 116, 121, 32,
-        97, 110, 100, 32, 105, 110, 116, 101, 103, 114, 105, 116,
-        121, 32, 111, 102, 32, 99, 111, 109, 109, 117, 110, 105,
-        99, 97, 116, 105, 111, 110, 115, 46]);
-
-    // We want some random key bytes of various sizes.
-    // These were randomly generated from a script.
-    var keyBytes = {
-        128: new Uint8Array([222, 192, 212, 252, 191, 60, 71,
-            65, 200, 146, 218, 189, 28, 212, 192, 78]),
-        192: new Uint8Array([208, 238, 131, 65, 63, 68, 196, 63, 186, 208,
-            61, 207, 166, 18, 99, 152, 29, 109, 221, 95, 240, 30, 28, 246]),
-        256: new Uint8Array([103, 105, 56, 35, 251, 29, 88, 7, 63, 145, 236,
-            233, 204, 58, 249, 16, 229, 83, 38, 22, 164, 210, 123, 19, 235, 123, 116,
-            216, 0, 11, 191, 48])
-    }
+    var commonFixtures = getAesCommonFixtures();
+    var plaintext = commonFixtures.plaintext;
+    var keyBytes = commonFixtures.keyBytes;
 
     // AES-CBC needs a 16 byte (128 bit) IV.
     var iv = new Uint8Array([85, 170, 248, 155, 168, 148, 19, 213, 78, 167, 39,
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_common_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_common_fixtures.js
new file mode 100644
index 000000000000..d8c6d1666cca
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_common_fixtures.js
@@ -0,0 +1,57 @@
+function getAesCommonFixtures() {
+  var plaintext = new Uint8Array([
+    84, 104, 105, 115, 32, 115, 112, 101, 99, 105, 102, 105, 99, 97, 116, 105,
+    111, 110, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97, 32, 74, 97,
+    118, 97, 83, 99, 114, 105, 112, 116, 32, 65, 80, 73, 32, 102, 111, 114, 32,
+    112, 101, 114, 102, 111, 114, 109, 105, 110, 103, 32, 98, 97, 115, 105, 99,
+    32, 99, 114, 121, 112, 116, 111, 103, 114, 97, 112, 104, 105, 99, 32, 111,
+    112, 101, 114, 97, 116, 105, 111, 110, 115, 32, 105, 110, 32, 119, 101, 98,
+    32, 97, 112, 112, 108, 105, 99, 97, 116, 105, 111, 110, 115, 44, 32, 115,
+    117, 99, 104, 32, 97, 115, 32, 104, 97, 115, 104, 105, 110, 103, 44, 32,
+    115, 105, 103, 110, 97, 116, 117, 114, 101, 32, 103, 101, 110, 101, 114, 97,
+    116, 105, 111, 110, 32, 97, 110, 100, 32, 118, 101, 114, 105, 102, 105, 99,
+    97, 116, 105, 111, 110, 44, 32, 97, 110, 100, 32, 101, 110, 99, 114, 121,
+    112, 116, 105, 111, 110, 32, 97, 110, 100, 32, 100, 101, 99, 114, 121, 112,
+    116, 105, 111, 110, 46, 32, 65, 100, 100, 105, 116, 105, 111, 110, 97, 108,
+    108, 121, 44, 32, 105, 116, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115,
+    32, 97, 110, 32, 65, 80, 73, 32, 102, 111, 114, 32, 97, 112, 112, 108, 105,
+    99, 97, 116, 105, 111, 110, 115, 32, 116, 111, 32, 103, 101, 110, 101, 114,
+    97, 116, 101, 32, 97, 110, 100, 47, 111, 114, 32, 109, 97, 110, 97, 103,
+    101, 32, 116, 104, 101, 32, 107, 101, 121, 105, 110, 103, 32, 109, 97, 116,
+    101, 114, 105, 97, 108, 32, 110, 101, 99, 101, 115, 115, 97, 114, 121, 32,
+    116, 111, 32, 112, 101, 114, 102, 111, 114, 109, 32, 116, 104, 101, 115,
+    101, 32, 111, 112, 101, 114, 97, 116, 105, 111, 110, 115, 46, 32, 85, 115,
+    101, 115, 32, 102, 111, 114, 32, 116, 104, 105, 115, 32, 65, 80, 73, 32,
+    114, 97, 110, 103, 101, 32, 102, 114, 111, 109, 32, 117, 115, 101, 114, 32,
+    111, 114, 32, 115, 101, 114, 118, 105, 99, 101, 32, 97, 117, 116, 104, 101,
+    110, 116, 105, 99, 97, 116, 105, 111, 110, 44, 32, 100, 111, 99, 117, 109,
+    101, 110, 116, 32, 111, 114, 32, 99, 111, 100, 101, 32, 115, 105, 103, 110,
+    105, 110, 103, 44, 32, 97, 110, 100, 32, 116, 104, 101, 32, 99, 111, 110,
+    102, 105, 100, 101, 110, 116, 105, 97, 108, 105, 116, 121, 32, 97, 110, 100,
+    32, 105, 110, 116, 101, 103, 114, 105, 116, 121, 32, 111, 102, 32, 99, 111,
+    109, 109, 117, 110, 105, 99, 97, 116, 105, 111, 110, 115, 46,
+  ]);
+
+  var keyBytes = {
+    128: new Uint8Array([
+      222, 192, 212, 252, 191, 60, 71, 65, 200, 146, 218, 189, 28, 212, 192, 78,
+    ]),
+    192: new Uint8Array([
+      208, 238, 131, 65, 63, 68, 196, 63, 186, 208, 61, 207, 166, 18, 99, 152,
+      29, 109, 221, 95, 240, 30, 28, 246,
+    ]),
+    256: new Uint8Array([
+      103, 105, 56, 35, 251, 29, 88, 7, 63, 145, 236, 233, 204, 58, 249, 16,
+      229, 83, 38, 22, 164, 210, 123, 19, 235, 123, 116, 216, 0, 11, 191, 48,
+    ]),
+  };
+
+  var additionalData = new Uint8Array([
+    84, 104, 101, 114, 101, 32, 97, 114, 101, 32, 55, 32, 102, 117, 114, 116,
+    104, 101, 114, 32, 101, 100, 105, 116, 111, 114, 105, 97, 108, 32, 110, 111,
+    116, 101, 115, 32, 105, 110, 32, 116, 104, 101, 32, 100, 111, 99, 117, 109,
+    101, 110, 116, 46,
+  ]);
+
+  return { plaintext, keyBytes, additionalData };
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr.https.any.js
index f9d85bb6c93b..cbda32f35432 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: encrypt() Using AES-CTR
 // META: script=../util/helpers.js
+// META: script=aes_common_fixtures.js
 // META: script=aes_ctr_vectors.js
 // META: script=aes.js
 // META: timeout=long
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr_vectors.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr_vectors.js
index 201dff83ce9c..89a19fa5fcbe 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ctr_vectors.js
@@ -12,59 +12,9 @@
 //     plaintext - the text to encrypt
 //     result - the expected result (usually just ciphertext, sometimes with added authentication)
 function getTestVectors() {
-    // Before we can really start, we need to fill a bunch of buffers with data
-    var plaintext = new Uint8Array([84, 104, 105, 115, 32, 115,
-        112, 101, 99, 105, 102, 105, 99, 97, 116, 105, 111, 110,
-        32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97, 32,
-        74, 97, 118, 97, 83, 99, 114, 105, 112, 116, 32, 65, 80,
-        73, 32, 102, 111, 114, 32, 112, 101, 114, 102, 111, 114,
-        109, 105, 110, 103, 32, 98, 97, 115, 105, 99, 32, 99, 114,
-        121, 112, 116, 111, 103, 114, 97, 112, 104, 105, 99, 32,
-        111, 112, 101, 114, 97, 116, 105, 111, 110, 115, 32, 105,
-        110, 32, 119, 101, 98, 32, 97, 112, 112, 108, 105, 99, 97,
-        116, 105, 111, 110, 115, 44, 32, 115, 117, 99, 104, 32, 97,
-        115, 32, 104, 97, 115, 104, 105, 110, 103, 44, 32, 115,
-        105, 103, 110, 97, 116, 117, 114, 101, 32, 103, 101, 110,
-        101, 114, 97, 116, 105, 111, 110, 32, 97, 110, 100, 32,
-        118, 101, 114, 105, 102, 105, 99, 97, 116, 105, 111, 110,
-        44, 32, 97, 110, 100, 32, 101, 110, 99, 114, 121, 112,
-        116, 105, 111, 110, 32, 97, 110, 100, 32, 100, 101, 99,
-        114, 121, 112, 116, 105, 111, 110, 46, 32, 65, 100, 100,
-        105, 116, 105, 111, 110, 97, 108, 108, 121, 44, 32, 105,
-        116, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97,
-        110, 32, 65, 80, 73, 32, 102, 111, 114, 32, 97, 112, 112,
-        108, 105, 99, 97, 116, 105, 111, 110, 115, 32, 116, 111,
-        32, 103, 101, 110, 101, 114, 97, 116, 101, 32, 97, 110,
-        100, 47, 111, 114, 32, 109, 97, 110, 97, 103, 101, 32, 116,
-        104, 101, 32, 107, 101, 121, 105, 110, 103, 32, 109, 97,
-        116, 101, 114, 105, 97, 108, 32, 110, 101, 99, 101, 115,
-        115, 97, 114, 121, 32, 116, 111, 32, 112, 101, 114, 102,
-        111, 114, 109, 32, 116, 104, 101, 115, 101, 32, 111, 112,
-        101, 114, 97, 116, 105, 111, 110, 115, 46, 32, 85, 115,
-        101, 115, 32, 102, 111, 114, 32, 116, 104, 105, 115, 32,
-        65, 80, 73, 32, 114, 97, 110, 103, 101, 32, 102, 114, 111,
-        109, 32, 117, 115, 101, 114, 32, 111, 114, 32, 115, 101,
-        114, 118, 105, 99, 101, 32, 97, 117, 116, 104, 101, 110,
-        116, 105, 99, 97, 116, 105, 111, 110, 44, 32, 100, 111,
-        99, 117, 109, 101, 110, 116, 32, 111, 114, 32, 99, 111,
-        100, 101, 32, 115, 105, 103, 110, 105, 110, 103, 44, 32,
-        97, 110, 100, 32, 116, 104, 101, 32, 99, 111, 110, 102,
-        105, 100, 101, 110, 116, 105, 97, 108, 105, 116, 121, 32,
-        97, 110, 100, 32, 105, 110, 116, 101, 103, 114, 105, 116,
-        121, 32, 111, 102, 32, 99, 111, 109, 109, 117, 110, 105,
-        99, 97, 116, 105, 111, 110, 115, 46]);
-
-    // We want some random key bytes of various sizes.
-    // These were randomly generated from a script.
-    var keyBytes = {
-        128: new Uint8Array([222, 192, 212, 252, 191, 60, 71,
-            65, 200, 146, 218, 189, 28, 212, 192, 78]),
-        192: new Uint8Array([208, 238, 131, 65, 63, 68, 196, 63, 186, 208,
-            61, 207, 166, 18, 99, 152, 29, 109, 221, 95, 240, 30, 28, 246]),
-        256: new Uint8Array([103, 105, 56, 35, 251, 29, 88, 7, 63, 145, 236,
-            233, 204, 58, 249, 16, 229, 83, 38, 22, 164, 210, 123, 19, 235, 123, 116,
-            216, 0, 11, 191, 48])
-    }
+    var commonFixtures = getAesCommonFixtures();
+    var plaintext = commonFixtures.plaintext;
+    var keyBytes = commonFixtures.keyBytes;
 
     // AES-CTR needs a 16 byte (128 bit) counter.
     var counter = new Uint8Array([85, 170, 248, 155, 168, 148, 19, 213, 78, 167, 39,
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm.https.any.js
index b3e6b5f0d2c1..295351fc319d 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: encrypt() Using AES-GCM w/ 96-bit iv
 // META: script=../util/helpers.js
+// META: script=aes_common_fixtures.js
 // META: script=aes_gcm_96_iv_fixtures.js
 // META: script=aes_gcm_vectors.js
 // META: script=aes.js
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv.https.any.js
index 196a8ea94fb1..a46f4c79b891 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: encrypt() Using AES-GCM w/ 256-bit iv
 // META: script=../util/helpers.js
+// META: script=aes_common_fixtures.js
 // META: script=aes_gcm_256_iv_fixtures.js
 // META: script=aes_gcm_vectors.js
 // META: script=aes.js
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv_fixtures.js
index 9cdbbbb79075..a081b8e86483 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_256_iv_fixtures.js
@@ -1,53 +1,7 @@
 function getFixtures() {
-  // Before we can really start, we need to fill a bunch of buffers with data
-  var plaintext = new Uint8Array([
-    84, 104, 105, 115, 32, 115, 112, 101, 99, 105, 102, 105, 99, 97, 116, 105,
-    111, 110, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97, 32, 74, 97,
-    118, 97, 83, 99, 114, 105, 112, 116, 32, 65, 80, 73, 32, 102, 111, 114, 32,
-    112, 101, 114, 102, 111, 114, 109, 105, 110, 103, 32, 98, 97, 115, 105, 99,
-    32, 99, 114, 121, 112, 116, 111, 103, 114, 97, 112, 104, 105, 99, 32, 111,
-    112, 101, 114, 97, 116, 105, 111, 110, 115, 32, 105, 110, 32, 119, 101, 98,
-    32, 97, 112, 112, 108, 105, 99, 97, 116, 105, 111, 110, 115, 44, 32, 115,
-    117, 99, 104, 32, 97, 115, 32, 104, 97, 115, 104, 105, 110, 103, 44, 32,
-    115, 105, 103, 110, 97, 116, 117, 114, 101, 32, 103, 101, 110, 101, 114, 97,
-    116, 105, 111, 110, 32, 97, 110, 100, 32, 118, 101, 114, 105, 102, 105, 99,
-    97, 116, 105, 111, 110, 44, 32, 97, 110, 100, 32, 101, 110, 99, 114, 121,
-    112, 116, 105, 111, 110, 32, 97, 110, 100, 32, 100, 101, 99, 114, 121, 112,
-    116, 105, 111, 110, 46, 32, 65, 100, 100, 105, 116, 105, 111, 110, 97, 108,
-    108, 121, 44, 32, 105, 116, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115,
-    32, 97, 110, 32, 65, 80, 73, 32, 102, 111, 114, 32, 97, 112, 112, 108, 105,
-    99, 97, 116, 105, 111, 110, 115, 32, 116, 111, 32, 103, 101, 110, 101, 114,
-    97, 116, 101, 32, 97, 110, 100, 47, 111, 114, 32, 109, 97, 110, 97, 103,
-    101, 32, 116, 104, 101, 32, 107, 101, 121, 105, 110, 103, 32, 109, 97, 116,
-    101, 114, 105, 97, 108, 32, 110, 101, 99, 101, 115, 115, 97, 114, 121, 32,
-    116, 111, 32, 112, 101, 114, 102, 111, 114, 109, 32, 116, 104, 101, 115,
-    101, 32, 111, 112, 101, 114, 97, 116, 105, 111, 110, 115, 46, 32, 85, 115,
-    101, 115, 32, 102, 111, 114, 32, 116, 104, 105, 115, 32, 65, 80, 73, 32,
-    114, 97, 110, 103, 101, 32, 102, 114, 111, 109, 32, 117, 115, 101, 114, 32,
-    111, 114, 32, 115, 101, 114, 118, 105, 99, 101, 32, 97, 117, 116, 104, 101,
-    110, 116, 105, 99, 97, 116, 105, 111, 110, 44, 32, 100, 111, 99, 117, 109,
-    101, 110, 116, 32, 111, 114, 32, 99, 111, 100, 101, 32, 115, 105, 103, 110,
-    105, 110, 103, 44, 32, 97, 110, 100, 32, 116, 104, 101, 32, 99, 111, 110,
-    102, 105, 100, 101, 110, 116, 105, 97, 108, 105, 116, 121, 32, 97, 110, 100,
-    32, 105, 110, 116, 101, 103, 114, 105, 116, 121, 32, 111, 102, 32, 99, 111,
-    109, 109, 117, 110, 105, 99, 97, 116, 105, 111, 110, 115, 46,
-  ]);
-
-  // We want some random key bytes of various sizes.
-  // These were randomly generated from a script.
-  var keyBytes = {
-    128: new Uint8Array([
-      222, 192, 212, 252, 191, 60, 71, 65, 200, 146, 218, 189, 28, 212, 192, 78,
-    ]),
-    192: new Uint8Array([
-      208, 238, 131, 65, 63, 68, 196, 63, 186, 208, 61, 207, 166, 18, 99, 152,
-      29, 109, 221, 95, 240, 30, 28, 246,
-    ]),
-    256: new Uint8Array([
-      103, 105, 56, 35, 251, 29, 88, 7, 63, 145, 236, 233, 204, 58, 249, 16,
-      229, 83, 38, 22, 164, 210, 123, 19, 235, 123, 116, 216, 0, 11, 191, 48,
-    ]),
-  };
+  var commonFixtures = getAesCommonFixtures();
+  var plaintext = commonFixtures.plaintext;
+  var keyBytes = commonFixtures.keyBytes;
 
   // AES-GCM needs an IV of no more than 2^64 - 1 bytes. Arbitrary 32 bytes is okay then.
   var iv = new Uint8Array([
@@ -55,15 +9,7 @@ function getFixtures() {
     33, 117, 56, 94, 248, 173, 234, 194, 200, 115, 53, 235, 146, 141, 212,
   ]);
 
-  // Authenticated encryption via AES-GCM requires additional data that
-  // will be checked. We use the ASCII encoded Editorial Note
-  // following the Abstract of the Web Cryptography API recommendation.
-  var additionalData = new Uint8Array([
-    84, 104, 101, 114, 101, 32, 97, 114, 101, 32, 55, 32, 102, 117, 114, 116,
-    104, 101, 114, 32, 101, 100, 105, 116, 111, 114, 105, 97, 108, 32, 110, 111,
-    116, 101, 115, 32, 105, 110, 32, 116, 104, 101, 32, 100, 111, 99, 117, 109,
-    101, 110, 116, 46,
-  ]);
+  var additionalData = commonFixtures.additionalData;
 
   //  The length of the tag defaults to 16 bytes (128 bit).
   var tag = {
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_96_iv_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_96_iv_fixtures.js
index bb00e2d7dd92..e120b58d8dc4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_96_iv_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_gcm_96_iv_fixtures.js
@@ -1,68 +1,14 @@
 function getFixtures() {
-  // Before we can really start, we need to fill a bunch of buffers with data
-  var plaintext = new Uint8Array([
-    84, 104, 105, 115, 32, 115, 112, 101, 99, 105, 102, 105, 99, 97, 116, 105,
-    111, 110, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97, 32, 74, 97,
-    118, 97, 83, 99, 114, 105, 112, 116, 32, 65, 80, 73, 32, 102, 111, 114, 32,
-    112, 101, 114, 102, 111, 114, 109, 105, 110, 103, 32, 98, 97, 115, 105, 99,
-    32, 99, 114, 121, 112, 116, 111, 103, 114, 97, 112, 104, 105, 99, 32, 111,
-    112, 101, 114, 97, 116, 105, 111, 110, 115, 32, 105, 110, 32, 119, 101, 98,
-    32, 97, 112, 112, 108, 105, 99, 97, 116, 105, 111, 110, 115, 44, 32, 115,
-    117, 99, 104, 32, 97, 115, 32, 104, 97, 115, 104, 105, 110, 103, 44, 32,
-    115, 105, 103, 110, 97, 116, 117, 114, 101, 32, 103, 101, 110, 101, 114, 97,
-    116, 105, 111, 110, 32, 97, 110, 100, 32, 118, 101, 114, 105, 102, 105, 99,
-    97, 116, 105, 111, 110, 44, 32, 97, 110, 100, 32, 101, 110, 99, 114, 121,
-    112, 116, 105, 111, 110, 32, 97, 110, 100, 32, 100, 101, 99, 114, 121, 112,
-    116, 105, 111, 110, 46, 32, 65, 100, 100, 105, 116, 105, 111, 110, 97, 108,
-    108, 121, 44, 32, 105, 116, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115,
-    32, 97, 110, 32, 65, 80, 73, 32, 102, 111, 114, 32, 97, 112, 112, 108, 105,
-    99, 97, 116, 105, 111, 110, 115, 32, 116, 111, 32, 103, 101, 110, 101, 114,
-    97, 116, 101, 32, 97, 110, 100, 47, 111, 114, 32, 109, 97, 110, 97, 103,
-    101, 32, 116, 104, 101, 32, 107, 101, 121, 105, 110, 103, 32, 109, 97, 116,
-    101, 114, 105, 97, 108, 32, 110, 101, 99, 101, 115, 115, 97, 114, 121, 32,
-    116, 111, 32, 112, 101, 114, 102, 111, 114, 109, 32, 116, 104, 101, 115,
-    101, 32, 111, 112, 101, 114, 97, 116, 105, 111, 110, 115, 46, 32, 85, 115,
-    101, 115, 32, 102, 111, 114, 32, 116, 104, 105, 115, 32, 65, 80, 73, 32,
-    114, 97, 110, 103, 101, 32, 102, 114, 111, 109, 32, 117, 115, 101, 114, 32,
-    111, 114, 32, 115, 101, 114, 118, 105, 99, 101, 32, 97, 117, 116, 104, 101,
-    110, 116, 105, 99, 97, 116, 105, 111, 110, 44, 32, 100, 111, 99, 117, 109,
-    101, 110, 116, 32, 111, 114, 32, 99, 111, 100, 101, 32, 115, 105, 103, 110,
-    105, 110, 103, 44, 32, 97, 110, 100, 32, 116, 104, 101, 32, 99, 111, 110,
-    102, 105, 100, 101, 110, 116, 105, 97, 108, 105, 116, 121, 32, 97, 110, 100,
-    32, 105, 110, 116, 101, 103, 114, 105, 116, 121, 32, 111, 102, 32, 99, 111,
-    109, 109, 117, 110, 105, 99, 97, 116, 105, 111, 110, 115, 46,
-  ]);
-
-  // We want some random key bytes of various sizes.
-  // These were randomly generated from a script.
-  var keyBytes = {
-    128: new Uint8Array([
-      222, 192, 212, 252, 191, 60, 71, 65, 200, 146, 218, 189, 28, 212, 192, 78,
-    ]),
-    192: new Uint8Array([
-      208, 238, 131, 65, 63, 68, 196, 63, 186, 208, 61, 207, 166, 18, 99, 152,
-      29, 109, 221, 95, 240, 30, 28, 246,
-    ]),
-    256: new Uint8Array([
-      103, 105, 56, 35, 251, 29, 88, 7, 63, 145, 236, 233, 204, 58, 249, 16,
-      229, 83, 38, 22, 164, 210, 123, 19, 235, 123, 116, 216, 0, 11, 191, 48,
-    ]),
-  };
+  var commonFixtures = getAesCommonFixtures();
+  var plaintext = commonFixtures.plaintext;
+  var keyBytes = commonFixtures.keyBytes;
 
   // AES-GCM specification recommends that the IV should be 96 bits long.
   var iv = new Uint8Array([
     58, 146, 115, 42, 166, 234, 57, 191, 57, 134, 224, 199,
   ]);
 
-  // Authenticated encryption via AES-GCM requires additional data that
-  // will be checked. We use the ASCII encoded Editorial Note
-  // following the Abstract of the Web Cryptography API recommendation.
-  var additionalData = new Uint8Array([
-    84, 104, 101, 114, 101, 32, 97, 114, 101, 32, 55, 32, 102, 117, 114, 116,
-    104, 101, 114, 32, 101, 100, 105, 116, 111, 114, 105, 97, 108, 32, 110, 111,
-    116, 101, 115, 32, 105, 110, 32, 116, 104, 101, 32, 100, 111, 99, 117, 109,
-    101, 110, 116, 46,
-  ]);
+  var additionalData = commonFixtures.additionalData;
 
   //  The length of the tag defaults to 16 bytes (128 bit).
   var tag = {
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb.tentative.https.any.js
index cca34e9e54e7..e6a6246074c1 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: encrypt() Using AES-OCB w/ 120-bit iv
 // META: script=../util/helpers.js
+// META: script=aes_common_fixtures.js
 // META: script=aes_ocb_fixtures.js
 // META: script=aes_ocb_vectors.js
 // META: script=aes.js
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb_fixtures.js
index a5795195f163..3e0c014c3e1c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/aes_ocb_fixtures.js
@@ -1,64 +1,13 @@
 function getFixtures() {
-  // Before we can really start, we need to fill a bunch of buffers with data
-  var plaintext = new Uint8Array([
-    84, 104, 105, 115, 32, 115, 112, 101, 99, 105, 102, 105, 99, 97, 116, 105,
-    111, 110, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115, 32, 97, 32, 74, 97,
-    118, 97, 83, 99, 114, 105, 112, 116, 32, 65, 80, 73, 32, 102, 111, 114, 32,
-    112, 101, 114, 102, 111, 114, 109, 105, 110, 103, 32, 98, 97, 115, 105, 99,
-    32, 99, 114, 121, 112, 116, 111, 103, 114, 97, 112, 104, 105, 99, 32, 111,
-    112, 101, 114, 97, 116, 105, 111, 110, 115, 32, 105, 110, 32, 119, 101, 98,
-    32, 97, 112, 112, 108, 105, 99, 97, 116, 105, 111, 110, 115, 44, 32, 115,
-    117, 99, 104, 32, 97, 115, 32, 104, 97, 115, 104, 105, 110, 103, 44, 32,
-    115, 105, 103, 110, 97, 116, 117, 114, 101, 32, 103, 101, 110, 101, 114, 97,
-    116, 105, 111, 110, 32, 97, 110, 100, 32, 118, 101, 114, 105, 102, 105, 99,
-    97, 116, 105, 111, 110, 44, 32, 97, 110, 100, 32, 101, 110, 99, 114, 121,
-    112, 116, 105, 111, 110, 32, 97, 110, 100, 32, 100, 101, 99, 114, 121, 112,
-    116, 105, 111, 110, 46, 32, 65, 100, 100, 105, 116, 105, 111, 110, 97, 108,
-    108, 121, 44, 32, 105, 116, 32, 100, 101, 115, 99, 114, 105, 98, 101, 115,
-    32, 97, 110, 32, 65, 80, 73, 32, 102, 111, 114, 32, 97, 112, 112, 108, 105,
-    99, 97, 116, 105, 111, 110, 115, 32, 116, 111, 32, 103, 101, 110, 101, 114,
-    97, 116, 101, 32, 97, 110, 100, 47, 111, 114, 32, 109, 97, 110, 97, 103,
-    101, 32, 116, 104, 101, 32, 107, 101, 121, 105, 110, 103, 32, 109, 97, 116,
-    101, 114, 105, 97, 108, 32, 110, 101, 99, 101, 115, 115, 97, 114, 121, 32,
-    116, 111, 32, 112, 101, 114, 102, 111, 114, 109, 32, 116, 104, 101, 115,
-    101, 32, 111, 112, 101, 114, 97, 116, 105, 111, 110, 115, 46, 32, 85, 115,
-    101, 115, 32, 102, 111, 114, 32, 116, 104, 105, 115, 32, 65, 80, 73, 32,
-    114, 97, 110, 103, 101, 32, 102, 114, 111, 109, 32, 117, 115, 101, 114, 32,
-    111, 114, 32, 115, 101, 114, 118, 105, 99, 101, 32, 97, 117, 116, 104, 101,
-    110, 116, 105, 99, 97, 116, 105, 111, 110, 44, 32, 100, 111, 99, 117, 109,
-    101, 110, 116, 32, 111, 114, 32, 99, 111, 100, 101, 32, 115, 105, 103, 110,
-    105, 110, 103, 44, 32, 97, 110, 100, 32, 116, 104, 101, 32, 99, 111, 110,
-    102, 105, 100, 101, 110, 116, 105, 97, 108, 105, 116, 121, 32, 97, 110, 100,
-    32, 105, 110, 116, 101, 103, 114, 105, 116, 121, 32, 111, 102, 32, 99, 111,
-    109, 109, 117, 110, 105, 99, 97, 116, 105, 111, 110, 115, 46,
-  ]);
-
-  // We want some random key bytes of various sizes.
-  // These were randomly generated from a script.
-  var keyBytes = {
-    128: new Uint8Array([
-      222, 192, 212, 252, 191, 60, 71, 65, 200, 146, 218, 189, 28, 212, 192, 78,
-    ]),
-    192: new Uint8Array([
-      208, 238, 131, 65, 63, 68, 196, 63, 186, 208, 61, 207, 166, 18, 99, 152,
-      29, 109, 221, 95, 240, 30, 28, 246,
-    ]),
-    256: new Uint8Array([
-      103, 105, 56, 35, 251, 29, 88, 7, 63, 145, 236, 233, 204, 58, 249, 16,
-      229, 83, 38, 22, 164, 210, 123, 19, 235, 123, 116, 216, 0, 11, 191, 48,
-    ]),
-  };
+  var commonFixtures = getAesCommonFixtures();
+  var plaintext = commonFixtures.plaintext;
+  var keyBytes = commonFixtures.keyBytes;
 
   var iv = new Uint8Array([
     58, 146, 115, 42, 166, 234, 57, 191, 57, 134, 224, 199, 108, 116, 46,
   ]);
 
-  var additionalData = new Uint8Array([
-    84, 104, 101, 114, 101, 32, 97, 114, 101, 32, 55, 32, 102, 117, 114, 116,
-    104, 101, 114, 32, 101, 100, 105, 116, 111, 114, 105, 97, 108, 32, 110, 111,
-    116, 101, 115, 32, 105, 110, 32, 116, 104, 101, 32, 100, 111, 99, 117, 109,
-    101, 110, 116, 46,
-  ]);
+  var additionalData = commonFixtures.additionalData;
 
   var ciphertext = {
     128: {
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa.js
index 071c086b3c4d..951ffd56e581 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa.js
@@ -23,7 +23,7 @@ function run_test() {
             promise_test(function(test) {
                 return subtle.decrypt(vector.algorithm, vector.privateKey, vector.ciphertext)
                 .then(function(plaintext) {
-                    assert_true(equalBuffers(plaintext, vector.plaintext, "Decryption works"));
+                    assert_true(equalBuffers(plaintext, vector.plaintext), "Decryption works");
                 }, function(err) {
                     assert_unreached("Decryption should not throw error " + vector.name + ": '" + err.message + "'");
                 });
@@ -60,7 +60,7 @@ function run_test() {
                     }
                 }, vector.privateKey, ciphertext)
                 .then(function(plaintext) {
-                    assert_true(equalBuffers(plaintext, vector.plaintext, "Decryption works"));
+                    assert_true(equalBuffers(plaintext, vector.plaintext), "Decryption works");
                 }, function(err) {
                     assert_unreached("Decryption should not throw error " + vector.name + ": '" + err.message + "'");
                 });
@@ -91,7 +91,7 @@ function run_test() {
                 var ciphertext = copyBuffer(vector.ciphertext);
                 var operation = subtle.decrypt(vector.algorithm, vector.privateKey, ciphertext)
                 .then(function(plaintext) {
-                    assert_true(equalBuffers(plaintext, vector.plaintext, "Decryption works"));
+                    assert_true(equalBuffers(plaintext, vector.plaintext), "Decryption works");
                 }, function(err) {
                     assert_unreached("Decryption should not throw error " + vector.name + ": '" + err.message + "'");
                 });
@@ -160,7 +160,7 @@ function run_test() {
                 var ciphertext = copyBuffer(vector.ciphertext);
                 var operation = subtle.decrypt(vector.algorithm, vector.privateKey, ciphertext)
                 .then(function(plaintext) {
-                    assert_true(equalBuffers(plaintext, vector.plaintext, "Decryption works"));
+                    assert_true(equalBuffers(plaintext, vector.plaintext), "Decryption works");
                 }, function(err) {
                     assert_unreached("Decryption should not throw error " + vector.name + ": '" + err.message + "'");
                 });
@@ -538,9 +538,7 @@ function run_test() {
     });
 
     promise_test(function() {
-        return Promise.all(all_promises)
-            .then(function() {done();})
-            .catch(function() {done();})
+        return Promise.all(all_promises).finally(done);
     }, "setup");
 
     // A test vector has all needed fields for encryption, EXCEPT that the
@@ -552,9 +550,7 @@ function run_test() {
         var publicPromise, privatePromise;
 
         if (vector.publicKey !== null) {
-            publicPromise = new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
+            publicPromise = Promise.resolve(vector);
         } else {
             publicPromise = subtle.importKey(vector.publicKeyFormat, vector.publicKeyBuffer, {name: vector.algorithm.name, hash: vector.hash}, false, publicKeyUsages)
             .then(function(key) {
@@ -564,9 +560,7 @@ function run_test() {
         }
 
         if (vector.privateKey !== null) {
-            privatePromise = new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
+            privatePromise = Promise.resolve(vector);
         } else {
             privatePromise = subtle.importKey(vector.privateKeyFormat, vector.privateKeyBuffer, {name: vector.algorithm.name, hash: vector.hash}, false, privateKeyUsages)
             .then(function(key) {
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_oaep.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_oaep.https.any.js
index 3550f5eec287..42511415f157 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_oaep.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_oaep.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: encrypt() Using RSA-OAEP
 // META: script=../util/helpers.js
+// META: script=../util/rsa_key_fixtures.js
 // META: script=rsa_vectors.js
 // META: script=rsa.js
 // META: timeout=long
diff --git a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_vectors.js b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_vectors.js
index fcc732eddc1d..ca99953524e4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encrypt_decrypt/rsa_vectors.js
@@ -18,8 +18,9 @@
 //     plaintext - the text to encrypt
 //     result - the expected result (usually just ciphertext, sometimes with added authentication)
 function getTestVectors() {
-    var pkcs8 = new Uint8Array([48, 130, 4, 191, 2, 1, 0, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 4, 130, 4, 169, 48, 130, 4, 165, 2, 1, 0, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1, 2, 130, 1, 1, 0, 139, 55, 92, 203, 135, 200, 37, 197, 255, 61, 83, 208, 9, 145, 110, 150, 65, 5, 126, 24, 82, 114, 39, 160, 122, 178, 38, 190, 16, 136, 129, 58, 59, 56, 187, 123, 72, 243, 119, 5, 81, 101, 250, 42, 147, 57, 210, 77, 198, 103, 213, 197, 186, 52, 39, 230, 164, 129, 23, 110, 172, 21, 255, 212, 144, 104, 49, 30, 28, 40, 59, 159, 58, 142, 12, 184, 9, 180, 99, 12, 80, 170, 143, 62, 69, 166, 11, 53, 158, 25, 191, 140, 187, 94, 202, 214, 78, 118, 31, 16, 149, 116, 63, 243, 106, 175, 92, 240, 236, 185, 127, 237, 173, 221, 166, 11, 91, 243, 93, 129, 26, 117, 184, 34, 35, 12, 250, 160, 25, 47, 173, 64, 84, 126, 39, 84, 72, 170, 51, 22, 191, 142, 43, 76, 224, 133, 79, 199, 112, 139, 83, 123, 162, 45, 19, 33, 11, 9, 174, 195, 122, 39, 89, 239, 192, 130, 161, 83, 27, 35, 169, 23, 48, 3, 125, 222, 78, 242, 107, 95, 150, 239, 220, 195, 159, 211, 76, 52, 90, 213, 28, 187, 228, 79, 229, 139, 138, 59, 78, 201, 151, 134, 108, 8, 109, 255, 27, 136, 49, 239, 10, 31, 234, 38, 60, 247, 218, 205, 3, 192, 76, 188, 194, 178, 121, 229, 127, 165, 185, 83, 153, 107, 251, 29, 214, 136, 23, 175, 127, 180, 44, 222, 247, 165, 41, 74, 87, 250, 194, 184, 173, 115, 159, 27, 2, 153, 2, 129, 129, 0, 251, 248, 51, 194, 198, 49, 201, 112, 36, 12, 142, 116, 133, 240, 106, 62, 162, 168, 72, 34, 81, 26, 134, 39, 221, 70, 78, 248, 175, 175, 113, 72, 209, 164, 37, 182, 184, 101, 125, 221, 82, 70, 131, 43, 142, 83, 48, 32, 197, 187, 181, 104, 133, 90, 106, 236, 62, 66, 33, 215, 147, 241, 220, 91, 47, 37, 132, 226, 65, 94, 72, 233, 162, 189, 41, 43, 19, 64, 49, 249, 156, 142, 180, 47, 192, 188, 208, 68, 155, 242, 44, 230, 222, 201, 112, 20, 239, 229, 172, 147, 235, 232, 53, 135, 118, 86, 37, 44, 187, 177, 108, 65, 91, 103, 177, 132, 210, 40, 69, 104, 162, 119, 213, 147, 53, 88, 92, 253, 2, 129, 129, 0, 214, 184, 206, 39, 199, 41, 93, 93, 22, 252, 53, 112, 237, 100, 200, 218, 147, 3, 250, 210, 148, 136, 193, 166, 94, 154, 215, 17, 249, 3, 112, 24, 125, 187, 253, 129, 49, 109, 105, 100, 139, 200, 140, 197, 200, 53, 81, 175, 255, 69, 222, 186, 207, 182, 17, 5, 247, 9, 228, 195, 8, 9, 185, 0, 49, 235, 214, 134, 36, 68, 150, 198, 246, 158, 105, 46, 189, 200, 20, 246, 66, 57, 244, 173, 21, 117, 110, 203, 120, 197, 165, 176, 153, 49, 219, 24, 48, 119, 197, 70, 163, 140, 76, 116, 56, 137, 173, 61, 62, 208, 121, 181, 98, 46, 208, 18, 15, 160, 225, 249, 59, 89, 61, 183, 216, 82, 224, 95, 2, 129, 128, 56, 135, 75, 157, 131, 247, 129, 120, 206, 45, 158, 252, 23, 92, 131, 137, 127, 214, 127, 48, 107, 191, 166, 159, 100, 238, 52, 35, 104, 206, 212, 124, 128, 195, 241, 206, 23, 122, 117, 141, 100, 186, 251, 12, 151, 134, 164, 66, 133, 250, 1, 205, 236, 53, 7, 205, 238, 125, 201, 183, 226, 178, 29, 60, 187, 204, 16, 14, 238, 153, 103, 132, 59, 5, 115, 41, 253, 204, 166, 41, 152, 237, 15, 17, 179, 140, 232, 176, 171, 199, 222, 57, 1, 124, 113, 207, 208, 174, 87, 84, 108, 85, 145, 68, 205, 208, 175, 208, 100, 95, 126, 168, 255, 7, 185, 116, 209, 237, 68, 253, 31, 142, 0, 245, 96, 191, 109, 69, 2, 129, 129, 0, 133, 41, 239, 144, 115, 207, 143, 123, 95, 249, 226, 26, 186, 223, 58, 65, 115, 211, 144, 6, 112, 223, 175, 89, 66, 106, 188, 223, 4, 147, 193, 61, 47, 29, 27, 70, 184, 36, 166, 172, 24, 148, 179, 217, 37, 37, 12, 24, 30, 52, 114, 193, 96, 120, 5, 110, 177, 154, 141, 40, 247, 31, 48, 128, 146, 117, 52, 129, 212, 148, 68, 253, 247, 140, 158, 166, 194, 68, 7, 220, 1, 142, 119, 211, 175, 239, 56, 91, 47, 247, 67, 158, 150, 35, 121, 65, 51, 45, 212, 70, 206, 190, 255, 219, 68, 4, 254, 79, 113, 89, 81, 97, 208, 22, 64, 44, 51, 77, 15, 87, 198, 26, 190, 79, 249, 244, 203, 249, 2, 129, 129, 0, 135, 216, 119, 8, 212, 103, 99, 228, 204, 190, 178, 209, 233, 113, 46, 91, 240, 33, 109, 112, 222, 148, 32, 165, 178, 6, 155, 116, 89, 185, 159, 93, 159, 127, 47, 173, 124, 215, 154, 174, 230, 122, 127, 154, 52, 67, 126, 60, 121, 168, 74, 240, 205, 141, 233, 223, 242, 104, 235, 12, 71, 147, 245, 1, 249, 136, 213, 64, 246, 211, 71, 92, 32, 121, 184, 34, 122, 35, 217, 104, 222, 196, 227, 198, 101, 3, 24, 113, 147, 69, 150, 48, 71, 43, 253, 182, 186, 29, 231, 134, 199, 151, 250, 111, 78, 166, 90, 42, 132, 25, 38, 47, 41, 103, 136, 86, 203, 115, 201, 189, 75, 200, 155, 94, 4, 27, 34, 119]);
-    var spki = new Uint8Array([48, 130, 1, 34, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 3, 130, 1, 15, 0, 48, 130, 1, 10, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1]);
+    var keyFixtures = getRsaKeyFixtures();
+    var pkcs8 = keyFixtures.pkcs8;
+    var spki = keyFixtures.spki;
 
     // Can optionally provide a label for encryption. We use the ASCII-encoded
     // abstract from the candidate recommendation.
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
new file mode 100644
index 000000000000..2c7493dfffd6
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
@@ -0,0 +1,36 @@
+// Generated by WebCryptoAPI/tools/generate.py. Do not edit directly.
+const generateKeyTestVectors = [
+    {name: "AES-CTR", resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
+    {name: "AES-CBC", resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
+    {name: "AES-GCM", resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
+    {name: "AES-OCB", resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
+    {name: "ChaCha20-Poly1305", resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
+    {name: "AES-KW", resultType: CryptoKey, usages: ["wrapKey", "unwrapKey"], mandatoryUsages: []},
+    {name: "HMAC", resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
+    {name: "RSASSA-PKCS1-v1_5", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "RSA-PSS", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "RSA-OAEP", resultType: "CryptoKeyPair", usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: ["decrypt", "unwrapKey"]},
+    {name: "ECDSA", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "ECDH", resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
+    {name: "Ed25519", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "Ed448", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "ML-DSA-44", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "ML-DSA-65", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "ML-DSA-87", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
+    {name: "ML-KEM-512", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "ML-KEM-768", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "ML-KEM-1024", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "X25519", resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
+    {name: "X448", resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
+    {name: "KMAC128", resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
+    {name: "KMAC256", resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
+];
+
+function getGenerateKeyTestVectors(algorithmNames) {
+    if (algorithmNames && !Array.isArray(algorithmNames)) {
+        algorithmNames = [algorithmNames];
+    }
+
+    return generateKeyTestVectors.filter(
+        vector => !algorithmNames || algorithmNames.includes(vector.name));
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
index a3258ae0dd77..2a618ce4ab25 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
@@ -1,8 +1,6 @@
 function run_test(algorithmNames) {
     var subtle = crypto.subtle; // Change to test prefixed implementations
 
-    setup({explicit_timeout: true});
-
 // These tests check that generateKey throws an error, and that
 // the error is of the right type, for a wide set of incorrect parameters.
 //
@@ -21,42 +19,7 @@ function run_test(algorithmNames) {
 // helper functions that generate all possible test parameters for
 // different situations.
 
-    var allTestVectors = [ // Parameters that should work for generateKey
-        {name: "AES-CTR",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-CBC",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-GCM",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-OCB",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "ChaCha20-Poly1305",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-KW",   resultType: CryptoKey, usages: ["wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "HMAC",     resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
-        {name: "RSASSA-PKCS1-v1_5", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "RSA-PSS",  resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "RSA-OAEP", resultType: "CryptoKeyPair", usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: ["decrypt", "unwrapKey"]},
-        {name: "ECDSA",    resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ECDH",     resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
-        {name: "Ed25519",  resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "Ed448",    resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-DSA-44", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-DSA-65", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-DSA-87", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-KEM-512", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
-        {name: "ML-KEM-768", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
-        {name: "ML-KEM-1024", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
-        {name: "X25519",   resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
-        {name: "X448",     resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
-        {name: "KMAC128",  resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
-        {name: "KMAC256",  resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
-    ];
-
-    var testVectors = [];
-    if (algorithmNames && !Array.isArray(algorithmNames)) {
-        algorithmNames = [algorithmNames];
-    };
-    allTestVectors.forEach(function(vector) {
-        if (!algorithmNames || algorithmNames.includes(vector.name)) {
-            testVectors.push(vector);
-        }
-    });
+    var testVectors = getGenerateKeyTestVectors(algorithmNames);
 
 
     function parameterString(algorithm, extractable, usages) {
@@ -117,16 +80,15 @@ function run_test(algorithmNames) {
     }
 
 
-    // Don't create an exhaustive list of all invalid usages,
-    // because there would usually be nearly 2**8 of them,
-    // way too many to test. Instead, create every singleton
+    // Don't create an exhaustive list of all invalid usages because
+    // there would be too many to test. Instead, create every singleton
     // of an illegal usage, and "poison" every valid usage
     // with an illegal one.
     function invalidUsages(validUsages, mandatoryUsages) {
         var results = [];
 
         var illegalUsages = [];
-        ["encrypt", "decrypt", "sign", "verify", "wrapKey", "unwrapKey", "deriveKey", "deriveBits"].forEach(function(usage) {
+        allKeyUsages.forEach(function(usage) {
             if (!validUsages.includes(usage)) {
                 illegalUsages.push(usage);
             }
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CBC.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CBC.https.any.js
index 38bed1cc7028..5febdbb94926 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CBC.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CBC.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["AES-CBC"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CTR.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CTR.https.any.js
index 0e7940775fe0..0eb6664f5d00 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CTR.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-CTR.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["AES-CTR"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-GCM.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-GCM.https.any.js
index a394c8b629c5..3d13b78903fd 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-GCM.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-GCM.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["AES-GCM"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-KW.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-KW.https.any.js
index 40c199b29a5c..138565e59ac1 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-KW.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-KW.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["AES-KW"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-OCB.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-OCB.tentative.https.any.js
index d4a2cd868ff5..ef7c8c38e537 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-OCB.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_AES-OCB.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["AES-OCB"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDH.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDH.https.any.js
index e522254d743a..f61d27e995c4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDH.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDH.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["ECDH"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDSA.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDSA.https.any.js
index e19974ff488c..e49b5e675b3f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDSA.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ECDSA.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["ECDSA"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed25519.https.any.js
index 8f18fb1efe09..7505e97bf2e1 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed25519.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["Ed25519"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed448.tentative.https.any.js
index b25dcd149094..6ee388e40f76 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Ed448.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["Ed448"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_HMAC.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_HMAC.https.any.js
index 43ce1c026fc7..e3097cd46cdc 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_HMAC.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_HMAC.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["HMAC"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-DSA.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-DSA.tentative.https.any.js
index 91e20bc6148f..d41636dea797 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-DSA.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-DSA.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["ML-DSA-44", "ML-DSA-65", "ML-DSA-87"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-KEM.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-KEM.tentative.https.any.js
index 9cd347d00f81..0ece96944e7b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-KEM.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_ML-KEM.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["ML-KEM-512", "ML-KEM-768", "ML-KEM-1024"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-OAEP.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-OAEP.https.any.js
index 1d2bca96b18c..a4eb4e6cbc82 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-OAEP.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-OAEP.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["RSA-OAEP"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-PSS.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-PSS.https.any.js
index 562f66697c9f..62ac442ebe2b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-PSS.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSA-PSS.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["RSA-PSS"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSASSA-PKCS1-v1_5.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSASSA-PKCS1-v1_5.https.any.js
index fb19308de6f7..f06e3402799a 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSASSA-PKCS1-v1_5.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_RSASSA-PKCS1-v1_5.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["RSASSA-PKCS1-v1_5"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X25519.https.any.js
index 2662d8697a9a..6735e85151e6 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X25519.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["X25519"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X448.tentative.https.any.js
index 455e260d1fe9..26e12b972590 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_X448.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["X448"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_chacha20_poly1305.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_chacha20_poly1305.tentative.https.any.js
index c9a278cdfc2b..6ec0593a14b9 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_chacha20_poly1305.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_chacha20_poly1305.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["ChaCha20-Poly1305"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_kmac.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_kmac.tentative.https.any.js
index f906038c7d3f..889c17e9c23b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_kmac.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_kmac.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCryptoAPI: generateKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=algorithm_registry.js
 // META: script=failures.js
 run_test(["KMAC128", "KMAC256"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
index c72384b7b93b..5006cd35ad9c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
@@ -2,8 +2,6 @@
 function run_test(algorithmNames, slowTest) {
     var subtle = crypto.subtle; // Change to test prefixed implementations
 
-    setup({explicit_timeout: true});
-
 // These tests check that generateKey successfully creates keys
 // when provided any of a wide set of correct parameters
 // and that they can be exported afterwards.
@@ -17,42 +15,7 @@ function run_test(algorithmNames, slowTest) {
 // helper functions that generate all possible test parameters for
 // different situations.
 
-    var allTestVectors = [ // Parameters that should work for generateKey
-        {name: "AES-CTR",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-CBC",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-GCM",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-OCB",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "ChaCha20-Poly1305",  resultType: CryptoKey, usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "AES-KW",   resultType: CryptoKey, usages: ["wrapKey", "unwrapKey"], mandatoryUsages: []},
-        {name: "HMAC",     resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
-        {name: "RSASSA-PKCS1-v1_5", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "RSA-PSS",  resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "RSA-OAEP", resultType: "CryptoKeyPair", usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"], mandatoryUsages: ["decrypt", "unwrapKey"]},
-        {name: "ECDSA",    resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ECDH",     resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
-        {name: "Ed25519",  resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "Ed448",    resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-DSA-44", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-DSA-65", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-DSA-87", resultType: "CryptoKeyPair", usages: ["sign", "verify"], mandatoryUsages: ["sign"]},
-        {name: "ML-KEM-512", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
-        {name: "ML-KEM-768", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
-        {name: "ML-KEM-1024", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
-        {name: "X25519",   resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
-        {name: "X448",     resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
-        {name: "KMAC128",  resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
-        {name: "KMAC256",  resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
-    ];
-
-    var testVectors = [];
-    if (algorithmNames && !Array.isArray(algorithmNames)) {
-        algorithmNames = [algorithmNames];
-    };
-    allTestVectors.forEach(function(vector) {
-        if (!algorithmNames || algorithmNames.includes(vector.name)) {
-            testVectors.push(vector);
-        }
-    });
+    var testVectors = getGenerateKeyTestVectors(algorithmNames);
 
     function parameterString(algorithm, extractable, usages) {
         var result = "(" +
@@ -93,6 +56,7 @@ function run_test(algorithmNames, slowTest) {
                     ];
                     if (extractable)
                         promises.push(subtle.exportKey('raw-seed', result.privateKey));
+                    await Promise.all(promises);
                 } else if (resultType === "CryptoKeyPair") {
                     const promises = [
                         subtle.exportKey('jwk', result.publicKey),
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CBC.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CBC.https.any.js
index 80f92c2cb7d7..b2e1b2971a91 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CBC.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CBC.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["AES-CBC"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CTR.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CTR.https.any.js
index 243a104b606d..bec9e22f3205 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CTR.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-CTR.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["AES-CTR"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-GCM.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-GCM.https.any.js
index f0f947c8160f..df6e694c1e12 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-GCM.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-GCM.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["AES-GCM"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-KW.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-KW.https.any.js
index dbc040fdc5cb..e55b24745c26 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-KW.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-KW.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["AES-KW"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-OCB.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-OCB.tentative.https.any.js
index b43abc4edb41..c87f875f4b1e 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-OCB.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_AES-OCB.tentative.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["AES-OCB"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDH.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDH.https.any.js
index e9dee526149d..9ec44a350605 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDH.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDH.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["ECDH"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDSA.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDSA.https.any.js
index a022f31fe9d1..9b0f40aa9a9b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDSA.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ECDSA.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["ECDSA"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed25519.https.any.js
index 6b3bc460f60f..8ecbbd23553c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed25519.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["Ed25519"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed448.tentative.https.any.js
index 8e37f57b244b..d017170ca1ad 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Ed448.tentative.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["Ed448"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_HMAC.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_HMAC.https.any.js
index 18e0b271226f..59fab83b08b8 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_HMAC.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_HMAC.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["HMAC"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-DSA.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-DSA.tentative.https.any.js
index 15d52f2a5059..6c81b193167c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-DSA.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-DSA.tentative.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["ML-DSA-44", "ML-DSA-65", "ML-DSA-87"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-KEM.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-KEM.tentative.https.any.js
index 68a0d97b9755..f41b5c34cdb5 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-KEM.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_ML-KEM.tentative.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["ML-KEM-512", "ML-KEM-768", "ML-KEM-1024"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-OAEP.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-OAEP.https.any.js
index d933fd981d4a..f7c550df2222 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-OAEP.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-OAEP.https.any.js
@@ -18,5 +18,6 @@
 // META: variant=?151-last
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["RSA-OAEP"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-PSS.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-PSS.https.any.js
index cb43e3de3de3..d1a9ec33ac23 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-PSS.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSA-PSS.https.any.js
@@ -6,5 +6,6 @@
 // META: variant=?31-last
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["RSA-PSS"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSASSA-PKCS1-v1_5.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSASSA-PKCS1-v1_5.https.any.js
index b8db5972284d..6db5a3703fe7 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSASSA-PKCS1-v1_5.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_RSASSA-PKCS1-v1_5.https.any.js
@@ -6,5 +6,6 @@
 // META: variant=?31-last
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["RSASSA-PKCS1-v1_5"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X25519.https.any.js
index 0e87cf50108e..5acd5b5a1c2b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X25519.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["X25519"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X448.tentative.https.any.js
index e7dbe32696d8..f1475c16bbd2 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_X448.tentative.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["X448"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_chacha20_poly1305.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_chacha20_poly1305.tentative.https.any.js
index a1cef25c2f24..2f3efebb6bc2 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_chacha20_poly1305.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_chacha20_poly1305.tentative.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["ChaCha20-Poly1305"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_kmac.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_kmac.tentative.https.any.js
index 9f881f92bc17..8276fa9058c4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_kmac.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_kmac.tentative.https.any.js
@@ -2,5 +2,6 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
 // META: script=successes.js
 run_test(["KMAC128", "KMAC256"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/getRandomValues.any.js b/test/fixtures/wpt/WebCryptoAPI/getRandomValues.any.js
index aecd38efd60b..8fd18a81deff 100644
--- a/test/fixtures/wpt/WebCryptoAPI/getRandomValues.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/getRandomValues.any.js
@@ -66,7 +66,7 @@ for (const array of arrays) {
     }, "Large length: " + array);
 
     test(function() {
-        assert_true(self.crypto.getRandomValues(new ctor(0)).length == 0)
+        assert_true(self.crypto.getRandomValues(new ctor(0)).length === 0)
     }, "Null arrays: " + array);
 
     test(function() {
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey.tentative.https.any.js
index 5ce13d858d6f..02f745d71c28 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey.tentative.https.any.js
@@ -1,8 +1,9 @@
 // META: title=WebCryptoAPI: importKey() for ML-DSA keys
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/mldsa_key_fixtures.js
 // META: script=ML-DSA_importKey_fixtures.js
-// META: script=ML-DSA_importKey.js
+// META: script=ml_importKey.js
 
 runTests("ML-DSA-44");
 runTests("ML-DSA-65");
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
index ef1f5a1f51a9..abccc10c63fb 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
@@ -1,99 +1,11 @@
+var mldsaKeyFixtures = getMldsaKeyFixtures();
+
 var keyData = {
   'ML-DSA-44': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
-    pkcs8: new Uint8Array([
-      48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 17, 4, 34,
-      128, 32, 153, 21, 95, 99, 48, 150, 218, 124, 190, 8, 122, 137, 72, 184,
-      79, 118, 123, 16, 249, 1, 200, 35, 194, 64, 177, 221, 43, 200, 112, 5,
-      201, 62,
-    ]),
-    spki: new Uint8Array([
-      48, 130, 5, 50, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 17, 3, 130, 5,
-      33, 0, 85, 152, 213, 68, 198, 20, 177, 84, 200, 188, 33, 104, 36, 161,
-      193, 127, 226, 151, 48, 107, 122, 191, 89, 86, 188, 3, 245, 199, 18, 79,
-      168, 192, 218, 218, 223, 227, 84, 133, 41, 187, 9, 183, 14, 222, 155, 137,
-      84, 111, 138, 97, 234, 152, 52, 15, 163, 47, 227, 218, 19, 20, 229, 93,
-      99, 252, 155, 213, 30, 241, 158, 211, 213, 191, 155, 73, 211, 145, 59,
-      194, 75, 140, 3, 161, 149, 139, 48, 172, 155, 172, 120, 234, 142, 79, 78,
-      116, 215, 184, 50, 182, 162, 192, 93, 221, 179, 216, 70, 186, 92, 93, 51,
-      190, 61, 173, 105, 206, 9, 208, 52, 54, 208, 252, 115, 176, 146, 118, 23,
-      0, 5, 41, 151, 121, 241, 246, 193, 206, 212, 160, 181, 7, 99, 220, 78, 96,
-      123, 142, 35, 107, 37, 218, 138, 139, 228, 207, 166, 132, 87, 36, 116,
-      251, 174, 10, 41, 196, 171, 26, 212, 90, 213, 223, 141, 87, 232, 59, 46,
-      173, 16, 247, 173, 4, 219, 165, 234, 8, 217, 233, 163, 13, 10, 160, 22,
-      87, 232, 2, 9, 92, 177, 35, 67, 55, 104, 51, 204, 231, 81, 209, 62, 31,
-      117, 56, 141, 78, 109, 148, 118, 191, 93, 193, 59, 30, 88, 237, 19, 169,
-      14, 11, 150, 102, 215, 144, 69, 246, 32, 159, 110, 49, 75, 78, 225, 121,
-      184, 206, 234, 126, 171, 164, 43, 237, 244, 63, 83, 70, 136, 213, 244,
-      121, 184, 34, 201, 249, 95, 64, 165, 99, 14, 195, 231, 18, 121, 20, 156,
-      80, 231, 133, 197, 0, 94, 195, 22, 251, 255, 174, 213, 103, 75, 88, 58,
-      138, 66, 37, 85, 162, 15, 242, 29, 49, 147, 191, 163, 170, 109, 195, 22,
-      63, 197, 149, 117, 100, 36, 81, 115, 203, 126, 62, 86, 103, 193, 182, 69,
-      238, 233, 162, 62, 248, 132, 158, 212, 208, 187, 127, 212, 198, 169, 245,
-      26, 153, 28, 207, 85, 65, 145, 200, 23, 196, 38, 64, 49, 54, 233, 185, 72,
-      156, 86, 230, 127, 152, 108, 184, 240, 109, 8, 103, 228, 206, 142, 73, 74,
-      214, 52, 182, 203, 82, 201, 175, 188, 111, 42, 232, 8, 177, 131, 47, 237,
-      92, 120, 210, 124, 48, 185, 215, 137, 36, 70, 162, 164, 119, 0, 155, 20,
-      57, 33, 27, 220, 77, 254, 233, 190, 106, 135, 21, 194, 57, 238, 95, 162,
-      78, 164, 33, 210, 215, 43, 100, 96, 232, 87, 19, 43, 65, 240, 183, 17,
-      131, 247, 97, 241, 7, 111, 159, 40, 252, 45, 228, 76, 71, 46, 85, 181, 54,
-      41, 135, 162, 144, 227, 128, 121, 173, 207, 119, 54, 19, 197, 23, 231,
-      176, 125, 190, 32, 76, 60, 34, 24, 160, 42, 73, 190, 124, 99, 5, 9, 214,
-      6, 220, 177, 206, 79, 222, 10, 142, 250, 63, 179, 67, 21, 159, 57, 126,
-      239, 28, 238, 240, 107, 79, 185, 174, 232, 168, 146, 128, 229, 119, 19,
-      21, 33, 239, 193, 42, 178, 152, 124, 24, 203, 131, 193, 93, 162, 2, 208,
-      231, 20, 203, 232, 47, 54, 114, 255, 236, 97, 99, 156, 15, 160, 75, 60,
-      111, 59, 35, 25, 230, 43, 91, 170, 161, 74, 70, 179, 180, 251, 71, 197,
-      240, 104, 42, 39, 202, 206, 12, 115, 249, 138, 55, 252, 216, 61, 185, 121,
-      76, 137, 172, 166, 88, 92, 130, 18, 52, 67, 13, 187, 49, 147, 212, 77, 74,
-      56, 59, 123, 99, 205, 36, 137, 96, 111, 148, 121, 157, 2, 83, 246, 86,
-      156, 152, 98, 172, 77, 244, 214, 225, 184, 240, 121, 144, 56, 213, 161,
-      43, 67, 4, 161, 104, 202, 91, 134, 247, 108, 24, 46, 187, 63, 216, 50,
-      125, 120, 17, 216, 22, 228, 156, 253, 7, 180, 15, 130, 180, 72, 71, 169,
-      3, 236, 247, 11, 170, 32, 76, 236, 225, 133, 250, 20, 235, 200, 143, 89,
-      25, 158, 49, 158, 164, 213, 221, 81, 120, 241, 150, 210, 19, 79, 165, 24,
-      35, 170, 182, 242, 255, 143, 171, 148, 140, 41, 207, 186, 98, 224, 16,
-      152, 224, 38, 110, 175, 169, 111, 132, 201, 178, 114, 25, 196, 50, 149,
-      158, 193, 180, 101, 183, 92, 109, 131, 102, 119, 123, 78, 107, 223, 4, 1,
-      206, 140, 130, 237, 205, 36, 18, 180, 197, 154, 26, 236, 140, 173, 230,
-      101, 35, 189, 121, 104, 21, 75, 81, 224, 186, 212, 81, 107, 66, 244, 235,
-      64, 90, 206, 39, 44, 43, 162, 187, 63, 229, 217, 154, 185, 157, 24, 125,
-      252, 91, 136, 59, 47, 182, 200, 73, 19, 137, 132, 81, 16, 234, 227, 210,
-      32, 16, 160, 188, 250, 27, 190, 164, 53, 244, 219, 199, 177, 146, 117, 50,
-      99, 72, 235, 37, 154, 72, 51, 203, 61, 39, 230, 34, 132, 117, 217, 167,
-      201, 42, 17, 76, 72, 103, 172, 93, 169, 29, 76, 88, 178, 226, 32, 53, 190,
-      60, 210, 132, 113, 198, 26, 70, 179, 47, 34, 184, 88, 178, 208, 1, 196,
-      89, 136, 167, 33, 38, 9, 255, 89, 202, 27, 93, 229, 100, 192, 24, 234,
-      200, 186, 125, 231, 212, 188, 11, 29, 51, 189, 70, 147, 176, 231, 81, 16,
-      114, 152, 159, 21, 124, 185, 208, 50, 74, 211, 113, 207, 35, 54, 173, 205,
-      133, 52, 167, 199, 87, 158, 120, 33, 204, 163, 146, 233, 21, 61, 28, 102,
-      48, 232, 184, 15, 219, 238, 240, 215, 222, 239, 3, 110, 180, 95, 103, 147,
-      236, 10, 57, 195, 159, 231, 50, 92, 145, 165, 44, 204, 121, 187, 9, 210,
-      80, 86, 251, 169, 132, 236, 248, 23, 207, 222, 227, 13, 53, 1, 88, 69,
-      105, 13, 238, 202, 251, 194, 245, 14, 38, 1, 245, 157, 212, 162, 182, 217,
-      230, 115, 139, 175, 219, 199, 74, 124, 186, 158, 3, 220, 87, 220, 177, 85,
-      13, 58, 168, 223, 6, 238, 156, 80, 121, 44, 166, 176, 0, 48, 98, 70, 93,
-      78, 50, 192, 16, 186, 2, 233, 105, 105, 120, 195, 17, 100, 141, 214, 158,
-      144, 63, 4, 88, 190, 101, 209, 55, 119, 46, 128, 117, 225, 121, 204, 195,
-      19, 61, 170, 116, 251, 225, 230, 28, 27, 249, 84, 195, 224, 190, 60, 212,
-      83, 3, 148, 204, 4, 103, 50, 233, 175, 207, 47, 51, 216, 79, 251, 150, 81,
-      171, 7, 145, 55, 188, 187, 217, 200, 155, 246, 85, 42, 123, 18, 112, 192,
-      116, 163, 40, 187, 132, 192, 210, 188, 106, 117, 217, 185, 183, 202, 33,
-      11, 205, 10, 61, 52, 15, 66, 131, 121, 112, 26, 96, 166, 241, 1, 68, 206,
-      80, 92, 132, 83, 89, 126, 135, 157, 4, 202, 16, 5, 131, 112, 62, 56, 234,
-      176, 213, 119, 205, 203, 17, 106, 156, 117, 251, 135, 21, 73, 219, 238, 3,
-      88, 21, 71, 136, 118, 0, 7, 106, 151, 200, 221, 179, 206, 50, 198, 27,
-      118, 181, 27, 85, 35, 248, 44, 57, 15, 221, 97, 121, 4, 167, 111, 182,
-      207, 195, 52, 134, 195, 128, 173, 111, 98, 152, 29, 138, 197, 175, 171,
-      247, 194, 20, 134, 209, 232, 94, 17, 203, 139, 30, 237, 187, 243, 16, 180,
-      43, 105, 236, 66, 175, 170, 139, 24, 99, 28, 225, 141, 96, 250, 119, 0,
-      111, 212, 34, 217, 42, 134, 88, 78, 76, 126, 169, 168, 59, 154, 93, 54,
-      43, 161, 29, 111, 124, 59, 225, 52, 86, 147, 38, 151, 161, 36, 119, 204,
-      164, 121, 46, 186, 65, 84, 70, 38, 15, 203, 48, 168, 235, 231, 30, 55, 95,
-      36, 10, 20, 166, 109, 8, 18, 109, 251, 213, 82, 142, 240, 49, 249, 180,
-      78, 69,
-    ]),
+    pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-44'],
+    spki: mldsaKeyFixtures.spki['ML-DSA-44'],
     'raw-public': hexStringToUint8Array(
       '5598d544c614b154c8bc216824a1c17fe297306b7abf5956bc03f5c7124fa8c0dadadfe3548529bb09b70ede9b89546f8a61ea98340fa32fe3da1314e55d63fc9bd51ef19ed3d5bf9b49d3913bc24b8c03a1958b30ac9bac78ea8e4f4e74d7b832b6a2c05dddb3d846ba5c5d33be3dad69ce09d03436d0fc73b09276170005299779f1f6c1ced4a0b50763dc4e607b8e236b25da8a8be4cfa684572474fbae0a29c4ab1ad45ad5df8d57e83b2ead10f7ad04dba5ea08d9e9a30d0aa01657e802095cb12343376833cce751d13e1f75388d4e6d9476bf5dc13b1e58ed13a90e0b9666d79045f6209f6e314b4ee179b8ceea7eaba42bedf43f534688d5f479b822c9f95f40a5630ec3e71279149c50e785c5005ec316fbffaed5674b583a8a422555a20ff21d3193bfa3aa6dc3163fc5957564245173cb7e3e5667c1b645eee9a23ef8849ed4d0bb7fd4c6a9f51a991ccf554191c817c426403136e9b9489c56e67f986cb8f06d0867e4ce8e494ad634b6cb52c9afbc6f2ae808b1832fed5c78d27c30b9d7892446a2a477009b1439211bdc4dfee9be6a8715c239ee5fa24ea421d2d72b6460e857132b41f0b71183f761f1076f9f28fc2de44c472e55b5362987a290e38079adcf773613c517e7b07dbe204c3c2218a02a49be7c630509d606dcb1ce4fde0a8efa3fb343159f397eef1ceef06b4fb9aee8a89280e577131521efc12ab2987c18cb83c15da202d0e714cbe82f3672ffec61639c0fa04b3c6f3b2319e62b5baaa14a46b3b4fb47c5f0682a27cace0c73f98a37fcd83db9794c89aca6585c821234430dbb3193d44d4a383b7b63cd2489606f94799d0253f6569c9862ac4df4d6e1b8f0799038d5a12b4304a168ca5b86f76c182ebb3fd8327d7811d816e49cfd07b40f82b44847a903ecf70baa204cece185fa14ebc88f59199e319ea4d5dd5178f196d2134fa51823aab6f2ff8fab948c29cfba62e01098e0266eafa96f84c9b27219c432959ec1b465b75c6d8366777b4e6bdf0401ce8c82edcd2412b4c59a1aec8cade66523bd7968154b51e0bad4516b42f4eb405ace272c2ba2bb3fe5d99ab99d187dfc5b883b2fb6c8491389845110eae3d22010a0bcfa1bbea435f4dbc7b19275326348eb259a4833cb3d27e6228475d9a7c92a114c4867ac5da91d4c58b2e22035be3cd28471c61a46b32f22b858b2d001c45988a7212609ff59ca1b5de564c018eac8ba7de7d4bc0b1d33bd4693b0e7511072989f157cb9d0324ad371cf2336adcd8534a7c7579e7821cca392e9153d1c6630e8b80fdbeef0d7deef036eb45f6793ec0a39c39fe7325c91a52ccc79bb09d25056fba984ecf817cfdee30d35015845690deecafbc2f50e2601f59dd4a2b6d9e6738bafdbc74a7cba9e03dc57dcb1550d3aa8df06ee9c50792ca6b0003062465d4e32c010ba02e9696978c311648dd69e903f0458be65d137772e8075e179ccc3133daa74fbe1e61c1bf954c3e0be3cd4530394cc046732e9afcf2f33d84ffb9651ab079137bcbbd9c89bf6552a7b1270c074a328bb84c0d2bc6a75d9b9b7ca210bcd0a3d340f428379701a60a6f10144ce505c8453597e879d04ca100583703e38eab0d577cdcb116a9c75fb871549dbee03581547887600076a97c8ddb3ce32c61b76b51b5523f82c390fdd617904a76fb6cfc33486c380ad6f62981d8ac5afabf7c21486d1e85e11cb8b1eedbbf310b42b69ec42afaa8b18631ce18d60fa77006fd422d92a86584e4c7ea9a83b9a5d362ba11d6f7c3be13456932697a12477cca4792eba415446260fcb30a8ebe71e375f240a14a66d08126dfbd5528ef031f9b44e45'
     ),
@@ -111,138 +23,8 @@ var keyData = {
   'ML-DSA-65': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
-    pkcs8: new Uint8Array([
-      48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 18, 4, 34,
-      128, 32, 132, 164, 137, 75, 123, 70, 164, 178, 3, 156, 206, 16, 195, 26,
-      133, 186, 176, 195, 102, 48, 254, 35, 29, 66, 103, 17, 67, 152, 38, 7,
-      130, 139,
-    ]),
-    spki: new Uint8Array([
-      48, 130, 7, 178, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 18, 3, 130,
-      7, 161, 0, 216, 177, 233, 60, 151, 24, 246, 66, 175, 161, 192, 118, 9,
-      177, 87, 232, 5, 216, 49, 254, 251, 160, 51, 216, 250, 171, 229, 104, 149,
-      117, 135, 107, 5, 239, 244, 167, 83, 57, 49, 153, 29, 135, 108, 138, 117,
-      236, 120, 65, 89, 65, 17, 201, 127, 147, 246, 103, 238, 204, 25, 83, 240,
-      29, 173, 127, 140, 1, 88, 40, 43, 134, 51, 19, 125, 131, 224, 50, 167, 82,
-      20, 217, 215, 162, 41, 95, 215, 56, 130, 226, 177, 216, 20, 169, 133, 85,
-      140, 9, 105, 172, 54, 121, 0, 87, 202, 18, 93, 96, 147, 103, 127, 164, 63,
-      197, 97, 49, 230, 125, 53, 80, 64, 20, 239, 29, 90, 118, 102, 221, 177, 6,
-      220, 220, 170, 107, 107, 18, 138, 125, 138, 70, 66, 60, 185, 232, 209, 4,
-      100, 17, 118, 24, 181, 110, 241, 50, 250, 138, 209, 19, 84, 220, 61, 96,
-      80, 128, 81, 101, 160, 9, 5, 53, 33, 112, 60, 59, 195, 79, 115, 190, 101,
-      93, 56, 171, 146, 51, 82, 233, 66, 225, 226, 211, 72, 58, 9, 74, 222, 185,
-      175, 211, 156, 164, 68, 188, 119, 46, 14, 64, 160, 13, 207, 60, 81, 68,
-      108, 148, 59, 88, 88, 92, 88, 171, 249, 204, 160, 137, 222, 234, 168, 233,
-      3, 86, 224, 174, 105, 224, 1, 177, 184, 230, 236, 30, 85, 249, 56, 105,
-      211, 50, 83, 168, 139, 28, 175, 181, 22, 89, 166, 215, 152, 218, 184, 111,
-      65, 24, 82, 71, 185, 100, 172, 66, 178, 6, 215, 164, 252, 56, 40, 198,
-      207, 152, 110, 186, 207, 39, 235, 179, 38, 215, 88, 105, 109, 177, 130,
-      91, 5, 223, 164, 78, 241, 176, 125, 197, 94, 100, 40, 214, 251, 239, 253,
-      88, 154, 14, 75, 254, 94, 210, 86, 244, 51, 95, 168, 139, 213, 73, 87,
-      151, 209, 150, 126, 88, 69, 251, 116, 157, 122, 96, 212, 206, 42, 218, 38,
-      85, 184, 50, 246, 188, 35, 72, 60, 226, 155, 246, 86, 209, 110, 133, 161,
-      129, 126, 80, 154, 238, 64, 64, 170, 156, 177, 225, 52, 87, 42, 88, 154,
-      174, 246, 30, 84, 143, 221, 51, 27, 65, 60, 40, 22, 120, 42, 145, 34, 82,
-      235, 79, 20, 215, 211, 231, 151, 108, 119, 53, 116, 190, 13, 139, 199,
-      189, 84, 54, 186, 222, 90, 116, 253, 227, 207, 104, 209, 118, 42, 144, 94,
-      22, 219, 198, 211, 216, 171, 75, 245, 61, 240, 157, 108, 81, 19, 238, 39,
-      120, 210, 242, 63, 126, 6, 15, 18, 97, 232, 207, 184, 84, 239, 72, 115,
-      90, 95, 112, 78, 45, 201, 13, 102, 208, 151, 146, 253, 153, 177, 115, 14,
-      194, 184, 107, 118, 120, 63, 105, 89, 144, 60, 242, 80, 106, 32, 11, 204,
-      170, 165, 221, 182, 31, 187, 159, 216, 118, 218, 207, 182, 107, 136, 211,
-      162, 231, 196, 128, 83, 251, 192, 189, 149, 1, 245, 36, 146, 159, 11, 116,
-      30, 191, 141, 182, 157, 227, 91, 88, 72, 224, 55, 195, 96, 245, 135, 249,
-      142, 16, 229, 237, 27, 60, 2, 91, 138, 82, 197, 210, 40, 8, 123, 172, 202,
-      207, 119, 199, 190, 102, 40, 141, 174, 93, 211, 219, 134, 105, 26, 103,
-      100, 102, 62, 130, 224, 135, 173, 82, 224, 200, 213, 76, 211, 38, 181, 16,
-      97, 99, 75, 14, 42, 162, 223, 237, 141, 1, 29, 140, 191, 146, 49, 236,
-      179, 88, 202, 220, 124, 239, 231, 131, 101, 134, 111, 28, 54, 151, 172,
-      67, 167, 113, 96, 204, 63, 76, 169, 95, 14, 175, 149, 189, 173, 39, 177,
-      102, 23, 158, 102, 236, 224, 70, 203, 190, 132, 230, 136, 3, 28, 201, 131,
-      148, 164, 219, 181, 208, 26, 239, 111, 86, 35, 102, 133, 114, 113, 180,
-      184, 82, 180, 106, 124, 248, 126, 87, 177, 165, 176, 204, 128, 141, 179,
-      141, 34, 119, 160, 57, 206, 168, 95, 197, 110, 79, 60, 48, 170, 125, 206,
-      147, 137, 156, 85, 46, 7, 193, 228, 150, 22, 46, 147, 51, 153, 157, 248,
-      151, 253, 114, 58, 126, 38, 127, 19, 225, 99, 183, 235, 175, 90, 166, 8,
-      233, 141, 10, 85, 232, 147, 7, 20, 137, 240, 84, 231, 86, 134, 50, 212,
-      201, 6, 253, 18, 150, 114, 160, 140, 2, 254, 189, 152, 14, 68, 110, 50,
-      134, 199, 73, 237, 56, 116, 110, 135, 36, 40, 14, 167, 50, 71, 81, 9, 178,
-      54, 182, 247, 64, 32, 204, 116, 92, 131, 40, 30, 246, 188, 236, 182, 187,
-      132, 239, 124, 136, 238, 146, 137, 247, 87, 52, 15, 78, 108, 135, 178,
-      101, 70, 199, 193, 192, 144, 196, 106, 186, 141, 42, 101, 214, 196, 67,
-      175, 38, 8, 189, 148, 166, 253, 221, 144, 119, 81, 1, 232, 175, 81, 237,
-      13, 188, 220, 230, 47, 115, 184, 179, 0, 51, 118, 39, 22, 114, 232, 88,
-      15, 121, 216, 130, 107, 173, 108, 175, 225, 113, 40, 223, 185, 6, 244,
-      227, 73, 38, 64, 84, 10, 200, 53, 81, 179, 217, 106, 172, 59, 161, 70,
-      180, 70, 48, 56, 46, 233, 133, 245, 57, 120, 154, 167, 49, 109, 188, 152,
-      245, 181, 1, 159, 247, 44, 167, 152, 6, 191, 246, 38, 120, 141, 57, 241,
-      168, 60, 38, 6, 82, 248, 87, 85, 0, 10, 22, 19, 44, 178, 63, 38, 78, 1,
-      210, 166, 140, 3, 199, 112, 135, 155, 36, 13, 204, 124, 47, 5, 190, 103,
-      91, 205, 147, 248, 115, 177, 196, 180, 234, 85, 35, 24, 182, 16, 207, 107,
-      167, 10, 54, 193, 146, 71, 95, 45, 109, 184, 43, 101, 155, 184, 55, 171,
-      196, 136, 89, 227, 84, 183, 31, 0, 137, 230, 146, 250, 6, 27, 225, 241,
-      11, 95, 124, 248, 133, 171, 149, 67, 73, 19, 110, 104, 173, 86, 6, 246,
-      195, 196, 200, 175, 53, 18, 198, 223, 140, 85, 208, 253, 204, 220, 255,
-      232, 88, 238, 20, 97, 24, 52, 13, 3, 179, 62, 151, 101, 67, 33, 79, 253,
-      157, 253, 233, 197, 109, 130, 78, 11, 165, 214, 200, 41, 157, 63, 46, 175,
-      251, 246, 225, 227, 199, 92, 107, 216, 58, 124, 226, 202, 153, 92, 31,
-      250, 182, 92, 99, 0, 110, 18, 78, 228, 166, 190, 67, 88, 245, 155, 139,
-      82, 152, 39, 204, 74, 140, 95, 82, 82, 160, 147, 144, 33, 0, 242, 200, 22,
-      102, 160, 233, 102, 224, 42, 205, 240, 56, 95, 197, 226, 175, 235, 240,
-      125, 10, 51, 12, 246, 150, 234, 173, 95, 132, 173, 174, 1, 161, 23, 39,
-      52, 168, 87, 54, 4, 66, 201, 34, 155, 82, 133, 170, 76, 52, 226, 109, 163,
-      19, 34, 184, 226, 39, 20, 75, 72, 201, 70, 188, 71, 182, 230, 6, 19, 255,
-      8, 145, 193, 63, 81, 150, 24, 72, 89, 168, 74, 98, 173, 133, 67, 227, 44,
-      252, 252, 227, 192, 125, 20, 227, 144, 24, 31, 48, 67, 67, 48, 94, 163,
-      52, 219, 163, 225, 214, 214, 109, 211, 122, 213, 198, 90, 204, 40, 97,
-      211, 121, 17, 28, 132, 246, 110, 230, 51, 197, 42, 162, 143, 199, 158,
-      215, 210, 133, 60, 65, 127, 1, 153, 193, 22, 171, 250, 114, 204, 246, 255,
-      126, 25, 96, 44, 164, 102, 172, 211, 23, 245, 122, 48, 221, 249, 138, 148,
-      134, 206, 135, 246, 42, 235, 198, 89, 189, 45, 125, 204, 69, 193, 48, 29,
-      144, 125, 224, 127, 66, 1, 134, 141, 224, 211, 193, 141, 69, 128, 75, 167,
-      244, 160, 120, 54, 191, 214, 29, 40, 249, 15, 46, 68, 141, 91, 242, 91,
-      80, 252, 109, 122, 154, 64, 153, 56, 65, 254, 106, 18, 4, 172, 171, 136,
-      80, 98, 79, 133, 255, 4, 100, 191, 144, 171, 219, 46, 132, 181, 130, 228,
-      107, 68, 32, 123, 201, 17, 67, 35, 144, 180, 160, 30, 125, 9, 55, 184,
-      172, 0, 159, 250, 232, 83, 168, 162, 102, 158, 121, 208, 177, 116, 163,
-      160, 80, 241, 46, 156, 58, 203, 240, 67, 176, 244, 170, 160, 115, 122,
-      141, 154, 101, 218, 178, 119, 130, 195, 32, 207, 51, 149, 98, 51, 219, 57,
-      121, 216, 156, 101, 218, 184, 220, 204, 41, 181, 149, 63, 80, 194, 11,
-      143, 164, 219, 23, 123, 141, 119, 43, 94, 78, 175, 89, 165, 48, 167, 44,
-      45, 219, 197, 15, 202, 118, 116, 245, 151, 218, 14, 199, 96, 27, 102, 206,
-      198, 123, 222, 178, 210, 20, 200, 38, 25, 124, 58, 102, 92, 197, 107, 51,
-      5, 236, 125, 173, 198, 113, 144, 108, 177, 22, 104, 223, 165, 39, 9, 84,
-      87, 124, 80, 153, 8, 212, 76, 2, 28, 12, 90, 212, 129, 148, 212, 229, 63,
-      29, 200, 113, 171, 154, 107, 189, 202, 22, 147, 7, 32, 253, 70, 37, 224,
-      98, 199, 129, 21, 54, 49, 52, 124, 84, 40, 190, 194, 108, 73, 26, 15, 124,
-      87, 87, 198, 217, 122, 127, 82, 167, 131, 59, 8, 172, 49, 162, 61, 64, 79,
-      196, 205, 65, 110, 75, 130, 128, 197, 182, 251, 110, 141, 197, 184, 166,
-      244, 246, 217, 20, 105, 85, 42, 80, 251, 77, 59, 204, 247, 179, 218, 181,
-      124, 209, 4, 28, 118, 234, 145, 237, 140, 106, 54, 88, 82, 28, 235, 68,
-      221, 109, 139, 11, 166, 182, 63, 142, 194, 255, 213, 219, 116, 158, 31,
-      224, 119, 126, 232, 160, 144, 1, 177, 92, 219, 162, 49, 181, 116, 163,
-      104, 245, 193, 188, 26, 172, 15, 190, 135, 207, 106, 246, 13, 132, 76,
-      189, 160, 25, 123, 26, 20, 48, 203, 59, 209, 69, 235, 103, 253, 160, 108,
-      83, 206, 70, 98, 0, 2, 57, 162, 202, 63, 45, 89, 173, 201, 254, 254, 253,
-      143, 21, 77, 131, 184, 234, 37, 68, 206, 69, 186, 179, 145, 147, 135, 42,
-      137, 152, 253, 213, 240, 13, 122, 161, 218, 186, 180, 213, 162, 150, 231,
-      63, 112, 182, 233, 86, 12, 225, 195, 133, 37, 28, 22, 147, 201, 200, 197,
-      115, 3, 138, 194, 86, 79, 247, 27, 241, 149, 128, 197, 8, 11, 134, 53,
-      118, 175, 248, 253, 114, 91, 31, 192, 253, 209, 111, 31, 228, 244, 184,
-      179, 146, 145, 167, 137, 155, 184, 218, 38, 62, 187, 22, 181, 193, 93, 16,
-      9, 195, 42, 198, 225, 100, 144, 148, 223, 184, 40, 117, 32, 131, 94, 93,
-      83, 88, 125, 95, 220, 20, 206, 7, 228, 78, 54, 238, 178, 196, 38, 245, 95,
-      8, 235, 106, 17, 175, 142, 193, 60, 179, 53, 244, 92, 147, 244, 218, 95,
-      127, 251, 128, 42, 105, 82, 243, 224, 213, 25, 91, 151, 22, 201, 18, 25,
-      230, 165, 85, 25, 249, 170, 160, 171, 210, 209, 32, 154, 124, 245, 60, 30,
-      255, 138, 154, 29, 85, 156, 232, 177, 78, 14, 137, 52, 215, 247, 26, 211,
-      115, 72, 20, 133, 232, 1, 151, 251, 63, 45, 120, 69, 49, 209, 130, 255, 2,
-      218, 21, 251, 16, 86, 30, 62, 136, 92, 149, 60, 6, 125, 129, 145, 235,
-      102, 190, 144, 248, 1, 53, 135, 21, 158, 44, 158, 230, 246, 172, 249, 161,
-      105, 204, 49, 60, 70, 63, 127, 163, 231, 175, 174, 234, 147, 185, 62, 5,
-      244, 156, 4, 31, 39, 156, 176, 154, 251, 166, 143, 212, 43, 30, 97, 50,
-      37, 176, 155, 77, 149, 102,
-    ]),
+    pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-65'],
+    spki: mldsaKeyFixtures.spki['ML-DSA-65'],
     'raw-public': hexStringToUint8Array(
       'd8b1e93c9718f642afa1c07609b157e805d831fefba033d8faabe5689575876b05eff4a7533931991d876c8a75ec7841594111c97f93f667eecc1953f01dad7f8c0158282b8633137d83e032a75214d9d7a2295fd73882e2b1d814a985558c0969ac36790057ca125d6093677fa43fc56131e67d35504014ef1d5a7666ddb106dcdcaa6b6b128a7d8a46423cb9e8d10464117618b56ef132fa8ad11354dc3d6050805165a009053521703c3bc34f73be655d38ab923352e942e1e2d3483a094adeb9afd39ca444bc772e0e40a00dcf3c51446c943b58585c58abf9cca089deeaa8e90356e0ae69e001b1b8e6ec1e55f93869d33253a88b1cafb51659a6d798dab86f41185247b964ac42b206d7a4fc3828c6cf986ebacf27ebb326d758696db1825b05dfa44ef1b07dc55e6428d6fbeffd589a0e4bfe5ed256f4335fa88bd5495797d1967e5845fb749d7a60d4ce2ada2655b832f6bc23483ce29bf656d16e85a1817e509aee4040aa9cb1e134572a589aaef61e548fdd331b413c2816782a912252eb4f14d7d3e7976c773574be0d8bc7bd5436bade5a74fde3cf68d1762a905e16dbc6d3d8ab4bf53df09d6c5113ee2778d2f23f7e060f1261e8cfb854ef48735a5f704e2dc90d66d09792fd99b1730ec2b86b76783f6959903cf2506a200bccaaa5ddb61fbb9fd876dacfb66b88d3a2e7c48053fbc0bd9501f524929f0b741ebf8db69de35b5848e037c360f587f98e10e5ed1b3c025b8a52c5d228087baccacf77c7be66288dae5dd3db86691a6764663e82e087ad52e0c8d54cd326b51061634b0e2aa2dfed8d011d8cbf9231ecb358cadc7cefe78365866f1c3697ac43a77160cc3f4ca95f0eaf95bdad27b166179e66ece046cbbe84e688031cc98394a4dbb5d01aef6f562366857271b4b852b46a7cf87e57b1a5b0cc808db38d2277a039cea85fc56e4f3c30aa7dce93899c552e07c1e496162e9333999df897fd723a7e267f13e163b7ebaf5aa608e98d0a55e893071489f054e7568632d4c906fd129672a08c02febd980e446e3286c749ed38746e8724280ea732475109b236b6f74020cc745c83281ef6bcecb6bb84ef7c88ee9289f757340f4e6c87b26546c7c1c090c46aba8d2a65d6c443af2608bd94a6fddd90775101e8af51ed0dbcdce62f73b8b3003376271672e8580f79d8826bad6cafe17128dfb906f4e3492640540ac83551b3d96aac3ba146b44630382ee985f539789aa7316dbc98f5b5019ff72ca79806bff626788d39f1a83c260652f85755000a16132cb23f264e01d2a68c03c770879b240dcc7c2f05be675bcd93f873b1c4b4ea552318b610cf6ba70a36c192475f2d6db82b659bb837abc48859e354b71f0089e692fa061be1f10b5f7cf885ab954349136e68ad5606f6c3c4c8af3512c6df8c55d0fdccdcffe858ee146118340d03b33e976543214ffd9dfde9c56d824e0ba5d6c8299d3f2eaffbf6e1e3c75c6bd83a7ce2ca995c1ffab65c63006e124ee4a6be4358f59b8b529827cc4a8c5f5252a093902100f2c81666a0e966e02acdf0385fc5e2afebf07d0a330cf696eaad5f84adae01a1172734a857360442c9229b5285aa4c34e26da31322b8e227144b48c946bc47b6e60613ff0891c13f5196184859a84a62ad8543e32cfcfce3c07d14e390181f304343305ea334dba3e1d6d66dd37ad5c65acc2861d379111c84f66ee633c52aa28fc79ed7d2853c417f0199c116abfa72ccf6ff7e19602ca466acd317f57a30ddf98a9486ce87f62aebc659bd2d7dcc45c1301d907de07f4201868de0d3c18d45804ba7f4a07836bfd61d28f90f2e448d5bf25b50fc6d7a9a40993841fe6a1204acab8850624f85ff0464bf90abdb2e84b582e46b44207bc911432390b4a01e7d0937b8ac009ffae853a8a2669e79d0b174a3a050f12e9c3acbf043b0f4aaa0737a8d9a65dab27782c320cf33956233db3979d89c65dab8dccc29b5953f50c20b8fa4db177b8d772b5e4eaf59a530a72c2ddbc50fca7674f597da0ec7601b66cec67bdeb2d214c826197c3a665cc56b3305ec7dadc671906cb11668dfa5270954577c509908d44c021c0c5ad48194d4e53f1dc871ab9a6bbdca16930720fd4625e062c781153631347c5428bec26c491a0f7c5757c6d97a7f52a7833b08ac31a23d404fc4cd416e4b8280c5b6fb6e8dc5b8a6f4f6d91469552a50fb4d3bccf7b3dab57cd1041c76ea91ed8c6a3658521ceb44dd6d8b0ba6b63f8ec2ffd5db749e1fe0777ee8a09001b15cdba231b574a368f5c1bc1aac0fbe87cf6af60d844cbda0197b1a1430cb3bd145eb67fda06c53ce4662000239a2ca3f2d59adc9fefefd8f154d83b8ea2544ce45bab39193872a8998fdd5f00d7aa1dabab4d5a296e73f70b6e9560ce1c385251c1693c9c8c573038ac2564ff71bf19580c5080b863576aff8fd725b1fc0fdd16f1fe4f4b8b39291a7899bb8da263ebb16b5c15d1009c32ac6e1649094dfb8287520835e5d53587d5fdc14ce07e44e36eeb2c426f55f08eb6a11af8ec13cb335f45c93f4da5f7ffb802a6952f3e0d5195b9716c91219e6a55519f9aaa0abd2d1209a7cf53c1eff8a9a1d559ce8b14e0e8934d7f71ad373481485e80197fb3f2d784531d182ff02da15fb10561e3e885c953c067d8191eb66be90f8013587159e2c9ee6f6acf9a169cc313c463f7fa3e7afaeea93b93e05f49c041f279cb09afba68fd42b1e613225b09b4d9566'
     ),
@@ -260,178 +42,8 @@ var keyData = {
   'ML-DSA-87': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
-    pkcs8: new Uint8Array([
-      48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 19, 4, 34,
-      128, 32, 161, 80, 109, 145, 76, 109, 101, 140, 117, 39, 228, 51, 151, 221,
-      109, 76, 37, 246, 164, 121, 116, 51, 90, 76, 208, 59, 254, 105, 131, 68,
-      18, 81,
-    ]),
-    spki: new Uint8Array([
-      48, 130, 10, 50, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 19, 3, 130,
-      10, 33, 0, 146, 184, 67, 40, 172, 27, 204, 27, 135, 22, 109, 223, 127, 23,
-      97, 130, 198, 228, 199, 62, 178, 21, 173, 20, 88, 180, 205, 168, 17, 164,
-      135, 92, 85, 146, 76, 194, 152, 80, 239, 157, 33, 21, 239, 182, 176, 254,
-      124, 80, 135, 138, 87, 169, 103, 99, 87, 5, 91, 161, 239, 59, 18, 246,
-      148, 20, 32, 60, 117, 245, 182, 156, 196, 230, 82, 117, 228, 211, 81, 45,
-      115, 217, 23, 95, 138, 95, 103, 124, 32, 89, 187, 48, 251, 103, 81, 234,
-      76, 4, 57, 197, 71, 48, 125, 169, 195, 147, 183, 142, 166, 8, 147, 7, 77,
-      240, 111, 44, 168, 23, 89, 107, 95, 220, 75, 202, 44, 25, 244, 200, 160,
-      0, 174, 111, 107, 204, 22, 36, 122, 191, 101, 33, 52, 252, 14, 47, 25,
-      109, 135, 48, 131, 253, 195, 237, 60, 86, 14, 119, 85, 28, 182, 139, 136,
-      191, 59, 187, 90, 126, 207, 168, 238, 184, 83, 77, 254, 208, 21, 57, 104,
-      188, 228, 134, 82, 249, 190, 249, 163, 120, 111, 68, 225, 210, 131, 29,
-      151, 153, 146, 71, 163, 104, 225, 194, 33, 64, 213, 92, 145, 253, 42, 32,
-      233, 95, 224, 72, 184, 119, 192, 113, 253, 177, 153, 246, 240, 49, 103,
-      170, 229, 82, 69, 186, 36, 252, 29, 124, 255, 25, 148, 5, 160, 159, 105,
-      157, 185, 25, 158, 122, 145, 30, 245, 51, 205, 62, 56, 154, 23, 52, 0,
-      225, 177, 105, 195, 131, 177, 151, 197, 114, 110, 128, 227, 127, 176, 28,
-      252, 217, 56, 61, 136, 148, 190, 124, 108, 129, 62, 243, 235, 37, 70, 228,
-      233, 10, 67, 124, 120, 58, 164, 83, 57, 80, 39, 204, 98, 28, 199, 136, 75,
-      12, 51, 255, 24, 130, 127, 19, 239, 160, 94, 137, 75, 15, 82, 158, 252,
-      163, 43, 236, 193, 234, 27, 74, 69, 14, 179, 171, 10, 169, 27, 138, 172,
-      213, 189, 222, 167, 110, 24, 11, 118, 151, 223, 94, 154, 125, 9, 21, 137,
-      70, 128, 51, 102, 52, 105, 104, 157, 54, 186, 75, 217, 226, 169, 71, 125,
-      177, 253, 218, 85, 236, 242, 25, 215, 147, 181, 104, 242, 82, 75, 50, 165,
-      49, 102, 128, 82, 237, 170, 134, 162, 196, 56, 247, 199, 138, 102, 118,
-      37, 66, 114, 165, 177, 156, 251, 39, 199, 12, 167, 246, 169, 150, 108, 91,
-      192, 42, 68, 192, 244, 255, 107, 18, 191, 7, 73, 19, 174, 28, 116, 66,
-      131, 96, 173, 60, 131, 190, 249, 219, 246, 71, 182, 124, 183, 129, 101,
-      109, 95, 180, 78, 17, 140, 182, 62, 80, 195, 184, 253, 176, 169, 153, 1,
-      29, 83, 39, 252, 150, 41, 219, 176, 48, 151, 108, 60, 255, 239, 0, 85,
-      101, 193, 110, 204, 12, 254, 22, 136, 15, 154, 217, 88, 13, 28, 252, 232,
-      48, 32, 33, 41, 221, 103, 227, 228, 177, 54, 175, 195, 106, 174, 140, 54,
-      128, 108, 214, 228, 215, 118, 226, 206, 171, 21, 155, 162, 152, 135, 203,
-      16, 170, 130, 100, 173, 155, 243, 80, 40, 98, 157, 248, 7, 101, 88, 199,
-      218, 224, 141, 82, 238, 121, 92, 82, 97, 49, 31, 155, 61, 63, 84, 227, 90,
-      143, 164, 59, 216, 101, 19, 35, 134, 2, 20, 18, 197, 97, 215, 169, 85,
-      220, 75, 254, 91, 125, 144, 43, 65, 128, 29, 66, 77, 184, 172, 89, 123,
-      203, 231, 254, 59, 18, 249, 204, 249, 220, 153, 84, 166, 63, 23, 108, 120,
-      145, 216, 67, 223, 123, 248, 15, 253, 63, 191, 126, 84, 95, 98, 141, 66,
-      200, 129, 194, 174, 30, 80, 48, 75, 113, 14, 102, 101, 218, 249, 14, 203,
-      24, 6, 11, 89, 99, 56, 49, 17, 148, 160, 242, 101, 191, 102, 227, 115, 33,
-      107, 71, 235, 6, 141, 68, 161, 162, 165, 227, 159, 82, 253, 54, 157, 214,
-      255, 141, 151, 154, 134, 150, 93, 141, 97, 158, 244, 180, 135, 42, 10, 3,
-      148, 9, 152, 149, 20, 18, 237, 253, 180, 136, 165, 13, 80, 195, 220, 43,
-      3, 178, 10, 127, 144, 2, 207, 209, 246, 40, 110, 38, 133, 9, 22, 180, 11,
-      223, 116, 236, 205, 186, 25, 183, 155, 165, 77, 206, 101, 255, 106, 223,
-      70, 10, 22, 176, 119, 142, 163, 197, 178, 251, 216, 112, 237, 63, 201, 77,
-      219, 196, 2, 176, 48, 15, 207, 91, 74, 236, 21, 8, 205, 126, 77, 28, 13,
-      26, 28, 202, 250, 100, 79, 134, 209, 193, 78, 202, 58, 248, 124, 215, 64,
-      143, 244, 17, 23, 163, 162, 241, 249, 49, 210, 168, 203, 213, 135, 77, 14,
-      29, 35, 193, 234, 58, 12, 106, 165, 163, 251, 192, 115, 251, 7, 198, 189,
-      93, 207, 178, 246, 50, 189, 185, 51, 45, 84, 140, 194, 34, 46, 92, 90,
-      136, 81, 81, 53, 52, 253, 128, 247, 131, 243, 21, 207, 245, 141, 49, 178,
-      213, 214, 211, 8, 17, 234, 133, 225, 104, 197, 186, 224, 117, 1, 173, 104,
-      17, 177, 161, 223, 71, 195, 159, 194, 45, 177, 116, 26, 187, 193, 161,
-      213, 179, 158, 8, 122, 186, 122, 191, 158, 5, 12, 178, 235, 78, 132, 78,
-      189, 16, 86, 110, 73, 51, 129, 255, 242, 110, 63, 6, 53, 209, 110, 132,
-      236, 43, 239, 192, 221, 138, 1, 128, 176, 0, 113, 85, 119, 201, 36, 188,
-      202, 9, 223, 98, 196, 42, 130, 158, 149, 200, 150, 202, 132, 118, 153, 97,
-      54, 195, 154, 15, 45, 246, 129, 144, 255, 231, 75, 25, 56, 47, 178, 98,
-      10, 106, 84, 56, 113, 161, 227, 37, 246, 1, 245, 129, 173, 70, 186, 11,
-      28, 125, 198, 243, 225, 113, 130, 5, 138, 52, 251, 194, 152, 105, 48, 214,
-      13, 246, 228, 75, 236, 194, 223, 177, 64, 150, 97, 167, 20, 27, 74, 76,
-      166, 199, 239, 91, 240, 8, 22, 54, 41, 63, 35, 112, 255, 251, 88, 252,
-      147, 173, 185, 43, 98, 83, 155, 230, 176, 55, 161, 8, 83, 15, 110, 151,
-      241, 110, 168, 203, 190, 198, 218, 152, 144, 150, 58, 123, 11, 123, 250,
-      104, 113, 198, 93, 1, 152, 51, 172, 140, 246, 115, 113, 229, 218, 166,
-      200, 35, 123, 16, 133, 169, 191, 59, 103, 12, 114, 15, 60, 37, 4, 92, 208,
-      54, 31, 79, 56, 225, 6, 11, 74, 107, 79, 225, 239, 16, 73, 249, 234, 197,
-      129, 230, 97, 39, 115, 49, 96, 141, 41, 242, 225, 177, 214, 18, 103, 34,
-      229, 37, 176, 241, 99, 82, 227, 195, 77, 32, 64, 4, 120, 49, 199, 209,
-      139, 2, 4, 222, 233, 45, 151, 141, 142, 252, 41, 124, 231, 13, 144, 63,
-      212, 252, 145, 34, 142, 232, 152, 84, 135, 87, 175, 46, 53, 139, 60, 168,
-      135, 167, 101, 253, 127, 152, 138, 154, 31, 231, 198, 77, 89, 182, 9, 54,
-      103, 119, 100, 218, 245, 44, 191, 74, 30, 152, 84, 22, 62, 159, 131, 163,
-      223, 3, 51, 194, 241, 49, 9, 213, 43, 214, 201, 75, 158, 198, 22, 203,
-      209, 190, 199, 189, 75, 4, 6, 72, 60, 241, 113, 171, 30, 42, 143, 73, 51,
-      72, 206, 110, 175, 203, 195, 199, 15, 155, 208, 166, 121, 26, 132, 59, 44,
-      72, 155, 7, 48, 122, 132, 224, 142, 3, 7, 21, 207, 11, 30, 112, 18, 149,
-      146, 127, 41, 104, 197, 169, 86, 213, 108, 253, 111, 160, 5, 11, 202, 172,
-      233, 32, 5, 52, 92, 124, 152, 162, 11, 88, 28, 166, 248, 141, 251, 38,
-      161, 53, 49, 136, 246, 183, 85, 9, 165, 115, 108, 18, 208, 218, 129, 165,
-      163, 131, 34, 32, 94, 226, 121, 93, 24, 87, 226, 105, 25, 242, 128, 198,
-      78, 26, 237, 21, 92, 33, 121, 8, 119, 131, 140, 193, 14, 60, 139, 130, 19,
-      65, 96, 50, 5, 249, 12, 27, 51, 23, 195, 89, 255, 47, 23, 109, 62, 202,
-      190, 5, 131, 92, 91, 39, 27, 209, 132, 146, 95, 98, 66, 26, 230, 186, 236,
-      186, 162, 149, 81, 143, 221, 21, 79, 171, 236, 21, 161, 19, 135, 10, 213,
-      168, 200, 135, 19, 221, 177, 207, 106, 214, 194, 124, 220, 53, 45, 176,
-      245, 178, 189, 49, 242, 22, 230, 154, 241, 146, 230, 187, 180, 244, 158,
-      145, 197, 225, 51, 150, 140, 26, 175, 78, 142, 243, 232, 221, 137, 205,
-      130, 178, 54, 216, 136, 118, 212, 33, 90, 206, 18, 224, 158, 44, 23, 144,
-      204, 24, 184, 48, 81, 233, 124, 20, 222, 77, 119, 144, 22, 145, 241, 19,
-      206, 135, 252, 164, 114, 84, 37, 175, 107, 67, 243, 183, 137, 213, 53,
-      236, 41, 73, 50, 34, 146, 218, 204, 68, 235, 158, 150, 139, 133, 75, 248,
-      157, 7, 0, 53, 68, 44, 156, 110, 56, 197, 209, 201, 0, 155, 225, 85, 35,
-      169, 193, 231, 36, 31, 142, 101, 168, 29, 192, 31, 128, 81, 191, 253, 184,
-      153, 226, 214, 1, 27, 6, 0, 192, 36, 101, 72, 105, 150, 226, 3, 21, 12,
-      127, 72, 250, 223, 240, 136, 249, 157, 129, 247, 91, 178, 157, 208, 86,
-      146, 23, 176, 150, 35, 211, 155, 22, 207, 119, 168, 167, 122, 180, 183,
-      106, 97, 138, 87, 96, 34, 141, 110, 145, 231, 226, 35, 115, 232, 129, 54,
-      186, 128, 190, 238, 37, 169, 194, 37, 24, 237, 211, 164, 111, 54, 88, 245,
-      125, 67, 78, 194, 11, 194, 235, 217, 87, 203, 14, 220, 189, 107, 68, 94,
-      139, 66, 230, 5, 54, 64, 28, 246, 143, 75, 127, 239, 243, 20, 251, 189,
-      246, 246, 151, 90, 219, 227, 242, 223, 205, 40, 124, 245, 4, 189, 72, 39,
-      145, 110, 96, 120, 164, 27, 117, 146, 177, 30, 76, 173, 106, 130, 228,
-      192, 189, 59, 167, 30, 127, 178, 164, 5, 133, 80, 199, 207, 216, 189, 156,
-      93, 222, 150, 129, 81, 193, 180, 38, 59, 8, 214, 210, 95, 150, 182, 175,
-      148, 43, 153, 169, 66, 62, 135, 140, 159, 89, 195, 253, 3, 132, 180, 164,
-      244, 243, 232, 71, 196, 200, 158, 194, 114, 115, 193, 88, 161, 185, 235,
-      247, 14, 126, 225, 176, 111, 17, 79, 77, 245, 80, 229, 174, 6, 180, 156,
-      217, 85, 174, 201, 255, 237, 85, 83, 53, 188, 153, 98, 91, 193, 21, 211,
-      49, 145, 196, 252, 52, 66, 226, 131, 203, 214, 130, 237, 194, 208, 174,
-      102, 133, 220, 235, 222, 79, 232, 36, 21, 161, 248, 51, 185, 164, 156, 95,
-      121, 65, 57, 233, 183, 29, 199, 105, 104, 12, 90, 195, 186, 81, 199, 176,
-      1, 87, 16, 226, 192, 206, 185, 197, 46, 34, 75, 174, 153, 238, 15, 50, 87,
-      226, 96, 26, 197, 202, 73, 235, 19, 140, 9, 79, 12, 52, 83, 76, 85, 146,
-      234, 24, 151, 179, 178, 118, 58, 162, 223, 103, 69, 244, 231, 135, 167,
-      204, 117, 166, 60, 237, 82, 63, 11, 4, 207, 10, 146, 54, 126, 191, 79,
-      133, 60, 128, 34, 136, 170, 23, 84, 81, 38, 94, 9, 130, 245, 100, 115,
-      209, 34, 228, 158, 101, 216, 135, 208, 207, 191, 169, 115, 252, 144, 139,
-      226, 252, 6, 44, 221, 134, 170, 87, 11, 46, 124, 58, 219, 179, 238, 6, 98,
-      216, 18, 174, 42, 12, 97, 126, 85, 245, 81, 220, 232, 135, 114, 21, 125,
-      135, 225, 182, 245, 228, 223, 242, 62, 158, 35, 76, 6, 110, 25, 184, 206,
-      124, 237, 54, 252, 199, 44, 78, 89, 0, 135, 44, 176, 57, 168, 36, 221,
-      173, 77, 214, 209, 60, 1, 202, 238, 237, 61, 90, 47, 114, 230, 92, 238,
-      235, 18, 151, 220, 243, 225, 163, 159, 139, 189, 253, 62, 225, 182, 202,
-      59, 7, 83, 99, 129, 118, 175, 37, 246, 85, 119, 251, 246, 69, 180, 247,
-      37, 24, 194, 89, 158, 97, 230, 247, 254, 145, 102, 89, 77, 68, 245, 3,
-      103, 83, 28, 45, 168, 30, 189, 151, 112, 120, 215, 84, 90, 198, 85, 85,
-      129, 55, 127, 124, 28, 137, 229, 139, 54, 88, 229, 105, 81, 212, 83, 28,
-      107, 250, 82, 164, 43, 24, 15, 57, 206, 156, 19, 145, 95, 57, 169, 8, 128,
-      211, 29, 213, 195, 148, 27, 73, 186, 221, 242, 11, 167, 78, 246, 133, 18,
-      118, 67, 236, 59, 19, 112, 254, 93, 168, 157, 118, 0, 107, 248, 57, 149,
-      67, 222, 123, 225, 207, 251, 69, 218, 56, 110, 162, 19, 25, 209, 209, 213,
-      200, 158, 70, 9, 100, 208, 77, 48, 255, 151, 200, 0, 68, 230, 70, 120,
-      209, 29, 86, 225, 188, 189, 226, 101, 42, 176, 32, 147, 121, 72, 151, 130,
-      217, 13, 66, 148, 84, 129, 215, 249, 164, 174, 187, 80, 85, 185, 245, 108,
-      169, 119, 59, 178, 144, 229, 63, 194, 132, 250, 131, 82, 161, 125, 126,
-      255, 252, 220, 204, 104, 231, 201, 136, 246, 116, 43, 88, 233, 0, 43, 128,
-      214, 40, 59, 81, 147, 139, 132, 69, 24, 233, 21, 14, 91, 230, 241, 19,
-      138, 163, 55, 13, 221, 47, 64, 140, 248, 6, 38, 164, 16, 219, 63, 33, 180,
-      71, 151, 0, 234, 103, 58, 213, 222, 163, 95, 132, 1, 178, 146, 66, 124,
-      242, 223, 102, 129, 192, 214, 194, 117, 162, 252, 246, 143, 42, 70, 139,
-      97, 168, 64, 141, 190, 115, 126, 93, 175, 59, 49, 9, 184, 88, 201, 100,
-      182, 142, 145, 244, 72, 128, 203, 49, 196, 5, 5, 18, 46, 34, 87, 171, 132,
-      158, 128, 75, 194, 8, 242, 52, 156, 229, 245, 56, 245, 88, 14, 195, 110,
-      166, 51, 158, 245, 195, 120, 17, 166, 66, 100, 212, 188, 243, 2, 236, 90,
-      8, 16, 35, 151, 122, 175, 115, 168, 186, 191, 60, 71, 23, 81, 217, 79,
-      203, 239, 61, 146, 247, 168, 112, 83, 102, 146, 222, 178, 45, 247, 63, 23,
-      181, 3, 136, 208, 62, 154, 203, 35, 250, 238, 61, 98, 207, 90, 169, 175,
-      36, 227, 9, 182, 78, 226, 99, 89, 67, 105, 185, 35, 242, 162, 54, 99, 60,
-      148, 14, 118, 1, 26, 120, 62, 82, 62, 222, 34, 99, 58, 174, 145, 199, 190,
-      21, 182, 117, 238, 13, 170, 29, 67, 149, 44, 90, 94, 181, 125, 182, 186,
-      82, 55, 105, 253, 29, 212, 67, 134, 204, 227, 94, 255, 127, 72, 157, 140,
-      142, 224, 77, 149, 29, 170, 45, 163, 214, 209, 46, 28, 125, 177, 111, 2,
-      92, 121, 252, 166, 204, 227, 173, 51, 60, 162, 243, 202, 207, 103, 30,
-      153, 182, 116, 182, 130, 98, 59, 25, 141, 239, 49, 224, 176, 27, 237, 218,
-      76, 68, 189, 108, 185, 136, 255, 105, 150, 11, 153, 44, 248, 139, 199,
-      178, 235, 85, 115, 121, 144, 87, 221, 50, 222, 238, 16, 20, 51, 190, 93,
-      248, 228, 84, 228, 115, 31, 229, 227, 137, 180, 44, 115, 224, 119, 129,
-      181, 134, 224, 144, 186, 123, 208, 118, 96, 101, 177, 191, 232, 171, 6,
-      17, 247, 187, 173, 84, 70, 249, 19, 191, 116, 172, 126, 131, 216, 123,
-      225, 151, 55, 205, 177, 93, 139, 117,
-    ]),
+    pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-87'],
+    spki: mldsaKeyFixtures.spki['ML-DSA-87'],
     'raw-public': hexStringToUint8Array(
       '92b84328ac1bcc1b87166ddf7f176182c6e4c73eb215ad1458b4cda811a4875c55924cc29850ef9d2115efb6b0fe7c50878a57a9676357055ba1ef3b12f69414203c75f5b69cc4e65275e4d3512d73d9175f8a5f677c2059bb30fb6751ea4c0439c547307da9c393b78ea60893074df06f2ca817596b5fdc4bca2c19f4c8a000ae6f6bcc16247abf652134fc0e2f196d873083fdc3ed3c560e77551cb68b88bf3bbb5a7ecfa8eeb8534dfed0153968bce48652f9bef9a3786f44e1d2831d97999247a368e1c22140d55c91fd2a20e95fe048b877c071fdb199f6f03167aae55245ba24fc1d7cff199405a09f699db9199e7a911ef533cd3e389a173400e1b169c383b197c5726e80e37fb01cfcd9383d8894be7c6c813ef3eb2546e4e90a437c783aa453395027cc621cc7884b0c33ff18827f13efa05e894b0f529efca32becc1ea1b4a450eb3ab0aa91b8aacd5bddea76e180b7697df5e9a7d091589468033663469689d36ba4bd9e2a9477db1fdda55ecf219d793b568f2524b32a531668052edaa86a2c438f7c78a6676254272a5b19cfb27c70ca7f6a9966c5bc02a44c0f4ff6b12bf074913ae1c74428360ad3c83bef9dbf647b67cb781656d5fb44e118cb63e50c3b8fdb0a999011d5327fc9629dbb030976c3cffef005565c16ecc0cfe16880f9ad9580d1cfce830202129dd67e3e4b136afc36aae8c36806cd6e4d776e2ceab159ba29887cb10aa8264ad9bf35028629df8076558c7dae08d52ee795c5261311f9b3d3f54e35a8fa43bd865132386021412c561d7a955dc4bfe5b7d902b41801d424db8ac597bcbe7fe3b12f9ccf9dc9954a63f176c7891d843df7bf80ffd3fbf7e545f628d42c881c2ae1e50304b710e6665daf90ecb18060b596338311194a0f265bf66e373216b47eb068d44a1a2a5e39f52fd369dd6ff8d979a86965d8d619ef4b4872a0a03940998951412edfdb488a50d50c3dc2b03b20a7f9002cfd1f6286e26850916b40bdf74eccdba19b79ba54dce65ff6adf460a16b0778ea3c5b2fbd870ed3fc94ddbc402b0300fcf5b4aec1508cd7e4d1c0d1a1ccafa644f86d1c14eca3af87cd7408ff41117a3a2f1f931d2a8cbd5874d0e1d23c1ea3a0c6aa5a3fbc073fb07c6bd5dcfb2f632bdb9332d548cc2222e5c5a8851513534fd80f783f315cff58d31b2d5d6d30811ea85e168c5bae07501ad6811b1a1df47c39fc22db1741abbc1a1d5b39e087aba7abf9e050cb2eb4e844ebd10566e493381fff26e3f0635d16e84ec2befc0dd8a0180b000715577c924bcca09df62c42a829e95c896ca8476996136c39a0f2df68190ffe74b19382fb2620a6a543871a1e325f601f581ad46ba0b1c7dc6f3e17182058a34fbc2986930d60df6e44becc2dfb1409661a7141b4a4ca6c7ef5bf0081636293f2370fffb58fc93adb92b62539be6b037a108530f6e97f16ea8cbbec6da9890963a7b0b7bfa6871c65d019833ac8cf67371e5daa6c8237b1085a9bf3b670c720f3c25045cd0361f4f38e1060b4a6b4fe1ef1049f9eac581e661277331608d29f2e1b1d6126722e525b0f16352e3c34d2040047831c7d18b0204dee92d978d8efc297ce70d903fd4fc91228ee898548757af2e358b3ca887a765fd7f988a9a1fe7c64d59b60936677764daf52cbf4a1e9854163e9f83a3df0333c2f13109d52bd6c94b9ec616cbd1bec7bd4b0406483cf171ab1e2a8f493348ce6eafcbc3c70f9bd0a6791a843b2c489b07307a84e08e030715cf0b1e701295927f2968c5a956d56cfd6fa0050bcaace92005345c7c98a20b581ca6f88dfb26a1353188f6b75509a5736c12d0da81a5a38322205ee2795d1857e26919f280c64e1aed155c21790877838cc10e3c8b821341603205f90c1b3317c359ff2f176d3ecabe05835c5b271bd184925f62421ae6baecbaa295518fdd154fabec15a113870ad5a8c88713ddb1cf6ad6c27cdc352db0f5b2bd31f216e69af192e6bbb4f49e91c5e133968c1aaf4e8ef3e8dd89cd82b236d88876d4215ace12e09e2c1790cc18b83051e97c14de4d77901691f113ce87fca4725425af6b43f3b789d535ec2949322292dacc44eb9e968b854bf89d070035442c9c6e38c5d1c9009be15523a9c1e7241f8e65a81dc01f8051bffdb899e2d6011b0600c02465486996e203150c7f48fadff088f99d81f75bb29dd0569217b09623d39b16cf77a8a77ab4b76a618a5760228d6e91e7e22373e88136ba80beee25a9c22518edd3a46f3658f57d434ec20bc2ebd957cb0edcbd6b445e8b42e60536401cf68f4b7feff314fbbdf6f6975adbe3f2dfcd287cf504bd4827916e6078a41b7592b11e4cad6a82e4c0bd3ba71e7fb2a4058550c7cfd8bd9c5dde968151c1b4263b08d6d25f96b6af942b99a9423e878c9f59c3fd0384b4a4f4f3e847c4c89ec27273c158a1b9ebf70e7ee1b06f114f4df550e5ae06b49cd955aec9ffed555335bc99625bc115d33191c4fc3442e283cbd682edc2d0ae6685dcebde4fe82415a1f833b9a49c5f794139e9b71dc769680c5ac3ba51c7b0015710e2c0ceb9c52e224bae99ee0f3257e2601ac5ca49eb138c094f0c34534c5592ea1897b3b2763aa2df6745f4e787a7cc75a63ced523f0b04cf0a92367ebf4f853c802288aa175451265e0982f56473d122e49e65d887d0cfbfa973fc908be2fc062cdd86aa570b2e7c3adbb3ee0662d812ae2a0c617e55f551dce88772157d87e1b6f5e4dff23e9e234c066e19b8ce7ced36fcc72c4e5900872cb039a824ddad4dd6d13c01caeeed3d5a2f72e65ceeeb1297dcf3e1a39f8bbdfd3ee1b6ca3b0753638176af25f65577fbf645b4f72518c2599e61e6f7fe9166594d44f50367531c2da81ebd977078d7545ac6555581377f7c1c89e58b3658e56951d4531c6bfa52a42b180f39ce9c13915f39a90880d31dd5c3941b49baddf20ba74ef685127643ec3b1370fe5da89d76006bf8399543de7be1cffb45da386ea21319d1d1d5c89e460964d04d30ff97c80044e64678d11d56e1bcbde2652ab0209379489782d90d42945481d7f9a4aebb5055b9f56ca9773bb290e53fc284fa8352a17d7efffcdccc68e7c988f6742b58e9002b80d6283b51938b844518e9150e5be6f1138aa3370ddd2f408cf80626a410db3f21b4479700ea673ad5dea35f8401b292427cf2df6681c0d6c275a2fcf68f2a468b61a8408dbe737e5daf3b3109b858c964b68e91f44880cb31c40505122e2257ab849e804bc208f2349ce5f538f5580ec36ea6339ef5c37811a64264d4bcf302ec5a081023977aaf73a8babf3c471751d94fcbef3d92f7a870536692deb22df73f17b50388d03e9acb23faee3d62cf5aa9af24e309b64ee263594369b923f2a236633c940e76011a783e523ede22633aae91c7be15b675ee0daa1d43952c5a5eb57db6ba523769fd1dd44386cce35eff7f489d8c8ee04d951daa2da3d6d12e1c7db16f025c79fca6cce3ad333ca2f3cacf671e99b674b682623b198def31e0b01bedda4c44bd6cb988ff69960b992cf88bc7b2eb5573799057dd32deee101433be5df8e454e4731fe5e389b42c73e07781b586e090ba7bd0766065b1bfe8ab0611f7bbad5446f913bf74ac7e83d87be19737cdb15d8b75'
     ),
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.js
deleted file mode 100644
index d9257ac69825..000000000000
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.js
+++ /dev/null
@@ -1,130 +0,0 @@
-var subtle = crypto.subtle;
-
-function runTests(algorithmName) {
-  var algorithm = { name: algorithmName };
-  var data = keyData[algorithmName];
-  var jwkData = {
-    jwk: { kty: data.jwk.kty, alg: data.jwk.alg, pub: data.jwk.pub },
-  };
-
-  [true, false].forEach(function (extractable) {
-    // Test public keys first
-    allValidUsages(data.publicUsages, true).forEach(function (usages) {
-      ['spki', 'jwk', 'raw-public'].forEach(function (format) {
-        if (format === 'jwk') {
-          // Not all fields used for public keys
-          testFormat(
-            format,
-            algorithm,
-            jwkData,
-            algorithmName,
-            usages,
-            extractable
-          );
-        } else {
-          testFormat(
-            format,
-            algorithm,
-            data,
-            algorithmName,
-            usages,
-            extractable
-          );
-        }
-      });
-    });
-
-    // Next, test private keys
-    allValidUsages(data.privateUsages).forEach(function (usages) {
-      ['pkcs8', 'jwk', 'raw-seed'].forEach(function (format) {
-        testFormat(format, algorithm, data, algorithmName, usages, extractable);
-      });
-    });
-  });
-}
-
-// Test importKey with a given key format and other parameters. If
-// extrable is true, export the key and verify that it matches the input.
-function testFormat(format, algorithm, keyData, keySize, usages, extractable) {
-  [algorithm, algorithm.name].forEach((alg) => {
-    promise_test(function (test) {
-      return subtle
-        .importKey(format, keyData[format], alg, extractable, usages)
-        .then(
-          function (key) {
-            assert_equals(
-              key.constructor,
-              CryptoKey,
-              'Imported a CryptoKey object'
-            );
-            assert_goodCryptoKey(
-              key,
-              algorithm,
-              extractable,
-              usages,
-              format === 'pkcs8' ||
-                format === 'raw-seed' ||
-                (format === 'jwk' && keyData[format].priv)
-                ? 'private'
-                : 'public'
-            );
-            if (!extractable) {
-              return;
-            }
-
-            return subtle.exportKey(format, key).then(
-              function (result) {
-                if (format !== 'jwk') {
-                  assert_true(
-                    equalBuffers(keyData[format], result),
-                    'Round trip works'
-                  );
-                } else {
-                  assert_true(
-                    equalJwk(keyData[format], result),
-                    'Round trip works'
-                  );
-                }
-              },
-              function (err) {
-                assert_unreached(
-                  'Threw an unexpected error: ' + err.toString()
-                );
-              }
-            );
-          },
-          function (err) {
-            assert_unreached('Threw an unexpected error: ' + err.toString());
-          }
-        );
-    }, 'Good parameters: ' +
-      keySize.toString() +
-      ' bits ' +
-      parameterString(format, keyData[format], alg, extractable, usages));
-  });
-}
-
-// Helper methods follow:
-
-// Convert method parameters to a string to uniquely name each test
-function parameterString(format, data, algorithm, extractable, usages) {
-  if ('byteLength' in data) {
-    data = 'buffer(' + data.byteLength.toString() + ')';
-  } else {
-    data = 'object(' + Object.keys(data).join(', ') + ')';
-  }
-  var result =
-    '(' +
-    objectToString(format) +
-    ', ' +
-    objectToString(data) +
-    ', ' +
-    objectToString(algorithm) +
-    ', ' +
-    objectToString(extractable) +
-    ', ' +
-    objectToString(usages) +
-    ')';
-
-  return result;
-}
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.tentative.https.any.js
index 8b459c17e2d3..11d80c76bc55 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey.tentative.https.any.js
@@ -2,7 +2,7 @@
 // META: timeout=long
 // META: script=../util/helpers.js
 // META: script=ML-KEM_importKey_fixtures.js
-// META: script=ML-KEM_importKey.js
+// META: script=ml_importKey.js
 
 runTests("ML-KEM-512");
 runTests("ML-KEM-768");
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey.https.any.js
index 3b78bab4e741..473fab2887e7 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for EC keys
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/ec_key_fixtures.js
 
 // Test importKey and exportKey for EC algorithms. Only "happy paths" are
 // currently tested - those where the operation should succeed.
@@ -9,56 +10,7 @@
 
     var curves = ['P-256', 'P-384', 'P-521'];
 
-    var keyData = {
-        "P-521": {
-            spki: new Uint8Array([48, 129, 155, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
-            spki_compressed: new Uint8Array([48, 88, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 68, 0, 3, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63]),
-            raw: new Uint8Array([4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
-            raw_compressed: new Uint8Array([3, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63]),
-            pkcs8: new Uint8Array([48, 129, 238, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 129, 214, 48, 129, 211, 2, 1, 1, 4, 66, 0, 244, 8, 117, 131, 104, 186, 147, 15, 48, 247, 106, 224, 84, 254, 92, 210, 206, 127, 218, 44, 159, 118, 166, 212, 54, 207, 117, 214, 108, 68, 11, 254, 99, 49, 199, 193, 114, 161, 36, 120, 25, 60, 130, 81, 72, 123, 201, 18, 99, 250, 80, 33, 127, 133, 255, 99, 111, 89, 205, 84, 110, 58, 180, 131, 180, 161, 129, 137, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
-            pkcs8_private_only: new Uint8Array([48, 96, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 73, 48, 71, 2, 1, 1, 4, 66, 0, 244, 8, 117, 131, 104, 186, 147, 15, 48, 247, 106, 224, 84, 254, 92, 210, 206, 127, 218, 44, 159, 118, 166, 212, 54, 207, 117, 214, 108, 68, 11, 254, 99, 49, 199, 193, 114, 161, 36, 120, 25, 60, 130, 81, 72, 123, 201, 18, 99, 250, 80, 33, 127, 133, 255, 99, 111, 89, 205, 84, 110, 58, 180, 131, 180]),
-            jwk: {
-                kty: "EC",
-                crv: "P-521",
-                x: "AVb0efjfHiCn_8BM5CDD4VSuJRmWvuQvA0uE1Bt0PzTkXzEbgTqc3sjNpZu7vTHUYLMpJSHnwbci5WZ8A9svrnU_",
-                y: "AVAXNs_iRzlDINjkr8L9ObWpMxBhuB4iQSgrnheJGCK1t54FL0WXtZZD_Tk3nFG9USXE9IvD8CXOPNNpUyhsyzj7",
-                d: "APQIdYNoupMPMPdq4FT-XNLOf9osn3am1DbPddZsRAv-YzHHwXKhJHgZPIJRSHvJEmP6UCF_hf9jb1nNVG46tIO0"
-            }
-        },
-
-        "P-256": {
-            spki: new Uint8Array([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
-            spki_compressed: new Uint8Array([48, 57, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 34, 0, 2, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209]),
-            raw: new Uint8Array([4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
-            raw_compressed: new Uint8Array([2, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209]),
-            pkcs8: new Uint8Array([48, 129, 135, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 109, 48, 107, 2, 1, 1, 4, 32, 19, 211, 58, 45, 90, 191, 156, 249, 235, 178, 31, 248, 96, 212, 174, 254, 110, 86, 231, 119, 144, 244, 222, 233, 180, 8, 132, 235, 211, 53, 68, 234, 161, 68, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
-            pkcs8_private_only: new Uint8Array([48, 65, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 39, 48, 37, 2, 1, 1, 4, 32, 19, 211, 58, 45, 90, 191, 156, 249, 235, 178, 31, 248, 96, 212, 174, 254, 110, 86, 231, 119, 144, 244, 222, 233, 180, 8, 132, 235, 211, 53, 68, 234]),
-            jwk: {
-                kty: "EC",
-                crv: "P-256",
-                x: "0hCwpvnZ8BKGgFi0P6T0cQGFQ7ugDJJQ35JXwqyuXdE",
-                y: "zgN1UtSBRQzjm00QlXAbF1v6s0uObAmeGPHBmDWDYeg",
-                d: "E9M6LVq_nPnrsh_4YNSu_m5W53eQ9N7ptAiE69M1ROo"
-            }
-        },
-
-        "P-384": {
-            spki: new Uint8Array([48, 118, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
-            spki_compressed: new Uint8Array([48, 70, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 50, 0, 2, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53]),
-            raw: new Uint8Array([4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
-            raw_compressed: new Uint8Array([2, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53]),
-            pkcs8: new Uint8Array([48, 129, 182, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 129, 158, 48, 129, 155, 2, 1, 1, 4, 48, 69, 55, 181, 153, 7, 132, 211, 194, 210, 46, 150, 168, 249, 47, 161, 170, 73, 46, 232, 115, 229, 118, 164, 21, 130, 225, 68, 24, 60, 152, 136, 209, 14, 107, 158, 180, 206, 212, 178, 204, 64, 18, 228, 172, 94, 168, 64, 115, 161, 100, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
-            pkcs8_private_only: new Uint8Array([48, 78, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 55, 48, 53, 2, 1, 1, 4, 48, 69, 55, 181, 153, 7, 132, 211, 194, 210, 46, 150, 168, 249, 47, 161, 170, 73, 46, 232, 115, 229, 118, 164, 21, 130, 225, 68, 24, 60, 152, 136, 209, 14, 107, 158, 180, 206, 212, 178, 204, 64, 18, 228, 172, 94, 168, 64, 115]),
-            jwk: {
-                kty: "EC",
-                crv: "P-384",
-                x: "IZwU1mYXs27G2IVrOFtzp000T9iude8EZDXdpU47RL1fvevR0I3Wni19wdwhjLQ1",
-                y: "vSgTjMd4M3qEL2vWGyQOdCSfJGZ8KlgQp2v8KOAzX4imUB3sAZdtqFr7AIactqzo",
-                d: "RTe1mQeE08LSLpao-S-hqkku6HPldqQVguFEGDyYiNEOa560ztSyzEAS5KxeqEBz"
-            }
-        },
-
-    };
+    var keyData = ecKeyData;
 
     // combinations to test
     var testVectors = [
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDH.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDH.https.any.js
index 423d399f19de..260e49791a51 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDH.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDH.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/ec_key_fixtures.js
 // META: script=ec_importKey_failures_fixtures.js
 // META: script=importKey_failures.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDSA.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDSA.https.any.js
index 527940798a42..96116d5462df 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDSA.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_ECDSA.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/ec_key_fixtures.js
 // META: script=ec_importKey_failures_fixtures.js
 // META: script=importKey_failures.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_fixtures.js
index dc0e11d551a9..a37a72cb28d5 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ec_importKey_failures_fixtures.js
@@ -1,17 +1,41 @@
-// Setup: define the correct behaviors that should be sought, and create
-// helper functions that generate all possible test parameters for
-// different situations.
+function ecPrivateJwk(namedCurve) {
+    return Object.assign({}, ecKeyData[namedCurve].jwk);
+}
+
 function getValidKeyData(algorithm) {
-    return validKeyData[algorithm.namedCurve];
+    var key = ecKeyData[algorithm.namedCurve];
+    return [
+        {format: "spki", data: key.spki},
+        {format: "raw", data: key.raw},
+        {format: "pkcs8", data: key.pkcs8},
+        {format: "jwk", data: ecPrivateJwk(algorithm.namedCurve)}
+    ];
 }
 
 function getBadKeyLengthData(algorithm) {
-    return badKeyLengthData[algorithm.namedCurve];
+    var key = ecKeyData[algorithm.namedCurve];
+    var jwk = ecPrivateJwk(algorithm.namedCurve);
+    jwk.x = jwk.x.slice(0, -1);
+    return [
+        {format: "spki", data: key.spki.slice(0, -1)},
+        {format: "raw", data: key.raw.slice(0, -1)},
+        {format: "pkcs8", data: key.pkcs8.slice(0, -1)},
+        {format: "jwk", data: jwk}
+    ];
 }
 
 function getMissingJWKFieldKeyData(algorithm) {
-    // The curve doesn't affect when testing for missing JWK fields.
-    return missingJWKFieldKeyData["P-521"];
+    var missingX = ecPrivateJwk("P-521");
+    var missingKty = ecPrivateJwk("P-521");
+    var missingCrv = ecPrivateJwk("P-521");
+    delete missingX.x;
+    delete missingKty.kty;
+    delete missingCrv.crv;
+    return [
+        {param: "x", data: missingX},
+        {param: "kty", data: missingKty},
+        {param: "crv", data: missingCrv}
+    ];
 }
 
 function getMismatchedJWKKeyData(algorithm) {
@@ -20,206 +44,15 @@ function getMismatchedJWKKeyData(algorithm) {
 }
 
 function getMismatchedKtyField(algorithm) {
-    return mismatchedKtyField[algorithm.namedCurve];
+    return "OKP";
 }
 
 function getMismatchedCrvField(algorithm) {
-    return mismatchedCrvField[algorithm.namedCurve];
-}
-
-var validKeyData = {
-    "P-521": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 129, 155, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
-        },
-        {
-            format:"pkcs8",
-            data: new Uint8Array([48, 129, 238, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 129, 214, 48, 129, 211, 2, 1, 1, 4, 66, 0, 244, 8, 117, 131, 104, 186, 147, 15, 48, 247, 106, 224, 84, 254, 92, 210, 206, 127, 218, 44, 159, 118, 166, 212, 54, 207, 117, 214, 108, 68, 11, 254, 99, 49, 199, 193, 114, 161, 36, 120, 25, 60, 130, 81, 72, 123, 201, 18, 99, 250, 80, 33, 127, 133, 255, 99, 111, 89, 205, 84, 110, 58, 180, 131, 180, 161, 129, 137, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
-        },
-        {
-            format: "jwk",
-            data: {
-                kty: "EC",
-                crv: "P-521",
-                x: "AVb0efjfHiCn_8BM5CDD4VSuJRmWvuQvA0uE1Bt0PzTkXzEbgTqc3sjNpZu7vTHUYLMpJSHnwbci5WZ8A9svrnU_",
-                y: "AVAXNs_iRzlDINjkr8L9ObWpMxBhuB4iQSgrnheJGCK1t54FL0WXtZZD_Tk3nFG9USXE9IvD8CXOPNNpUyhsyzj7",
-                d: "APQIdYNoupMPMPdq4FT-XNLOf9osn3am1DbPddZsRAv-YzHHwXKhJHgZPIJRSHvJEmP6UCF_hf9jb1nNVG46tIO0"
-            }
-        }
-    ],
-    "P-256": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 129, 135, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 109, 48, 107, 2, 1, 1, 4, 32, 19, 211, 58, 45, 90, 191, 156, 249, 235, 178, 31, 248, 96, 212, 174, 254, 110, 86, 231, 119, 144, 244, 222, 233, 180, 8, 132, 235, 211, 53, 68, 234, 161, 68, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
-        },
-        {
-            format: "jwk",
-            data: {
-                kty: "EC",
-                crv: "P-256",
-                x: "0hCwpvnZ8BKGgFi0P6T0cQGFQ7ugDJJQ35JXwqyuXdE",
-                y: "zgN1UtSBRQzjm00QlXAbF1v6s0uObAmeGPHBmDWDYeg",
-                d: "E9M6LVq_nPnrsh_4YNSu_m5W53eQ9N7ptAiE69M1ROo"
-            }
-        },
-    ],
-    "P-384": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 118, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 129, 182, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 129, 158, 48, 129, 155, 2, 1, 1, 4, 48, 69, 55, 181, 153, 7, 132, 211, 194, 210, 46, 150, 168, 249, 47, 161, 170, 73, 46, 232, 115, 229, 118, 164, 21, 130, 225, 68, 24, 60, 152, 136, 209, 14, 107, 158, 180, 206, 212, 178, 204, 64, 18, 228, 172, 94, 168, 64, 115, 161, 100, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
-        },
-        {
-            format: "jwk",
-            data: {
-                kty: "EC",
-                crv: "P-384",
-                x: "IZwU1mYXs27G2IVrOFtzp000T9iude8EZDXdpU47RL1fvevR0I3Wni19wdwhjLQ1",
-                y: "vSgTjMd4M3qEL2vWGyQOdCSfJGZ8KlgQp2v8KOAzX4imUB3sAZdtqFr7AIactqzo",
-                d: "RTe1mQeE08LSLpao-S-hqkku6HPldqQVguFEGDyYiNEOa560ztSyzEAS5KxeqEBz"
-            }
-        }
-    ]
-};
-
-// Removed just the last byte.
-var badKeyLengthData = {
-    "P-521": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 129, 155, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56]),
-        },
-        {
-            format:"pkcs8",
-            data: new Uint8Array([48, 129, 238, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 129, 214, 48, 129, 211, 2, 1, 1, 4, 66, 0, 244, 8, 117, 131, 104, 186, 147, 15, 48, 247, 106, 224, 84, 254, 92, 210, 206, 127, 218, 44, 159, 118, 166, 212, 54, 207, 117, 214, 108, 68, 11, 254, 99, 49, 199, 193, 114, 161, 36, 120, 25, 60, 130, 81, 72, 123, 201, 18, 99, 250, 80, 33, 127, 133, 255, 99, 111, 89, 205, 84, 110, 58, 180, 131, 180, 161, 129, 137, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56]),
-        },
-        {
-            format: "jwk",
-            data: {
-                kty: "EC",
-                crv: "P-521",
-                x: "AVb0efjfHiCn_8BM5CDD4VSuJRmWvuQvA0uE1Bt0PzTkXzEbgTqc3sjNpZu7vTHUYLMpJSHnwbci5WZ8A9svrnU",
-                y: "AVAXNs_iRzlDINjkr8L9ObWpMxBhuB4iQSgrnheJGCK1t54FL0WXtZZD_Tk3nFG9USXE9IvD8CXOPNNpUyhsyzj7",
-                d: "APQIdYNoupMPMPdq4FT-XNLOf9osn3am1DbPddZsRAv-YzHHwXKhJHgZPIJRSHvJEmP6UCF_hf9jb1nNVG46tIO0"
-            }
-        }
-    ],
-    "P-256": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 129, 135, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 109, 48, 107, 2, 1, 1, 4, 32, 19, 211, 58, 45, 90, 191, 156, 249, 235, 178, 31, 248, 96, 212, 174, 254, 110, 86, 231, 119, 144, 244, 222, 233, 180, 8, 132, 235, 211, 53, 68, 234, 161, 68, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97]),
-        },
-        {
-            format: "jwk",
-            data: {
-                kty: "EC",
-                crv: "P-256",
-                x: "0hCwpvnZ8BKGgFi0P6T0cQGFQ7ugDJJQ35JXwqyuXd",
-                y: "zgN1UtSBRQzjm00QlXAbF1v6s0uObAmeGPHBmDWDYeg",
-                d: "E9M6LVq_nPnrsh_4YNSu_m5W53eQ9N7ptAiE69M1ROo"
-            }
-        },
-    ],
-    "P-384": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 118, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 129, 182, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 129, 158, 48, 129, 155, 2, 1, 1, 4, 48, 69, 55, 181, 153, 7, 132, 211, 194, 210, 46, 150, 168, 249, 47, 161, 170, 73, 46, 232, 115, 229, 118, 164, 21, 130, 225, 68, 24, 60, 152, 136, 209, 14, 107, 158, 180, 206, 212, 178, 204, 64, 18, 228, 172, 94, 168, 64, 115, 161, 100, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172]),
-        },
-        {
-            format: "jwk",
-            data: {
-                kty: "EC",
-                crv: "P-384",
-                x: "IZwU1mYXs27G2IVrOFtzp000T9iude8EZDXdpU47RL1fvevR0I3Wni19wdwhjLQ",
-                y: "vSgTjMd4M3qEL2vWGyQOdCSfJGZ8KlgQp2v8KOAzX4imUB3sAZdtqFr7AIactqzo",
-                d: "RTe1mQeE08LSLpao-S-hqkku6HPldqQVguFEGDyYiNEOa560ztSyzEAS5KxeqEBz"
-            }
-        }
-    ]
-};
-
-var missingJWKFieldKeyData = {
-    "P-521": [
-        {
-            param: "x",
-            data: {
-                kty: "EC",
-                crv: "P-521",
-                y: "AVAXNs_iRzlDINjkr8L9ObWpMxBhuB4iQSgrnheJGCK1t54FL0WXtZZD_Tk3nFG9USXE9IvD8CXOPNNpUyhsyzj7",
-                d: "APQIdYNoupMPMPdq4FT-XNLOf9osn3am1DbPddZsRAv-YzHHwXKhJHgZPIJRSHvJEmP6UCF_hf9jb1nNVG46tIO0"
-            }
-        },
-        {
-            param: "kty",
-            data: {
-                crv: "P-521",
-                x: "AVb0efjfHiCn_8BM5CDD4VSuJRmWvuQvA0uE1Bt0PzTkXzEbgTqc3sjNpZu7vTHUYLMpJSHnwbci5WZ8A9svrnU_",
-                y: "AVAXNs_iRzlDINjkr8L9ObWpMxBhuB4iQSgrnheJGCK1t54FL0WXtZZD_Tk3nFG9USXE9IvD8CXOPNNpUyhsyzj7",
-                d: "APQIdYNoupMPMPdq4FT-XNLOf9osn3am1DbPddZsRAv-YzHHwXKhJHgZPIJRSHvJEmP6UCF_hf9jb1nNVG46tIO0"
-            }
-        },
-        {
-            param: "crv",
-            data: {
-                kty: "EC",
-                x: "AVb0efjfHiCn_8BM5CDD4VSuJRmWvuQvA0uE1Bt0PzTkXzEbgTqc3sjNpZu7vTHUYLMpJSHnwbci5WZ8A9svrnU_",
-                y: "AVAXNs_iRzlDINjkr8L9ObWpMxBhuB4iQSgrnheJGCK1t54FL0WXtZZD_Tk3nFG9USXE9IvD8CXOPNNpUyhsyzj7",
-                d: "APQIdYNoupMPMPdq4FT-XNLOf9osn3am1DbPddZsRAv-YzHHwXKhJHgZPIJRSHvJEmP6UCF_hf9jb1nNVG46tIO0"
-            }
-        }
-    ]
-};
-
-// The 'kty' field doesn't match the key algorithm.
-var mismatchedKtyField =  {
-    "P-521": "OKP",
-    "P-256": "OKP",
-    "P-384": "OKP",
+    return mismatchedEcCurves[algorithm.namedCurve];
 }
 
-// The 'kty' field doesn't match the key algorithm.
-var mismatchedCrvField =  {
+var mismatchedEcCurves = {
     "P-521": "P-256",
     "P-256": "P-384",
-    "P-384": "P-521",
-}
+    "P-384": "P-521"
+};
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/importKey_failures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/importKey_failures.js
index f45da96cf6b0..7581614f0dcb 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/importKey_failures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/importKey_failures.js
@@ -1,8 +1,6 @@
 function run_test(algorithmNames) {
     var subtle = crypto.subtle; // Change to test prefixed implementations
 
-    setup({explicit_timeout: true});
-
 // These tests check that importKey and exportKey throw an error, and that
 // the error is of the right type, for a wide set of incorrect parameters.
 
@@ -79,16 +77,15 @@ function run_test(algorithmNames) {
         }, testTag + ": importKey" + parameterString(format, algorithm, extractable, usages, keyData));
     }
 
-    // Don't create an exhaustive list of all invalid usages,
-    // because there would usually be nearly 2**8 of them,
-    // way too many to test. Instead, create every singleton
+    // Don't create an exhaustive list of all invalid usages because
+    // there would be too many to test. Instead, create every singleton
     // of an illegal usage, and "poison" every valid usage
     // with an illegal one.
     function invalidUsages(validUsages, mandatoryUsages) {
         var results = [];
 
         var illegalUsages = [];
-        ["encrypt", "decrypt", "sign", "verify", "wrapKey", "unwrapKey", "deriveKey", "deriveBits"].forEach(function(usage) {
+        allKeyUsages.forEach(function(usage) {
             if (!validUsages.includes(usage)) {
                 illegalUsages.push(usage);
             }
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
similarity index 98%
rename from test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey.js
rename to test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
index d9257ac69825..a33c3a85b912 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
@@ -1,5 +1,6 @@
 var subtle = crypto.subtle;
 
+// Shared ML-DSA and ML-KEM import/export tests.
 function runTests(algorithmName) {
   var algorithm = { name: algorithmName };
   var data = keyData[algorithmName];
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed25519.https.any.js
index 49656489d425..b6b378651951 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed25519.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for OKP keys
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_fixtures.js
 // META: script=okp_importKey.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed448.tentative.https.any.js
index 5bb7460c1fbc..8498ce4ef8f3 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_Ed448.tentative.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for OKP keys
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_fixtures.js
 // META: script=okp_importKey.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X25519.https.any.js
index de1431d6cc24..5d629c082730 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X25519.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for OKP keys
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_fixtures.js
 // META: script=okp_importKey.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X448.tentative.https.any.js
index f8552be3c826..09361ed9b8d6 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_X448.tentative.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for OKP keys
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_fixtures.js
 // META: script=okp_importKey.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js
index e07b796df83d..0b541d77016f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_failures_fixtures.js
 // META: script=importKey_failures.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed448.tentative.https.any.js
index 8ff3de5c79d3..726d5c1e3772 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_Ed448.tentative.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_failures_fixtures.js
 // META: script=importKey_failures.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X25519.https.any.js
index a0116bee8885..d4c9c105bc3b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X25519.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_failures_fixtures.js
 // META: script=importKey_failures.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X448.tentative.https.any.js
index eccce68fac73..2b575d7ab4d7 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_X448.tentative.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: importKey() for Failures
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=okp_importKey_failures_fixtures.js
 // META: script=importKey_failures.js
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_fixtures.js
index 6a7f583e0165..01c65d60d44d 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_failures_fixtures.js
@@ -1,438 +1,85 @@
-// Setup: define the correct behaviors that should be sought, and create
-// helper functions that generate all possible test parameters for
-// different situations.
+function algorithmName(algorithm) {
+    return algorithm.name || algorithm;
+}
+
+function privateJwk(name) {
+    return Object.assign({}, okpKeyData[name].jwk);
+}
+
+function publicJwk(name) {
+    var jwk = privateJwk(name);
+    delete jwk.d;
+    return jwk;
+}
+
 function getValidKeyData(algorithm) {
-    return validKeyData[algorithm.name || algorithm];
+    var name = algorithmName(algorithm);
+    var key = okpKeyData[name];
+    return [
+        {format: "spki", data: key.spki},
+        {format: "pkcs8", data: key.pkcs8},
+        {format: "raw", data: key.raw},
+        {format: "jwk", data: privateJwk(name)},
+        {format: "jwk", data: publicJwk(name)}
+    ];
 }
 
 function getBadKeyLengthData(algorithm) {
-    return badKeyLengthData[algorithm.name || algorithm];
+    var name = algorithmName(algorithm);
+    var key = okpKeyData[name];
+    var badPrivateJwk = privateJwk(name);
+    var badPublicJwk = publicJwk(name);
+    badPrivateJwk.d = badPrivateJwk.d.slice(0, -1);
+    badPublicJwk.x = badPublicJwk.x.slice(0, -1);
+    return [
+        {format: "spki", data: key.spki.slice(0, -1)},
+        {format: "pkcs8", data: key.pkcs8.slice(0, -1)},
+        {format: "raw", data: key.raw.slice(0, -1)},
+        {format: "jwk", data: badPrivateJwk},
+        {format: "jwk", data: badPublicJwk}
+    ];
 }
 
 function getMissingJWKFieldKeyData(algorithm) {
-    return missingJWKFieldKeyData[algorithm.name || algorithm];
+    var name = algorithmName(algorithm);
+    var missingX = privateJwk(name);
+    var missingKty = privateJwk(name);
+    var missingCrv = name === "Ed448" ? privateJwk(name) : publicJwk(name);
+    delete missingX.x;
+    delete missingKty.kty;
+    delete missingCrv.crv;
+    return [
+        {param: "x", data: missingX},
+        {param: "kty", data: missingKty},
+        {param: "crv", data: missingCrv}
+    ];
 }
 
 function getMismatchedJWKKeyData(algorithm) {
-    return mismatchedJWKKeyData[algorithm.name || algorithm];
+    var name = algorithmName(algorithm);
+    var jwk = privateJwk(name);
+    jwk.x = mismatchedPublicKeys[name];
+    return [jwk];
 }
 
 function getMismatchedKtyField(algorithm) {
-    return mismatchedKtyField[algorithm.name || algorithm];
+    return "EC";
 }
 
 function getMismatchedCrvField(algorithm) {
-    return mismatchedCrvField[algorithm.name || algorithm];
+    return mismatchedCurves[algorithmName(algorithm)];
 }
 
-var validKeyData = {
-    "Ed25519": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, 216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61, 204])
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32, 243, 200, 244, 196, 141, 248, 120, 20, 110, 140, 211, 191, 109, 244, 229, 14, 56, 155, 167, 7, 78, 21, 194, 53, 45, 205, 93, 48, 141, 76, 168, 31])
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61, 204])
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed25519",
-                d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB8",
-                x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPcw",
-                kty: "OKP"
-            },
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed25519",
-                x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPcw",
-                kty: "OKP"
-            },
-        }
-    ],
-    "Ed448": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 67, 48, 5, 6, 3, 43, 101, 113, 3, 58, 0, 171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90, 128]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 71, 2, 1, 0, 48, 5, 6, 3, 43, 101, 113, 4, 59, 4, 57, 14, 255, 3, 69, 140, 40, 224, 23, 156, 82, 29, 227, 18, 201, 105, 183, 131, 67, 72, 236, 171, 153, 26, 96, 227, 178, 233, 167, 158, 76, 217, 228, 128, 239, 41, 23, 18, 210, 200, 61, 4, 114, 114, 213, 201, 244, 40, 102, 79, 105, 109, 38, 112, 69, 143, 29, 46]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90, 128]),
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed448",
-                d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
-                x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
-                kty: "OKP"
-            },
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed448",
-                x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
-                kty: "OKP"
-            },
-        },
-    ],
-    "X25519": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 110, 3, 33, 0, 28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151, 6]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32, 200, 131, 142, 118, 208, 87, 223, 183, 216, 201, 90, 105, 225, 56, 22, 10, 221, 99, 115, 253, 113, 164, 210, 118, 187, 86, 227, 168, 27, 100, 255, 97]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151, 6]),
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X25519",
-                d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E",
-                x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
-                kty: "OKP"
-            },
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X25519",
-                x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
-                kty: "OKP"
-            },
-        },
-    ],
-    "X448": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 66, 48, 5, 6, 3, 43, 101, 111, 3, 57, 0, 182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206, 111]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 70, 2, 1, 0, 48, 5, 6, 3, 43, 101, 111, 4, 58, 4, 56, 88, 199, 210, 154, 62, 181, 25, 178, 157, 0, 207, 177, 145, 187, 100, 252, 109, 138, 66, 216, 241, 113, 118, 39, 43, 137, 242, 39, 45, 24, 25, 41, 92, 101, 37, 192, 130, 150, 113, 176, 82, 239, 7, 39, 83, 15, 24, 142, 49, 208, 204, 83, 191, 38, 146, 158]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206, 111]),
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X448",
-                d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp4",
-                x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
-                kty: "OKP"
-            },
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X448",
-                x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
-                kty: "OKP"
-            },
-        },
-    ],
-};
-
-// Removed just the last byte.
-var badKeyLengthData = {
-    "Ed25519": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, 216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61])
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32, 243, 200, 244, 196, 141, 248, 120, 20, 110, 140, 211, 191, 109, 244, 229, 14, 56, 155, 167, 7, 78, 21, 194, 53, 45, 205, 93, 48, 141, 76, 168])
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61])
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed25519",
-                d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB",
-                x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPcw",
-                kty: "OKP"
-            }
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed25519",
-                x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPc",
-                kty: "OKP"
-            }
-        }
-    ],
-    "Ed448": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 67, 48, 5, 6, 3, 43, 101, 113, 3, 58, 0, 171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 71, 2, 1, 0, 48, 5, 6, 3, 43, 101, 113, 4, 59, 4, 57, 14, 255, 3, 69, 140, 40, 224, 23, 156, 82, 29, 227, 18, 201, 105, 183, 131, 67, 72, 236, 171, 153, 26, 96, 227, 178, 233, 167, 158, 76, 217, 228, 128, 239, 41, 23, 18, 210, 200, 61, 4, 114, 114, 213, 201, 244, 40, 102, 79, 105, 109, 38, 112, 69, 143, 29]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90]),
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed448",
-                d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0",
-                x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
-                kty: "OKP"
-            },
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "Ed448",
-                x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalq",
-                kty: "OKP"
-            },
-        },
-    ],
-    "X25519": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 110, 3, 33, 0, 28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32, 200, 131, 142, 118, 208, 87, 223, 183, 216, 201, 90, 105, 225, 56, 22, 10, 221, 99, 115, 253, 113, 164, 210, 118, 187, 86, 227, 168, 27, 100, 255]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151]),
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X25519",
-                x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lw",
-                kty: "OKP"
-            }
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X25519",
-                d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2",
-                x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
-                kty: "OKP"
-            },
-        },
-    ],
-    "X448": [
-        {
-            format: "spki",
-            data: new Uint8Array([48, 66, 48, 5, 6, 3, 43, 101, 111, 3, 57, 0, 182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206]),
-        },
-        {
-            format: "pkcs8",
-            data: new Uint8Array([48, 70, 2, 1, 0, 48, 5, 6, 3, 43, 101, 111, 4, 58, 4, 56, 88, 199, 210, 154, 62, 181, 25, 178, 157, 0, 207, 177, 145, 187, 100, 252, 109, 138, 66, 216, 241, 113, 118, 39, 43, 137, 242, 39, 45, 24, 25, 41, 92, 101, 37, 192, 130, 150, 113, 176, 82, 239, 7, 39, 83, 15, 24, 142, 49, 208, 204, 83, 191, 38, 146]),
-        },
-        {
-            format: "raw",
-            data: new Uint8Array([182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206]),
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X448",
-                d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp",
-                x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
-                kty: "OKP"
-            },
-        },
-        {
-            format: "jwk",
-            data: {
-                crv: "X448",
-                x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm",
-                kty: "OKP"
-            },
-        },
-    ],
+var mismatchedPublicKeys = {
+    "Ed25519": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+    "Ed448": "X9dEm1m0Yf0s54fsYWrUah2hNCSFpw4fig6nXYDpZ3jt8SR2m0bHBhvWeD3x5Q9s0foavq_oJWGA",
+    "X25519": "hSDwCYkwp1R0i33ctD73Wg2_Og0mOBr066SpjqqbTmo",
+    "X448": "mwj3zDG34+Z9ItWuoSEHSic70rg94Jxj+qc9LCLF2bvINmRyQdlT1AxbEtqIEg1TF3+A5TLEH6A"
 };
 
-var missingJWKFieldKeyData =  {
-    "Ed25519": [
-        {
-            param: "x",
-            data: {
-                crv: "Ed25519",
-                d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB8",
-                kty: "OKP"
-            },
-        },
-        {
-            param: "kty",
-            data: {
-                crv: "Ed25519",
-                x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
-                d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB8",
-            },
-        },
-        {
-            param: "crv",
-            data: {
-                x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
-                kty: "OKP"
-            },
-        }
-    ],
-    "Ed448": [
-        {
-            param: "x",
-            data: {
-                crv: "Ed448",
-                d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
-                kty: "OKP"
-            }
-        },
-        {
-            param: "kty",
-            data: {
-                crv: "Ed448",
-                d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
-                x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
-            }
-        },
-        {
-            param: "crv",
-            data: {
-                d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
-                x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
-                kty: "OKP"
-            }
-        }
-    ],
-    "X25519": [
-        {
-            param: "x",
-            data: {
-                crv: "X25519",
-                d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E",
-                kty: "OKP"
-            },
-        },
-        {
-            param: "kty",
-            data: {
-                crv: "X25519",
-                d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E",
-                x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
-            },
-        },
-        {
-            param: "crv",
-            data: {
-                x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
-                kty: "OKP"
-            },
-        }
-    ],
-    "X448": [
-        {
-            param: "x",
-            data: {
-                crv: "X448",
-                d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp4",
-                kty: "OKP"
-            }
-        },
-        {
-            param: "kty",
-            data: {
-                crv: "X448",
-                d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp4",
-                x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
-            }
-        },
-        {
-            param: "crv",
-            data: {
-                x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
-                kty: "OKP"
-            }
-        }
-    ],
-};
-
-// The public key doesn't match the private key.
-var mismatchedJWKKeyData =  {
-    "Ed25519": [
-        {
-            crv: "Ed25519",
-            d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB8",
-            x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
-            kty: "OKP"
-        },
-    ],
-    "Ed448": [
-        {
-            crv: "Ed448",
-            d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
-            x: "X9dEm1m0Yf0s54fsYWrUah2hNCSFpw4fig6nXYDpZ3jt8SR2m0bHBhvWeD3x5Q9s0foavq_oJWGA",
-            kty: "OKP"
-        },
-    ],
-    "X25519": [
-        {
-            crv: "X25519",
-            d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E",
-            x: "hSDwCYkwp1R0i33ctD73Wg2_Og0mOBr066SpjqqbTmo",
-            kty: "OKP"
-        },
-    ],
-    "X448": [
-        {
-
-            crv: "X448",
-            kty: "OKP",
-            d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp4",
-            x: "mwj3zDG34+Z9ItWuoSEHSic70rg94Jxj+qc9LCLF2bvINmRyQdlT1AxbEtqIEg1TF3+A5TLEH6A",
-        },
-    ],
-}
-
-// The 'kty' field doesn't match the key algorithm.
-var mismatchedKtyField =  {
-    "Ed25519": "EC",
-    "X25519": "EC",
-    "Ed448": "EC",
-    "X448": "EC",
-}
-
-// The 'kty' field doesn't match the key algorithm.
-var mismatchedCrvField =  {
+var mismatchedCurves = {
     "Ed25519": "X25519",
     "X25519": "Ed25519",
     "Ed448": "X448",
-    "X448": "Ed448",
-}
+    "X448": "Ed448"
+};
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_fixtures.js
index 58b41d52601e..5fe0f05c42b4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/okp_importKey_fixtures.js
@@ -1,58 +1 @@
-var keyData = {
-    "Ed25519": {
-        privateUsages: ["sign"],
-        publicUsages: ["verify"],
-        spki: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, 216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61, 204]),
-        raw: new Uint8Array([216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61, 204]),
-        pkcs8: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32, 243, 200, 244, 196, 141, 248, 120, 20, 110, 140, 211, 191, 109, 244, 229, 14, 56, 155, 167, 7, 78, 21, 194, 53, 45, 205, 93, 48, 141, 76, 168, 31]),
-        jwk: {
-            crv: "Ed25519",
-            d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB8",
-            x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPcw",
-            kty: "OKP"
-        }
-    },
-
-    "Ed448": {
-        privateUsages: ["sign"],
-        publicUsages: ["verify"],
-        spki: new Uint8Array([48, 67, 48, 5, 6, 3, 43, 101, 113, 3, 58, 0, 171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90, 128]),
-        raw: new Uint8Array([171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90, 128]),
-        pkcs8: new Uint8Array([48, 71, 2, 1, 0, 48, 5, 6, 3, 43, 101, 113, 4, 59, 4, 57, 14, 255, 3, 69, 140, 40, 224, 23, 156, 82, 29, 227, 18, 201, 105, 183, 131, 67, 72, 236, 171, 153, 26, 96, 227, 178, 233, 167, 158, 76, 217, 228, 128, 239, 41, 23, 18, 210, 200, 61, 4, 114, 114, 213, 201, 244, 40, 102, 79, 105, 109, 38, 112, 69, 143, 29, 46]),
-        jwk: {
-            crv: "Ed448",
-            d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
-            x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
-            kty: "OKP"
-        }
-    },
-
-    "X25519": {
-        privateUsages: ["deriveKey", "deriveBits"],
-        publicUsages: [],
-        spki: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 110, 3, 33, 0, 28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151, 6]),
-        raw: new Uint8Array([28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151, 6]),
-        pkcs8: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32, 200, 131, 142, 118, 208, 87, 223, 183, 216, 201, 90, 105, 225, 56, 22, 10, 221, 99, 115, 253, 113, 164, 210, 118, 187, 86, 227, 168, 27, 100, 255, 97]),
-        jwk: {
-            crv: "X25519",
-            d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E",
-            x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
-            kty: "OKP"
-        }
-    },
-
-    "X448": {
-        privateUsages: ["deriveKey", "deriveBits"],
-        publicUsages: [],
-        spki: new Uint8Array([48, 66, 48, 5, 6, 3, 43, 101, 111, 3, 57, 0, 182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206, 111]),
-        raw: new Uint8Array([182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206, 111]),
-        pkcs8: new Uint8Array([48, 70, 2, 1, 0, 48, 5, 6, 3, 43, 101, 111, 4, 58, 4, 56, 88, 199, 210, 154, 62, 181, 25, 178, 157, 0, 207, 177, 145, 187, 100, 252, 109, 138, 66, 216, 241, 113, 118, 39, 43, 137, 242, 39, 45, 24, 25, 41, 92, 101, 37, 192, 130, 150, 113, 176, 82, 239, 7, 39, 83, 15, 24, 142, 49, 208, 204, 83, 191, 38, 146, 158]),
-        jwk: {
-            crv: "X448",
-            d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp4",
-            x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
-            kty: "OKP"
-        }
-    },
-
-};
+var keyData = okpKeyData;
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.https.any.js
index 3f1e2e5ea9d8..2af5e05048e4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: sign() and verify() Using ECDSA
 // META: script=../util/helpers.js
 // META: script=ecdsa_vectors.js
+// META: script=signature.js
 // META: script=ecdsa.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.js
index cc13b1bd9c3c..a1a744aaa824 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/ecdsa.js
@@ -1,658 +1,71 @@
-
 function run_test() {
-    setup({explicit_done: true});
-
-    var subtle = self.crypto.subtle; // Change to test prefixed implementations
-
-    // When are all these tests really done? When all the promises they use have resolved.
-    var all_promises = [];
-
-    // Source file [algorithm_name]_vectors.js provides the getTestVectors method
-    // for the algorithm that drives these tests.
-    var testVectors = getTestVectors();
-    var invalidTestVectors = getInvalidTestVectors();
-
-    // Test verification first, because signing tests rely on that working
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                signature[0] = 255 - signature[0];
-                var algorithm = {
-                    hash: vector.hashName,
-                    get name() {
-                        signature[0] = vector.signature[0];
-                        return vector.algorithmName;
-                    }
-                };
-                var operation = subtle.verify(algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with altered signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify(algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature[0] = 255 - signature[0];
-                return operation;
-            }, vector.name + " verification with altered signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var algorithm = {
-                    get name() {
-                        signature.buffer.transfer();
-                        return vector.algorithmName;
-                    },
-                    hash: vector.hashName
-                };
-                var operation = subtle.verify(algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with transferred signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify(algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature.buffer.transfer();
-                return operation;
-            }, vector.name + " verification with transferred signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                plaintext[0] = 255 - plaintext[0];
-                var algorithm = {
-                    hash: vector.hashName,
-                    get name() {
-                        plaintext[0] = vector.plaintext[0];
-                        return vector.algorithmName;
-                    }
-                };
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with altered plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext[0] = 255 - plaintext[0];
-                return operation;
-            }, vector.name + " with altered plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failed verification if plaintext is transferred during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var algorithm = {
-                    get name() {
-                        plaintext.buffer.transfer();
-                        return vector.algorithmName;
-                    },
-                    hash: vector.hashName
-                };
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with transferred plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is transferred after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext.buffer.transfer();
-                return operation;
-            }, vector.name + " with transferred plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to using privateKey to verify.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                return subtle.verify(algorithm, vector.privateKey, vector.signature, vector.plaintext)
-                .then(function(plaintext) {
-                    assert_unreached("Should have thrown error for using privateKey to verify in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " using privateKey to verify");
-
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " using privateKey to verify");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to using publicKey to sign.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                return subtle.sign(algorithm, vector.publicKey, vector.plaintext)
-                .then(function(signature) {
-                    assert_unreached("Should have thrown error for using publicKey to sign in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " using publicKey to sign");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " using publicKey to sign");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to no "verify" usage.
-    testVectors.forEach(function(originalVector) {
-        var vector = Object.assign({}, originalVector);
-
-        var promise = importVectorKeys(vector, [], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                return subtle.verify(algorithm, vector.publicKey, vector.signature, vector.plaintext)
-                .then(function(plaintext) {
-                    assert_unreached("Should have thrown error for no verify usage in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " no verify usage");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " no verify usage");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful signing and verification.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                return subtle.sign(algorithm, vector.privateKey, vector.plaintext)
-                .then(function(signature) {
-                    // Can we verify the signature?
-                    return subtle.verify(algorithm, vector.publicKey, signature, vector.plaintext)
-                    .then(function(is_verified) {
-                        assert_true(is_verified, "Round trip verification works");
-                        return signature;
-                    }, function(err) {
-                        assert_unreached("verify error for test " + vector.name + ": '" + err.message + "'");
-                    });
-                }, function(err) {
-                    assert_unreached("sign error for test " + vector.name + ": '" + err.message + "'");
-                });
-            }, vector.name + " round trip");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested signing or verifying
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " round trip");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test signing with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var promise = subtle.generateKey({name: "HMAC", hash: "SHA-1"}, false, ["sign", "verify"])
-        .then(function(wrongKey) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            return importVectorKeys(vector, ["verify"], ["sign"])
-            .then(function(vectors) {
-                promise_test(function(test) {
-                    var operation = subtle.sign(algorithm, wrongKey, vector.plaintext)
-                    .then(function(signature) {
-                        assert_unreached("Signing should not have succeeded for " + vector.name);
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                    });
-
-                    return operation;
-                }, vector.name + " signing with wrong algorithm name");
-
-            }, function(err) {
-                // We need a failed test if the importVectorKey operation fails, so
-                // we know we never tested verification.
-                promise_test(function(test) {
-                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-                }, "importVectorKeys step: " + vector.name + " signing with wrong algorithm name");
-            });
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-            }, "generate wrong key step: " + vector.name + " signing with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var promise = subtle.generateKey({name: "HMAC", hash: "SHA-1"}, false, ["sign", "verify"])
-        .then(function(wrongKey) {
-            return importVectorKeys(vector, ["verify"], ["sign"])
-            .then(function(vectors) {
-                var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-                promise_test(function(test) {
-                    var operation = subtle.verify(algorithm, wrongKey, vector.signature, vector.plaintext)
-                    .then(function(signature) {
-                        assert_unreached("Verifying should not have succeeded for " + vector.name);
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                    });
-
-                    return operation;
-                }, vector.name + " verifying with wrong algorithm name");
-
-            }, function(err) {
-                // We need a failed test if the importVectorKey operation fails, so
-                // we know we never tested verification.
-                promise_test(function(test) {
-                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-                }, "importVectorKeys step: " + vector.name + " verifying with wrong algorithm name");
-            });
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-            }, "generate wrong key step: " + vector.name + " verifying with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification fails with wrong signature
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            var signature = copyBuffer(vector.signature);
-            signature[0] = 255 - signature[0];
-            promise_test(function(test) {
-                var operation = subtle.verify(algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to altered signature");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to altered signature");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification fails with wrong hash
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var hashName = "SHA-1";
-            if (vector.hashName === "SHA-1") {
-                hashName = "SHA-256"
+    const subtle = self.crypto.subtle;
+    const normalize = vector => ({...vector, data: vector.plaintext});
+    const testVectors = getTestVectors().map(normalize);
+    const invalidTestVectors = getInvalidTestVectors().map(normalize);
+    const algorithmIdentifier = vector => ({
+        name: vector.algorithmName,
+        hash: vector.hashName,
+    });
+    const importAlgorithm = vector => ({
+        name: vector.algorithmName,
+        namedCurve: vector.namedCurve,
+    });
+
+    runSignatureTests({
+        vectors: testVectors,
+        invalidVectors: invalidTestVectors,
+        algorithmIdentifier,
+        importAlgorithm,
+        dataLabel: "plaintext",
+    });
+
+    testVectors.forEach(function(vector) {
+        promise_test(async function() {
+            const key = await subtle.importKey(
+                vector.publicKeyFormat,
+                vector.publicKeyBuffer,
+                importAlgorithm(vector),
+                false,
+                ["verify"]
+            );
+            const hash = vector.hashName === "SHA-1" ? "SHA-256" : "SHA-1";
+            const isVerified = await subtle.verify(
+                {name: vector.algorithmName, hash},
+                key,
+                vector.signature,
+                vector.data
+            );
+            assert_false(isVerified, "Signature NOT verified");
+        }, vector.name + " verification failure due to wrong hash");
+
+        promise_test(async function() {
+            const key = await subtle.importKey(
+                vector.publicKeyFormat,
+                vector.publicKeyBuffer,
+                importAlgorithm(vector),
+                false,
+                ["verify"]
+            );
+            const hash = vector.hashName.substring(0, 3) +
+                vector.hashName.substring(4);
+            let error;
+            try {
+                await subtle.verify(
+                    {name: vector.algorithmName, hash},
+                    key,
+                    vector.signature,
+                    vector.data
+                );
+            } catch (caught) {
+                error = caught;
             }
-            var algorithm = {name: vector.algorithmName, hash: hashName};
-            promise_test(function(test) {
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to wrong hash");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong hash");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification fails with bad hash name
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            // use the wrong name for the hash
-            var hashName = vector.hashName.substring(0, 3) + vector.hashName.substring(4);
-            var algorithm = {name: vector.algorithmName, hash: hashName};
-            promise_test(function(test) {
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_unreached("Verification should throw an error");
-                }, function(err) {
-                    assert_equals(err.name, "NotSupportedError", "Correctly throws NotSupportedError for illegal hash name")
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to bad hash name");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to bad hash name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification fails with short (odd length) signature
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            var signature = vector.signature.slice(1); // Skip the first byte
-            promise_test(function(test) {
-                var operation = subtle.verify(algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to shortened signature");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to shortened signature");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification fails with wrong plaintext
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            var plaintext = copyBuffer(vector.plaintext);
-            plaintext[0] = 255 - plaintext[0];
-            promise_test(function(test) {
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to altered plaintext");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to altered plaintext");
-        });
-
-        all_promises.push(promise);
+            assert_not_equals(error, undefined, "Verification should throw");
+            assert_equals(
+                error.name,
+                "NotSupportedError",
+                "Correctly throws NotSupportedError for illegal hash name"
+            );
+        }, vector.name + " verification failure due to bad hash name");
     });
-
-    // Test invalid signatures
-    invalidTestVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            var algorithm = {name: vector.algorithmName, hash: vector.hashName};
-            promise_test(function(test) {
-                var operation = subtle.verify(algorithm, vector.publicKey, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature unexpectedly verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification");
-        });
-
-        all_promises.push(promise);
-    });
-
-    promise_test(function() {
-        return Promise.all(all_promises)
-            .then(function() {done();})
-            .catch(function() {done();})
-    }, "setup");
-
-    // A test vector has all needed fields for signing and verifying, EXCEPT that the
-    // key field may be null. This function replaces that null with the Correct
-    // CryptoKey object.
-    //
-    // Returns a Promise that yields an updated vector on success.
-    function importVectorKeys(vector, publicKeyUsages, privateKeyUsages) {
-        var publicPromise, privatePromise;
-
-        if (vector.publicKey !== null) {
-            publicPromise = new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
-        } else {
-            publicPromise = subtle.importKey(vector.publicKeyFormat, vector.publicKeyBuffer, {name: vector.algorithmName, namedCurve: vector.namedCurve}, false, publicKeyUsages)
-            .then(function(key) {
-                vector.publicKey = key;
-                return vector;
-            });        // Returns a copy of the sourceBuffer it is sent.
-        }
-
-        if (vector.privateKey !== null) {
-            privatePromise = new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
-        } else {
-            privatePromise = subtle.importKey(vector.privateKeyFormat, vector.privateKeyBuffer, {name: vector.algorithmName, namedCurve: vector.namedCurve}, false, privateKeyUsages)
-            .then(function(key) {
-                vector.privateKey = key;
-                return vector;
-            });
-        }
-
-        return Promise.all([publicPromise, privatePromise]);
-    }
-
-    return;
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa.js
index 77961566d9a6..a60ceda96a6c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa.js
@@ -1,337 +1,10 @@
-
 function run_test(algorithmName) {
-  var subtle = self.crypto.subtle; // Change to test prefixed implementations
-
-  // Source file [algorithm_name]_vectors.js provides the getTestVectors method
-  // for the algorithm that drives these tests.
-  var testVectors = getTestVectors(algorithmName);
-
-  testVectors.forEach(function(vector) {
-      var algorithm = {name: vector.algorithmName};
-
-      // Test verification first, because signing tests rely on that working
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              isVerified = await subtle.verify(algorithm, key, vector.signature, vector.data)
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Signature verified");
-      }, vector.name + " verification");
-
-      // Test verification with an altered buffer during call
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var signature = copyBuffer(vector.signature);
-              signature[0] = 255 - signature[0];
-              isVerified = await subtle.verify({
-                  get name() {
-                      signature[0] = vector.signature[0];
-                      return vector.algorithmName;
-                  }
-              }, key, signature, vector.data);
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Signature verified");
-      }, vector.name + " verification with altered signature during call");
-
-      // Test verification with an altered buffer after call
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var signature = copyBuffer(vector.signature);
-              [isVerified] = await Promise.all([
-                  subtle.verify(algorithm, key, signature, vector.data),
-                  signature[0] = 255 - signature[0]
-              ]);
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Signature verified");
-      }, vector.name + " verification with altered signature after call");
-
-      // Test verification with a transferred buffer during call
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var signature = copyBuffer(vector.signature);
-              isVerified = await subtle.verify({
-                  get name() {
-                      signature.buffer.transfer();
-                      return vector.algorithmName;
-                  }
-              }, key, signature, vector.data);
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_false(isVerified, "Signature is NOT verified");
-      }, vector.name + " verification with transferred signature during call");
-
-      // Test verification with a transferred buffer after call
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var signature = copyBuffer(vector.signature);
-              var operation = subtle.verify(algorithm, key, signature, vector.data);
-              signature.buffer.transfer();
-              isVerified = await operation;
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Signature verified");
-      }, vector.name + " verification with transferred signature after call");
-
-      // Check for successful verification even if data is altered during call.
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var data = copyBuffer(vector.data);
-              data[0] = 255 - data[0];
-              isVerified = await subtle.verify({
-                  get name() {
-                      data[0] = vector.data[0];
-                      return vector.algorithmName;
-                  }
-              }, key, vector.signature, data);
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Signature verified");
-      }, vector.name + " with altered data during call");
-
-      // Check for successful verification even if data is altered after call.
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var data = copyBuffer(vector.data);
-              [isVerified] = await Promise.all([
-                  subtle.verify(algorithm, key, vector.signature, data),
-                  data[0] = 255 - data[0]
-              ]);
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Signature verified");
-      }, vector.name + " with altered data after call");
-
-      // Check for failed verification if data is transferred during call.
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var data = copyBuffer(vector.data);
-              isVerified = await subtle.verify({
-                  get name() {
-                      data.buffer.transfer();
-                      return vector.algorithmName;
-                  }
-              }, key, vector.signature, data);
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_false(isVerified, "Signature is NOT verified");
-      }, vector.name + " with transferred data during call");
-
-      // Check for successful verification even if data is transferred after call.
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              var data = copyBuffer(vector.data);
-              var operation = subtle.verify(algorithm, key, vector.signature, data);
-              data.buffer.transfer();
-              isVerified = await operation;
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Signature verified");
-      }, vector.name + " with transferred data after call");
-
-      // Check for failures due to using privateKey to verify.
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("pkcs8", vector.privateKeyBuffer, algorithm, false, ["sign"]);
-              isVerified = await subtle.verify(algorithm, key, vector.signature, vector.data)
-              assert_unreached("Should have thrown error for using privateKey to verify in " + vector.name);
-          } catch (err) {
-              if (err instanceof AssertionError)
-                  throw err;
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-          };
-          assert_false(isVerified, "Signature verified");
-      }, vector.name + " using privateKey to verify");
-
-      // Check for failures due to using publicKey to sign.
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              let signature = await subtle.sign(algorithm, key, vector.data);
-              assert_unreached("Should have thrown error for using publicKey to sign in " + vector.name);
-          } catch (err) {
-              if (err instanceof AssertionError)
-                  throw err;
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-          };
-      }, vector.name + " using publicKey to sign");
-
-      // Check for failures due to no "verify" usage.
-      promise_test(async() => {
-          let isVerified = false;
-          let key;
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, []);
-              isVerified = await subtle.verify(algorithm, key, vector.signature, vector.data)
-              assert_unreached("Should have thrown error for no verify usage in " + vector.name);
-          } catch (err) {
-              if (err instanceof AssertionError)
-                  throw err;
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-          };
-          assert_false(isVerified, "Signature verified");
-      }, vector.name + " no verify usage");
-
-      // Check for successful signing and verification.
-      var algorithm = {name: vector.algorithmName};
-      promise_test(async() => {
-          let isVerified = false;
-          let privateKey, publicKey;
-          let signature;
-          try {
-              privateKey = await subtle.importKey("pkcs8", vector.privateKeyBuffer, algorithm, false, ["sign"]);
-              publicKey = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              signature = await subtle.sign(algorithm, privateKey, vector.data);
-              isVerified = await subtle.verify(algorithm, publicKey, vector.signature, vector.data)
-          } catch (err) {
-              assert_false(publicKey === undefined || privateKey === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_false(signature === undefined, "sign error for test " + vector.name + ": '" + err.message + "'");
-              assert_unreached("verify error for test " + vector.name + ": '" + err.message + "'");
-          };
-          assert_true(isVerified, "Round trip verification works");
-      }, vector.name + " round trip");
-
-      // Test signing with the wrong algorithm
-      var algorithm = {name: vector.algorithmName};
-      promise_test(async() => {
-          let wrongKey;
-          try {
-              wrongKey = await subtle.generateKey({name: "HMAC", hash: "SHA-1"}, false, ["sign", "verify"])
-              let signature = await subtle.sign(algorithm, wrongKey, vector.data);
-              assert_unreached("Signing should not have succeeded for " + vector.name);
-          } catch (err) {
-              if (err instanceof AssertionError)
-                  throw err;
-              assert_false(wrongKey === undefined, "Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-              assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-          };
-      }, vector.name + " signing with wrong algorithm name");
-
-      // Test verification with the wrong algorithm
-      var algorithm = {name: vector.algorithmName};
-      promise_test(async() => {
-          let wrongKey;
-          try {
-              wrongKey = await subtle.generateKey({name: "HMAC", hash: "SHA-1"}, false, ["sign", "verify"])
-              let isVerified = await subtle.verify(algorithm, wrongKey, vector.signature, vector.data)
-              assert_unreached("Verifying should not have succeeded for " + vector.name);
-          } catch (err) {
-              if (err instanceof AssertionError)
-                  throw err;
-              assert_false(wrongKey === undefined, "Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-              assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-          };
-      }, vector.name + " verifying with wrong algorithm name");
-
-      // Test verification fails with wrong signature
-      var algorithm = {name: vector.algorithmName};
-      promise_test(async() => {
-          let key;
-          let isVerified = true;
-          var signature = copyBuffer(vector.signature);
-          signature[0] = 255 - signature[0];
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              isVerified = await subtle.verify(algorithm, key, signature, vector.data)
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_false(isVerified, "Signature verified");
-      }, vector.name + " verification failure due to altered signature");
-
-      // Test verification fails with short (odd length) signature
-      promise_test(async() => {
-          let key;
-          let isVerified = true;
-          var signature = vector.signature.slice(1); // Skip the first byte
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              isVerified = await subtle.verify(algorithm, key, signature, vector.data)
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_false(isVerified, "Signature verified");
-      }, vector.name + " verification failure due to shortened signature");
-
-      // Test verification fails with wrong data
-      promise_test(async() => {
-          let key;
-          let isVerified = true;
-          var data = copyBuffer(vector.data);
-          data[0] = 255 - data[0];
-          try {
-              key = await subtle.importKey("spki", vector.publicKeyBuffer, algorithm, false, ["verify"]);
-              isVerified = await subtle.verify(algorithm, key, vector.signature, data)
-          } catch (err) {
-              assert_false(key === undefined, "importKey failed for " + vector.name + ". Message: ''" + err.message + "''");
-              assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-          };
-          assert_false(isVerified, "Signature verified");
-      }, vector.name + " verification failure due to altered data");
-
-      // Test that generated keys are valid for signing and verifying.
-      promise_test(async() => {
-          let key = await subtle.generateKey(algorithm, false, ["sign", "verify"]);
-          let signature = await subtle.sign(algorithm, key.privateKey, vector.data);
-          let isVerified = await subtle.verify(algorithm, key.publicKey, signature, vector.data);
-          assert_true(isVerified, "Verificaton failed.");
-      }, "Sign and verify using generated " + vector.algorithmName + " keys.");
+  runSignatureTests({
+    vectors: getTestVectors(algorithmName),
+    algorithmIdentifier(vector) {
+      return {name: vector.algorithmName};
+    },
+    katFirst: true,
+    generatedKeys: true,
   });
-
-  return;
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve25519.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve25519.https.any.js
index b012b64733ef..a4f32cbaeb7e 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve25519.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve25519.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: sign() and verify() Using EdDSA
 // META: script=../util/helpers.js
 // META: script=eddsa_vectors.js
+// META: script=signature.js
 // META: script=eddsa.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve448.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve448.tentative.https.any.js
index 281bb63ad659..8dd43dfeb172 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve448.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/eddsa_curve448.tentative.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: sign() and verify() Using EdDSA
 // META: script=../util/helpers.js
 // META: script=eddsa_vectors.js
+// META: script=signature.js
 // META: script=eddsa.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.https.any.js
index a6c88f80ed99..070611181e58 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: sign() and verify() Using HMAC
 // META: script=../util/helpers.js
 // META: script=hmac_vectors.js
+// META: script=mac.js
 // META: script=hmac.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.js
index 929d9464e171..05b9cedfb94c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/hmac.js
@@ -1,494 +1,11 @@
-
 function run_test() {
-    setup({explicit_done: true});
-
-    var subtle = self.crypto.subtle; // Change to test prefixed implementations
-
-    // When are all these tests really done? When all the promises they use have resolved.
-    var all_promises = [];
-
-    // Source file hmac_vectors.js provides the getTestVectors method
-    // for the algorithm that drives these tests.
-    var testVectors = getTestVectors();
-
-    // Test verification first, because signing tests rely on that working
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                signature[0] = 255 - signature[0];
-                var operation = subtle.verify({
-                    get name() {
-                        signature[0] = vector.signature[0];
-                        return "HMAC";
-                    },
-                    hash: vector.hash
-                }, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature is not verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with altered signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature is not verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature[0] = 255 - signature[0];
-                return operation;
-            }, vector.name + " verification with altered signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify({
-                    get name() {
-                        signature.buffer.transfer();
-                        return "HMAC";
-                    },
-                    hash: vector.hash
-                }, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with transferred signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature is not verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature.buffer.transfer();
-                return operation;
-            }, vector.name + " verification with transferred signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                plaintext[0] = 255 - plaintext[0];
-                var operation = subtle.verify({
-                    hash: vector.hash,
-                    get name() {
-                        plaintext[0] = vector.plaintext[0];
-                        return "HMAC";
-                    }
-                }, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with altered plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext[0] = 255 - plaintext[0];
-                return operation;
-            }, vector.name + " with altered plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failed verification if plaintext is transferred during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify({
-                    get name() {
-                        plaintext.buffer.transfer();
-                        return "HMAC";
-                    },
-                    hash: vector.hash
-                }, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with transferred plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is transferred after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext.buffer.transfer();
-                return operation;
-            }, vector.name + " with transferred plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to no "verify" usage.
-    testVectors.forEach(function(originalVector) {
-        var vector = Object.assign({}, originalVector);
-
-        var promise = importVectorKeys(vector, ["sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                return subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, vector.signature, vector.plaintext)
-                .then(function(plaintext) {
-                    assert_unreached("Should have thrown error for no verify usage in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " no verify usage");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " no verify usage");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful signing and verification.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                return subtle.sign({name: "HMAC", hash: vector.hash}, vector.key, vector.plaintext)
-                .then(function(signature) {
-                    assert_true(equalBuffers(signature, vector.signature), "Signing did not give the expected output");
-                    // Can we get the verify the new signature?
-                    return subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, signature, vector.plaintext)
-                    .then(function(is_verified) {
-                        assert_true(is_verified, "Round trip verifies");
-                        return signature;
-                    }, function(err) {
-                        assert_unreached("verify error for test " + vector.name + ": '" + err.message + "'");
-                    });
-                });
-            }, vector.name + " round trip");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested signing or verifying
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " round trip");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test signing with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
-        .then(function(wrongKey) {
-            return importVectorKeys(vector, ["verify", "sign"])
-            .then(function(vectors) {
-                promise_test(function(test) {
-                    var operation = subtle.sign({name: "HMAC", hash: vector.hash}, wrongKey.privateKey, vector.plaintext)
-                    .then(function(signature) {
-                        assert_unreached("Signing should not have succeeded for " + vector.name);
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                    });
-
-                    return operation;
-                }, vector.name + " signing with wrong algorithm name");
-
-            }, function(err) {
-                // We need a failed test if the importVectorKey operation fails, so
-                // we know we never tested verification.
-                promise_test(function(test) {
-                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-                }, "importVectorKeys step: " + vector.name + " signing with wrong algorithm name");
-            });
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-            }, "generate wrong key step: " + vector.name + " signing with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
-        .then(function(wrongKey) {
-            return importVectorKeys(vector, ["verify", "sign"])
-            .then(function(vector) {
-                promise_test(function(test) {
-                    var operation = subtle.verify({name: "HMAC", hash: vector.hash}, wrongKey.publicKey, vector.signature, vector.plaintext)
-                    .then(function(signature) {
-                        assert_unreached("Verifying should not have succeeded for " + vector.name);
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                    });
-
-                    return operation;
-                }, vector.name + " verifying with wrong algorithm name");
-
-            }, function(err) {
-                // We need a failed test if the importVectorKey operation fails, so
-                // we know we never tested verification.
-                promise_test(function(test) {
-                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-                }, "importVectorKeys step: " + vector.name + " verifying with wrong algorithm name");
-            });
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-            }, "generate wrong key step: " + vector.name + " verifying with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Verification should fail if the plaintext is changed
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            var plaintext = copyBuffer(vector.plaintext);
-            plaintext[0] = 255 - plaintext[0];
-            promise_test(function(test) {
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to wrong plaintext");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong plaintext");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Verification should fail if the signature is changed
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            var signature = copyBuffer(vector.signature);
-            signature[0] = 255 - signature[0];
-            promise_test(function(test) {
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to wrong signature");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong signature");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Verification should fail if the signature is wrong length
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            var signature = vector.signature.slice(1); // Drop first byte
-            promise_test(function(test) {
-                var operation = subtle.verify({name: "HMAC", hash: vector.hash}, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to short signature");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to short signature");
-        });
-
-        all_promises.push(promise);
-    });
-
-
-
-    promise_test(function() {
-        return Promise.all(all_promises)
-            .then(function() {done();})
-            .catch(function() {done();})
-    }, "setup");
-
-    // A test vector has all needed fields for signing and verifying, EXCEPT that the
-    // key field may be null. This function replaces that null with the Correct
-    // CryptoKey object.
-    //
-    // Returns a Promise that yields an updated vector on success.
-    function importVectorKeys(vector, keyUsages) {
-        if (vector.key !== null) {
-            return new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
-        } else {
-            return subtle.importKey("raw", vector.keyBuffer, {name: "HMAC", hash: vector.hash}, false, keyUsages)
-            .then(function(key) {
-                vector.key = key;
-                return vector;
-            });
+    runMacTests({
+        importFormat: "raw",
+        importAlgorithm: function(vector) {
+            return {name: "HMAC", hash: vector.hash};
+        },
+        operationAlgorithm: function(vector) {
+            return {name: "HMAC", hash: vector.hash};
         }
-    }
-
-    return;
+    });
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.js
index d9d82d150b39..ac30a5559d8c 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.js
@@ -1,586 +1,25 @@
 function run_test() {
-    setup({explicit_done: true});
-
-    var subtle = self.crypto.subtle; // Change to test prefixed implementations
-
-    // When are all these tests really done? When all the promises they use have resolved.
-    var all_promises = [];
-
-    // Source file kmac_vectors.js provides the getTestVectors method
-    // for the algorithm that drives these tests.
-    var testVectors = getTestVectors();
-
-    // Test verification first, because signing tests rely on that working
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                signature[0] = 255 - signature[0];
-                var algorithmParams = {
-                    outputLength: vector.outputLength,
-                    get name() {
-                        signature[0] = vector.signature[0];
-                        return vector.algorithm;
-                    }
-                };
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature is not verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with altered signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature is not verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature[0] = 255 - signature[0];
-                return operation;
-            }, vector.name + " verification with altered signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var algorithmParams = {
-                    get name() {
-                        signature.buffer.transfer();
-                        return vector.algorithm;
-                    },
-                    outputLength: vector.outputLength
-                };
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with transferred signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature is not verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature.buffer.transfer();
-                return operation;
-            }, vector.name + " verification with transferred signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                plaintext[0] = 255 - plaintext[0];
-                var algorithmParams = {
-                    outputLength: vector.outputLength,
-                    get name() {
-                        plaintext[0] = vector.plaintext[0];
-                        return vector.algorithm;
-                    }
-                };
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with altered plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext[0] = 255 - plaintext[0];
-                return operation;
-            }, vector.name + " with altered plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failed verification if plaintext is transferred during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var algorithmParams = {
-                    get name() {
-                        plaintext.buffer.transfer();
-                        return vector.algorithm;
-                    },
-                    outputLength: vector.outputLength
-                };
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with transferred plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is transferred after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext.buffer.transfer();
-                return operation;
-            }, vector.name + " with transferred plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to no "verify" usage.
-    testVectors.forEach(function(originalVector) {
-        var vector = Object.assign({}, originalVector);
-
-        var promise = importVectorKeys(vector, ["sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                return subtle.verify(algorithmParams, vector.key, vector.signature, vector.plaintext)
-                .then(function(plaintext) {
-                    assert_unreached("Should have thrown error for no verify usage in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " no verify usage");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " no verify usage");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful signing and verification.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                return subtle.sign(algorithmParams, vector.key, vector.plaintext)
-                .then(function(signature) {
-                    assert_true(equalBuffers(signature, vector.signature), "Signing did not give the expected output");
-                    // Can we get the verify the new signature?
-                    return subtle.verify(algorithmParams, vector.key, signature, vector.plaintext)
-                    .then(function(is_verified) {
-                        assert_true(is_verified, "Round trip verifies");
-                        return signature;
-                    }, function(err) {
-                        assert_unreached("verify error for test " + vector.name + ": '" + err.message + "'");
-                    });
-                });
-            }, vector.name + " round trip");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested signing or verifying
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " round trip");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test signing with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
-        .then(function(wrongKey) {
-            return importVectorKeys(vector, ["verify", "sign"])
-            .then(function(vectors) {
-                promise_test(function(test) {
-                    var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                    if (vector.customization !== undefined) {
-                        algorithmParams.customization = vector.customization;
-                    }
-                    var operation = subtle.sign(algorithmParams, wrongKey.privateKey, vector.plaintext)
-                    .then(function(signature) {
-                        assert_unreached("Signing should not have succeeded for " + vector.name);
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                    });
-
-                    return operation;
-                }, vector.name + " signing with wrong algorithm name");
-
-            }, function(err) {
-                // We need a failed test if the importVectorKey operation fails, so
-                // we know we never tested verification.
-                promise_test(function(test) {
-                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-                }, "importVectorKeys step: " + vector.name + " signing with wrong algorithm name");
-            });
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-            }, "generate wrong key step: " + vector.name + " signing with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
-        .then(function(wrongKey) {
-            return importVectorKeys(vector, ["verify", "sign"])
-            .then(function(vector) {
-                promise_test(function(test) {
-                    var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                    if (vector.customization !== undefined) {
-                        algorithmParams.customization = vector.customization;
-                    }
-                    var operation = subtle.verify(algorithmParams, wrongKey.publicKey, vector.signature, vector.plaintext)
-                    .then(function(signature) {
-                        assert_unreached("Verifying should not have succeeded for " + vector.name);
-                    }, function(err) {
-                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                    });
-
-                    return operation;
-                }, vector.name + " verifying with wrong algorithm name");
-
-            }, function(err) {
-                // We need a failed test if the importVectorKey operation fails, so
-                // we know we never tested verification.
-                promise_test(function(test) {
-                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-                }, "importVectorKeys step: " + vector.name + " verifying with wrong algorithm name");
-            });
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
-            }, "generate wrong key step: " + vector.name + " verifying with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Verification should fail if the plaintext is changed
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            var plaintext = copyBuffer(vector.plaintext);
-            plaintext[0] = 255 - plaintext[0];
-            promise_test(function(test) {
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to wrong plaintext");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong plaintext");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Verification should fail if the signature is changed
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            var signature = copyBuffer(vector.signature);
-            signature[0] = 255 - signature[0];
-            promise_test(function(test) {
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to wrong signature");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong signature");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Verification should fail if the signature is wrong length
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            var signature = vector.signature.slice(1); // Drop first byte
-            promise_test(function(test) {
-                var algorithmParams = {name: vector.algorithm, outputLength: vector.outputLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to short signature");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to short signature");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification failure due to wrong length parameter
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify", "sign"])
-        .then(function(vector) {
-            promise_test(function(test) {
-                var differentLength = vector.outputLength === 256 ? 512 : 256;
-                var algorithmParams = {name: vector.algorithm, outputLength: differentLength};
-                if (vector.customization !== undefined) {
-                    algorithmParams.customization = vector.customization;
-                }
-                var operation = subtle.verify(algorithmParams, vector.key, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified with wrong length");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure due to wrong length parameter");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong length parameter");
-        });
-
-        all_promises.push(promise);
-    });
-
-    promise_test(function() {
-        return Promise.all(all_promises)
-            .then(function() {done();})
-            .catch(function() {done();})
-    }, "setup");
-
-    // A test vector has all needed fields for signing and verifying, EXCEPT that the
-    // key field may be null. This function replaces that null with the Correct
-    // CryptoKey object.
-    //
-    // Returns a Promise that yields an updated vector on success.
-    function importVectorKeys(vector, keyUsages) {
-        if (vector.key !== null) {
-            return new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
-        } else {
-            return subtle.importKey("raw-secret", vector.keyBuffer, {name: vector.algorithm}, false, keyUsages)
-            .then(function(key) {
-                vector.key = key;
-                return vector;
-            });
+    function operationAlgorithm(vector) {
+        var algorithm = {
+            name: vector.algorithm,
+            outputLength: vector.outputLength
+        };
+        if (vector.customization !== undefined) {
+            algorithm.customization = vector.customization;
         }
+        return algorithm;
     }
 
-    return;
+    runMacTests({
+        importFormat: "raw-secret",
+        importAlgorithm: function(vector) {
+            return {name: vector.algorithm};
+        },
+        operationAlgorithm: operationAlgorithm,
+        wrongVerificationAlgorithm: function(vector) {
+            var algorithm = operationAlgorithm(vector);
+            algorithm.outputLength = vector.outputLength === 256 ? 512 : 256;
+            return algorithm;
+        }
+    });
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.tentative.https.any.js
index 3d34c5752137..0a57ba7a3f80 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/kmac.tentative.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: sign() and verify() Using KMAC
 // META: script=../util/helpers.js
 // META: script=kmac_vectors.js
+// META: script=mac.js
 // META: script=kmac.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/mac.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mac.js
new file mode 100644
index 000000000000..27787c91d8a2
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mac.js
@@ -0,0 +1,514 @@
+
+function runMacTests(options) {
+    setup({explicit_done: true});
+
+    var subtle = self.crypto.subtle; // Change to test prefixed implementations
+
+    // When are all these tests really done? When all the promises they use have resolved.
+    var all_promises = [];
+
+    // The algorithm-specific vector source provides getTestVectors().
+    var testVectors = getTestVectors();
+
+    function operationAlgorithm(vector, nameGetter) {
+        var algorithm = options.operationAlgorithm(vector);
+        if (nameGetter !== undefined) {
+            Object.defineProperty(algorithm, "name", {
+                enumerable: true,
+                get: nameGetter
+            });
+        }
+        return algorithm;
+    }
+
+    // Test verification first, because signing tests rely on that working
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, vector.plaintext)
+                .then(function(is_verified) {
+                    assert_true(is_verified, "Signature verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " verification");
+
+        }, function(err) {
+            // We need a failed test if the importVectorKey operation fails, so
+            // we know we never tested verification.
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Test verification with an altered buffer during call
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var signature = copyBuffer(vector.signature);
+                signature[0] = 255 - signature[0];
+                var operation = subtle.verify(operationAlgorithm(vector, function() {
+                        signature[0] = vector.signature[0];
+                        return options.operationAlgorithm(vector).name;
+                    }), vector.key, signature, vector.plaintext)
+                .then(function(is_verified) {
+                    assert_true(is_verified, "Signature is not verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " verification with altered signature during call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification with altered signature during call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Test verification with an altered buffer after call
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var signature = copyBuffer(vector.signature);
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
+                .then(function(is_verified) {
+                    assert_true(is_verified, "Signature is not verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                signature[0] = 255 - signature[0];
+                return operation;
+            }, vector.name + " verification with altered signature after call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification with altered signature after call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Test verification with a transferred buffer during call
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var signature = copyBuffer(vector.signature);
+                var operation = subtle.verify(operationAlgorithm(vector, function() {
+                        signature.buffer.transfer();
+                        return options.operationAlgorithm(vector).name;
+                    }), vector.key, signature, vector.plaintext)
+                .then(function(is_verified) {
+                    assert_false(is_verified, "Signature is NOT verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " verification with transferred signature during call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification with transferred signature during call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Test verification with a transferred buffer after call
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var signature = copyBuffer(vector.signature);
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
+                .then(function(is_verified) {
+                    assert_true(is_verified, "Signature is not verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                signature.buffer.transfer();
+                return operation;
+            }, vector.name + " verification with transferred signature after call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification with transferred signature after call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Check for successful verification even if plaintext is altered during call.
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var plaintext = copyBuffer(vector.plaintext);
+                plaintext[0] = 255 - plaintext[0];
+                var operation = subtle.verify(operationAlgorithm(vector, function() {
+                        plaintext[0] = vector.plaintext[0];
+                        return options.operationAlgorithm(vector).name;
+                    }), vector.key, vector.signature, plaintext)
+                .then(function(is_verified) {
+                    assert_true(is_verified, "Signature verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " with altered plaintext during call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " with altered plaintext during call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Check for successful verification even if plaintext is altered after call.
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var plaintext = copyBuffer(vector.plaintext);
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, plaintext)
+                .then(function(is_verified) {
+                    assert_true(is_verified, "Signature verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                plaintext[0] = 255 - plaintext[0];
+                return operation;
+            }, vector.name + " with altered plaintext after call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " with altered plaintext after call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Check for failed verification if plaintext is transferred during call.
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var plaintext = copyBuffer(vector.plaintext);
+                var operation = subtle.verify(operationAlgorithm(vector, function() {
+                        plaintext.buffer.transfer();
+                        return options.operationAlgorithm(vector).name;
+                    }), vector.key, vector.signature, plaintext)
+                .then(function(is_verified) {
+                    assert_false(is_verified, "Signature is NOT verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " with transferred plaintext during call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " with transferred plaintext during call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Check for successful verification even if plaintext is transferred after call.
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                var plaintext = copyBuffer(vector.plaintext);
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, plaintext)
+                .then(function(is_verified) {
+                    assert_true(is_verified, "Signature verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                plaintext.buffer.transfer();
+                return operation;
+            }, vector.name + " with transferred plaintext after call");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " with transferred plaintext after call");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Check for failures due to no "verify" usage.
+    testVectors.forEach(function(originalVector) {
+        var vector = Object.assign({}, originalVector);
+
+        var promise = importVectorKeys(vector, ["sign"])
+        .then(function(vector) {
+            promise_test(function(test) {
+                return subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, vector.plaintext)
+                .then(function(plaintext) {
+                    assert_unreached("Should have thrown error for no verify usage in " + vector.name + ": '" + err.message + "'");
+                }, function(err) {
+                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
+                });
+            }, vector.name + " no verify usage");
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " no verify usage");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Check for successful signing and verification.
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vectors) {
+            promise_test(function(test) {
+                return subtle.sign(operationAlgorithm(vector), vector.key, vector.plaintext)
+                .then(function(signature) {
+                    assert_true(equalBuffers(signature, vector.signature), "Signing did not give the expected output");
+                    // Can we get the verify the new signature?
+                    return subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
+                    .then(function(is_verified) {
+                        assert_true(is_verified, "Round trip verifies");
+                        return signature;
+                    }, function(err) {
+                        assert_unreached("verify error for test " + vector.name + ": '" + err.message + "'");
+                    });
+                });
+            }, vector.name + " round trip");
+
+        }, function(err) {
+            // We need a failed test if the importVectorKey operation fails, so
+            // we know we never tested signing or verifying
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " round trip");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Test signing with the wrong algorithm
+    testVectors.forEach(function(vector) {
+        // Want to get the key for the wrong algorithm
+        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
+        .then(function(wrongKey) {
+            return importVectorKeys(vector, ["verify", "sign"])
+            .then(function(vectors) {
+                promise_test(function(test) {
+                    var operation = subtle.sign(operationAlgorithm(vector), wrongKey.privateKey, vector.plaintext)
+                    .then(function(signature) {
+                        assert_unreached("Signing should not have succeeded for " + vector.name);
+                    }, function(err) {
+                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
+                    });
+
+                    return operation;
+                }, vector.name + " signing with wrong algorithm name");
+
+            }, function(err) {
+                // We need a failed test if the importVectorKey operation fails, so
+                // we know we never tested verification.
+                promise_test(function(test) {
+                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+                }, "importVectorKeys step: " + vector.name + " signing with wrong algorithm name");
+            });
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
+            }, "generate wrong key step: " + vector.name + " signing with wrong algorithm name");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Test verification with the wrong algorithm
+    testVectors.forEach(function(vector) {
+        // Want to get the key for the wrong algorithm
+        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
+        .then(function(wrongKey) {
+            return importVectorKeys(vector, ["verify", "sign"])
+            .then(function(vector) {
+                promise_test(function(test) {
+                    var operation = subtle.verify(operationAlgorithm(vector), wrongKey.publicKey, vector.signature, vector.plaintext)
+                    .then(function(signature) {
+                        assert_unreached("Verifying should not have succeeded for " + vector.name);
+                    }, function(err) {
+                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
+                    });
+
+                    return operation;
+                }, vector.name + " verifying with wrong algorithm name");
+
+            }, function(err) {
+                // We need a failed test if the importVectorKey operation fails, so
+                // we know we never tested verification.
+                promise_test(function(test) {
+                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+                }, "importVectorKeys step: " + vector.name + " verifying with wrong algorithm name");
+            });
+        }, function(err) {
+            promise_test(function(test) {
+                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
+            }, "generate wrong key step: " + vector.name + " verifying with wrong algorithm name");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Verification should fail if the plaintext is changed
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            var plaintext = copyBuffer(vector.plaintext);
+            plaintext[0] = 255 - plaintext[0];
+            promise_test(function(test) {
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, plaintext)
+                .then(function(is_verified) {
+                    assert_false(is_verified, "Signature is NOT verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " verification failure due to wrong plaintext");
+
+        }, function(err) {
+            // We need a failed test if the importVectorKey operation fails, so
+            // we know we never tested verification.
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong plaintext");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Verification should fail if the signature is changed
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            var signature = copyBuffer(vector.signature);
+            signature[0] = 255 - signature[0];
+            promise_test(function(test) {
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
+                .then(function(is_verified) {
+                    assert_false(is_verified, "Signature is NOT verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " verification failure due to wrong signature");
+
+        }, function(err) {
+            // We need a failed test if the importVectorKey operation fails, so
+            // we know we never tested verification.
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong signature");
+        });
+
+        all_promises.push(promise);
+    });
+
+    // Verification should fail if the signature is wrong length
+    testVectors.forEach(function(vector) {
+        var promise = importVectorKeys(vector, ["verify", "sign"])
+        .then(function(vector) {
+            var signature = vector.signature.slice(1); // Drop first byte
+            promise_test(function(test) {
+                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
+                .then(function(is_verified) {
+                    assert_false(is_verified, "Signature is NOT verified");
+                }, function(err) {
+                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                });
+
+                return operation;
+            }, vector.name + " verification failure due to short signature");
+
+        }, function(err) {
+            // We need a failed test if the importVectorKey operation fails, so
+            // we know we never tested verification.
+            promise_test(function(test) {
+                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+            }, "importVectorKeys step: " + vector.name + " verification failure due to short signature");
+        });
+
+        all_promises.push(promise);
+    });
+
+    if (options.wrongVerificationAlgorithm !== undefined) {
+        // Test verification failure due to algorithm-specific parameters.
+        testVectors.forEach(function(vector) {
+            var promise = importVectorKeys(vector, ["verify", "sign"])
+            .then(function(vector) {
+                promise_test(function(test) {
+                    var operation = subtle.verify(options.wrongVerificationAlgorithm(vector), vector.key, vector.signature, vector.plaintext)
+                    .then(function(is_verified) {
+                        assert_false(is_verified, "Signature is NOT verified with wrong length");
+                    }, function(err) {
+                        assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
+                    });
+
+                    return operation;
+                }, vector.name + " verification failure due to wrong length parameter");
+
+            }, function(err) {
+                promise_test(function(test) {
+                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
+                }, "importVectorKeys step: " + vector.name + " verification failure due to wrong length parameter");
+            });
+
+            all_promises.push(promise);
+        });
+    }
+
+
+
+    promise_test(function() {
+        return Promise.all(all_promises).finally(done);
+    }, "setup");
+
+    // A test vector has all needed fields for signing and verifying, EXCEPT that the
+    // key field may be null. This function replaces that null with the Correct
+    // CryptoKey object.
+    //
+    // Returns a Promise that yields an updated vector on success.
+    function importVectorKeys(vector, keyUsages) {
+        if (vector.key !== null) {
+            return Promise.resolve(vector);
+        } else {
+            return subtle.importKey(options.importFormat, vector.keyBuffer, options.importAlgorithm(vector), false, keyUsages)
+            .then(function(key) {
+                vector.key = key;
+                return vector;
+            });
+        }
+    }
+
+    return;
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.js
index 10879273c1c3..a2a4ef276043 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.js
@@ -1,1038 +1,10 @@
 function run_test() {
-  setup({ explicit_done: true });
-
-  var subtle = self.crypto.subtle; // Change to test prefixed implementations
-
-  // When are all these tests really done? When all the promises they use have resolved.
-  var all_promises = [];
-
-  // Source file [algorithm_name]_vectors.js provides the getTestVectors method
-  // for the algorithm that drives these tests.
-  var testVectors = getTestVectors();
-  var invalidTestVectors = getInvalidTestVectors();
-
-  // Test verification first, because signing tests rely on that working
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, vector.signature, vector.data)
-            .then(
-              function (is_verified) {
-                assert_true(is_verified, 'Signature verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' verification');
-      },
-      function (err) {
-        // We need a failed test if the importVectorKey operation fails, so
-        // we know we never tested verification.
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' + vector.name + ' verification');
-      }
-    );
-
-    all_promises.push(promise);
+  runSignatureTests({
+    vectors: getTestVectors(),
+    invalidVectors: getInvalidTestVectors(),
+    algorithmIdentifier(vector) {
+      return vector.algorithmName;
+    },
+    dataLabel: 'plaintext',
   });
-
-  // Test verification with an altered buffer during call
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        promise_test(function (test) {
-          var signature = copyBuffer(vector.signature);
-          signature[0] = 255 - signature[0];
-          var operation = subtle
-            .verify(
-              {
-                get name() {
-                  signature[0] = vector.signature[0];
-                  return vector.algorithmName;
-                },
-              },
-              vector.publicKey,
-              signature,
-              vector.data
-            )
-            .then(
-              function (is_verified) {
-                assert_true(is_verified, 'Signature verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' verification with altered signature during call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' verification with altered signature during call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Test verification with an altered buffer after call
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          var signature = copyBuffer(vector.signature);
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, signature, vector.data)
-            .then(
-              function (is_verified) {
-                assert_true(is_verified, 'Signature verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          signature[0] = 255 - signature[0];
-          return operation;
-        }, vector.name + ' verification with altered signature after call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' verification with altered signature after call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Test verification with a transferred buffer during call
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        promise_test(function (test) {
-          var signature = copyBuffer(vector.signature);
-          var operation = subtle
-            .verify(
-              {
-                get name() {
-                  signature.buffer.transfer();
-                  return vector.algorithmName;
-                },
-              },
-              vector.publicKey,
-              signature,
-              vector.data
-            )
-            .then(
-              function (is_verified) {
-                assert_false(is_verified, 'Signature is NOT verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' verification with transferred signature during call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' verification with transferred signature during call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Test verification with a transferred buffer after call
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          var signature = copyBuffer(vector.signature);
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, signature, vector.data)
-            .then(
-              function (is_verified) {
-                assert_true(is_verified, 'Signature verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          signature.buffer.transfer();
-          return operation;
-        }, vector.name + ' verification with transferred signature after call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' verification with transferred signature after call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for successful verification even if plaintext is altered during call.
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        promise_test(function (test) {
-          var plaintext = copyBuffer(vector.data);
-          plaintext[0] = 255 - plaintext[0];
-          var operation = subtle
-            .verify(
-              {
-                get name() {
-                  plaintext[0] = vector.data[0];
-                  return vector.algorithmName;
-                },
-              },
-              vector.publicKey,
-              vector.signature,
-              plaintext
-            )
-            .then(
-              function (is_verified) {
-                assert_true(is_verified, 'Signature verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' with altered plaintext during call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' with altered plaintext during call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for successful verification even if plaintext is altered after call.
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          var plaintext = copyBuffer(vector.data);
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, vector.signature, plaintext)
-            .then(
-              function (is_verified) {
-                assert_true(is_verified, 'Signature verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          plaintext[0] = 255 - plaintext[0];
-          return operation;
-        }, vector.name + ' with altered plaintext after call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' with altered plaintext after call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for failed verification if plaintext is transferred during call.
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        promise_test(function (test) {
-          var plaintext = copyBuffer(vector.data);
-          var operation = subtle
-            .verify(
-              {
-                get name() {
-                  plaintext.buffer.transfer();
-                  return vector.algorithmName;
-                },
-              },
-              vector.publicKey,
-              vector.signature,
-              plaintext
-            )
-            .then(
-              function (is_verified) {
-                assert_false(is_verified, 'Signature is NOT verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' with transferred plaintext during call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' with transferred plaintext during call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for successful verification even if plaintext is transferred after call.
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          var plaintext = copyBuffer(vector.data);
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, vector.signature, plaintext)
-            .then(
-              function (is_verified) {
-                assert_true(is_verified, 'Signature verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          plaintext.buffer.transfer();
-          return operation;
-        }, vector.name + ' with transferred plaintext after call');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' with transferred plaintext after call');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for failures due to using privateKey to verify.
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          return subtle
-            .verify(algorithm, vector.privateKey, vector.signature, vector.data)
-            .then(
-              function (plaintext) {
-                assert_unreached(
-                  'Should have thrown error for using privateKey to verify in ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              },
-              function (err) {
-                assert_equals(
-                  err.name,
-                  'InvalidAccessError',
-                  "Should throw InvalidAccessError instead of '" +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-        }, vector.name + ' using privateKey to verify');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' using privateKey to verify');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for failures due to using publicKey to sign.
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          return subtle.sign(algorithm, vector.publicKey, vector.data).then(
-            function (signature) {
-              assert_unreached(
-                'Should have thrown error for using publicKey to sign in ' +
-                  vector.name +
-                  ': ' +
-                  err.message +
-                  "'"
-              );
-            },
-            function (err) {
-              assert_equals(
-                err.name,
-                'InvalidAccessError',
-                "Should throw InvalidAccessError instead of '" +
-                  err.message +
-                  "'"
-              );
-            }
-          );
-        }, vector.name + ' using publicKey to sign');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' using publicKey to sign');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for failures due to no "verify" usage.
-  testVectors.forEach(function (originalVector) {
-    var vector = Object.assign({}, originalVector);
-
-    var promise = importVectorKeys(vector, [], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          return subtle
-            .verify(algorithm, vector.publicKey, vector.signature, vector.data)
-            .then(
-              function (plaintext) {
-                assert_unreached(
-                  'Should have thrown error for no verify usage in ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              },
-              function (err) {
-                assert_equals(
-                  err.name,
-                  'InvalidAccessError',
-                  "Should throw InvalidAccessError instead of '" +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-        }, vector.name + ' no verify usage');
-      },
-      function (err) {
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' + vector.name + ' no verify usage');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Check for successful signing and verification.
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          return subtle.sign(algorithm, vector.privateKey, vector.data).then(
-            function (signature) {
-              // Can we verify the signature?
-              return subtle
-                .verify(algorithm, vector.publicKey, signature, vector.data)
-                .then(
-                  function (is_verified) {
-                    assert_true(is_verified, 'Round trip verification works');
-                    return signature;
-                  },
-                  function (err) {
-                    assert_unreached(
-                      'verify error for test ' +
-                        vector.name +
-                        ': ' +
-                        err.message +
-                        "'"
-                    );
-                  }
-                );
-            },
-            function (err) {
-              assert_unreached(
-                'sign error for test ' + vector.name + ": '" + err.message + "'"
-              );
-            }
-          );
-        }, vector.name + ' round trip');
-      },
-      function (err) {
-        // We need a failed test if the importVectorKey operation fails, so
-        // we know we never tested signing or verifying
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' + vector.name + ' round trip');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Test signing with the wrong algorithm
-  testVectors.forEach(function (vector) {
-    // Want to get the key for the wrong algorithm
-    var promise = subtle
-      .generateKey({ name: 'HMAC', hash: 'SHA-1' }, false, ['sign', 'verify'])
-      .then(
-        function (wrongKey) {
-          var algorithm = vector.algorithmName;
-          return importVectorKeys(vector, ['verify'], ['sign']).then(
-            function (vectors) {
-              promise_test(function (test) {
-                var operation = subtle
-                  .sign(algorithm, wrongKey, vector.data)
-                  .then(
-                    function (signature) {
-                      assert_unreached(
-                        'Signing should not have succeeded for ' + vector.name
-                      );
-                    },
-                    function (err) {
-                      assert_equals(
-                        err.name,
-                        'InvalidAccessError',
-                        "Should have thrown InvalidAccessError instead of '" +
-                          err.message +
-                          "'"
-                      );
-                    }
-                  );
-
-                return operation;
-              }, vector.name + ' signing with wrong algorithm name');
-            },
-            function (err) {
-              // We need a failed test if the importVectorKey operation fails, so
-              // we know we never tested verification.
-              promise_test(function (test) {
-                assert_unreached(
-                  'importVectorKeys failed for ' +
-                    vector.name +
-                    ". Message: ''" +
-                    err.message +
-                    "''"
-                );
-              }, 'importVectorKeys step: ' +
-                vector.name +
-                ' signing with wrong algorithm name');
-            }
-          );
-        },
-        function (err) {
-          promise_test(function (test) {
-            assert_unreached(
-              'Generate wrong key for test ' +
-                vector.name +
-                " failed: '" +
-                err.message +
-                "'"
-            );
-          }, 'generate wrong key step: ' +
-            vector.name +
-            ' signing with wrong algorithm name');
-        }
-      );
-
-    all_promises.push(promise);
-  });
-
-  // Test verification with the wrong algorithm
-  testVectors.forEach(function (vector) {
-    // Want to get the key for the wrong algorithm
-    var promise = subtle
-      .generateKey({ name: 'HMAC', hash: 'SHA-1' }, false, ['sign', 'verify'])
-      .then(
-        function (wrongKey) {
-          return importVectorKeys(vector, ['verify'], ['sign']).then(
-            function (vectors) {
-              var algorithm = vector.algorithmName;
-              promise_test(function (test) {
-                var operation = subtle
-                  .verify(algorithm, wrongKey, vector.signature, vector.data)
-                  .then(
-                    function (signature) {
-                      assert_unreached(
-                        'Verifying should not have succeeded for ' + vector.name
-                      );
-                    },
-                    function (err) {
-                      assert_equals(
-                        err.name,
-                        'InvalidAccessError',
-                        "Should have thrown InvalidAccessError instead of '" +
-                          err.message +
-                          "'"
-                      );
-                    }
-                  );
-
-                return operation;
-              }, vector.name + ' verifying with wrong algorithm name');
-            },
-            function (err) {
-              // We need a failed test if the importVectorKey operation fails, so
-              // we know we never tested verification.
-              promise_test(function (test) {
-                assert_unreached(
-                  'importVectorKeys failed for ' +
-                    vector.name +
-                    ". Message: ''" +
-                    err.message +
-                    "''"
-                );
-              }, 'importVectorKeys step: ' +
-                vector.name +
-                ' verifying with wrong algorithm name');
-            }
-          );
-        },
-        function (err) {
-          promise_test(function (test) {
-            assert_unreached(
-              'Generate wrong key for test ' +
-                vector.name +
-                " failed: '" +
-                err.message +
-                "'"
-            );
-          }, 'generate wrong key step: ' +
-            vector.name +
-            ' verifying with wrong algorithm name');
-        }
-      );
-
-    all_promises.push(promise);
-  });
-
-  // Test verification fails with wrong signature
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        var signature = copyBuffer(vector.signature);
-        signature[0] = 255 - signature[0];
-        promise_test(function (test) {
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, signature, vector.data)
-            .then(
-              function (is_verified) {
-                assert_false(is_verified, 'Signature NOT verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' verification failure due to altered signature');
-      },
-      function (err) {
-        // We need a failed test if the importVectorKey operation fails, so
-        // we know we never tested verification.
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' verification failure due to altered signature');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Test verification fails with short (odd length) signature
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        var signature = vector.signature.slice(1); // Skip the first byte
-        promise_test(function (test) {
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, signature, vector.data)
-            .then(
-              function (is_verified) {
-                assert_false(is_verified, 'Signature NOT verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' verification failure due to shortened signature');
-      },
-      function (err) {
-        // We need a failed test if the importVectorKey operation fails, so
-        // we know we never tested verification.
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' verification failure due to shortened signature');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Test verification fails with wrong plaintext
-  testVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        var plaintext = copyBuffer(vector.data);
-        plaintext[0] = 255 - plaintext[0];
-        promise_test(function (test) {
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, vector.signature, plaintext)
-            .then(
-              function (is_verified) {
-                assert_false(is_verified, 'Signature NOT verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' verification failure due to altered plaintext');
-      },
-      function (err) {
-        // We need a failed test if the importVectorKey operation fails, so
-        // we know we never tested verification.
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' +
-          vector.name +
-          ' verification failure due to altered plaintext');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  // Test invalid signatures
-  invalidTestVectors.forEach(function (vector) {
-    var promise = importVectorKeys(vector, ['verify'], ['sign']).then(
-      function (vectors) {
-        var algorithm = vector.algorithmName;
-        promise_test(function (test) {
-          var operation = subtle
-            .verify(algorithm, vector.publicKey, vector.signature, vector.data)
-            .then(
-              function (is_verified) {
-                assert_false(is_verified, 'Signature unexpectedly verified');
-              },
-              function (err) {
-                assert_unreached(
-                  'Verification should not throw error ' +
-                    vector.name +
-                    ': ' +
-                    err.message +
-                    "'"
-                );
-              }
-            );
-
-          return operation;
-        }, vector.name + ' verification');
-      },
-      function (err) {
-        // We need a failed test if the importVectorKey operation fails, so
-        // we know we never tested verification.
-        promise_test(function (test) {
-          assert_unreached(
-            'importVectorKeys failed for ' +
-              vector.name +
-              ". Message: ''" +
-              err.message +
-              "''"
-          );
-        }, 'importVectorKeys step: ' + vector.name + ' verification');
-      }
-    );
-
-    all_promises.push(promise);
-  });
-
-  promise_test(function () {
-    return Promise.all(all_promises)
-      .then(function () {
-        done();
-      })
-      .catch(function () {
-        done();
-      });
-  }, 'setup');
-
-  // A test vector has all needed fields for signing and verifying, EXCEPT that the
-  // key field may be null. This function replaces that null with the Correct
-  // CryptoKey object.
-  //
-  // Returns a Promise that yields an updated vector on success.
-  function importVectorKeys(vector, publicKeyUsages, privateKeyUsages) {
-    var publicPromise, privatePromise;
-
-    if (vector.publicKey !== null) {
-      publicPromise = new Promise(function (resolve, reject) {
-        resolve(vector);
-      });
-    } else {
-      publicPromise = subtle
-        .importKey(
-          vector.publicKeyFormat,
-          vector.publicKeyBuffer,
-          { name: vector.algorithmName },
-          false,
-          publicKeyUsages
-        )
-        .then(function (key) {
-          vector.publicKey = key;
-          return vector;
-        }); // Returns a copy of the sourceBuffer it is sent.
-    }
-
-    if (vector.privateKey !== null) {
-      privatePromise = new Promise(function (resolve, reject) {
-        resolve(vector);
-      });
-    } else {
-      privatePromise = subtle
-        .importKey(
-          vector.privateKeyFormat,
-          vector.privateKeyBuffer,
-          { name: vector.algorithmName },
-          false,
-          privateKeyUsages
-        )
-        .then(function (key) {
-          vector.privateKey = key;
-          return vector;
-        });
-    }
-
-    return Promise.all([publicPromise, privatePromise]);
-  }
-
-  return;
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.tentative.https.any.js
index be336b349846..253cc85e258f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa.tentative.https.any.js
@@ -1,6 +1,8 @@
 // META: title=WebCryptoAPI: sign() and verify() Using ML-DSA
 // META: script=../util/helpers.js
+// META: script=../util/mldsa_key_fixtures.js
 // META: script=mldsa_vectors.js
+// META: script=signature.js
 // META: script=mldsa.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa_vectors.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa_vectors.js
index a035821b7e35..021060a1f35b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/mldsa_vectors.js
@@ -1,393 +1,4 @@
-// PKCS#8 private keys for ML-DSA variants
-var pkcs8 = {
-  'ML-DSA-44': new Uint8Array([
-    48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 17, 4, 34, 128,
-    32, 153, 21, 95, 99, 48, 150, 218, 124, 190, 8, 122, 137, 72, 184, 79, 118,
-    123, 16, 249, 1, 200, 35, 194, 64, 177, 221, 43, 200, 112, 5, 201, 62,
-  ]),
-  'ML-DSA-65': new Uint8Array([
-    48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 18, 4, 34, 128,
-    32, 132, 164, 137, 75, 123, 70, 164, 178, 3, 156, 206, 16, 195, 26, 133,
-    186, 176, 195, 102, 48, 254, 35, 29, 66, 103, 17, 67, 152, 38, 7, 130, 139,
-  ]),
-  'ML-DSA-87': new Uint8Array([
-    48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 19, 4, 34, 128,
-    32, 161, 80, 109, 145, 76, 109, 101, 140, 117, 39, 228, 51, 151, 221, 109,
-    76, 37, 246, 164, 121, 116, 51, 90, 76, 208, 59, 254, 105, 131, 68, 18, 81,
-  ]),
-};
-
-// SPKI public keys for ML-DSA variants
-var spki = {
-  'ML-DSA-44': new Uint8Array([
-    48, 130, 5, 50, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 17, 3, 130, 5,
-    33, 0, 85, 152, 213, 68, 198, 20, 177, 84, 200, 188, 33, 104, 36, 161, 193,
-    127, 226, 151, 48, 107, 122, 191, 89, 86, 188, 3, 245, 199, 18, 79, 168,
-    192, 218, 218, 223, 227, 84, 133, 41, 187, 9, 183, 14, 222, 155, 137, 84,
-    111, 138, 97, 234, 152, 52, 15, 163, 47, 227, 218, 19, 20, 229, 93, 99, 252,
-    155, 213, 30, 241, 158, 211, 213, 191, 155, 73, 211, 145, 59, 194, 75, 140,
-    3, 161, 149, 139, 48, 172, 155, 172, 120, 234, 142, 79, 78, 116, 215, 184,
-    50, 182, 162, 192, 93, 221, 179, 216, 70, 186, 92, 93, 51, 190, 61, 173,
-    105, 206, 9, 208, 52, 54, 208, 252, 115, 176, 146, 118, 23, 0, 5, 41, 151,
-    121, 241, 246, 193, 206, 212, 160, 181, 7, 99, 220, 78, 96, 123, 142, 35,
-    107, 37, 218, 138, 139, 228, 207, 166, 132, 87, 36, 116, 251, 174, 10, 41,
-    196, 171, 26, 212, 90, 213, 223, 141, 87, 232, 59, 46, 173, 16, 247, 173, 4,
-    219, 165, 234, 8, 217, 233, 163, 13, 10, 160, 22, 87, 232, 2, 9, 92, 177,
-    35, 67, 55, 104, 51, 204, 231, 81, 209, 62, 31, 117, 56, 141, 78, 109, 148,
-    118, 191, 93, 193, 59, 30, 88, 237, 19, 169, 14, 11, 150, 102, 215, 144, 69,
-    246, 32, 159, 110, 49, 75, 78, 225, 121, 184, 206, 234, 126, 171, 164, 43,
-    237, 244, 63, 83, 70, 136, 213, 244, 121, 184, 34, 201, 249, 95, 64, 165,
-    99, 14, 195, 231, 18, 121, 20, 156, 80, 231, 133, 197, 0, 94, 195, 22, 251,
-    255, 174, 213, 103, 75, 88, 58, 138, 66, 37, 85, 162, 15, 242, 29, 49, 147,
-    191, 163, 170, 109, 195, 22, 63, 197, 149, 117, 100, 36, 81, 115, 203, 126,
-    62, 86, 103, 193, 182, 69, 238, 233, 162, 62, 248, 132, 158, 212, 208, 187,
-    127, 212, 198, 169, 245, 26, 153, 28, 207, 85, 65, 145, 200, 23, 196, 38,
-    64, 49, 54, 233, 185, 72, 156, 86, 230, 127, 152, 108, 184, 240, 109, 8,
-    103, 228, 206, 142, 73, 74, 214, 52, 182, 203, 82, 201, 175, 188, 111, 42,
-    232, 8, 177, 131, 47, 237, 92, 120, 210, 124, 48, 185, 215, 137, 36, 70,
-    162, 164, 119, 0, 155, 20, 57, 33, 27, 220, 77, 254, 233, 190, 106, 135, 21,
-    194, 57, 238, 95, 162, 78, 164, 33, 210, 215, 43, 100, 96, 232, 87, 19, 43,
-    65, 240, 183, 17, 131, 247, 97, 241, 7, 111, 159, 40, 252, 45, 228, 76, 71,
-    46, 85, 181, 54, 41, 135, 162, 144, 227, 128, 121, 173, 207, 119, 54, 19,
-    197, 23, 231, 176, 125, 190, 32, 76, 60, 34, 24, 160, 42, 73, 190, 124, 99,
-    5, 9, 214, 6, 220, 177, 206, 79, 222, 10, 142, 250, 63, 179, 67, 21, 159,
-    57, 126, 239, 28, 238, 240, 107, 79, 185, 174, 232, 168, 146, 128, 229, 119,
-    19, 21, 33, 239, 193, 42, 178, 152, 124, 24, 203, 131, 193, 93, 162, 2, 208,
-    231, 20, 203, 232, 47, 54, 114, 255, 236, 97, 99, 156, 15, 160, 75, 60, 111,
-    59, 35, 25, 230, 43, 91, 170, 161, 74, 70, 179, 180, 251, 71, 197, 240, 104,
-    42, 39, 202, 206, 12, 115, 249, 138, 55, 252, 216, 61, 185, 121, 76, 137,
-    172, 166, 88, 92, 130, 18, 52, 67, 13, 187, 49, 147, 212, 77, 74, 56, 59,
-    123, 99, 205, 36, 137, 96, 111, 148, 121, 157, 2, 83, 246, 86, 156, 152, 98,
-    172, 77, 244, 214, 225, 184, 240, 121, 144, 56, 213, 161, 43, 67, 4, 161,
-    104, 202, 91, 134, 247, 108, 24, 46, 187, 63, 216, 50, 125, 120, 17, 216,
-    22, 228, 156, 253, 7, 180, 15, 130, 180, 72, 71, 169, 3, 236, 247, 11, 170,
-    32, 76, 236, 225, 133, 250, 20, 235, 200, 143, 89, 25, 158, 49, 158, 164,
-    213, 221, 81, 120, 241, 150, 210, 19, 79, 165, 24, 35, 170, 182, 242, 255,
-    143, 171, 148, 140, 41, 207, 186, 98, 224, 16, 152, 224, 38, 110, 175, 169,
-    111, 132, 201, 178, 114, 25, 196, 50, 149, 158, 193, 180, 101, 183, 92, 109,
-    131, 102, 119, 123, 78, 107, 223, 4, 1, 206, 140, 130, 237, 205, 36, 18,
-    180, 197, 154, 26, 236, 140, 173, 230, 101, 35, 189, 121, 104, 21, 75, 81,
-    224, 186, 212, 81, 107, 66, 244, 235, 64, 90, 206, 39, 44, 43, 162, 187, 63,
-    229, 217, 154, 185, 157, 24, 125, 252, 91, 136, 59, 47, 182, 200, 73, 19,
-    137, 132, 81, 16, 234, 227, 210, 32, 16, 160, 188, 250, 27, 190, 164, 53,
-    244, 219, 199, 177, 146, 117, 50, 99, 72, 235, 37, 154, 72, 51, 203, 61, 39,
-    230, 34, 132, 117, 217, 167, 201, 42, 17, 76, 72, 103, 172, 93, 169, 29, 76,
-    88, 178, 226, 32, 53, 190, 60, 210, 132, 113, 198, 26, 70, 179, 47, 34, 184,
-    88, 178, 208, 1, 196, 89, 136, 167, 33, 38, 9, 255, 89, 202, 27, 93, 229,
-    100, 192, 24, 234, 200, 186, 125, 231, 212, 188, 11, 29, 51, 189, 70, 147,
-    176, 231, 81, 16, 114, 152, 159, 21, 124, 185, 208, 50, 74, 211, 113, 207,
-    35, 54, 173, 205, 133, 52, 167, 199, 87, 158, 120, 33, 204, 163, 146, 233,
-    21, 61, 28, 102, 48, 232, 184, 15, 219, 238, 240, 215, 222, 239, 3, 110,
-    180, 95, 103, 147, 236, 10, 57, 195, 159, 231, 50, 92, 145, 165, 44, 204,
-    121, 187, 9, 210, 80, 86, 251, 169, 132, 236, 248, 23, 207, 222, 227, 13,
-    53, 1, 88, 69, 105, 13, 238, 202, 251, 194, 245, 14, 38, 1, 245, 157, 212,
-    162, 182, 217, 230, 115, 139, 175, 219, 199, 74, 124, 186, 158, 3, 220, 87,
-    220, 177, 85, 13, 58, 168, 223, 6, 238, 156, 80, 121, 44, 166, 176, 0, 48,
-    98, 70, 93, 78, 50, 192, 16, 186, 2, 233, 105, 105, 120, 195, 17, 100, 141,
-    214, 158, 144, 63, 4, 88, 190, 101, 209, 55, 119, 46, 128, 117, 225, 121,
-    204, 195, 19, 61, 170, 116, 251, 225, 230, 28, 27, 249, 84, 195, 224, 190,
-    60, 212, 83, 3, 148, 204, 4, 103, 50, 233, 175, 207, 47, 51, 216, 79, 251,
-    150, 81, 171, 7, 145, 55, 188, 187, 217, 200, 155, 246, 85, 42, 123, 18,
-    112, 192, 116, 163, 40, 187, 132, 192, 210, 188, 106, 117, 217, 185, 183,
-    202, 33, 11, 205, 10, 61, 52, 15, 66, 131, 121, 112, 26, 96, 166, 241, 1,
-    68, 206, 80, 92, 132, 83, 89, 126, 135, 157, 4, 202, 16, 5, 131, 112, 62,
-    56, 234, 176, 213, 119, 205, 203, 17, 106, 156, 117, 251, 135, 21, 73, 219,
-    238, 3, 88, 21, 71, 136, 118, 0, 7, 106, 151, 200, 221, 179, 206, 50, 198,
-    27, 118, 181, 27, 85, 35, 248, 44, 57, 15, 221, 97, 121, 4, 167, 111, 182,
-    207, 195, 52, 134, 195, 128, 173, 111, 98, 152, 29, 138, 197, 175, 171, 247,
-    194, 20, 134, 209, 232, 94, 17, 203, 139, 30, 237, 187, 243, 16, 180, 43,
-    105, 236, 66, 175, 170, 139, 24, 99, 28, 225, 141, 96, 250, 119, 0, 111,
-    212, 34, 217, 42, 134, 88, 78, 76, 126, 169, 168, 59, 154, 93, 54, 43, 161,
-    29, 111, 124, 59, 225, 52, 86, 147, 38, 151, 161, 36, 119, 204, 164, 121,
-    46, 186, 65, 84, 70, 38, 15, 203, 48, 168, 235, 231, 30, 55, 95, 36, 10, 20,
-    166, 109, 8, 18, 109, 251, 213, 82, 142, 240, 49, 249, 180, 78, 69,
-  ]),
-  'ML-DSA-65': new Uint8Array([
-    48, 130, 7, 178, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 18, 3, 130, 7,
-    161, 0, 216, 177, 233, 60, 151, 24, 246, 66, 175, 161, 192, 118, 9, 177, 87,
-    232, 5, 216, 49, 254, 251, 160, 51, 216, 250, 171, 229, 104, 149, 117, 135,
-    107, 5, 239, 244, 167, 83, 57, 49, 153, 29, 135, 108, 138, 117, 236, 120,
-    65, 89, 65, 17, 201, 127, 147, 246, 103, 238, 204, 25, 83, 240, 29, 173,
-    127, 140, 1, 88, 40, 43, 134, 51, 19, 125, 131, 224, 50, 167, 82, 20, 217,
-    215, 162, 41, 95, 215, 56, 130, 226, 177, 216, 20, 169, 133, 85, 140, 9,
-    105, 172, 54, 121, 0, 87, 202, 18, 93, 96, 147, 103, 127, 164, 63, 197, 97,
-    49, 230, 125, 53, 80, 64, 20, 239, 29, 90, 118, 102, 221, 177, 6, 220, 220,
-    170, 107, 107, 18, 138, 125, 138, 70, 66, 60, 185, 232, 209, 4, 100, 17,
-    118, 24, 181, 110, 241, 50, 250, 138, 209, 19, 84, 220, 61, 96, 80, 128, 81,
-    101, 160, 9, 5, 53, 33, 112, 60, 59, 195, 79, 115, 190, 101, 93, 56, 171,
-    146, 51, 82, 233, 66, 225, 226, 211, 72, 58, 9, 74, 222, 185, 175, 211, 156,
-    164, 68, 188, 119, 46, 14, 64, 160, 13, 207, 60, 81, 68, 108, 148, 59, 88,
-    88, 92, 88, 171, 249, 204, 160, 137, 222, 234, 168, 233, 3, 86, 224, 174,
-    105, 224, 1, 177, 184, 230, 236, 30, 85, 249, 56, 105, 211, 50, 83, 168,
-    139, 28, 175, 181, 22, 89, 166, 215, 152, 218, 184, 111, 65, 24, 82, 71,
-    185, 100, 172, 66, 178, 6, 215, 164, 252, 56, 40, 198, 207, 152, 110, 186,
-    207, 39, 235, 179, 38, 215, 88, 105, 109, 177, 130, 91, 5, 223, 164, 78,
-    241, 176, 125, 197, 94, 100, 40, 214, 251, 239, 253, 88, 154, 14, 75, 254,
-    94, 210, 86, 244, 51, 95, 168, 139, 213, 73, 87, 151, 209, 150, 126, 88, 69,
-    251, 116, 157, 122, 96, 212, 206, 42, 218, 38, 85, 184, 50, 246, 188, 35,
-    72, 60, 226, 155, 246, 86, 209, 110, 133, 161, 129, 126, 80, 154, 238, 64,
-    64, 170, 156, 177, 225, 52, 87, 42, 88, 154, 174, 246, 30, 84, 143, 221, 51,
-    27, 65, 60, 40, 22, 120, 42, 145, 34, 82, 235, 79, 20, 215, 211, 231, 151,
-    108, 119, 53, 116, 190, 13, 139, 199, 189, 84, 54, 186, 222, 90, 116, 253,
-    227, 207, 104, 209, 118, 42, 144, 94, 22, 219, 198, 211, 216, 171, 75, 245,
-    61, 240, 157, 108, 81, 19, 238, 39, 120, 210, 242, 63, 126, 6, 15, 18, 97,
-    232, 207, 184, 84, 239, 72, 115, 90, 95, 112, 78, 45, 201, 13, 102, 208,
-    151, 146, 253, 153, 177, 115, 14, 194, 184, 107, 118, 120, 63, 105, 89, 144,
-    60, 242, 80, 106, 32, 11, 204, 170, 165, 221, 182, 31, 187, 159, 216, 118,
-    218, 207, 182, 107, 136, 211, 162, 231, 196, 128, 83, 251, 192, 189, 149, 1,
-    245, 36, 146, 159, 11, 116, 30, 191, 141, 182, 157, 227, 91, 88, 72, 224,
-    55, 195, 96, 245, 135, 249, 142, 16, 229, 237, 27, 60, 2, 91, 138, 82, 197,
-    210, 40, 8, 123, 172, 202, 207, 119, 199, 190, 102, 40, 141, 174, 93, 211,
-    219, 134, 105, 26, 103, 100, 102, 62, 130, 224, 135, 173, 82, 224, 200, 213,
-    76, 211, 38, 181, 16, 97, 99, 75, 14, 42, 162, 223, 237, 141, 1, 29, 140,
-    191, 146, 49, 236, 179, 88, 202, 220, 124, 239, 231, 131, 101, 134, 111, 28,
-    54, 151, 172, 67, 167, 113, 96, 204, 63, 76, 169, 95, 14, 175, 149, 189,
-    173, 39, 177, 102, 23, 158, 102, 236, 224, 70, 203, 190, 132, 230, 136, 3,
-    28, 201, 131, 148, 164, 219, 181, 208, 26, 239, 111, 86, 35, 102, 133, 114,
-    113, 180, 184, 82, 180, 106, 124, 248, 126, 87, 177, 165, 176, 204, 128,
-    141, 179, 141, 34, 119, 160, 57, 206, 168, 95, 197, 110, 79, 60, 48, 170,
-    125, 206, 147, 137, 156, 85, 46, 7, 193, 228, 150, 22, 46, 147, 51, 153,
-    157, 248, 151, 253, 114, 58, 126, 38, 127, 19, 225, 99, 183, 235, 175, 90,
-    166, 8, 233, 141, 10, 85, 232, 147, 7, 20, 137, 240, 84, 231, 86, 134, 50,
-    212, 201, 6, 253, 18, 150, 114, 160, 140, 2, 254, 189, 152, 14, 68, 110, 50,
-    134, 199, 73, 237, 56, 116, 110, 135, 36, 40, 14, 167, 50, 71, 81, 9, 178,
-    54, 182, 247, 64, 32, 204, 116, 92, 131, 40, 30, 246, 188, 236, 182, 187,
-    132, 239, 124, 136, 238, 146, 137, 247, 87, 52, 15, 78, 108, 135, 178, 101,
-    70, 199, 193, 192, 144, 196, 106, 186, 141, 42, 101, 214, 196, 67, 175, 38,
-    8, 189, 148, 166, 253, 221, 144, 119, 81, 1, 232, 175, 81, 237, 13, 188,
-    220, 230, 47, 115, 184, 179, 0, 51, 118, 39, 22, 114, 232, 88, 15, 121, 216,
-    130, 107, 173, 108, 175, 225, 113, 40, 223, 185, 6, 244, 227, 73, 38, 64,
-    84, 10, 200, 53, 81, 179, 217, 106, 172, 59, 161, 70, 180, 70, 48, 56, 46,
-    233, 133, 245, 57, 120, 154, 167, 49, 109, 188, 152, 245, 181, 1, 159, 247,
-    44, 167, 152, 6, 191, 246, 38, 120, 141, 57, 241, 168, 60, 38, 6, 82, 248,
-    87, 85, 0, 10, 22, 19, 44, 178, 63, 38, 78, 1, 210, 166, 140, 3, 199, 112,
-    135, 155, 36, 13, 204, 124, 47, 5, 190, 103, 91, 205, 147, 248, 115, 177,
-    196, 180, 234, 85, 35, 24, 182, 16, 207, 107, 167, 10, 54, 193, 146, 71, 95,
-    45, 109, 184, 43, 101, 155, 184, 55, 171, 196, 136, 89, 227, 84, 183, 31, 0,
-    137, 230, 146, 250, 6, 27, 225, 241, 11, 95, 124, 248, 133, 171, 149, 67,
-    73, 19, 110, 104, 173, 86, 6, 246, 195, 196, 200, 175, 53, 18, 198, 223,
-    140, 85, 208, 253, 204, 220, 255, 232, 88, 238, 20, 97, 24, 52, 13, 3, 179,
-    62, 151, 101, 67, 33, 79, 253, 157, 253, 233, 197, 109, 130, 78, 11, 165,
-    214, 200, 41, 157, 63, 46, 175, 251, 246, 225, 227, 199, 92, 107, 216, 58,
-    124, 226, 202, 153, 92, 31, 250, 182, 92, 99, 0, 110, 18, 78, 228, 166, 190,
-    67, 88, 245, 155, 139, 82, 152, 39, 204, 74, 140, 95, 82, 82, 160, 147, 144,
-    33, 0, 242, 200, 22, 102, 160, 233, 102, 224, 42, 205, 240, 56, 95, 197,
-    226, 175, 235, 240, 125, 10, 51, 12, 246, 150, 234, 173, 95, 132, 173, 174,
-    1, 161, 23, 39, 52, 168, 87, 54, 4, 66, 201, 34, 155, 82, 133, 170, 76, 52,
-    226, 109, 163, 19, 34, 184, 226, 39, 20, 75, 72, 201, 70, 188, 71, 182, 230,
-    6, 19, 255, 8, 145, 193, 63, 81, 150, 24, 72, 89, 168, 74, 98, 173, 133, 67,
-    227, 44, 252, 252, 227, 192, 125, 20, 227, 144, 24, 31, 48, 67, 67, 48, 94,
-    163, 52, 219, 163, 225, 214, 214, 109, 211, 122, 213, 198, 90, 204, 40, 97,
-    211, 121, 17, 28, 132, 246, 110, 230, 51, 197, 42, 162, 143, 199, 158, 215,
-    210, 133, 60, 65, 127, 1, 153, 193, 22, 171, 250, 114, 204, 246, 255, 126,
-    25, 96, 44, 164, 102, 172, 211, 23, 245, 122, 48, 221, 249, 138, 148, 134,
-    206, 135, 246, 42, 235, 198, 89, 189, 45, 125, 204, 69, 193, 48, 29, 144,
-    125, 224, 127, 66, 1, 134, 141, 224, 211, 193, 141, 69, 128, 75, 167, 244,
-    160, 120, 54, 191, 214, 29, 40, 249, 15, 46, 68, 141, 91, 242, 91, 80, 252,
-    109, 122, 154, 64, 153, 56, 65, 254, 106, 18, 4, 172, 171, 136, 80, 98, 79,
-    133, 255, 4, 100, 191, 144, 171, 219, 46, 132, 181, 130, 228, 107, 68, 32,
-    123, 201, 17, 67, 35, 144, 180, 160, 30, 125, 9, 55, 184, 172, 0, 159, 250,
-    232, 83, 168, 162, 102, 158, 121, 208, 177, 116, 163, 160, 80, 241, 46, 156,
-    58, 203, 240, 67, 176, 244, 170, 160, 115, 122, 141, 154, 101, 218, 178,
-    119, 130, 195, 32, 207, 51, 149, 98, 51, 219, 57, 121, 216, 156, 101, 218,
-    184, 220, 204, 41, 181, 149, 63, 80, 194, 11, 143, 164, 219, 23, 123, 141,
-    119, 43, 94, 78, 175, 89, 165, 48, 167, 44, 45, 219, 197, 15, 202, 118, 116,
-    245, 151, 218, 14, 199, 96, 27, 102, 206, 198, 123, 222, 178, 210, 20, 200,
-    38, 25, 124, 58, 102, 92, 197, 107, 51, 5, 236, 125, 173, 198, 113, 144,
-    108, 177, 22, 104, 223, 165, 39, 9, 84, 87, 124, 80, 153, 8, 212, 76, 2, 28,
-    12, 90, 212, 129, 148, 212, 229, 63, 29, 200, 113, 171, 154, 107, 189, 202,
-    22, 147, 7, 32, 253, 70, 37, 224, 98, 199, 129, 21, 54, 49, 52, 124, 84, 40,
-    190, 194, 108, 73, 26, 15, 124, 87, 87, 198, 217, 122, 127, 82, 167, 131,
-    59, 8, 172, 49, 162, 61, 64, 79, 196, 205, 65, 110, 75, 130, 128, 197, 182,
-    251, 110, 141, 197, 184, 166, 244, 246, 217, 20, 105, 85, 42, 80, 251, 77,
-    59, 204, 247, 179, 218, 181, 124, 209, 4, 28, 118, 234, 145, 237, 140, 106,
-    54, 88, 82, 28, 235, 68, 221, 109, 139, 11, 166, 182, 63, 142, 194, 255,
-    213, 219, 116, 158, 31, 224, 119, 126, 232, 160, 144, 1, 177, 92, 219, 162,
-    49, 181, 116, 163, 104, 245, 193, 188, 26, 172, 15, 190, 135, 207, 106, 246,
-    13, 132, 76, 189, 160, 25, 123, 26, 20, 48, 203, 59, 209, 69, 235, 103, 253,
-    160, 108, 83, 206, 70, 98, 0, 2, 57, 162, 202, 63, 45, 89, 173, 201, 254,
-    254, 253, 143, 21, 77, 131, 184, 234, 37, 68, 206, 69, 186, 179, 145, 147,
-    135, 42, 137, 152, 253, 213, 240, 13, 122, 161, 218, 186, 180, 213, 162,
-    150, 231, 63, 112, 182, 233, 86, 12, 225, 195, 133, 37, 28, 22, 147, 201,
-    200, 197, 115, 3, 138, 194, 86, 79, 247, 27, 241, 149, 128, 197, 8, 11, 134,
-    53, 118, 175, 248, 253, 114, 91, 31, 192, 253, 209, 111, 31, 228, 244, 184,
-    179, 146, 145, 167, 137, 155, 184, 218, 38, 62, 187, 22, 181, 193, 93, 16,
-    9, 195, 42, 198, 225, 100, 144, 148, 223, 184, 40, 117, 32, 131, 94, 93, 83,
-    88, 125, 95, 220, 20, 206, 7, 228, 78, 54, 238, 178, 196, 38, 245, 95, 8,
-    235, 106, 17, 175, 142, 193, 60, 179, 53, 244, 92, 147, 244, 218, 95, 127,
-    251, 128, 42, 105, 82, 243, 224, 213, 25, 91, 151, 22, 201, 18, 25, 230,
-    165, 85, 25, 249, 170, 160, 171, 210, 209, 32, 154, 124, 245, 60, 30, 255,
-    138, 154, 29, 85, 156, 232, 177, 78, 14, 137, 52, 215, 247, 26, 211, 115,
-    72, 20, 133, 232, 1, 151, 251, 63, 45, 120, 69, 49, 209, 130, 255, 2, 218,
-    21, 251, 16, 86, 30, 62, 136, 92, 149, 60, 6, 125, 129, 145, 235, 102, 190,
-    144, 248, 1, 53, 135, 21, 158, 44, 158, 230, 246, 172, 249, 161, 105, 204,
-    49, 60, 70, 63, 127, 163, 231, 175, 174, 234, 147, 185, 62, 5, 244, 156, 4,
-    31, 39, 156, 176, 154, 251, 166, 143, 212, 43, 30, 97, 50, 37, 176, 155, 77,
-    149, 102,
-  ]),
-  'ML-DSA-87': new Uint8Array([
-    48, 130, 10, 50, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 19, 3, 130, 10,
-    33, 0, 146, 184, 67, 40, 172, 27, 204, 27, 135, 22, 109, 223, 127, 23, 97,
-    130, 198, 228, 199, 62, 178, 21, 173, 20, 88, 180, 205, 168, 17, 164, 135,
-    92, 85, 146, 76, 194, 152, 80, 239, 157, 33, 21, 239, 182, 176, 254, 124,
-    80, 135, 138, 87, 169, 103, 99, 87, 5, 91, 161, 239, 59, 18, 246, 148, 20,
-    32, 60, 117, 245, 182, 156, 196, 230, 82, 117, 228, 211, 81, 45, 115, 217,
-    23, 95, 138, 95, 103, 124, 32, 89, 187, 48, 251, 103, 81, 234, 76, 4, 57,
-    197, 71, 48, 125, 169, 195, 147, 183, 142, 166, 8, 147, 7, 77, 240, 111, 44,
-    168, 23, 89, 107, 95, 220, 75, 202, 44, 25, 244, 200, 160, 0, 174, 111, 107,
-    204, 22, 36, 122, 191, 101, 33, 52, 252, 14, 47, 25, 109, 135, 48, 131, 253,
-    195, 237, 60, 86, 14, 119, 85, 28, 182, 139, 136, 191, 59, 187, 90, 126,
-    207, 168, 238, 184, 83, 77, 254, 208, 21, 57, 104, 188, 228, 134, 82, 249,
-    190, 249, 163, 120, 111, 68, 225, 210, 131, 29, 151, 153, 146, 71, 163, 104,
-    225, 194, 33, 64, 213, 92, 145, 253, 42, 32, 233, 95, 224, 72, 184, 119,
-    192, 113, 253, 177, 153, 246, 240, 49, 103, 170, 229, 82, 69, 186, 36, 252,
-    29, 124, 255, 25, 148, 5, 160, 159, 105, 157, 185, 25, 158, 122, 145, 30,
-    245, 51, 205, 62, 56, 154, 23, 52, 0, 225, 177, 105, 195, 131, 177, 151,
-    197, 114, 110, 128, 227, 127, 176, 28, 252, 217, 56, 61, 136, 148, 190, 124,
-    108, 129, 62, 243, 235, 37, 70, 228, 233, 10, 67, 124, 120, 58, 164, 83, 57,
-    80, 39, 204, 98, 28, 199, 136, 75, 12, 51, 255, 24, 130, 127, 19, 239, 160,
-    94, 137, 75, 15, 82, 158, 252, 163, 43, 236, 193, 234, 27, 74, 69, 14, 179,
-    171, 10, 169, 27, 138, 172, 213, 189, 222, 167, 110, 24, 11, 118, 151, 223,
-    94, 154, 125, 9, 21, 137, 70, 128, 51, 102, 52, 105, 104, 157, 54, 186, 75,
-    217, 226, 169, 71, 125, 177, 253, 218, 85, 236, 242, 25, 215, 147, 181, 104,
-    242, 82, 75, 50, 165, 49, 102, 128, 82, 237, 170, 134, 162, 196, 56, 247,
-    199, 138, 102, 118, 37, 66, 114, 165, 177, 156, 251, 39, 199, 12, 167, 246,
-    169, 150, 108, 91, 192, 42, 68, 192, 244, 255, 107, 18, 191, 7, 73, 19, 174,
-    28, 116, 66, 131, 96, 173, 60, 131, 190, 249, 219, 246, 71, 182, 124, 183,
-    129, 101, 109, 95, 180, 78, 17, 140, 182, 62, 80, 195, 184, 253, 176, 169,
-    153, 1, 29, 83, 39, 252, 150, 41, 219, 176, 48, 151, 108, 60, 255, 239, 0,
-    85, 101, 193, 110, 204, 12, 254, 22, 136, 15, 154, 217, 88, 13, 28, 252,
-    232, 48, 32, 33, 41, 221, 103, 227, 228, 177, 54, 175, 195, 106, 174, 140,
-    54, 128, 108, 214, 228, 215, 118, 226, 206, 171, 21, 155, 162, 152, 135,
-    203, 16, 170, 130, 100, 173, 155, 243, 80, 40, 98, 157, 248, 7, 101, 88,
-    199, 218, 224, 141, 82, 238, 121, 92, 82, 97, 49, 31, 155, 61, 63, 84, 227,
-    90, 143, 164, 59, 216, 101, 19, 35, 134, 2, 20, 18, 197, 97, 215, 169, 85,
-    220, 75, 254, 91, 125, 144, 43, 65, 128, 29, 66, 77, 184, 172, 89, 123, 203,
-    231, 254, 59, 18, 249, 204, 249, 220, 153, 84, 166, 63, 23, 108, 120, 145,
-    216, 67, 223, 123, 248, 15, 253, 63, 191, 126, 84, 95, 98, 141, 66, 200,
-    129, 194, 174, 30, 80, 48, 75, 113, 14, 102, 101, 218, 249, 14, 203, 24, 6,
-    11, 89, 99, 56, 49, 17, 148, 160, 242, 101, 191, 102, 227, 115, 33, 107, 71,
-    235, 6, 141, 68, 161, 162, 165, 227, 159, 82, 253, 54, 157, 214, 255, 141,
-    151, 154, 134, 150, 93, 141, 97, 158, 244, 180, 135, 42, 10, 3, 148, 9, 152,
-    149, 20, 18, 237, 253, 180, 136, 165, 13, 80, 195, 220, 43, 3, 178, 10, 127,
-    144, 2, 207, 209, 246, 40, 110, 38, 133, 9, 22, 180, 11, 223, 116, 236, 205,
-    186, 25, 183, 155, 165, 77, 206, 101, 255, 106, 223, 70, 10, 22, 176, 119,
-    142, 163, 197, 178, 251, 216, 112, 237, 63, 201, 77, 219, 196, 2, 176, 48,
-    15, 207, 91, 74, 236, 21, 8, 205, 126, 77, 28, 13, 26, 28, 202, 250, 100,
-    79, 134, 209, 193, 78, 202, 58, 248, 124, 215, 64, 143, 244, 17, 23, 163,
-    162, 241, 249, 49, 210, 168, 203, 213, 135, 77, 14, 29, 35, 193, 234, 58,
-    12, 106, 165, 163, 251, 192, 115, 251, 7, 198, 189, 93, 207, 178, 246, 50,
-    189, 185, 51, 45, 84, 140, 194, 34, 46, 92, 90, 136, 81, 81, 53, 52, 253,
-    128, 247, 131, 243, 21, 207, 245, 141, 49, 178, 213, 214, 211, 8, 17, 234,
-    133, 225, 104, 197, 186, 224, 117, 1, 173, 104, 17, 177, 161, 223, 71, 195,
-    159, 194, 45, 177, 116, 26, 187, 193, 161, 213, 179, 158, 8, 122, 186, 122,
-    191, 158, 5, 12, 178, 235, 78, 132, 78, 189, 16, 86, 110, 73, 51, 129, 255,
-    242, 110, 63, 6, 53, 209, 110, 132, 236, 43, 239, 192, 221, 138, 1, 128,
-    176, 0, 113, 85, 119, 201, 36, 188, 202, 9, 223, 98, 196, 42, 130, 158, 149,
-    200, 150, 202, 132, 118, 153, 97, 54, 195, 154, 15, 45, 246, 129, 144, 255,
-    231, 75, 25, 56, 47, 178, 98, 10, 106, 84, 56, 113, 161, 227, 37, 246, 1,
-    245, 129, 173, 70, 186, 11, 28, 125, 198, 243, 225, 113, 130, 5, 138, 52,
-    251, 194, 152, 105, 48, 214, 13, 246, 228, 75, 236, 194, 223, 177, 64, 150,
-    97, 167, 20, 27, 74, 76, 166, 199, 239, 91, 240, 8, 22, 54, 41, 63, 35, 112,
-    255, 251, 88, 252, 147, 173, 185, 43, 98, 83, 155, 230, 176, 55, 161, 8, 83,
-    15, 110, 151, 241, 110, 168, 203, 190, 198, 218, 152, 144, 150, 58, 123, 11,
-    123, 250, 104, 113, 198, 93, 1, 152, 51, 172, 140, 246, 115, 113, 229, 218,
-    166, 200, 35, 123, 16, 133, 169, 191, 59, 103, 12, 114, 15, 60, 37, 4, 92,
-    208, 54, 31, 79, 56, 225, 6, 11, 74, 107, 79, 225, 239, 16, 73, 249, 234,
-    197, 129, 230, 97, 39, 115, 49, 96, 141, 41, 242, 225, 177, 214, 18, 103,
-    34, 229, 37, 176, 241, 99, 82, 227, 195, 77, 32, 64, 4, 120, 49, 199, 209,
-    139, 2, 4, 222, 233, 45, 151, 141, 142, 252, 41, 124, 231, 13, 144, 63, 212,
-    252, 145, 34, 142, 232, 152, 84, 135, 87, 175, 46, 53, 139, 60, 168, 135,
-    167, 101, 253, 127, 152, 138, 154, 31, 231, 198, 77, 89, 182, 9, 54, 103,
-    119, 100, 218, 245, 44, 191, 74, 30, 152, 84, 22, 62, 159, 131, 163, 223, 3,
-    51, 194, 241, 49, 9, 213, 43, 214, 201, 75, 158, 198, 22, 203, 209, 190,
-    199, 189, 75, 4, 6, 72, 60, 241, 113, 171, 30, 42, 143, 73, 51, 72, 206,
-    110, 175, 203, 195, 199, 15, 155, 208, 166, 121, 26, 132, 59, 44, 72, 155,
-    7, 48, 122, 132, 224, 142, 3, 7, 21, 207, 11, 30, 112, 18, 149, 146, 127,
-    41, 104, 197, 169, 86, 213, 108, 253, 111, 160, 5, 11, 202, 172, 233, 32, 5,
-    52, 92, 124, 152, 162, 11, 88, 28, 166, 248, 141, 251, 38, 161, 53, 49, 136,
-    246, 183, 85, 9, 165, 115, 108, 18, 208, 218, 129, 165, 163, 131, 34, 32,
-    94, 226, 121, 93, 24, 87, 226, 105, 25, 242, 128, 198, 78, 26, 237, 21, 92,
-    33, 121, 8, 119, 131, 140, 193, 14, 60, 139, 130, 19, 65, 96, 50, 5, 249,
-    12, 27, 51, 23, 195, 89, 255, 47, 23, 109, 62, 202, 190, 5, 131, 92, 91, 39,
-    27, 209, 132, 146, 95, 98, 66, 26, 230, 186, 236, 186, 162, 149, 81, 143,
-    221, 21, 79, 171, 236, 21, 161, 19, 135, 10, 213, 168, 200, 135, 19, 221,
-    177, 207, 106, 214, 194, 124, 220, 53, 45, 176, 245, 178, 189, 49, 242, 22,
-    230, 154, 241, 146, 230, 187, 180, 244, 158, 145, 197, 225, 51, 150, 140,
-    26, 175, 78, 142, 243, 232, 221, 137, 205, 130, 178, 54, 216, 136, 118, 212,
-    33, 90, 206, 18, 224, 158, 44, 23, 144, 204, 24, 184, 48, 81, 233, 124, 20,
-    222, 77, 119, 144, 22, 145, 241, 19, 206, 135, 252, 164, 114, 84, 37, 175,
-    107, 67, 243, 183, 137, 213, 53, 236, 41, 73, 50, 34, 146, 218, 204, 68,
-    235, 158, 150, 139, 133, 75, 248, 157, 7, 0, 53, 68, 44, 156, 110, 56, 197,
-    209, 201, 0, 155, 225, 85, 35, 169, 193, 231, 36, 31, 142, 101, 168, 29,
-    192, 31, 128, 81, 191, 253, 184, 153, 226, 214, 1, 27, 6, 0, 192, 36, 101,
-    72, 105, 150, 226, 3, 21, 12, 127, 72, 250, 223, 240, 136, 249, 157, 129,
-    247, 91, 178, 157, 208, 86, 146, 23, 176, 150, 35, 211, 155, 22, 207, 119,
-    168, 167, 122, 180, 183, 106, 97, 138, 87, 96, 34, 141, 110, 145, 231, 226,
-    35, 115, 232, 129, 54, 186, 128, 190, 238, 37, 169, 194, 37, 24, 237, 211,
-    164, 111, 54, 88, 245, 125, 67, 78, 194, 11, 194, 235, 217, 87, 203, 14,
-    220, 189, 107, 68, 94, 139, 66, 230, 5, 54, 64, 28, 246, 143, 75, 127, 239,
-    243, 20, 251, 189, 246, 246, 151, 90, 219, 227, 242, 223, 205, 40, 124, 245,
-    4, 189, 72, 39, 145, 110, 96, 120, 164, 27, 117, 146, 177, 30, 76, 173, 106,
-    130, 228, 192, 189, 59, 167, 30, 127, 178, 164, 5, 133, 80, 199, 207, 216,
-    189, 156, 93, 222, 150, 129, 81, 193, 180, 38, 59, 8, 214, 210, 95, 150,
-    182, 175, 148, 43, 153, 169, 66, 62, 135, 140, 159, 89, 195, 253, 3, 132,
-    180, 164, 244, 243, 232, 71, 196, 200, 158, 194, 114, 115, 193, 88, 161,
-    185, 235, 247, 14, 126, 225, 176, 111, 17, 79, 77, 245, 80, 229, 174, 6,
-    180, 156, 217, 85, 174, 201, 255, 237, 85, 83, 53, 188, 153, 98, 91, 193,
-    21, 211, 49, 145, 196, 252, 52, 66, 226, 131, 203, 214, 130, 237, 194, 208,
-    174, 102, 133, 220, 235, 222, 79, 232, 36, 21, 161, 248, 51, 185, 164, 156,
-    95, 121, 65, 57, 233, 183, 29, 199, 105, 104, 12, 90, 195, 186, 81, 199,
-    176, 1, 87, 16, 226, 192, 206, 185, 197, 46, 34, 75, 174, 153, 238, 15, 50,
-    87, 226, 96, 26, 197, 202, 73, 235, 19, 140, 9, 79, 12, 52, 83, 76, 85, 146,
-    234, 24, 151, 179, 178, 118, 58, 162, 223, 103, 69, 244, 231, 135, 167, 204,
-    117, 166, 60, 237, 82, 63, 11, 4, 207, 10, 146, 54, 126, 191, 79, 133, 60,
-    128, 34, 136, 170, 23, 84, 81, 38, 94, 9, 130, 245, 100, 115, 209, 34, 228,
-    158, 101, 216, 135, 208, 207, 191, 169, 115, 252, 144, 139, 226, 252, 6, 44,
-    221, 134, 170, 87, 11, 46, 124, 58, 219, 179, 238, 6, 98, 216, 18, 174, 42,
-    12, 97, 126, 85, 245, 81, 220, 232, 135, 114, 21, 125, 135, 225, 182, 245,
-    228, 223, 242, 62, 158, 35, 76, 6, 110, 25, 184, 206, 124, 237, 54, 252,
-    199, 44, 78, 89, 0, 135, 44, 176, 57, 168, 36, 221, 173, 77, 214, 209, 60,
-    1, 202, 238, 237, 61, 90, 47, 114, 230, 92, 238, 235, 18, 151, 220, 243,
-    225, 163, 159, 139, 189, 253, 62, 225, 182, 202, 59, 7, 83, 99, 129, 118,
-    175, 37, 246, 85, 119, 251, 246, 69, 180, 247, 37, 24, 194, 89, 158, 97,
-    230, 247, 254, 145, 102, 89, 77, 68, 245, 3, 103, 83, 28, 45, 168, 30, 189,
-    151, 112, 120, 215, 84, 90, 198, 85, 85, 129, 55, 127, 124, 28, 137, 229,
-    139, 54, 88, 229, 105, 81, 212, 83, 28, 107, 250, 82, 164, 43, 24, 15, 57,
-    206, 156, 19, 145, 95, 57, 169, 8, 128, 211, 29, 213, 195, 148, 27, 73, 186,
-    221, 242, 11, 167, 78, 246, 133, 18, 118, 67, 236, 59, 19, 112, 254, 93,
-    168, 157, 118, 0, 107, 248, 57, 149, 67, 222, 123, 225, 207, 251, 69, 218,
-    56, 110, 162, 19, 25, 209, 209, 213, 200, 158, 70, 9, 100, 208, 77, 48, 255,
-    151, 200, 0, 68, 230, 70, 120, 209, 29, 86, 225, 188, 189, 226, 101, 42,
-    176, 32, 147, 121, 72, 151, 130, 217, 13, 66, 148, 84, 129, 215, 249, 164,
-    174, 187, 80, 85, 185, 245, 108, 169, 119, 59, 178, 144, 229, 63, 194, 132,
-    250, 131, 82, 161, 125, 126, 255, 252, 220, 204, 104, 231, 201, 136, 246,
-    116, 43, 88, 233, 0, 43, 128, 214, 40, 59, 81, 147, 139, 132, 69, 24, 233,
-    21, 14, 91, 230, 241, 19, 138, 163, 55, 13, 221, 47, 64, 140, 248, 6, 38,
-    164, 16, 219, 63, 33, 180, 71, 151, 0, 234, 103, 58, 213, 222, 163, 95, 132,
-    1, 178, 146, 66, 124, 242, 223, 102, 129, 192, 214, 194, 117, 162, 252, 246,
-    143, 42, 70, 139, 97, 168, 64, 141, 190, 115, 126, 93, 175, 59, 49, 9, 184,
-    88, 201, 100, 182, 142, 145, 244, 72, 128, 203, 49, 196, 5, 5, 18, 46, 34,
-    87, 171, 132, 158, 128, 75, 194, 8, 242, 52, 156, 229, 245, 56, 245, 88, 14,
-    195, 110, 166, 51, 158, 245, 195, 120, 17, 166, 66, 100, 212, 188, 243, 2,
-    236, 90, 8, 16, 35, 151, 122, 175, 115, 168, 186, 191, 60, 71, 23, 81, 217,
-    79, 203, 239, 61, 146, 247, 168, 112, 83, 102, 146, 222, 178, 45, 247, 63,
-    23, 181, 3, 136, 208, 62, 154, 203, 35, 250, 238, 61, 98, 207, 90, 169, 175,
-    36, 227, 9, 182, 78, 226, 99, 89, 67, 105, 185, 35, 242, 162, 54, 99, 60,
-    148, 14, 118, 1, 26, 120, 62, 82, 62, 222, 34, 99, 58, 174, 145, 199, 190,
-    21, 182, 117, 238, 13, 170, 29, 67, 149, 44, 90, 94, 181, 125, 182, 186, 82,
-    55, 105, 253, 29, 212, 67, 134, 204, 227, 94, 255, 127, 72, 157, 140, 142,
-    224, 77, 149, 29, 170, 45, 163, 214, 209, 46, 28, 125, 177, 111, 2, 92, 121,
-    252, 166, 204, 227, 173, 51, 60, 162, 243, 202, 207, 103, 30, 153, 182, 116,
-    182, 130, 98, 59, 25, 141, 239, 49, 224, 176, 27, 237, 218, 76, 68, 189,
-    108, 185, 136, 255, 105, 150, 11, 153, 44, 248, 139, 199, 178, 235, 85, 115,
-    121, 144, 87, 221, 50, 222, 238, 16, 20, 51, 190, 93, 248, 228, 84, 228,
-    115, 31, 229, 227, 137, 180, 44, 115, 224, 119, 129, 181, 134, 224, 144,
-    186, 123, 208, 118, 96, 101, 177, 191, 232, 171, 6, 17, 247, 187, 173, 84,
-    70, 249, 19, 191, 116, 172, 126, 131, 216, 123, 225, 151, 55, 205, 177, 93,
-    139, 117,
-  ]),
-};
+var { pkcs8, spki } = getMldsaKeyFixtures();
 
 // Test message to sign (same for all variants)
 var data = new Uint8Array([
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa.js
index 667f5d2793e4..8a87ba88cb4b 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa.js
@@ -1,581 +1,106 @@
-
 function run_test() {
-    setup({explicit_done: true});
-
-    var subtle = self.crypto.subtle; // Change to test prefixed implementations
-
-    // When are all these tests really done? When all the promises they use have resolved.
-    var all_promises = [];
-
-    // Source file [algorithm_name]_vectors.js provides the getTestVectors method
-    // for the algorithm that drives these tests.
-    var testVectors = getTestVectors();
-
-    // Test verification first, because signing tests rely on that working
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var operation = subtle.verify(vector.algorithm, vector.publicKey, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                signature[0] = 255 - signature[0];
-                var operation = subtle.verify({
-                    ...vector.algorithm,
-                    get name() {
-                        signature[0] = vector.signature[0];
-                        return vector.algorithm.name;
-                    }
-                }, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with altered signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with an altered buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify(vector.algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature[0] = 255 - signature[0];
-                return operation;
-            }, vector.name + " verification with altered signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with altered signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer during call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify({
-                    ...vector.algorithm,
-                    get name() {
-                        signature.buffer.transfer();
-                        return vector.algorithm.name;
-                    }
-                }, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification with transferred signature during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with a transferred buffer after call
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                var operation = subtle.verify(vector.algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                signature.buffer.transfer();
-                return operation;
-            }, vector.name + " verification with transferred signature after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with transferred signature after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                plaintext[0] = 255 - plaintext[0];
-                var operation = subtle.verify({
-                    ...vector.algorithm,
-                    get name() {
-                        plaintext[0] = vector.plaintext[0];
-                        return vector.algorithm.name;
-                    }
-                }, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with altered plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is altered after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify(vector.algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext[0] = 255 - plaintext[0];
-                return operation;
-            }, vector.name + " with altered plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with altered plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failed verification if plaintext is transferred during call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify({
-                    ...vector.algorithm,
-                    get name() {
-                        plaintext.buffer.transfer();
-                        return vector.algorithm.name;
-                    }
-                }, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature is NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " with transferred plaintext during call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext during call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful verification even if plaintext is transferred after call.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                var operation = subtle.verify(vector.algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_true(is_verified, "Signature verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                plaintext.buffer.transfer();
-                return operation;
-            }, vector.name + " with transferred plaintext after call");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " with transferred plaintext after call");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to using privateKey to verify.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                return subtle.verify(vector.algorithm, vector.privateKey, vector.signature, vector.plaintext)
-                .then(function(plaintext) {
-                    assert_unreached("Should have thrown error for using privateKey to verify in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " using privateKey to verify");
-
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " using privateKey to verify");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to using publicKey to sign.
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                return subtle.sign(vector.algorithm, vector.publicKey, vector.plaintext)
-                .then(function(signature) {
-                    assert_unreached("Should have thrown error for using publicKey to sign in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " using publicKey to sign");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " using publicKey to sign");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for failures due to no "verify" usage.
-    testVectors.forEach(function(originalVector) {
-        var vector = Object.assign({}, originalVector);
-
-        var promise = importVectorKeys(vector, [], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                return subtle.verify(vector.algorithm, vector.publicKey, vector.signature, vector.plaintext)
-                .then(function(plaintext) {
-                    assert_unreached("Should have thrown error for no verify usage in " + vector.name + ": '" + err.message + "'");
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
-                });
-            }, vector.name + " no verify usage");
-        }, function(err) {
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " no verify usage");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Check for successful signing and verification.
-    testVectors.forEach(function(vector) {
-        // RSA signing is deterministic with PKCS#1 v1.5, or PSS with zero-length salts.
-        const isDeterministic = !("saltLength" in vector.algorithm) || vector.algorithm.saltLength == 0;
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                return subtle.sign(vector.algorithm, vector.privateKey, vector.plaintext)
-                .then(function(signature) {
-                    if (isDeterministic) {
-                        // If deterministic, we can check the output matches. Otherwise, we can only check it verifies.
-                        assert_true(equalBuffers(signature, vector.signature), "Signing did not give the expected output");
-                    }
-                    // Can we verify the new signature?
-                    return subtle.verify(vector.algorithm, vector.publicKey, signature, vector.plaintext)
-                    .then(function(is_verified) {
-                        assert_true(is_verified, "Round trip verifies");
-                        return signature;
-                    }, function(err) {
-                        assert_unreached("verify error for test " + vector.name + ": '" + err.message + "'");
-                    });
-                })
-                .then(function(priorSignature) {
-                    // Will a second signing give us different signature? It should for PSS with non-empty salt
-                    return subtle.sign(vector.algorithm, vector.privateKey, vector.plaintext)
-                    .then(function(signature) {
-                        if (isDeterministic) {
-                            assert_true(equalBuffers(priorSignature, signature), "Two signings with empty salt give same signature")
-                        } else {
-                            assert_false(equalBuffers(priorSignature, signature), "Two signings with a salt give different signatures")
-                        }
-                    }, function(err) {
-                        assert_unreached("second time verify error for test " + vector.name + ": '" + err.message + "'");
-                    });
-                }, function(err) {
-                    assert_unreached("sign error for test " + vector.name + ": '" + err.message + "'");
-                });
-            }, vector.name + " round trip");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested signing or verifying
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " round trip");
-        });
-
-        all_promises.push(promise);
-    });
-
-
-    // Test signing with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var alteredVector = Object.assign({}, vector);
-        alteredVector.algorithm = Object.assign({}, vector.algorithm);
-        if (vector.algorithm.name === "RSA-PSS") {
-            alteredVector.algorithm.name = "RSASSA-PKCS1-v1_5";
-        } else {
-            alteredVector.algorithm.name = "RSA-PSS";
-        }
-
-        var promise = importVectorKeys(alteredVector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var operation = subtle.sign(vector.algorithm, alteredVector.privateKey, vector.plaintext)
-                .then(function(signature) {
-                    assert_unreached("Signing should not have succeeded for " + vector.name);
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " signing with wrong algorithm name");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " signing with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Test verification with the wrong algorithm
-    testVectors.forEach(function(vector) {
-        // Want to get the key for the wrong algorithm
-        var alteredVector = Object.assign({}, vector);
-        alteredVector.algorithm = Object.assign({}, vector.algorithm);
-        if (vector.algorithm.name === "RSA-PSS") {
-            alteredVector.algorithm.name = "RSASSA-PKCS1-v1_5";
-        } else {
-            alteredVector.algorithm.name = "RSA-PSS";
-        }
-
-        var promise = importVectorKeys(alteredVector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            // Some tests are sign only
-            if (!("signature" in vector)) {
-                return;
+    const subtle = self.crypto.subtle;
+    const testVectors = getTestVectors().map(
+        vector => ({...vector, data: vector.plaintext})
+    );
+    const importAlgorithm = vector => ({
+        name: vector.algorithm.name,
+        hash: vector.hash,
+    });
+
+    runSignatureTests({
+        vectors: testVectors,
+        algorithmIdentifier(vector) {
+            return vector.algorithm;
+        },
+        importAlgorithm,
+        dataLabel: "plaintext",
+        shortSignature: false,
+        wrongVerifyLabel: " verification with wrong algorithm name",
+        alteredSignatureLabel: " verification failure with altered signature",
+        alteredDataLabel: " verification failure with altered plaintext",
+        async wrongKey(vector, operation) {
+            const name = vector.algorithm.name === "RSA-PSS"
+                ? "RSASSA-PKCS1-v1_5"
+                : "RSA-PSS";
+            const isSign = operation === "sign";
+            return subtle.importKey(
+                isSign ? vector.privateKeyFormat : vector.publicKeyFormat,
+                isSign ? vector.privateKeyBuffer : vector.publicKeyBuffer,
+                {name, hash: vector.hash},
+                false,
+                [operation]
+            );
+        },
+        async roundTrip({
+            vector,
+            algorithm,
+            verificationKey,
+            signingKey,
+        }) {
+            const isDeterministic = !("saltLength" in algorithm) ||
+                algorithm.saltLength === 0;
+            const signature = await subtle.sign(
+                algorithm,
+                signingKey,
+                vector.data
+            );
+
+            if (isDeterministic) {
+                assert_true(
+                    equalBuffers(signature, vector.signature),
+                    "Signing did not give the expected output"
+                );
             }
-            promise_test(function(test) {
-                var operation = subtle.verify(vector.algorithm, alteredVector.publicKey, vector.signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_unreached("Verification should not have succeeded for " + vector.name);
-                }, function(err) {
-                    assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
-                });
 
-                return operation;
-            }, vector.name + " verification with wrong algorithm name");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification with wrong algorithm name");
-        });
-
-        all_promises.push(promise);
-    });
-
-    // Verification should fail with wrong signature
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var signature = copyBuffer(vector.signature);
-                signature[0] = 255 - signature[0];
-                var operation = subtle.verify(vector.algorithm, vector.publicKey, signature, vector.plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure with altered signature");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure with altered signature");
-        });
-
-        all_promises.push(promise);
+            const isVerified = await subtle.verify(
+                algorithm,
+                verificationKey,
+                signature,
+                vector.data
+            );
+            assert_true(isVerified, "Round trip verifies");
+
+            const secondSignature = await subtle.sign(
+                algorithm,
+                signingKey,
+                vector.data
+            );
+            if (isDeterministic) {
+                assert_true(
+                    equalBuffers(signature, secondSignature),
+                    "Two signings with empty salt give same signature"
+                );
+            } else {
+                assert_false(
+                    equalBuffers(signature, secondSignature),
+                    "Two signings with a salt give different signatures"
+                );
+            }
+        },
     });
 
-    // [RSA-PSS] Verification should fail with wrong saltLength
     testVectors.forEach(function(vector) {
-        if (vector.algorithm.name === "RSA-PSS") {
-            var promise = importVectorKeys(vector, ["verify"], ["sign"])
-            .then(function(vectors) {
-                promise_test(function(test) {
-                    const saltLength = vector.algorithm.saltLength === 32 ? 48 : 32;
-                    var operation = subtle.verify({ ...vector.algorithm, saltLength }, vector.publicKey, vector.signature, vector.plaintext)
-                    .then(function(is_verified) {
-                        assert_false(is_verified, "Signature NOT verified");
-                    }, function(err) {
-                        assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                    });
-
-                    return operation;
-                }, vector.name + " verification failure with wrong saltLength");
-
-            }, function(err) {
-                // We need a failed test if the importVectorKey operation fails, so
-                // we know we never tested verification.
-                promise_test(function(test) {
-                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-                }, "importVectorKeys step: " + vector.name + " verification failure with wrong saltLength");
-            });
-
-            all_promises.push(promise);
+        if (vector.algorithm.name !== "RSA-PSS") {
+            return;
         }
-    });
 
-    // Verification should fail with wrong plaintext
-    testVectors.forEach(function(vector) {
-        var promise = importVectorKeys(vector, ["verify"], ["sign"])
-        .then(function(vectors) {
-            promise_test(function(test) {
-                var plaintext = copyBuffer(vector.plaintext);
-                plaintext[0] = 255 - plaintext[0];
-                var operation = subtle.verify(vector.algorithm, vector.publicKey, vector.signature, plaintext)
-                .then(function(is_verified) {
-                    assert_false(is_verified, "Signature NOT verified");
-                }, function(err) {
-                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
-                });
-
-                return operation;
-            }, vector.name + " verification failure with altered plaintext");
-
-        }, function(err) {
-            // We need a failed test if the importVectorKey operation fails, so
-            // we know we never tested verification.
-            promise_test(function(test) {
-                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
-            }, "importVectorKeys step: " + vector.name + " verification failure with altered plaintext");
-        });
-
-        all_promises.push(promise);
+        promise_test(async function() {
+            const key = await subtle.importKey(
+                vector.publicKeyFormat,
+                vector.publicKeyBuffer,
+                importAlgorithm(vector),
+                false,
+                ["verify"]
+            );
+            const saltLength = vector.algorithm.saltLength === 32 ? 48 : 32;
+            const isVerified = await subtle.verify(
+                {...vector.algorithm, saltLength},
+                key,
+                vector.signature,
+                vector.data
+            );
+            assert_false(isVerified, "Signature NOT verified");
+        }, vector.name + " verification failure with wrong saltLength");
     });
-
-
-    promise_test(function() {
-        return Promise.all(all_promises)
-            .then(function() {done();})
-            .catch(function() {done();})
-    }, "setup");
-
-    // A test vector has all needed fields for signing and verifying, EXCEPT that the
-    // key field may be null. This function replaces that null with the Correct
-    // CryptoKey object.
-    //
-    // Returns a Promise that yields an updated vector on success.
-    function importVectorKeys(vector, publicKeyUsages, privateKeyUsages) {
-        var publicPromise, privatePromise;
-
-        if (vector.publicKey !== null) {
-            publicPromise = new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
-        } else {
-            publicPromise = subtle.importKey(vector.publicKeyFormat, vector.publicKeyBuffer, {name: vector.algorithm.name, hash: vector.hash}, false, publicKeyUsages)
-            .then(function(key) {
-                vector.publicKey = key;
-                return vector;
-            });        // Returns a copy of the sourceBuffer it is sent.
-        }
-
-        if (vector.privateKey !== null) {
-            privatePromise = new Promise(function(resolve, reject) {
-                resolve(vector);
-            });
-        } else {
-            privatePromise = subtle.importKey(vector.privateKeyFormat, vector.privateKeyBuffer, {name: vector.algorithm.name, hash: vector.hash}, false, privateKeyUsages)
-            .then(function(key) {
-                vector.privateKey = key;
-                return vector;
-            });
-        }
-
-        return Promise.all([publicPromise, privatePromise]);
-    }
-
-    return;
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs.https.any.js
index 3e3a8c23bf53..43b87658d21f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs.https.any.js
@@ -1,6 +1,8 @@
 // META: title=WebCryptoAPI: sign() and verify() Using RSASSA-PKCS1-v1_5
 // META: script=../util/helpers.js
+// META: script=../util/rsa_key_fixtures.js
 // META: script=rsa_pkcs_vectors.js
+// META: script=signature.js
 // META: script=rsa.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs_vectors.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs_vectors.js
index 71e5d8571bc8..f1eca448a988 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pkcs_vectors.js
@@ -18,8 +18,9 @@
 //     plaintext - the text to encrypt
 //     signature - the expected signature
 function getTestVectors() {
-    var pkcs8 = new Uint8Array([48, 130, 4, 191, 2, 1, 0, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 4, 130, 4, 169, 48, 130, 4, 165, 2, 1, 0, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1, 2, 130, 1, 1, 0, 139, 55, 92, 203, 135, 200, 37, 197, 255, 61, 83, 208, 9, 145, 110, 150, 65, 5, 126, 24, 82, 114, 39, 160, 122, 178, 38, 190, 16, 136, 129, 58, 59, 56, 187, 123, 72, 243, 119, 5, 81, 101, 250, 42, 147, 57, 210, 77, 198, 103, 213, 197, 186, 52, 39, 230, 164, 129, 23, 110, 172, 21, 255, 212, 144, 104, 49, 30, 28, 40, 59, 159, 58, 142, 12, 184, 9, 180, 99, 12, 80, 170, 143, 62, 69, 166, 11, 53, 158, 25, 191, 140, 187, 94, 202, 214, 78, 118, 31, 16, 149, 116, 63, 243, 106, 175, 92, 240, 236, 185, 127, 237, 173, 221, 166, 11, 91, 243, 93, 129, 26, 117, 184, 34, 35, 12, 250, 160, 25, 47, 173, 64, 84, 126, 39, 84, 72, 170, 51, 22, 191, 142, 43, 76, 224, 133, 79, 199, 112, 139, 83, 123, 162, 45, 19, 33, 11, 9, 174, 195, 122, 39, 89, 239, 192, 130, 161, 83, 27, 35, 169, 23, 48, 3, 125, 222, 78, 242, 107, 95, 150, 239, 220, 195, 159, 211, 76, 52, 90, 213, 28, 187, 228, 79, 229, 139, 138, 59, 78, 201, 151, 134, 108, 8, 109, 255, 27, 136, 49, 239, 10, 31, 234, 38, 60, 247, 218, 205, 3, 192, 76, 188, 194, 178, 121, 229, 127, 165, 185, 83, 153, 107, 251, 29, 214, 136, 23, 175, 127, 180, 44, 222, 247, 165, 41, 74, 87, 250, 194, 184, 173, 115, 159, 27, 2, 153, 2, 129, 129, 0, 251, 248, 51, 194, 198, 49, 201, 112, 36, 12, 142, 116, 133, 240, 106, 62, 162, 168, 72, 34, 81, 26, 134, 39, 221, 70, 78, 248, 175, 175, 113, 72, 209, 164, 37, 182, 184, 101, 125, 221, 82, 70, 131, 43, 142, 83, 48, 32, 197, 187, 181, 104, 133, 90, 106, 236, 62, 66, 33, 215, 147, 241, 220, 91, 47, 37, 132, 226, 65, 94, 72, 233, 162, 189, 41, 43, 19, 64, 49, 249, 156, 142, 180, 47, 192, 188, 208, 68, 155, 242, 44, 230, 222, 201, 112, 20, 239, 229, 172, 147, 235, 232, 53, 135, 118, 86, 37, 44, 187, 177, 108, 65, 91, 103, 177, 132, 210, 40, 69, 104, 162, 119, 213, 147, 53, 88, 92, 253, 2, 129, 129, 0, 214, 184, 206, 39, 199, 41, 93, 93, 22, 252, 53, 112, 237, 100, 200, 218, 147, 3, 250, 210, 148, 136, 193, 166, 94, 154, 215, 17, 249, 3, 112, 24, 125, 187, 253, 129, 49, 109, 105, 100, 139, 200, 140, 197, 200, 53, 81, 175, 255, 69, 222, 186, 207, 182, 17, 5, 247, 9, 228, 195, 8, 9, 185, 0, 49, 235, 214, 134, 36, 68, 150, 198, 246, 158, 105, 46, 189, 200, 20, 246, 66, 57, 244, 173, 21, 117, 110, 203, 120, 197, 165, 176, 153, 49, 219, 24, 48, 119, 197, 70, 163, 140, 76, 116, 56, 137, 173, 61, 62, 208, 121, 181, 98, 46, 208, 18, 15, 160, 225, 249, 59, 89, 61, 183, 216, 82, 224, 95, 2, 129, 128, 56, 135, 75, 157, 131, 247, 129, 120, 206, 45, 158, 252, 23, 92, 131, 137, 127, 214, 127, 48, 107, 191, 166, 159, 100, 238, 52, 35, 104, 206, 212, 124, 128, 195, 241, 206, 23, 122, 117, 141, 100, 186, 251, 12, 151, 134, 164, 66, 133, 250, 1, 205, 236, 53, 7, 205, 238, 125, 201, 183, 226, 178, 29, 60, 187, 204, 16, 14, 238, 153, 103, 132, 59, 5, 115, 41, 253, 204, 166, 41, 152, 237, 15, 17, 179, 140, 232, 176, 171, 199, 222, 57, 1, 124, 113, 207, 208, 174, 87, 84, 108, 85, 145, 68, 205, 208, 175, 208, 100, 95, 126, 168, 255, 7, 185, 116, 209, 237, 68, 253, 31, 142, 0, 245, 96, 191, 109, 69, 2, 129, 129, 0, 133, 41, 239, 144, 115, 207, 143, 123, 95, 249, 226, 26, 186, 223, 58, 65, 115, 211, 144, 6, 112, 223, 175, 89, 66, 106, 188, 223, 4, 147, 193, 61, 47, 29, 27, 70, 184, 36, 166, 172, 24, 148, 179, 217, 37, 37, 12, 24, 30, 52, 114, 193, 96, 120, 5, 110, 177, 154, 141, 40, 247, 31, 48, 128, 146, 117, 52, 129, 212, 148, 68, 253, 247, 140, 158, 166, 194, 68, 7, 220, 1, 142, 119, 211, 175, 239, 56, 91, 47, 247, 67, 158, 150, 35, 121, 65, 51, 45, 212, 70, 206, 190, 255, 219, 68, 4, 254, 79, 113, 89, 81, 97, 208, 22, 64, 44, 51, 77, 15, 87, 198, 26, 190, 79, 249, 244, 203, 249, 2, 129, 129, 0, 135, 216, 119, 8, 212, 103, 99, 228, 204, 190, 178, 209, 233, 113, 46, 91, 240, 33, 109, 112, 222, 148, 32, 165, 178, 6, 155, 116, 89, 185, 159, 93, 159, 127, 47, 173, 124, 215, 154, 174, 230, 122, 127, 154, 52, 67, 126, 60, 121, 168, 74, 240, 205, 141, 233, 223, 242, 104, 235, 12, 71, 147, 245, 1, 249, 136, 213, 64, 246, 211, 71, 92, 32, 121, 184, 34, 122, 35, 217, 104, 222, 196, 227, 198, 101, 3, 24, 113, 147, 69, 150, 48, 71, 43, 253, 182, 186, 29, 231, 134, 199, 151, 250, 111, 78, 166, 90, 42, 132, 25, 38, 47, 41, 103, 136, 86, 203, 115, 201, 189, 75, 200, 155, 94, 4, 27, 34, 119]);
-    var spki = new Uint8Array([48, 130, 1, 34, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 3, 130, 1, 15, 0, 48, 130, 1, 10, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1]);
+    var keyFixtures = getRsaKeyFixtures();
+    var pkcs8 = keyFixtures.pkcs8;
+    var spki = keyFixtures.spki;
 
     // plaintext
     var plaintext = new Uint8Array([95, 77, 186, 79, 50, 12, 12, 232, 118, 114, 90, 252, 229, 251, 210, 91, 248, 62, 90, 113, 37, 160, 140, 175, 231, 60, 62, 186, 196, 33, 119, 157, 249, 213, 93, 24, 12, 58, 233, 148, 38, 69, 225, 216, 47, 238, 140, 157, 41, 75, 60, 177, 160, 138, 153, 49, 32, 27, 60, 14, 129, 252, 71, 202, 207, 131, 21, 162, 175, 102, 50, 65, 19, 195, 182, 98, 48, 195, 70, 8, 196, 244, 89, 54, 52, 206, 2, 178, 103, 54, 34, 119, 240, 168, 64, 202, 116, 188, 61, 26, 98, 54, 149, 44, 94, 215, 170, 248, 168, 254, 203, 221, 250, 117, 132, 230, 151, 140, 234, 93, 42, 91, 159, 183, 241, 180, 140, 139, 11, 229, 138, 48, 82, 2, 117, 77, 131, 118, 16, 115, 116, 121, 60, 240, 38, 170, 238, 83, 0, 114, 125, 131, 108, 215, 30, 113, 179, 69, 221, 178, 228, 68, 70, 255, 197, 185, 1, 99, 84, 19, 137, 13, 145, 14, 163, 128, 152, 74, 144, 25, 16, 49, 50, 63, 22, 219, 204, 157, 107, 225, 104, 184, 72, 133, 56, 76, 160, 62, 18, 96, 10, 193, 194, 72, 2, 138, 243, 114, 108, 201, 52, 99, 136, 46, 168, 192, 42, 171]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss.https.any.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss.https.any.js
index 399baba78468..c3ed8355f3f8 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss.https.any.js
@@ -1,6 +1,8 @@
 // META: title=WebCryptoAPI: sign() and verify() Using RSA-PSS
 // META: script=../util/helpers.js
+// META: script=../util/rsa_key_fixtures.js
 // META: script=rsa_pss_vectors.js
+// META: script=signature.js
 // META: script=rsa.js
 // META: timeout=long
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss_vectors.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss_vectors.js
index c3ce77960629..224bacc3d1bb 100644
--- a/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/rsa_pss_vectors.js
@@ -18,8 +18,9 @@
 //     plaintext - the text to encrypt
 //     signature - the expected signature
 function getTestVectors() {
-    var pkcs8 = new Uint8Array([48, 130, 4, 191, 2, 1, 0, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 4, 130, 4, 169, 48, 130, 4, 165, 2, 1, 0, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1, 2, 130, 1, 1, 0, 139, 55, 92, 203, 135, 200, 37, 197, 255, 61, 83, 208, 9, 145, 110, 150, 65, 5, 126, 24, 82, 114, 39, 160, 122, 178, 38, 190, 16, 136, 129, 58, 59, 56, 187, 123, 72, 243, 119, 5, 81, 101, 250, 42, 147, 57, 210, 77, 198, 103, 213, 197, 186, 52, 39, 230, 164, 129, 23, 110, 172, 21, 255, 212, 144, 104, 49, 30, 28, 40, 59, 159, 58, 142, 12, 184, 9, 180, 99, 12, 80, 170, 143, 62, 69, 166, 11, 53, 158, 25, 191, 140, 187, 94, 202, 214, 78, 118, 31, 16, 149, 116, 63, 243, 106, 175, 92, 240, 236, 185, 127, 237, 173, 221, 166, 11, 91, 243, 93, 129, 26, 117, 184, 34, 35, 12, 250, 160, 25, 47, 173, 64, 84, 126, 39, 84, 72, 170, 51, 22, 191, 142, 43, 76, 224, 133, 79, 199, 112, 139, 83, 123, 162, 45, 19, 33, 11, 9, 174, 195, 122, 39, 89, 239, 192, 130, 161, 83, 27, 35, 169, 23, 48, 3, 125, 222, 78, 242, 107, 95, 150, 239, 220, 195, 159, 211, 76, 52, 90, 213, 28, 187, 228, 79, 229, 139, 138, 59, 78, 201, 151, 134, 108, 8, 109, 255, 27, 136, 49, 239, 10, 31, 234, 38, 60, 247, 218, 205, 3, 192, 76, 188, 194, 178, 121, 229, 127, 165, 185, 83, 153, 107, 251, 29, 214, 136, 23, 175, 127, 180, 44, 222, 247, 165, 41, 74, 87, 250, 194, 184, 173, 115, 159, 27, 2, 153, 2, 129, 129, 0, 251, 248, 51, 194, 198, 49, 201, 112, 36, 12, 142, 116, 133, 240, 106, 62, 162, 168, 72, 34, 81, 26, 134, 39, 221, 70, 78, 248, 175, 175, 113, 72, 209, 164, 37, 182, 184, 101, 125, 221, 82, 70, 131, 43, 142, 83, 48, 32, 197, 187, 181, 104, 133, 90, 106, 236, 62, 66, 33, 215, 147, 241, 220, 91, 47, 37, 132, 226, 65, 94, 72, 233, 162, 189, 41, 43, 19, 64, 49, 249, 156, 142, 180, 47, 192, 188, 208, 68, 155, 242, 44, 230, 222, 201, 112, 20, 239, 229, 172, 147, 235, 232, 53, 135, 118, 86, 37, 44, 187, 177, 108, 65, 91, 103, 177, 132, 210, 40, 69, 104, 162, 119, 213, 147, 53, 88, 92, 253, 2, 129, 129, 0, 214, 184, 206, 39, 199, 41, 93, 93, 22, 252, 53, 112, 237, 100, 200, 218, 147, 3, 250, 210, 148, 136, 193, 166, 94, 154, 215, 17, 249, 3, 112, 24, 125, 187, 253, 129, 49, 109, 105, 100, 139, 200, 140, 197, 200, 53, 81, 175, 255, 69, 222, 186, 207, 182, 17, 5, 247, 9, 228, 195, 8, 9, 185, 0, 49, 235, 214, 134, 36, 68, 150, 198, 246, 158, 105, 46, 189, 200, 20, 246, 66, 57, 244, 173, 21, 117, 110, 203, 120, 197, 165, 176, 153, 49, 219, 24, 48, 119, 197, 70, 163, 140, 76, 116, 56, 137, 173, 61, 62, 208, 121, 181, 98, 46, 208, 18, 15, 160, 225, 249, 59, 89, 61, 183, 216, 82, 224, 95, 2, 129, 128, 56, 135, 75, 157, 131, 247, 129, 120, 206, 45, 158, 252, 23, 92, 131, 137, 127, 214, 127, 48, 107, 191, 166, 159, 100, 238, 52, 35, 104, 206, 212, 124, 128, 195, 241, 206, 23, 122, 117, 141, 100, 186, 251, 12, 151, 134, 164, 66, 133, 250, 1, 205, 236, 53, 7, 205, 238, 125, 201, 183, 226, 178, 29, 60, 187, 204, 16, 14, 238, 153, 103, 132, 59, 5, 115, 41, 253, 204, 166, 41, 152, 237, 15, 17, 179, 140, 232, 176, 171, 199, 222, 57, 1, 124, 113, 207, 208, 174, 87, 84, 108, 85, 145, 68, 205, 208, 175, 208, 100, 95, 126, 168, 255, 7, 185, 116, 209, 237, 68, 253, 31, 142, 0, 245, 96, 191, 109, 69, 2, 129, 129, 0, 133, 41, 239, 144, 115, 207, 143, 123, 95, 249, 226, 26, 186, 223, 58, 65, 115, 211, 144, 6, 112, 223, 175, 89, 66, 106, 188, 223, 4, 147, 193, 61, 47, 29, 27, 70, 184, 36, 166, 172, 24, 148, 179, 217, 37, 37, 12, 24, 30, 52, 114, 193, 96, 120, 5, 110, 177, 154, 141, 40, 247, 31, 48, 128, 146, 117, 52, 129, 212, 148, 68, 253, 247, 140, 158, 166, 194, 68, 7, 220, 1, 142, 119, 211, 175, 239, 56, 91, 47, 247, 67, 158, 150, 35, 121, 65, 51, 45, 212, 70, 206, 190, 255, 219, 68, 4, 254, 79, 113, 89, 81, 97, 208, 22, 64, 44, 51, 77, 15, 87, 198, 26, 190, 79, 249, 244, 203, 249, 2, 129, 129, 0, 135, 216, 119, 8, 212, 103, 99, 228, 204, 190, 178, 209, 233, 113, 46, 91, 240, 33, 109, 112, 222, 148, 32, 165, 178, 6, 155, 116, 89, 185, 159, 93, 159, 127, 47, 173, 124, 215, 154, 174, 230, 122, 127, 154, 52, 67, 126, 60, 121, 168, 74, 240, 205, 141, 233, 223, 242, 104, 235, 12, 71, 147, 245, 1, 249, 136, 213, 64, 246, 211, 71, 92, 32, 121, 184, 34, 122, 35, 217, 104, 222, 196, 227, 198, 101, 3, 24, 113, 147, 69, 150, 48, 71, 43, 253, 182, 186, 29, 231, 134, 199, 151, 250, 111, 78, 166, 90, 42, 132, 25, 38, 47, 41, 103, 136, 86, 203, 115, 201, 189, 75, 200, 155, 94, 4, 27, 34, 119]);
-    var spki = new Uint8Array([48, 130, 1, 34, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 3, 130, 1, 15, 0, 48, 130, 1, 10, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1]);
+    var keyFixtures = getRsaKeyFixtures();
+    var pkcs8 = keyFixtures.pkcs8;
+    var spki = keyFixtures.spki;
 
     // plaintext for RSA-PSS
     var plaintext = new Uint8Array([95, 77, 186, 79, 50, 12, 12, 232, 118, 114, 90, 252, 229, 251, 210, 91, 248, 62, 90, 113, 37, 160, 140, 175, 231, 60, 62, 186, 196, 33, 119, 157, 249, 213, 93, 24, 12, 58, 233, 148, 38, 69, 225, 216, 47, 238, 140, 157, 41, 75, 60, 177, 160, 138, 153, 49, 32, 27, 60, 14, 129, 252, 71, 202, 207, 131, 21, 162, 175, 102, 50, 65, 19, 195, 182, 98, 48, 195, 70, 8, 196, 244, 89, 54, 52, 206, 2, 178, 103, 54, 34, 119, 240, 168, 64, 202, 116, 188, 61, 26, 98, 54, 149, 44, 94, 215, 170, 248, 168, 254, 203, 221, 250, 117, 132, 230, 151, 140, 234, 93, 42, 91, 159, 183, 241, 180, 140, 139, 11, 229, 138, 48, 82, 2, 117, 77, 131, 118, 16, 115, 116, 121, 60, 240, 38, 170, 238, 83, 0, 114, 125, 131, 108, 215, 30, 113, 179, 69, 221, 178, 228, 68, 70, 255, 197, 185, 1, 99, 84, 19, 137, 13, 145, 14, 163, 128, 152, 74, 144, 25, 16, 49, 50, 63, 22, 219, 204, 157, 107, 225, 104, 184, 72, 133, 56, 76, 160, 62, 18, 96, 10, 193, 194, 72, 2, 138, 243, 114, 108, 201, 52, 99, 136, 46, 168, 192, 42, 171]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/sign_verify/signature.js b/test/fixtures/wpt/WebCryptoAPI/sign_verify/signature.js
new file mode 100644
index 000000000000..2d734e1d973e
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/sign_verify/signature.js
@@ -0,0 +1,368 @@
+function runSignatureTests(options) {
+  const subtle = self.crypto.subtle;
+  const publicKeyCache = new WeakMap();
+  const privateKeyCache = new WeakMap();
+  const dataLabel = options.dataLabel || 'data';
+
+  function algorithmIdentifier(vector) {
+    return options.algorithmIdentifier(vector);
+  }
+
+  function algorithmName(vector) {
+    const algorithm = algorithmIdentifier(vector);
+    return typeof algorithm === 'string' ? algorithm : algorithm.name;
+  }
+
+  function algorithmWithNameGetter(vector, getter) {
+    const algorithm = algorithmIdentifier(vector);
+    const result = typeof algorithm === 'string' ? {} : { ...algorithm };
+    Object.defineProperty(result, 'name', {
+      enumerable: true,
+      get: getter,
+    });
+    return result;
+  }
+
+  function importAlgorithm(vector) {
+    return options.importAlgorithm
+      ? options.importAlgorithm(vector)
+      : {name: algorithmName(vector)};
+  }
+
+  function cachedKey(cache, vector, usages, importer) {
+    let keys = cache.get(vector);
+    if (keys === undefined) {
+      keys = new Map();
+      cache.set(vector, keys);
+    }
+
+    const cacheKey = usages.join(',');
+    if (!keys.has(cacheKey)) {
+      keys.set(cacheKey, importer());
+    }
+    return keys.get(cacheKey);
+  }
+
+  function publicKey(vector, usages = ['verify']) {
+    return cachedKey(publicKeyCache, vector, usages, function () {
+      return subtle.importKey(
+        vector.publicKeyFormat || 'spki',
+        vector.publicKeyBuffer,
+        importAlgorithm(vector),
+        false,
+        usages
+      );
+    });
+  }
+
+  function privateKey(vector, usages = ['sign']) {
+    return cachedKey(privateKeyCache, vector, usages, function () {
+      return subtle.importKey(
+        vector.privateKeyFormat || 'pkcs8',
+        vector.privateKeyBuffer,
+        importAlgorithm(vector),
+        false,
+        usages
+      );
+    });
+  }
+
+  async function assertInvalidAccess(operation, message) {
+    let error;
+    try {
+      await operation();
+    } catch (caught) {
+      error = caught;
+    }
+    assert_not_equals(error, undefined, message);
+    assert_equals(
+      error.name,
+      'InvalidAccessError',
+      "Should have thrown InvalidAccessError instead of '" + error.message + "'"
+    );
+  }
+
+  options.vectors.forEach(function (vector) {
+    const algorithm = algorithmIdentifier(vector);
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const isVerified = await subtle.verify(
+        algorithm,
+        key,
+        vector.signature,
+        vector.data
+      );
+      assert_true(isVerified, 'Signature verified');
+    }, vector.name + ' verification');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const signature = copyBuffer(vector.signature);
+      signature[0] = 255 - signature[0];
+      const duringCallAlgorithm = algorithmWithNameGetter(vector, function () {
+        signature[0] = vector.signature[0];
+        return algorithmName(vector);
+      });
+      const isVerified = await subtle.verify(
+        duringCallAlgorithm,
+        key,
+        signature,
+        vector.data
+      );
+      assert_true(isVerified, 'Signature verified');
+    }, vector.name + ' verification with altered signature during call');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const signature = copyBuffer(vector.signature);
+      const operation = subtle.verify(algorithm, key, signature, vector.data);
+      signature[0] = 255 - signature[0];
+      assert_true(await operation, 'Signature verified');
+    }, vector.name + ' verification with altered signature after call');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const signature = copyBuffer(vector.signature);
+      const duringCallAlgorithm = algorithmWithNameGetter(vector, function () {
+        signature.buffer.transfer();
+        return algorithmName(vector);
+      });
+      const isVerified = await subtle.verify(
+        duringCallAlgorithm,
+        key,
+        signature,
+        vector.data
+      );
+      assert_false(isVerified, 'Signature is NOT verified');
+    }, vector.name + ' verification with transferred signature during call');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const signature = copyBuffer(vector.signature);
+      const operation = subtle.verify(algorithm, key, signature, vector.data);
+      signature.buffer.transfer();
+      assert_true(await operation, 'Signature verified');
+    }, vector.name + ' verification with transferred signature after call');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const data = copyBuffer(vector.data);
+      data[0] = 255 - data[0];
+      const duringCallAlgorithm = algorithmWithNameGetter(vector, function () {
+        data[0] = vector.data[0];
+        return algorithmName(vector);
+      });
+      const isVerified = await subtle.verify(
+        duringCallAlgorithm,
+        key,
+        vector.signature,
+        data
+      );
+      assert_true(isVerified, 'Signature verified');
+    }, vector.name + ' with altered ' + dataLabel + ' during call');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const data = copyBuffer(vector.data);
+      const operation = subtle.verify(algorithm, key, vector.signature, data);
+      data[0] = 255 - data[0];
+      assert_true(await operation, 'Signature verified');
+    }, vector.name + ' with altered ' + dataLabel + ' after call');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const data = copyBuffer(vector.data);
+      const duringCallAlgorithm = algorithmWithNameGetter(vector, function () {
+        data.buffer.transfer();
+        return algorithmName(vector);
+      });
+      const isVerified = await subtle.verify(
+        duringCallAlgorithm,
+        key,
+        vector.signature,
+        data
+      );
+      assert_false(isVerified, 'Signature is NOT verified');
+    }, vector.name + ' with transferred ' + dataLabel + ' during call');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const data = copyBuffer(vector.data);
+      const operation = subtle.verify(algorithm, key, vector.signature, data);
+      data.buffer.transfer();
+      assert_true(await operation, 'Signature verified');
+    }, vector.name + ' with transferred ' + dataLabel + ' after call');
+
+    promise_test(async function () {
+      const key = await privateKey(vector);
+      await assertInvalidAccess(
+        () => subtle.verify(algorithm, key, vector.signature, vector.data),
+        'Using a private key to verify should fail'
+      );
+    }, vector.name + ' using privateKey to verify');
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      await assertInvalidAccess(
+        () => subtle.sign(algorithm, key, vector.data),
+        'Using a public key to sign should fail'
+      );
+    }, vector.name + ' using publicKey to sign');
+
+    promise_test(async function () {
+      const key = await publicKey(vector, []);
+      await assertInvalidAccess(
+        () => subtle.verify(algorithm, key, vector.signature, vector.data),
+        'Verifying without the verify usage should fail'
+      );
+    }, vector.name + ' no verify usage');
+
+    promise_test(async function () {
+      const verificationKey = await publicKey(vector);
+      const signingKey = await privateKey(vector);
+
+      if (options.roundTrip) {
+        await options.roundTrip({
+          subtle,
+          vector,
+          algorithm,
+          verificationKey,
+          signingKey,
+        });
+        return;
+      }
+
+      if (options.katFirst) {
+        const vectorSignatureIsVerified = await subtle.verify(
+          algorithm,
+          verificationKey,
+          vector.signature,
+          vector.data
+        );
+        assert_true(
+          vectorSignatureIsVerified,
+          'Known-answer signature verified'
+        );
+      }
+
+      const signature = await subtle.sign(algorithm, signingKey, vector.data);
+
+      if (!options.katFirst || !equalBuffers(signature, vector.signature)) {
+        const generatedSignatureIsVerified = await subtle.verify(
+          algorithm,
+          verificationKey,
+          signature,
+          vector.data
+        );
+        assert_true(
+          generatedSignatureIsVerified,
+          'Generated signature verified'
+        );
+      }
+    }, vector.name + ' round trip');
+
+    promise_test(async function () {
+      const wrongKey = options.wrongKey
+        ? await options.wrongKey(vector, 'sign')
+        : await subtle.generateKey(
+            {name: 'HMAC', hash: 'SHA-1'},
+            false,
+            ['sign', 'verify']
+          );
+      await assertInvalidAccess(
+        () => subtle.sign(algorithm, wrongKey, vector.data),
+        'Signing with a key for another algorithm should fail'
+      );
+    }, vector.name + ' signing with wrong algorithm name');
+
+    promise_test(async function () {
+      const wrongKey = options.wrongKey
+        ? await options.wrongKey(vector, 'verify')
+        : await subtle.generateKey(
+            {name: 'HMAC', hash: 'SHA-1'},
+            false,
+            ['sign', 'verify']
+          );
+      await assertInvalidAccess(
+        () => subtle.verify(algorithm, wrongKey, vector.signature, vector.data),
+        'Verifying with a key for another algorithm should fail'
+      );
+    }, vector.name +
+      (options.wrongVerifyLabel || ' verifying with wrong algorithm name'));
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const signature = copyBuffer(vector.signature);
+      signature[0] = 255 - signature[0];
+      const isVerified = await subtle.verify(
+        algorithm,
+        key,
+        signature,
+        vector.data
+      );
+      assert_false(isVerified, 'Signature NOT verified');
+    }, vector.name +
+      (options.alteredSignatureLabel ||
+        ' verification failure due to altered signature'));
+
+    if (options.shortSignature !== false) {
+      promise_test(async function () {
+        const key = await publicKey(vector);
+        const signature = vector.signature.slice(1);
+        const isVerified = await subtle.verify(
+          algorithm,
+          key,
+          signature,
+          vector.data
+        );
+        assert_false(isVerified, 'Signature NOT verified');
+      }, vector.name + ' verification failure due to shortened signature');
+    }
+
+    promise_test(async function () {
+      const key = await publicKey(vector);
+      const data = copyBuffer(vector.data);
+      data[0] = 255 - data[0];
+      const isVerified = await subtle.verify(
+        algorithm,
+        key,
+        vector.signature,
+        data
+      );
+      assert_false(isVerified, 'Signature NOT verified');
+    }, vector.name +
+      (options.alteredDataLabel ||
+        ' verification failure due to altered ' + dataLabel));
+
+    if (options.generatedKeys) {
+      promise_test(async function () {
+        const key = await subtle.generateKey(algorithm, false, ['sign', 'verify']);
+        const signature = await subtle.sign(
+          algorithm,
+          key.privateKey,
+          vector.data
+        );
+        const isVerified = await subtle.verify(
+          algorithm,
+          key.publicKey,
+          signature,
+          vector.data
+        );
+        assert_true(isVerified, 'Verification failed.');
+      }, 'Sign and verify using generated ' + algorithmName(vector) + ' keys.');
+    }
+  });
+
+  (options.invalidVectors || []).forEach(function (vector) {
+    promise_test(async function () {
+      const isVerified = await subtle.verify(
+        algorithmIdentifier(vector),
+        await publicKey(vector),
+        vector.signature,
+        vector.data
+      );
+      assert_false(isVerified, 'Signature unexpectedly verified');
+    }, vector.name + ' verification');
+  });
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
index ca23b7823177..97cf9dff48ae 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCrypto API: supports method tests for algorithms in https://wicg.github.io/webcrypto-modern-algos/
 // META: script=util/helpers.js
+// META: script=util/supports.js
 
 'use strict';
 
@@ -58,73 +59,11 @@ const operations = [
 ];
 
 // Test that supports method exists and is a static method
-test(() => {
-  assert_true(
-      typeof SubtleCrypto.supports === 'function',
-      'SubtleCrypto.supports should be a function');
-}, 'SubtleCrypto.supports method exists');
+testSupportsMethod();
 
 
 // Test standard WebCrypto algorithms for requested operations
-for (const [algorithmName, algorithmInfo] of Object.entries(modernAlgorithms)) {
-  for (const operation of operations) {
-    promise_test(async (t) => {
-      const isSupported = algorithmInfo.operations.includes(operation);
-
-      // Use appropriate algorithm parameters for each operation
-      let algorithm;
-      let lengthOrAdditionalAlgorithm;
-      switch (operation) {
-        case 'generateKey':
-          algorithm = algorithmInfo.keyGenParams || algorithmName;
-          break;
-        case 'importKey':
-          algorithm = algorithmInfo.importParams || algorithmName;
-          break;
-        case 'sign':
-        case 'verify':
-          algorithm = algorithmInfo.signParams || algorithmName;
-          break;
-        case 'encrypt':
-        case 'decrypt':
-          algorithm = algorithmInfo.encryptParams || algorithmName;
-          break;
-        case 'deriveBits':
-          algorithm = algorithmInfo.deriveBitsParams || algorithmName;
-          if (algorithm?.public instanceof Promise) {
-            algorithm.public = (await algorithm.public).publicKey;
-          }
-          if (algorithmName === 'PBKDF2' || algorithmName === 'HKDF') {
-            lengthOrAdditionalAlgorithm = 256;
-          }
-          break;
-        case 'digest':
-          algorithm = algorithmName;
-          break;
-        case 'encapsulateKey':
-        case 'encapsulateBits':
-        case 'decapsulateKey':
-        case 'decapsulateBits':
-          algorithm = algorithmName;
-          if (operation === 'encapsulateKey' || operation === 'decapsulateKey') {
-            lengthOrAdditionalAlgorithm = { name: 'AES-GCM', length: 256 };
-          }
-          break;
-        default:
-          algorithm = algorithmName;
-      }
-
-      const result = SubtleCrypto.supports(operation, algorithm, lengthOrAdditionalAlgorithm);
-
-      if (isSupported) {
-        assert_true(result, `${algorithmName} should support ${operation}`);
-      } else {
-        assert_false(
-            result, `${algorithmName} should not support ${operation}`);
-      }
-    }, `supports(${operation}, ${algorithmName})`);
-  }
-}
+runSupportsTests(modernAlgorithms, operations);
 
 // Test some algorithm objects with valid parameters
 test(() => {
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
index ac3a32c74100..fcccbecd6916 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
@@ -1,5 +1,6 @@
 // META: title=WebCrypto API: supports method tests
 // META: script=util/helpers.js
+// META: script=util/supports.js
 
 'use strict';
 
@@ -156,12 +157,7 @@ const operations = [
 ];
 
 // Test that supports method exists and is a static method
-test(() => {
-  assert_true(
-    typeof SubtleCrypto.supports === 'function',
-    'SubtleCrypto.supports should be a function'
-  );
-}, 'SubtleCrypto.supports method exists');
+testSupportsMethod();
 
 // Test invalid operation names
 test(() => {
@@ -192,57 +188,7 @@ test(() => {
 }, 'supports returns false for invalid algorithms');
 
 // Test standard WebCrypto algorithms for requested operations
-for (const [algorithmName, algorithmInfo] of Object.entries(
-  standardAlgorithms
-)) {
-  for (const operation of operations) {
-    promise_test(async (t) => {
-      const isSupported = algorithmInfo.operations.includes(operation);
-
-      // Use appropriate algorithm parameters for each operation
-      let algorithm;
-      let length;
-      switch (operation) {
-        case 'generateKey':
-          algorithm = algorithmInfo.keyGenParams || algorithmName;
-          break;
-        case 'importKey':
-          algorithm = algorithmInfo.importParams || algorithmName;
-          break;
-        case 'sign':
-        case 'verify':
-          algorithm = algorithmInfo.signParams || algorithmName;
-          break;
-        case 'encrypt':
-        case 'decrypt':
-          algorithm = algorithmInfo.encryptParams || algorithmName;
-          break;
-        case 'deriveBits':
-          algorithm = algorithmInfo.deriveBitsParams || algorithmName;
-          if (algorithm?.public instanceof Promise) {
-            algorithm.public = (await algorithm.public).publicKey;
-          }
-          if (algorithmName === 'PBKDF2' || algorithmName === 'HKDF') {
-            length = 256;
-          }
-          break;
-        case 'digest':
-          algorithm = algorithmName;
-          break;
-        default:
-          algorithm = algorithmName;
-      }
-
-      const result = SubtleCrypto.supports(operation, algorithm, length);
-
-      if (isSupported) {
-        assert_true(result, `${algorithmName} should support ${operation}`);
-      } else {
-        assert_false(result, `${algorithmName} should not support ${operation}`);
-      }
-    }, `supports(${operation}, ${algorithmName})`);
-  }
-}
+runSupportsTests(standardAlgorithms, operations);
 
 // Test algorithm objects (not just strings)
 test(() => {
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/ec_key_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/util/ec_key_fixtures.js
new file mode 100644
index 000000000000..e298fa8f9ebe
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/util/ec_key_fixtures.js
@@ -0,0 +1,50 @@
+var ecKeyData = {
+    "P-521": {
+        spki: new Uint8Array([48, 129, 155, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
+        spki_compressed: new Uint8Array([48, 88, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 3, 68, 0, 3, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63]),
+        raw: new Uint8Array([4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
+        raw_compressed: new Uint8Array([3, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63]),
+        pkcs8: new Uint8Array([48, 129, 238, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 129, 214, 48, 129, 211, 2, 1, 1, 4, 66, 0, 244, 8, 117, 131, 104, 186, 147, 15, 48, 247, 106, 224, 84, 254, 92, 210, 206, 127, 218, 44, 159, 118, 166, 212, 54, 207, 117, 214, 108, 68, 11, 254, 99, 49, 199, 193, 114, 161, 36, 120, 25, 60, 130, 81, 72, 123, 201, 18, 99, 250, 80, 33, 127, 133, 255, 99, 111, 89, 205, 84, 110, 58, 180, 131, 180, 161, 129, 137, 3, 129, 134, 0, 4, 1, 86, 244, 121, 248, 223, 30, 32, 167, 255, 192, 76, 228, 32, 195, 225, 84, 174, 37, 25, 150, 190, 228, 47, 3, 75, 132, 212, 27, 116, 63, 52, 228, 95, 49, 27, 129, 58, 156, 222, 200, 205, 165, 155, 187, 189, 49, 212, 96, 179, 41, 37, 33, 231, 193, 183, 34, 229, 102, 124, 3, 219, 47, 174, 117, 63, 1, 80, 23, 54, 207, 226, 71, 57, 67, 32, 216, 228, 175, 194, 253, 57, 181, 169, 51, 16, 97, 184, 30, 34, 65, 40, 43, 158, 23, 137, 24, 34, 181, 183, 158, 5, 47, 69, 151, 181, 150, 67, 253, 57, 55, 156, 81, 189, 81, 37, 196, 244, 139, 195, 240, 37, 206, 60, 211, 105, 83, 40, 108, 203, 56, 251]),
+        pkcs8_private_only: new Uint8Array([48, 96, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 35, 4, 73, 48, 71, 2, 1, 1, 4, 66, 0, 244, 8, 117, 131, 104, 186, 147, 15, 48, 247, 106, 224, 84, 254, 92, 210, 206, 127, 218, 44, 159, 118, 166, 212, 54, 207, 117, 214, 108, 68, 11, 254, 99, 49, 199, 193, 114, 161, 36, 120, 25, 60, 130, 81, 72, 123, 201, 18, 99, 250, 80, 33, 127, 133, 255, 99, 111, 89, 205, 84, 110, 58, 180, 131, 180]),
+        jwk: {
+            kty: "EC",
+            crv: "P-521",
+            x: "AVb0efjfHiCn_8BM5CDD4VSuJRmWvuQvA0uE1Bt0PzTkXzEbgTqc3sjNpZu7vTHUYLMpJSHnwbci5WZ8A9svrnU_",
+            y: "AVAXNs_iRzlDINjkr8L9ObWpMxBhuB4iQSgrnheJGCK1t54FL0WXtZZD_Tk3nFG9USXE9IvD8CXOPNNpUyhsyzj7",
+            d: "APQIdYNoupMPMPdq4FT-XNLOf9osn3am1DbPddZsRAv-YzHHwXKhJHgZPIJRSHvJEmP6UCF_hf9jb1nNVG46tIO0"
+        }
+    },
+
+    "P-256": {
+        spki: new Uint8Array([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
+        spki_compressed: new Uint8Array([48, 57, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 34, 0, 2, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209]),
+        raw: new Uint8Array([4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
+        raw_compressed: new Uint8Array([2, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209]),
+        pkcs8: new Uint8Array([48, 129, 135, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 109, 48, 107, 2, 1, 1, 4, 32, 19, 211, 58, 45, 90, 191, 156, 249, 235, 178, 31, 248, 96, 212, 174, 254, 110, 86, 231, 119, 144, 244, 222, 233, 180, 8, 132, 235, 211, 53, 68, 234, 161, 68, 3, 66, 0, 4, 210, 16, 176, 166, 249, 217, 240, 18, 134, 128, 88, 180, 63, 164, 244, 113, 1, 133, 67, 187, 160, 12, 146, 80, 223, 146, 87, 194, 172, 174, 93, 209, 206, 3, 117, 82, 212, 129, 69, 12, 227, 155, 77, 16, 149, 112, 27, 23, 91, 250, 179, 75, 142, 108, 9, 158, 24, 241, 193, 152, 53, 131, 97, 232]),
+        pkcs8_private_only: new Uint8Array([48, 65, 2, 1, 0, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 4, 39, 48, 37, 2, 1, 1, 4, 32, 19, 211, 58, 45, 90, 191, 156, 249, 235, 178, 31, 248, 96, 212, 174, 254, 110, 86, 231, 119, 144, 244, 222, 233, 180, 8, 132, 235, 211, 53, 68, 234]),
+        jwk: {
+            kty: "EC",
+            crv: "P-256",
+            x: "0hCwpvnZ8BKGgFi0P6T0cQGFQ7ugDJJQ35JXwqyuXdE",
+            y: "zgN1UtSBRQzjm00QlXAbF1v6s0uObAmeGPHBmDWDYeg",
+            d: "E9M6LVq_nPnrsh_4YNSu_m5W53eQ9N7ptAiE69M1ROo"
+        }
+    },
+
+    "P-384": {
+        spki: new Uint8Array([48, 118, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
+        spki_compressed: new Uint8Array([48, 70, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 3, 50, 0, 2, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53]),
+        raw: new Uint8Array([4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
+        raw_compressed: new Uint8Array([2, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53]),
+        pkcs8: new Uint8Array([48, 129, 182, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 129, 158, 48, 129, 155, 2, 1, 1, 4, 48, 69, 55, 181, 153, 7, 132, 211, 194, 210, 46, 150, 168, 249, 47, 161, 170, 73, 46, 232, 115, 229, 118, 164, 21, 130, 225, 68, 24, 60, 152, 136, 209, 14, 107, 158, 180, 206, 212, 178, 204, 64, 18, 228, 172, 94, 168, 64, 115, 161, 100, 3, 98, 0, 4, 33, 156, 20, 214, 102, 23, 179, 110, 198, 216, 133, 107, 56, 91, 115, 167, 77, 52, 79, 216, 174, 117, 239, 4, 100, 53, 221, 165, 78, 59, 68, 189, 95, 189, 235, 209, 208, 141, 214, 158, 45, 125, 193, 220, 33, 140, 180, 53, 189, 40, 19, 140, 199, 120, 51, 122, 132, 47, 107, 214, 27, 36, 14, 116, 36, 159, 36, 102, 124, 42, 88, 16, 167, 107, 252, 40, 224, 51, 95, 136, 166, 80, 29, 236, 1, 151, 109, 168, 90, 251, 0, 134, 156, 182, 172, 232]),
+        pkcs8_private_only: new Uint8Array([48, 78, 2, 1, 0, 48, 16, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 5, 43, 129, 4, 0, 34, 4, 55, 48, 53, 2, 1, 1, 4, 48, 69, 55, 181, 153, 7, 132, 211, 194, 210, 46, 150, 168, 249, 47, 161, 170, 73, 46, 232, 115, 229, 118, 164, 21, 130, 225, 68, 24, 60, 152, 136, 209, 14, 107, 158, 180, 206, 212, 178, 204, 64, 18, 228, 172, 94, 168, 64, 115]),
+        jwk: {
+            kty: "EC",
+            crv: "P-384",
+            x: "IZwU1mYXs27G2IVrOFtzp000T9iude8EZDXdpU47RL1fvevR0I3Wni19wdwhjLQ1",
+            y: "vSgTjMd4M3qEL2vWGyQOdCSfJGZ8KlgQp2v8KOAzX4imUB3sAZdtqFr7AIactqzo",
+            d: "RTe1mQeE08LSLpao-S-hqkku6HPldqQVguFEGDyYiNEOa560ztSyzEAS5KxeqEBz"
+        }
+    },
+
+};
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/helpers.js b/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
index 3d44b7a7550e..cc44dd16b1c9 100644
--- a/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
+++ b/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
@@ -40,6 +40,21 @@ var registeredAlgorithmNames = [
     "KMAC256",
 ];
 
+var allKeyUsages = [
+    "encrypt",
+    "decrypt",
+    "sign",
+    "verify",
+    "wrapKey",
+    "unwrapKey",
+    "deriveKey",
+    "deriveBits",
+    "encapsulateKey",
+    "encapsulateBits",
+    "decapsulateKey",
+    "decapsulateBits",
+];
+
 
 // Treats an array as a set, and generates an array of all non-empty
 // subsets (which are themselves arrays).
@@ -86,6 +101,35 @@ function objectToString(obj) {
     }
 }
 
+function mismatchedCryptoKeyAlgorithmMembers(keyAlgorithm, algorithm, registeredAlgorithmName) {
+    const mismatches = [];
+
+    if (["HMAC", "RSASSA-PKCS1-v1_5", "RSA-PSS", "RSA-OAEP"].includes(registeredAlgorithmName)) {
+        const expectedHash = typeof algorithm.hash === "string" ?
+            algorithm.hash : algorithm.hash.name;
+        if (keyAlgorithm.hash.name.toUpperCase() !== expectedHash.toUpperCase()) {
+            mismatches.push("hash");
+        }
+    }
+
+    if (algorithm.namedCurve !== undefined &&
+        keyAlgorithm.namedCurve !== algorithm.namedCurve) {
+        mismatches.push("namedCurve");
+    }
+
+    if (algorithm.modulusLength !== undefined &&
+        keyAlgorithm.modulusLength !== algorithm.modulusLength) {
+        mismatches.push("modulusLength");
+    }
+
+    if (algorithm.publicExponent !== undefined &&
+        !equalBuffers(keyAlgorithm.publicExponent, algorithm.publicExponent)) {
+        mismatches.push("publicExponent");
+    }
+
+    return mismatches;
+}
+
 // Is key a CryptoKey object with correct algorithm, extractable, and usages?
 // Is it a secret, private, or public kind of key?
 function assert_goodCryptoKey(key, algorithm, extractable, usages, kind) {
@@ -132,9 +176,13 @@ function assert_goodCryptoKey(key, algorithm, extractable, usages, kind) {
     } else {
         assert_equals(key.algorithm.length, algorithm.length, "Correct length");
     }
-    if (["HMAC", "RSASSA-PKCS1-v1_5", "RSA-PSS"].includes(registeredAlgorithmName)) {
-        assert_equals(key.algorithm.hash.name.toUpperCase(), algorithm.hash.toUpperCase(), "Correct hash function");
-    }
+    assert_array_equals(
+        mismatchedCryptoKeyAlgorithmMembers(
+            key.algorithm,
+            algorithm,
+            registeredAlgorithmName),
+        [],
+        "Algorithm members are correct");
 
     if (/^(?:Ed|X)(?:25519|448)$/.test(key.algorithm.name)) {
         assert_false('namedCurve' in key.algorithm, "Does not have a namedCurve property");
@@ -164,12 +212,9 @@ function assert_goodCryptoKey(key, algorithm, extractable, usages, kind) {
 
     // The usages parameter could have repeats, but the usages
     // property of the result should not.
-    var usageCount = 0;
-    key.usages.forEach(function(usage) {
-        usageCount += 1;
-        assert_in_array(usage, correctUsages, "Has " + usage + " usage");
-    });
-    assert_equals(key.usages.length, usageCount, "usages property is correct");
+    const expectedUsages = unique(correctUsages).sort();
+    const actualUsages = [...key.usages].sort();
+    assert_array_equals(actualUsages, expectedUsages, "usages property is correct");
     assert_equals(key[Symbol.toStringTag], 'CryptoKey', "has the expected Symbol.toStringTag");
 }
 
@@ -287,7 +332,7 @@ function bytesToHexString(bytes)
     if (!bytes)
         return null;
 
-    bytes = new Uint8Array(bytes);
+    bytes = byteView(bytes);
     var hexBytes = [];
 
     for (var i = 0; i < bytes.length; ++i) {
@@ -302,18 +347,25 @@ function bytesToHexString(bytes)
 
 function hexStringToUint8Array(hexString)
 {
-    if (hexString.length % 2 != 0)
-        throw "Invalid hexString";
-    var arrayBuffer = new Uint8Array(hexString.length / 2);
-
-    for (var i = 0; i < hexString.length; i += 2) {
-        var byteValue = parseInt(hexString.substr(i, 2), 16);
-        if (byteValue == NaN)
-            throw "Invalid hexString";
-        arrayBuffer[i/2] = byteValue;
+    if (hexString.length % 2 !== 0 || !/^[0-9a-f]*$/i.test(hexString)) {
+        throw new TypeError("Invalid hexadecimal string");
     }
 
-    return arrayBuffer;
+    const result = new Uint8Array(hexString.length / 2);
+
+    for (let i = 0; i < hexString.length; i += 2) {
+        result[i / 2] = parseInt(hexString.slice(i, i + 2), 16);
+    }
+
+    return result;
+}
+
+function byteView(source) {
+    if (ArrayBuffer.isView(source)) {
+        return new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+    }
+
+    return new Uint8Array(source);
 }
 
 // Compares two ArrayBuffer or ArrayBufferView objects. If bitCount is
@@ -321,44 +373,39 @@ function hexStringToUint8Array(hexString)
 // in every byte. If bitCount is included, only that leading number of bits
 // have to match.
 function equalBuffers(a, b, bitCount) {
-    var remainder;
+    const aBytes = byteView(a);
+    const bBytes = byteView(b);
 
-    if (typeof bitCount === "undefined" && a.byteLength !== b.byteLength) {
+    if (typeof bitCount === "undefined") {
+        if (aBytes.byteLength !== bBytes.byteLength) {
+            return false;
+        }
+        bitCount = aBytes.byteLength * 8;
+    } else if (!Number.isInteger(bitCount) || bitCount < 0 ||
+               bitCount > aBytes.byteLength * 8 ||
+               bitCount > bBytes.byteLength * 8) {
         return false;
     }
 
-    var aBytes = new Uint8Array(a);
-    var bBytes = new Uint8Array(b);
-
-    var length = a.byteLength;
-    if (typeof bitCount !== "undefined") {
-        length = Math.floor(bitCount / 8);
-    }
-
-    for (var i=0; i<length; i++) {
+    const length = Math.floor(bitCount / 8);
+    for (let i = 0; i < length; i++) {
         if (aBytes[i] !== bBytes[i]) {
             return false;
         }
     }
 
-    if (typeof bitCount !== "undefined") {
-        remainder = bitCount % 8;
-        return aBytes[length] >> (8 - remainder) === bBytes[length] >> (8 - remainder);
+    const remainder = bitCount % 8;
+    if (remainder === 0) {
+        return true;
     }
 
-    return true;
+    const mask = 0xff << (8 - remainder);
+    return (aBytes[length] & mask) === (bBytes[length] & mask);
 }
 
 // Returns a copy of the sourceBuffer it is sent.
 function copyBuffer(sourceBuffer) {
-    var source = new Uint8Array(sourceBuffer);
-    var copy = new Uint8Array(sourceBuffer.byteLength)
-
-    for (var i=0; i<source.byteLength; i++) {
-        copy[i] = source[i];
-    }
-
-    return copy;
+    return new Uint8Array(byteView(sourceBuffer));
 }
 
 // Are two Jwk objects "the same"? That is, does the object returned include
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/mldsa_key_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/util/mldsa_key_fixtures.js
new file mode 100644
index 000000000000..7b5170cdfeac
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/util/mldsa_key_fixtures.js
@@ -0,0 +1,394 @@
+function getMldsaKeyFixtures() {
+  // PKCS#8 private keys for ML-DSA variants
+  const pkcs8 = {
+    'ML-DSA-44': new Uint8Array([
+      48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 17, 4, 34, 128,
+      32, 153, 21, 95, 99, 48, 150, 218, 124, 190, 8, 122, 137, 72, 184, 79, 118,
+      123, 16, 249, 1, 200, 35, 194, 64, 177, 221, 43, 200, 112, 5, 201, 62,
+    ]),
+    'ML-DSA-65': new Uint8Array([
+      48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 18, 4, 34, 128,
+      32, 132, 164, 137, 75, 123, 70, 164, 178, 3, 156, 206, 16, 195, 26, 133,
+      186, 176, 195, 102, 48, 254, 35, 29, 66, 103, 17, 67, 152, 38, 7, 130, 139,
+    ]),
+    'ML-DSA-87': new Uint8Array([
+      48, 52, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 19, 4, 34, 128,
+      32, 161, 80, 109, 145, 76, 109, 101, 140, 117, 39, 228, 51, 151, 221, 109,
+      76, 37, 246, 164, 121, 116, 51, 90, 76, 208, 59, 254, 105, 131, 68, 18, 81,
+    ]),
+  };
+
+  // SPKI public keys for ML-DSA variants
+  const spki = {
+    'ML-DSA-44': new Uint8Array([
+      48, 130, 5, 50, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 17, 3, 130, 5,
+      33, 0, 85, 152, 213, 68, 198, 20, 177, 84, 200, 188, 33, 104, 36, 161, 193,
+      127, 226, 151, 48, 107, 122, 191, 89, 86, 188, 3, 245, 199, 18, 79, 168,
+      192, 218, 218, 223, 227, 84, 133, 41, 187, 9, 183, 14, 222, 155, 137, 84,
+      111, 138, 97, 234, 152, 52, 15, 163, 47, 227, 218, 19, 20, 229, 93, 99, 252,
+      155, 213, 30, 241, 158, 211, 213, 191, 155, 73, 211, 145, 59, 194, 75, 140,
+      3, 161, 149, 139, 48, 172, 155, 172, 120, 234, 142, 79, 78, 116, 215, 184,
+      50, 182, 162, 192, 93, 221, 179, 216, 70, 186, 92, 93, 51, 190, 61, 173,
+      105, 206, 9, 208, 52, 54, 208, 252, 115, 176, 146, 118, 23, 0, 5, 41, 151,
+      121, 241, 246, 193, 206, 212, 160, 181, 7, 99, 220, 78, 96, 123, 142, 35,
+      107, 37, 218, 138, 139, 228, 207, 166, 132, 87, 36, 116, 251, 174, 10, 41,
+      196, 171, 26, 212, 90, 213, 223, 141, 87, 232, 59, 46, 173, 16, 247, 173, 4,
+      219, 165, 234, 8, 217, 233, 163, 13, 10, 160, 22, 87, 232, 2, 9, 92, 177,
+      35, 67, 55, 104, 51, 204, 231, 81, 209, 62, 31, 117, 56, 141, 78, 109, 148,
+      118, 191, 93, 193, 59, 30, 88, 237, 19, 169, 14, 11, 150, 102, 215, 144, 69,
+      246, 32, 159, 110, 49, 75, 78, 225, 121, 184, 206, 234, 126, 171, 164, 43,
+      237, 244, 63, 83, 70, 136, 213, 244, 121, 184, 34, 201, 249, 95, 64, 165,
+      99, 14, 195, 231, 18, 121, 20, 156, 80, 231, 133, 197, 0, 94, 195, 22, 251,
+      255, 174, 213, 103, 75, 88, 58, 138, 66, 37, 85, 162, 15, 242, 29, 49, 147,
+      191, 163, 170, 109, 195, 22, 63, 197, 149, 117, 100, 36, 81, 115, 203, 126,
+      62, 86, 103, 193, 182, 69, 238, 233, 162, 62, 248, 132, 158, 212, 208, 187,
+      127, 212, 198, 169, 245, 26, 153, 28, 207, 85, 65, 145, 200, 23, 196, 38,
+      64, 49, 54, 233, 185, 72, 156, 86, 230, 127, 152, 108, 184, 240, 109, 8,
+      103, 228, 206, 142, 73, 74, 214, 52, 182, 203, 82, 201, 175, 188, 111, 42,
+      232, 8, 177, 131, 47, 237, 92, 120, 210, 124, 48, 185, 215, 137, 36, 70,
+      162, 164, 119, 0, 155, 20, 57, 33, 27, 220, 77, 254, 233, 190, 106, 135, 21,
+      194, 57, 238, 95, 162, 78, 164, 33, 210, 215, 43, 100, 96, 232, 87, 19, 43,
+      65, 240, 183, 17, 131, 247, 97, 241, 7, 111, 159, 40, 252, 45, 228, 76, 71,
+      46, 85, 181, 54, 41, 135, 162, 144, 227, 128, 121, 173, 207, 119, 54, 19,
+      197, 23, 231, 176, 125, 190, 32, 76, 60, 34, 24, 160, 42, 73, 190, 124, 99,
+      5, 9, 214, 6, 220, 177, 206, 79, 222, 10, 142, 250, 63, 179, 67, 21, 159,
+      57, 126, 239, 28, 238, 240, 107, 79, 185, 174, 232, 168, 146, 128, 229, 119,
+      19, 21, 33, 239, 193, 42, 178, 152, 124, 24, 203, 131, 193, 93, 162, 2, 208,
+      231, 20, 203, 232, 47, 54, 114, 255, 236, 97, 99, 156, 15, 160, 75, 60, 111,
+      59, 35, 25, 230, 43, 91, 170, 161, 74, 70, 179, 180, 251, 71, 197, 240, 104,
+      42, 39, 202, 206, 12, 115, 249, 138, 55, 252, 216, 61, 185, 121, 76, 137,
+      172, 166, 88, 92, 130, 18, 52, 67, 13, 187, 49, 147, 212, 77, 74, 56, 59,
+      123, 99, 205, 36, 137, 96, 111, 148, 121, 157, 2, 83, 246, 86, 156, 152, 98,
+      172, 77, 244, 214, 225, 184, 240, 121, 144, 56, 213, 161, 43, 67, 4, 161,
+      104, 202, 91, 134, 247, 108, 24, 46, 187, 63, 216, 50, 125, 120, 17, 216,
+      22, 228, 156, 253, 7, 180, 15, 130, 180, 72, 71, 169, 3, 236, 247, 11, 170,
+      32, 76, 236, 225, 133, 250, 20, 235, 200, 143, 89, 25, 158, 49, 158, 164,
+      213, 221, 81, 120, 241, 150, 210, 19, 79, 165, 24, 35, 170, 182, 242, 255,
+      143, 171, 148, 140, 41, 207, 186, 98, 224, 16, 152, 224, 38, 110, 175, 169,
+      111, 132, 201, 178, 114, 25, 196, 50, 149, 158, 193, 180, 101, 183, 92, 109,
+      131, 102, 119, 123, 78, 107, 223, 4, 1, 206, 140, 130, 237, 205, 36, 18,
+      180, 197, 154, 26, 236, 140, 173, 230, 101, 35, 189, 121, 104, 21, 75, 81,
+      224, 186, 212, 81, 107, 66, 244, 235, 64, 90, 206, 39, 44, 43, 162, 187, 63,
+      229, 217, 154, 185, 157, 24, 125, 252, 91, 136, 59, 47, 182, 200, 73, 19,
+      137, 132, 81, 16, 234, 227, 210, 32, 16, 160, 188, 250, 27, 190, 164, 53,
+      244, 219, 199, 177, 146, 117, 50, 99, 72, 235, 37, 154, 72, 51, 203, 61, 39,
+      230, 34, 132, 117, 217, 167, 201, 42, 17, 76, 72, 103, 172, 93, 169, 29, 76,
+      88, 178, 226, 32, 53, 190, 60, 210, 132, 113, 198, 26, 70, 179, 47, 34, 184,
+      88, 178, 208, 1, 196, 89, 136, 167, 33, 38, 9, 255, 89, 202, 27, 93, 229,
+      100, 192, 24, 234, 200, 186, 125, 231, 212, 188, 11, 29, 51, 189, 70, 147,
+      176, 231, 81, 16, 114, 152, 159, 21, 124, 185, 208, 50, 74, 211, 113, 207,
+      35, 54, 173, 205, 133, 52, 167, 199, 87, 158, 120, 33, 204, 163, 146, 233,
+      21, 61, 28, 102, 48, 232, 184, 15, 219, 238, 240, 215, 222, 239, 3, 110,
+      180, 95, 103, 147, 236, 10, 57, 195, 159, 231, 50, 92, 145, 165, 44, 204,
+      121, 187, 9, 210, 80, 86, 251, 169, 132, 236, 248, 23, 207, 222, 227, 13,
+      53, 1, 88, 69, 105, 13, 238, 202, 251, 194, 245, 14, 38, 1, 245, 157, 212,
+      162, 182, 217, 230, 115, 139, 175, 219, 199, 74, 124, 186, 158, 3, 220, 87,
+      220, 177, 85, 13, 58, 168, 223, 6, 238, 156, 80, 121, 44, 166, 176, 0, 48,
+      98, 70, 93, 78, 50, 192, 16, 186, 2, 233, 105, 105, 120, 195, 17, 100, 141,
+      214, 158, 144, 63, 4, 88, 190, 101, 209, 55, 119, 46, 128, 117, 225, 121,
+      204, 195, 19, 61, 170, 116, 251, 225, 230, 28, 27, 249, 84, 195, 224, 190,
+      60, 212, 83, 3, 148, 204, 4, 103, 50, 233, 175, 207, 47, 51, 216, 79, 251,
+      150, 81, 171, 7, 145, 55, 188, 187, 217, 200, 155, 246, 85, 42, 123, 18,
+      112, 192, 116, 163, 40, 187, 132, 192, 210, 188, 106, 117, 217, 185, 183,
+      202, 33, 11, 205, 10, 61, 52, 15, 66, 131, 121, 112, 26, 96, 166, 241, 1,
+      68, 206, 80, 92, 132, 83, 89, 126, 135, 157, 4, 202, 16, 5, 131, 112, 62,
+      56, 234, 176, 213, 119, 205, 203, 17, 106, 156, 117, 251, 135, 21, 73, 219,
+      238, 3, 88, 21, 71, 136, 118, 0, 7, 106, 151, 200, 221, 179, 206, 50, 198,
+      27, 118, 181, 27, 85, 35, 248, 44, 57, 15, 221, 97, 121, 4, 167, 111, 182,
+      207, 195, 52, 134, 195, 128, 173, 111, 98, 152, 29, 138, 197, 175, 171, 247,
+      194, 20, 134, 209, 232, 94, 17, 203, 139, 30, 237, 187, 243, 16, 180, 43,
+      105, 236, 66, 175, 170, 139, 24, 99, 28, 225, 141, 96, 250, 119, 0, 111,
+      212, 34, 217, 42, 134, 88, 78, 76, 126, 169, 168, 59, 154, 93, 54, 43, 161,
+      29, 111, 124, 59, 225, 52, 86, 147, 38, 151, 161, 36, 119, 204, 164, 121,
+      46, 186, 65, 84, 70, 38, 15, 203, 48, 168, 235, 231, 30, 55, 95, 36, 10, 20,
+      166, 109, 8, 18, 109, 251, 213, 82, 142, 240, 49, 249, 180, 78, 69,
+    ]),
+    'ML-DSA-65': new Uint8Array([
+      48, 130, 7, 178, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 18, 3, 130, 7,
+      161, 0, 216, 177, 233, 60, 151, 24, 246, 66, 175, 161, 192, 118, 9, 177, 87,
+      232, 5, 216, 49, 254, 251, 160, 51, 216, 250, 171, 229, 104, 149, 117, 135,
+      107, 5, 239, 244, 167, 83, 57, 49, 153, 29, 135, 108, 138, 117, 236, 120,
+      65, 89, 65, 17, 201, 127, 147, 246, 103, 238, 204, 25, 83, 240, 29, 173,
+      127, 140, 1, 88, 40, 43, 134, 51, 19, 125, 131, 224, 50, 167, 82, 20, 217,
+      215, 162, 41, 95, 215, 56, 130, 226, 177, 216, 20, 169, 133, 85, 140, 9,
+      105, 172, 54, 121, 0, 87, 202, 18, 93, 96, 147, 103, 127, 164, 63, 197, 97,
+      49, 230, 125, 53, 80, 64, 20, 239, 29, 90, 118, 102, 221, 177, 6, 220, 220,
+      170, 107, 107, 18, 138, 125, 138, 70, 66, 60, 185, 232, 209, 4, 100, 17,
+      118, 24, 181, 110, 241, 50, 250, 138, 209, 19, 84, 220, 61, 96, 80, 128, 81,
+      101, 160, 9, 5, 53, 33, 112, 60, 59, 195, 79, 115, 190, 101, 93, 56, 171,
+      146, 51, 82, 233, 66, 225, 226, 211, 72, 58, 9, 74, 222, 185, 175, 211, 156,
+      164, 68, 188, 119, 46, 14, 64, 160, 13, 207, 60, 81, 68, 108, 148, 59, 88,
+      88, 92, 88, 171, 249, 204, 160, 137, 222, 234, 168, 233, 3, 86, 224, 174,
+      105, 224, 1, 177, 184, 230, 236, 30, 85, 249, 56, 105, 211, 50, 83, 168,
+      139, 28, 175, 181, 22, 89, 166, 215, 152, 218, 184, 111, 65, 24, 82, 71,
+      185, 100, 172, 66, 178, 6, 215, 164, 252, 56, 40, 198, 207, 152, 110, 186,
+      207, 39, 235, 179, 38, 215, 88, 105, 109, 177, 130, 91, 5, 223, 164, 78,
+      241, 176, 125, 197, 94, 100, 40, 214, 251, 239, 253, 88, 154, 14, 75, 254,
+      94, 210, 86, 244, 51, 95, 168, 139, 213, 73, 87, 151, 209, 150, 126, 88, 69,
+      251, 116, 157, 122, 96, 212, 206, 42, 218, 38, 85, 184, 50, 246, 188, 35,
+      72, 60, 226, 155, 246, 86, 209, 110, 133, 161, 129, 126, 80, 154, 238, 64,
+      64, 170, 156, 177, 225, 52, 87, 42, 88, 154, 174, 246, 30, 84, 143, 221, 51,
+      27, 65, 60, 40, 22, 120, 42, 145, 34, 82, 235, 79, 20, 215, 211, 231, 151,
+      108, 119, 53, 116, 190, 13, 139, 199, 189, 84, 54, 186, 222, 90, 116, 253,
+      227, 207, 104, 209, 118, 42, 144, 94, 22, 219, 198, 211, 216, 171, 75, 245,
+      61, 240, 157, 108, 81, 19, 238, 39, 120, 210, 242, 63, 126, 6, 15, 18, 97,
+      232, 207, 184, 84, 239, 72, 115, 90, 95, 112, 78, 45, 201, 13, 102, 208,
+      151, 146, 253, 153, 177, 115, 14, 194, 184, 107, 118, 120, 63, 105, 89, 144,
+      60, 242, 80, 106, 32, 11, 204, 170, 165, 221, 182, 31, 187, 159, 216, 118,
+      218, 207, 182, 107, 136, 211, 162, 231, 196, 128, 83, 251, 192, 189, 149, 1,
+      245, 36, 146, 159, 11, 116, 30, 191, 141, 182, 157, 227, 91, 88, 72, 224,
+      55, 195, 96, 245, 135, 249, 142, 16, 229, 237, 27, 60, 2, 91, 138, 82, 197,
+      210, 40, 8, 123, 172, 202, 207, 119, 199, 190, 102, 40, 141, 174, 93, 211,
+      219, 134, 105, 26, 103, 100, 102, 62, 130, 224, 135, 173, 82, 224, 200, 213,
+      76, 211, 38, 181, 16, 97, 99, 75, 14, 42, 162, 223, 237, 141, 1, 29, 140,
+      191, 146, 49, 236, 179, 88, 202, 220, 124, 239, 231, 131, 101, 134, 111, 28,
+      54, 151, 172, 67, 167, 113, 96, 204, 63, 76, 169, 95, 14, 175, 149, 189,
+      173, 39, 177, 102, 23, 158, 102, 236, 224, 70, 203, 190, 132, 230, 136, 3,
+      28, 201, 131, 148, 164, 219, 181, 208, 26, 239, 111, 86, 35, 102, 133, 114,
+      113, 180, 184, 82, 180, 106, 124, 248, 126, 87, 177, 165, 176, 204, 128,
+      141, 179, 141, 34, 119, 160, 57, 206, 168, 95, 197, 110, 79, 60, 48, 170,
+      125, 206, 147, 137, 156, 85, 46, 7, 193, 228, 150, 22, 46, 147, 51, 153,
+      157, 248, 151, 253, 114, 58, 126, 38, 127, 19, 225, 99, 183, 235, 175, 90,
+      166, 8, 233, 141, 10, 85, 232, 147, 7, 20, 137, 240, 84, 231, 86, 134, 50,
+      212, 201, 6, 253, 18, 150, 114, 160, 140, 2, 254, 189, 152, 14, 68, 110, 50,
+      134, 199, 73, 237, 56, 116, 110, 135, 36, 40, 14, 167, 50, 71, 81, 9, 178,
+      54, 182, 247, 64, 32, 204, 116, 92, 131, 40, 30, 246, 188, 236, 182, 187,
+      132, 239, 124, 136, 238, 146, 137, 247, 87, 52, 15, 78, 108, 135, 178, 101,
+      70, 199, 193, 192, 144, 196, 106, 186, 141, 42, 101, 214, 196, 67, 175, 38,
+      8, 189, 148, 166, 253, 221, 144, 119, 81, 1, 232, 175, 81, 237, 13, 188,
+      220, 230, 47, 115, 184, 179, 0, 51, 118, 39, 22, 114, 232, 88, 15, 121, 216,
+      130, 107, 173, 108, 175, 225, 113, 40, 223, 185, 6, 244, 227, 73, 38, 64,
+      84, 10, 200, 53, 81, 179, 217, 106, 172, 59, 161, 70, 180, 70, 48, 56, 46,
+      233, 133, 245, 57, 120, 154, 167, 49, 109, 188, 152, 245, 181, 1, 159, 247,
+      44, 167, 152, 6, 191, 246, 38, 120, 141, 57, 241, 168, 60, 38, 6, 82, 248,
+      87, 85, 0, 10, 22, 19, 44, 178, 63, 38, 78, 1, 210, 166, 140, 3, 199, 112,
+      135, 155, 36, 13, 204, 124, 47, 5, 190, 103, 91, 205, 147, 248, 115, 177,
+      196, 180, 234, 85, 35, 24, 182, 16, 207, 107, 167, 10, 54, 193, 146, 71, 95,
+      45, 109, 184, 43, 101, 155, 184, 55, 171, 196, 136, 89, 227, 84, 183, 31, 0,
+      137, 230, 146, 250, 6, 27, 225, 241, 11, 95, 124, 248, 133, 171, 149, 67,
+      73, 19, 110, 104, 173, 86, 6, 246, 195, 196, 200, 175, 53, 18, 198, 223,
+      140, 85, 208, 253, 204, 220, 255, 232, 88, 238, 20, 97, 24, 52, 13, 3, 179,
+      62, 151, 101, 67, 33, 79, 253, 157, 253, 233, 197, 109, 130, 78, 11, 165,
+      214, 200, 41, 157, 63, 46, 175, 251, 246, 225, 227, 199, 92, 107, 216, 58,
+      124, 226, 202, 153, 92, 31, 250, 182, 92, 99, 0, 110, 18, 78, 228, 166, 190,
+      67, 88, 245, 155, 139, 82, 152, 39, 204, 74, 140, 95, 82, 82, 160, 147, 144,
+      33, 0, 242, 200, 22, 102, 160, 233, 102, 224, 42, 205, 240, 56, 95, 197,
+      226, 175, 235, 240, 125, 10, 51, 12, 246, 150, 234, 173, 95, 132, 173, 174,
+      1, 161, 23, 39, 52, 168, 87, 54, 4, 66, 201, 34, 155, 82, 133, 170, 76, 52,
+      226, 109, 163, 19, 34, 184, 226, 39, 20, 75, 72, 201, 70, 188, 71, 182, 230,
+      6, 19, 255, 8, 145, 193, 63, 81, 150, 24, 72, 89, 168, 74, 98, 173, 133, 67,
+      227, 44, 252, 252, 227, 192, 125, 20, 227, 144, 24, 31, 48, 67, 67, 48, 94,
+      163, 52, 219, 163, 225, 214, 214, 109, 211, 122, 213, 198, 90, 204, 40, 97,
+      211, 121, 17, 28, 132, 246, 110, 230, 51, 197, 42, 162, 143, 199, 158, 215,
+      210, 133, 60, 65, 127, 1, 153, 193, 22, 171, 250, 114, 204, 246, 255, 126,
+      25, 96, 44, 164, 102, 172, 211, 23, 245, 122, 48, 221, 249, 138, 148, 134,
+      206, 135, 246, 42, 235, 198, 89, 189, 45, 125, 204, 69, 193, 48, 29, 144,
+      125, 224, 127, 66, 1, 134, 141, 224, 211, 193, 141, 69, 128, 75, 167, 244,
+      160, 120, 54, 191, 214, 29, 40, 249, 15, 46, 68, 141, 91, 242, 91, 80, 252,
+      109, 122, 154, 64, 153, 56, 65, 254, 106, 18, 4, 172, 171, 136, 80, 98, 79,
+      133, 255, 4, 100, 191, 144, 171, 219, 46, 132, 181, 130, 228, 107, 68, 32,
+      123, 201, 17, 67, 35, 144, 180, 160, 30, 125, 9, 55, 184, 172, 0, 159, 250,
+      232, 83, 168, 162, 102, 158, 121, 208, 177, 116, 163, 160, 80, 241, 46, 156,
+      58, 203, 240, 67, 176, 244, 170, 160, 115, 122, 141, 154, 101, 218, 178,
+      119, 130, 195, 32, 207, 51, 149, 98, 51, 219, 57, 121, 216, 156, 101, 218,
+      184, 220, 204, 41, 181, 149, 63, 80, 194, 11, 143, 164, 219, 23, 123, 141,
+      119, 43, 94, 78, 175, 89, 165, 48, 167, 44, 45, 219, 197, 15, 202, 118, 116,
+      245, 151, 218, 14, 199, 96, 27, 102, 206, 198, 123, 222, 178, 210, 20, 200,
+      38, 25, 124, 58, 102, 92, 197, 107, 51, 5, 236, 125, 173, 198, 113, 144,
+      108, 177, 22, 104, 223, 165, 39, 9, 84, 87, 124, 80, 153, 8, 212, 76, 2, 28,
+      12, 90, 212, 129, 148, 212, 229, 63, 29, 200, 113, 171, 154, 107, 189, 202,
+      22, 147, 7, 32, 253, 70, 37, 224, 98, 199, 129, 21, 54, 49, 52, 124, 84, 40,
+      190, 194, 108, 73, 26, 15, 124, 87, 87, 198, 217, 122, 127, 82, 167, 131,
+      59, 8, 172, 49, 162, 61, 64, 79, 196, 205, 65, 110, 75, 130, 128, 197, 182,
+      251, 110, 141, 197, 184, 166, 244, 246, 217, 20, 105, 85, 42, 80, 251, 77,
+      59, 204, 247, 179, 218, 181, 124, 209, 4, 28, 118, 234, 145, 237, 140, 106,
+      54, 88, 82, 28, 235, 68, 221, 109, 139, 11, 166, 182, 63, 142, 194, 255,
+      213, 219, 116, 158, 31, 224, 119, 126, 232, 160, 144, 1, 177, 92, 219, 162,
+      49, 181, 116, 163, 104, 245, 193, 188, 26, 172, 15, 190, 135, 207, 106, 246,
+      13, 132, 76, 189, 160, 25, 123, 26, 20, 48, 203, 59, 209, 69, 235, 103, 253,
+      160, 108, 83, 206, 70, 98, 0, 2, 57, 162, 202, 63, 45, 89, 173, 201, 254,
+      254, 253, 143, 21, 77, 131, 184, 234, 37, 68, 206, 69, 186, 179, 145, 147,
+      135, 42, 137, 152, 253, 213, 240, 13, 122, 161, 218, 186, 180, 213, 162,
+      150, 231, 63, 112, 182, 233, 86, 12, 225, 195, 133, 37, 28, 22, 147, 201,
+      200, 197, 115, 3, 138, 194, 86, 79, 247, 27, 241, 149, 128, 197, 8, 11, 134,
+      53, 118, 175, 248, 253, 114, 91, 31, 192, 253, 209, 111, 31, 228, 244, 184,
+      179, 146, 145, 167, 137, 155, 184, 218, 38, 62, 187, 22, 181, 193, 93, 16,
+      9, 195, 42, 198, 225, 100, 144, 148, 223, 184, 40, 117, 32, 131, 94, 93, 83,
+      88, 125, 95, 220, 20, 206, 7, 228, 78, 54, 238, 178, 196, 38, 245, 95, 8,
+      235, 106, 17, 175, 142, 193, 60, 179, 53, 244, 92, 147, 244, 218, 95, 127,
+      251, 128, 42, 105, 82, 243, 224, 213, 25, 91, 151, 22, 201, 18, 25, 230,
+      165, 85, 25, 249, 170, 160, 171, 210, 209, 32, 154, 124, 245, 60, 30, 255,
+      138, 154, 29, 85, 156, 232, 177, 78, 14, 137, 52, 215, 247, 26, 211, 115,
+      72, 20, 133, 232, 1, 151, 251, 63, 45, 120, 69, 49, 209, 130, 255, 2, 218,
+      21, 251, 16, 86, 30, 62, 136, 92, 149, 60, 6, 125, 129, 145, 235, 102, 190,
+      144, 248, 1, 53, 135, 21, 158, 44, 158, 230, 246, 172, 249, 161, 105, 204,
+      49, 60, 70, 63, 127, 163, 231, 175, 174, 234, 147, 185, 62, 5, 244, 156, 4,
+      31, 39, 156, 176, 154, 251, 166, 143, 212, 43, 30, 97, 50, 37, 176, 155, 77,
+      149, 102,
+    ]),
+    'ML-DSA-87': new Uint8Array([
+      48, 130, 10, 50, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 3, 19, 3, 130, 10,
+      33, 0, 146, 184, 67, 40, 172, 27, 204, 27, 135, 22, 109, 223, 127, 23, 97,
+      130, 198, 228, 199, 62, 178, 21, 173, 20, 88, 180, 205, 168, 17, 164, 135,
+      92, 85, 146, 76, 194, 152, 80, 239, 157, 33, 21, 239, 182, 176, 254, 124,
+      80, 135, 138, 87, 169, 103, 99, 87, 5, 91, 161, 239, 59, 18, 246, 148, 20,
+      32, 60, 117, 245, 182, 156, 196, 230, 82, 117, 228, 211, 81, 45, 115, 217,
+      23, 95, 138, 95, 103, 124, 32, 89, 187, 48, 251, 103, 81, 234, 76, 4, 57,
+      197, 71, 48, 125, 169, 195, 147, 183, 142, 166, 8, 147, 7, 77, 240, 111, 44,
+      168, 23, 89, 107, 95, 220, 75, 202, 44, 25, 244, 200, 160, 0, 174, 111, 107,
+      204, 22, 36, 122, 191, 101, 33, 52, 252, 14, 47, 25, 109, 135, 48, 131, 253,
+      195, 237, 60, 86, 14, 119, 85, 28, 182, 139, 136, 191, 59, 187, 90, 126,
+      207, 168, 238, 184, 83, 77, 254, 208, 21, 57, 104, 188, 228, 134, 82, 249,
+      190, 249, 163, 120, 111, 68, 225, 210, 131, 29, 151, 153, 146, 71, 163, 104,
+      225, 194, 33, 64, 213, 92, 145, 253, 42, 32, 233, 95, 224, 72, 184, 119,
+      192, 113, 253, 177, 153, 246, 240, 49, 103, 170, 229, 82, 69, 186, 36, 252,
+      29, 124, 255, 25, 148, 5, 160, 159, 105, 157, 185, 25, 158, 122, 145, 30,
+      245, 51, 205, 62, 56, 154, 23, 52, 0, 225, 177, 105, 195, 131, 177, 151,
+      197, 114, 110, 128, 227, 127, 176, 28, 252, 217, 56, 61, 136, 148, 190, 124,
+      108, 129, 62, 243, 235, 37, 70, 228, 233, 10, 67, 124, 120, 58, 164, 83, 57,
+      80, 39, 204, 98, 28, 199, 136, 75, 12, 51, 255, 24, 130, 127, 19, 239, 160,
+      94, 137, 75, 15, 82, 158, 252, 163, 43, 236, 193, 234, 27, 74, 69, 14, 179,
+      171, 10, 169, 27, 138, 172, 213, 189, 222, 167, 110, 24, 11, 118, 151, 223,
+      94, 154, 125, 9, 21, 137, 70, 128, 51, 102, 52, 105, 104, 157, 54, 186, 75,
+      217, 226, 169, 71, 125, 177, 253, 218, 85, 236, 242, 25, 215, 147, 181, 104,
+      242, 82, 75, 50, 165, 49, 102, 128, 82, 237, 170, 134, 162, 196, 56, 247,
+      199, 138, 102, 118, 37, 66, 114, 165, 177, 156, 251, 39, 199, 12, 167, 246,
+      169, 150, 108, 91, 192, 42, 68, 192, 244, 255, 107, 18, 191, 7, 73, 19, 174,
+      28, 116, 66, 131, 96, 173, 60, 131, 190, 249, 219, 246, 71, 182, 124, 183,
+      129, 101, 109, 95, 180, 78, 17, 140, 182, 62, 80, 195, 184, 253, 176, 169,
+      153, 1, 29, 83, 39, 252, 150, 41, 219, 176, 48, 151, 108, 60, 255, 239, 0,
+      85, 101, 193, 110, 204, 12, 254, 22, 136, 15, 154, 217, 88, 13, 28, 252,
+      232, 48, 32, 33, 41, 221, 103, 227, 228, 177, 54, 175, 195, 106, 174, 140,
+      54, 128, 108, 214, 228, 215, 118, 226, 206, 171, 21, 155, 162, 152, 135,
+      203, 16, 170, 130, 100, 173, 155, 243, 80, 40, 98, 157, 248, 7, 101, 88,
+      199, 218, 224, 141, 82, 238, 121, 92, 82, 97, 49, 31, 155, 61, 63, 84, 227,
+      90, 143, 164, 59, 216, 101, 19, 35, 134, 2, 20, 18, 197, 97, 215, 169, 85,
+      220, 75, 254, 91, 125, 144, 43, 65, 128, 29, 66, 77, 184, 172, 89, 123, 203,
+      231, 254, 59, 18, 249, 204, 249, 220, 153, 84, 166, 63, 23, 108, 120, 145,
+      216, 67, 223, 123, 248, 15, 253, 63, 191, 126, 84, 95, 98, 141, 66, 200,
+      129, 194, 174, 30, 80, 48, 75, 113, 14, 102, 101, 218, 249, 14, 203, 24, 6,
+      11, 89, 99, 56, 49, 17, 148, 160, 242, 101, 191, 102, 227, 115, 33, 107, 71,
+      235, 6, 141, 68, 161, 162, 165, 227, 159, 82, 253, 54, 157, 214, 255, 141,
+      151, 154, 134, 150, 93, 141, 97, 158, 244, 180, 135, 42, 10, 3, 148, 9, 152,
+      149, 20, 18, 237, 253, 180, 136, 165, 13, 80, 195, 220, 43, 3, 178, 10, 127,
+      144, 2, 207, 209, 246, 40, 110, 38, 133, 9, 22, 180, 11, 223, 116, 236, 205,
+      186, 25, 183, 155, 165, 77, 206, 101, 255, 106, 223, 70, 10, 22, 176, 119,
+      142, 163, 197, 178, 251, 216, 112, 237, 63, 201, 77, 219, 196, 2, 176, 48,
+      15, 207, 91, 74, 236, 21, 8, 205, 126, 77, 28, 13, 26, 28, 202, 250, 100,
+      79, 134, 209, 193, 78, 202, 58, 248, 124, 215, 64, 143, 244, 17, 23, 163,
+      162, 241, 249, 49, 210, 168, 203, 213, 135, 77, 14, 29, 35, 193, 234, 58,
+      12, 106, 165, 163, 251, 192, 115, 251, 7, 198, 189, 93, 207, 178, 246, 50,
+      189, 185, 51, 45, 84, 140, 194, 34, 46, 92, 90, 136, 81, 81, 53, 52, 253,
+      128, 247, 131, 243, 21, 207, 245, 141, 49, 178, 213, 214, 211, 8, 17, 234,
+      133, 225, 104, 197, 186, 224, 117, 1, 173, 104, 17, 177, 161, 223, 71, 195,
+      159, 194, 45, 177, 116, 26, 187, 193, 161, 213, 179, 158, 8, 122, 186, 122,
+      191, 158, 5, 12, 178, 235, 78, 132, 78, 189, 16, 86, 110, 73, 51, 129, 255,
+      242, 110, 63, 6, 53, 209, 110, 132, 236, 43, 239, 192, 221, 138, 1, 128,
+      176, 0, 113, 85, 119, 201, 36, 188, 202, 9, 223, 98, 196, 42, 130, 158, 149,
+      200, 150, 202, 132, 118, 153, 97, 54, 195, 154, 15, 45, 246, 129, 144, 255,
+      231, 75, 25, 56, 47, 178, 98, 10, 106, 84, 56, 113, 161, 227, 37, 246, 1,
+      245, 129, 173, 70, 186, 11, 28, 125, 198, 243, 225, 113, 130, 5, 138, 52,
+      251, 194, 152, 105, 48, 214, 13, 246, 228, 75, 236, 194, 223, 177, 64, 150,
+      97, 167, 20, 27, 74, 76, 166, 199, 239, 91, 240, 8, 22, 54, 41, 63, 35, 112,
+      255, 251, 88, 252, 147, 173, 185, 43, 98, 83, 155, 230, 176, 55, 161, 8, 83,
+      15, 110, 151, 241, 110, 168, 203, 190, 198, 218, 152, 144, 150, 58, 123, 11,
+      123, 250, 104, 113, 198, 93, 1, 152, 51, 172, 140, 246, 115, 113, 229, 218,
+      166, 200, 35, 123, 16, 133, 169, 191, 59, 103, 12, 114, 15, 60, 37, 4, 92,
+      208, 54, 31, 79, 56, 225, 6, 11, 74, 107, 79, 225, 239, 16, 73, 249, 234,
+      197, 129, 230, 97, 39, 115, 49, 96, 141, 41, 242, 225, 177, 214, 18, 103,
+      34, 229, 37, 176, 241, 99, 82, 227, 195, 77, 32, 64, 4, 120, 49, 199, 209,
+      139, 2, 4, 222, 233, 45, 151, 141, 142, 252, 41, 124, 231, 13, 144, 63, 212,
+      252, 145, 34, 142, 232, 152, 84, 135, 87, 175, 46, 53, 139, 60, 168, 135,
+      167, 101, 253, 127, 152, 138, 154, 31, 231, 198, 77, 89, 182, 9, 54, 103,
+      119, 100, 218, 245, 44, 191, 74, 30, 152, 84, 22, 62, 159, 131, 163, 223, 3,
+      51, 194, 241, 49, 9, 213, 43, 214, 201, 75, 158, 198, 22, 203, 209, 190,
+      199, 189, 75, 4, 6, 72, 60, 241, 113, 171, 30, 42, 143, 73, 51, 72, 206,
+      110, 175, 203, 195, 199, 15, 155, 208, 166, 121, 26, 132, 59, 44, 72, 155,
+      7, 48, 122, 132, 224, 142, 3, 7, 21, 207, 11, 30, 112, 18, 149, 146, 127,
+      41, 104, 197, 169, 86, 213, 108, 253, 111, 160, 5, 11, 202, 172, 233, 32, 5,
+      52, 92, 124, 152, 162, 11, 88, 28, 166, 248, 141, 251, 38, 161, 53, 49, 136,
+      246, 183, 85, 9, 165, 115, 108, 18, 208, 218, 129, 165, 163, 131, 34, 32,
+      94, 226, 121, 93, 24, 87, 226, 105, 25, 242, 128, 198, 78, 26, 237, 21, 92,
+      33, 121, 8, 119, 131, 140, 193, 14, 60, 139, 130, 19, 65, 96, 50, 5, 249,
+      12, 27, 51, 23, 195, 89, 255, 47, 23, 109, 62, 202, 190, 5, 131, 92, 91, 39,
+      27, 209, 132, 146, 95, 98, 66, 26, 230, 186, 236, 186, 162, 149, 81, 143,
+      221, 21, 79, 171, 236, 21, 161, 19, 135, 10, 213, 168, 200, 135, 19, 221,
+      177, 207, 106, 214, 194, 124, 220, 53, 45, 176, 245, 178, 189, 49, 242, 22,
+      230, 154, 241, 146, 230, 187, 180, 244, 158, 145, 197, 225, 51, 150, 140,
+      26, 175, 78, 142, 243, 232, 221, 137, 205, 130, 178, 54, 216, 136, 118, 212,
+      33, 90, 206, 18, 224, 158, 44, 23, 144, 204, 24, 184, 48, 81, 233, 124, 20,
+      222, 77, 119, 144, 22, 145, 241, 19, 206, 135, 252, 164, 114, 84, 37, 175,
+      107, 67, 243, 183, 137, 213, 53, 236, 41, 73, 50, 34, 146, 218, 204, 68,
+      235, 158, 150, 139, 133, 75, 248, 157, 7, 0, 53, 68, 44, 156, 110, 56, 197,
+      209, 201, 0, 155, 225, 85, 35, 169, 193, 231, 36, 31, 142, 101, 168, 29,
+      192, 31, 128, 81, 191, 253, 184, 153, 226, 214, 1, 27, 6, 0, 192, 36, 101,
+      72, 105, 150, 226, 3, 21, 12, 127, 72, 250, 223, 240, 136, 249, 157, 129,
+      247, 91, 178, 157, 208, 86, 146, 23, 176, 150, 35, 211, 155, 22, 207, 119,
+      168, 167, 122, 180, 183, 106, 97, 138, 87, 96, 34, 141, 110, 145, 231, 226,
+      35, 115, 232, 129, 54, 186, 128, 190, 238, 37, 169, 194, 37, 24, 237, 211,
+      164, 111, 54, 88, 245, 125, 67, 78, 194, 11, 194, 235, 217, 87, 203, 14,
+      220, 189, 107, 68, 94, 139, 66, 230, 5, 54, 64, 28, 246, 143, 75, 127, 239,
+      243, 20, 251, 189, 246, 246, 151, 90, 219, 227, 242, 223, 205, 40, 124, 245,
+      4, 189, 72, 39, 145, 110, 96, 120, 164, 27, 117, 146, 177, 30, 76, 173, 106,
+      130, 228, 192, 189, 59, 167, 30, 127, 178, 164, 5, 133, 80, 199, 207, 216,
+      189, 156, 93, 222, 150, 129, 81, 193, 180, 38, 59, 8, 214, 210, 95, 150,
+      182, 175, 148, 43, 153, 169, 66, 62, 135, 140, 159, 89, 195, 253, 3, 132,
+      180, 164, 244, 243, 232, 71, 196, 200, 158, 194, 114, 115, 193, 88, 161,
+      185, 235, 247, 14, 126, 225, 176, 111, 17, 79, 77, 245, 80, 229, 174, 6,
+      180, 156, 217, 85, 174, 201, 255, 237, 85, 83, 53, 188, 153, 98, 91, 193,
+      21, 211, 49, 145, 196, 252, 52, 66, 226, 131, 203, 214, 130, 237, 194, 208,
+      174, 102, 133, 220, 235, 222, 79, 232, 36, 21, 161, 248, 51, 185, 164, 156,
+      95, 121, 65, 57, 233, 183, 29, 199, 105, 104, 12, 90, 195, 186, 81, 199,
+      176, 1, 87, 16, 226, 192, 206, 185, 197, 46, 34, 75, 174, 153, 238, 15, 50,
+      87, 226, 96, 26, 197, 202, 73, 235, 19, 140, 9, 79, 12, 52, 83, 76, 85, 146,
+      234, 24, 151, 179, 178, 118, 58, 162, 223, 103, 69, 244, 231, 135, 167, 204,
+      117, 166, 60, 237, 82, 63, 11, 4, 207, 10, 146, 54, 126, 191, 79, 133, 60,
+      128, 34, 136, 170, 23, 84, 81, 38, 94, 9, 130, 245, 100, 115, 209, 34, 228,
+      158, 101, 216, 135, 208, 207, 191, 169, 115, 252, 144, 139, 226, 252, 6, 44,
+      221, 134, 170, 87, 11, 46, 124, 58, 219, 179, 238, 6, 98, 216, 18, 174, 42,
+      12, 97, 126, 85, 245, 81, 220, 232, 135, 114, 21, 125, 135, 225, 182, 245,
+      228, 223, 242, 62, 158, 35, 76, 6, 110, 25, 184, 206, 124, 237, 54, 252,
+      199, 44, 78, 89, 0, 135, 44, 176, 57, 168, 36, 221, 173, 77, 214, 209, 60,
+      1, 202, 238, 237, 61, 90, 47, 114, 230, 92, 238, 235, 18, 151, 220, 243,
+      225, 163, 159, 139, 189, 253, 62, 225, 182, 202, 59, 7, 83, 99, 129, 118,
+      175, 37, 246, 85, 119, 251, 246, 69, 180, 247, 37, 24, 194, 89, 158, 97,
+      230, 247, 254, 145, 102, 89, 77, 68, 245, 3, 103, 83, 28, 45, 168, 30, 189,
+      151, 112, 120, 215, 84, 90, 198, 85, 85, 129, 55, 127, 124, 28, 137, 229,
+      139, 54, 88, 229, 105, 81, 212, 83, 28, 107, 250, 82, 164, 43, 24, 15, 57,
+      206, 156, 19, 145, 95, 57, 169, 8, 128, 211, 29, 213, 195, 148, 27, 73, 186,
+      221, 242, 11, 167, 78, 246, 133, 18, 118, 67, 236, 59, 19, 112, 254, 93,
+      168, 157, 118, 0, 107, 248, 57, 149, 67, 222, 123, 225, 207, 251, 69, 218,
+      56, 110, 162, 19, 25, 209, 209, 213, 200, 158, 70, 9, 100, 208, 77, 48, 255,
+      151, 200, 0, 68, 230, 70, 120, 209, 29, 86, 225, 188, 189, 226, 101, 42,
+      176, 32, 147, 121, 72, 151, 130, 217, 13, 66, 148, 84, 129, 215, 249, 164,
+      174, 187, 80, 85, 185, 245, 108, 169, 119, 59, 178, 144, 229, 63, 194, 132,
+      250, 131, 82, 161, 125, 126, 255, 252, 220, 204, 104, 231, 201, 136, 246,
+      116, 43, 88, 233, 0, 43, 128, 214, 40, 59, 81, 147, 139, 132, 69, 24, 233,
+      21, 14, 91, 230, 241, 19, 138, 163, 55, 13, 221, 47, 64, 140, 248, 6, 38,
+      164, 16, 219, 63, 33, 180, 71, 151, 0, 234, 103, 58, 213, 222, 163, 95, 132,
+      1, 178, 146, 66, 124, 242, 223, 102, 129, 192, 214, 194, 117, 162, 252, 246,
+      143, 42, 70, 139, 97, 168, 64, 141, 190, 115, 126, 93, 175, 59, 49, 9, 184,
+      88, 201, 100, 182, 142, 145, 244, 72, 128, 203, 49, 196, 5, 5, 18, 46, 34,
+      87, 171, 132, 158, 128, 75, 194, 8, 242, 52, 156, 229, 245, 56, 245, 88, 14,
+      195, 110, 166, 51, 158, 245, 195, 120, 17, 166, 66, 100, 212, 188, 243, 2,
+      236, 90, 8, 16, 35, 151, 122, 175, 115, 168, 186, 191, 60, 71, 23, 81, 217,
+      79, 203, 239, 61, 146, 247, 168, 112, 83, 102, 146, 222, 178, 45, 247, 63,
+      23, 181, 3, 136, 208, 62, 154, 203, 35, 250, 238, 61, 98, 207, 90, 169, 175,
+      36, 227, 9, 182, 78, 226, 99, 89, 67, 105, 185, 35, 242, 162, 54, 99, 60,
+      148, 14, 118, 1, 26, 120, 62, 82, 62, 222, 34, 99, 58, 174, 145, 199, 190,
+      21, 182, 117, 238, 13, 170, 29, 67, 149, 44, 90, 94, 181, 125, 182, 186, 82,
+      55, 105, 253, 29, 212, 67, 134, 204, 227, 94, 255, 127, 72, 157, 140, 142,
+      224, 77, 149, 29, 170, 45, 163, 214, 209, 46, 28, 125, 177, 111, 2, 92, 121,
+      252, 166, 204, 227, 173, 51, 60, 162, 243, 202, 207, 103, 30, 153, 182, 116,
+      182, 130, 98, 59, 25, 141, 239, 49, 224, 176, 27, 237, 218, 76, 68, 189,
+      108, 185, 136, 255, 105, 150, 11, 153, 44, 248, 139, 199, 178, 235, 85, 115,
+      121, 144, 87, 221, 50, 222, 238, 16, 20, 51, 190, 93, 248, 228, 84, 228,
+      115, 31, 229, 227, 137, 180, 44, 115, 224, 119, 129, 181, 134, 224, 144,
+      186, 123, 208, 118, 96, 101, 177, 191, 232, 171, 6, 17, 247, 187, 173, 84,
+      70, 249, 19, 191, 116, 172, 126, 131, 216, 123, 225, 151, 55, 205, 177, 93,
+      139, 117,
+    ]),
+  };
+
+  return { pkcs8, spki };
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/okp_key_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/util/okp_key_fixtures.js
new file mode 100644
index 000000000000..569e7c7215a7
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/util/okp_key_fixtures.js
@@ -0,0 +1,58 @@
+var okpKeyData = {
+    "Ed25519": {
+        privateUsages: ["sign"],
+        publicUsages: ["verify"],
+        spki: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, 216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61, 204]),
+        raw: new Uint8Array([216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61, 204]),
+        pkcs8: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32, 243, 200, 244, 196, 141, 248, 120, 20, 110, 140, 211, 191, 109, 244, 229, 14, 56, 155, 167, 7, 78, 21, 194, 53, 45, 205, 93, 48, 141, 76, 168, 31]),
+        jwk: {
+            crv: "Ed25519",
+            d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB8",
+            x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPcw",
+            kty: "OKP"
+        }
+    },
+
+    "Ed448": {
+        privateUsages: ["sign"],
+        publicUsages: ["verify"],
+        spki: new Uint8Array([48, 67, 48, 5, 6, 3, 43, 101, 113, 3, 58, 0, 171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90, 128]),
+        raw: new Uint8Array([171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90, 128]),
+        pkcs8: new Uint8Array([48, 71, 2, 1, 0, 48, 5, 6, 3, 43, 101, 113, 4, 59, 4, 57, 14, 255, 3, 69, 140, 40, 224, 23, 156, 82, 29, 227, 18, 201, 105, 183, 131, 67, 72, 236, 171, 153, 26, 96, 227, 178, 233, 167, 158, 76, 217, 228, 128, 239, 41, 23, 18, 210, 200, 61, 4, 114, 114, 213, 201, 244, 40, 102, 79, 105, 109, 38, 112, 69, 143, 29, 46]),
+        jwk: {
+            crv: "Ed448",
+            d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
+            x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
+            kty: "OKP"
+        }
+    },
+
+    "X25519": {
+        privateUsages: ["deriveKey", "deriveBits"],
+        publicUsages: [],
+        spki: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 110, 3, 33, 0, 28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151, 6]),
+        raw: new Uint8Array([28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151, 6]),
+        pkcs8: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32, 200, 131, 142, 118, 208, 87, 223, 183, 216, 201, 90, 105, 225, 56, 22, 10, 221, 99, 115, 253, 113, 164, 210, 118, 187, 86, 227, 168, 27, 100, 255, 97]),
+        jwk: {
+            crv: "X25519",
+            d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E",
+            x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
+            kty: "OKP"
+        }
+    },
+
+    "X448": {
+        privateUsages: ["deriveKey", "deriveBits"],
+        publicUsages: [],
+        spki: new Uint8Array([48, 66, 48, 5, 6, 3, 43, 101, 111, 3, 57, 0, 182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206, 111]),
+        raw: new Uint8Array([182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206, 111]),
+        pkcs8: new Uint8Array([48, 70, 2, 1, 0, 48, 5, 6, 3, 43, 101, 111, 4, 58, 4, 56, 88, 199, 210, 154, 62, 181, 25, 178, 157, 0, 207, 177, 145, 187, 100, 252, 109, 138, 66, 216, 241, 113, 118, 39, 43, 137, 242, 39, 45, 24, 25, 41, 92, 101, 37, 192, 130, 150, 113, 176, 82, 239, 7, 39, 83, 15, 24, 142, 49, 208, 204, 83, 191, 38, 146, 158]),
+        jwk: {
+            crv: "X448",
+            d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp4",
+            x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
+            kty: "OKP"
+        }
+    },
+
+};
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/rsa_key_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/util/rsa_key_fixtures.js
new file mode 100644
index 000000000000..13adb1a133e6
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/util/rsa_key_fixtures.js
@@ -0,0 +1,6 @@
+function getRsaKeyFixtures() {
+    return {
+        pkcs8: new Uint8Array([48, 130, 4, 191, 2, 1, 0, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 4, 130, 4, 169, 48, 130, 4, 165, 2, 1, 0, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1, 2, 130, 1, 1, 0, 139, 55, 92, 203, 135, 200, 37, 197, 255, 61, 83, 208, 9, 145, 110, 150, 65, 5, 126, 24, 82, 114, 39, 160, 122, 178, 38, 190, 16, 136, 129, 58, 59, 56, 187, 123, 72, 243, 119, 5, 81, 101, 250, 42, 147, 57, 210, 77, 198, 103, 213, 197, 186, 52, 39, 230, 164, 129, 23, 110, 172, 21, 255, 212, 144, 104, 49, 30, 28, 40, 59, 159, 58, 142, 12, 184, 9, 180, 99, 12, 80, 170, 143, 62, 69, 166, 11, 53, 158, 25, 191, 140, 187, 94, 202, 214, 78, 118, 31, 16, 149, 116, 63, 243, 106, 175, 92, 240, 236, 185, 127, 237, 173, 221, 166, 11, 91, 243, 93, 129, 26, 117, 184, 34, 35, 12, 250, 160, 25, 47, 173, 64, 84, 126, 39, 84, 72, 170, 51, 22, 191, 142, 43, 76, 224, 133, 79, 199, 112, 139, 83, 123, 162, 45, 19, 33, 11, 9, 174, 195, 122, 39, 89, 239, 192, 130, 161, 83, 27, 35, 169, 23, 48, 3, 125, 222, 78, 242, 107, 95, 150, 239, 220, 195, 159, 211, 76, 52, 90, 213, 28, 187, 228, 79, 229, 139, 138, 59, 78, 201, 151, 134, 108, 8, 109, 255, 27, 136, 49, 239, 10, 31, 234, 38, 60, 247, 218, 205, 3, 192, 76, 188, 194, 178, 121, 229, 127, 165, 185, 83, 153, 107, 251, 29, 214, 136, 23, 175, 127, 180, 44, 222, 247, 165, 41, 74, 87, 250, 194, 184, 173, 115, 159, 27, 2, 153, 2, 129, 129, 0, 251, 248, 51, 194, 198, 49, 201, 112, 36, 12, 142, 116, 133, 240, 106, 62, 162, 168, 72, 34, 81, 26, 134, 39, 221, 70, 78, 248, 175, 175, 113, 72, 209, 164, 37, 182, 184, 101, 125, 221, 82, 70, 131, 43, 142, 83, 48, 32, 197, 187, 181, 104, 133, 90, 106, 236, 62, 66, 33, 215, 147, 241, 220, 91, 47, 37, 132, 226, 65, 94, 72, 233, 162, 189, 41, 43, 19, 64, 49, 249, 156, 142, 180, 47, 192, 188, 208, 68, 155, 242, 44, 230, 222, 201, 112, 20, 239, 229, 172, 147, 235, 232, 53, 135, 118, 86, 37, 44, 187, 177, 108, 65, 91, 103, 177, 132, 210, 40, 69, 104, 162, 119, 213, 147, 53, 88, 92, 253, 2, 129, 129, 0, 214, 184, 206, 39, 199, 41, 93, 93, 22, 252, 53, 112, 237, 100, 200, 218, 147, 3, 250, 210, 148, 136, 193, 166, 94, 154, 215, 17, 249, 3, 112, 24, 125, 187, 253, 129, 49, 109, 105, 100, 139, 200, 140, 197, 200, 53, 81, 175, 255, 69, 222, 186, 207, 182, 17, 5, 247, 9, 228, 195, 8, 9, 185, 0, 49, 235, 214, 134, 36, 68, 150, 198, 246, 158, 105, 46, 189, 200, 20, 246, 66, 57, 244, 173, 21, 117, 110, 203, 120, 197, 165, 176, 153, 49, 219, 24, 48, 119, 197, 70, 163, 140, 76, 116, 56, 137, 173, 61, 62, 208, 121, 181, 98, 46, 208, 18, 15, 160, 225, 249, 59, 89, 61, 183, 216, 82, 224, 95, 2, 129, 128, 56, 135, 75, 157, 131, 247, 129, 120, 206, 45, 158, 252, 23, 92, 131, 137, 127, 214, 127, 48, 107, 191, 166, 159, 100, 238, 52, 35, 104, 206, 212, 124, 128, 195, 241, 206, 23, 122, 117, 141, 100, 186, 251, 12, 151, 134, 164, 66, 133, 250, 1, 205, 236, 53, 7, 205, 238, 125, 201, 183, 226, 178, 29, 60, 187, 204, 16, 14, 238, 153, 103, 132, 59, 5, 115, 41, 253, 204, 166, 41, 152, 237, 15, 17, 179, 140, 232, 176, 171, 199, 222, 57, 1, 124, 113, 207, 208, 174, 87, 84, 108, 85, 145, 68, 205, 208, 175, 208, 100, 95, 126, 168, 255, 7, 185, 116, 209, 237, 68, 253, 31, 142, 0, 245, 96, 191, 109, 69, 2, 129, 129, 0, 133, 41, 239, 144, 115, 207, 143, 123, 95, 249, 226, 26, 186, 223, 58, 65, 115, 211, 144, 6, 112, 223, 175, 89, 66, 106, 188, 223, 4, 147, 193, 61, 47, 29, 27, 70, 184, 36, 166, 172, 24, 148, 179, 217, 37, 37, 12, 24, 30, 52, 114, 193, 96, 120, 5, 110, 177, 154, 141, 40, 247, 31, 48, 128, 146, 117, 52, 129, 212, 148, 68, 253, 247, 140, 158, 166, 194, 68, 7, 220, 1, 142, 119, 211, 175, 239, 56, 91, 47, 247, 67, 158, 150, 35, 121, 65, 51, 45, 212, 70, 206, 190, 255, 219, 68, 4, 254, 79, 113, 89, 81, 97, 208, 22, 64, 44, 51, 77, 15, 87, 198, 26, 190, 79, 249, 244, 203, 249, 2, 129, 129, 0, 135, 216, 119, 8, 212, 103, 99, 228, 204, 190, 178, 209, 233, 113, 46, 91, 240, 33, 109, 112, 222, 148, 32, 165, 178, 6, 155, 116, 89, 185, 159, 93, 159, 127, 47, 173, 124, 215, 154, 174, 230, 122, 127, 154, 52, 67, 126, 60, 121, 168, 74, 240, 205, 141, 233, 223, 242, 104, 235, 12, 71, 147, 245, 1, 249, 136, 213, 64, 246, 211, 71, 92, 32, 121, 184, 34, 122, 35, 217, 104, 222, 196, 227, 198, 101, 3, 24, 113, 147, 69, 150, 48, 71, 43, 253, 182, 186, 29, 231, 134, 199, 151, 250, 111, 78, 166, 90, 42, 132, 25, 38, 47, 41, 103, 136, 86, 203, 115, 201, 189, 75, 200, 155, 94, 4, 27, 34, 119]),
+        spki: new Uint8Array([48, 130, 1, 34, 48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0, 3, 130, 1, 15, 0, 48, 130, 1, 10, 2, 130, 1, 1, 0, 211, 87, 96, 146, 230, 41, 87, 54, 69, 68, 231, 228, 35, 59, 123, 219, 41, 61, 178, 8, 81, 34, 196, 121, 50, 133, 70, 249, 240, 247, 18, 246, 87, 196, 177, 120, 104, 201, 48, 144, 140, 197, 148, 247, 237, 0, 192, 20, 66, 193, 175, 4, 194, 246, 120, 164, 139, 162, 200, 15, 209, 113, 62, 48, 181, 172, 80, 120, 122, 195, 81, 101, 137, 241, 113, 150, 127, 99, 134, 173, 163, 73, 0, 166, 187, 4, 238, 206, 164, 43, 240, 67, 206, 217, 160, 249, 77, 12, 192, 158, 145, 155, 157, 113, 102, 192, 138, 182, 206, 32, 70, 64, 174, 164, 196, 146, 13, 182, 216, 110, 185, 22, 208, 220, 192, 244, 52, 26, 16, 56, 4, 41, 231, 225, 3, 33, 68, 234, 148, 157, 232, 246, 192, 204, 191, 149, 250, 142, 146, 141, 112, 216, 163, 140, 225, 104, 219, 69, 246, 241, 52, 102, 61, 111, 101, 111, 92, 234, 188, 114, 93, 168, 192, 42, 171, 234, 170, 19, 172, 54, 167, 92, 192, 186, 225, 53, 223, 49, 20, 182, 101, 137, 199, 237, 60, 182, 21, 89, 174, 90, 56, 79, 22, 43, 250, 128, 219, 228, 97, 127, 134, 195, 241, 208, 16, 201, 79, 226, 201, 191, 1, 154, 110, 99, 179, 239, 192, 40, 212, 60, 238, 97, 28, 133, 236, 38, 60, 144, 108, 70, 55, 114, 198, 145, 27, 25, 238, 192, 150, 202, 118, 236, 94, 49, 225, 227, 2, 3, 1, 0, 1])
+    };
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/supports.js b/test/fixtures/wpt/WebCryptoAPI/util/supports.js
new file mode 100644
index 000000000000..18442424f4a2
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/util/supports.js
@@ -0,0 +1,74 @@
+'use strict';
+
+function testSupportsMethod() {
+  test(() => {
+    assert_true(
+      typeof SubtleCrypto.supports === 'function',
+      'SubtleCrypto.supports should be a function'
+    );
+  }, 'SubtleCrypto.supports method exists');
+}
+
+function runSupportsTests(algorithms, operations) {
+  for (const [algorithmName, algorithmInfo] of Object.entries(algorithms)) {
+    for (const operation of operations) {
+      promise_test(async (t) => {
+        const isSupported = algorithmInfo.operations.includes(operation);
+
+        let algorithm;
+        let lengthOrAdditionalAlgorithm;
+        switch (operation) {
+          case 'generateKey':
+            algorithm = algorithmInfo.keyGenParams || algorithmName;
+            break;
+          case 'importKey':
+            algorithm = algorithmInfo.importParams || algorithmName;
+            break;
+          case 'sign':
+          case 'verify':
+            algorithm = algorithmInfo.signParams || algorithmName;
+            break;
+          case 'encrypt':
+          case 'decrypt':
+            algorithm = algorithmInfo.encryptParams || algorithmName;
+            break;
+          case 'deriveBits':
+            algorithm = algorithmInfo.deriveBitsParams || algorithmName;
+            if (algorithm?.public instanceof Promise) {
+              algorithm.public = (await algorithm.public).publicKey;
+            }
+            if (algorithmName === 'PBKDF2' || algorithmName === 'HKDF') {
+              lengthOrAdditionalAlgorithm = 256;
+            }
+            break;
+          case 'digest':
+            algorithm = algorithmName;
+            break;
+          case 'encapsulateKey':
+          case 'encapsulateBits':
+          case 'decapsulateKey':
+          case 'decapsulateBits':
+            algorithm = algorithmName;
+            if (operation === 'encapsulateKey' || operation === 'decapsulateKey') {
+              lengthOrAdditionalAlgorithm = { name: 'AES-GCM', length: 256 };
+            }
+            break;
+          default:
+            algorithm = algorithmName;
+        }
+
+        const result = SubtleCrypto.supports(
+          operation,
+          algorithm,
+          lengthOrAdditionalAlgorithm
+        );
+
+        if (isSupported) {
+          assert_true(result, `${algorithmName} should support ${operation}`);
+        } else {
+          assert_false(result, `${algorithmName} should not support ${operation}`);
+        }
+      }, `supports(${operation}, ${algorithmName})`);
+    }
+  }
+}
diff --git a/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js b/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js
index 9fa3bb775d42..d7a044030826 100644
--- a/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js
@@ -1,6 +1,7 @@
 // META: title=WebCryptoAPI: wrapKey() and unwrapKey()
 // META: timeout=long
 // META: script=../util/helpers.js
+// META: script=../util/okp_key_fixtures.js
 // META: script=wrapKey_unwrapKey_vectors.js
 
 // Tests for wrapKey and unwrapKey round tripping
@@ -285,7 +286,7 @@
         }
 
         if ("kty" in exportedKey && algorithmName === "AES-KW") {
-            return JSON.stringify(exportedKey).length % 8 == 0;
+            return JSON.stringify(exportedKey).length % 8 === 0;
         }
 
         if ("kty" in exportedKey && algorithmName === "RSA-OAEP") {
@@ -478,4 +479,3 @@
 
     function str2ab(str)        { return Uint8Array.from( str.split(''), function(s){return s.charCodeAt(0)} ); }
     function ab2str(ab)         { return String.fromCharCode.apply(null, new Uint8Array(ab)); }
-
diff --git a/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey_vectors.js b/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey_vectors.js
index cf799a8a8ce3..36500e4f27ba 100644
--- a/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey_vectors.js
@@ -49,46 +49,10 @@ let toWrapKeyData = {
             d: "E9M6LVq_nPnrsh_4YNSu_m5W53eQ9N7ptAiE69M1ROo"
         }
     },
-    "ED25519": {
-        spki: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, 216, 225, 137, 99, 216, 9, 212, 135, 217, 84, 154, 204, 174, 198, 116, 46, 126, 235, 162, 77, 138, 13, 59, 20, 183, 227, 202, 234, 6, 137, 61, 204]),
-        pkcs8: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32, 243, 200, 244, 196, 141, 248, 120, 20, 110, 140, 211, 191, 109, 244, 229, 14, 56, 155, 167, 7, 78, 21, 194, 53, 45, 205, 93, 48, 141, 76, 168, 31]),
-        jwk: {
-            crv: "Ed25519",
-            d: "88j0xI34eBRujNO_bfTlDjibpwdOFcI1Lc1dMI1MqB8",
-            x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPcw",
-            kty: "OKP"
-        }
-    },
-    "ED448": {
-        spki: new Uint8Array([48, 67, 48, 5, 6, 3, 43, 101, 113, 3, 58, 0, 171, 75, 184, 133, 253, 125, 44, 90, 242, 78, 131, 113, 12, 255, 160, 199, 74, 87, 226, 116, 128, 29, 178, 5, 123, 11, 220, 94, 160, 50, 182, 254, 107, 199, 139, 128, 69, 54, 90, 235, 38, 232, 110, 31, 20, 253, 52, 157, 7, 196, 132, 149, 245, 164, 106, 90, 128]),
-        pkcs8: new Uint8Array([48, 71, 2, 1, 0, 48, 5, 6, 3, 43, 101, 113, 4, 59, 4, 57, 14, 255, 3, 69, 140, 40, 224, 23, 156, 82, 29, 227, 18, 201, 105, 183, 131, 67, 72, 236, 171, 153, 26, 96, 227, 178, 233, 167, 158, 76, 217, 228, 128, 239, 41, 23, 18, 210, 200, 61, 4, 114, 114, 213, 201, 244, 40, 102, 79, 105, 109, 38, 112, 69, 143, 29, 46]),
-        jwk: {
-            crv: "Ed448",
-            d: "Dv8DRYwo4BecUh3jEslpt4NDSOyrmRpg47Lpp55M2eSA7ykXEtLIPQRyctXJ9ChmT2ltJnBFjx0u",
-            x: "q0u4hf19LFryToNxDP-gx0pX4nSAHbIFewvcXqAytv5rx4uARTZa6ybobh8U_TSdB8SElfWkalqA",
-            kty: "OKP"
-        }
-    },
-    "X25519": {
-        spki: new Uint8Array([48, 42, 48, 5, 6, 3, 43, 101, 110, 3, 33, 0, 28, 242, 177, 230, 2, 46, 197, 55, 55, 30, 215, 245, 62, 84, 250, 17, 84, 216, 62, 152, 235, 100, 234, 81, 250, 229, 179, 48, 124, 254, 151, 6]),
-        pkcs8: new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32, 200, 131, 142, 118, 208, 87, 223, 183, 216, 201, 90, 105, 225, 56, 22, 10, 221, 99, 115, 253, 113, 164, 210, 118, 187, 86, 227, 168, 27, 100, 255, 97]),
-        jwk: {
-            crv: "X25519",
-            d: "yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E",
-            x: "HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY",
-            kty: "OKP"
-        }
-    },
-    "X448": {
-        spki: new Uint8Array([48, 66, 48, 5, 6, 3, 43, 101, 111, 3, 57, 0, 182, 4, 161, 209, 165, 205, 29, 148, 38, 213, 97, 239, 99, 10, 158, 177, 108, 190, 105, 213, 185, 202, 97, 94, 220, 83, 99, 62, 251, 82, 234, 49, 230, 230, 160, 161, 219, 172, 198, 231, 108, 188, 230, 72, 45, 126, 75, 163, 213, 93, 158, 128, 39, 101, 206, 111]),
-        pkcs8: new Uint8Array([48, 70, 2, 1, 0, 48, 5, 6, 3, 43, 101, 111, 4, 58, 4, 56, 88, 199, 210, 154, 62, 181, 25, 178, 157, 0, 207, 177, 145, 187, 100, 252, 109, 138, 66, 216, 241, 113, 118, 39, 43, 137, 242, 39, 45, 24, 25, 41, 92, 101, 37, 192, 130, 150, 113, 176, 82, 239, 7, 39, 83, 15, 24, 142, 49, 208, 204, 83, 191, 38, 146, 158]),
-        jwk: {
-            crv: "X448",
-            d: "WMfSmj61GbKdAM-xkbtk_G2KQtjxcXYnK4nyJy0YGSlcZSXAgpZxsFLvBydTDxiOMdDMU78mkp4",
-            x: "tgSh0aXNHZQm1WHvYwqesWy-adW5ymFe3FNjPvtS6jHm5qCh26zG52y85kgtfkuj1V2egCdlzm8",
-            kty: "OKP"
-        }
-    },
+    "ED25519": okpKeyData.Ed25519,
+    "ED448": okpKeyData.Ed448,
+    "X25519": okpKeyData.X25519,
+    "X448": okpKeyData.X448,
     "SYMMETRIC128": {
         raw: new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]),
     },
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index 32b9537ffca9..4c01b3e53663 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -96,7 +96,7 @@
     "path": "web-locks"
   },
   "WebCryptoAPI": {
-    "commit": "ec2fee39a4ca3c13afd55236795547eedd7f165d",
+    "commit": "82c3d9069cf2e93e5528a1f428fa122bd9af651d",
     "path": "WebCryptoAPI"
   },
   "webidl": {

From 8c4531bbc9e96242de7e5af0b299e6ee62536890 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Wed, 5 Aug 2026 16:49:29 +0200
Subject: [PATCH 024/344] src: report why --enable-fips failed

The startup failure always appended the OpenSSL error queue, so when
Node.js itself detected the missing fips provider it printed an error
header followed by nothing. Report the reason instead.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64979
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 src/crypto/crypto_util.cc         | 38 ++++++++++++++++++++++---------
 src/crypto/crypto_util.h          |  5 +++-
 src/node.cc                       |  8 +++----
 test/parallel/test-crypto-fips.js | 15 ++++++++----
 4 files changed, 45 insertions(+), 21 deletions(-)

diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 7c3e4b7ab5fe..166fea15da59 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -99,20 +99,36 @@ int NoPasswordCallback(char* buf, int size, int rwflag, void* u) {
   return 0;
 }
 
-bool ProcessFipsOptions() {
-  /* Override FIPS settings in configuration file, if needed. */
-  if (per_process::cli_options->enable_fips_crypto ||
-      per_process::cli_options->force_fips_crypto) {
+std::optional<std::string> ProcessFipsOptions() {
+  const bool enable_fips = per_process::cli_options->enable_fips_crypto;
+  const bool force_fips = per_process::cli_options->force_fips_crypto;
+  if (!enable_fips && !force_fips) return std::nullopt;
+
 #if OPENSSL_VERSION_MAJOR >= 3
-    if (!ncrypto::testFipsEnabled()) return false;
-    return ncrypto::setFipsEnabled(true, nullptr);
-#else
-    // TODO(@jasnell): Remove this ifdef branch when openssl 1.1.1 is
-    // no longer supported.
-    if (FIPS_mode() == 0) return FIPS_mode_set(1);
+  // Whether FIPS-approved implementations are reachable is decided by the
+  // OpenSSL configuration, not by Node.js. Refuse to start rather than
+  // restrict the default property query to a provider that is not there,
+  // which would leave every operation failing as unsupported.
+  if (!ncrypto::testFipsEnabled()) {
+    const std::string option = force_fips ? "--force-fips" : "--enable-fips";
+    return option + " requires an active OpenSSL provider named \"fips\". "
+                    "FIPS mode is configured through OpenSSL; see "
+                    "https://nodejs.org/api/crypto.html#fips-mode";
+  }
 #endif
+
+  CryptoErrorList errors{CryptoErrorList::Option::NONE};
+  if (!ncrypto::setFipsEnabled(true, &errors)) {
+    std::string error = "OpenSSL error when trying to enable FIPS";
+    if (!errors.empty()) error += ':';
+    for (const auto& openssl_error : errors) {
+      error += '\n';
+      error += openssl_error;
+    }
+    return error;
   }
-  return true;
+
+  return std::nullopt;
 }
 
 bool InitCryptoOnce(Isolate* isolate) {
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index 308e8fccba59..5c9dad13196b 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -62,7 +62,10 @@ constexpr T NumBitsToBytes(T bits) {
   return (bits / CHAR_BIT) + ((CHAR_BIT - 1 + (bits % CHAR_BIT)) / CHAR_BIT);
 }
 
-bool ProcessFipsOptions();
+// Applies the FIPS related command line options. Returns a description of
+// what went wrong, or std::nullopt when there was nothing to do or the
+// options were applied successfully.
+std::optional<std::string> ProcessFipsOptions();
 
 bool InitCryptoOnce(v8::Isolate* isolate);
 void InitCryptoOnce();
diff --git a/src/node.cc b/src/node.cc
index b368c5873434..b5455fe40356 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1168,6 +1168,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
   if (!(flags & ProcessInitializationFlags::kNoInitOpenSSL)) {
 #if HAVE_OPENSSL
 #ifndef OPENSSL_IS_BORINGSSL
+#if OPENSSL_VERSION_MAJOR >= 3
     auto GetOpenSSLErrorString = []() -> std::string {
       std::string ret;
       ERR_print_errors_cb(
@@ -1183,7 +1184,6 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
 
     // In the case of FIPS builds we should make sure
     // the random source is properly initialized first.
-#if OPENSSL_VERSION_MAJOR >= 3
     // Call OPENSSL_init_crypto to initialize OPENSSL_INIT_LOAD_CONFIG to
     // avoid the default behavior where errors raised during the parsing of the
     // OpenSSL configuration file are not propagated and cannot be detected.
@@ -1244,12 +1244,10 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
       OPENSSL_init();
     }
 #endif
-    if (!crypto::ProcessFipsOptions()) {
+    if (auto fips_error = crypto::ProcessFipsOptions()) {
       result->exit_code_ = ExitCode::kGenericUserError;
       result->early_return_ = true;
-      result->errors_.emplace_back(
-          "OpenSSL error when trying to enable FIPS:\n" +
-          GetOpenSSLErrorString());
+      result->errors_.emplace_back(std::move(*fips_error));
       return result;
     }
 
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 04a95fa5fd37..055de8a536fe 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -21,7 +21,14 @@ const FIPS_ERROR_STRING2 =
   'Error [ERR_CRYPTO_FIPS_FORCED]: Cannot set FIPS mode, it was forced with ' +
   '--force-fips at startup.';
 const FIPS_UNSUPPORTED_ERROR_STRING = 'fips mode not supported';
-const FIPS_ENABLE_ERROR_STRING = 'OpenSSL error when trying to enable FIPS:';
+const FIPS_ENABLE_ERROR_STRING =
+  hasOpenSSL3 ?
+    '--enable-fips requires an active OpenSSL provider named "fips"' :
+    'OpenSSL error when trying to enable FIPS:';
+const FIPS_FORCE_ERROR_STRING =
+  hasOpenSSL3 ?
+    '--force-fips requires an active OpenSSL provider named "fips"' :
+    'OpenSSL error when trying to enable FIPS:';
 
 const CNF_FIPS_ON = fixtures.path('openssl_fips_enabled.cnf');
 const CNF_FIPS_OFF = fixtures.path('openssl_fips_disabled.cnf');
@@ -75,7 +82,7 @@ testHelper(
   ['--enable-fips'],
   testFipsCrypto() ? kNoFailure : kGenericUserError,
   testFipsCrypto() ? FIPS_ENABLED : FIPS_ENABLE_ERROR_STRING,
-  'process.versions',
+  'require("crypto").getFips()',
   process.env);
 
 // --force-fips should raise an error if OpenSSL is not FIPS enabled.
@@ -83,8 +90,8 @@ testHelper(
   testFipsCrypto() ? 'stdout' : 'stderr',
   ['--force-fips'],
   testFipsCrypto() ? kNoFailure : kGenericUserError,
-  testFipsCrypto() ? FIPS_ENABLED : FIPS_ENABLE_ERROR_STRING,
-  'process.versions',
+  testFipsCrypto() ? FIPS_ENABLED : FIPS_FORCE_ERROR_STRING,
+  'require("crypto").getFips()',
   process.env);
 
 // By default FIPS should be off in both FIPS and non-FIPS builds

From 0e1a99ac240549a4ec07fa655f405155ced1f0de Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sun, 2 Aug 2026 15:01:19 +0200
Subject: [PATCH 025/344] tools: add an OpenSSL FIPS build to test-shared.yml

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64960
Fixes: https://github.com/nodejs/node/issues/48379
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 tools/dep_updaters/update-nixpkgs-pin.sh |  2 +
 tools/nix/openssl-fips.nix               | 57 ++++++++++++++++++++++++
 tools/nix/openssl-matrix.nix             |  2 +
 3 files changed, 61 insertions(+)
 create mode 100644 tools/nix/openssl-fips.nix

diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh
index 3463d9fc2137..e31e70b8cd7c 100755
--- a/tools/dep_updaters/update-nixpkgs-pin.sh
+++ b/tools/dep_updaters/update-nixpkgs-pin.sh
@@ -77,6 +77,8 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
   inherit (pkgs)
     \(.attrs | sort | join("\n    "))
     ;
+
+  openssl_fips = import ./openssl-fips.nix { };
 }"' > "$OPENSSL_MATRIX_FILE"
 
 cat -<<EOF
diff --git a/tools/nix/openssl-fips.nix b/tools/nix/openssl-fips.nix
new file mode 100644
index 000000000000..1da44c409a8c
--- /dev/null
+++ b/tools/nix/openssl-fips.nix
@@ -0,0 +1,57 @@
+{
+  openssl ? (import ./openssl-matrix.nix { }).openssl,
+}:
+
+openssl.overrideAttrs (oldAttrs: {
+  pname = "openssl-fips";
+
+  doCheck = false;
+  configureFlags = (oldAttrs.configureFlags or [ ]) ++ [
+    "no-docs"
+    "no-tests"
+    "enable-fips"
+  ];
+  outputs = [
+    "bin"
+    "out"
+    "dev"
+  ];
+
+  # Nix strips the provider after installation, invalidating the module MAC
+  # generated by OpenSSL's install_fips target. Regenerate and verify it in
+  # postFixup, after stripping has finished modifying the provider.
+  postFixup = (oldAttrs.postFixup or "") + ''
+    opensslConfig="$out/etc/ssl/openssl.cnf"
+    fipsModule="$out/lib/ossl-modules/fips${openssl.stdenv.hostPlatform.extensions.sharedLibrary}"
+    fipsConfig="$out/etc/ssl/fipsmodule.cnf"
+
+    substituteInPlace "$opensslConfig" \
+      --replace-fail 'openssl_conf = openssl_init' $'openssl_conf = openssl_init\nnodejs_conf = openssl_init' \
+      --replace-fail '# .include fipsmodule.cnf' ".include $fipsConfig" \
+      --replace-fail 'providers = provider_sect' $'providers = provider_sect\nalg_section = algorithm_sect' \
+      --replace-fail '# fips = fips_sect' 'fips = fips_sect' \
+      --replace-fail '# activate = 1' $'activate = 1\n\n[algorithm_sect]\ndefault_properties = fips=yes'
+
+    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
+      -module "$fipsModule" \
+      -out "$fipsConfig"
+
+    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
+      -config "$opensslConfig"
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    export PATH="$bin/bin:$PATH"
+
+    openssl mac \
+      -digest SHA256 -macopt key:key HMAC </dev/null >/dev/null
+    openssl md5 </dev/null >/dev/null 2>&1 \
+    && echo "MD5 unexpectedly available with FIPS properties enabled" >&2 \
+    && exit 1
+
+    runHook postInstallCheck
+  '';
+})
diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index 8c62cae81196..56cc7d506ad6 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -16,4 +16,6 @@
     openssl_3_6
     openssl_4_0
     ;
+
+  openssl_fips = import ./openssl-fips.nix { };
 }

From c321752dcb46a50f2ab17a8ef58f0c8f98f9f74e Mon Sep 17 00:00:00 2001
From: Dario Piotrowicz <dario.piotrowicz@gmail.com>
Date: Wed, 5 Aug 2026 17:16:43 +0100
Subject: [PATCH 026/344] doc: remove `--expose-gc` flag from CLI documentation

PR-URL: https://github.com/nodejs/node/pull/58909
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 doc/api/cli.md | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 1a497808d935..ef6a9738f8df 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -1547,25 +1547,6 @@ added:
 
 Enable experimental support for the worker inspection with Chrome DevTools.
 
-### `--expose-gc`
-
-<!-- YAML
-added:
-  - v22.3.0
-  - v20.18.0
--->
-
-> Stability: 1 - Experimental. This flag is inherited from V8 and is subject to
-> change upstream.
-
-This flag will expose the gc extension from V8.
-
-```js
-if (globalThis.gc) {
-  globalThis.gc();
-}
-```
-
 ### `--force-context-aware`
 
 <!-- YAML

From 92e311046248c2650d7c3874055816cf0391e3c8 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Mon, 3 Aug 2026 17:42:56 +0200
Subject: [PATCH 027/344] crypto: fix disabling FIPS mode

OpenSSL reports FIPS mode as disabled after a successful
EVP_default_properties_enable_fips(..., 0) call. Do not treat that
disabled state as a failure.

Add OpenSSL 3 regression coverage that verifies the state is enabled
before disabling it again.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64982
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 deps/ncrypto/ncrypto.cc           |  3 +--
 test/parallel/test-crypto-fips.js | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index 1aadcf67bffe..b4fa65daa78c 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -539,8 +539,7 @@ bool setFipsEnabled(bool enable, CryptoErrorList* errors) {
   if (isFipsEnabled() == enable) return true;
   ClearErrorOnReturn clearErrorOnReturn(errors);
 #if OPENSSL_VERSION_MAJOR >= 3
-  return EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1 &&
-         EVP_default_properties_is_fips_enabled(nullptr);
+  return EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
 #else
   return FIPS_mode_set(enable ? 1 : 0) == 1;
 #endif
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 055de8a536fe..8b2e1c9a3649 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -105,6 +105,24 @@ if (!sharedOpenSSL()) {
     FIPS_DISABLED,
     'require("crypto").getFips()',
     { ...process.env, 'OPENSSL_CONF': ' ' });
+
+  if (hasOpenSSL3) {
+    // Disabling FIPS mode should not throw after OpenSSL updates the default
+    // property query.
+    testHelper(
+      'stdout',
+      [],
+      kNoFailure,
+      FIPS_DISABLED,
+      '(() => {' +
+      'const crypto = require("crypto");' +
+      'crypto.setFips(true);' +
+      'require("assert").strictEqual(crypto.getFips(), 1);' +
+      'crypto.setFips(false);' +
+      'return crypto.getFips();' +
+      '})()',
+      { ...process.env, 'OPENSSL_CONF': ' ' });
+  }
 }
 
 // Toggling fips with setFips should not be allowed from a worker thread

From 29a2ecefeb93a59799aecc00d6be9f0c6c596e7b Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Mon, 3 Aug 2026 17:45:13 +0200
Subject: [PATCH 028/344] build: handle malformed OpenSSL macros

A missing OPENSSL_VERSION_NUMBER macro raises TypeError while the
configure logic attempts to slice None. Treat that like the other
version detection failures so configure warns and records version 0.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64982
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 configure.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.py b/configure.py
index 20bf5b7d101f..6ddc73c301ef 100755
--- a/configure.py
+++ b/configure.py
@@ -1517,7 +1517,7 @@ def get_openssl_version(o):
 
     return version_number
 
-  except (OSError, ValueError, subprocess.SubprocessError) as e:
+  except (OSError, TypeError, ValueError, subprocess.SubprocessError) as e:
     warn(f'Failed to determine OpenSSL version from header: {e}')
     return 0
 

From 28f662b42419510394dc8b23ef942e9f84968ee7 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Mon, 3 Aug 2026 17:49:28 +0200
Subject: [PATCH 029/344] build: check FIPS option value in node.gyp

openssl_is_fips is always the string "true" or "false", so testing
whether it is non-empty always adds OPENSSL_FIPS to mkssldef. Add the
define only when FIPS was requested.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64982
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 node.gyp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/node.gyp b/node.gyp
index cf5e53d00d7e..5fbf5e31c039 100644
--- a/node.gyp
+++ b/node.gyp
@@ -1032,7 +1032,7 @@
             ],
           },
           'conditions': [
-            ['openssl_is_fips!=""', {
+            ['openssl_is_fips=="true"', {
               'variables': { 'mkssldef_flags': ['-DOPENSSL_FIPS'] },
             }],
           ],

From 9a256b06934ceefa619580adbddb3f260f597e85 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Mon, 3 Aug 2026 18:04:19 +0200
Subject: [PATCH 030/344] doc: clarify OpenSSL FIPS configuration

Distinguish OpenSSL 3 provider setup from FIPS/property-query state,
document configuration precedence and provider limitations, and retain
the OpenSSL 1.1 and runtime control guidance.

Regenerate the CLI manpage.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64982
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 BUILDING.md       |  12 +--
 doc/api/cli.md    |  24 +++---
 doc/api/crypto.md | 194 +++++++++++++++++++++++++++++++---------------
 doc/node.1        |  21 ++---
 4 files changed, 164 insertions(+), 87 deletions(-)

diff --git a/BUILDING.md b/BUILDING.md
index 02ea54c2f8ac..e477d46863f4 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -1032,11 +1032,11 @@ as `deps/icu` (You'll have: `deps/icu/source/...`)
 ### Configure OpenSSL appname
 
 Node.js can use an OpenSSL configuration file by specifying the environment
-variable `OPENSSL_CONF`, or using the command line option `--openssl-conf`, and
-if none of those are specified will default to reading the default OpenSSL
-configuration file `openssl.cnf`. Node.js will only read a section that is by
-default named `nodejs_conf`, but this name can be overridden using the following
-configure option:
+variable `OPENSSL_CONF`, or using the command line option `--openssl-config`,
+which takes precedence. If neither is specified, Node.js defaults to reading the
+default OpenSSL configuration file `openssl.cnf`. Node.js will only read a
+section that is by default named `nodejs_conf`, but this name can be overridden
+using the following configure option:
 
 ```bash
 ./configure --openssl-conf-name=<some_conf_name>
@@ -1048,6 +1048,8 @@ Node.js supports FIPS when statically or dynamically linked with OpenSSL 3 via
 [OpenSSL's provider model](https://docs.openssl.org/3.0/man7/crypto/#OPENSSL-PROVIDERS).
 It is not necessary to rebuild Node.js to enable support for FIPS.
 
+When using OpenSSL 1.1.1, Node.js must be built against a FIPS-capable OpenSSL.
+
 See [FIPS mode](doc/api/crypto.md#fips-mode) for more information on how to
 enable FIPS support in Node.js.
 
diff --git a/doc/api/cli.md b/doc/api/cli.md
index ef6a9738f8df..7e503bdde4f2 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -881,8 +881,9 @@ priority than `--dns-result-order`.
 added: v6.0.0
 -->
 
-Enable FIPS-compliant crypto at startup. (Requires Node.js to be built
-against FIPS-compatible OpenSSL.)
+Enable [FIPS mode][] at startup. With OpenSSL 3, a configured provider named
+`fips` must be available and initialize successfully. With OpenSSL 1.1.1,
+Node.js must be built against a FIPS-capable OpenSSL.
 
 ### `--enable-source-maps`
 
@@ -1561,8 +1562,8 @@ Disable loading native addons that are not [context-aware][].
 added: v6.0.0
 -->
 
-Force FIPS-compliant crypto on startup. (Cannot be disabled from script code.)
-(Same requirements as `--enable-fips`.)
+Enable [FIPS mode][] at startup and prevent it from being disabled from script
+code. The same OpenSSL requirements as [`--enable-fips`][] apply.
 
 ### `--force-node-api-uncaught-exceptions-policy`
 
@@ -2257,9 +2258,11 @@ usually only useful for developers debugging Node.js itself.
 added: v6.9.0
 -->
 
-Load an OpenSSL configuration file on startup. Among other uses, this can be
-used to enable FIPS-compliant crypto if Node.js is built
-against FIPS-enabled OpenSSL.
+Load an OpenSSL configuration file on startup. The file can activate an
+OpenSSL 3 FIPS provider or configure a FIPS-capable OpenSSL 1.1.1 build. See
+[FIPS mode][].
+
+This option takes precedence over the `OPENSSL_CONF` environment variable.
 
 ### `--openssl-legacy-provider`
 
@@ -4234,9 +4237,8 @@ environment variable is arbitrary.
 added: v6.11.0
 -->
 
-Load an OpenSSL configuration file on startup. Among other uses, this can be
-used to enable FIPS-compliant crypto if Node.js is built with
-`./configure --openssl-fips`.
+Load an OpenSSL configuration file on startup. The file can be used as part of
+a [FIPS mode][] configuration.
 
 If the [`--openssl-config`][] command-line option is used, the environment
 variable is ignored.
@@ -4443,6 +4445,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [ECMAScript module]: esm.md#modules-ecmascript-modules
 [EventSource Web API]: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events
 [ExperimentalWarning: `vm.measureMemory` is an experimental feature]: vm.md#vmmeasurememoryoptions
+[FIPS mode]: crypto.md#fips-mode
 [File System Permissions]: permissions.md#file-system-permissions
 [Loading ECMAScript modules using `require()`]: modules.md#loading-ecmascript-modules-using-require
 [Module resolution and loading]: packages.md#module-resolution-and-loading
@@ -4472,6 +4475,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`--cpu-prof-dir`]: #--cpu-prof-dir
 [`--diagnostic-dir`]: #--diagnostic-dirdirectory
 [`--disable-sigusr1`]: #--disable-sigusr1
+[`--enable-fips`]: #--enable-fips
 [`--env-file-if-exists`]: #--env-file-if-existsfile
 [`--env-file`]: #--env-filefile
 [`--experimental-sea-config`]: single-executable-applications.md#1-generating-single-executable-preparation-blobs
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 70292635c835..6811bfb40d91 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -4302,11 +4302,8 @@ deprecated: v10.0.0
 
 > Stability: 0 - Deprecated
 
-Property for checking and controlling whether a FIPS compliant crypto provider
-is currently in use. Setting to true requires a FIPS build of Node.js.
-
-This property is deprecated. Please use `crypto.setFips()` and
-`crypto.getFips()` instead.
+Deprecated property for checking and controlling [FIPS mode][]. Use
+[`crypto.getFips()`][] and [`crypto.setFips()`][] instead.
 
 ### `crypto.generateKey(type, options, callback)`
 
@@ -4897,9 +4894,14 @@ console.log(aliceSecret === bobSecret);
 added: v10.0.0
 -->
 
-* Returns: {number} `1` if and only if a FIPS compliant crypto provider is
-  currently in use, `0` otherwise. A future semver-major release may change
-  the return type of this API to a {boolean}.
+* Returns: {number} `1` if FIPS mode is enabled, `0` otherwise. A future
+  semver-major release may change the return type of this API to a {boolean}.
+
+With OpenSSL 3, this reports whether the default property query includes
+`fips=yes`. It does not establish that a FIPS provider is loaded or validated.
+It can return `1` even when a requested cryptographic implementation cannot be
+fetched because no loaded provider supplies a match for `fips=yes`. See [FIPS
+mode][].
 
 ### `crypto.getHashes()`
 
@@ -6171,10 +6173,33 @@ is a bit field taking one of or a mix of the following flags (defined in
 added: v10.0.0
 -->
 
-* `bool` {boolean} `true` to enable FIPS mode.
+* `bool` {boolean} `true` to enable FIPS mode, `false` to disable it.
+
+Changes [FIPS mode][]. With OpenSSL 3, this only adds or removes `fips=yes` in
+the default property query. It does not install, load, initialize, or validate
+a FIPS provider. For a usable FIPS configuration, install the provider and
+configure OpenSSL to load it when Node.js starts, as described in [FIPS
+mode][].
+
+If no loaded provider supplies a requested cryptographic implementation
+matching `fips=yes`, the call can still succeed and `crypto.getFips()` can still
+return `1`, but fetching that implementation fails. Affected `node:crypto`
+operations typically fail with `ERR_OSSL_EVP_UNSUPPORTED`. Operations that do
+not require a new fetch, including those using previously fetched
+implementations or initialized operation contexts, may still succeed. Call this
+method during application initialization, before application code uses other
+OpenSSL-backed APIs.
+
+This method only affects subsequent algorithm fetches. Node.js initializes some
+OpenSSL state before application code runs. When the property query must be
+active from process startup, set `default_properties = fips=yes` in the OpenSSL
+configuration or use [`--enable-fips`][] or [`--force-fips`][]. The command-line
+flags additionally require a configured provider named `fips` to initialize and
+pass its self-test; Node.js fails to start otherwise.
 
-Enables the FIPS compliant crypto provider in a FIPS-enabled Node.js build.
-Throws an error if FIPS mode is not available.
+Throws an error if OpenSSL cannot change the state. FIPS mode cannot be
+disabled when Node.js was started with `--force-fips`. With OpenSSL 1.1.1,
+enabling FIPS mode requires a FIPS-capable OpenSSL build.
 
 ### `crypto.sign(algorithm, data, key[, callback])`
 
@@ -6609,83 +6634,120 @@ console.log(receivedPlaintext);
 
 ### FIPS mode
 
-When using OpenSSL 3, Node.js supports FIPS 140-2 when used with an appropriate
-OpenSSL 3 provider, such as the [FIPS provider from OpenSSL 3][] which can be
-installed by following the instructions in [OpenSSL's FIPS README file][].
+Node.js exposes the FIPS support provided by the linked OpenSSL library. Node.js
+is not itself FIPS validated. Validation belongs to a specific OpenSSL module or
+provider and only applies when it is deployed according to its security policy.
+Vendor-provided Node.js or OpenSSL builds can require a different configuration;
+follow the vendor's documentation for those builds.
 
-For FIPS support in Node.js you will need:
+With OpenSSL 1.1.1, Node.js must be built against a FIPS-capable OpenSSL library.
+
+With OpenSSL 3, FIPS support uses the provider model described in the
+[OpenSSL FIPS module guide][]. Using FIPS-approved implementations requires:
 
 * A correctly installed OpenSSL 3 FIPS provider.
 * An OpenSSL 3 [FIPS module configuration file][].
-* An OpenSSL 3 configuration file that references the FIPS module
-  configuration file.
+* The FIPS provider to be loaded into the OpenSSL library context used by
+  Node.js, normally by activating it in an OpenSSL configuration file when
+  Node.js starts.
+* The default property query to include `fips=yes` when cryptographic
+  implementations are fetched. This can be set from process startup by the
+  OpenSSL configuration, [`--enable-fips`][], or [`--force-fips`][], or for
+  subsequent fetches by `crypto.setFips(true)`.
 
-Node.js will need to be configured with an OpenSSL configuration file that
-points to the FIPS provider. An example configuration file looks like this:
+An example OpenSSL 3 configuration file looks like this:
 
 ```text
 nodejs_conf = nodejs_init
+config_diagnostics = 1
 
 .include /<absolute path>/fipsmodule.cnf
 
 [nodejs_init]
 providers = provider_sect
+alg_section = algorithm_sect
 
 [provider_sect]
-default = default_sect
 # The fips section name should match the section name inside the
 # included fipsmodule.cnf.
 fips = fips_sect
+base = base_sect
 
-[default_sect]
+[base_sect]
 activate = 1
-```
-
-where `fipsmodule.cnf` is the FIPS module configuration file generated from the
-FIPS provider installation step:
 
-```bash
-openssl fipsinstall
+[algorithm_sect]
+default_properties = fips=yes
 ```
 
-Set the `OPENSSL_CONF` environment variable to point to
-your configuration file and `OPENSSL_MODULES` to the location of the FIPS
-provider dynamic library. e.g.
+The `fipsmodule.cnf` file is generated as part of the FIPS provider installation
+and contains module integrity and self-test information. The exact command and
+arguments are installation-specific; see [OpenSSL FIPS configuration][] and the
+[OpenSSL FIPS module guide][]. The installation uses `openssl fipsinstall`.
+
+The example activates the provider and enables the `fips=yes` property query
+when Node.js starts. To activate the provider at startup but enable the property
+query later with `crypto.setFips(true)`, omit `alg_section = algorithm_sect` and
+the `[algorithm_sect]` block. The provider must still be loaded; when using this
+startup configuration, keep its activation enabled. `crypto.setFips(true)`
+should be called before application code uses other OpenSSL-backed APIs. It is
+not equivalent to enabling the property query from process startup because
+Node.js initializes some OpenSSL state before application code runs. Use the
+example as written, [`--enable-fips`][], or [`--force-fips`][] when the property
+query must be active from process startup.
+
+`config_diagnostics` causes configuration errors to prevent startup instead of
+being ignored. The `base` provider supplies non-cryptographic supporting
+algorithms, such as encoders and decoders, that are commonly needed alongside
+the FIPS provider. `default_properties = fips=yes` restricts OpenSSL's default
+algorithm selection to implementations that match `fips=yes`.
+
+Set `OPENSSL_CONF` to the OpenSSL configuration file. For a dynamically loaded
+provider, `OPENSSL_MODULES` can set the directory containing the provider module.
+For example:
 
 ```bash
 export OPENSSL_CONF=/<path to configuration file>/nodejs.cnf
 export OPENSSL_MODULES=/<path to openssl lib>/ossl-modules
 ```
 
-FIPS mode can then be enabled in Node.js either by:
-
-* Starting Node.js with `--enable-fips` or `--force-fips` command line flags.
-* Programmatically calling `crypto.setFips(true)`.
-
-Optionally FIPS mode can be enabled in Node.js via the OpenSSL configuration
-file. e.g.
-
-```text
-nodejs_conf = nodejs_init
-
-.include /<absolute path>/fipsmodule.cnf
-
-[nodejs_init]
-providers = provider_sect
-alg_section = algorithm_sect
-
-[provider_sect]
-default = default_sect
-# The fips section name should match the section name inside the
-# included fipsmodule.cnf.
-fips = fips_sect
-
-[default_sect]
-activate = 1
-
-[algorithm_sect]
-default_properties = fips=yes
-```
+The [`--openssl-config`][] command-line option selects the configuration file and
+takes precedence over `OPENSSL_CONF`. If neither is set, OpenSSL's default
+configuration file is used.
+
+By default, Node.js reads the `nodejs_conf` section instead of OpenSSL's usual
+`openssl_conf` section. Use [`--openssl-shared-config`][] to read `openssl_conf`,
+or build Node.js with `./configure --openssl-conf-name=<name>` to change the
+default section name.
+
+On OpenSSL 3, the configuration above enables the `fips=yes` property query at
+startup. The following controls are also available:
+
+* [`--enable-fips`][] and [`--force-fips`][] enable the property query and
+  additionally require the configured provider named `fips` to initialize and
+  pass its self-test. Node.js exits if that check fails. `--force-fips` also
+  prevents FIPS mode from being disabled from script code.
+* [`crypto.setFips()`][] changes the FIPS/property-query state. On OpenSSL 3, it
+  does not install, load, initialize, or validate a provider. Implementations
+  fetched before the call are not changed.
+* [`crypto.getFips()`][] reports the FIPS/property-query state. On OpenSSL 3, a
+  return value of `1` does not prove that a FIPS provider is loaded or validated.
+
+With OpenSSL 1.1.1, these controls use the library's FIPS mode support and
+require a FIPS-capable OpenSSL build.
+
+Only algorithms available under the active FIPS settings can be used. With
+OpenSSL 3, if no loaded provider supplies a requested cryptographic
+implementation matching `fips=yes`, fetching it fails, typically with
+`ERR_OSSL_EVP_UNSUPPORTED`. The same error can occur for algorithms that
+Node.js supports when FIPS mode is disabled but that are unavailable under the
+active FIPS settings.
+
+OpenSSL documents that the same FIPS provider cannot be used by multiple copies
+of `libcrypto` in one process. This can affect native addons that load another
+copy of `libcrypto`; OpenSSL's documented workaround is to use a separate copy
+of the provider for each `libcrypto` instance. See [OpenSSL FIPS provider
+limitations][].
 
 ## Crypto constants
 
@@ -6968,15 +7030,17 @@ See the [list of SSL OP Flags][] for details.
 [CVE-2021-44532]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
 [Caveats]: #support-for-weak-or-compromised-algorithms
 [Crypto constants]: #crypto-constants
-[FIPS module configuration file]: https://www.openssl.org/docs/man3.0/man5/fips_config.html
-[FIPS provider from OpenSSL 3]: https://www.openssl.org/docs/man3.0/man7/crypto.html#FIPS-provider
+[FIPS mode]: #fips-mode
+[FIPS module configuration file]: https://docs.openssl.org/3.0/man5/fips_config/
 [HTML 5.2]: https://www.w3.org/TR/html52/changes.html#features-removed
 [JWK]: https://tools.ietf.org/html/rfc7517
 [Key usages]: webcrypto.md#cryptokeyusages
 [NIST SP 800-131A]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
 [NIST SP 800-132]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
-[OpenSSL's FIPS README file]: https://github.com/openssl/openssl/blob/openssl-3.0/README-FIPS.md
+[OpenSSL FIPS configuration]: https://docs.openssl.org/3.0/man5/fips_config/
+[OpenSSL FIPS module guide]: https://docs.openssl.org/master/man7/fips_module/
+[OpenSSL FIPS provider limitations]: https://docs.openssl.org/3.6/man7/OSSL_PROVIDER-FIPS/
 [OpenSSL's SPKAC implementation]: https://www.openssl.org/docs/man3.0/man1/openssl-spkac.html
 [Permission Model]: permissions.md#permission-model
 [RFC 1421]: https://www.rfc-editor.org/rfc/rfc1421.txt
@@ -6993,6 +7057,10 @@ See the [list of SSL OP Flags][] for details.
 [RFC 9562]: https://www.rfc-editor.org/rfc/rfc9562.txt
 [Web Crypto API documentation]: webcrypto.md
 [`--allow-openssl-store`]: cli.md#--allow-openssl-store
+[`--enable-fips`]: cli.md#--enable-fips
+[`--force-fips`]: cli.md#--force-fips
+[`--openssl-config`]: cli.md#--openssl-configfile
+[`--openssl-shared-config`]: cli.md#--openssl-shared-config
 [`BN_is_prime_ex`]: https://www.openssl.org/docs/man1.1.1/man3/BN_is_prime_ex.html
 [`Buffer`]: buffer.md
 [`DH_generate_key()`]: https://www.openssl.org/docs/man3.0/man3/DH_generate_key.html
@@ -7019,6 +7087,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.generateKeyPair()`]: #cryptogeneratekeypairtype-options-callback
 [`crypto.getCurves()`]: #cryptogetcurves
 [`crypto.getDiffieHellman()`]: #cryptogetdiffiehellmangroupname
+[`crypto.getFips()`]: #cryptogetfips
 [`crypto.getHashes()`]: #cryptogethashes
 [`crypto.hash()`]: #cryptohashalgorithm-data-options
 [`crypto.privateDecrypt()`]: #cryptoprivatedecryptprivatekey-buffer
@@ -7027,6 +7096,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.publicEncrypt()`]: #cryptopublicencryptkey-buffer
 [`crypto.randomBytes()`]: #cryptorandombytessize-callback
 [`crypto.randomFill()`]: #cryptorandomfillbuffer-offset-size-callback
+[`crypto.setFips()`]: #cryptosetfipsbool
 [`crypto.sign()`]: #cryptosignalgorithm-data-key-callback
 [`crypto.verify()`]: #cryptoverifyalgorithm-data-key-signature-callback
 [`crypto.webcrypto.getRandomValues()`]: webcrypto.md#cryptogetrandomvaluestypedarray
diff --git a/doc/node.1 b/doc/node.1
index b7e4d0a429a2..d42424224c44 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -513,8 +513,9 @@ The default is \fBverbatim\fR and \fBdns.setDefaultResultOrder()\fR have higher
 priority than \fB--dns-result-order\fR.
 .
 .It Fl -enable-fips
-Enable FIPS-compliant crypto at startup. (Requires Node.js to be built
-against FIPS-compatible OpenSSL.)
+Enable FIPS mode at startup. With OpenSSL 3, a configured provider named
+\fBfips\fR must be available and initialize successfully. With OpenSSL 1.1.1,
+Node.js must be built against a FIPS-capable OpenSSL.
 .
 .It Fl -enable-source-maps
 Enable Source Map support for stack traces.
@@ -842,8 +843,8 @@ if (globalThis.gc) {
 Disable loading native addons that are not context-aware.
 .
 .It Fl -force-fips
-Force FIPS-compliant crypto on startup. (Cannot be disabled from script code.)
-(Same requirements as \fB--enable-fips\fR.)
+Enable FIPS mode at startup and prevent it from being disabled from script
+code. The same OpenSSL requirements as \fB--enable-fips\fR apply.
 .
 .It Fl -force-node-api-uncaught-exceptions-policy
 Enforces \fBuncaughtException\fR event on Node-API asynchronous callbacks.
@@ -1146,9 +1147,10 @@ Enable extra debug checks for memory leaks in Node.js internals. This is
 usually only useful for developers debugging Node.js itself.
 .
 .It Fl -openssl-config Ns = Ns Ar file
-Load an OpenSSL configuration file on startup. Among other uses, this can be
-used to enable FIPS-compliant crypto if Node.js is built
-against FIPS-enabled OpenSSL.
+Load an OpenSSL configuration file on startup. The file can activate an
+OpenSSL 3 FIPS provider or configure a FIPS-capable OpenSSL 1.1.1 build. See
+FIPS mode.
+This option takes precedence over the \fBOPENSSL_CONF\fR environment variable.
 .
 .It Fl -openssl-legacy-provider
 Enable OpenSSL 3.0 legacy provider. For more information please see
@@ -2378,9 +2380,8 @@ propagation.
 environment variable is arbitrary.
 .
 .It Ev OPENSSL_CONF Ar file
-Load an OpenSSL configuration file on startup. Among other uses, this can be
-used to enable FIPS-compliant crypto if Node.js is built with
-\fB./configure --openssl-fips\fR.
+Load an OpenSSL configuration file on startup. The file can be used as part of
+a FIPS mode configuration.
 If the \fB--openssl-config\fR command-line option is used, the environment
 variable is ignored.
 .

From f48927fe5b2c8613ec451a4a3bce979051602c43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=ED=98=9C=EB=AF=B8?=
 <103042868+hyemimi@users.noreply.github.com>
Date: Thu, 6 Aug 2026 05:03:09 +0900
Subject: [PATCH 031/344] esm: fix wasm import name in error message

Report the rejected import name instead of the import module when
throwing for reserved Wasm import names.

Signed-off-by: hyemimi <hyemi7375@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64950
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
---
 lib/internal/modules/esm/translators.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
index c8eb2d857a3d..ad3de25bf6d5 100644
--- a/lib/internal/modules/esm/translators.js
+++ b/lib/internal/modules/esm/translators.js
@@ -581,7 +581,7 @@ translators.set('wasm', function(url, translateContext) {
       throw new WebAssembly.LinkError(`Invalid Wasm import "${impt.module}" in ${url}`);
     }
     if (impt.name.startsWith('wasm:') || impt.name.startsWith('wasm-js:')) {
-      throw new WebAssembly.LinkError(`Invalid Wasm import name "${impt.module}" in ${url}`);
+      throw new WebAssembly.LinkError(`Invalid Wasm import name "${impt.name}" in ${url}`);
     }
     importsList.add(impt.module);
   }

From 0450ab6c6a9d5582ada0ee0e495db9f8b326fc6d Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 5 Aug 2026 22:04:24 +0200
Subject: [PATCH 032/344] doc: update `node.1` to fix linter

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65053
Refs: https://github.com/nodejs/node/pull/58909
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/node.1 | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/doc/node.1 b/doc/node.1
index d42424224c44..5d7ce00a6f7b 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -831,14 +831,6 @@ Enable experimental WebAssembly System Interface (WASI) support.
 .It Fl -experimental-worker-inspection
 Enable experimental support for the worker inspection with Chrome DevTools.
 .
-.It Fl -expose-gc
-This flag will expose the gc extension from V8.
-.Bd -literal
-if (globalThis.gc) {
-  globalThis.gc();
-}
-.Ed
-.
 .It Fl -force-context-aware
 Disable loading native addons that are not context-aware.
 .

From 9167ebd32b6c92e10be01e8f9068aa75a0d1074e Mon Sep 17 00:00:00 2001
From: mike-git374 <217764531+mike-git374@users.noreply.github.com>
Date: Wed, 5 Aug 2026 14:43:40 -0600
Subject: [PATCH 033/344] sqlite: bind ArrayBuffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/nodejs/node/pull/62061
Fixes: https://github.com/nodejs/node/issues/61396
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
---
 src/node_sqlite.cc                            |  9 ++-
 .../test-sqlite-typed-array-and-data-view.js  | 69 +++++++++++++++++++
 2 files changed, 75 insertions(+), 3 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 038af9812f9e..3ff6c274ddbb 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -235,7 +235,8 @@ void JSValueToSQLiteResult(Isolate* isolate,
   } else if (value->IsString()) {
     Utf8Value val(isolate, value.As<String>());
     sqlite3_result_text(ctx, *val, val.length(), SQLITE_TRANSIENT);
-  } else if (value->IsArrayBufferView()) {
+  } else if (value->IsArrayBufferView() || value->IsArrayBuffer() ||
+             value->IsSharedArrayBuffer()) {
     ArrayBufferViewContents<uint8_t> buf(value);
     sqlite3_result_blob(ctx, buf.data(), buf.length(), SQLITE_TRANSIENT);
   } else if (value->IsBigInt()) {
@@ -2665,7 +2666,8 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
   int anon_idx = 1;
   int anon_start = 0;
 
-  if (args[0]->IsObject() && !args[0]->IsArrayBufferView()) {
+  if (args[0]->IsObject() && !args[0]->IsArrayBufferView() &&
+      !args[0]->IsArrayBuffer() && !args[0]->IsSharedArrayBuffer()) {
     Local<Object> obj = args[0].As<Object>();
     Local<Context> context = Isolate::GetCurrent()->GetCurrentContext();
     Local<Array> keys;
@@ -2791,7 +2793,8 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
     }
   } else if (value->IsNull()) {
     r = sqlite3_bind_null(statement_, index);
-  } else if (value->IsArrayBufferView()) {
+  } else if (value->IsArrayBufferView() || value->IsArrayBuffer() ||
+             value->IsSharedArrayBuffer()) {
     ArrayBufferViewContents<uint8_t> buf(value);
     r = sqlite3_bind_blob64(statement_,
                             index,
diff --git a/test/parallel/test-sqlite-typed-array-and-data-view.js b/test/parallel/test-sqlite-typed-array-and-data-view.js
index 2d5269be09b7..5236c182e061 100644
--- a/test/parallel/test-sqlite-typed-array-and-data-view.js
+++ b/test/parallel/test-sqlite-typed-array-and-data-view.js
@@ -5,6 +5,10 @@ const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
 
 const arrayBuffer = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]).buffer;
+const sharedArrayBuffer = new SharedArrayBuffer(8);
+const typedArrayOnSharedArrayBuffer = new Uint8Array(sharedArrayBuffer);
+typedArrayOnSharedArrayBuffer.set([1, 2, 3, 4, 5, 6, 7, 8]);
+
 const TypedArrays = [
   ['Int8Array', Int8Array],
   ['Uint8Array', Uint8Array],
@@ -51,3 +55,68 @@ suite('StatementSync with TypedArray/DataView', () => {
     });
   }
 });
+
+suite('StatementSync with ArrayBuffer and SharedArrayBuffer', () => {
+  const buffers = [
+    ['ArrayBuffer', arrayBuffer],
+    ['SharedArrayBuffer', sharedArrayBuffer],
+  ];
+
+  for (const [displayName, buffer] of buffers) {
+    test(`${displayName} - anonymous binding`, (t) => {
+      const db = new DatabaseSync(':memory:');
+      t.after(() => { db.close(); });
+      db.exec('CREATE TABLE test (data BLOB)');
+      // insert
+      {
+        const stmt = db.prepare('INSERT INTO test VALUES (?)');
+        stmt.run(buffer);
+      }
+      // select all
+      {
+        const stmt = db.prepare('SELECT * FROM test');
+        const row = stmt.get();
+        t.assert.ok(row.data instanceof Uint8Array);
+        t.assert.strictEqual(row.data.length, 8);
+        t.assert.deepStrictEqual(row.data, new Uint8Array(arrayBuffer));
+      }
+      // query
+      {
+        const stmt = db.prepare('SELECT * FROM test WHERE data = ?');
+        const rows = stmt.all(buffer);
+        t.assert.strictEqual(rows.length, 1);
+        t.assert.ok(rows[0].data instanceof Uint8Array);
+        t.assert.strictEqual(rows[0].data.length, 8);
+        t.assert.deepStrictEqual(rows[0].data, new Uint8Array(arrayBuffer));
+      }
+    });
+
+    test(`${displayName} - named binding (object)`, (t) => {
+      const db = new DatabaseSync(':memory:');
+      t.after(() => { db.close(); });
+      db.exec('CREATE TABLE test (data BLOB)');
+      // insert
+      {
+        const stmt = db.prepare('INSERT INTO test VALUES ($data)');
+        stmt.run({ '$data': buffer });
+      }
+      // select all
+      {
+        const stmt = db.prepare('SELECT * FROM test');
+        const row = stmt.get();
+        t.assert.ok(row.data instanceof Uint8Array);
+        t.assert.strictEqual(row.data.length, 8);
+        t.assert.deepStrictEqual(row.data, new Uint8Array(arrayBuffer));
+      }
+      // query
+      {
+        const stmt = db.prepare('SELECT * FROM test WHERE data = $data');
+        const rows = stmt.all({ '$data': buffer });
+        t.assert.strictEqual(rows.length, 1);
+        t.assert.ok(rows[0].data instanceof Uint8Array);
+        t.assert.strictEqual(rows[0].data.length, 8);
+        t.assert.deepStrictEqual(rows[0].data, new Uint8Array(arrayBuffer));
+      }
+    });
+  }
+});

From 7aff78d23149d1626ad7f789174d0ac3c78e37c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9?= <contact.9a5d6388@renegade334.me.uk>
Date: Wed, 5 Aug 2026 22:04:26 +0100
Subject: [PATCH 034/344] meta: update sccache to 0.17.0

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/64985
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/build-tarball.yml               | 2 +-
 .github/workflows/coverage-linux-without-intl.yml | 2 +-
 .github/workflows/coverage-linux.yml              | 2 +-
 .github/workflows/stress-test.yml                 | 2 +-
 .github/workflows/test-internet.yml               | 2 +-
 .github/workflows/test-linux-quic.yml             | 2 +-
 .github/workflows/test-linux.yml                  | 2 +-
 .github/workflows/test-macos.yml                  | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index 1e1febe22c7f..ab0698e11b74 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -120,7 +120,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Download tarball
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
index 1519ef6592e8..92c9f3b88217 100644
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ b/.github/workflows/coverage-linux-without-intl.yml
@@ -66,7 +66,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Install gcovr
         run: pip install gcovr==7.2
       - name: Configure
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
index e4a3c334c8cd..e97b759bc6a4 100644
--- a/.github/workflows/coverage-linux.yml
+++ b/.github/workflows/coverage-linux.yml
@@ -66,7 +66,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Install gcovr
         run: pip install gcovr==7.2
       - name: Configure
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index b6fa42137d5e..6f1e75813915 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -78,7 +78,7 @@ jobs:
       - name: Set up sccache
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       # This is needed due to https://github.com/nodejs/build/issues/3878
       - name: Cleanup
         if: runner.os == 'macOS'
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
index bcb9ff76372f..7052f014b200 100644
--- a/.github/workflows/test-internet.yml
+++ b/.github/workflows/test-internet.yml
@@ -63,7 +63,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Build
         run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn"
       - name: Test Internet
diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
index 38d2ef9b8407..e1a05cf91859 100644
--- a/.github/workflows/test-linux-quic.yml
+++ b/.github/workflows/test-linux-quic.yml
@@ -68,7 +68,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Build
         working-directory: node
         run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support --experimental-quic"
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index c38bae0693fd..40762503f685 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -79,7 +79,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Build
         working-directory: node
         run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support"
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
index 173f6758ad71..e87e83505d6d 100644
--- a/.github/workflows/test-macos.yml
+++ b/.github/workflows/test-macos.yml
@@ -102,7 +102,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       # The `npm ci` for this step fails a lot as part of the Test step. Run it
       # now so that we don't have to wait 2 hours for the Build step to pass
       # first before that failure happens. (And if there's something about

From 7c61b08aedfbb90c209a2181e0a85a2afd276c5e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Wed, 1 Jul 2026 11:18:34 -0300
Subject: [PATCH 035/344] sqlite: add StatementSync.prototype[Symbol.dispose]()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This extends explicit resource management support to prepared
statements, allowing a StatementSync to be deterministically
finalized via a `using` declaration, mirroring the existing
DatabaseSync and Session dispose methods.

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64232
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 doc/api/sqlite.md                           |  9 +++++
 src/node_sqlite.cc                          | 16 ++++++--
 src/node_sqlite.h                           |  2 +
 test/parallel/test-sqlite-statement-sync.js | 43 +++++++++++++++++++++
 4 files changed, 66 insertions(+), 4 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 483212a8b4ed..25e828c5e389 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -1194,6 +1194,15 @@ added: v22.5.0
 The source SQL text of the prepared statement. This property is a
 wrapper around [`sqlite3_sql()`][].
 
+### `statement[Symbol.dispose]()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Finalizes the prepared statement. If the prepared statement is already
+finalized, then this is a no-op.
+
 ## Class: `SQLTagStore`
 
 <!-- YAML
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 3ff6c274ddbb..6a2f6c8c76b4 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1058,10 +1058,7 @@ void DatabaseSync::FinalizeStatements() {
 }
 
 void DatabaseSync::UntrackStatement(StatementSync* statement) {
-  auto it = statements_.find(statement);
-  if (it != statements_.end()) {
-    statements_.erase(it);
-  }
+  statements_.erase(statement);
 }
 
 inline bool DatabaseSync::IsOpen() {
@@ -2634,6 +2631,10 @@ StatementSync::StatementSync(Environment* env,
 }
 
 StatementSync::~StatementSync() {
+  Close();
+}
+
+void StatementSync::Close() {
   if (!IsFinalized()) {
     db_->UntrackStatement(this);
     Finalize();
@@ -2654,6 +2655,12 @@ inline bool StatementSync::IsFinalized() {
   return statement_ == nullptr;
 }
 
+void StatementSync::Close(const FunctionCallbackInfo<Value>& args) {
+  StatementSync* stmt;
+  ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
+  stmt->Close();
+}
+
 inline int StatementSync::ResetStatement() {
   reset_generation_++;
   return sqlite3_reset(statement_);
@@ -3687,6 +3694,7 @@ Local<FunctionTemplate> StatementSync::GetConstructorTemplate(
         isolate, tmpl, "setReadBigInts", StatementSync::SetReadBigInts);
     SetProtoMethod(
         isolate, tmpl, "setReturnArrays", StatementSync::SetReturnArrays);
+    SetProtoDispose(isolate, tmpl, StatementSync::Close);
     env->set_sqlite_statement_sync_constructor_template(tmpl);
   }
   return tmpl;
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 9046b022eea4..352036761184 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -284,6 +284,7 @@ class StatementSync : public BaseObject {
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetReadBigInts(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetReturnArrays(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Close(const v8::FunctionCallbackInfo<v8::Value>& args);
   v8::MaybeLocal<v8::Value> ColumnToValue(const int column);
   v8::MaybeLocal<v8::Name> ColumnNameToName(const int column);
   bool GetCachedColumnNames(v8::LocalVector<v8::Name>* keys);
@@ -295,6 +296,7 @@ class StatementSync : public BaseObject {
 
  private:
   ~StatementSync() override;
+  void Close();
   BaseObjectPtr<DatabaseSync> db_;
   sqlite3_stmt* statement_;
   bool return_arrays_ = false;
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index c353c8035c5f..dc058c90ea12 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -969,3 +969,46 @@ suite('options.allowBareNamedParameters', () => {
     );
   });
 });
+
+
+suite('StatementSync.prototype[Symbol.dispose]()', () => {
+  test('finalizes an open statement', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE storage(key TEXT, val TEXT)');
+    const stmt = db.prepare('SELECT * FROM storage');
+    stmt[Symbol.dispose]();
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+
+  test('does not throw on an already-finalized statement', () => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt[Symbol.dispose]();
+    stmt[Symbol.dispose]();
+  });
+
+  test('works with a using declaration', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE storage(key TEXT, val TEXT)');
+    let captured;
+    {
+      using stmt = db.prepare('SELECT * FROM storage');
+      captured = stmt;
+      t.assert.deepStrictEqual(stmt.all(), []);
+    }
+    t.assert.throws(() => captured.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+
+  test('closing the database after dispose does not double-finalize', () => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt[Symbol.dispose]();
+    db.close();
+  });
+});

From 58ea88e1d3bc5ed1f8e5b3b5b71154f7904845cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Fri, 3 Jul 2026 21:13:33 -0300
Subject: [PATCH 036/344] sqlite: add StatementSync.prototype.close()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64232
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 doc/api/sqlite.md                             |  10 ++
 src/node_sqlite.cc                            |  12 +-
 src/node_sqlite.h                             |   1 +
 test/parallel/test-sqlite-named-parameters.js |  16 +++
 test/parallel/test-sqlite-statement-sync.js   | 129 ++++++++++++++++++
 5 files changed, 167 insertions(+), 1 deletion(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 25e828c5e389..96504fd43ebb 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -989,6 +989,15 @@ objects. If the prepared statement does not return any results, this method
 returns an empty array. The prepared statement [parameters are bound][] using
 the values in `namedParameters` and `anonymousParameters`.
 
+### `statement.close()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Finalizes the prepared statement. An exception is thrown if the statement is
+already finalized. This method is a wrapper around [`sqlite3_finalize()`][].
+
 ### `statement.columns()`
 
 <!-- YAML
@@ -1683,6 +1692,7 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3_deserialize()`]: https://sqlite.org/c3ref/deserialize.html
 [`sqlite3_exec()`]: https://www.sqlite.org/c3ref/exec.html
 [`sqlite3_expanded_sql()`]: https://www.sqlite.org/c3ref/expanded_sql.html
+[`sqlite3_finalize()`]: https://www.sqlite.org/c3ref/finalize.html
 [`sqlite3_get_autocommit()`]: https://sqlite.org/c3ref/get_autocommit.html
 [`sqlite3_last_insert_rowid()`]: https://www.sqlite.org/c3ref/last_insert_rowid.html
 [`sqlite3_load_extension()`]: https://www.sqlite.org/c3ref/load_extension.html
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 6a2f6c8c76b4..50bd3a361731 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -2656,6 +2656,15 @@ inline bool StatementSync::IsFinalized() {
 }
 
 void StatementSync::Close(const FunctionCallbackInfo<Value>& args) {
+  StatementSync* stmt;
+  ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, stmt->IsFinalized(), "statement has been finalized");
+  stmt->Close();
+}
+
+void StatementSync::Dispose(const FunctionCallbackInfo<Value>& args) {
   StatementSync* stmt;
   ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
   stmt->Close();
@@ -3694,7 +3703,8 @@ Local<FunctionTemplate> StatementSync::GetConstructorTemplate(
         isolate, tmpl, "setReadBigInts", StatementSync::SetReadBigInts);
     SetProtoMethod(
         isolate, tmpl, "setReturnArrays", StatementSync::SetReturnArrays);
-    SetProtoDispose(isolate, tmpl, StatementSync::Close);
+    SetProtoMethod(isolate, tmpl, "close", StatementSync::Close);
+    SetProtoDispose(isolate, tmpl, StatementSync::Dispose);
     env->set_sqlite_statement_sync_constructor_template(tmpl);
   }
   return tmpl;
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 352036761184..6243b03e590d 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -285,6 +285,7 @@ class StatementSync : public BaseObject {
   static void SetReadBigInts(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetReturnArrays(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Close(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Dispose(const v8::FunctionCallbackInfo<v8::Value>& args);
   v8::MaybeLocal<v8::Value> ColumnToValue(const int column);
   v8::MaybeLocal<v8::Name> ColumnNameToName(const int column);
   bool GetCachedColumnNames(v8::LocalVector<v8::Name>* keys);
diff --git a/test/parallel/test-sqlite-named-parameters.js b/test/parallel/test-sqlite-named-parameters.js
index 2fd6fb0da1c3..fd0a209b6b0b 100644
--- a/test/parallel/test-sqlite-named-parameters.js
+++ b/test/parallel/test-sqlite-named-parameters.js
@@ -109,6 +109,22 @@ suite('StatementSync.prototype.setAllowUnknownNamedParameters()', () => {
       message: /The "enabled" argument must be a boolean/,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const setup = db.exec(
+      'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
+    );
+    t.assert.strictEqual(setup, undefined);
+    const stmt = db.prepare('INSERT INTO data (key, val) VALUES ($k, $v)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setAllowUnknownNamedParameters(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('options.allowUnknownNamedParameters', () => {
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index dc058c90ea12..cf0e4daa45ca 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -67,6 +67,18 @@ suite('StatementSync.prototype.get()', () => {
       __proto__: null, key: 'key1', val: 'val1',
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.get();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.all()', () => {
@@ -120,6 +132,18 @@ suite('StatementSync.prototype.all()', () => {
       { __proto__: null, key: 'key1', val: 'val1' },
     ]);
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.all();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.iterate()', () => {
@@ -286,6 +310,18 @@ suite('StatementSync.prototype.iterate()', () => {
     stmt2.get();
     it.next();
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.iterate();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.run()', () => {
@@ -385,6 +421,18 @@ suite('StatementSync.prototype.run()', () => {
     const stmt = db.prepare('INSERT INTO data (key, val) VALUES (?1, ?2)');
     t.assert.deepStrictEqual(stmt.run(1, 2), { changes: 1, lastInsertRowid: 1 });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.run();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.sourceSQL', () => {
@@ -399,6 +447,16 @@ suite('StatementSync.prototype.sourceSQL', () => {
     const stmt = db.prepare(sql);
     t.assert.strictEqual(stmt.sourceSQL, sql);
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => stmt.sourceSQL, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.expandedSQL', () => {
@@ -418,6 +476,16 @@ suite('StatementSync.prototype.expandedSQL', () => {
     );
     t.assert.strictEqual(stmt.expandedSQL, expanded);
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => stmt.expandedSQL, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.setReadBigInts()', () => {
@@ -487,6 +555,18 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
       [`${Number.MAX_SAFE_INTEGER} + 1`]: 2n ** 53n,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setReadBigInts(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.setReturnArrays()', () => {
@@ -505,6 +585,18 @@ suite('StatementSync.prototype.setReturnArrays()', () => {
       message: /The "returnArrays" argument must be a boolean/,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setReturnArrays(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.get() with array output', () => {
@@ -723,6 +815,18 @@ suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
       message: /The "allowBareNamedParameters" argument must be a boolean/,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setAllowBareNamedParameters(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('options.readBigInts', () => {
@@ -971,6 +1075,31 @@ suite('options.allowBareNamedParameters', () => {
 });
 
 
+suite('StatementSync.prototype.close()', () => {
+  test('finalizes an open statement', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE storage(key TEXT, val TEXT)');
+    const stmt = db.prepare('SELECT * FROM storage');
+    t.assert.strictEqual(stmt.close(), undefined);
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.close();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+});
+
 suite('StatementSync.prototype[Symbol.dispose]()', () => {
   test('finalizes an open statement', (t) => {
     using db = new DatabaseSync(':memory:');

From 09d0da99e9c1707f6096bdd69917997c00c57d32 Mon Sep 17 00:00:00 2001
From: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Date: Thu, 6 Aug 2026 05:18:25 +0200
Subject: [PATCH 037/344] sqlite: fix undefined behaviour in
 `Session::Changeset()`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If `nChangeset == 0`, the pointer `pChangeset` may be nullptr.
Passing a nullptr to `memcpy()` is undefined behaviour.
This can be triggered by running the test suite under UBSAN.

Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: https://github.com/nodejs/node/pull/63637
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 src/node_sqlite.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 50bd3a361731..d474f89db900 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3936,7 +3936,9 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
   auto freeChangeset = OnScopeLeave([&] { sqlite3_free(pChangeset); });
 
   Local<ArrayBuffer> buffer = ArrayBuffer::New(env->isolate(), nChangeset);
-  std::memcpy(buffer->GetBackingStore()->Data(), pChangeset, nChangeset);
+  if (nChangeset > 0) {
+    std::memcpy(buffer->GetBackingStore()->Data(), pChangeset, nChangeset);
+  }
   Local<Uint8Array> uint8Array = Uint8Array::New(buffer, 0, nChangeset);
 
   args.GetReturnValue().Set(uint8Array);

From 49fb028714509f9bae7f79714b9cf3a1e5a36276 Mon Sep 17 00:00:00 2001
From: mike-git374 <217764531+mike-git374@users.noreply.github.com>
Date: Wed, 25 Feb 2026 18:25:05 -0700
Subject: [PATCH 038/344] sqlite: bind Boolean

PR-URL: https://github.com/nodejs/node/pull/62001
Fixes: https://github.com/nodejs/node/issues/57862
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
---
 src/node_sqlite.cc                      | 7 +++++--
 test/parallel/test-sqlite-data-types.js | 9 +++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index d474f89db900..1272deb42f11 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -2780,10 +2780,11 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
 
 bool StatementSync::BindValue(const Local<Value>& value, const int index) {
   // SQLite only supports a subset of JavaScript types. Some JS types such as
-  // functions don't make sense to support. Other JS types such as booleans and
+  // functions don't make sense to support. Other JS types such as
   // Dates could be supported by converting them to numbers. However, there
   // would not be a good way to read the values back from SQLite with the
-  // original type.
+  // original type. JS Boolean binds to 1 and 0 because SQLite maps true and
+  // false keywords to 1 and 0.
   Isolate* isolate = env()->isolate();
   int r;
   if (value->IsNumber()) {
@@ -2817,6 +2818,8 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
                             buf.data(),
                             static_cast<sqlite3_uint64>(buf.length()),
                             SQLITE_TRANSIENT);
+  } else if (value->IsBoolean()) {
+    r = sqlite3_bind_int(statement_, index, value->IsTrue() ? 1 : 0);
   } else if (value->IsBigInt()) {
     bool lossless;
     int64_t as_int = value.As<BigInt>()->Int64Value(&lossless);
diff --git a/test/parallel/test-sqlite-data-types.js b/test/parallel/test-sqlite-data-types.js
index 5e51f17733c5..bac5a6283135 100644
--- a/test/parallel/test-sqlite-data-types.js
+++ b/test/parallel/test-sqlite-data-types.js
@@ -71,6 +71,15 @@ suite('data binding and mapping', () => {
       text: '',
       buf: new Uint8Array(),
     });
+
+    t.assert.deepStrictEqual(
+      stmt.run(5, true, false, true, null),
+      { changes: 1, lastInsertRowid: 5 }
+    );
+    t.assert.deepStrictEqual(
+      query.get(5),
+      { __proto__: null, key: 5, int: 1, double: 0, text: '1', buf: null }
+    );
   });
 
   test('large strings are bound correctly', (t) => {

From 615273deac19c9095bbbdecaab3788428606b324 Mon Sep 17 00:00:00 2001
From: Robert Nagy <ronagy@icloud.com>
Date: Thu, 6 Aug 2026 12:25:51 +0300
Subject: [PATCH 039/344] buffer: support aligned allocations

Add an optional `alignment` argument to `Buffer.allocUnsafe()` and
`Buffer.allocUnsafeSlow()`, which guarantees that the memory backing the
returned buffer starts at an address that is a multiple of `alignment`.

Some operating system interfaces refuse to work with unaligned memory.
The motivating case is unbuffered ("direct") file I/O: a read or write
on a descriptor opened with `O_DIRECT` fails with `EINVAL` unless the
buffer address is a multiple of the logical block size of the underlying
device. Until now there was no way to obtain such a buffer from JS,
since the address of a backing store can neither be observed nor chosen.
Alignment is also worth having purely for performance, for instance to
keep a hot buffer from straddling one more cache line than its size
requires.

V8 does not allow picking the address of a backing store, so alignment
is instead achieved by over-allocating `alignment - 1` bytes and
positioning the buffer at the first suitably aligned byte within them.
The new `arrayBufferAlignedOffset()` binding computes that offset.

Addresses are not stable across snapshot serialization, so the binding
reports no padding while a snapshot is being built. Otherwise the
snapshot would capture where this particular process happened to
allocate and stop being reproducible. Buffers restored from a snapshot
are consequently not aligned; the pool works around this by recreating
itself in a deserialize callback.

The `Buffer.allocUnsafe()` pool is now aligned to a cache line itself,
which lets pooled allocations satisfy any alignment up to 64 bytes by
padding their offset into the pool rather than allocating separately.

Assisted-by: Claude/Opus 5
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/65003
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 doc/api/buffer.md                            |  98 +++++++++++-
 doc/api/deprecations.md                      |   4 +-
 doc/api/worker_threads.md                    |   2 +-
 lib/buffer.js                                |  87 ++++++++--
 lib/internal/buffer.js                       |  17 ++
 src/node_buffer.cc                           |  84 +++++++---
 test/parallel/test-buffer-alloc-alignment.js | 158 +++++++++++++++++++
 7 files changed, 415 insertions(+), 35 deletions(-)
 create mode 100644 test/parallel/test-buffer-alloc-alignment.js

diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 212e0899e0b8..93af755b7620 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -791,11 +791,14 @@ data that might not have been allocated for `Buffer`s.
 
 A `TypeError` will be thrown if `size` is not a number.
 
-### Static method: `Buffer.allocUnsafe(size)`
+### Static method: `Buffer.allocUnsafe(size[, alignment])`
 
 <!-- YAML
 added: v5.10.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65003
+    description: Added the `alignment` argument.
   - version: v20.0.0
     pr-url: https://github.com/nodejs/node/pull/45796
     description: Throw ERR_INVALID_ARG_TYPE or ERR_OUT_OF_RANGE instead of
@@ -810,6 +813,9 @@ changes:
 -->
 
 * `size` {integer} The desired length of the new `Buffer`.
+* `alignment` {integer} If given, the memory backing the new `Buffer` will start
+  at an address that is a multiple of `alignment`. Must be a power of two no
+  larger than `2 ** 30`. See [Aligned allocations][].
 * Returns: {Buffer}
 
 Allocates a new `Buffer` of `size` bytes. If `size` is larger than
@@ -865,11 +871,14 @@ pool, while `Buffer.allocUnsafe(size).fill(fill)` _will_ use the internal
 difference is subtle but can be important when an application requires the
 additional performance that [`Buffer.allocUnsafe()`][] provides.
 
-### Static method: `Buffer.allocUnsafeSlow(size)`
+### Static method: `Buffer.allocUnsafeSlow(size[, alignment])`
 
 <!-- YAML
 added: v5.12.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65003
+    description: Added the `alignment` argument.
   - version: v20.0.0
     pr-url: https://github.com/nodejs/node/pull/45796
     description: Throw ERR_INVALID_ARG_TYPE or ERR_OUT_OF_RANGE instead of
@@ -881,6 +890,9 @@ changes:
 -->
 
 * `size` {integer} The desired length of the new `Buffer`.
+* `alignment` {integer} If given, the memory backing the new `Buffer` will start
+  at an address that is a multiple of `alignment`. Must be a power of two no
+  larger than `2 ** 30`. See [Aligned allocations][].
 * Returns: {Buffer}
 
 Allocates a new `Buffer` of `size` bytes. If `size` is larger than
@@ -5608,16 +5620,92 @@ While there are clear performance advantages to using
 [`Buffer.allocUnsafe()`][], extra care _must_ be taken in order to avoid
 introducing security vulnerabilities into an application.
 
+### Aligned allocations
+
+Some operating system interfaces require the memory they operate on to be
+aligned, and on some hardware alignment is merely faster. The most common
+example of the former is unbuffered ("direct") file I/O, which on Linux requires
+the buffer address, the file offset and the transfer length to all be multiples
+of the logical block size of the underlying device:
+
+```mjs
+import { open } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { Buffer } from 'node:buffer';
+
+const blockSize = 4096;
+
+// The buffer address must be block-aligned for O_DIRECT to accept it.
+const buf = Buffer.allocUnsafeSlow(blockSize, blockSize);
+
+const file = await open('/dev/sda', constants.O_RDONLY | constants.O_DIRECT);
+try {
+  await file.read(buf, 0, blockSize, 0);
+} finally {
+  await file.close();
+}
+```
+
+```cjs
+const fs = require('node:fs');
+const { Buffer } = require('node:buffer');
+
+const blockSize = 4096;
+
+// The buffer address must be block-aligned for O_DIRECT to accept it.
+const buf = Buffer.allocUnsafeSlow(blockSize, blockSize);
+
+const flags = fs.constants.O_RDONLY | fs.constants.O_DIRECT;
+fs.open('/dev/sda', flags, (err, fd) => {
+  if (err) throw err;
+  fs.read(fd, buf, 0, blockSize, 0, (err) => {
+    fs.close(fd, () => {});
+    if (err) throw err;
+  });
+});
+```
+
+Alignment can also be worth requesting purely for performance, even when no
+interface demands it. Aligning a hot `Buffer` to the cache line size (64 bytes on
+most contemporary CPUs) keeps it from straddling one more cache line than it
+needs to, so that a small structure is fetched with one cache miss instead of
+two, and page-aligned (4096 bytes) allocations similarly help interfaces that map
+or pin memory. These are micro-optimizations: measure before reaching for them,
+since the extra bytes are not free.
+
+Because the address of a `Buffer`'s memory cannot be chosen directly, extra bytes
+have to be allocated or skipped to reach an aligned address.
+[`Buffer.allocUnsafeSlow()`][] over-allocates up to `alignment - 1` bytes and
+positions the returned `Buffer` at the first suitably aligned byte within them.
+[`Buffer.allocUnsafe()`][] instead pads its offset into the shared internal pool,
+whose start is always aligned to 64 bytes, and only falls back to an allocation
+of its own when `alignment` is larger than that. Either way,
+[`buf.byteOffset`][] is usually not 0 and [`buf.buffer`][] is larger than `size`,
+so code that reaches past the `Buffer` into its underlying `ArrayBuffer` must
+take the offset into account, as it must for pooled `Buffer`s.
+
+The alignment is a property of the returned `Buffer` and is preserved for its
+whole lifetime, but it is not inherited by other views: [`buf.subarray`][],
+[`buf.slice()`][] and `structuredClone()` may all produce unaligned `Buffer`s.
+
+Alignment also does not survive being captured in a startup snapshot: memory does
+not keep its address across serialization, so a `Buffer` allocated while
+[`--build-snapshot`][] is in effect is not aligned in the deserialized process.
+Allocate inside a [`v8.startupSnapshot.setDeserializeMainFunction()`][] callback,
+or after startup, if the alignment has to hold at run time.
+
 [ASCII]: https://en.wikipedia.org/wiki/ASCII
+[Aligned allocations]: #aligned-allocations
 [Base64]: https://en.wikipedia.org/wiki/Base64
 [ISO-8859-1]: https://en.wikipedia.org/wiki/ISO-8859-1
 [RFC 4648, Section 5]: https://tools.ietf.org/html/rfc4648#section-5
 [UTF-16]: https://en.wikipedia.org/wiki/UTF-16
 [UTF-8]: https://en.wikipedia.org/wiki/UTF-8
 [WHATWG Encoding Standard]: https://encoding.spec.whatwg.org/
+[`--build-snapshot`]: cli.md#--build-snapshot
 [`Buffer.alloc()`]: #static-method-bufferallocsize-fill-encoding
-[`Buffer.allocUnsafe()`]: #static-method-bufferallocunsafesize
-[`Buffer.allocUnsafeSlow()`]: #static-method-bufferallocunsafeslowsize
+[`Buffer.allocUnsafe()`]: #static-method-bufferallocunsafesize-alignment
+[`Buffer.allocUnsafeSlow()`]: #static-method-bufferallocunsafeslowsize-alignment
 [`Buffer.concat()`]: #static-method-bufferconcatlist-totallength
 [`Buffer.copyBytesFrom()`]: #static-method-buffercopybytesfromview-offset-length
 [`Buffer.from(array)`]: #static-method-bufferfromarray
@@ -5639,6 +5727,7 @@ introducing security vulnerabilities into an application.
 [`TypedArray.prototype.subarray()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray/subarray
 [`blob.stream()`]: #blobstream
 [`buf.buffer`]: #bufbuffer
+[`buf.byteOffset`]: #bufbyteoffset
 [`buf.compare()`]: #bufcomparetarget-targetstart-targetend-sourcestart-sourceend
 [`buf.entries()`]: #bufentries
 [`buf.fill()`]: #buffillvalue-offset-end-encoding
@@ -5653,6 +5742,7 @@ introducing security vulnerabilities into an application.
 [`buffer.constants.MAX_STRING_LENGTH`]: #bufferconstantsmax_string_length
 [`buffer.kMaxLength`]: #bufferkmaxlength
 [`util.inspect()`]: util.md#utilinspectobject-options
+[`v8.startupSnapshot.setDeserializeMainFunction()`]: v8.md#v8startupsnapshotsetdeserializemainfunctioncallback-data
 [`v8::Uint8Array::kMaxLength`]: https://v8.github.io/api/head/classv8_1_1Uint8Array.html#a7677e3d0c9c92e4d40bef7212f5980c6
 [base64url]: https://tools.ietf.org/html/rfc4648#section-5
 [endianness]: https://en.wikipedia.org/wiki/Endianness
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 334b94f6bb8f..9b18c4ed486f 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4624,7 +4624,7 @@ will throw an error in a future version.
 [`--pending-deprecation`]: cli.md#--pending-deprecation
 [`--throw-deprecation`]: cli.md#--throw-deprecation
 [`--unhandled-rejections`]: cli.md#--unhandled-rejectionsmode
-[`Buffer.allocUnsafeSlow(size)`]: buffer.md#static-method-bufferallocunsafeslowsize
+[`Buffer.allocUnsafeSlow(size)`]: buffer.md#static-method-bufferallocunsafeslowsize-alignment
 [`Buffer.from(array)`]: buffer.md#static-method-bufferfromarray
 [`Buffer.from(buffer)`]: buffer.md#static-method-bufferfrombuffer
 [`Buffer.isBuffer()`]: buffer.md#static-method-bufferisbufferobj
@@ -4770,7 +4770,7 @@ will throw an error in a future version.
 [`writable.writableLength`]: stream.md#writablewritablelength
 [`zlib.bytesWritten`]: zlib.md#zlibbyteswritten
 [alloc]: buffer.md#static-method-bufferallocsize-fill-encoding
-[alloc_unsafe_size]: buffer.md#static-method-bufferallocunsafesize
+[alloc_unsafe_size]: buffer.md#static-method-bufferallocunsafesize-alignment
 [caveats of asynchronous customization hooks]: module.md#caveats-of-asynchronous-customization-hooks
 [from_arraybuffer]: buffer.md#static-method-bufferfromarraybuffer-byteoffset-length
 [from_string_encoding]: buffer.md#static-method-bufferfromstring-encoding
diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index e137722674b3..d812bce8fd05 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -2234,7 +2234,7 @@ thread spawned will spawn another until the application crashes.
 [`--max-old-space-size`]: cli.md#--max-old-space-sizesize-in-mib
 [`--max-semi-space-size`]: cli.md#--max-semi-space-sizesize-in-mib
 [`AsyncResource`]: async_hooks.md#class-asyncresource
-[`Buffer.allocUnsafe()`]: buffer.md#static-method-bufferallocunsafesize
+[`Buffer.allocUnsafe()`]: buffer.md#static-method-bufferallocunsafesize-alignment
 [`ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST`]: errors.md#err_missing_message_port_in_transfer_list
 [`ERR_WORKER_MESSAGING_ERRORED`]: errors.md#err_worker_messaging_errored
 [`ERR_WORKER_MESSAGING_FAILED`]: errors.md#err_worker_messaging_failed
diff --git a/lib/buffer.js b/lib/buffer.js
index cc213f12dacf..19574064ad12 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -140,6 +140,7 @@ const {
   markAsUntransferable,
   addBufferPrototypeMethods,
   createUnsafeBuffer,
+  createUnsafeAlignedBuffer,
   asciiWrite,
   latin1Write,
   utf8Write,
@@ -171,13 +172,27 @@ const constants = ObjectDefineProperties({}, {
   },
 });
 
+// The largest alignment accepted by `Buffer.allocUnsafeSlow()`. Any plausible
+// I/O alignment requirement (logical block size, memory page size, huge page
+// size) is well below this.
+const kMaxAlignment = 2 ** 30;
+
+// Slices handed out of the pool are 8 byte aligned relative to the start of the
+// pool, so aligning the pool itself to a cache line keeps them from straddling
+// one more cache line than their size requires.
+const kPoolAlignment = 64;
+
 Buffer.poolSize = 64 * 1024;
-let poolSize, poolOffset, allocPool, allocBuffer;
+// `poolOffset` is relative to `poolBase`, which is where the pool starts inside
+// `allocPool`. The pool is over-allocated to be able to align it, so `poolBase`
+// is not necessarily 0.
+let poolSize, poolOffset, poolBase, allocPool, allocBuffer;
 
 function createPool() {
   poolSize = Buffer.poolSize;
-  allocBuffer = createUnsafeBuffer(poolSize);
+  allocBuffer = createUnsafeAlignedBuffer(poolSize, kPoolAlignment);
   allocPool = allocBuffer.buffer;
+  poolBase = TypedArrayPrototypeGetByteOffset(allocBuffer);
   markAsUntransferable(allocPool);
   poolOffset = 0;
 }
@@ -444,25 +459,58 @@ Buffer.alloc = function alloc(size, fill, encoding) {
 /**
  * Equivalent to Buffer(num), by default creates a non-zero-filled Buffer
  * instance. If `--zero-fill-buffers` is set, will zero-fill the buffer.
+ *
+ * If `alignment` is given, the memory backing the returned buffer starts at an
+ * address that is a multiple of `alignment`. See `Buffer.allocUnsafeSlow()`.
+ * @param {number} size
+ * @param {number} [alignment] A power of two, at most 2 ** 30
  * @returns {FastBuffer}
  */
-Buffer.allocUnsafe = function allocUnsafe(size) {
+Buffer.allocUnsafe = function allocUnsafe(size, alignment) {
   validateNumber(size, 'size', 0, kMaxLength);
-  return allocate(size);
+  if (alignment === undefined) {
+    return allocate(size);
+  }
+  validateAlignment(size, alignment);
+  return allocateAligned(size, alignment);
 };
 
 /**
  * By default creates a non-zero-filled Buffer instance that is not allocated
  * off the pre-initialized pool. If `--zero-fill-buffers` is set, will zero-fill
  * the buffer.
+ *
+ * If `alignment` is given, the memory backing the returned buffer starts at an
+ * address that is a multiple of `alignment`, which is required by e.g. reads
+ * and writes on file descriptors opened with `O_DIRECT`. Note that up to
+ * `alignment - 1` extra bytes are allocated to satisfy the request, and that
+ * the returned buffer's `byteOffset` is therefore usually non-zero.
  * @param {number} size
- * @returns {FastBuffer|undefined}
+ * @param {number} [alignment] A power of two, at most 2 ** 30
+ * @returns {FastBuffer}
  */
-Buffer.allocUnsafeSlow = function allocUnsafeSlow(size) {
+Buffer.allocUnsafeSlow = function allocUnsafeSlow(size, alignment) {
   validateNumber(size, 'size', 0, kMaxLength);
-  return createUnsafeBuffer(size);
+  if (alignment === undefined) {
+    return createUnsafeBuffer(size);
+  }
+  validateAlignment(size, alignment);
+  return createUnsafeAlignedBuffer(size, alignment);
 };
 
+function validateAlignment(size, alignment) {
+  validateInteger(alignment, 'alignment', 1, kMaxAlignment);
+  if ((alignment & (alignment - 1)) !== 0) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'alignment', alignment, 'must be a power of two');
+  }
+  // Satisfying the alignment costs up to `alignment - 1` extra bytes.
+  if (size > kMaxLength - (alignment - 1)) {
+    throw new ERR_OUT_OF_RANGE(
+      'size', `<= ${kMaxLength - (alignment - 1)}`, size);
+  }
+}
+
 function allocate(size) {
   if (size <= 0) {
     return new FastBuffer();
@@ -470,7 +518,7 @@ function allocate(size) {
   if (size < (Buffer.poolSize >>> 1)) {
     if (size > (poolSize - poolOffset))
       createPool();
-    const b = new FastBuffer(allocPool, poolOffset, size);
+    const b = new FastBuffer(allocPool, poolBase + poolOffset, size);
     poolOffset += size;
     alignPool();
     return b;
@@ -478,6 +526,25 @@ function allocate(size) {
   return createUnsafeBuffer(size);
 }
 
+function allocateAligned(size, alignment) {
+  if (size <= 0) {
+    return new FastBuffer();
+  }
+  // The pool starts at a `kPoolAlignment` aligned address, so any alignment up
+  // to that can be satisfied by padding the offset into the pool. Stricter
+  // alignments need an allocation of their own.
+  if (alignment > kPoolAlignment || size >= (Buffer.poolSize >>> 1)) {
+    return createUnsafeAlignedBuffer(size, alignment);
+  }
+  poolOffset = (poolOffset + alignment - 1) & ~(alignment - 1);
+  if (size > (poolSize - poolOffset))
+    createPool();
+  const b = new FastBuffer(allocPool, poolBase + poolOffset, size);
+  poolOffset += size;
+  alignPool();
+  return b;
+}
+
 function fromStringFast(string, ops) {
   const maxLength = Buffer.poolSize >>> 1;
 
@@ -498,7 +565,7 @@ function fromStringFast(string, ops) {
     createPool();
 
   const actual = ops.write(allocBuffer, string, poolOffset, length);
-  const b = new FastBuffer(allocPool, poolOffset, actual);
+  const b = new FastBuffer(allocPool, poolBase + poolOffset, actual);
 
   poolOffset += actual;
   alignPool();
@@ -560,7 +627,7 @@ function fromArrayLike(obj) {
   if (length < (Buffer.poolSize >>> 1)) {
     if (length > (poolSize - poolOffset))
       createPool();
-    const b = new FastBuffer(allocPool, poolOffset, length);
+    const b = new FastBuffer(allocPool, poolBase + poolOffset, length);
     TypedArrayPrototypeSet(b, obj, 0);
     poolOffset += length;
     alignPool();
diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index d23f5d0ab6ab..5029f60e7ba0 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -33,6 +33,7 @@ const {
   hexWrite,
   ucs2Write,
   utf8WriteStatic,
+  arrayBufferAlignedOffset,
   createUnsafeArrayBuffer,
   setDetachKey,
 } = internalBinding('buffer');
@@ -1104,12 +1105,28 @@ function createUnsafeBuffer(size) {
   return new FastBuffer(createUnsafeArrayBuffer(size));
 }
 
+// Returns an uninitialized buffer of `size` bytes whose first byte is located at
+// a memory address that is a multiple of `alignment`. `alignment` must be a
+// power of two, and `size + alignment - 1` must not exceed the maximum buffer
+// length. Since the address of a backing store cannot be chosen, `alignment - 1`
+// extra bytes are allocated and skipped, which leaves the returned buffer with a
+// non-zero `byteOffset` into a larger ArrayBuffer.
+function createUnsafeAlignedBuffer(size, alignment) {
+  if (size === 0) {
+    return new FastBuffer();
+  }
+
+  const ab = createUnsafeArrayBuffer(size + alignment - 1);
+  return new FastBuffer(ab, arrayBufferAlignedOffset(ab, alignment), size);
+}
+
 module.exports = {
   FastBuffer,
   addBufferPrototypeMethods,
   markAsUntransferable,
   isMarkedAsUntransferable,
   createUnsafeBuffer,
+  createUnsafeAlignedBuffer,
   readUInt16BE,
   readUInt32BE,
   asciiWrite,
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index 29aeedd68f48..5be36d41666f 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -1615,6 +1615,32 @@ inline size_t CheckNumberToSize(Local<Value> number) {
   return size;
 }
 
+// Allocates an ArrayBuffer of `size` bytes. Its contents are left
+// uninitialized, unless zero-filling is required.
+MaybeLocal<ArrayBuffer> AllocateUnsafeArrayBuffer(Environment* env,
+                                                  size_t size) {
+  Isolate* isolate = env->isolate();
+
+  // 0-length, or zero-fill flag is set, or building snapshot
+  if (size == 0 || per_process::cli_options->zero_fill_all_buffers ||
+      env->isolate_data()->is_building_snapshot()) {
+    return ArrayBuffer::New(isolate, size);
+  }
+
+  std::unique_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
+      isolate,
+      size,
+      BackingStoreInitializationMode::kUninitialized,
+      v8::BackingStoreOnFailureMode::kReturnNull);
+
+  if (!store) [[unlikely]] {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<ArrayBuffer>();
+  }
+
+  return ArrayBuffer::New(isolate, std::move(store));
+}
+
 void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   if (args.Length() != 1) {
@@ -1624,30 +1650,49 @@ void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
 
   size_t size = CheckNumberToSize(args[0]);
 
-  Isolate* isolate = env->isolate();
-
   Local<ArrayBuffer> buf;
+  if (AllocateUnsafeArrayBuffer(env, size).ToLocal(&buf)) {
+    args.GetReturnValue().Set(buf);
+  }
+}
 
-  // 0-length, or zero-fill flag is set, or building snapshot
-  if (size == 0 || per_process::cli_options->zero_fill_all_buffers ||
-      env->isolate_data()->is_building_snapshot()) {
-    buf = ArrayBuffer::New(isolate, size);
-  } else {
-    std::unique_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
-        isolate,
-        size,
-        BackingStoreInitializationMode::kUninitialized,
-        v8::BackingStoreOnFailureMode::kReturnNull);
+// arrayBufferAlignedOffset(arrayBuffer, alignment)
+//
+// Returns the offset of the first byte of `arrayBuffer` that is located at a
+// memory address which is a multiple of `alignment`. V8 does not let us choose
+// the address of a backing store, so an aligned view is obtained by
+// over-allocating `alignment - 1` bytes and skipping to that offset. The
+// backing store of a non-resizable ArrayBuffer never moves, so the offset stays
+// aligned for the lifetime of the ArrayBuffer.
+void ArrayBufferAlignedOffset(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 2);
+  CHECK(args[0]->IsArrayBuffer());
+  Local<ArrayBuffer> ab = args[0].As<ArrayBuffer>();
 
-    if (!store) [[unlikely]] {
-      THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
-      return;
-    }
+  size_t alignment = CheckNumberToSize(args[1]);
 
-    buf = ArrayBuffer::New(isolate, std::move(store));
+  // Validated in JS land.
+  CHECK_GT(alignment, 0);
+  CHECK_EQ(alignment & (alignment - 1), 0);
+
+  // A backing store does not keep its address across snapshot serialization, so
+  // an offset computed here would not be aligned after deserialization anyway
+  // -- and worse, baking one in would make the snapshot depend on where this
+  // process happened to allocate, i.e. no longer reproducible. Report no
+  // padding instead. The buffer pool recreates itself in a deserialize
+  // callback, so it is properly aligned once the deserialized process runs.
+  if (env->isolate_data()->is_building_snapshot()) {
+    args.GetReturnValue().Set(0.0);
+    return;
   }
 
-  args.GetReturnValue().Set(buf);
+  uintptr_t start = reinterpret_cast<uintptr_t>(ab->Data());
+  size_t offset = (alignment - (start & (alignment - 1))) & (alignment - 1);
+  CHECK_EQ((start + offset) & (alignment - 1), 0);
+  CHECK_LE(offset, ab->ByteLength());
+
+  args.GetReturnValue().Set(static_cast<double>(offset));
 }
 
 template <encoding encoding>
@@ -1779,6 +1824,8 @@ void Initialize(Local<Object> target,
   SetMethod(context, target, "copyArrayBuffer", CopyArrayBuffer);
   SetMethodNoSideEffect(
       context, target, "createUnsafeArrayBuffer", CreateUnsafeArrayBuffer);
+  SetMethodNoSideEffect(
+      context, target, "arrayBufferAlignedOffset", ArrayBufferAlignedOffset);
 
   SetFastMethod(context, target, "swap16", Swap16, &fast_swap16);
   SetFastMethod(context, target, "swap32", Swap32, &fast_swap32);
@@ -1887,6 +1934,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 
   registry->Register(CopyArrayBuffer);
   registry->Register(CreateUnsafeArrayBuffer);
+  registry->Register(ArrayBufferAlignedOffset);
 
   registry->Register(Atob);
   registry->Register(Btoa);
diff --git a/test/parallel/test-buffer-alloc-alignment.js b/test/parallel/test-buffer-alloc-alignment.js
new file mode 100644
index 000000000000..a1a3890ddc20
--- /dev/null
+++ b/test/parallel/test-buffer-alloc-alignment.js
@@ -0,0 +1,158 @@
+// Flags: --expose-internals
+'use strict';
+require('../common');
+const assert = require('assert');
+const { Buffer, constants } = require('buffer');
+const { internalBinding } = require('internal/test/binding');
+const { arrayBufferAlignedOffset } = internalBinding('buffer');
+
+// Buffer.allocUnsafe(size, alignment) and Buffer.allocUnsafeSlow(size,
+// alignment) return a buffer whose memory starts at an address that is a
+// multiple of `alignment`.
+
+// Addresses are not observable from JS, so alignment cannot be checked against
+// `byteOffset` alone: the padding an allocation needs depends on where its
+// backing store happens to land. `arrayBufferAlignedOffset(ab, alignment)`
+// returns an offset into `ab` that is known to be aligned, so any other offset
+// is aligned exactly when it is congruent to that one.
+function assertAligned(buf, alignment) {
+  const aligned = arrayBufferAlignedOffset(buf.buffer, alignment);
+  // `aligned` is in [0, alignment), so adding `alignment` keeps this positive.
+  const skew = (buf.byteOffset - aligned + alignment) % alignment;
+  assert.strictEqual(skew, 0,
+                     `byteOffset ${buf.byteOffset} is not ${alignment} byte ` +
+                     `aligned (aligned offsets are ${aligned} mod ${alignment})`);
+}
+
+const alignments = [1, 2, 4, 8, 16, 64, 512, 4096, 65536];
+const sizes = [0, 1, 7, 64, 65, 512, 4096, 100000];
+
+for (const alloc of [Buffer.allocUnsafe, Buffer.allocUnsafeSlow]) {
+  for (const alignment of alignments) {
+    for (const size of sizes) {
+      const buf = alloc(size, alignment);
+      assert.strictEqual(buf.length, size);
+      if (size > 0) {
+        assertAligned(buf, alignment);
+      }
+      // The view must fit inside the (over-allocated) ArrayBuffer.
+      assert.ok(buf.byteOffset + size <= buf.buffer.byteLength);
+      // The whole buffer must be writable through the aligned view.
+      buf.fill(0x61);
+      if (size > 0) {
+        assert.strictEqual(buf[0], 0x61);
+        assert.strictEqual(buf[size - 1], 0x61);
+      }
+    }
+  }
+
+  // A zero length buffer is returned for size 0, whatever the alignment.
+  assert.strictEqual(alloc(0, 4096).length, 0);
+
+  // An aligned buffer is a normal Buffer.
+  {
+    const buf = alloc(32, 4096);
+    assert.ok(Buffer.isBuffer(buf));
+    buf.write('hello');
+    assert.strictEqual(buf.toString('latin1', 0, 5), 'hello');
+    assert.strictEqual(buf.subarray(1, 3).length, 2);
+  }
+
+  // Consecutive allocations do not overlap.
+  {
+    const a = alloc(64, 64).fill(0x01);
+    const b = alloc(64, 64).fill(0x02);
+    assert.strictEqual(a[0], 0x01);
+    assert.strictEqual(a[63], 0x01);
+    assert.strictEqual(b[0], 0x02);
+    assert.strictEqual(b[63], 0x02);
+  }
+
+  // Invalid alignments.
+  for (const alignment of [0, -1, -4096, 3, 5, 100, 1000, 2 ** 30 + 1]) {
+    assert.throws(() => alloc(10, alignment), {
+      name: /^(RangeError|TypeError)$/,
+    });
+  }
+
+  for (const alignment of [1.5, NaN, Infinity]) {
+    assert.throws(() => alloc(10, alignment), { code: 'ERR_OUT_OF_RANGE' });
+  }
+
+  for (const alignment of [null, '64', 64n, {}, [], true]) {
+    assert.throws(() => alloc(10, alignment), {
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+
+  // Alignments that are not a power of two report the reason.
+  assert.throws(() => alloc(10, 3), {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: /must be a power of two/,
+  });
+
+  // `size` plus the padding must still fit within the maximum buffer length.
+  assert.throws(() => alloc(constants.MAX_LENGTH, 4096), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+
+  // `size` itself is validated before `alignment`.
+  assert.throws(() => alloc(-1, 64), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => alloc(constants.MAX_LENGTH + 1, 64), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+}
+
+// Omitting the alignment keeps the previous behaviour.
+{
+  const buf = Buffer.allocUnsafeSlow(100);
+  assert.strictEqual(buf.length, 100);
+  assert.strictEqual(buf.byteOffset, 0);
+  assert.strictEqual(buf.buffer.byteLength, 100);
+}
+
+// Buffer.allocUnsafeSlow() is never pooled, even when aligned.
+{
+  const a = Buffer.allocUnsafeSlow(64, 64);
+  const b = Buffer.allocUnsafeSlow(64, 64);
+  assert.notStrictEqual(a.buffer, b.buffer);
+}
+
+// Buffer.allocUnsafe() serves alignments up to the pool alignment from the pool,
+// and allocates on its own beyond that.
+{
+  const bufs = [];
+  for (let i = 0; i < 8; i++) {
+    bufs.push(Buffer.allocUnsafe(64, 64));
+  }
+  // Pooled, so consecutive allocations share an ArrayBuffer. A pool may be
+  // exhausted in between, hence checking that any two neighbours share one.
+  assert.ok(bufs.some((buf, i) => i > 0 && buf.buffer === bufs[i - 1].buffer));
+  for (const buf of bufs) {
+    assertAligned(buf, 64);
+  }
+
+  // Stricter than the pool alignment, so this gets its own ArrayBuffer.
+  const own = Buffer.allocUnsafe(64, 128);
+  assert.ok(bufs.every((buf) => buf.buffer !== own.buffer));
+}
+
+// Aligned pooled allocations do not disturb unaligned ones. Interleave the two
+// and make sure every buffer keeps its own contents.
+{
+  const bufs = [];
+  for (let i = 0; i < 256; i++) {
+    const buf = i % 2 === 0 ?
+      Buffer.allocUnsafe(24) :
+      Buffer.allocUnsafe(24, 16);
+    if (i % 2 === 1) {
+      assertAligned(buf, 16);
+    }
+    buf.fill(i % 256);
+    bufs.push(buf);
+  }
+  for (let i = 0; i < bufs.length; i++) {
+    assert.strictEqual(bufs[i][0], i % 256);
+    assert.strictEqual(bufs[i][23], i % 256);
+  }
+}

From e9327d1422beed5a5d98b769631cc8602d22841c Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Thu, 6 Aug 2026 16:13:04 +0500
Subject: [PATCH 040/344] dns: fix crash on setServers with port 0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65009
Fixes: https://github.com/nodejs/node/issues/65006
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 src/cares_wrap.cc         | 8 ++++----
 test/parallel/test-dns.js | 4 ++++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/cares_wrap.cc b/src/cares_wrap.cc
index 7b7faa4be594..7d9323c83ee6 100644
--- a/src/cares_wrap.cc
+++ b/src/cares_wrap.cc
@@ -2159,13 +2159,13 @@ void SetServers(const FunctionCallbackInfo<Value>& args) {
     if (!elm->Get(env->context(), 1).ToLocal(&ipValue)) return;
     if (!elm->Get(env->context(), 2).ToLocal(&portValue)) return;
 
-    CHECK(familyValue->Int32Value(env->context()).FromJust());
+    CHECK(familyValue->IsInt32());
     CHECK(ipValue->IsString());
-    CHECK(portValue->Int32Value(env->context()).FromJust());
+    CHECK(portValue->IsInt32());
 
-    int fam = familyValue->Int32Value(env->context()).FromJust();
+    int32_t fam = familyValue.As<Int32>()->Value();
     node::Utf8Value ip(env->isolate(), ipValue);
-    int port = portValue->Int32Value(env->context()).FromJust();
+    int32_t port = portValue.As<Int32>()->Value();
 
     ares_addr_port_node* cur = &servers[i];
 
diff --git a/test/parallel/test-dns.js b/test/parallel/test-dns.js
index d7c2efcbd16e..d6056d459a1b 100644
--- a/test/parallel/test-dns.js
+++ b/test/parallel/test-dns.js
@@ -136,6 +136,10 @@ const portsExpected = [
 dns.setServers(ports);
 assert.deepStrictEqual(dns.getServers(), portsExpected);
 
+// Port 0 means "use the default port" for c-ares.
+dns.setServers(['4.4.4.4:0', '[2001:4860:4860::8888]:0']);
+assert.deepStrictEqual(dns.getServers(), ['4.4.4.4', '2001:4860:4860::8888']);
+
 dns.setServers([]);
 assert.deepStrictEqual(dns.getServers(), []);
 

From 3d7d2774937c43e61ac40483972ee47d66ea39cf Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 2 Aug 2026 20:55:44 -0700
Subject: [PATCH 041/344] net: improve performance of net.BlockList

* fix duplicate address insertion in SocketAddressBlockList
* fix BlockList rule listing order to match apply
* add minor bound check in BlockList
* improve performance of BlockList apply
* eliminating shared_ptr
* check fast api path
* add clear method to BlockList
* general storage improvements to BlockList
* use shared locks for BlockList reads
* add bulk address adding to BlockList
* add BlockList benchmark
* add remove range/subnet to BlockList
* add cidr notation parsing to BlockList
* add additional apis to BlockList
* add private subnet presets to BlockList

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: OpenCode/Opus
PR-URL: https://github.com/nodejs/node/pull/64974
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
---
 benchmark/net/net-blocklist.js           | 146 ++++++
 doc/api/net.md                           | 188 +++++++-
 lib/internal/blocklist.js                | 211 ++++++++-
 src/node_sockaddr.cc                     | 497 +++++++++++++++++---
 src/node_sockaddr.h                      | 120 +++--
 test/cctest/test_sockaddr.cc             | 412 +++++++++++++++-
 test/parallel/test-blocklist-fast-api.js |  42 ++
 test/parallel/test-blocklist.js          | 572 ++++++++++++++++++++++-
 8 files changed, 2061 insertions(+), 127 deletions(-)
 create mode 100644 benchmark/net/net-blocklist.js
 create mode 100644 test/parallel/test-blocklist-fast-api.js

diff --git a/benchmark/net/net-blocklist.js b/benchmark/net/net-blocklist.js
new file mode 100644
index 000000000000..9c293682ff61
--- /dev/null
+++ b/benchmark/net/net-blocklist.js
@@ -0,0 +1,146 @@
+'use strict';
+
+const common = require('../common.js');
+const { BlockList, SocketAddress } = require('net');
+
+const hasAddAddresses = typeof BlockList.prototype.addAddresses === 'function';
+
+const operations = ['check', 'checkWithSocketAddress', 'addAddress'];
+if (hasAddAddresses) {
+  operations.push('addAddresses');
+}
+
+const bench = common.createBenchmark(main, {
+  n: [1e6],
+  ruleCount: [10, 100, 1000, 10000],
+  ruleType: ['address', 'subnet', 'mixed'],
+  checkResult: ['hit', 'miss'],
+  operation: operations,
+}, {
+  combinationFilter({ operation, ruleCount, ruleType }) {
+    // addAddress and addAddresses only need address rules, not subnets.
+    if ((operation === 'addAddress' || operation === 'addAddresses') &&
+        ruleType !== 'address') {
+      return false;
+    }
+    return true;
+  },
+});
+
+function generateIPv4(index) {
+  return `${(index >>> 24) & 0xff}.${(index >>> 16) & 0xff}.` +
+         `${(index >>> 8) & 0xff}.${index & 0xff}`;
+}
+
+function buildBlockList(ruleCount, ruleType) {
+  const blockList = new BlockList();
+
+  if (ruleType === 'address' || ruleType === 'mixed') {
+    const addressCount = ruleType === 'mixed' ?
+      Math.floor(ruleCount / 2) : ruleCount;
+    const addresses = [];
+    for (let i = 0; i < addressCount; i++) {
+      // Start from 10.0.0.1 to avoid 0.0.0.0
+      addresses.push(generateIPv4(0x0a000001 + i));
+    }
+    if (hasAddAddresses) {
+      blockList.addAddresses(addresses);
+    } else {
+      for (const addr of addresses) {
+        blockList.addAddress(addr);
+      }
+    }
+  }
+
+  if (ruleType === 'subnet' || ruleType === 'mixed') {
+    const subnetCount = ruleType === 'mixed' ?
+      Math.floor(ruleCount / 2) : ruleCount;
+    for (let i = 0; i < subnetCount; i++) {
+      // Use distinct /24 subnets: 172.i.j.0/24
+      const second = (i >>> 8) & 0xff;
+      const third = i & 0xff;
+      blockList.addSubnet(`172.${second}.${third}.0`, 24);
+    }
+  }
+
+  return blockList;
+}
+
+function main({ n, ruleCount, ruleType, checkResult, operation }) {
+  if (operation === 'check') {
+    benchCheck(n, ruleCount, ruleType, checkResult);
+  } else if (operation === 'checkWithSocketAddress') {
+    benchCheckWithSocketAddress(n, ruleCount, ruleType, checkResult);
+  } else if (operation === 'addAddress') {
+    benchAddAddress(n, ruleCount);
+  } else if (operation === 'addAddresses') {
+    benchAddAddresses(n, ruleCount);
+  }
+}
+
+// Benchmark check() with string addresses (the common JS API path).
+function benchCheck(n, ruleCount, ruleType, checkResult) {
+  const blockList = buildBlockList(ruleCount, ruleType);
+
+  // For 'hit', use an address that's in the list.
+  // For 'miss', use an address that's not in the list.
+  const address = checkResult === 'hit' ? '10.0.0.1' : '192.168.255.255';
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    blockList.check(address);
+  }
+  bench.end(n);
+}
+
+// Benchmark check() with pre-created SocketAddress objects
+// (avoids measuring SocketAddress construction overhead).
+function benchCheckWithSocketAddress(n, ruleCount, ruleType, checkResult) {
+  const blockList = buildBlockList(ruleCount, ruleType);
+
+  const address = checkResult === 'hit' ? '10.0.0.1' : '192.168.255.255';
+  const sa = new SocketAddress({ address });
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    blockList.check(sa);
+  }
+  bench.end(n);
+}
+
+// Benchmark single addAddress() calls (one lock acquire per call).
+function benchAddAddress(n, ruleCount) {
+  // Scale n down for large rule counts to keep runtime reasonable.
+  const iterations = Math.min(n, ruleCount * 100);
+
+  const addresses = [];
+  for (let i = 0; i < ruleCount; i++) {
+    addresses.push(generateIPv4(0x0a000001 + i));
+  }
+
+  bench.start();
+  for (let i = 0; i < iterations; i++) {
+    const blockList = new BlockList();
+    for (let j = 0; j < addresses.length; j++) {
+      blockList.addAddress(addresses[j]);
+    }
+  }
+  bench.end(iterations);
+}
+
+// Benchmark batch addAddresses() (one lock acquire per batch).
+function benchAddAddresses(n, ruleCount) {
+  const iterations = Math.min(n, ruleCount * 100);
+
+  const addresses = [];
+  for (let i = 0; i < ruleCount; i++) {
+    addresses.push(generateIPv4(0x0a000001 + i));
+  }
+
+  bench.start();
+  for (let i = 0; i < iterations; i++) {
+    const blockList = new BlockList();
+    blockList.addAddresses(addresses);
+  }
+  bench.end(iterations);
+}
diff --git a/doc/api/net.md b/doc/api/net.md
index 5c893e6e2023..01277f22651a 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -96,6 +96,47 @@ added:
 
 Adds a rule to block the given IP address.
 
+### `blockList.addAddresses(addresses[, type])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `addresses` {string\[]|net.SocketAddress\[]} An array of IPv4 or IPv6
+  addresses.
+* `type` {string} Either `'ipv4'` or `'ipv6'`. **Default:** `'ipv4'`.
+
+Adds multiple address rules to the block list in a single operation.
+This is more efficient than calling `blockList.addAddress()` repeatedly
+when adding a large number of individual addresses, as the addresses
+are inserted under a single internal lock acquisition.
+
+### `blockList.addCIDR(cidr)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
+  `'10.0.0.0/8'` or `'2001:db8::/32'`).
+
+Adds a subnet rule using CIDR notation. The address family is automatically
+detected from the address (IPv6 if the address contains `':'`, IPv4
+otherwise). This is equivalent to calling `blockList.addSubnet()` with
+the parsed network address, prefix length, and family.
+
+### `blockList.addCIDRs(cidrs)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `cidrs` {string\[]} An array of IPv4 or IPv6 subnets in CIDR notation.
+
+Adds multiple subnet rules using CIDR notation in a single call. The address
+family for each entry is automatically detected. This is equivalent to
+calling `blockList.addCIDR()` for each element of the array.
+
 ### `blockList.addRange(start, end[, type])`
 
 <!-- YAML
@@ -158,28 +199,13 @@ console.log(blockList.check('::ffff:7b7b:7b7b', 'ipv6')); // Prints: true
 console.log(blockList.check('::ffff:123.123.123.123', 'ipv6')); // Prints: true
 ```
 
-### `blockList.rules`
+### `blockList.clear()`
 
-<!-- YAML
-added:
-  - v15.0.0
-  - v14.18.0
+<!--
+added: REPLACEME
 -->
 
-* Type: {string\[]}
-
-The list of rules added to the blocklist.
-
-### `BlockList.isBlockList(value)`
-
-<!-- YAML
-added:
-  - v23.4.0
-  - v22.13.0
--->
-
-* `value` {any} Any JS value
-* Returns `true` if the `value` is a `net.BlockList`.
+Clears all rules from the `BlockList`.
 
 ### `blockList.fromJSON(value)`
 
@@ -205,6 +231,130 @@ blockList.fromJSON(JSON.stringify(data));
 
 * `value` Blocklist.rules
 
+### `BlockList.isBlockList(value)`
+
+<!-- YAML
+added:
+  - v23.4.0
+  - v22.13.0
+-->
+
+* `value` {any} Any JS value
+* Returns `true` if the `value` is a `net.BlockList`.
+
+### `BlockList.PRIVATE_RANGES`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string\[]}
+
+A frozen array of CIDR strings representing private, loopback, and link-local
+IP address ranges. This can be passed to `blockList.addCIDRs()` to quickly
+populate a blocklist with all non-routable address ranges.
+
+The included ranges are:
+
+* `10.0.0.0/8` — RFC 1918 private IPv4
+* `172.16.0.0/12` — RFC 1918 private IPv4
+* `192.168.0.0/16` — RFC 1918 private IPv4
+* `127.0.0.0/8` — IPv4 loopback
+* `::1/128` — IPv6 loopback
+* `169.254.0.0/16` — IPv4 link-local
+* `fe80::/10` — IPv6 link-local
+* `fc00::/7` — IPv6 unique local (ULA)
+
+```js
+const blockList = new net.BlockList();
+blockList.addCIDRs(net.BlockList.PRIVATE_RANGES);
+
+console.log(blockList.check('10.0.0.1'));      // Prints: true
+console.log(blockList.check('127.0.0.1'));     // Prints: true
+console.log(blockList.check('8.8.8.8'));       // Prints: false
+```
+
+### `blockList.removeAddress(address[, type])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `address` {string|net.SocketAddress} An IPv4 or IPv6 address.
+* `type` {string} Either `'ipv4'` or `'ipv6'`. **Default:** `'ipv4'`.
+
+Removes a rule that was previously added with `blockList.addAddress()`. The
+address must match exactly the value used when the rule was added. If the
+specified address does not exist, this is a no-op.
+
+### `blockList.removeCIDR(cidr)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
+  `'10.0.0.0/8'` or `'2001:db8::/32'`).
+
+Removes a subnet rule using CIDR notation. The address family is automatically
+detected from the address. This is equivalent to calling
+`blockList.removeSubnet()` with the parsed network address, prefix length,
+and family. If the specified subnet does not exist, this is a no-op.
+
+### `blockList.removeRange(start, end[, type])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `start` {string|net.SocketAddress} The starting IPv4 or IPv6 address in the
+  range.
+* `end` {string|net.SocketAddress} The ending IPv4 or IPv6 address in the range.
+* `type` {string} Either `'ipv4'` or `'ipv6'`. **Default:** `'ipv4'`.
+
+Removes a rule that was previously added with `blockList.addRange()`. The `start`
+and `end` addresses must match exactly the values used when the rule was added.
+If the specified range does not exist, this is a no-op.
+
+### `blockList.removeSubnet(net, prefix[, type])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `net` {string|net.SocketAddress} The network IPv4 or IPv6 address.
+* `prefix` {number} The number of CIDR prefix bits. For IPv4, this
+  must be a value between `0` and `32`. For IPv6, this must be between
+  `0` and `128`.
+* `type` {string} Either `'ipv4'` or `'ipv6'`. **Default:** `'ipv4'`.
+
+Removes a rule that was previously added with `blockList.addSubnet()`. The
+network address and prefix must match exactly the values used when the rule was
+added. If the specified subnet does not exist, this is a no-op.
+
+### `blockList.rules`
+
+<!-- YAML
+added:
+  - v15.0.0
+  - v14.18.0
+-->
+
+* Type: {string\[]}
+
+The list of rules added to the blocklist.
+
+### `blockList.size`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The number of rules in the blocklist. This is equivalent to
+`blockList.rules.length` but does not allocate the rules array.
+
 ### `blockList.toJSON()`
 
 > Stability: 1.2 - Release candidate
diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js
index fd0e7667377b..f290c7ada405 100644
--- a/lib/internal/blocklist.js
+++ b/lib/internal/blocklist.js
@@ -4,13 +4,21 @@ const {
   ArrayIsArray,
   Boolean,
   JSONParse,
+  NumberIsNaN,
   NumberParseInt,
+  ObjectFreeze,
   ObjectSetPrototypeOf,
+  StringPrototypeIncludes,
+  StringPrototypeLastIndexOf,
+  StringPrototypeSlice,
+  StringPrototypeToLowerCase,
   Symbol,
 } = primordials;
 
 const {
   BlockList: BlockListHandle,
+  AF_INET,
+  AF_INET6,
 } = internalBinding('block_list');
 
 const {
@@ -40,6 +48,22 @@ const {
 
 const { validateInt32, validateString } = require('internal/validators');
 
+function parseCIDR(cidr) {
+  validateString(cidr, 'cidr');
+  const slash = StringPrototypeLastIndexOf(cidr, '/');
+  if (slash === -1) {
+    throw new ERR_INVALID_ARG_VALUE('cidr', cidr, 'must contain a prefix length (e.g. "10.0.0.0/8")');
+  }
+  const address = StringPrototypeSlice(cidr, 0, slash);
+  const prefixStr = StringPrototypeSlice(cidr, slash + 1);
+  const prefix = NumberParseInt(prefixStr, 10);
+  if (NumberIsNaN(prefix) || `${prefix}` !== prefixStr) {
+    throw new ERR_INVALID_ARG_VALUE('cidr', cidr, 'prefix length must be a valid integer');
+  }
+  const family = StringPrototypeIncludes(address, ':') ? 'ipv6' : 'ipv4';
+  return { address, prefix, family };
+}
+
 class BlockList {
   constructor() {
     markTransferMode(this, true, false);
@@ -56,6 +80,21 @@ class BlockList {
     return value?.[kHandle] !== undefined;
   }
 
+  static PRIVATE_RANGES = ObjectFreeze([
+    // RFC 1918 - Private IPv4
+    '10.0.0.0/8',
+    '172.16.0.0/12',
+    '192.168.0.0/16',
+    // Loopback
+    '127.0.0.0/8',
+    '::1/128',
+    // Link-local
+    '169.254.0.0/16',
+    'fe80::/10',
+    // Unique local (ULA)
+    'fc00::/7',
+  ]);
+
   [kInspect](depth, options) {
     if (depth < 0)
       return this;
@@ -70,6 +109,10 @@ class BlockList {
     }, opts)}`;
   }
 
+  /**
+   * @param {string|SocketAddress} address
+   * @param {string} [family]
+   */
   addAddress(address, family = 'ipv4') {
     if (!SocketAddress.isSocketAddress(address)) {
       validateString(address, 'address');
@@ -82,6 +125,33 @@ class BlockList {
     this[kHandle].addAddress(address[kSocketAddressHandle]);
   }
 
+  /**
+   *
+   * @param {(string|SocketAddress)[]} addresses
+   * @param {string} [family]
+   */
+  addAddresses(addresses, family = 'ipv4') {
+    if (!ArrayIsArray(addresses)) {
+      throw new ERR_INVALID_ARG_TYPE('addresses', 'Array', addresses);
+    }
+    validateString(family, 'family');
+    const handles = [];
+    for (let i = 0; i < addresses.length; i++) {
+      let address = addresses[i];
+      if (!SocketAddress.isSocketAddress(address)) {
+        validateString(address, `addresses[${i}]`);
+        address = new SocketAddress({ address, family });
+      }
+      handles.push(address[kSocketAddressHandle]);
+    }
+    this[kHandle].addAddresses(handles);
+  }
+
+  /**
+   * @param {string|SocketAddress} start
+   * @param {string|SocketAddress} end
+   * @param {string} [family]
+   */
   addRange(start, end, family = 'ipv4') {
     if (!SocketAddress.isSocketAddress(start)) {
       validateString(start, 'start');
@@ -106,6 +176,11 @@ class BlockList {
       throw new ERR_INVALID_ARG_VALUE('start', start, 'must come before end');
   }
 
+  /**
+   * @param {string|SocketAddress} network
+   * @param {number} prefix
+   * @param {string} [family]
+   */
   addSubnet(network, prefix, family = 'ipv4') {
     if (!SocketAddress.isSocketAddress(network)) {
       validateString(network, 'network');
@@ -128,23 +203,136 @@ class BlockList {
     this[kHandle].addSubnet(network[kSocketAddressHandle], prefix);
   }
 
+  /**
+   * @param {string} cidr
+   */
+  addCIDR(cidr) {
+    const { address, prefix, family } = parseCIDR(cidr);
+    this.addSubnet(address, prefix, family);
+  }
+
+  /**
+   * @param {string[]} cidrs
+   */
+  addCIDRs(cidrs) {
+    if (!ArrayIsArray(cidrs)) {
+      throw new ERR_INVALID_ARG_TYPE('cidrs', 'Array', cidrs);
+    }
+    // Validate and parse all entries first so that an exception mid-array
+    // does not leave the blocklist half-modified.
+    const parsed = [];
+    for (let i = 0; i < cidrs.length; i++) {
+      validateString(cidrs[i], `cidrs[${i}]`);
+      parsed.push(parseCIDR(cidrs[i]));
+    }
+    for (let i = 0; i < parsed.length; i++) {
+      const { address, prefix, family } = parsed[i];
+      this.addSubnet(address, prefix, family);
+    }
+  }
+
+  /**
+   * @param {string|SocketAddress} address
+   * @param {string} [family]
+   */
+  removeAddress(address, family = 'ipv4') {
+    if (!SocketAddress.isSocketAddress(address)) {
+      validateString(address, 'address');
+      validateString(family, 'family');
+      address = new SocketAddress({
+        address,
+        family,
+      });
+    }
+    this[kHandle].removeAddress(address[kSocketAddressHandle]);
+  }
+
+  /**
+   * @param {string|SocketAddress} start
+   * @param {string|SocketAddress} end
+   * @param {string} [family]
+   */
+  removeRange(start, end, family = 'ipv4') {
+    if (!SocketAddress.isSocketAddress(start)) {
+      validateString(start, 'start');
+      validateString(family, 'family');
+      start = new SocketAddress({
+        address: start,
+        family,
+      });
+    }
+    if (!SocketAddress.isSocketAddress(end)) {
+      validateString(end, 'end');
+      validateString(family, 'family');
+      end = new SocketAddress({
+        address: end,
+        family,
+      });
+    }
+    this[kHandle].removeRange(
+      start[kSocketAddressHandle],
+      end[kSocketAddressHandle]);
+  }
+
+  /**
+   * @param {string|SocketAddress} network
+   * @param {number} prefix
+   * @param {string} [family]
+   */
+  removeSubnet(network, prefix, family = 'ipv4') {
+    if (!SocketAddress.isSocketAddress(network)) {
+      validateString(network, 'network');
+      validateString(family, 'family');
+      network = new SocketAddress({
+        address: network,
+        family,
+      });
+    }
+    switch (network.family) {
+      case 'ipv4':
+        validateInt32(prefix, 'prefix', 0, 32);
+        break;
+      case 'ipv6':
+        validateInt32(prefix, 'prefix', 0, 128);
+        break;
+    }
+    prefix += 0;
+    this[kHandle].removeSubnet(network[kSocketAddressHandle], prefix);
+  }
+
+  /**
+   * @param {string} cidr
+   */
+  removeCIDR(cidr) {
+    const { address, prefix, family } = parseCIDR(cidr);
+    this.removeSubnet(address, prefix, family);
+  }
+
+  /**
+   * @param {string|SocketAddress} address
+   * @param {string} [family]
+   * @returns {boolean}
+   */
   check(address, family = 'ipv4') {
     if (!SocketAddress.isSocketAddress(address)) {
       validateString(address, 'address');
       validateString(family, 'family');
-      try {
-        address = new SocketAddress({
-          address,
-          family,
-        });
-      } catch {
-        // Ignore the error. If it's not a valid address, return false.
-        return false;
-      }
+      // Fast path: pass the string directly to C++ which does
+      // inet_pton + Apply() without allocating a JS SocketAddress wrapper.
+      const af = StringPrototypeToLowerCase(family) === 'ipv4' ?
+        AF_INET : AF_INET6;
+      return this[kHandle].checkString(address, af);
     }
     return Boolean(this[kHandle].check(address[kSocketAddressHandle]));
   }
 
+  /**
+   * Removes all rules from the block list.
+   */
+  clear() {
+    this[kHandle].clear();
+  }
+
   /*
   * @param {string[]} data
   * @example
@@ -269,6 +457,11 @@ class BlockList {
   get rules() {
     return this[kHandle].getRules();
   }
+
+  get size() {
+    return this[kHandle].getSize();
+  }
+
   [kClone]() {
     const handle = this[kHandle];
     return {
diff --git a/src/node_sockaddr.cc b/src/node_sockaddr.cc
index 9348f0ac8e4d..e12fb86a3a95 100644
--- a/src/node_sockaddr.cc
+++ b/src/node_sockaddr.cc
@@ -3,6 +3,7 @@
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
 #include "nbytes.h"
+#include "node_debug.h"
 #include "node_errors.h"
 #include "node_hash.h"
 #include "node_sockaddr-inl.h"  // NOLINT(build/include_inline)
@@ -15,6 +16,7 @@
 namespace node {
 
 using v8::Array;
+using v8::CFunction;
 using v8::Context;
 using v8::FunctionCallbackInfo;
 using v8::FunctionTemplate;
@@ -399,106 +401,321 @@ SocketAddressBlockList::SocketAddressBlockList(
     std::shared_ptr<SocketAddressBlockList> parent)
     : parent_(parent) {}
 
-void SocketAddressBlockList::AddSocketAddress(
-    const std::shared_ptr<SocketAddress>& address) {
-  Mutex::ScopedLock lock(mutex_);
-  std::unique_ptr<Rule> rule = std::make_unique<SocketAddressRule>(address);
-  rules_.emplace_front(std::move(rule));
-  address_rules_[*address.get()] = rules_.begin();
+// --- SubnetTrie implementation ---
+
+namespace {
+inline int GetBit(const uint8_t* bytes, int bit_index) {
+  return (bytes[bit_index >> 3] >> (7 - (bit_index & 7))) & 1;
+}
+
+inline const uint8_t* GetAddressBytes(const SocketAddress& addr, int* bits) {
+  if (addr.family() == AF_INET) {
+    const auto* in = reinterpret_cast<const sockaddr_in*>(addr.data());
+    *bits = 32;
+    return reinterpret_cast<const uint8_t*>(&in->sin_addr);
+  }
+  const auto* in6 = reinterpret_cast<const sockaddr_in6*>(addr.data());
+  *bits = 128;
+  return reinterpret_cast<const uint8_t*>(&in6->sin6_addr);
+}
+}  // namespace
+
+void SocketAddressBlockList::SubnetTrie::Insert(const uint8_t* address_bytes,
+                                                int prefix_length) {
+  if (root_ == nullptr) {
+    root_ = std::make_unique<Node>();
+  }
+
+  Node* node = root_.get();
+  for (int i = 0; i < prefix_length; i++) {
+    if (node->terminal) {
+      // A broader prefix already covers this subnet. No-op.
+      return;
+    }
+    int bit = GetBit(address_bytes, i);
+    if (node->children[bit] == nullptr) {
+      node->children[bit] = std::make_unique<Node>();
+    }
+    node = node->children[bit].get();
+  }
+
+  if (!node->terminal) {
+    node->terminal = true;
+    count_++;
+    // Prune children — this prefix subsumes all longer prefixes below it.
+    node->children[0].reset();
+    node->children[1].reset();
+  }
 }
 
-void SocketAddressBlockList::RemoveSocketAddress(
-    const std::shared_ptr<SocketAddress>& address) {
-  Mutex::ScopedLock lock(mutex_);
-  auto it = address_rules_.find(*address.get());
-  if (it != std::end(address_rules_)) {
-    rules_.erase(it->second);
-    address_rules_.erase(it);
+bool SocketAddressBlockList::SubnetTrie::Lookup(const uint8_t* address_bytes,
+                                                int address_bits) const {
+  if (root_ == nullptr) return false;
+
+  const Node* node = root_.get();
+  // A terminal root means prefix /0 — matches everything.
+  if (node->terminal) return true;
+
+  for (int i = 0; i < address_bits; i++) {
+    int bit = GetBit(address_bytes, i);
+    node = node->children[bit].get();
+    if (node == nullptr) return false;
+    if (node->terminal) return true;
+  }
+  return false;
+}
+
+void SocketAddressBlockList::SubnetTrie::Clear() {
+  root_.reset();
+  count_ = 0;
+}
+
+void SocketAddressBlockList::AddSocketAddressImpl(
+    const SocketAddress& address) {
+  if (address_rules_.count(address) == 0) {
+    address_count_++;
+  }
+  address_rules_[address] = address;
+  // Insert the cross-family counterpart so that both IPv4 and
+  // IPv4-mapped IPv6 lookups resolve in O(1).
+  if (address.family() == AF_INET) {
+    // Map 1.2.3.4 -> ::ffff:1.2.3.4
+    std::string mapped = "::ffff:" + address.address();
+    SocketAddress ipv6;
+    if (SocketAddress::New(AF_INET6, mapped.c_str(), address.port(), &ipv6)) {
+      address_rules_[ipv6] = address;
+    }
+  } else if (address.family() == AF_INET6) {
+    // Check if this is an IPv4-mapped IPv6 address (::ffff:x.x.x.x)
+    // and insert the IPv4 counterpart if so.
+    const sockaddr_in6* in6 =
+        reinterpret_cast<const sockaddr_in6*>(address.data());
+    const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&in6->sin6_addr);
+    constexpr uint8_t ipv4_mapped_prefix[] = {
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    if (memcmp(bytes, ipv4_mapped_prefix, sizeof(ipv4_mapped_prefix)) == 0) {
+      sockaddr_in ipv4_addr{};
+      ipv4_addr.sin_family = AF_INET;
+      ipv4_addr.sin_port = in6->sin6_port;
+      memcpy(&ipv4_addr.sin_addr, bytes + sizeof(ipv4_mapped_prefix), 4);
+      SocketAddress ipv4(reinterpret_cast<const sockaddr*>(&ipv4_addr));
+      address_rules_[ipv4] = address;
+    }
+  }
+}
+
+void SocketAddressBlockList::AddSocketAddress(const SocketAddress& address) {
+  RwLock::ScopedLock lock(mutex_);
+  AddSocketAddressImpl(address);
+}
+
+void SocketAddressBlockList::AddSocketAddresses(const SocketAddress* addresses,
+                                                size_t count) {
+  RwLock::ScopedLock lock(mutex_);
+  for (size_t i = 0; i < count; i++) {
+    AddSocketAddressImpl(addresses[i]);
+  }
+}
+
+void SocketAddressBlockList::RemoveSocketAddress(const SocketAddress& address) {
+  RwLock::ScopedLock lock(mutex_);
+  if (address_rules_.erase(address)) {
+    address_count_--;
+  }
+  // Also remove the cross-family counterpart.
+  if (address.family() == AF_INET) {
+    std::string mapped = "::ffff:" + address.address();
+    SocketAddress ipv6;
+    if (SocketAddress::New(AF_INET6, mapped.c_str(), address.port(), &ipv6)) {
+      address_rules_.erase(ipv6);
+    }
+  } else if (address.family() == AF_INET6) {
+    const sockaddr_in6* in6 =
+        reinterpret_cast<const sockaddr_in6*>(address.data());
+    const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&in6->sin6_addr);
+    constexpr uint8_t ipv4_mapped_prefix[] = {
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    if (memcmp(bytes, ipv4_mapped_prefix, sizeof(ipv4_mapped_prefix)) == 0) {
+      sockaddr_in ipv4_addr{};
+      ipv4_addr.sin_family = AF_INET;
+      ipv4_addr.sin_port = in6->sin6_port;
+      memcpy(&ipv4_addr.sin_addr, bytes + sizeof(ipv4_mapped_prefix), 4);
+      SocketAddress ipv4(reinterpret_cast<const sockaddr*>(&ipv4_addr));
+      address_rules_.erase(ipv4);
+    }
   }
 }
 
-void SocketAddressBlockList::AddSocketAddressRange(
-    const std::shared_ptr<SocketAddress>& start,
-    const std::shared_ptr<SocketAddress>& end) {
-  Mutex::ScopedLock lock(mutex_);
+void SocketAddressBlockList::AddSocketAddressRange(const SocketAddress& start,
+                                                   const SocketAddress& end) {
+  DCHECK(!(start > end));
+  RwLock::ScopedLock lock(mutex_);
   std::unique_ptr<Rule> rule =
       std::make_unique<SocketAddressRangeRule>(start, end);
   rules_.emplace_front(std::move(rule));
 }
 
-void SocketAddressBlockList::AddSocketAddressMask(
-    const std::shared_ptr<SocketAddress>& network, int prefix) {
-  Mutex::ScopedLock lock(mutex_);
-  std::unique_ptr<Rule> rule =
-      std::make_unique<SocketAddressMaskRule>(network, prefix);
-  rules_.emplace_front(std::move(rule));
+void SocketAddressBlockList::AddSocketAddressMask(const SocketAddress& network,
+                                                  int prefix) {
+  RwLock::ScopedLock lock(mutex_);
+  int bits;
+  const uint8_t* bytes = GetAddressBytes(network, &bits);
+
+  if (network.family() == AF_INET) {
+    ipv4_subnets_.Insert(bytes, prefix);
+    // Also insert into IPv6 trie as ::ffff:x.x.x.x with prefix+96.
+    uint8_t mapped[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    memcpy(mapped + 12, bytes, 4);
+    ipv6_subnets_.Insert(mapped, prefix + 96);
+  } else {
+    ipv6_subnets_.Insert(bytes, prefix);
+    // Check if this is a ::ffff:x.x.x.x/N subnet — if so, also insert
+    // the IPv4 portion into the IPv4 trie.
+    constexpr uint8_t v4mapped[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    if (prefix >= 96 && memcmp(bytes, v4mapped, 12) == 0) {
+      ipv4_subnets_.Insert(bytes + 12, prefix - 96);
+    }
+  }
+
+  // Keep metadata for ListRules serialization.
+  subnet_rules_.emplace_front(
+      std::make_unique<SocketAddressMaskRule>(network, prefix));
+}
+
+void SocketAddressBlockList::RemoveSocketAddressRange(
+    const SocketAddress& start, const SocketAddress& end) {
+  RwLock::ScopedLock lock(mutex_);
+  // rules_ contains only SocketAddressRangeRule instances (subnet rules
+  // are stored separately in subnet_rules_).
+  for (auto it = rules_.begin(); it != rules_.end(); ++it) {
+    auto* range = static_cast<SocketAddressRangeRule*>(it->get());
+    if (range->start == start && range->end == end) {
+      rules_.erase(it);
+      return;
+    }
+  }
+}
+
+void SocketAddressBlockList::RemoveSocketAddressMask(
+    const SocketAddress& network, int prefix) {
+  RwLock::ScopedLock lock(mutex_);
+
+  // Remove from subnet_rules_ metadata list.
+  bool found = false;
+  for (auto it = subnet_rules_.begin(); it != subnet_rules_.end(); ++it) {
+    if ((*it)->network == network && (*it)->prefix == prefix) {
+      subnet_rules_.erase(it);
+      found = true;
+      break;
+    }
+  }
+  if (!found) return;
+
+  // Rebuild both tries from the remaining subnet_rules_. This handles the
+  // case where a broader prefix had subsumed narrower ones in the trie --
+  // simply removing the broader prefix from the trie would not restore the
+  // narrower entries that were pruned on insert. Rebuilding is O(n) in the
+  // number of subnet rules but removal is not a hot path.
+  ipv4_subnets_.Clear();
+  ipv6_subnets_.Clear();
+  for (const auto& rule : subnet_rules_) {
+    int bits;
+    const uint8_t* b = GetAddressBytes(rule->network, &bits);
+    if (rule->network.family() == AF_INET) {
+      ipv4_subnets_.Insert(b, rule->prefix);
+      uint8_t mapped[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+      memcpy(mapped + 12, b, 4);
+      ipv6_subnets_.Insert(mapped, rule->prefix + 96);
+    } else {
+      ipv6_subnets_.Insert(b, rule->prefix);
+      constexpr uint8_t v4mapped[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+      if (rule->prefix >= 96 && memcmp(b, v4mapped, 12) == 0) {
+        ipv4_subnets_.Insert(b + 12, rule->prefix - 96);
+      }
+    }
+  }
 }
 
 bool SocketAddressBlockList::Apply(const SocketAddress& address) {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
+  // O(1) lookup for exact address matches. The address_rules_ map
+  // uses IpHash/IpEqual (port-insensitive, family-sensitive).
+  if (address_rules_.count(address)) return true;
+
+  // O(prefix_length) lookup for subnet/mask rules via radix trie.
+  int bits;
+  const uint8_t* bytes = GetAddressBytes(address, &bits);
+  if (address.family() == AF_INET) {
+    if (ipv4_subnets_.Lookup(bytes, bits)) return true;
+    // Also check IPv6 trie for ::ffff:x.x.x.x subnets.
+    uint8_t mapped[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    memcpy(mapped + 12, bytes, 4);
+    if (ipv6_subnets_.Lookup(mapped, 128)) return true;
+  } else {
+    if (ipv6_subnets_.Lookup(bytes, bits)) return true;
+    // Check if this is ::ffff:x.x.x.x — also check IPv4 trie.
+    constexpr uint8_t v4mapped[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    if (memcmp(bytes, v4mapped, 12) == 0) {
+      if (ipv4_subnets_.Lookup(bytes + 12, 32)) return true;
+    }
+  }
+
+  // Linear scan for range rules only. Subnet rules are in the trie.
   for (const auto& rule : rules_) {
     if (rule->Apply(address)) return true;
   }
   return parent_ ? parent_->Apply(address) : false;
 }
 
-SocketAddressBlockList::SocketAddressRule::SocketAddressRule(
-    const std::shared_ptr<SocketAddress>& address_)
-    : address(address_) {}
+void SocketAddressBlockList::Clear() {
+  RwLock::ScopedLock lock(mutex_);
+  rules_.clear();
+  address_rules_.clear();
+  address_count_ = 0;
+  ipv4_subnets_.Clear();
+  ipv6_subnets_.Clear();
+  subnet_rules_.clear();
+}
 
 SocketAddressBlockList::SocketAddressRangeRule::SocketAddressRangeRule(
-    const std::shared_ptr<SocketAddress>& start_,
-    const std::shared_ptr<SocketAddress>& end_)
+    const SocketAddress& start_, const SocketAddress& end_)
     : start(start_), end(end_) {}
 
 SocketAddressBlockList::SocketAddressMaskRule::SocketAddressMaskRule(
-    const std::shared_ptr<SocketAddress>& network_, int prefix_)
+    const SocketAddress& network_, int prefix_)
     : network(network_), prefix(prefix_) {}
 
-bool SocketAddressBlockList::SocketAddressRule::Apply(
-    const SocketAddress& address) {
-  return this->address->is_match(address);
-}
-
-std::string SocketAddressBlockList::SocketAddressRule::ToString() {
-  std::string ret = "Address: ";
-  ret += address->family() == AF_INET ? "IPv4" : "IPv6";
-  ret += " ";
-  ret += address->address();
-  return ret;
-}
-
 bool SocketAddressBlockList::SocketAddressRangeRule::Apply(
     const SocketAddress& address) {
-  return address >= *start.get() && address <= *end.get();
+  return address >= start && address <= end;
 }
 
 std::string SocketAddressBlockList::SocketAddressRangeRule::ToString() {
   std::string ret = "Range: ";
-  ret += start->family() == AF_INET ? "IPv4" : "IPv6";
+  ret += start.family() == AF_INET ? "IPv4" : "IPv6";
   ret += " ";
-  ret += start->address();
+  ret += start.address();
   ret += "-";
-  ret += end->address();
+  ret += end.address();
   return ret;
 }
 
 bool SocketAddressBlockList::SocketAddressMaskRule::Apply(
     const SocketAddress& address) {
-  return address.is_in_network(*network.get(), prefix);
+  return address.is_in_network(network, prefix);
 }
 
 std::string SocketAddressBlockList::SocketAddressMaskRule::ToString() {
   std::string ret = "Subnet: ";
-  ret += network->family() == AF_INET ? "IPv4" : "IPv6";
+  ret += network.family() == AF_INET ? "IPv4" : "IPv6";
   ret += " ";
-  ret += network->address();
+  ret += network.address();
   ret += "/" + std::to_string(prefix);
   return ret;
 }
 
 MaybeLocal<Array> SocketAddressBlockList::ListRules(Environment* env) {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
   LocalVector<Value> rules(env->isolate());
   if (!ListRules(env, &rules)) return MaybeLocal<Array>();
   return Array::New(env->isolate(), rules.data(), rules.size());
@@ -506,22 +723,42 @@ MaybeLocal<Array> SocketAddressBlockList::ListRules(Environment* env) {
 
 bool SocketAddressBlockList::ListRules(Environment* env,
                                        LocalVector<Value>* rules) {
-  if (parent_ && !parent_->ListRules(env, rules)) return false;
+  // List local rules first, then parent rules, matching the
+  // evaluation order in Apply().
+  //
+  // address_rules_ may contain cross-family duplicates (e.g. both
+  // 1.1.1.1 and ::ffff:1.1.1.1 map to the same original address).
+  // Track which originals have been listed to avoid duplicates.
+  SocketAddress::Map<bool> seen;
+  for (const auto& [_, address] : address_rules_) {
+    if (seen.count(address)) continue;
+    seen[address] = true;
+    std::string str = "Address: ";
+    str += address.family() == AF_INET ? "IPv4" : "IPv6";
+    str += " ";
+    str += address.address();
+    Local<Value> v;
+    if (!ToV8Value(env->context(), str).ToLocal(&v)) return false;
+    rules->push_back(v);
+  }
+  for (const auto& rule : subnet_rules_) {
+    Local<Value> str;
+    if (!rule->ToV8String(env).ToLocal(&str)) return false;
+    rules->push_back(str);
+  }
   for (const auto& rule : rules_) {
     Local<Value> str;
     if (!rule->ToV8String(env).ToLocal(&str)) return false;
     rules->push_back(str);
   }
-  return true;
+  return !parent_ || parent_->ListRules(env, rules);
 }
 
 void SocketAddressBlockList::MemoryInfo(node::MemoryTracker* tracker) const {
   tracker->TrackField("rules", rules_);
-}
-
-void SocketAddressBlockList::SocketAddressRule::MemoryInfo(
-    node::MemoryTracker* tracker) const {
-  tracker->TrackField("address", address);
+  tracker->TrackFieldWithSize("address_rules",
+                              address_rules_.size() * sizeof(SocketAddress));
+  tracker->TrackField("subnet_rules", subnet_rules_);
 }
 
 void SocketAddressBlockList::SocketAddressRangeRule::MemoryInfo(
@@ -590,8 +827,34 @@ void SocketAddressBlockListWrap::AddAddress(
   SocketAddressBase* addr;
   ASSIGN_OR_RETURN_UNWRAP(&addr, args[0]);
 
-  wrap->blocklist_->AddSocketAddress(addr->address());
+  wrap->blocklist_->AddSocketAddress(*addr->address());
+
+  args.GetReturnValue().Set(true);
+}
+
+void SocketAddressBlockListWrap::AddAddresses(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  SocketAddressBlockListWrap* wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+
+  CHECK(args[0]->IsArray());
+  Local<Array> arr = args[0].As<Array>();
+  uint32_t len = arr->Length();
 
+  std::vector<SocketAddress> addresses;
+  addresses.reserve(len);
+
+  for (uint32_t i = 0; i < len; i++) {
+    Local<Value> item;
+    if (!arr->Get(env->context(), i).ToLocal(&item)) return;
+    CHECK(SocketAddressBase::HasInstance(env, item));
+    SocketAddressBase* addr;
+    ASSIGN_OR_RETURN_UNWRAP(&addr, item.As<Object>());
+    addresses.push_back(*addr->address());
+  }
+
+  wrap->blocklist_->AddSocketAddresses(addresses.data(), addresses.size());
   args.GetReturnValue().Set(true);
 }
 
@@ -610,11 +873,11 @@ void SocketAddressBlockListWrap::AddRange(
   ASSIGN_OR_RETURN_UNWRAP(&end_addr, args[1]);
 
   // Starting address must come before the end address
-  if (*start_addr->address().get() > *end_addr->address().get())
+  if (*start_addr->address() > *end_addr->address())
     return args.GetReturnValue().Set(false);
 
-  wrap->blocklist_->AddSocketAddressRange(start_addr->address(),
-                                          end_addr->address());
+  wrap->blocklist_->AddSocketAddressRange(*start_addr->address(),
+                                          *end_addr->address());
 
   args.GetReturnValue().Set(true);
 }
@@ -640,11 +903,62 @@ void SocketAddressBlockListWrap::AddSubnet(
   CHECK_IMPLIES(addr->address()->family() == AF_INET6, prefix <= 128);
   CHECK_GE(prefix, 0);
 
-  wrap->blocklist_->AddSocketAddressMask(addr->address(), prefix);
+  wrap->blocklist_->AddSocketAddressMask(*addr->address(), prefix);
 
   args.GetReturnValue().Set(true);
 }
 
+void SocketAddressBlockListWrap::RemoveAddress(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  SocketAddressBlockListWrap* wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+
+  CHECK(SocketAddressBase::HasInstance(env, args[0]));
+  SocketAddressBase* addr;
+  ASSIGN_OR_RETURN_UNWRAP(&addr, args[0]);
+
+  wrap->blocklist_->RemoveSocketAddress(*addr->address());
+}
+
+void SocketAddressBlockListWrap::RemoveRange(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  SocketAddressBlockListWrap* wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+
+  CHECK(SocketAddressBase::HasInstance(env, args[0]));
+  CHECK(SocketAddressBase::HasInstance(env, args[1]));
+
+  SocketAddressBase* start_addr;
+  SocketAddressBase* end_addr;
+  ASSIGN_OR_RETURN_UNWRAP(&start_addr, args[0]);
+  ASSIGN_OR_RETURN_UNWRAP(&end_addr, args[1]);
+
+  wrap->blocklist_->RemoveSocketAddressRange(*start_addr->address(),
+                                             *end_addr->address());
+}
+
+void SocketAddressBlockListWrap::RemoveSubnet(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  SocketAddressBlockListWrap* wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+
+  CHECK(SocketAddressBase::HasInstance(env, args[0]));
+  CHECK(args[1]->IsInt32());
+
+  SocketAddressBase* addr;
+  ASSIGN_OR_RETURN_UNWRAP(&addr, args[0]);
+
+  int32_t prefix;
+  if (!args[1]->Int32Value(env->context()).To(&prefix)) {
+    return;
+  }
+
+  wrap->blocklist_->RemoveSocketAddressMask(*addr->address(), prefix);
+}
+
 void SocketAddressBlockListWrap::Check(
     const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
@@ -658,6 +972,39 @@ void SocketAddressBlockListWrap::Check(
   args.GetReturnValue().Set(wrap->blocklist_->Apply(*addr->address()));
 }
 
+bool SocketAddressBlockListWrap::FastCheck(Local<Object> receiver,
+                                           Local<Object> addr_obj) {
+  TRACK_V8_FAST_API_CALL("blocklist.check");
+  SocketAddressBlockListWrap* wrap =
+      FromJSObject<SocketAddressBlockListWrap>(receiver);
+  SocketAddressBase* addr = FromJSObject<SocketAddressBase>(addr_obj);
+  return wrap->blocklist_->Apply(*addr->address());
+}
+
+CFunction SocketAddressBlockListWrap::fast_check_(
+    CFunction::Make(&SocketAddressBlockListWrap::FastCheck));
+
+void SocketAddressBlockListWrap::CheckString(
+    const FunctionCallbackInfo<Value>& args) {
+  SocketAddressBlockListWrap* wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+
+  CHECK(args[0]->IsString());
+  CHECK(args[1]->IsInt32());
+
+  Utf8Value address(args.GetIsolate(), args[0]);
+  int32_t family = args[1].As<Int32>()->Value();
+
+  SocketAddress addr;
+  if (!SocketAddress::New(family, *address, 0, &addr)) {
+    // Invalid address string — return false (not blocked).
+    args.GetReturnValue().Set(false);
+    return;
+  }
+
+  args.GetReturnValue().Set(wrap->blocklist_->Apply(addr));
+}
+
 void SocketAddressBlockListWrap::GetRules(
     const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
@@ -668,6 +1015,20 @@ void SocketAddressBlockListWrap::GetRules(
     args.GetReturnValue().Set(rules);
 }
 
+void SocketAddressBlockListWrap::GetSize(
+    const FunctionCallbackInfo<Value>& args) {
+  SocketAddressBlockListWrap* wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+  args.GetReturnValue().Set(static_cast<double>(wrap->blocklist_->size()));
+}
+
+void SocketAddressBlockListWrap::Clear(
+    const FunctionCallbackInfo<Value>& args) {
+  SocketAddressBlockListWrap* wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+  wrap->blocklist_->Clear();
+}
+
 void SocketAddressBlockListWrap::MemoryInfo(MemoryTracker* tracker) const {
   blocklist_->MemoryInfo(tracker);
 }
@@ -691,10 +1052,18 @@ Local<FunctionTemplate> SocketAddressBlockListWrap::GetConstructorTemplate(
     tmpl->SetClassName(FIXED_ONE_BYTE_STRING(env->isolate(), "BlockList"));
     tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);
     SetProtoMethod(isolate, tmpl, "addAddress", AddAddress);
+    SetProtoMethod(isolate, tmpl, "addAddresses", AddAddresses);
     SetProtoMethod(isolate, tmpl, "addRange", AddRange);
     SetProtoMethod(isolate, tmpl, "addSubnet", AddSubnet);
-    SetProtoMethod(isolate, tmpl, "check", Check);
+    SetProtoMethod(isolate, tmpl, "removeAddress", RemoveAddress);
+    SetProtoMethod(isolate, tmpl, "removeRange", RemoveRange);
+    SetProtoMethod(isolate, tmpl, "removeSubnet", RemoveSubnet);
+    SetFastMethod(
+        isolate, tmpl->PrototypeTemplate(), "check", Check, &fast_check_);
+    SetProtoMethod(isolate, tmpl, "checkString", CheckString);
     SetProtoMethod(isolate, tmpl, "getRules", GetRules);
+    SetProtoMethodNoSideEffect(isolate, tmpl, "getSize", GetSize);
+    SetProtoMethod(isolate, tmpl, "clear", Clear);
     env->set_blocklist_constructor_template(tmpl);
   }
   return tmpl;
diff --git a/src/node_sockaddr.h b/src/node_sockaddr.h
index 05bb127b012f..55354138fa84 100644
--- a/src/node_sockaddr.h
+++ b/src/node_sockaddr.h
@@ -248,19 +248,29 @@ class SocketAddressBlockList : public MemoryRetainer {
       std::shared_ptr<SocketAddressBlockList> parent = {});
   ~SocketAddressBlockList() = default;
 
-  void AddSocketAddress(const std::shared_ptr<SocketAddress>& address);
+  void AddSocketAddress(const SocketAddress& address);
 
-  void RemoveSocketAddress(const std::shared_ptr<SocketAddress>& address);
+  void AddSocketAddresses(const SocketAddress* addresses, size_t count);
 
-  void AddSocketAddressRange(const std::shared_ptr<SocketAddress>& start,
-                             const std::shared_ptr<SocketAddress>& end);
+  void RemoveSocketAddress(const SocketAddress& address);
 
-  void AddSocketAddressMask(const std::shared_ptr<SocketAddress>& address,
-                            int prefix);
+  void AddSocketAddressRange(const SocketAddress& start,
+                             const SocketAddress& end);
+
+  void RemoveSocketAddressRange(const SocketAddress& start,
+                                const SocketAddress& end);
+
+  void AddSocketAddressMask(const SocketAddress& address, int prefix);
+
+  void RemoveSocketAddressMask(const SocketAddress& address, int prefix);
 
   bool Apply(const SocketAddress& address);
 
-  size_t size() const { return rules_.size(); }
+  void Clear();
+
+  size_t size() const {
+    return address_count_ + rules_.size() + subnet_rules_.size();
+  }
 
   v8::MaybeLocal<v8::Array> ListRules(Environment* env);
 
@@ -270,25 +280,12 @@ class SocketAddressBlockList : public MemoryRetainer {
     virtual std::string ToString() = 0;
   };
 
-  struct SocketAddressRule final : Rule {
-    std::shared_ptr<SocketAddress> address;
-
-    explicit SocketAddressRule(const std::shared_ptr<SocketAddress>& address);
-
-    bool Apply(const SocketAddress& address) override;
-    std::string ToString() override;
-
-    void MemoryInfo(node::MemoryTracker* tracker) const override;
-    SET_MEMORY_INFO_NAME(SocketAddressRule)
-    SET_SELF_SIZE(SocketAddressRule)
-  };
-
   struct SocketAddressRangeRule final : Rule {
-    std::shared_ptr<SocketAddress> start;
-    std::shared_ptr<SocketAddress> end;
+    SocketAddress start;
+    SocketAddress end;
 
-    SocketAddressRangeRule(const std::shared_ptr<SocketAddress>& start,
-                           const std::shared_ptr<SocketAddress>& end);
+    SocketAddressRangeRule(const SocketAddress& start,
+                           const SocketAddress& end);
 
     bool Apply(const SocketAddress& address) override;
     std::string ToString() override;
@@ -299,11 +296,10 @@ class SocketAddressBlockList : public MemoryRetainer {
   };
 
   struct SocketAddressMaskRule final : Rule {
-    std::shared_ptr<SocketAddress> network;
+    SocketAddress network;
     int prefix;
 
-    SocketAddressMaskRule(const std::shared_ptr<SocketAddress>& address,
-                          int prefix);
+    SocketAddressMaskRule(const SocketAddress& address, int prefix);
 
     bool Apply(const SocketAddress& address) override;
     std::string ToString() override;
@@ -317,14 +313,68 @@ class SocketAddressBlockList : public MemoryRetainer {
   SET_MEMORY_INFO_NAME(SocketAddressBlockList)
   SET_SELF_SIZE(SocketAddressBlockList)
 
+  // A compressed radix trie for O(prefix_length) subnet lookups.
+  // Each node has two children (bit 0, bit 1). A node marked
+  // terminal means all addresses matching the prefix up to that
+  // depth are blocked. On insert, if a new prefix is shorter than
+  // or equal to an existing one, the subtree is pruned (the shorter
+  // prefix subsumes all longer ones). On lookup, we walk the bits
+  // of the address and return true as soon as we hit a terminal node.
+  class SubnetTrie {
+   public:
+    SubnetTrie() = default;
+    ~SubnetTrie() = default;
+
+    // Insert a subnet (network address bytes, prefix length in bits).
+    // If a broader prefix already exists, the insert is a no-op.
+    // If this prefix is broader than existing children, they are pruned.
+    void Insert(const uint8_t* address_bytes, int prefix_length);
+
+    // Returns true if the given address falls within any inserted subnet.
+    bool Lookup(const uint8_t* address_bytes, int address_bits) const;
+
+    // Remove all entries.
+    void Clear();
+
+    bool empty() const { return root_ == nullptr; }
+
+    size_t size() const { return count_; }
+
+   private:
+    struct Node {
+      std::unique_ptr<Node> children[2];
+      bool terminal = false;
+    };
+
+    std::unique_ptr<Node> root_;
+    size_t count_ = 0;
+  };
+
  private:
+  // Lock-free implementation used by both AddSocketAddress and
+  // AddSocketAddresses. Caller must hold the write lock.
+  void AddSocketAddressImpl(const SocketAddress& address);
   bool ListRules(Environment* env, v8::LocalVector<v8::Value>* vec);
 
   std::shared_ptr<SocketAddressBlockList> parent_;
+  // Range rules only. Scanned linearly by Apply().
   std::list<std::unique_ptr<Rule>> rules_;
-  SocketAddress::Map<std::list<std::unique_ptr<Rule>>::iterator> address_rules_;
-
-  Mutex mutex_;
+  // Exact address rules. Keyed by IP only (port-insensitive) so that
+  // Apply() can perform O(1) lookups regardless of the port on the
+  // checked address. Not included in rules_ to avoid redundant scanning.
+  SocketAddress::IpMap<SocketAddress> address_rules_;
+  // User-visible address count (not inflated by cross-family dual-insert).
+  size_t address_count_ = 0;
+  // Subnet/mask rules stored in radix tries for O(prefix_length) lookup.
+  // Separate tries for IPv4 (max 32-bit depth) and IPv6 (max 128-bit).
+  SubnetTrie ipv4_subnets_;
+  SubnetTrie ipv6_subnets_;
+  // Subnet metadata kept for ListRules serialization only.
+  std::list<std::unique_ptr<SocketAddressMaskRule>> subnet_rules_;
+
+  // RwLock allows concurrent Apply() calls (shared/read lock) while
+  // mutations (Add*/Remove*/Clear) take an exclusive/write lock.
+  mutable RwLock mutex_;
 };
 
 class SocketAddressBlockListWrap : public BaseObject {
@@ -343,10 +393,19 @@ class SocketAddressBlockListWrap : public BaseObject {
 
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void AddAddress(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AddAddresses(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void AddRange(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void AddSubnet(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void RemoveAddress(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void RemoveRange(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void RemoveSubnet(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Check(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static bool FastCheck(v8::Local<v8::Object> receiver,
+                        v8::Local<v8::Object> addr_obj);
+  static void CheckString(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetRules(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetSize(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Clear(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   SocketAddressBlockListWrap(Environment* env,
                              v8::Local<v8::Object> wrap,
@@ -390,6 +449,7 @@ class SocketAddressBlockListWrap : public BaseObject {
 
  private:
   std::shared_ptr<SocketAddressBlockList> blocklist_;
+  static v8::CFunction fast_check_;
 };
 
 }  // namespace node
diff --git a/test/cctest/test_sockaddr.cc b/test/cctest/test_sockaddr.cc
index a4feefd6f4b3..adb15f9f84cf 100644
--- a/test/cctest/test_sockaddr.cc
+++ b/test/cctest/test_sockaddr.cc
@@ -272,6 +272,127 @@ TEST(SocketAddress, Comparison) {
   CHECK(addr2 >= addr5);
 }
 
+TEST(SocketAddress, NewAutoFamily) {
+  // SocketAddress::New(host, port) without explicit family.
+  // Tries AF_INET first, then AF_INET6.
+  SocketAddress addr;
+
+  // IPv4 address should succeed.
+  CHECK(SocketAddress::New("192.168.1.1", 8080, &addr));
+  CHECK_EQ(addr.family(), AF_INET);
+  CHECK_EQ(addr.address(), "192.168.1.1");
+  CHECK_EQ(addr.port(), 8080);
+
+  // IPv6 address should succeed (fails AF_INET, falls through to AF_INET6).
+  CHECK(SocketAddress::New("::1", 443, &addr));
+  CHECK_EQ(addr.family(), AF_INET6);
+  CHECK_EQ(addr.address(), "::1");
+  CHECK_EQ(addr.port(), 443);
+
+  // Invalid address should fail.
+  CHECK(!SocketAddress::New("not_an_address", 0, &addr));
+}
+
+TEST(SocketAddress, HashIPv6) {
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET6, "::1", 443, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "::1", 443, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "::2", 443, &s3);
+
+  SocketAddress a1(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress a2(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress a3(reinterpret_cast<const sockaddr*>(&s3));
+
+  // Same address and port: hash must be equal.
+  CHECK_EQ(SocketAddress::Hash()(a1), SocketAddress::Hash()(a2));
+
+  // Different address: hash should (very likely) differ.
+  CHECK_NE(SocketAddress::Hash()(a1), SocketAddress::Hash()(a3));
+}
+
+TEST(SocketAddress, IsMatchCrossFamily) {
+  sockaddr_storage s1, s2, s3, s4;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "::ffff:10.0.0.1", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "::1", 0, &s3);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.2", 0, &s4);
+
+  SocketAddress ipv4(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress mapped(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress ipv6(reinterpret_cast<const sockaddr*>(&s3));
+  SocketAddress other(reinterpret_cast<const sockaddr*>(&s4));
+
+  // IPv4 matches its IPv4-mapped IPv6 counterpart.
+  CHECK(ipv4.is_match(mapped));
+  CHECK(mapped.is_match(ipv4));
+
+  // IPv4 does not match a non-mapped IPv6 address.
+  CHECK(!ipv4.is_match(ipv6));
+  CHECK(!ipv6.is_match(ipv4));
+
+  // Same family, different address.
+  CHECK(!ipv4.is_match(other));
+
+  // Self-match.
+  CHECK(ipv4.is_match(ipv4));
+  CHECK(ipv6.is_match(ipv6));
+}
+
+TEST(SocketAddress, InNetworkIPv4) {
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET, "192.168.1.100", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "192.168.0.0", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 0, &s3);
+
+  SocketAddress addr(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress net(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress outside(reinterpret_cast<const sockaddr*>(&s3));
+
+  CHECK(addr.is_in_network(net, 16));
+  CHECK(!outside.is_in_network(net, 16));
+  CHECK(!addr.is_in_network(net, 24));  // 192.168.1.x != 192.168.0.x
+}
+
+TEST(SocketAddress, InNetworkIPv6) {
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db8::1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db8::", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db9::1", 0, &s3);
+
+  SocketAddress addr(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress net(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress outside(reinterpret_cast<const sockaddr*>(&s3));
+
+  CHECK(addr.is_in_network(net, 32));
+  CHECK(!outside.is_in_network(net, 32));
+
+  // /128 prefix == exact match.
+  CHECK(addr.is_in_network(addr, 128));
+  CHECK(!outside.is_in_network(addr, 128));
+}
+
+TEST(SocketAddress, InNetworkCrossFamily) {
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "::ffff:10.0.0.0", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "::ffff:10.0.0.1", 0, &s3);
+
+  SocketAddress ipv4(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress net6(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress mapped(reinterpret_cast<const sockaddr*>(&s3));
+
+  // IPv4 address in an IPv4-mapped IPv6 subnet.
+  CHECK(ipv4.is_in_network(net6, 120));  // prefix 120 = /24 on the IPv4 part
+  CHECK(mapped.is_in_network(net6, 120));
+
+  // IPv6 address in IPv4 network.
+  sockaddr_storage s4;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.0", 0, &s4);
+  SocketAddress net4(reinterpret_cast<const sockaddr*>(&s4));
+
+  CHECK(mapped.is_in_network(net4, 24));
+}
+
 TEST(SocketAddressBlockList, Simple) {
   SocketAddressBlockList bl;
 
@@ -283,14 +404,299 @@ TEST(SocketAddressBlockList, Simple) {
   std::shared_ptr<SocketAddress> addr2 = std::make_shared<SocketAddress>(
       reinterpret_cast<const sockaddr*>(&storage[1]));
 
-  bl.AddSocketAddress(addr1);
-  bl.AddSocketAddress(addr2);
+  bl.AddSocketAddress(*addr1);
+  bl.AddSocketAddress(*addr2);
 
   CHECK(bl.Apply(*addr1));
   CHECK(bl.Apply(*addr2));
 
-  bl.RemoveSocketAddress(addr1);
+  bl.RemoveSocketAddress(*addr1);
 
   CHECK(!bl.Apply(*addr1));
   CHECK(bl.Apply(*addr2));
 }
+
+TEST(SocketAddressBlockList, CrossFamilyAddress) {
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "::ffff:10.0.0.1", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "::1", 0, &s3);
+
+  SocketAddress ipv4(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress mapped(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress other(reinterpret_cast<const sockaddr*>(&s3));
+
+  // Adding IPv4 should also match the IPv4-mapped IPv6 form.
+  bl.AddSocketAddress(ipv4);
+  CHECK(bl.Apply(ipv4));
+  CHECK(bl.Apply(mapped));
+  CHECK(!bl.Apply(other));
+
+  // Remove should clean up cross-family counterpart.
+  bl.RemoveSocketAddress(ipv4);
+  CHECK(!bl.Apply(ipv4));
+  CHECK(!bl.Apply(mapped));
+}
+
+TEST(SocketAddressBlockList, CrossFamilyAddressIPv6) {
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2;
+  SocketAddress::ToSockAddr(AF_INET6, "::ffff:192.168.1.1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "192.168.1.1", 0, &s2);
+
+  SocketAddress mapped(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress ipv4(reinterpret_cast<const sockaddr*>(&s2));
+
+  // Adding an IPv4-mapped IPv6 address should also match the IPv4 form.
+  bl.AddSocketAddress(mapped);
+  CHECK(bl.Apply(mapped));
+  CHECK(bl.Apply(ipv4));
+
+  // Remove the IPv6 form should clean up the IPv4 counterpart.
+  bl.RemoveSocketAddress(mapped);
+  CHECK(!bl.Apply(mapped));
+  CHECK(!bl.Apply(ipv4));
+}
+
+TEST(SocketAddressBlockList, BatchAddresses) {
+  SocketAddressBlockList bl;
+
+  sockaddr_storage storage[3];
+  SocketAddress::ToSockAddr(AF_INET, "1.1.1.1", 0, &storage[0]);
+  SocketAddress::ToSockAddr(AF_INET, "2.2.2.2", 0, &storage[1]);
+  SocketAddress::ToSockAddr(AF_INET, "3.3.3.3", 0, &storage[2]);
+
+  SocketAddress addrs[3] = {
+      SocketAddress(reinterpret_cast<const sockaddr*>(&storage[0])),
+      SocketAddress(reinterpret_cast<const sockaddr*>(&storage[1])),
+      SocketAddress(reinterpret_cast<const sockaddr*>(&storage[2])),
+  };
+
+  bl.AddSocketAddresses(addrs, 3);
+
+  CHECK(bl.Apply(addrs[0]));
+  CHECK(bl.Apply(addrs[1]));
+  CHECK(bl.Apply(addrs[2]));
+
+  sockaddr_storage s4;
+  SocketAddress::ToSockAddr(AF_INET, "4.4.4.4", 0, &s4);
+  SocketAddress addr4(reinterpret_cast<const sockaddr*>(&s4));
+  CHECK(!bl.Apply(addr4));
+}
+
+TEST(SocketAddressBlockList, Range) {
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2, s3, s4, s5;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.10", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.5", 0, &s3);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.11", 0, &s4);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.0", 0, &s5);
+
+  SocketAddress start(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress end(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress mid(reinterpret_cast<const sockaddr*>(&s3));
+  SocketAddress above(reinterpret_cast<const sockaddr*>(&s4));
+  SocketAddress below(reinterpret_cast<const sockaddr*>(&s5));
+
+  bl.AddSocketAddressRange(start, end);
+
+  CHECK(bl.Apply(start));
+  CHECK(bl.Apply(end));
+  CHECK(bl.Apply(mid));
+  CHECK(!bl.Apply(above));
+  CHECK(!bl.Apply(below));
+
+  // Remove range.
+  bl.RemoveSocketAddressRange(start, end);
+  CHECK(!bl.Apply(mid));
+}
+
+TEST(SocketAddressBlockList, Subnet) {
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET, "192.168.1.0", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "192.168.1.100", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET, "192.168.2.1", 0, &s3);
+
+  SocketAddress net(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress inside(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress outside(reinterpret_cast<const sockaddr*>(&s3));
+
+  bl.AddSocketAddressMask(net, 24);
+
+  CHECK(bl.Apply(inside));
+  CHECK(!bl.Apply(outside));
+
+  // Remove subnet.
+  bl.RemoveSocketAddressMask(net, 24);
+  CHECK(!bl.Apply(inside));
+}
+
+TEST(SocketAddressBlockList, SubnetIPv6) {
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db8::", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db8::1", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db9::1", 0, &s3);
+
+  SocketAddress net(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress inside(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress outside(reinterpret_cast<const sockaddr*>(&s3));
+
+  bl.AddSocketAddressMask(net, 32);
+
+  CHECK(bl.Apply(inside));
+  CHECK(!bl.Apply(outside));
+
+  bl.RemoveSocketAddressMask(net, 32);
+  CHECK(!bl.Apply(inside));
+}
+
+TEST(SocketAddressBlockList, SubnetCrossFamily) {
+  SocketAddressBlockList bl;
+
+  // Adding an IPv4 subnet should also match IPv4-mapped IPv6 addresses.
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.0", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.5", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "::ffff:10.0.0.5", 0, &s3);
+
+  SocketAddress net(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress ipv4(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress mapped(reinterpret_cast<const sockaddr*>(&s3));
+
+  bl.AddSocketAddressMask(net, 24);
+
+  CHECK(bl.Apply(ipv4));
+  CHECK(bl.Apply(mapped));
+}
+
+TEST(SocketAddressBlockList, ClearAll) {
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET, "1.1.1.1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET, "192.168.0.0", 0, &s3);
+
+  SocketAddress addr(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress rangeStart(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress subnet(reinterpret_cast<const sockaddr*>(&s3));
+
+  sockaddr_storage s4;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.10", 0, &s4);
+  SocketAddress rangeEnd(reinterpret_cast<const sockaddr*>(&s4));
+
+  bl.AddSocketAddress(addr);
+  bl.AddSocketAddressRange(rangeStart, rangeEnd);
+  bl.AddSocketAddressMask(subnet, 16);
+
+  CHECK(bl.Apply(addr));
+  CHECK(bl.Apply(rangeStart));
+
+  sockaddr_storage s5;
+  SocketAddress::ToSockAddr(AF_INET, "192.168.1.1", 0, &s5);
+  SocketAddress subnetAddr(reinterpret_cast<const sockaddr*>(&s5));
+  CHECK(bl.Apply(subnetAddr));
+
+  bl.Clear();
+
+  CHECK(!bl.Apply(addr));
+  CHECK(!bl.Apply(rangeStart));
+  CHECK(!bl.Apply(subnetAddr));
+}
+
+TEST(SocketAddressBlockList, ParentBlockList) {
+  auto parent = std::make_shared<SocketAddressBlockList>();
+  SocketAddressBlockList child(parent);
+
+  sockaddr_storage s1, s2;
+  SocketAddress::ToSockAddr(AF_INET, "1.1.1.1", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "2.2.2.2", 0, &s2);
+
+  SocketAddress addr1(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress addr2(reinterpret_cast<const sockaddr*>(&s2));
+
+  parent->AddSocketAddress(addr1);
+  child.AddSocketAddress(addr2);
+
+  // Child should match both its own rules and parent's.
+  CHECK(child.Apply(addr1));
+  CHECK(child.Apply(addr2));
+
+  // Parent should only match its own rules.
+  CHECK(parent->Apply(addr1));
+  CHECK(!parent->Apply(addr2));
+}
+
+TEST(SocketAddressBlockList, SubnetOverlapRemoval) {
+  // Removing a broader subnet must restore narrower subnets that were
+  // subsumed by the broader prefix in the trie.
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.0", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "10.1.0.0", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET, "10.1.2.3", 0, &s3);
+
+  SocketAddress broad(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress narrow(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress target(reinterpret_cast<const sockaddr*>(&s3));
+
+  bl.AddSocketAddressMask(broad, 8);    // 10.0.0.0/8
+  bl.AddSocketAddressMask(narrow, 16);  // 10.1.0.0/16 (subsumed by /8)
+
+  CHECK(bl.Apply(target));  // Covered by /8.
+
+  bl.RemoveSocketAddressMask(broad, 8);
+
+  // After removing /8, the /16 must still work.
+  CHECK(bl.Apply(target));
+
+  // Address outside /16 but inside old /8 should no longer match.
+  sockaddr_storage s4;
+  SocketAddress::ToSockAddr(AF_INET, "10.2.0.1", 0, &s4);
+  SocketAddress outside(reinterpret_cast<const sockaddr*>(&s4));
+  CHECK(!bl.Apply(outside));
+}
+
+TEST(SocketAddressBlockList, SubnetRemoveMixedFamily) {
+  // Removing one family's subnet must correctly rebuild the remaining
+  // rules, including those from the other family.
+  SocketAddressBlockList bl;
+
+  sockaddr_storage s1, s2, s3, s4;
+  SocketAddress::ToSockAddr(AF_INET, "192.168.0.0", 0, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db8::", 0, &s2);
+  SocketAddress::ToSockAddr(AF_INET, "192.168.1.1", 0, &s3);
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db8::1", 0, &s4);
+
+  SocketAddress ipv4Net(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress ipv6Net(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress ipv4Addr(reinterpret_cast<const sockaddr*>(&s3));
+  SocketAddress ipv6Addr(reinterpret_cast<const sockaddr*>(&s4));
+
+  bl.AddSocketAddressMask(ipv4Net, 16);
+  bl.AddSocketAddressMask(ipv6Net, 32);
+
+  CHECK(bl.Apply(ipv4Addr));
+  CHECK(bl.Apply(ipv6Addr));
+
+  // Remove IPv4 subnet — IPv6 subnet must survive the rebuild.
+  bl.RemoveSocketAddressMask(ipv4Net, 16);
+  CHECK(!bl.Apply(ipv4Addr));
+  CHECK(bl.Apply(ipv6Addr));
+
+  // Re-add IPv4, then remove IPv6 — IPv4 must survive.
+  bl.AddSocketAddressMask(ipv4Net, 16);
+  bl.RemoveSocketAddressMask(ipv6Net, 32);
+  CHECK(bl.Apply(ipv4Addr));
+  CHECK(!bl.Apply(ipv6Addr));
+}
diff --git a/test/parallel/test-blocklist-fast-api.js b/test/parallel/test-blocklist-fast-api.js
new file mode 100644
index 000000000000..3c59ad361d1a
--- /dev/null
+++ b/test/parallel/test-blocklist-fast-api.js
@@ -0,0 +1,42 @@
+// Flags: --allow-natives-syntax --expose-internals --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { BlockList } = require('net');
+const { internalBinding } = require('internal/test/binding');
+
+// The fast API is on the native check() method which takes a
+// SocketAddressBase object. The JS BlockList.prototype.check() routes
+// string arguments to checkString() which has no fast API, so we need
+// to use SocketAddress objects to exercise the fast API path.
+const { kHandle: kBlockListHandle } = require('internal/blocklist');
+const {
+  SocketAddress,
+  kHandle: kSocketAddressHandle,
+} = require('internal/socketaddress');
+
+const blockList = new BlockList();
+blockList.addAddress('1.1.1.1');
+blockList.addSubnet('10.0.0.0', 24);
+
+const handle = blockList[kBlockListHandle];
+const addr1 = new SocketAddress({ address: '1.1.1.1' })[kSocketAddressHandle];
+const addr2 = new SocketAddress({ address: '2.2.2.2' })[kSocketAddressHandle];
+const addr3 = new SocketAddress({ address: '10.0.0.5' })[kSocketAddressHandle];
+
+function testFastCheck() {
+  assert.strictEqual(handle.check(addr1), true);
+  assert.strictEqual(handle.check(addr2), false);
+  assert.strictEqual(handle.check(addr3), true);
+}
+
+eval('%PrepareFunctionForOptimization(testFastCheck)');
+testFastCheck();
+eval('%OptimizeFunctionOnNextCall(testFastCheck)');
+testFastCheck();
+
+if (common.isDebug) {
+  const { getV8FastApiCallCount } = internalBinding('debug');
+  assert.strictEqual(getV8FastApiCallCount('blocklist.check'), 3);
+}
diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js
index 6895efcc1c00..08a293bb6a81 100644
--- a/test/parallel/test-blocklist.js
+++ b/test/parallel/test-blocklist.js
@@ -178,11 +178,11 @@ const util = require('util');
   blockList.addSubnet('8592:757c:efae:4e45::', 64, 'IpV6'); // Case insensitive
 
   const rulesCheck = [
+    'Address: IPv4 1.1.1.1',
     'Subnet: IPv6 8592:757c:efae:4e45::/64',
     'Range: IPv4 10.0.0.1-10.0.0.10',
-    'Address: IPv4 1.1.1.1',
   ];
-  assert.deepStrictEqual(blockList.rules, rulesCheck);
+  assert.deepStrictEqual(blockList.rules.sort(), rulesCheck.sort());
 
   assert(blockList.check('1.1.1.1'));
   assert(blockList.check('10.0.0.5'));
@@ -288,6 +288,88 @@ const util = require('util');
   assert(!BlockList.isBlockList({}));
 }
 
+{
+  // Test that adding the same address twice does not create duplicate rules.
+  // Previously, the second add would orphan the first rule in the internal
+  // list while overwriting its index entry, making it unreachable for removal
+  // but still evaluated during checks.
+  const blockList = new BlockList();
+  blockList.addAddress('1.1.1.1');
+  blockList.addAddress('1.1.1.1');
+
+  // Should have exactly one rule, not two.
+  assert.strictEqual(blockList.rules.length, 1);
+  assert(blockList.check('1.1.1.1'));
+}
+
+{
+  // Test clear() removes all rules.
+  const blockList = new BlockList();
+  blockList.addAddress('1.1.1.1');
+  blockList.addRange('10.0.0.1', '10.0.0.10');
+  blockList.addSubnet('192.168.0.0', 16);
+
+  assert.strictEqual(blockList.rules.length, 3);
+  assert(blockList.check('1.1.1.1'));
+  assert(blockList.check('10.0.0.5'));
+  assert(blockList.check('192.168.1.1'));
+
+  blockList.clear();
+
+  assert.strictEqual(blockList.rules.length, 0);
+  assert(!blockList.check('1.1.1.1'));
+  assert(!blockList.check('10.0.0.5'));
+  assert(!blockList.check('192.168.1.1'));
+
+  // Can add new rules after clearing.
+  blockList.addAddress('2.2.2.2');
+  assert.strictEqual(blockList.rules.length, 1);
+  assert(blockList.check('2.2.2.2'));
+  assert(!blockList.check('1.1.1.1'));
+}
+
+{
+  // addAddresses() validation: non-array argument throws.
+  const blockList0 = new BlockList();
+  assert.throws(() => blockList0.addAddresses('not-an-array'), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+  assert.throws(() => blockList0.addAddresses(123), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+{
+  // Test addAddresses() batch insert.
+  const blockList = new BlockList();
+  blockList.addAddresses(['1.1.1.1', '2.2.2.2', '3.3.3.3']);
+
+  assert(blockList.check('1.1.1.1'));
+  assert(blockList.check('2.2.2.2'));
+  assert(blockList.check('3.3.3.3'));
+  assert(!blockList.check('4.4.4.4'));
+  assert.strictEqual(blockList.rules.length, 3);
+
+  // Cross-family works with batch insert.
+  assert(blockList.check('::ffff:1.1.1.1', 'ipv6'));
+
+  // Batch with SocketAddress objects.
+  const blockList2 = new BlockList();
+  const sa1 = new SocketAddress({ address: '10.0.0.1' });
+  const sa2 = new SocketAddress({ address: '10.0.0.2' });
+  blockList2.addAddresses([sa1, sa2]);
+  assert(blockList2.check('10.0.0.1'));
+  assert(blockList2.check('10.0.0.2'));
+  assert(!blockList2.check('10.0.0.3'));
+
+  // IPv6 batch.
+  const blockList3 = new BlockList();
+  blockList3.addAddresses(['::1', '::2'], 'ipv6');
+  assert(blockList3.check('::1', 'ipv6'));
+  assert(blockList3.check('::2', 'ipv6'));
+  assert(!blockList3.check('::3', 'ipv6'));
+}
+
 // Test exporting and importing the rule list to/from JSON
 {
   const ruleList = [
@@ -359,3 +441,489 @@ const util = require('util');
     assert.strictEqual(test5.check(i[0], i[1]), i[2]);
   });
 }
+
+// removeRange: basic removal
+{
+  const blockList = new BlockList();
+  blockList.addRange('10.0.0.1', '10.0.0.100');
+  blockList.addRange('192.168.1.1', '192.168.1.50');
+  assert(blockList.check('10.0.0.50'));
+  assert(blockList.check('192.168.1.25'));
+
+  blockList.removeRange('10.0.0.1', '10.0.0.100');
+  assert(!blockList.check('10.0.0.50'));
+  assert(blockList.check('192.168.1.25'));
+  assert.strictEqual(blockList.rules.length, 1);
+}
+
+// removeRange: non-existent range is a no-op
+{
+  const blockList = new BlockList();
+  blockList.addRange('10.0.0.1', '10.0.0.10');
+  assert.strictEqual(blockList.rules.length, 1);
+  blockList.removeRange('99.99.99.1', '99.99.99.10');
+  assert.strictEqual(blockList.rules.length, 1);
+  assert(blockList.check('10.0.0.5'));
+}
+
+// removeRange: IPv6 range
+{
+  const blockList = new BlockList();
+  blockList.addRange('2001:db8::1', '2001:db8::ff', 'ipv6');
+  assert(blockList.check('2001:db8::50', 'ipv6'));
+
+  blockList.removeRange('2001:db8::1', '2001:db8::ff', 'ipv6');
+  assert(!blockList.check('2001:db8::50', 'ipv6'));
+  assert.strictEqual(blockList.rules.length, 0);
+}
+
+// removeRange: with SocketAddress objects
+{
+  const blockList = new BlockList();
+  const start = new SocketAddress({ address: '10.0.0.1' });
+  const end = new SocketAddress({ address: '10.0.0.10' });
+  blockList.addRange(start, end);
+  assert(blockList.check('10.0.0.5'));
+
+  blockList.removeRange(start, end);
+  assert(!blockList.check('10.0.0.5'));
+}
+
+// removeSubnet: basic IPv4 removal
+{
+  const blockList = new BlockList();
+  blockList.addSubnet('10.0.0.0', 8);
+  blockList.addSubnet('192.168.0.0', 16);
+  assert(blockList.check('10.1.2.3'));
+  assert(blockList.check('192.168.5.5'));
+
+  blockList.removeSubnet('10.0.0.0', 8);
+  assert(!blockList.check('10.1.2.3'));
+  assert(blockList.check('192.168.5.5'));
+  assert.strictEqual(blockList.rules.length, 1);
+}
+
+// removeSubnet: IPv6
+{
+  const blockList = new BlockList();
+  blockList.addSubnet('2001:db8::', 32, 'ipv6');
+  assert(blockList.check('2001:db8::1', 'ipv6'));
+
+  blockList.removeSubnet('2001:db8::', 32, 'ipv6');
+  assert(!blockList.check('2001:db8::1', 'ipv6'));
+  assert.strictEqual(blockList.rules.length, 0);
+}
+
+// removeSubnet: cross-family cleanup
+{
+  const blockList = new BlockList();
+  blockList.addSubnet('10.0.0.0', 8);
+  assert(blockList.check('::ffff:10.0.0.1', 'ipv6'));
+
+  blockList.removeSubnet('10.0.0.0', 8);
+  assert(!blockList.check('10.0.0.1'));
+  assert(!blockList.check('::ffff:10.0.0.1', 'ipv6'));
+}
+
+// removeSubnet: non-existent subnet is a no-op
+{
+  const blockList = new BlockList();
+  blockList.addSubnet('10.0.0.0', 8);
+  blockList.removeSubnet('172.16.0.0', 12);
+  assert(blockList.check('10.1.2.3'));
+  assert.strictEqual(blockList.rules.length, 1);
+}
+
+// removeSubnet: with SocketAddress objects
+{
+  const blockList = new BlockList();
+  const net = new SocketAddress({ address: '10.0.0.0' });
+  blockList.addSubnet(net, 8);
+  assert(blockList.check('10.1.2.3'));
+
+  blockList.removeSubnet(net, 8);
+  assert(!blockList.check('10.1.2.3'));
+}
+
+// removeRange/removeSubnet don't affect other rule types
+{
+  const blockList = new BlockList();
+  blockList.addAddress('1.1.1.1');
+  blockList.addRange('10.0.0.1', '10.0.0.100');
+  blockList.addSubnet('192.168.0.0', 16);
+
+  blockList.removeRange('10.0.0.1', '10.0.0.100');
+  blockList.removeSubnet('192.168.0.0', 16);
+
+  // Address rule should still work
+  assert(blockList.check('1.1.1.1'));
+  assert(!blockList.check('10.0.0.50'));
+  assert(!blockList.check('192.168.1.1'));
+}
+
+// addCIDR: IPv4
+{
+  const blockList = new BlockList();
+  blockList.addCIDR('10.0.0.0/8');
+  blockList.addCIDR('192.168.1.0/24');
+  assert(blockList.check('10.1.2.3'));
+  assert(blockList.check('192.168.1.50'));
+  assert(!blockList.check('192.168.2.1'));
+  assert(!blockList.check('11.0.0.1'));
+}
+
+// addCIDR: IPv6 auto-detected
+{
+  const blockList = new BlockList();
+  blockList.addCIDR('2001:db8::/32');
+  assert(blockList.check('2001:db8::1', 'ipv6'));
+  assert(blockList.check('2001:db8:ffff::1', 'ipv6'));
+  assert(!blockList.check('2001:db9::1', 'ipv6'));
+}
+
+// addCIDR: cross-family
+{
+  const blockList = new BlockList();
+  blockList.addCIDR('10.0.0.0/8');
+  assert(blockList.check('::ffff:10.0.0.1', 'ipv6'));
+}
+
+// addCIDR: validation errors
+{
+  const blockList = new BlockList();
+  assert.throws(() => blockList.addCIDR('10.0.0.0'), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => blockList.addCIDR('10.0.0.0/abc'), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => blockList.addCIDR(123), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+  assert.throws(() => blockList.addCIDR('10.0.0.0/'), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+}
+
+// removeCIDR: basic
+{
+  const blockList = new BlockList();
+  blockList.addCIDR('10.0.0.0/8');
+  blockList.addCIDR('192.168.0.0/16');
+  assert(blockList.check('10.1.2.3'));
+
+  blockList.removeCIDR('10.0.0.0/8');
+  assert(!blockList.check('10.1.2.3'));
+  assert(blockList.check('192.168.1.1'));
+  assert.strictEqual(blockList.rules.length, 1);
+}
+
+// removeCIDR: IPv6
+{
+  const blockList = new BlockList();
+  blockList.addCIDR('2001:db8::/32');
+  assert(blockList.check('2001:db8::1', 'ipv6'));
+
+  blockList.removeCIDR('2001:db8::/32');
+  assert(!blockList.check('2001:db8::1', 'ipv6'));
+  assert.strictEqual(blockList.rules.length, 0);
+}
+
+// removeCIDR: non-existent is a no-op
+{
+  const blockList = new BlockList();
+  blockList.addCIDR('10.0.0.0/8');
+  blockList.removeCIDR('172.16.0.0/12');
+  assert(blockList.check('10.1.2.3'));
+  assert.strictEqual(blockList.rules.length, 1);
+}
+
+// addCIDR interoperates with removeSubnet, and vice versa
+{
+  const blockList = new BlockList();
+  blockList.addCIDR('10.0.0.0/8');
+  blockList.removeSubnet('10.0.0.0', 8);
+  assert(!blockList.check('10.1.2.3'));
+
+  blockList.addSubnet('192.168.0.0', 16);
+  blockList.removeCIDR('192.168.0.0/16');
+  assert(!blockList.check('192.168.1.1'));
+}
+
+// removeAddress: basic
+{
+  const blockList = new BlockList();
+  blockList.addAddress('1.1.1.1');
+  blockList.addAddress('2.2.2.2');
+  assert(blockList.check('1.1.1.1'));
+
+  blockList.removeAddress('1.1.1.1');
+  assert(!blockList.check('1.1.1.1'));
+  assert(blockList.check('2.2.2.2'));
+}
+
+// removeAddress: cross-family cleanup
+{
+  const blockList = new BlockList();
+  blockList.addAddress('3.3.3.3');
+  assert(blockList.check('::ffff:3.3.3.3', 'ipv6'));
+
+  blockList.removeAddress('3.3.3.3');
+  assert(!blockList.check('3.3.3.3'));
+  assert(!blockList.check('::ffff:3.3.3.3', 'ipv6'));
+}
+
+// removeAddress: IPv6
+{
+  const blockList = new BlockList();
+  blockList.addAddress('::1', 'ipv6');
+  assert(blockList.check('::1', 'ipv6'));
+
+  blockList.removeAddress('::1', 'ipv6');
+  assert(!blockList.check('::1', 'ipv6'));
+}
+
+// removeAddress: non-existent is a no-op
+{
+  const blockList = new BlockList();
+  blockList.addAddress('1.1.1.1');
+  blockList.removeAddress('9.9.9.9');
+  assert(blockList.check('1.1.1.1'));
+}
+
+// removeAddress: with SocketAddress object
+{
+  const blockList = new BlockList();
+  const addr = new SocketAddress({ address: '5.5.5.5' });
+  blockList.addAddress(addr);
+  assert(blockList.check('5.5.5.5'));
+
+  blockList.removeAddress(addr);
+  assert(!blockList.check('5.5.5.5'));
+}
+
+// addCIDRs: batch
+{
+  const blockList = new BlockList();
+  blockList.addCIDRs(['10.0.0.0/8', '192.168.0.0/16', '2001:db8::/32']);
+  assert(blockList.check('10.1.2.3'));
+  assert(blockList.check('192.168.1.1'));
+  assert(blockList.check('2001:db8::1', 'ipv6'));
+  assert(!blockList.check('11.0.0.1'));
+  assert.strictEqual(blockList.rules.length, 3);
+}
+
+// addCIDRs: validation
+{
+  const blockList = new BlockList();
+  assert.throws(() => blockList.addCIDRs('not-an-array'), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+  assert.throws(() => blockList.addCIDRs([123]), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+  assert.throws(() => blockList.addCIDRs(['10.0.0.0']), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+}
+
+// addCIDRs: empty array is a no-op
+{
+  const blockList = new BlockList();
+  blockList.addCIDRs([]);
+  assert.strictEqual(blockList.size, 0);
+}
+
+// addCIDRs: invalid entry mid-array does not half-apply
+{
+  const blockList = new BlockList();
+  assert.throws(() => blockList.addCIDRs(['10.0.0.0/8', 'bad', '1.1.1.0/24']), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  // Nothing should have been applied.
+  assert.strictEqual(blockList.size, 0);
+  assert(!blockList.check('10.0.0.1'));
+}
+
+// size: tracks all rule types
+{
+  const blockList = new BlockList();
+  assert.strictEqual(blockList.size, 0);
+
+  blockList.addAddress('1.1.1.1');
+  assert.strictEqual(blockList.size, 1);
+
+  blockList.addRange('10.0.0.1', '10.0.0.10');
+  assert.strictEqual(blockList.size, 2);
+
+  blockList.addSubnet('192.168.0.0', 16);
+  assert.strictEqual(blockList.size, 3);
+
+  // Matches rules.length
+  assert.strictEqual(blockList.size, blockList.rules.length);
+
+  blockList.removeAddress('1.1.1.1');
+  assert.strictEqual(blockList.size, 2);
+
+  blockList.removeRange('10.0.0.1', '10.0.0.10');
+  assert.strictEqual(blockList.size, 1);
+
+  blockList.removeSubnet('192.168.0.0', 16);
+  assert.strictEqual(blockList.size, 0);
+
+  // After clear
+  blockList.addAddress('5.5.5.5');
+  blockList.clear();
+  assert.strictEqual(blockList.size, 0);
+}
+
+// size: duplicate addAddress does not double-count
+{
+  const blockList = new BlockList();
+  blockList.addAddress('1.1.1.1');
+  blockList.addAddress('1.1.1.1');
+  assert.strictEqual(blockList.size, 1);
+}
+
+// PRIVATE_RANGES: is a frozen array of CIDR strings
+{
+  assert(Array.isArray(BlockList.PRIVATE_RANGES));
+  assert(Object.isFrozen(BlockList.PRIVATE_RANGES));
+  assert(BlockList.PRIVATE_RANGES.length > 0);
+  for (const cidr of BlockList.PRIVATE_RANGES) {
+    assert.strictEqual(typeof cidr, 'string');
+    assert(cidr.includes('/'));
+  }
+}
+
+// PRIVATE_RANGES: covers expected addresses
+{
+  const blockList = new BlockList();
+  blockList.addCIDRs(BlockList.PRIVATE_RANGES);
+
+  // IPv4 private (RFC 1918)
+  assert(blockList.check('10.0.0.1'));
+  assert(blockList.check('10.255.255.255'));
+  assert(blockList.check('172.16.0.1'));
+  assert(blockList.check('172.31.255.255'));
+  assert(blockList.check('192.168.0.1'));
+  assert(blockList.check('192.168.255.255'));
+
+  // Loopback
+  assert(blockList.check('127.0.0.1'));
+  assert(blockList.check('127.255.255.255'));
+  assert(blockList.check('::1', 'ipv6'));
+
+  // Link-local
+  assert(blockList.check('169.254.0.1'));
+  assert(blockList.check('fe80::1', 'ipv6'));
+
+  // ULA
+  assert(blockList.check('fc00::1', 'ipv6'));
+  assert(blockList.check('fd00::1', 'ipv6'));
+
+  // Public addresses should not match
+  assert(!blockList.check('8.8.8.8'));
+  assert(!blockList.check('1.1.1.1'));
+  assert(!blockList.check('203.0.113.1'));
+  assert(!blockList.check('2001:db8::1', 'ipv6'));
+}
+
+// check() with invalid address string returns false (exercises checkString
+// error path in C++ — SocketAddress::New fails, returns false).
+{
+  const blockList = new BlockList();
+  blockList.addAddress('1.1.1.1');
+  assert.strictEqual(blockList.check('not_a_valid_ip'), false);
+  assert.strictEqual(blockList.check('', 'ipv4'), false);
+  assert.strictEqual(blockList.check('999.999.999.999'), false);
+  assert.strictEqual(blockList.check('not_valid_ipv6', 'ipv6'), false);
+}
+
+// check() family parameter is case-insensitive.
+{
+  const blockList = new BlockList();
+  blockList.addAddress('10.0.0.1');
+  blockList.addAddress('::1', 'ipv6');
+
+  assert(blockList.check('10.0.0.1', 'ipv4'));
+  assert(blockList.check('10.0.0.1', 'IPv4'));
+  assert(blockList.check('10.0.0.1', 'IPV4'));
+  assert(blockList.check('::1', 'ipv6'));
+  assert(blockList.check('::1', 'IPv6'));
+  assert(blockList.check('::1', 'IPV6'));
+}
+
+// SocketAddress constructor with invalid address throws ERR_INVALID_ADDRESS.
+{
+  assert.throws(() => new SocketAddress({ address: 'not_a_valid_ip' }), {
+    code: 'ERR_INVALID_ADDRESS',
+  });
+  assert.throws(
+    () => new SocketAddress({ address: 'not_valid', family: 'ipv6' }), {
+      code: 'ERR_INVALID_ADDRESS',
+    });
+}
+
+// check() with SocketAddress objects across family boundaries.
+{
+  const blockList = new BlockList();
+  const ipv4 = new SocketAddress({ address: '10.0.0.1' });
+  const mapped = new SocketAddress({
+    address: '::ffff:10.0.0.1',
+    family: 'ipv6',
+  });
+
+  blockList.addAddress(ipv4);
+
+  // Check with SocketAddress objects (exercises the check() -> C++ fast path).
+  assert(blockList.check(ipv4));
+  assert(blockList.check(mapped));
+
+  blockList.removeAddress(ipv4);
+  assert(!blockList.check(ipv4));
+  assert(!blockList.check(mapped));
+}
+
+// Subnet with IPv4-mapped IPv6 network.
+{
+  const blockList = new BlockList();
+  blockList.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
+
+  // IPv4-mapped IPv6 within the subnet should match.
+  assert(blockList.check('::ffff:10.0.0.5', 'ipv6'));
+  // The plain IPv4 form should also match (cross-family trie lookup).
+  assert(blockList.check('10.0.0.5'));
+  // Outside the subnet.
+  assert(!blockList.check('10.0.1.0'));
+}
+
+// Range with IPv6 addresses.
+{
+  const blockList = new BlockList();
+  blockList.addRange('::1', '::ff', 'ipv6');
+  assert(blockList.check('::1', 'ipv6'));
+  assert(blockList.check('::a0', 'ipv6'));
+  assert(blockList.check('::ff', 'ipv6'));
+  assert(!blockList.check('::100', 'ipv6'));
+  assert(!blockList.check('::0', 'ipv6'));
+
+  blockList.removeRange('::1', '::ff', 'ipv6');
+  assert(!blockList.check('::a0', 'ipv6'));
+}
+
+// Removing a broader subnet must restore subsumed narrower subnets.
+{
+  const blockList = new BlockList();
+  blockList.addSubnet('10.0.0.0', 8);   // /8 subsumes /16 in the trie
+  blockList.addSubnet('10.1.0.0', 16);
+  assert(blockList.check('10.1.2.3'));
+
+  blockList.removeSubnet('10.0.0.0', 8);
+
+  // /16 must still work after /8 is removed.
+  assert(blockList.check('10.1.2.3'));
+  // Address outside /16 but inside old /8 should no longer match.
+  assert(!blockList.check('10.2.0.1'));
+  assert.strictEqual(blockList.rules.length, 1);
+}

From ee5f72cf16be197e475352ff3a160db073bdbc13 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 6 Aug 2026 15:17:12 +0200
Subject: [PATCH 042/344] doc: fix broken link

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65078
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/buffer.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 93af755b7620..4fd34498c050 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5731,7 +5731,7 @@ or after startup, if the alignment has to hold at run time.
 [`buf.compare()`]: #bufcomparetarget-targetstart-targetend-sourcestart-sourceend
 [`buf.entries()`]: #bufentries
 [`buf.fill()`]: #buffillvalue-offset-end-encoding
-[`buf.indexOf()`]: #bufindexofvalue-byteoffset-encoding
+[`buf.indexOf()`]: #bufindexofvalue-start-end-encoding
 [`buf.keys()`]: #bufkeys
 [`buf.length`]: #buflength
 [`buf.slice()`]: #bufslicestart-end

From 656cfaeb2d54000aa6e9b0abd6e469f0fe217d2d Mon Sep 17 00:00:00 2001
From: Kirill Saied <sayed.kirill@gmail.com>
Date: Thu, 6 Aug 2026 23:24:40 +0200
Subject: [PATCH 043/344] fs: add windowsHandle option to file streams

Fixes: https://github.com/nodejs/node/issues/57288
Signed-off-by: PickBas <sayed.kirill@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63851
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 doc/api/fs.md                                 | 22 +++++++
 lib/internal/fs/streams.js                    | 38 +++++++++++-
 src/node_file.cc                              | 34 ++++++++++
 test/addons/fs-windows-handle/binding.cc      | 62 +++++++++++++++++++
 test/addons/fs-windows-handle/binding.gyp     |  9 +++
 test/addons/fs-windows-handle/test.js         | 35 +++++++++++
 .../parallel/test-fs-stream-windows-handle.js | 47 ++++++++++++++
 7 files changed, 245 insertions(+), 2 deletions(-)
 create mode 100644 test/addons/fs-windows-handle/binding.cc
 create mode 100644 test/addons/fs-windows-handle/binding.gyp
 create mode 100644 test/addons/fs-windows-handle/test.js
 create mode 100644 test/parallel/test-fs-stream-windows-handle.js

diff --git a/doc/api/fs.md b/doc/api/fs.md
index c7ee7c12ada0..70a3e7420bd2 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -2933,6 +2933,9 @@ behavior is similar to `cp dir1/ dir2/`.
 <!-- YAML
 added: v0.1.31
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63851
+    description: Add the `windowsHandle` option.
   - version: v16.10.0
     pr-url: https://github.com/nodejs/node/pull/40013
     description: The `fs` option does not need `open` method if an `fd` was provided.
@@ -2989,6 +2992,8 @@ changes:
   * `highWaterMark` {integer} **Default:** `64 * 1024`
   * `fs` {Object|null} **Default:** `null`
   * `signal` {AbortSignal|null} **Default:** `null`
+  * `windowsHandle` {bigint} A raw Win32 `HANDLE` value to read from, in place
+    of `fd`. Windows only. **Default:** `null`
 * Returns: {fs.ReadStream}
 
 `options` can include `start` and `end` values to read a range of bytes from
@@ -3009,6 +3014,12 @@ If `fd` points to a character device that only supports blocking reads
 available. This can prevent the process from exiting and the stream from
 closing naturally.
 
+On Windows, a value passed in `fd` is interpreted as a CRT file descriptor. To
+use a raw Win32 `HANDLE` instead, such as an inherited anonymous pipe handle
+obtained from another process, pass it as `windowsHandle`. The handle is wrapped
+in a file descriptor that the stream owns and closes. The `windowsHandle` option
+throws on non-Windows platforms and cannot be combined with the `fs` option.
+
 By default, the stream will emit a `'close'` event after it has been
 destroyed.  Set the `emitClose` option to `false` to change this behavior.
 
@@ -3059,6 +3070,9 @@ If `options` is a string, then it specifies the encoding.
 <!-- YAML
 added: v0.1.31
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63851
+    description: Add the `windowsHandle` option.
   - version: v22.0.0
     pr-url: https://github.com/nodejs/node/pull/52037
     description: bump default highWaterMark.
@@ -3123,6 +3137,8 @@ changes:
     [`stream.getDefaultHighWaterMark()`][].
   * `flush` {boolean} If `true`, the underlying file descriptor is flushed
     prior to closing it. **Default:** `false`.
+  * `windowsHandle` {bigint} A raw Win32 `HANDLE` value to write to, in place
+    of `fd`. Windows only. **Default:** `null`
 * Returns: {fs.WriteStream}
 
 `options` may also include a `start` option to allow writing data at some
@@ -3137,6 +3153,12 @@ then the file descriptor won't be closed, even if there's an error.
 It is the application's responsibility to close it and make sure there's no
 file descriptor leak.
 
+On Windows, a value passed in `fd` is interpreted as a CRT file descriptor. To
+use a raw Win32 `HANDLE` instead, such as an inherited anonymous pipe handle
+obtained from another process, pass it as `windowsHandle`. The handle is wrapped
+in a file descriptor that the stream owns and closes. The `windowsHandle` option
+throws on non-Windows platforms and cannot be combined with the `fs` option.
+
 By default, the stream will emit a `'close'` event after it has been
 destroyed.  Set the `emitClose` option to `false` to change this behavior.
 
diff --git a/lib/internal/fs/streams.js b/lib/internal/fs/streams.js
index c2e8abc4efda..4c53f7ea23e1 100644
--- a/lib/internal/fs/streams.js
+++ b/lib/internal/fs/streams.js
@@ -13,13 +13,17 @@ const {
 } = primordials;
 
 const {
+  ERR_FEATURE_UNAVAILABLE_ON_PLATFORM,
+  ERR_INCOMPATIBLE_OPTION_PAIR,
   ERR_INVALID_ARG_TYPE,
   ERR_METHOD_NOT_IMPLEMENTED,
+  ERR_MISSING_OPTION,
   ERR_OUT_OF_RANGE,
   ERR_STREAM_DESTROYED,
   ERR_SYSTEM_ERROR,
 } = require('internal/errors').codes;
 const {
+  isWindows,
   kEmptyObject,
 } = require('internal/util');
 const {
@@ -40,6 +44,8 @@ const {
 } = require('internal/fs/utils');
 const { Readable, Writable, finished } = require('stream');
 const { toPathIfFileURL } = require('internal/url');
+const binding = internalBinding('fs');
+const { O_RDONLY, O_WRONLY } = internalBinding('constants').fs;
 const kIoDone = Symbol('kIoDone');
 const kIsPerformingIO = Symbol('kIsPerformingIO');
 
@@ -160,6 +166,26 @@ function importFd(stream, options) {
                                  ['number', 'FileHandle'], options.fd);
 }
 
+function importWindowsHandle(stream, options, flags) {
+  if (options.windowsHandle == null) {
+    throw new ERR_MISSING_OPTION('options.windowsHandle');
+  }
+  if (!isWindows) {
+    throw new ERR_FEATURE_UNAVAILABLE_ON_PLATFORM('windowsHandle');
+  }
+  if (options.fs) {
+    // The HANDLE is wrapped using the real filesystem, so a custom fs
+    // implementation cannot be combined with it.
+    throw new ERR_METHOD_NOT_IMPLEMENTED('windowsHandle with fs');
+  }
+  if (typeof options.windowsHandle !== 'bigint') {
+    throw new ERR_INVALID_ARG_TYPE('options.windowsHandle', 'bigint',
+                                   options.windowsHandle);
+  }
+  stream[kFs] = fs;
+  return binding.handleToFd(options.windowsHandle, flags);
+}
+
 function ReadStream(path, options) {
   if (!(this instanceof ReadStream))
     return new ReadStream(path, options);
@@ -173,7 +199,11 @@ function ReadStream(path, options) {
     options.autoDestroy = false;
   }
 
-  if (options.fd == null) {
+  if (options.fd != null && options.windowsHandle != null) {
+    throw new ERR_INCOMPATIBLE_OPTION_PAIR('windowsHandle', 'fd');
+  } else if (options.windowsHandle != null) {
+    this.fd = getValidatedFd(importWindowsHandle(this, options, O_RDONLY));
+  } else if (options.fd == null) {
     this.fd = null;
     this[kFs] = options.fs || fs;
     validateFunction(this[kFs].open, 'options.fs.open');
@@ -325,7 +355,11 @@ function WriteStream(path, options) {
   // Only buffers are supported.
   options.decodeStrings = true;
 
-  if (options.fd == null) {
+  if (options.fd != null && options.windowsHandle != null) {
+    throw new ERR_INCOMPATIBLE_OPTION_PAIR('windowsHandle', 'fd');
+  } else if (options.windowsHandle != null) {
+    this.fd = getValidatedFd(importWindowsHandle(this, options, O_WRONLY));
+  } else if (options.fd == null) {
     this.fd = null;
     this[kFs] = options.fs || fs;
     validateFunction(this[kFs].open, 'options.fs.open');
diff --git a/src/node_file.cc b/src/node_file.cc
index 78bb84b9f06c..ae0d9f34f8e1 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -4150,6 +4150,33 @@ InternalFieldInfoBase* BindingData::Serialize(int index) {
   return info;
 }
 
+#ifdef _WIN32
+static void HandleToFd(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_GE(args.Length(), 1);
+  CHECK(args[0]->IsBigInt());
+
+  int flags = 0;
+  if (args[1]->IsNumber()) {
+    flags = args[1].As<Int32>()->Value();
+  }
+
+  bool lossless;
+  int64_t handle = args[0].As<BigInt>()->Int64Value(&lossless);
+  if (!lossless) {
+    return THROW_ERR_OUT_OF_RANGE(env,
+                                  "windowsHandle does not fit into 64 bits");
+  }
+  intptr_t value = static_cast<intptr_t>(handle);
+
+  int fd = _open_osfhandle(value, flags);
+  if (fd == -1) {
+    return env->ThrowErrnoException(errno, "_open_osfhandle");
+  }
+  args.GetReturnValue().Set(fd);
+}
+#endif  // _WIN32
+
 void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
                                              Local<ObjectTemplate> target) {
   Isolate* isolate = isolate_data->isolate();
@@ -4216,6 +4243,10 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
 
   SetMethod(isolate, target, "mkdtemp", Mkdtemp);
 
+#ifdef _WIN32
+  SetMethod(isolate, target, "handleToFd", HandleToFd);
+#endif
+
   SetMethod(isolate, target, "cpSyncCheckPaths", CpSyncCheckPaths);
   SetMethod(isolate, target, "cpSyncOverrideFile", CpSyncOverrideFile);
   SetMethod(isolate, target, "cpSyncCopyDir", CpSyncCopyDir);
@@ -4343,6 +4374,9 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(LUTimes);
 
   registry->Register(Mkdtemp);
+#ifdef _WIN32
+  registry->Register(HandleToFd);
+#endif
   registry->Register(NewFSReqCallback);
 
   registry->Register(FileHandle::New);
diff --git a/test/addons/fs-windows-handle/binding.cc b/test/addons/fs-windows-handle/binding.cc
new file mode 100644
index 000000000000..72194df15e5f
--- /dev/null
+++ b/test/addons/fs-windows-handle/binding.cc
@@ -0,0 +1,62 @@
+#include <node.h>
+#include <v8.h>
+
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+using v8::BigInt;
+using v8::Context;
+using v8::FunctionCallbackInfo;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::String;
+using v8::Value;
+
+// Creates an anonymous pipe and returns its raw Win32 read/write HANDLE values
+// as JS bigints. These are NOT CRT file descriptors, so passing them as the
+// `windowsHandle` stream option exercises the HANDLE -> fd conversion path on
+// Windows. Returns undefined on other platforms.
+void CreatePipeHandles(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+#ifdef _WIN32
+  Local<Context> context = isolate->GetCurrentContext();
+
+  HANDLE read_handle = nullptr;
+  HANDLE write_handle = nullptr;
+  if (!CreatePipe(&read_handle, &write_handle, nullptr, 0)) {
+    isolate->ThrowException(v8::Exception::Error(
+        String::NewFromUtf8(isolate, "CreatePipe failed").ToLocalChecked()));
+    return;
+  }
+
+  Local<Object> result = Object::New(isolate);
+  result
+      ->Set(context,
+            String::NewFromUtf8(isolate, "readHandle").ToLocalChecked(),
+            BigInt::New(
+                isolate,
+                static_cast<int64_t>(reinterpret_cast<intptr_t>(read_handle))))
+      .Check();
+  result
+      ->Set(context,
+            String::NewFromUtf8(isolate, "writeHandle").ToLocalChecked(),
+            BigInt::New(
+                isolate,
+                static_cast<int64_t>(reinterpret_cast<intptr_t>(write_handle))))
+      .Check();
+  args.GetReturnValue().Set(result);
+#else
+  args.GetReturnValue().SetUndefined();
+#endif
+}
+
+}  // anonymous namespace
+
+extern "C" NODE_MODULE_EXPORT void NODE_MODULE_INITIALIZER(
+    Local<Object> exports, Local<Value> module, Local<Context> context) {
+  NODE_SET_METHOD(exports, "createPipeHandles", CreatePipeHandles);
+}
diff --git a/test/addons/fs-windows-handle/binding.gyp b/test/addons/fs-windows-handle/binding.gyp
new file mode 100644
index 000000000000..7e0f38c27d57
--- /dev/null
+++ b/test/addons/fs-windows-handle/binding.gyp
@@ -0,0 +1,9 @@
+{
+  'targets': [
+    {
+      'target_name': 'binding',
+      'sources': [ 'binding.cc' ],
+      'includes': ['../common.gypi'],
+    },
+  ]
+}
diff --git a/test/addons/fs-windows-handle/test.js b/test/addons/fs-windows-handle/test.js
new file mode 100644
index 000000000000..122440ee4677
--- /dev/null
+++ b/test/addons/fs-windows-handle/test.js
@@ -0,0 +1,35 @@
+'use strict';
+// Verifies that fs.createReadStream()/createWriteStream() accept a raw Win32
+// HANDLE through the `windowsHandle` option, as happens when a parent process
+// passes an inherited anonymous pipe handle. The addon produces such handles
+// via CreatePipe(); Node must wrap them in CRT file descriptors instead of
+// failing with EBADF.
+
+const common = require('../../common');
+
+if (!common.isWindows) {
+  common.skip('windowsHandle is Windows-only');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+
+const binding = require(`./build/${common.buildType}/binding`);
+
+const { readHandle, writeHandle } = binding.createPipeHandles();
+assert.strictEqual(typeof readHandle, 'bigint');
+assert.strictEqual(typeof writeHandle, 'bigint');
+
+const payload = 'payload';
+
+const chunks = [];
+const rs = fs.createReadStream(null, { windowsHandle: readHandle });
+rs.on('error', (err) => assert.fail(err));
+rs.on('data', (chunk) => chunks.push(chunk));
+rs.on('end', common.mustCall(() => {
+  assert.strictEqual(Buffer.concat(chunks).toString(), payload);
+}));
+
+const ws = fs.createWriteStream(null, { windowsHandle: writeHandle });
+ws.on('error', (err) => assert.fail(err));
+ws.end(payload);
diff --git a/test/parallel/test-fs-stream-windows-handle.js b/test/parallel/test-fs-stream-windows-handle.js
new file mode 100644
index 000000000000..299a618802cf
--- /dev/null
+++ b/test/parallel/test-fs-stream-windows-handle.js
@@ -0,0 +1,47 @@
+'use strict';
+
+// Tests option validation for the `windowsHandle` option of
+// fs.createReadStream()/createWriteStream(). The functional round-trip on
+// Windows (where a real Win32 HANDLE is wrapped in a file descriptor) is
+// covered by test/addons/fs-windows-handle.
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+
+const handle = 1n;
+
+for (const create of [fs.createReadStream, fs.createWriteStream]) {
+  assert.throws(() => create(null, { windowsHandle: handle, fd: 2 }), {
+    code: 'ERR_INCOMPATIBLE_OPTION_PAIR',
+  });
+}
+
+if (!common.isWindows) {
+  for (const create of [fs.createReadStream, fs.createWriteStream]) {
+    assert.throws(() => create(null, { windowsHandle: handle }), {
+      code: 'ERR_FEATURE_UNAVAILABLE_ON_PLATFORM',
+    });
+  }
+  return;
+}
+
+for (const create of [fs.createReadStream, fs.createWriteStream]) {
+  // Cannot be combined with a custom `fs` implementation.
+  assert.throws(() => create(null, { windowsHandle: handle, fs: {} }), {
+    code: 'ERR_METHOD_NOT_IMPLEMENTED',
+  });
+
+  // Must be a bigint.
+  assert.throws(() => create(null, { windowsHandle: 'nope' }), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+  assert.throws(() => create(null, { windowsHandle: 1 }), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+
+  // Must fit into 64 bits.
+  assert.throws(() => create(null, { windowsHandle: 2n ** 64n }), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+}

From 7ddd853d8cb8d09eda1b1385e6fdee583a3cb9d6 Mon Sep 17 00:00:00 2001
From: Joyee Cheung <joyeec9h3@gmail.com>
Date: Thu, 6 Aug 2026 23:24:50 +0200
Subject: [PATCH 044/344] test: increase timeout in
 probe-failure-hang-during-evaluate

On slower CI machines, the probed process may take longer time
to bootstrap and establish connection to. Increase the timeout
so it's more likely to finish testing before timing out.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64719
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-07-24.md
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 .../test-debugger-probe-failure-hang-during-evaluate.js         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/parallel/test-debugger-probe-failure-hang-during-evaluate.js b/test/parallel/test-debugger-probe-failure-hang-during-evaluate.js
index 82ff78ca6f78..705557285c6c 100644
--- a/test/parallel/test-debugger-probe-failure-hang-during-evaluate.js
+++ b/test/parallel/test-debugger-probe-failure-hang-during-evaluate.js
@@ -12,7 +12,7 @@ const { assertProbeJson } = require('../common/debugger-probe');
 const cwd = fixtures.path('debugger');
 const fixture = 'probe-inspector-close-two-probes.js';
 const marker = 'probe-inspector-close-marker';
-const timeoutMs = common.platformTimeout(1000);
+const timeoutMs = common.platformTimeout(3000);
 const probes = [
   { expr: 'closeInspector()', target: { suffix: fixture, line: 10 } },
   { expr: 'firstProbeLine', target: { suffix: fixture, line: 11 } },

From 6bd15b2ac9dfaba80eb72dd28edccda571af7bcc Mon Sep 17 00:00:00 2001
From: Jeong SeokChan <95221819+standard-Chan@users.noreply.github.com>
Date: Fri, 7 Aug 2026 06:25:00 +0900
Subject: [PATCH 045/344] stream: fix recursive WritableStream abort

Recheck the stream state after signaling abort, as required by steps 3
and 4 of the WritableStreamAbort algorithm.

Only reject pending close promise caches, as a cache materialized after
the stream becomes errored may already contain a rejected promise.

This makes the recursive abort WPT pass and removes its expected-failure
entry.

Refs: https://streams.spec.whatwg.org/#writable-stream-abort
Signed-off-by: Jeong SeokChan <starp321@naver.com>
PR-URL: https://github.com/nodejs/node/pull/64825
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
---
 lib/internal/webstreams/writablestream.js | 15 +++++++++------
 test/wpt/status/streams.json              |  8 --------
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/lib/internal/webstreams/writablestream.js b/lib/internal/webstreams/writablestream.js
index 87e3bcaa2850..10b7dbcf277c 100644
--- a/lib/internal/webstreams/writablestream.js
+++ b/lib/internal/webstreams/writablestream.js
@@ -701,15 +701,18 @@ function writerReadyPromise(writer) {
 }
 
 function writableStreamAbort(stream, reason) {
-  const {
-    state,
-    controller,
-  } = stream[kState];
+  const { controller } = stream[kState];
+
+  let state = stream[kState].state;
   if (state === 'closed' || state === 'errored')
     return PromiseResolve();
 
   controller[kState].abortController.abort(reason);
 
+  state = stream[kState].state;
+  if (state === 'closed' || state === 'errored')
+    return PromiseResolve();
+
   if (stream[kState].pendingAbortRequest.abort.promise !== undefined)
     return stream[kState].pendingAbortRequest.abort.promise;
 
@@ -807,7 +810,7 @@ function writableStreamRejectCloseAndClosedPromiseIfNeeded(stream) {
   }
 
   const closedPromiseCache = stream[kState].closedPromise;
-  if (closedPromiseCache !== undefined) {
+  if (closedPromiseCache !== undefined && isPromisePending(closedPromiseCache.promise)) {
     setPromiseHandled(closedPromiseCache.promise);
     closedPromiseCache.reject(stream[kState].storedError);
   }
@@ -817,7 +820,7 @@ function writableStreamRejectCloseAndClosedPromiseIfNeeded(stream) {
   } = stream[kState];
   if (writer !== undefined) {
     const closeCache = writer[kState].close;
-    if (closeCache !== undefined) {
+    if (closeCache !== undefined && isPromisePending(closeCache.promise)) {
       setPromiseHandled(closeCache.promise);
       closeCache.reject(stream[kState].storedError);
     }
diff --git a/test/wpt/status/streams.json b/test/wpt/status/streams.json
index 2268ffcc87ac..968b33597651 100644
--- a/test/wpt/status/streams.json
+++ b/test/wpt/status/streams.json
@@ -43,13 +43,5 @@
   },
   "transform-streams/invalid-realm.tentative.window.js": {
     "skip": "Browser-specific test"
-  },
-  "writable-streams/aborting.any.js": {
-    "fail": {
-      "note": "Recursive abort() call from within an abort algorithm triggers ERR_INTERNAL_ASSERTION",
-      "expected": [
-        "recursive abort() call from abort() aborting signal"
-      ]
-    }
   }
 }

From 673db40fbffe707a457f752db79019d58852ee00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=ED=98=9C=EB=AF=B8?=
 <103042868+hyemimi@users.noreply.github.com>
Date: Fri, 7 Aug 2026 06:25:09 +0900
Subject: [PATCH 046/344] doc: fix grammar in worker_threads.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: hyemimi <hyemi7375@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64913
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 doc/api/worker_threads.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index d812bce8fd05..e7b6b19b355c 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -1836,8 +1836,8 @@ is done within the event loop. So the event loop utilization is
 immediately available once the worker's script begins execution.
 
 An `idle` time that does not increase does not indicate that the worker is
-stuck in bootstrap. The following examples shows how the worker's entire
-lifetime never accumulates any `idle` time, but is still be able to process
+stuck in bootstrap. The following example shows how the worker's entire
+lifetime never accumulates any `idle` time, but is still able to process
 messages.
 
 ```mjs

From 8657497521e107df252706438cc6eec8c99561e5 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 6 Aug 2026 23:25:21 +0200
Subject: [PATCH 047/344] tools: fix `pkcs11-store-test` check

`openssl_3_5` was renamed to `openssl` in 339062296ec.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65023
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .github/workflows/test-shared.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index a8f2ddc27831..284372317359 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -246,7 +246,7 @@ jobs:
     with:
       runner: ubuntu-24.04-arm
       v8-nar: ${{ needs.build-aarch64-linux-v8.outputs.local-cache && 'libv8-aarch64-linux.nar' }}
-      pkcs11-store-test: ${{ matrix.openssl.attr == 'openssl_3_5' }}
+      pkcs11-store-test: ${{ matrix.openssl.attr == 'openssl' }}
       # Override just the `openssl` attr of the default shared-lib set with
       # the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
       # other shared libs (brotli, cares, libuv, …) keep their defaults.

From ad35fe97f0d23c2f6d319df9dcefea05aff00919 Mon Sep 17 00:00:00 2001
From: Kirill Saied <sayed.kirill@gmail.com>
Date: Fri, 7 Aug 2026 07:19:08 +0200
Subject: [PATCH 048/344] src: expose Windows-only fs open flags

Signed-off-by: Kirill Saied <sayed.kirill@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64775
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 doc/api/fs.md                      | 28 +++++++++++++++++++++++++++-
 src/node_constants.cc              |  7 ++++++-
 test/parallel/test-fs-constants.js |  4 ++++
 3 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index 70a3e7420bd2..dd59bce3287e 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -8766,10 +8766,36 @@ The following constants are meant for use with `fs.open()`.
     is available on Windows operating systems only. On other operating systems,
     this flag is ignored.</td>
   </tr>
+  <tr>
+    <td><code>UV_FS_O_TEMPORARY</code></td>
+    <td>When set, the file is deleted automatically when the last handle to it
+    is closed. This flag is available on Windows operating systems only. On
+    other operating systems, this flag is ignored.</td>
+  </tr>
+  <tr>
+    <td><code>UV_FS_O_SHORT_LIVED</code></td>
+    <td>Hint that the file is short-lived, so the system avoids flushing it to
+    disk when possible. This flag is available on Windows operating systems
+    only. On other operating systems, this flag is ignored.</td>
+  </tr>
+  <tr>
+    <td><code>UV_FS_O_SEQUENTIAL</code></td>
+    <td>Hint that the file is accessed sequentially from beginning to end, to
+    optimize caching. This flag is available on Windows operating systems only.
+    On other operating systems, this flag is ignored.</td>
+  </tr>
+  <tr>
+    <td><code>UV_FS_O_RANDOM</code></td>
+    <td>Hint that the file is accessed randomly, to optimize caching. This flag
+    is available on Windows operating systems only. On other operating systems,
+    this flag is ignored.</td>
+  </tr>
 </table>
 
 On Windows, only `O_APPEND`, `O_CREAT`, `O_EXCL`, `O_RDONLY`, `O_RDWR`,
-`O_TRUNC`, `O_WRONLY`, and `UV_FS_O_FILEMAP` are available.
+`O_TRUNC`, `O_WRONLY`, `UV_FS_O_FILEMAP`, `UV_FS_O_TEMPORARY`,
+`UV_FS_O_SHORT_LIVED`, `UV_FS_O_SEQUENTIAL`, and `UV_FS_O_RANDOM` are
+available.
 
 ##### File type constants
 
diff --git a/src/node_constants.cc b/src/node_constants.cc
index db670789dc06..9725f36e8128 100644
--- a/src/node_constants.cc
+++ b/src/node_constants.cc
@@ -1137,7 +1137,12 @@ void DefineFsConstants(Local<Object> target) {
   NODE_DEFINE_CONSTANT(target, O_EXCL);
 #endif
 
-NODE_DEFINE_CONSTANT(target, UV_FS_O_FILEMAP);
+  // Windows-only open flags honored by libuv. They are 0 on other platforms.
+  NODE_DEFINE_CONSTANT(target, UV_FS_O_FILEMAP);
+  NODE_DEFINE_CONSTANT(target, UV_FS_O_TEMPORARY);
+  NODE_DEFINE_CONSTANT(target, UV_FS_O_SHORT_LIVED);
+  NODE_DEFINE_CONSTANT(target, UV_FS_O_SEQUENTIAL);
+  NODE_DEFINE_CONSTANT(target, UV_FS_O_RANDOM);
 
 #ifdef O_NOCTTY
   NODE_DEFINE_CONSTANT(target, O_NOCTTY);
diff --git a/test/parallel/test-fs-constants.js b/test/parallel/test-fs-constants.js
index cdecfe559163..b2ea4ce20ee6 100644
--- a/test/parallel/test-fs-constants.js
+++ b/test/parallel/test-fs-constants.js
@@ -35,6 +35,10 @@ const knownFsConstantNames = [
   'O_CREAT',
   'O_EXCL',
   'UV_FS_O_FILEMAP',
+  'UV_FS_O_TEMPORARY',
+  'UV_FS_O_SHORT_LIVED',
+  'UV_FS_O_SEQUENTIAL',
+  'UV_FS_O_RANDOM',
   'O_NOCTTY',
   'O_TRUNC',
   'O_APPEND',

From 4f2c63425893c93cf1e7eeebebb105eaebcd58e4 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 7 Aug 2026 11:16:36 +0200
Subject: [PATCH 049/344] tools: lazy-abort failed PR merges in CQ

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65004
Refs: https://github.com/nodejs/node/issues/64972
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 tools/actions/commit-queue.sh | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index 2ee7694aedd2..aa63a442377a 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -31,6 +31,8 @@ commit_queue_failed() {
 git config --local user.email "github-bot@iojs.org"
 git config --local user.name "Node.js GitHub Bot"
 
+SHOULD_ABORT=
+
 for pr in "$@"; do
   gh pr view "$pr" --json labels --jq ".labels" > labels.json
   # Skip PR if CI was requested
@@ -56,6 +58,14 @@ for pr in "$@"; do
     MULTIPLE_COMMIT_POLICY="--oneCommitMax"
   fi
 
+  if [ -n "$SHOULD_ABORT" ]; then
+    # If `git node land --abort` fails, we're in unknown state. Better to stop
+    # the script here, current PR was removed from the queue so it shouldn't
+    # interfere again in the future.
+    git node land --abort --yes
+    SHOULD_ABORT=
+  fi
+
   git node land --autorebase --yes $MULTIPLE_COMMIT_POLICY "$pr" >output 2>&1 || echo "Failed to land #${pr}"
   # cat here otherwise we'll be suppressing the output of git node land
   cat output
@@ -64,10 +74,8 @@ for pr in "$@"; do
   # if the "Landed in..." message was not on the output we assume land failed
   if ! grep -q '. Post "Landed in .*/pull/'"${pr}" output; then
     commit_queue_failed "$pr"
-    # If `git node land --abort` fails, we're in unknown state. Better to stop
-    # the script here, current PR was removed from the queue so it shouldn't
-    # interfere again in the future.
-    git node land --abort --yes
+    # Using a variable as there's no point in aborting if there are no PRs left in the queue.
+    SHOULD_ABORT=1
     continue
   fi
 

From ce0ca47023e9dfbe88442231ec986c6589b84dd9 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Fri, 7 Aug 2026 10:16:50 +0100
Subject: [PATCH 050/344] sqlite: clear SQLTagStore bindings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SQLTagStore reused cached statements without clearing values bound by a
previous execution. Clear bindings before binding new values and reject
parameters that do not correspond to template substitutions.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65041
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/node_sqlite.cc                        | 79 +++++++++++------------
 src/node_sqlite.h                         |  4 ++
 test/parallel/test-sqlite-template-tag.js | 37 +++++++++++
 3 files changed, 78 insertions(+), 42 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 1272deb42f11..41b0094a606b 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+bool SQLTagStore::ResetAndBindStatement(
+    Environment* env,
+    StatementSync* stmt,
+    const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = env->isolate();
+  int r = stmt->ResetStatement();
+  CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+  r = sqlite3_clear_bindings(stmt->statement_);
+  CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+  uint32_t n_params = args.Length() - 1;
+  int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+  if (param_count != static_cast<int>(n_params)) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env,
+        "SQLite parameters must be bound using template literal placeholders.");
+    return false;
+  }
+
+  for (int i = 0; i < param_count; ++i) {
+    if (!stmt->BindValue(args[i + 1], i + 1)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
 void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
   SQLTagStore* session;
   ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  uint32_t n_params = args.Length() - 1;
-  int r = stmt->ResetStatement();
-  CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-  int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-  for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
-    Local<Value> value = args[i + 1];
-    if (!stmt->BindValue(value, i + 1)) {
-      return;
-    }
+  if (!ResetAndBindStatement(env, stmt.get(), args)) {
+    return;
   }
 
   Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  uint32_t n_params = args.Length() - 1;
-  int r = stmt->ResetStatement();
-  CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-  int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-  for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
-    Local<Value> value = args[i + 1];
-    if (!stmt->BindValue(value, i + 1)) {
-      return;
-    }
+  if (!ResetAndBindStatement(env, stmt.get(), args)) {
+    return;
   }
 
   BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  uint32_t n_params = args.Length() - 1;
-  Isolate* isolate = env->isolate();
-
-  int r = stmt->ResetStatement();
-  CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-  int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-  for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
-    Local<Value> value = args[i + 1];
-    if (!stmt->BindValue(value, i + 1)) {
-      return;
-    }
+  if (!ResetAndBindStatement(env, stmt.get(), args)) {
+    return;
   }
 
   Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  uint32_t n_params = args.Length() - 1;
-  Isolate* isolate = env->isolate();
-
-  int r = stmt->ResetStatement();
-  CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-  int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-  for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
-    Local<Value> value = args[i + 1];
-    if (!stmt->BindValue(value, i + 1)) {
-      return;
-    }
+  if (!ResetAndBindStatement(env, stmt.get(), args)) {
+    return;
   }
 
   auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 6243b03e590d..675595e55025 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
  private:
   static BaseObjectPtr<StatementSync> PrepareStatement(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static bool ResetAndBindStatement(
+      Environment* env,
+      StatementSync* stmt,
+      const v8::FunctionCallbackInfo<v8::Value>& args);
   BaseObjectWeakPtr<DatabaseSync> database_;
   LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
   friend class StatementExecutionHelper;
diff --git a/test/parallel/test-sqlite-template-tag.js b/test/parallel/test-sqlite-template-tag.js
index 1a55148cb7b4..494f2d50f76f 100644
--- a/test/parallel/test-sqlite-template-tag.js
+++ b/test/parallel/test-sqlite-template-tag.js
@@ -90,6 +90,43 @@ test('queries with no results', () => {
   assert.strictEqual(count, 0);
 });
 
+test('rejects parameters outside of template expressions', () => {
+  const ldb = new DatabaseSync(':memory:');
+  const lsql = ldb.createTagStore();
+  ldb.exec(`
+    CREATE TABLE secrets(owner TEXT, token TEXT);
+    INSERT INTO secrets VALUES ('victim', 'secret');
+    CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+  `);
+
+  const expectedError = {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: /must be bound using template literal placeholders/,
+  };
+
+  for (const method of ['get', 'all', 'iterate']) {
+    // Prime the cached statement with a bound value before each attempt.
+    // eslint-disable-next-line no-unused-expressions
+    lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+    assert.throws(() => {
+      // eslint-disable-next-line no-unused-expressions
+      lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+    }, expectedError);
+  }
+
+  // eslint-disable-next-line no-unused-expressions
+  lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+  assert.throws(() => {
+    // eslint-disable-next-line no-unused-expressions
+    lsql.run`INSERT INTO transfers VALUES (?,?)`;
+  }, expectedError);
+  assert.strictEqual(
+    ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+    1);
+
+  ldb.close();
+});
+
 test('TagStore capacity, size, and clear', () => {
   assert.strictEqual(sql.capacity, 10);
   assert.strictEqual(sql.size, 0);

From c5588d71ad742860bb81747925330a84667d387a Mon Sep 17 00:00:00 2001
From: Augustin Mauroy <97875033+AugustinMauroy@users.noreply.github.com>
Date: Fri, 7 Aug 2026 11:29:48 +0200
Subject: [PATCH 051/344] doc: remove usage of `util.inherits`

Signed-off-by: Augustin Mauroy <97875033+AugustinMauroy@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/60817
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 doc/api/stream.md | 72 ++++++++++++++++++-----------------------------
 1 file changed, 28 insertions(+), 44 deletions(-)

diff --git a/doc/api/stream.md b/doc/api/stream.md
index 0000df868664..bb1199a7365a 100644
--- a/doc/api/stream.md
+++ b/doc/api/stream.md
@@ -3817,7 +3817,7 @@ changes:
 
 <!-- eslint-disable no-useless-constructor -->
 
-```js
+```cjs
 const { Writable } = require('node:stream');
 
 class MyWritable extends Writable {
@@ -3829,18 +3829,18 @@ class MyWritable extends Writable {
 }
 ```
 
-Or, when using pre-ES6 style constructors:
+<!-- eslint-disable no-useless-constructor -->
 
-```js
-const { Writable } = require('node:stream');
-const util = require('node:util');
+```mjs
+import { Writable } from 'node:stream';
 
-function MyWritable(options) {
-  if (!(this instanceof MyWritable))
-    return new MyWritable(options);
-  Writable.call(this, options);
+class MyWritable extends Writable {
+  constructor(options) {
+    // Calls the stream.Writable() constructor.
+    super(options);
+    // ...
+  }
 }
-util.inherits(MyWritable, Writable);
 ```
 
 Or, using the simplified constructor approach:
@@ -4190,20 +4190,6 @@ class MyReadable extends Readable {
 }
 ```
 
-Or, when using pre-ES6 style constructors:
-
-```js
-const { Readable } = require('node:stream');
-const util = require('node:util');
-
-function MyReadable(options) {
-  if (!(this instanceof MyReadable))
-    return new MyReadable(options);
-  Readable.call(this, options);
-}
-util.inherits(MyReadable, Readable);
-```
-
 Or, using the simplified constructor approach:
 
 ```js
@@ -4522,7 +4508,7 @@ changes:
 
 <!-- eslint-disable no-useless-constructor -->
 
-```js
+```cjs
 const { Duplex } = require('node:stream');
 
 class MyDuplex extends Duplex {
@@ -4533,18 +4519,17 @@ class MyDuplex extends Duplex {
 }
 ```
 
-Or, when using pre-ES6 style constructors:
+<!-- eslint-disable no-useless-constructor -->
 
-```js
-const { Duplex } = require('node:stream');
-const util = require('node:util');
+```mjs
+import { Duplex } from 'node:stream';
 
-function MyDuplex(options) {
-  if (!(this instanceof MyDuplex))
-    return new MyDuplex(options);
-  Duplex.call(this, options);
+class MyDuplex extends Duplex {
+  constructor(options) {
+    super(options);
+    // ...
+  }
 }
-util.inherits(MyDuplex, Duplex);
 ```
 
 Or, using the simplified constructor approach:
@@ -4719,7 +4704,7 @@ output on the `Readable` side is not consumed.
 
 <!-- eslint-disable no-useless-constructor -->
 
-```js
+```cjs
 const { Transform } = require('node:stream');
 
 class MyTransform extends Transform {
@@ -4730,18 +4715,17 @@ class MyTransform extends Transform {
 }
 ```
 
-Or, when using pre-ES6 style constructors:
+<!-- eslint-disable no-useless-constructor -->
 
-```js
-const { Transform } = require('node:stream');
-const util = require('node:util');
+```mjs
+import { Transform } from 'node:stream';
 
-function MyTransform(options) {
-  if (!(this instanceof MyTransform))
-    return new MyTransform(options);
-  Transform.call(this, options);
+class MyTransform extends Transform {
+  constructor(options) {
+    super(options);
+    // ...
+  }
 }
-util.inherits(MyTransform, Transform);
 ```
 
 Or, using the simplified constructor approach:

From 00c71fec936c063beeaa09fa705ebf1c2681e132 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9?= <contact.9a5d6388@renegade334.me.uk>
Date: Fri, 7 Aug 2026 14:06:02 +0100
Subject: [PATCH 052/344] dns: validate port range in `setServers()`

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/65021
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 lib/internal/dns/utils.js |  8 +++++---
 test/parallel/test-dns.js | 16 ++++++++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/lib/internal/dns/utils.js b/lib/internal/dns/utils.js
index 271731f87c43..8e70baffb904 100644
--- a/lib/internal/dns/utils.js
+++ b/lib/internal/dns/utils.js
@@ -24,6 +24,7 @@ const {
   validateArray,
   validateInt32,
   validateOneOf,
+  validatePort,
   validateString,
   validateUint32,
 } = require('internal/validators');
@@ -129,6 +130,7 @@ class ResolverBase {
         if (ipVersion !== 0) {
           const port = NumberParseInt(
             RegExpPrototypeSymbolReplace(addrSplitRE, serv, '$2')) || IANA_DNS_PORT;
+          validatePort(port);
           return ArrayPrototypePush(newSet, [ipVersion, match[1], port]);
         }
       }
@@ -138,13 +140,13 @@ class ResolverBase {
 
       if (addrSplitMatch) {
         const hostIP = addrSplitMatch[1];
-        const port = addrSplitMatch[2] || IANA_DNS_PORT;
+        const port = NumberParseInt(addrSplitMatch[2]) || IANA_DNS_PORT;
 
         ipVersion = isIP(hostIP);
 
         if (ipVersion !== 0) {
-          return ArrayPrototypePush(
-            newSet, [ipVersion, hostIP, NumberParseInt(port)]);
+          validatePort(port);
+          return ArrayPrototypePush(newSet, [ipVersion, hostIP, port]);
         }
       }
 
diff --git a/test/parallel/test-dns.js b/test/parallel/test-dns.js
index d6056d459a1b..d04877f5177e 100644
--- a/test/parallel/test-dns.js
+++ b/test/parallel/test-dns.js
@@ -90,6 +90,22 @@ assert(existing.length > 0);
   });
 }
 
+{
+  // Out-of-range ports, which should throw a clean error.
+  const invalidPorts = [2 ** 16, 2 ** 32, 2 ** 64];
+  invalidPorts.forEach((port) => {
+    assert.throws(
+      () => {
+        dns.setServers([`1.2.3.4:${port}`]);
+      },
+      {
+        name: 'RangeError',
+        code: 'ERR_SOCKET_BAD_PORT'
+      }
+    );
+  });
+}
+
 const goog = [
   '8.8.8.8',
   '8.8.4.4',

From 132c578e9795de450fb3a736d4d5d9ca083268cb Mon Sep 17 00:00:00 2001
From: Aviv Keller <me@aviv.sh>
Date: Fri, 7 Aug 2026 10:01:19 -0400
Subject: [PATCH 053/344] meta: add Aviv Keller to `.mailmap`

Signed-off-by: Aviv Keller <me@aviv.sh>
PR-URL: https://github.com/nodejs/node/pull/65048
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
---
 .mailmap | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.mailmap b/.mailmap
index 0860e8e01478..6cdb3bc4f739 100644
--- a/.mailmap
+++ b/.mailmap
@@ -55,6 +55,7 @@ Ashok Suthar <coderatlabs@gmail.com>
 Ashutosh Kumar Singh <singhjug1994@gmail.com>
 Atsuo Fukaya <fukayatsu@gmail.com>
 Austin Kelleher <austinlkelleher@gmail.com> <austin.kell47@gmail.com>
+Aviv Keller <me@aviv.sh>
 Azard <azardf4yy@gmail.com> <330815461@qq.com>
 Ben Lugavere <b.lugavere@gmail.com>
 Ben Noordhuis <info@bnoordhuis.nl> <ben@strongloop.com>

From 003a9137994dfd4f27401b920561a520aaffb8d9 Mon Sep 17 00:00:00 2001
From: Sumit Kumar Das <151006536+skdas20@users.noreply.github.com>
Date: Sat, 8 Aug 2026 12:59:13 +0530
Subject: [PATCH 054/344] doc: clarify sqlite bare parameter default

Signed-off-by: skdas20 <skdas5405@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62009
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/sqlite.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 96504fd43ebb..0af16c53da94 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -1135,13 +1135,13 @@ added: v22.5.0
   without the prefix character.
 
 The names of SQLite parameters begin with a prefix character. By default,
-`node:sqlite` requires that this prefix character is present when binding
-parameters. However, with the exception of dollar sign character, these
-prefix characters also require extra quoting when used in object keys.
+`node:sqlite` allows binding named parameters without this prefix character in
+the parameter object. With the exception of the dollar sign character, these
+prefix characters require extra quoting when used in object keys.
 
-To improve ergonomics, this method can be used to also allow bare named
-parameters, which do not require the prefix character in JavaScript code. There
-are several caveats to be aware of when enabling bare named parameters:
+This method enables or disables support for bare named parameters, which do not
+require the prefix character in JavaScript code. There are several caveats to
+be aware of when bare named parameters are enabled:
 
 * The prefix character is still required in SQL.
 * The prefix character is still allowed in JavaScript. In fact, prefixed names

From aa3b598e2e75854f62866726b966a4df4e039f9e Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 8 Aug 2026 09:29:24 +0200
Subject: [PATCH 055/344] tools: prefilter commit queue metadata

Run `git node metadata --readme` in the lightweight commit queue
selector before starting the checkout-heavy landing job.

The selector keeps `commit-queue` on PRs that are only waiting for
approvals, TSC approval count, or wait time. Other metadata failures
continue to the existing commit queue script so failure labels and
comments are still produced by the current landing path.

Fetch age-based, fast-track, and broader queue buckets before
deduplicating the list so not-yet-ready PRs do not crowd out PRs that
would otherwise have been selected.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64343
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 .github/workflows/commit-queue.yml | 128 ++++++++++++++++++-----
 doc/contributing/commit-queue.md   | 161 +++++++++++++++++++----------
 2 files changed, 208 insertions(+), 81 deletions(-)

diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 7af712268711..73c6e6bdee86 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -22,51 +22,44 @@ permissions:
   contents: read
 
 jobs:
-  get_mergeable_prs:
+  get_candidate_prs:
     permissions:
       pull-requests: read
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
-      numbers: ${{ steps.get_mergeable_prs.outputs.numbers }}
+      candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
-      - name: Get Pull Requests
-        id: get_mergeable_prs
+      - name: Get Pull Request Candidates
+        id: get_candidate_prs
         run: |
-          prs=$(gh pr list \
+          list_prs() {
+            gh pr list \
                   --repo "$GITHUB_REPOSITORY" \
                   --base "$GITHUB_REF_NAME" \
                   --label 'commit-queue' \
+                  "$@" \
                   --json 'number' \
-                  --search "created:<=$(date --date="2 days ago"  +"%Y-%m-%dT%H:%M:%S%z") -label:blocked" \
                   -t '{{ range . }}{{ .number }} {{ end }}' \
-                  --limit 100)
-          fast_track_prs=$(gh pr list \
-                  --repo "$GITHUB_REPOSITORY" \
-                  --base "$GITHUB_REF_NAME" \
-                  --label 'commit-queue' \
+                  --limit 100
+          }
+          aged_prs=$(list_prs \
+                  --search "created:<=$(date --date="2 days ago"  +"%Y-%m-%dT%H:%M:%S%z") -label:blocked")
+          fast_track_prs=$(list_prs \
                   --label 'fast-track' \
-                  --search "-label:blocked" \
-                  --json 'number' \
-                  -t '{{ range . }}{{ .number }} {{ end }}' \
-                  --limit 100)
-          numbers=$(echo $prs' '$fast_track_prs | jq -r -s 'unique | join(" ")')
-          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+                  --search "-label:blocked")
+          queued_prs=$(list_prs \
+                  --search "-label:blocked")
+          candidates=$(printf '%s %s %s\n' "$aged_prs" "$fast_track_prs" "$queued_prs" |
+                  jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
+          echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   commitQueue:
-    needs: get_mergeable_prs
-    if: needs.get_mergeable_prs.outputs.numbers != ''
+    needs: get_candidate_prs
+    if: needs.get_candidate_prs.outputs.candidates != ''
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          # A personal token is required because pushing with GITHUB_TOKEN will
-          # prevent commits from running CI after they land. It needs
-          # to be set here because `checkout` configures GitHub authentication
-          # for push as well.
-          token: ${{ secrets.GH_USER_TOKEN }}
-
       # Install dependencies
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -93,7 +86,86 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
+      - name: Filter Pull Requests
+        id: get_mergeable_prs
+        run: |
+          readme="${RUNNER_TEMP}/README.md"
+          curl -fsSLo "$readme" "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/README.md"
+
+          numbers=
+          # shellcheck disable=SC2086
+          for pr in $CANDIDATES; do
+            metadata="${RUNNER_TEMP}/metadata-${pr}.json"
+            output="${RUNNER_TEMP}/metadata-${pr}.txt"
+            if git node metadata "$pr" \
+                    --owner "$GITHUB_REPOSITORY_OWNER" \
+                    --repo "$REPOSITORY" \
+                    --readme "$readme" \
+                    --json > "$metadata" 2> "$output"; then
+              metadata_status=0
+            else
+              metadata_status=$?
+            fi
+
+            if [ -s "$output" ]; then
+              cat "$output"
+            fi
+
+            case "$metadata_status" in
+              0|2[0-9]|4[0-9]) ;;
+              *)
+                echo "git node metadata failed for pr ${pr} with exit code ${metadata_status}"
+                exit 1
+                ;;
+            esac
+
+            metadata_exit_code=$(jq -r '.exitCode' "$metadata") || {
+              echo "failed to parse metadata JSON for pr ${pr}"
+              exit 1
+            }
+            if [ "$metadata_exit_code" != "$metadata_status" ]; then
+              echo "metadata JSON exitCode mismatch for pr ${pr}"
+              exit 1
+            fi
+            metadata_reason_codes=$(jq -r '.reasonCodes | join(", ")' "$metadata") || {
+              echo "failed to parse metadata reason codes for pr ${pr}"
+              exit 1
+            }
+
+            if [ "$metadata_status" -eq 0 ]; then
+              echo "pr ${pr} is ready for the commit queue"
+              numbers="$numbers $pr"
+              continue
+            fi
+
+            if [ "$metadata_status" -ge 20 ] && [ "$metadata_status" -le 29 ]; then
+              echo "pr ${pr} skipped, not ready to land"
+              echo "reason codes: ${metadata_reason_codes}"
+              continue
+            fi
+
+            echo "pr ${pr} will be handled by the commit queue"
+            echo "reason codes: ${metadata_reason_codes}"
+            numbers="$numbers $pr"
+          done
+
+          numbers=$(echo "$numbers" | xargs)
+          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+        env:
+          CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
+          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        if: steps.get_mergeable_prs.outputs.numbers != ''
+        with:
+          # A personal token is required because pushing with GITHUB_TOKEN will
+          # prevent commits from running CI after they land. It needs
+          # to be set here because `checkout` configures GitHub authentication
+          # for push as well.
+          token: ${{ secrets.GH_USER_TOKEN }}
+
       - name: Start the Commit Queue
-        run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ needs.get_mergeable_prs.outputs.numbers }}
+        if: steps.get_mergeable_prs.outputs.numbers != ''
+        run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
diff --git a/doc/contributing/commit-queue.md b/doc/contributing/commit-queue.md
index 6cedc833029e..08f01b32d4ee 100644
--- a/doc/contributing/commit-queue.md
+++ b/doc/contributing/commit-queue.md
@@ -1,36 +1,48 @@
 # Commit queue
 
-_tl;dr: You can land pull requests by adding the `commit-queue` label to it._
+_tl;dr: You can ask the queue to land pull requests by adding the
+`commit-queue` label to them._
 
 Commit Queue is a feature for the project which simplifies the
 landing process by automating it via GitHub Actions. With it, collaborators can
-land pull requests by adding the `commit-queue` label to a PR. All
-checks will run via `@node-core/utils`, and if the pull request is ready to
-land, the Action will rebase it and push to `main`.
+queue pull requests for landing by adding the `commit-queue` label to a PR. The
+selector checks readiness with `@node-core/utils`. If the pull request is only
+blocked on a deferrable condition, currently wait time, the queue leaves the
+label in place and retries later. Other failures continue to the existing
+landing and failure-reporting path.
 
 This document gives an overview of how the Commit Queue works, as well as
 implementation details, reasoning for design choices, and current limitations.
 
 ## Overview
 
-From a high-level, the Commit Queue works as follow:
-
-1. Collaborators will add `commit-queue` label to pull requests ready to land
-2. Every five minutes the queue will do the following for each mergeable pull request
-   with the label:
-   1. Check if the PR also has a `request-ci` label (if it has, skip this PR
+From a high-level, the Commit Queue works as follows:
+
+1. Collaborators will add `commit-queue` label to pull requests they want the
+   queue to land. The label can be added before the pull request has completed
+   its wait time, or before requested CI has finished. Required approvals must
+   already be in place. The commit queue does not request CI on its own.
+2. On each scheduled run, the queue builds a candidate list from open pull
+   requests with the `commit-queue` label and without the `blocked` label. The
+   workflow uses a five-minute cron, but GitHub Actions scheduled workflows are
+   not guaranteed to run exactly every five minutes. For each candidate, the
+   queue will:
+   1. In the landing job, install and configure `@node-core/utils`, then run a
+      metadata-only readiness check without checking out the repository
+   2. If the metadata check exits with a deferrable readiness code, meaning
+      the PR is only blocked on wait time, keep the `commit-queue` label and
+      skip this PR until a later queue run
+   3. Check if the PR also has a `request-ci` label (if it has, skip this PR
       since it's pending a CI run)
-   2. Check if the last Jenkins CI is finished running (if it is not, skip this
-      PR)
-   3. Remove the `commit-queue` label
-   4. Run `git node land <pr> --oneCommitMax`
-   5. If it fails:
-      1. Abort `git node land` session
-      2. Add `commit-queue-failed` label to the PR
-      3. Leave a comment on the PR with the output from `git node land`
-      4. Skip next steps, go to next PR in the queue
-   6. If it succeeds:
-      1. Push the changes to nodejs/node
+   4. Check whether GitHub checks are still running (if they are, skip this PR)
+   5. Remove the `commit-queue` label and run `git node land`
+   6. If it fails:
+      1. Add the `commit-queue-failed` label to the PR
+      2. Leave a comment on the PR with the output from `git node land`
+      3. Abort the `git node land` session. If the abort succeeds, continue to
+         the next PR; otherwise, stop the queue in an unknown state
+   7. If it succeeds:
+      1. Push or merge the changes into nodejs/node
       2. Leave a comment on the PR with `Landed in ...`
       3. Close the PR
       4. Go to next PR in the queue
@@ -51,7 +63,7 @@ of the commit queue:
    guidelines or be a valid [`fixup!`](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---fixupamendrewordltcommitgt)
    commit that will be correctly handled by the [`--autosquash`](https://git-scm.com/docs/git-rebase#Documentation/git-rebase.txt---autosquash)
    option
-2. A CI must've ran and succeeded since the last change on the PR
+2. A CI must have run and succeeded since the last change on the PR
 3. A collaborator must have approved the PR since the last change
 4. Only Jenkins CI and GitHub Actions are checked (V8 CI and CITGM are ignored)
 5. The PR must target the `main` branch (PRs opened against other branches, such
@@ -59,10 +71,15 @@ of the commit queue:
 
 ## Implementation
 
-The [action](../../.github/workflows/commit-queue.yml) will run on scheduler
-events every five minutes. Five minutes is the smallest number accepted by
-the scheduler. The scheduler is not guaranteed to run every five minutes, it
-might take longer between runs.
+The [action](../../.github/workflows/commit-queue.yml) runs on scheduled events.
+It uses a five-minute cron because that is the smallest interval accepted by
+GitHub Actions. Scheduled workflows are not guaranteed to run exactly at that
+cadence and might take longer between runs.
+
+The workflow also uses a concurrency group so only one commit queue run can be
+active at a time. If a scheduled run starts while a previous run is still
+running, GitHub Actions keeps at most one pending run for the same concurrency
+group. A newer pending run replaces an older pending run.
 
 Using the scheduler is preferable over using pull\_request\_target for two
 reasons:
@@ -76,41 +93,79 @@ reasons:
    commit, meaning we wouldn't be able to use it for already opened PRs
    without rebasing them first.
 
-`@node-core/utils` is configured with a personal token and
-a Jenkins token from
-[@nodejs-github-bot](https://github.com/nodejs/github-bot).
-`octokit/graphql-action` is used to fetch all pull requests with the
-`commit-queue` label. The output is a JSON payload, so `jq` is used to turn
-that into a list of PR ids we can pass as arguments to
-[`commit-queue.sh`](../../tools/actions/commit-queue.sh).
-
-> The personal token only needs permission for public repositories and to read
-> profiles, we can use the GITHUB\_TOKEN for write operations. Jenkins token is
+The workflow starts with a small candidate job that uses GitHub CLI to fetch
+pull requests with the `commit-queue` label. It first fetches the same
+age-based and fast-track buckets the queue used before accepting early queue
+requests, then fetches the broader queue and de-duplicates the result. This
+keeps not-yet-ready PRs from crowding out PRs that the previous query would
+have selected if GitHub paginates or caps a query result.
+
+If there are candidate PRs, the landing job installs and configures
+`@node-core/utils` once with a personal token and a Jenkins token from
+[@nodejs-github-bot](https://github.com/nodejs/github-bot). It then downloads
+the workflow commit's README without checking out the repository and runs
+`git node metadata --readme --json` for each candidate. This uses the same
+`@node-core/utils` PR readiness checks as `git node land`, but does not clone,
+fetch, or merge the PR. The filter consumes the structured metadata result
+and its exit code instead of matching human-readable output:
+
+* exit code `0`: the PR is ready and is passed to
+  [`commit-queue.sh`](../../tools/actions/commit-queue.sh)
+* exit codes `20`-`29`: the PR is not ready for a deferrable metadata reason,
+  currently wait time, so it keeps the `commit-queue` label and is retried
+  later
+* exit codes `40`-`49`: the PR has a hard or mixed metadata readiness failure
+  and is passed to [`commit-queue.sh`](../../tools/actions/commit-queue.sh)
+
+The `20`-`29` exit code range is reserved by `@node-core/utils` for deferrable
+metadata readiness states, and `40`-`49` is reserved for hard metadata failure
+states. Unknown filter failures fail the workflow before starting the landing
+script and leave PR labels unchanged so the queue can retry on a later
+scheduled run. PRs passed through with exit code `40`-`49` continue through
+`commit-queue.sh`. The workflow checks out the repository only when at least
+one PR remains after filtering. The script still applies its existing
+`request-ci` and pending-check deferrals before removing the queue label and
+reporting a hard failure.
+
+> The personal token needs permission for public repositories and to read
+> profiles. It is used by `@node-core/utils` and by the landing job for
+> checkout, label and comment updates, merging, and pushing. Jenkins token is
 > required to check CI status.
 
 `commit-queue.sh` receives the following positional arguments:
 
 1. The repository owner
 2. The repository name
-3. The Action GITHUB\_TOKEN
-4. Every positional argument starting at this one will be a pull request ID of
+3. Every positional argument starting at this one will be a pull request ID of
    a pull request with commit-queue set.
 
-The script will iterate over the pull requests. `ncu-ci` is used to check if
-the last CI is still pending, and calls to the GitHub API are used to check if
-the PR is waiting for CI to start (`request-ci` label). The PR is skipped if CI
-is pending. No other CI validation is done here since `git node land` will fail
-if the last CI failed.
-
-The script removes the `commit-queue` label. It then runs `git node land`,
-forwarding stdout and stderr to a file. If any errors happen,
-`git node land --abort` is run, and then a `commit-queue-failed` label is added
-to the PR, as well as a comment with the output of `git node land`.
-
-If no errors happen during `git node land`, the script will use the
-`GITHUB_TOKEN` to push the changes to `main`, and then will leave a
-`Landed in ...` comment in the PR, and then will close it. Iteration continues
-until all PRs have done the steps above.
+The script will iterate over the pull requests. GitHub CLI is used to check if
+the PR is waiting for CI to start (`request-ci` label) or still has pending
+GitHub checks. The PR is skipped if CI is pending. No other CI validation is
+done here since `git node land` will fail if the last CI failed.
+
+The script removes the `commit-queue` label, then runs `git node land`,
+forwarding stdout and stderr to a file. PRs that are only blocked on wait time
+should have already been filtered by the metadata check. If a hard readiness
+failure appears between the metadata filter and `git node land`, the landing
+job adds a `commit-queue-failed` label to the PR, leaves a comment with the
+output of `git node land`, and then aborts the landing session. If the abort
+fails, the queue stops instead of continuing in an unknown state.
+
+Fast-tracked PRs use the metadata check before checkout and the landing script.
+If the fast-track request has not yet received enough collaborator thumbs-up,
+the queue keeps the `commit-queue` label and retries until either the
+fast-track request is approved or the PR becomes landable through the regular
+wait-time rules. The commit queue does not create the fast-track request
+comment; that is handled when the `fast-track` label is added. If that comment
+is missing, the queue reports the failure instead of keeping the PR queued.
+
+If no errors happen during `git node land`, the script either pushes the direct
+rebase landing to `main` or uses GitHub's squash merge API for single-commit and
+fixup landings. It then leaves a `Landed in ...` comment in the PR. GitHub
+closes PRs merged through the merge API automatically; for direct pushes, the
+script closes the PR. Iteration continues until all PRs have done the steps
+above.
 
 ## Reverting broken commits
 

From 06b1758dcdffaa7f6ae65ca3a5411af6e3afa095 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sat, 8 Aug 2026 00:29:36 -0700
Subject: [PATCH 056/344] sqlite: reject non-positive backup rates

Passing a rate of 0 to backup() causes sqlite3_backup_step() to copy
no pages. The backup job then continually reschedules itself and the
returned promise never settles.

Require backup rates to be positive integers to prevent zero-work
backup jobs.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/64893
Fixes: https://github.com/nodejs/node/issues/64892
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/sqlite.md                    | 2 +-
 src/node_sqlite.cc                   | 6 ++++++
 test/parallel/test-sqlite-backup.mjs | 9 +++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 0af16c53da94..74d258be6815 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -1366,7 +1366,7 @@ changes:
     database that have been added with [`ATTACH DATABASE`][] **Default:** `'main'`.
   * `target` {string} Name of the target database. This can be `'main'` (the default primary database) or any other
     database that have been added with [`ATTACH DATABASE`][] **Default:** `'main'`.
-  * `rate` {number} Number of pages to be transmitted in each batch of the backup. **Default:** `100`.
+  * `rate` {integer} Positive number of pages to be transmitted in each batch of the backup. **Default:** `100`.
   * `progress` {Function} An optional callback function that will be called after each backup step. The argument passed
     to this callback is an {Object} with `remainingPages` and `totalPages` properties, describing the current progress
     of the backup operation.
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 41b0094a606b..926b1ef298ae 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -2200,6 +2200,12 @@ void Backup(const FunctionCallbackInfo<Value>& args) {
         return;
       }
       rate = rate_v.As<Int32>()->Value();
+      if (rate <= 0) {
+        THROW_ERR_OUT_OF_RANGE(
+            env->isolate(),
+            "The \"options.rate\" argument must be a positive integer.");
+        return;
+      }
     }
 
     Local<Value> source_v;
diff --git a/test/parallel/test-sqlite-backup.mjs b/test/parallel/test-sqlite-backup.mjs
index 80061ee6601d..d1e09569e1ca 100644
--- a/test/parallel/test-sqlite-backup.mjs
+++ b/test/parallel/test-sqlite-backup.mjs
@@ -124,6 +124,15 @@ describe('backup()', () => {
       message: 'The "options.rate" argument must be an integer.'
     });
 
+    for (const rate of [0, -1]) {
+      t.assert.throws(() => {
+        backup(database, 'hello.db', { rate });
+      }, {
+        code: 'ERR_OUT_OF_RANGE',
+        message: 'The "options.rate" argument must be a positive integer.'
+      });
+    }
+
     t.assert.throws(() => {
       backup(database, 'hello.db', {
         progress: 'invalid'

From 7f3a42035c4be7771b5358dc7f323519ea41d08e Mon Sep 17 00:00:00 2001
From: "Kamat, Trivikram" <16024985+trivikr@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:18:53 -0700
Subject: [PATCH 057/344] test: use libuv clock for immediate queue test

Use getLibuvNow() when waiting for the timeout to expire. Date.now()
may have different precision from libuv's clock, causing the immediate
queue to run an extra iteration on platforms with coarse timers.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/64889
Refs: https://github.com/nodejs/reliability/issues?q=sort%3Aupdated-desc%20test-timers-immediate-queue
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 test/parallel/test-timers-immediate-queue.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/test/parallel/test-timers-immediate-queue.js b/test/parallel/test-timers-immediate-queue.js
index 8b433ddedbf4..517bb280d49d 100644
--- a/test/parallel/test-timers-immediate-queue.js
+++ b/test/parallel/test-timers-immediate-queue.js
@@ -19,9 +19,13 @@
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+// Flags: --expose-internals --no-warnings
+
 'use strict';
 require('../common');
 const assert = require('assert');
+const { internalBinding } = require('internal/test/binding');
+const timersBinding = internalBinding('timers');
 
 // setImmediate should run clear its queued cbs once per event loop turn
 // but immediates queued while processing the current queue should happen
@@ -38,8 +42,8 @@ const QUEUE = 10;
 function run() {
   if (hit === 0) {
     setTimeout(() => { ticked = true; }, 1);
-    const now = Date.now();
-    while (Date.now() - now < 2);
+    const now = timersBinding.getLibuvNow();
+    while (timersBinding.getLibuvNow() - now < 2);
   }
 
   if (ticked) return;

From 89d390559525b7d7545a8253841cff8e27b23a23 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 8 Aug 2026 10:36:58 +0200
Subject: [PATCH 058/344] tools: move ncu config to global for commit queue

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65132
Refs: https://github.com/nodejs/node/pull/64343
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 .github/workflows/commit-queue.yml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 73c6e6bdee86..16cb6fef3e3a 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -74,13 +74,14 @@ jobs:
 
       - name: Configure @node-core/utils
         run: |
-          ncu-config set branch "${GITHUB_REF_NAME}"
-          ncu-config set upstream origin
-          ncu-config set username "$USERNAME"
-          ncu-config set token "$GITHUB_TOKEN"
-          ncu-config set jenkins_token "$JENKINS_TOKEN"
-          ncu-config set repo "${REPOSITORY}"
-          ncu-config set owner "${GITHUB_REPOSITORY_OWNER}"
+          # Keep the config outside the workspace so checkout does not remove it.
+          ncu-config --global set branch "${GITHUB_REF_NAME}"
+          ncu-config --global set upstream origin
+          ncu-config --global set username "$USERNAME"
+          ncu-config --global set token "$GITHUB_TOKEN"
+          ncu-config --global set jenkins_token "$JENKINS_TOKEN"
+          ncu-config --global set repo "${REPOSITORY}"
+          ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}

From 82b2d9c08d29e430233393ad0e3b79bc371fc155 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 8 Aug 2026 14:18:49 +0200
Subject: [PATCH 059/344] test: update passphrases to comply with the next
 OpenSSL FIPS mode

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65077
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/parallel/test-crypto-key-store.js    | 7 ++++---
 test/parallel/test-crypto-no-algorithm.js | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/test/parallel/test-crypto-key-store.js b/test/parallel/test-crypto-key-store.js
index 72826afaaeff..b6f012416673 100644
--- a/test/parallel/test-crypto-key-store.js
+++ b/test/parallel/test-crypto-key-store.js
@@ -109,21 +109,22 @@ const data = Buffer.from('hello store');
 
 {
   // Encrypted PKCS#8 with passphrase via { key: url, passphrase }.
+  const passphrase = 'correct-passphrase';
   const { privateKey, publicKey } = generateKeyPairSync('ed25519');
   const file = path.join(tmpdir.path, 'enc.pem');
   fs.writeFileSync(file, privateKey.export({
-    format: 'pem', type: 'pkcs8', cipher: 'aes-256-cbc', passphrase: 'pw',
+    format: 'pem', type: 'pkcs8', cipher: 'aes-256-cbc', passphrase,
   }));
   const url = pathToFileURL(file);
 
-  const sig = sign(null, data, { key: url, passphrase: Buffer.from('pw') });
+  const sig = sign(null, data, { key: url, passphrase: Buffer.from(passphrase) });
   assert.strictEqual(verify(null, data, publicKey, sig), true);
 
   assert.throws(() => createPrivateKey(url), {
     code: 'ERR_MISSING_PASSPHRASE',
   });
 
-  assert.throws(() => createPrivateKey({ key: url, passphrase: 'bad' }),
+  assert.throws(() => createPrivateKey({ key: url, passphrase: 'wrong-passphrase' }),
                 common.expectsError({
                   name: 'Error',
                   code: /^ERR_OSSL_/,
diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js
index 3a9473dfb165..90d19ff97fcb 100644
--- a/test/parallel/test-crypto-no-algorithm.js
+++ b/test/parallel/test-crypto-no-algorithm.js
@@ -30,7 +30,7 @@ if (isMainThread) {
   const derivations = [
     ['HKDF', () => crypto.hkdfSync('sha256', Buffer.alloc(32), Buffer.alloc(8),
                                    Buffer.alloc(0), 32)],
-    ['PBKDF2', () => crypto.pbkdf2Sync('secret', Buffer.alloc(16), 1000, 32,
+    ['PBKDF2', () => crypto.pbkdf2Sync('passphrase', Buffer.alloc(16), 1000, 32,
                                        'sha256')],
   ];
   for (const { 0: name, 1: derive } of derivations) {

From ee7bf09090ca4f7a3a75c4ae57a91395cc5ba08d Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Sun, 19 Jul 2026 19:33:14 +0800
Subject: [PATCH 060/344] zlib: validate pledgedSrcSize for sync zstd

Zstd replaces a configured pledged source size with the input size when
the first call to ZSTD_compressStream2() uses ZSTD_e_end. Track consumed
input in Node and report ZSTD_error_srcSize_wrong when the completed
frame does not match the original pledge.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64601
Fixes: https://github.com/nodejs/node/issues/64600
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 src/node_zlib.cc                              | 23 +++++++-
 .../test-zlib-zstd-pledged-src-size.js        | 55 ++++++++++++++++---
 2 files changed, 70 insertions(+), 8 deletions(-)

diff --git a/src/node_zlib.cc b/src/node_zlib.cc
index 638982c7ede3..af82aa2ae73b 100644
--- a/src/node_zlib.cc
+++ b/src/node_zlib.cc
@@ -47,10 +47,11 @@
 
 #include <sys/types.h>
 
+#include <atomic>
 #include <cerrno>
 #include <cstdlib>
 #include <cstring>
-#include <atomic>
+#include <optional>
 
 namespace node {
 
@@ -349,6 +350,7 @@ class ZstdCompressContext final : public ZstdContext {
   DeleteFnPtr<ZSTD_CCtx, ZstdCompressContext::FreeZstd> cctx_;
 
   uint64_t pledged_src_size_ = ZSTD_CONTENTSIZE_UNKNOWN;
+  std::optional<uint64_t> consumed_src_size_;
 };
 
 class ZstdDecompressContext final : public ZstdContext {
@@ -1661,6 +1663,11 @@ void ZstdCompressContext::Close() {
 CompressionError ZstdCompressContext::Init(uint64_t pledged_src_size,
                                            std::string_view dictionary) {
   pledged_src_size_ = pledged_src_size;
+  if (pledged_src_size == ZSTD_CONTENTSIZE_UNKNOWN) {
+    consumed_src_size_.reset();
+  } else {
+    consumed_src_size_ = 0;
+  }
 #ifdef NODE_BUNDLED_ZSTD
   ZSTD_customMem custom_mem = {
       CompressionStreamMemoryOwner::AllocForBrotli,
@@ -1700,12 +1707,26 @@ CompressionError ZstdCompressContext::ResetStream() {
 }
 
 void ZstdCompressContext::DoThreadPoolWork() {
+  // Zstd overrides a configured pledge when the first call uses ZSTD_e_end.
+  size_t const input_pos = input_.pos;
   size_t const remaining =
       ZSTD_compressStream2(cctx_.get(), &output_, &input_, flush_);
+  if (consumed_src_size_.has_value()) {
+    *consumed_src_size_ += input_.pos - input_pos;
+  }
   if (ZSTD_isError(remaining)) {
     error_ = ZSTD_getErrorCode(remaining);
     error_code_string_ = ZstdStrerror(error_);
     error_string_ = ZSTD_getErrorString(error_);
+  } else if (remaining == 0 && flush_ == ZSTD_e_end &&
+             consumed_src_size_.has_value()) {
+    uint64_t const consumed_src_size = *consumed_src_size_;
+    consumed_src_size_.reset();
+    if (consumed_src_size != pledged_src_size_) {
+      error_ = ZSTD_error_srcSize_wrong;
+      error_code_string_ = ZstdStrerror(error_);
+      error_string_ = ZSTD_getErrorString(error_);
+    }
   }
 }
 
diff --git a/test/parallel/test-zlib-zstd-pledged-src-size.js b/test/parallel/test-zlib-zstd-pledged-src-size.js
index 4a5f27394c66..a0b1babd3f73 100644
--- a/test/parallel/test-zlib-zstd-pledged-src-size.js
+++ b/test/parallel/test-zlib-zstd-pledged-src-size.js
@@ -3,6 +3,11 @@ const common = require('../common');
 const assert = require('assert');
 const zlib = require('zlib');
 
+const pledgedSrcSizeError = {
+  code: 'ZSTD_error_srcSize_wrong',
+  errno: zlib.constants.ZSTD_error_srcSize_wrong,
+};
+
 function compressWithPledgedSrcSize({ pledgedSrcSize, actualSrcSize }) {
   return new Promise((resolve, reject) => {
     const compressor = zlib.createZstdCompress({ pledgedSrcSize });
@@ -18,23 +23,59 @@ function compressWithPledgedSrcSize({ pledgedSrcSize, actualSrcSize }) {
     // Compression should only succeed if sizes match
     assert.strictEqual(pledgedSrcSize, actualSrcSize);
   }, (error) => {
-    assert.strictEqual(error.code, 'ZSTD_error_srcSize_wrong');
+    assert.strictEqual(error.code, pledgedSrcSizeError.code);
+    assert.strictEqual(error.errno, pledgedSrcSizeError.errno);
     // Size error should only happen when sizes do not match
     assert.notStrictEqual(pledgedSrcSize, actualSrcSize);
   }).then(common.mustCall());
 }
 
-compressWithPledgedSrcSize({ pledgedSrcSize: 0, actualSrcSize: 0 });
+function compressSyncWithPledgedSrcSize({ pledgedSrcSize, actualSrcSize }) {
+  const compress = () => zlib.zstdCompressSync(
+    'x'.repeat(actualSrcSize),
+    { pledgedSrcSize },
+  );
+
+  if (pledgedSrcSize === actualSrcSize) {
+    compress();
+  } else {
+    assert.throws(compress, pledgedSrcSizeError);
+  }
+}
 
-compressWithPledgedSrcSize({ pledgedSrcSize: 0, actualSrcSize: 42 });
+const testCases = [
+  { pledgedSrcSize: 0, actualSrcSize: 0 },
+  { pledgedSrcSize: 0, actualSrcSize: 42 },
+  { pledgedSrcSize: 1, actualSrcSize: 42 },
+  { pledgedSrcSize: 13, actualSrcSize: 42 },
+  { pledgedSrcSize: 42, actualSrcSize: 0 },
+  { pledgedSrcSize: 42, actualSrcSize: 13 },
+  { pledgedSrcSize: 42, actualSrcSize: 42 },
+];
 
-compressWithPledgedSrcSize({ pledgedSrcSize: 13, actualSrcSize: 42 });
+for (const testCase of testCases) {
+  compressWithPledgedSrcSize(testCase);
+  compressSyncWithPledgedSrcSize(testCase);
+}
 
-compressWithPledgedSrcSize({ pledgedSrcSize: 42, actualSrcSize: 0 });
+const retryInput = Buffer.allocUnsafe(256 * 1024);
+let randomState = 0x12345678;
+for (let i = 0; i < retryInput.length; i++) {
+  randomState = (Math.imul(randomState, 1664525) + 1013904223) | 0;
+  retryInput[i] = randomState >>> 24;
+}
 
-compressWithPledgedSrcSize({ pledgedSrcSize: 42, actualSrcSize: 13 });
+const compressed = zlib.zstdCompressSync(retryInput, {
+  pledgedSrcSize: retryInput.length,
+  chunkSize: 64,
+});
+assert.ok(compressed.length > 64);
+assert.deepStrictEqual(zlib.zstdDecompressSync(compressed), retryInput);
 
-compressWithPledgedSrcSize({ pledgedSrcSize: 42, actualSrcSize: 42 });
+assert.throws(() => zlib.zstdCompressSync(retryInput, {
+  pledgedSrcSize: retryInput.length - 1,
+  chunkSize: 64,
+}), pledgedSrcSizeError);
 
 function assertInvalidPledgedSrcSize(pledgedSrcSize, expected) {
   assert.throws(

From ca885876f62d3036b85a7bfdbb070aa6cae36620 Mon Sep 17 00:00:00 2001
From: Ali Hassan <24819103+thisalihassan@users.noreply.github.com>
Date: Sat, 8 Aug 2026 18:54:01 +0500
Subject: [PATCH 061/344] sqlite: refactor error helpers and user function
 pointers

Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: https://github.com/nodejs/node/pull/62794
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node_sqlite.cc | 119 +++++++++++++++++++++------------------------
 src/node_sqlite.h  |   4 +-
 2 files changed, 57 insertions(+), 66 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 926b1ef298ae..2a36e464ccf2 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -170,59 +170,49 @@ static constexpr const LimitInfo* GetLimitInfoFromName(std::string_view name) {
   return nullptr;
 }
 
-inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate,
-                                            const char* message) {
+namespace {
+MaybeLocal<Object> CreateSQLiteErrorImpl(Isolate* isolate,
+                                         const char* message,
+                                         const char* errstr,
+                                         int errcode) {
+  Environment* env = Environment::GetCurrent(isolate);
+  Local<Context> context = isolate->GetCurrentContext();
   Local<String> js_msg;
   Local<Object> e;
-  Environment* env = Environment::GetCurrent(isolate);
   if (!String::NewFromUtf8(isolate, message).ToLocal(&js_msg) ||
-      !Exception::Error(js_msg)
-           ->ToObject(isolate->GetCurrentContext())
-           .ToLocal(&e) ||
-      e->Set(isolate->GetCurrentContext(),
-             env->code_string(),
-             env->err_sqlite_error_string())
+      !Exception::Error(js_msg)->ToObject(context).ToLocal(&e) ||
+      e->Set(context, env->code_string(), env->err_sqlite_error_string())
           .IsNothing()) {
     return MaybeLocal<Object>();
   }
+
+  if (errstr != nullptr) {
+    Local<String> js_errstr;
+    if (!String::NewFromUtf8(isolate, errstr).ToLocal(&js_errstr) ||
+        e->Set(context, env->errcode_string(), Integer::New(isolate, errcode))
+            .IsNothing() ||
+        e->Set(context, env->errstr_string(), js_errstr).IsNothing()) {
+      return MaybeLocal<Object>();
+    }
+  }
   return e;
 }
+}  // namespace
+
+inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate,
+                                            const char* message) {
+  return CreateSQLiteErrorImpl(isolate, message, nullptr, 0);
+}
 
 inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate, int errcode) {
   const char* errstr = sqlite3_errstr(errcode);
-  Local<String> js_errmsg;
-  Local<Object> e;
-  Environment* env = Environment::GetCurrent(isolate);
-  if (!String::NewFromUtf8(isolate, errstr).ToLocal(&js_errmsg) ||
-      !CreateSQLiteError(isolate, errstr).ToLocal(&e) ||
-      e->Set(env->context(),
-             env->errcode_string(),
-             Integer::New(isolate, errcode))
-          .IsNothing() ||
-      e->Set(env->context(), env->errstr_string(), js_errmsg).IsNothing()) {
-    return MaybeLocal<Object>();
-  }
-  return e;
+  return CreateSQLiteErrorImpl(isolate, errstr, errstr, errcode);
 }
 
 inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate, sqlite3* db) {
   int errcode = sqlite3_extended_errcode(db);
-  const char* errstr = sqlite3_errstr(errcode);
-  const char* errmsg = sqlite3_errmsg(db);
-  Local<String> js_errmsg;
-  Local<Object> e;
-  Environment* env = Environment::GetCurrent(isolate);
-  if (!String::NewFromUtf8(isolate, errstr).ToLocal(&js_errmsg) ||
-      !CreateSQLiteError(isolate, errmsg).ToLocal(&e) ||
-      e->Set(isolate->GetCurrentContext(),
-             env->errcode_string(),
-             Integer::New(isolate, errcode))
-          .IsNothing() ||
-      e->Set(isolate->GetCurrentContext(), env->errstr_string(), js_errmsg)
-          .IsNothing()) {
-    return MaybeLocal<Object>();
-  }
-  return e;
+  return CreateSQLiteErrorImpl(
+      isolate, sqlite3_errmsg(db), sqlite3_errstr(errcode), errcode);
 }
 
 void JSValueToSQLiteResult(Isolate* isolate,
@@ -307,14 +297,14 @@ inline MaybeLocal<Value> NullableSQLiteStringToValue(Isolate* isolate,
 class CustomAggregate {
  public:
   explicit CustomAggregate(Environment* env,
-                           DatabaseSync* db,
+                           BaseObjectWeakPtr<DatabaseSync> db,
                            bool use_bigint_args,
                            Local<Value> start,
                            Local<Function> step_fn,
                            Local<Function> inverse_fn,
                            Local<Function> result_fn)
       : env_(env),
-        db_(db),
+        db_(std::move(db)),
         use_bigint_args_(use_bigint_args),
         start_(env->isolate(), start),
         step_fn_(env->isolate(), step_fn),
@@ -350,7 +340,7 @@ class CustomAggregate {
                                Global<Function> CustomAggregate::*mptr) {
     CustomAggregate* self =
         static_cast<CustomAggregate*>(sqlite3_user_data(ctx));
-    CallbackDepthGuard guard(self->db_);
+    CallbackDepthGuard guard(self->db_.get());
     Environment* env = self->env_;
     Isolate* isolate = env->isolate();
     auto agg = self->GetAggregate(ctx);
@@ -408,7 +398,7 @@ class CustomAggregate {
   static inline void xValueBase(sqlite3_context* ctx, bool is_final) {
     CustomAggregate* self =
         static_cast<CustomAggregate*>(sqlite3_user_data(ctx));
-    CallbackDepthGuard guard(self->db_);
+    CallbackDepthGuard guard(self->db_.get());
     Environment* env = self->env_;
     Isolate* isolate = env->isolate();
     auto agg = self->GetAggregate(ctx);
@@ -487,7 +477,7 @@ class CustomAggregate {
   }
 
   Environment* env_;
-  DatabaseSync* db_;
+  BaseObjectWeakPtr<DatabaseSync> db_;
   bool use_bigint_args_;
   Global<Value> start_;
   Global<Function> step_fn_;
@@ -670,11 +660,11 @@ class BackupJob : public ThreadPoolWork {
 
 UserDefinedFunction::UserDefinedFunction(Environment* env,
                                          Local<Function> fn,
-                                         DatabaseSync* db,
+                                         BaseObjectWeakPtr<DatabaseSync> db,
                                          bool use_bigint_args)
     : env_(env),
       fn_(env->isolate(), fn),
-      db_(db),
+      db_(std::move(db)),
       use_bigint_args_(use_bigint_args) {}
 
 UserDefinedFunction::~UserDefinedFunction() {}
@@ -684,7 +674,7 @@ void UserDefinedFunction::xFunc(sqlite3_context* ctx,
                                 sqlite3_value** argv) {
   UserDefinedFunction* self =
       static_cast<UserDefinedFunction*>(sqlite3_user_data(ctx));
-  CallbackDepthGuard guard(self->db_);
+  CallbackDepthGuard guard(self->db_.get());
   Environment* env = self->env_;
   Isolate* isolate = env->isolate();
   auto recv = Undefined(isolate);
@@ -1735,8 +1725,8 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     argc = js_len.As<Int32>()->Value();
   }
 
-  UserDefinedFunction* user_data =
-      new UserDefinedFunction(env, fn, db, use_bigint_args);
+  UserDefinedFunction* user_data = new UserDefinedFunction(
+      env, fn, BaseObjectWeakPtr<DatabaseSync>(db), use_bigint_args);
   int text_rep = SQLITE_UTF8;
 
   if (deterministic) {
@@ -2057,22 +2047,23 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
 
   auto xInverse = !inverseFunc.IsEmpty() ? CustomAggregate::xInverse : nullptr;
   auto xValue = xInverse ? CustomAggregate::xValue : nullptr;
-  int r = sqlite3_create_window_function(db->connection_,
-                                         *name,
-                                         argc,
-                                         text_rep,
-                                         new CustomAggregate(env,
-                                                             db,
-                                                             use_bigint_args,
-                                                             start_v,
-                                                             stepFunction,
-                                                             inverseFunc,
-                                                             resultFunction),
-                                         CustomAggregate::xStep,
-                                         CustomAggregate::xFinal,
-                                         xValue,
-                                         xInverse,
-                                         CustomAggregate::xDestroy);
+  int r = sqlite3_create_window_function(
+      db->connection_,
+      *name,
+      argc,
+      text_rep,
+      new CustomAggregate(env,
+                          BaseObjectWeakPtr<DatabaseSync>(db),
+                          use_bigint_args,
+                          start_v,
+                          stepFunction,
+                          inverseFunc,
+                          resultFunction),
+      CustomAggregate::xStep,
+      CustomAggregate::xFinal,
+      xValue,
+      xInverse,
+      CustomAggregate::xDestroy);
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
 }
 
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 675595e55025..b4446e5db859 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -430,7 +430,7 @@ class UserDefinedFunction {
  public:
   UserDefinedFunction(Environment* env,
                       v8::Local<v8::Function> fn,
-                      DatabaseSync* db,
+                      BaseObjectWeakPtr<DatabaseSync> db,
                       bool use_bigint_args);
   ~UserDefinedFunction();
   static void xFunc(sqlite3_context* ctx, int argc, sqlite3_value** argv);
@@ -439,7 +439,7 @@ class UserDefinedFunction {
  private:
   Environment* env_;
   v8::Global<v8::Function> fn_;
-  DatabaseSync* db_;
+  BaseObjectWeakPtr<DatabaseSync> db_;
   bool use_bigint_args_;
 };
 

From 15da4a190bdad7e5af8371076892df666fb454f4 Mon Sep 17 00:00:00 2001
From: Tim Perry <1526883+pimterry@users.noreply.github.com>
Date: Sat, 8 Aug 2026 17:05:06 +0200
Subject: [PATCH 062/344] tls: fix authorized state on no-cert TLS1.3 client
 cert resumption

Previously if you used TLS 1.3 and the server requested a client cert,
but the client didn't send one, and you used rejectUnauthorized:false
the resumed session would report authorized=true. This doesn't match TLS
1.2 behaviour or make any sense, and was purely an artifact of our
internal logic for handling TLS 1.3 resumption details. We now correctly
report the authorization state and/or error from the original connection
in all cases, with a matrix test that fully checks the invariant:
authorized state after resume should always match the initial state.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64677
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/tls/wrap.js                      |   7 +
 .../test-tls-client-cert-resumption.js        | 199 ++++++++++++++++++
 2 files changed, 206 insertions(+)
 create mode 100644 test/parallel/test-tls-client-cert-resumption.js

diff --git a/lib/internal/tls/wrap.js b/lib/internal/tls/wrap.js
index 51fea0e99614..1c6e0577ce3d 100644
--- a/lib/internal/tls/wrap.js
+++ b/lib/internal/tls/wrap.js
@@ -1320,6 +1320,13 @@ function onServerSocketSecure() {
     if (verifyError) {
       this.authorizationError = verifyError.code;
 
+      if (this._rejectUnauthorized)
+        this.destroy();
+    } else if (!this._handle.getPeerX509Certificate()) {
+      // Ncrypto reports X509_V_OK for TLS 1.3 resumption without a peer
+      // certificate, as it uses PSKs. Require one to authorize the socket.
+      this.authorizationError = 'UNABLE_TO_GET_ISSUER_CERT';
+
       if (this._rejectUnauthorized)
         this.destroy();
     } else {
diff --git a/test/parallel/test-tls-client-cert-resumption.js b/test/parallel/test-tls-client-cert-resumption.js
new file mode 100644
index 000000000000..790809678d66
--- /dev/null
+++ b/test/parallel/test-tls-client-cert-resumption.js
@@ -0,0 +1,199 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// Server-side client-certificate authorization must survive TLS session
+// resumption. On a resumed handshake the client does not re-send its
+// certificate, so the server has to report the same authorization state it
+// derived from the original full handshake:
+//
+//   - a trusted certificate stays authorized,
+//   - an untrusted certificate stays unauthorized with its verification error,
+//   - a missing certificate stays unauthorized (UNABLE_TO_GET_ISSUER_CERT).
+//
+// The missing-certificate case is special on TLS 1.3: ncrypto reports X509_V_OK
+// for the resumed PSK handshake even though no certificate was presented, so
+// the absence has to be detected explicitly (see onServerSocketSecure() in
+// lib/internal/tls/wrap.js). The final case checks that such a certificate-less
+// resumed session is rejected outright when rejectUnauthorized is set.
+
+const assert = require('assert');
+const crypto = require('crypto');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+const { once } = require('events');
+
+const ca = fixtures.readKey('ca1-cert.pem');
+const serverCert = {
+  key: fixtures.readKey('agent2-key.pem'),
+  cert: fixtures.readKey('agent2-cert.pem'),
+};
+
+// Client certificate variants, keyed by the peer state they produce.
+const CLIENTS = {
+  trusted: {                                          // Signed by ca1
+    creds: {
+      key: fixtures.readKey('agent1-key.pem'),
+      cert: fixtures.readKey('agent1-cert.pem'),
+    },
+    authorized: true,
+    authorizationError: null,
+    peerCN: 'agent1',
+  },
+  untrusted: {                                        // Signed by ca2, not trusted
+    creds: {
+      key: fixtures.readKey('agent3-key.pem'),
+      cert: fixtures.readKey('agent3-cert.pem'),
+    },
+    authorized: false,
+    authorizationError: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    peerCN: 'agent3',
+  },
+  missing: {                                          // No client certificate
+    creds: {},
+    authorized: false,
+    authorizationError: 'UNABLE_TO_GET_ISSUER_CERT',
+    peerCN: undefined,
+  },
+};
+
+async function handshake(options, captureSession) {
+  const socket = tls.connect(options);
+  const sessionPromise = captureSession ?
+    once(socket, 'session').then(([session]) => session) : null;
+
+  socket.resume();
+  await once(socket, 'secureConnect');
+
+  const closePromise = once(socket, 'close');
+  const session = sessionPromise ? await sessionPromise : undefined;
+  socket.end();
+  await closePromise;
+  return session;
+}
+
+// Test a single resumption configuration and expected result:
+async function testResumption(version, name) {
+  const { creds, authorized, authorizationError, peerCN } = CLIENTS[name];
+
+  let connections = 0;
+  const server = tls.createServer({
+    ...serverCert,
+    ca,
+    requestCert: true,
+    rejectUnauthorized: false,
+    minVersion: version,
+    maxVersion: version,
+  }, common.mustCall((socket) => {
+    // 2nd conn must resume:
+    const resumed = connections++ === 1;
+    const where = `${version} ${name} ${resumed ? 'resumed' : 'new'}`;
+    assert.strictEqual(socket.isSessionReused(), resumed, where);
+
+    // Both conns must report same expected auth state:
+    assert.strictEqual(socket.authorized, authorized, where);
+    assert.strictEqual(socket.authorizationError, authorizationError, where);
+    const peer = socket.getPeerCertificate();
+    if (peerCN === undefined)
+      assert.deepStrictEqual(peer, {}, where);
+    else
+      assert.strictEqual(peer.subject.CN, peerCN, where);
+
+    // N.b. BoringSSL only sends a ticket after a write:
+    socket.end('.');
+  }, 2));
+
+  server.listen(0);
+  await once(server, 'listening');
+
+  const options = {
+    port: server.address().port,
+    host: '127.0.0.1',
+    checkServerIdentity: () => undefined,
+    rejectUnauthorized: false,
+    minVersion: version,
+    maxVersion: version,
+    ...creds,
+  };
+
+  try {
+    const session = await handshake(options, true);
+    assert(session);
+    await handshake({ ...options, session });
+  } finally {
+    server.close();
+    await once(server, 'close');
+  }
+}
+
+// Test the special case of resumption from rejectUnauthorized:false to
+// rejectUnauthorized:true, which must be rejected even though the original
+// session worked initially.
+async function testRejectResumedWithoutCert() {
+  const options = {
+    ...serverCert,
+    ca,
+    requestCert: true,
+    minVersion: 'TLSv1.3',
+    maxVersion: 'TLSv1.3',
+    ticketKeys: crypto.randomBytes(48),
+  };
+  const lenient = tls.createServer({ ...options, rejectUnauthorized: false });
+  lenient.on('secureConnection', common.mustCall((socket) => {
+    assert.strictEqual(socket.authorized, false);
+    assert.strictEqual(socket.authorizationError, 'UNABLE_TO_GET_ISSUER_CERT');
+    socket.end('.');
+  }));
+
+  const strict = tls.createServer({ ...options, rejectUnauthorized: true });
+  strict.on('secureConnection', common.mustNotCall());
+
+  const clientOptions = (port) => ({
+    port,
+    host: '127.0.0.1',
+    rejectUnauthorized: false,
+    checkServerIdentity: () => undefined,
+    minVersion: 'TLSv1.3',
+    maxVersion: 'TLSv1.3',
+  });
+
+  lenient.listen(0);
+  await once(lenient, 'listening');
+  const session = await handshake(clientOptions(lenient.address().port), true);
+  assert(session);
+  lenient.close();
+  await once(lenient, 'close');
+
+  strict.listen(0);
+  await once(strict, 'listening');
+
+  const resumed = tls.connect({ ...clientOptions(strict.address().port), session });
+  resumed.on('error', () => {});  // May observe the server's reset.
+  resumed.resume();
+
+  // The client completes the resumed handshake (it has the server's Finished)
+  // before the server's reset can arrive, so this asserts the strict server
+  // actually resumed rather than falling back to a rejected full handshake.
+  await once(resumed, 'secureConnect');
+  assert.strictEqual(resumed.isSessionReused(), true);
+
+  // Then the socket is destroyed during 'secure', which surfaces as a reset
+  // rather than a handshake failure.
+  const [err] = await once(strict, 'tlsClientError');
+  assert.strictEqual(err.code, 'ECONNRESET');
+
+  resumed.destroy();
+  strict.close();
+  await once(strict, 'close');
+}
+
+(async function() {
+  // Run the full matrix of configurations:
+  for (const version of ['TLSv1.2', 'TLSv1.3'])
+    for (const name of Object.keys(CLIENTS))
+      await testResumption(version, name);
+
+  // Validate the rejectUnauth:false->true case
+  await testRejectResumedWithoutCert();
+})().then(common.mustCall());

From 0157c450121aec364aa2eaf56fd2a05ebd4ece9a Mon Sep 17 00:00:00 2001
From: Issac <163278029+theSnackOverflow@users.noreply.github.com>
Date: Sun, 9 Aug 2026 00:41:43 +0900
Subject: [PATCH 063/344] doc: document quic stopSending() and resetStream()

`QuicStream` exposes `stopSending()` and `resetStream()`, but neither
appeared in the QuicStream API reference. Both matter when half-closing
a stream, which protocols such as WebTransport rely on.

Document the two methods and list them in the "Aborting a stream"
summary, which previously covered only `writer.fail()` and
`stream.destroy()`. Unlike those, both send the given code as-is rather
than deriving a wire code from an error.

Fixes: https://github.com/nodejs/node/issues/63680
Signed-off-by: Ji Hoon Kang <ivory.ma9ic@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64888
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/quic.md | 49 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 48 insertions(+), 1 deletion(-)

diff --git a/doc/api/quic.md b/doc/api/quic.md
index 2a657cb6834e..9b0254337d76 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -1921,9 +1921,14 @@ True if `stream.destroy()` has been called.
 
 ### Aborting a stream
 
-A QuicStream can be aborted in three ways, each producing different
+A QuicStream can be aborted in several ways, each producing different
 wire-frame side effects:
 
+* [`stream.stopSending()`][] — Aborts only the readable side. Sends
+  `STOP_SENDING` to the peer. The writable side is unaffected.
+* [`stream.resetStream()`][] — Aborts only the writable side. Sends
+  `RESET_STREAM` to the peer. Unlike [`writer.fail(reason)`][], the wire
+  code is given directly rather than derived from an error.
 * [`writer.fail(reason)`][] — Aborts only the writable side. Sends
   `RESET_STREAM` to the peer. The readable side is unaffected; any data
   already buffered for read remains available.
@@ -1941,6 +1946,46 @@ the wire code for both `writer.fail()` and `stream.destroy()`. Otherwise
 the implementation falls back to the negotiated application protocol's
 "internal error" code (see [`QuicError`][]).
 
+[`stream.stopSending()`][] and [`stream.resetStream()`][] do
+not perform this derivation: they send `code` as given.
+
+### `stream.resetStream([code])`
+
+<!-- YAML
+added: v23.8.0
+-->
+
+* `code` {number|bigint} The application error code to send to the peer.
+  **Default:** `0n`.
+
+Tells the peer that this end will not send any more data on this stream,
+sending a `RESET_STREAM` frame carrying `code`. The readable side is left
+open, so data already sent by the peer remains available to read.
+
+Any data still queued for sending is discarded. A reset stream is never
+acknowledged by the peer, so the outbound queue can no longer drain.
+
+No acknowledgement of this action is provided. The call does nothing if the
+stream has been destroyed, if it has already been reset, or if it is a
+remote-initiated unidirectional stream, which has no writable side to abort.
+
+### `stream.stopSending([code])`
+
+<!-- YAML
+added: v23.8.0
+-->
+
+* `code` {number|bigint} The application error code to send to the peer.
+  **Default:** `0n`.
+
+Asks the peer to stop sending data on this stream, sending a `STOP_SENDING`
+frame carrying `code`. The writable side is left open, so this end can
+still send data.
+
+No acknowledgement of this action is provided. The call does nothing if the
+stream has been destroyed, or if it is a locally-initiated unidirectional
+stream, which has no readable side to abort.
+
 ### `stream.early`
 
 <!-- YAML
@@ -4576,11 +4621,13 @@ throughput issues caused by flow control.
 [`stream.onwanttrailers`]: #streamonwanttrailers
 [`stream.pendingTrailers`]: #streampendingtrailers
 [`stream.priority`]: #streampriority
+[`stream.resetStream()`]: #streamresetstreamcode
 [`stream.sendHeaders()`]: #streamsendheadersheaders-options
 [`stream.sendInformationalHeaders()`]: #streamsendinformationalheadersheaders
 [`stream.sendTrailers()`]: #streamsendtrailersheaders
 [`stream.setBody()`]: #streamsetbodybody
 [`stream.setPriority()`]: #streamsetpriorityoptions
+[`stream.stopSending()`]: #streamstopsendingcode
 [`stream.writer`]: #streamwriter
 [`writer.fail()`]: #streamwriter
 [`writer.fail(reason)`]: #streamwriter

From 262d88e6c2fc2670682e92b31bb51e545306c1bb Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Sun, 9 Aug 2026 00:54:21 +0900
Subject: [PATCH 064/344] src: reuse cached env strings in remaining files

Follow-up to #59891, covering files it missed.
Overlapping locations (node_ffi.cc, crypto_util.cc) were already
handled by #64760.

Refs: https://github.com/nodejs/node/pull/59891
Refs: https://github.com/nodejs/node/pull/64760
Refs: https://github.com/nodejs/node/pull/64912

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65039
Refs: https://github.com/nodejs/node/pull/59891
Refs: https://github.com/nodejs/node/pull/64760
Refs: https://github.com/nodejs/node/pull/64912
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node_constants.cc | 6 +-----
 src/node_locks.cc     | 4 ++--
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/src/node_constants.cc b/src/node_constants.cc
index 9725f36e8128..432b66808920 100644
--- a/src/node_constants.cc
+++ b/src/node_constants.cc
@@ -1378,11 +1378,7 @@ void CreatePerContextProperties(Local<Object> target,
             FIXED_ONE_BYTE_STRING(isolate, "dlopen"),
             dlopen_constants)
       .Check();
-  os_constants
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "errno"),
-            err_constants)
-      .Check();
+  os_constants->Set(env->context(), env->errno_string(), err_constants).Check();
   os_constants
       ->Set(env->context(),
             FIXED_ONE_BYTE_STRING(isolate, "signals"),
diff --git a/src/node_locks.cc b/src/node_locks.cc
index 9c871569c4d4..26fac6b62c4c 100644
--- a/src/node_locks.cc
+++ b/src/node_locks.cc
@@ -817,10 +817,10 @@ void CreatePerIsolateProperties(IsolateData* isolate_data,
   PropertyAttribute read_only = static_cast<PropertyAttribute>(
       PropertyAttribute::ReadOnly | PropertyAttribute::DontDelete);
   target->Set(FIXED_ONE_BYTE_STRING(isolate, "LOCK_MODE_SHARED"),
-              FIXED_ONE_BYTE_STRING(isolate, "shared"),
+              isolate_data->shared_string(),
               read_only);
   target->Set(FIXED_ONE_BYTE_STRING(isolate, "LOCK_MODE_EXCLUSIVE"),
-              FIXED_ONE_BYTE_STRING(isolate, "exclusive"),
+              isolate_data->exclusive_string(),
               read_only);
   target->Set(FIXED_ONE_BYTE_STRING(isolate, "LOCK_STOLEN_ERROR"),
               FIXED_ONE_BYTE_STRING(isolate, "LOCK_STOLEN"),

From b1770bc196feceb6064ff61a88acf9f8f2ef2800 Mon Sep 17 00:00:00 2001
From: Efe Karasakal <hi@efe.dev>
Date: Sat, 8 Aug 2026 17:54:33 +0200
Subject: [PATCH 065/344] esm: only register text format when enabled

Signed-off-by: Efe Karasakal <hi@efe.dev>
PR-URL: https://github.com/nodejs/node/pull/64992
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/modules/esm/assert.js            | 25 +++++++++++++------
 .../es-module/test-esm-loader-text-format.mjs | 23 +++++++++++++++++
 2 files changed, 41 insertions(+), 7 deletions(-)
 create mode 100644 test/es-module/test-esm-loader-text-format.mjs

diff --git a/lib/internal/modules/esm/assert.js b/lib/internal/modules/esm/assert.js
index 406c0f4e4513..9bd6967dbbbe 100644
--- a/lib/internal/modules/esm/assert.js
+++ b/lib/internal/modules/esm/assert.js
@@ -3,6 +3,7 @@
 const {
   ArrayPrototypeFilter,
   ArrayPrototypeIncludes,
+  ArrayPrototypePush,
   ObjectKeys,
   ObjectPrototypeHasOwnProperty,
   ObjectValues,
@@ -30,7 +31,6 @@ const formatTypeMap = {
   'commonjs': kImplicitTypeAttribute,
   'json': 'json',
   'module': kImplicitTypeAttribute,
-  'text': 'text',
   'wasm': kImplicitTypeAttribute, // It's unclear whether the HTML spec will require an type attribute or not for Wasm; see https://github.com/WebAssembly/esm-integration/issues/42
 };
 // NOTE: Don't add bytes support yet as it requires Uint8Arrays backed by immutable ArrayBuffers,
@@ -48,6 +48,21 @@ const supportedTypeAttributes = ArrayPrototypeFilter(
   ObjectValues(formatTypeMap),
   (type) => type !== kImplicitTypeAttribute);
 
+let importAttributesInitialized = false;
+
+function initializeImportAttributes() {
+  if (importAttributesInitialized) {
+    return;
+  }
+
+  importAttributesInitialized = true;
+
+  if (getOptionValue('--experimental-import-text')) {
+    formatTypeMap.text = 'text';
+    ArrayPrototypePush(supportedTypeAttributes, 'text');
+  }
+}
+
 /**
  * Test a module's import attributes.
  * @param {string} url The URL of the imported module, for error reporting.
@@ -59,6 +74,8 @@ const supportedTypeAttributes = ArrayPrototypeFilter(
  */
 function validateAttributes(url, format,
                             importAttributes = { __proto__: null }) {
+  initializeImportAttributes();
+
   const keys = ObjectKeys(importAttributes);
   for (let i = 0; i < keys.length; i++) {
     if (keys[i] !== 'type') {
@@ -67,12 +84,6 @@ function validateAttributes(url, format,
   }
   const validType = formatTypeMap[format];
 
-  if (validType !== undefined &&
-    importAttributes.type === 'text' &&
-    !getOptionValue('--experimental-import-text')) {
-    throw new ERR_IMPORT_ATTRIBUTE_UNSUPPORTED('type', importAttributes.type, url);
-  }
-
   switch (validType) {
     case undefined:
       // Ignore attributes for module formats we don't recognize, to allow new
diff --git a/test/es-module/test-esm-loader-text-format.mjs b/test/es-module/test-esm-loader-text-format.mjs
new file mode 100644
index 000000000000..2a35992dbcf4
--- /dev/null
+++ b/test/es-module/test-esm-loader-text-format.mjs
@@ -0,0 +1,23 @@
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { registerHooks } from 'node:module';
+
+// A user loader can use `text` with and without import attributes without the feature flag.
+
+registerHooks({
+  load(url, context, nextLoad) {
+    if (url.endsWith('.txt')) {
+      return nextLoad(url, { ...context, format: 'text' });
+    }
+    return nextLoad(url, context);
+  },
+});
+
+const { default: text } = await import('../fixtures/file-to-read-without-bom.txt');
+const { default: empty } = await import(
+  '../fixtures/empty.txt',
+  { with: { type: 'text' } }
+);
+
+assert.strictEqual(text, 'abc\ndef\nghi\n');
+assert.strictEqual(empty, '');

From 5cb78ed3001e4639a67ab97053853ddbc82865d8 Mon Sep 17 00:00:00 2001
From: Anshika Jain <anshikajain196872@gmail.com>
Date: Sat, 8 Aug 2026 21:24:54 +0530
Subject: [PATCH 066/344] sqlite: validate maxSize argument in createTagStore()

Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63792
Fixes: https://github.com/nodejs/node/issues/63791
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node_sqlite.cc                        | 19 +++++++++++--
 test/parallel/test-sqlite-template-tag.js | 34 +++++++++++++++++++++++
 2 files changed, 50 insertions(+), 3 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 2a36e464ccf2..e3604d97bc53 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1076,10 +1076,23 @@ void DatabaseSync::CreateTagStore(const FunctionCallbackInfo<Value>& args) {
     return;
   }
   int capacity = 1000;
-  if (args.Length() > 0 && args[0]->IsNumber()) {
-    capacity = args[0].As<Number>()->Value();
+  if (args.Length() > 0 && !args[0]->IsUndefined()) {
+    if (!args[0]->IsNumber()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"maxSize\" argument must be a positive integer.");
+      return;
+    }
+    double val = args[0].As<Number>()->Value();
+    if (std::floor(val) != val || val <= 0 ||
+        val > std::numeric_limits<int>::max()) {
+      THROW_ERR_OUT_OF_RANGE(
+          env->isolate(),
+          "The \"maxSize\" argument must be a positive integer.");
+      return;
+    }
+    capacity = static_cast<int>(val);
   }
-
   BaseObjectPtr<SQLTagStore> session =
       SQLTagStore::Create(env, BaseObjectWeakPtr<DatabaseSync>(db), capacity);
   if (!session) {
diff --git a/test/parallel/test-sqlite-template-tag.js b/test/parallel/test-sqlite-template-tag.js
index 494f2d50f76f..445231bef0bd 100644
--- a/test/parallel/test-sqlite-template-tag.js
+++ b/test/parallel/test-sqlite-template-tag.js
@@ -257,6 +257,40 @@ test('a finished iterator stays done and does not restart', () => {
   assert.strictEqual(iter.next().done, true);
 });
 
+test('createTagStore throws on invalid maxSize', () => {
+  const db = new DatabaseSync(':memory:');
+
+  assert.throws(() => db.createTagStore(0), {
+    code: 'ERR_OUT_OF_RANGE',
+    message: /maxSize/,
+  });
+
+  assert.throws(() => db.createTagStore(-1), {
+    code: 'ERR_OUT_OF_RANGE',
+    message: /maxSize/,
+  });
+
+  assert.throws(() => db.createTagStore(NaN), {
+    code: 'ERR_OUT_OF_RANGE',
+    message: /maxSize/,
+  });
+
+  assert.throws(() => db.createTagStore(1.5), {
+    code: 'ERR_OUT_OF_RANGE',
+    message: /maxSize/,
+  });
+
+  assert.throws(() => db.createTagStore('abc'), {
+    code: 'ERR_INVALID_ARG_TYPE',
+    message: /maxSize/,
+  });
+
+  assert.throws(() => db.createTagStore(Number.MAX_SAFE_INTEGER), {
+    code: 'ERR_OUT_OF_RANGE',
+    message: /maxSize/,
+  });
+});
+
 test('sql.db returns the associated DatabaseSync instance', () => {
   assert.strictEqual(sql.db, db);
 });

From fa52f11d3b683c601f9f703d95b99bc56d74646d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Sat, 8 Aug 2026 14:17:23 -0300
Subject: [PATCH 067/344] doc: finalize statements in sqlite examples
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65088
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/sqlite.md | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 74d258be6815..166639ef0074 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -51,11 +51,14 @@ const insert = database.prepare('INSERT INTO data (key, value) VALUES (?, ?)');
 // Execute the prepared statement with bound values.
 insert.run(1, 'hello');
 insert.run(2, 'world');
+// Finalize the prepared statement once it is no longer needed.
+insert.close();
 // Create a prepared statement to read data from the database.
 const query = database.prepare('SELECT * FROM data ORDER BY key');
 // Execute the prepared statement and log the result set.
 console.log(query.all());
 // Prints: [ { key: 1, value: 'hello' }, { key: 2, value: 'world' } ]
+query.close();
 ```
 
 ```cjs
@@ -74,11 +77,14 @@ const insert = database.prepare('INSERT INTO data (key, value) VALUES (?, ?)');
 // Execute the prepared statement with bound values.
 insert.run(1, 'hello');
 insert.run(2, 'world');
+// Finalize the prepared statement once it is no longer needed.
+insert.close();
 // Create a prepared statement to read data from the database.
 const query = database.prepare('SELECT * FROM data ORDER BY key');
 // Execute the prepared statement and log the result set.
 console.log(query.all());
 // Prints: [ { key: 1, value: 'hello' }, { key: 2, value: 'world' } ]
+query.close();
 ```
 
 ## Type conversion between JavaScript and SQLite
@@ -262,7 +268,8 @@ db.aggregate('sumint', {
   step: (acc, value) => acc + value,
 });
 
-db.prepare('SELECT sumint(y) as total FROM t3').get(); // { total: 21 }
+using query = db.prepare('SELECT sumint(y) as total FROM t3');
+query.get(); // { total: 21 }
 ```
 
 ```mjs
@@ -283,7 +290,8 @@ db.aggregate('sumint', {
   step: (acc, value) => acc + value,
 });
 
-db.prepare('SELECT sumint(y) as total FROM t3').get(); // { total: 21 }
+using query = db.prepare('SELECT sumint(y) as total FROM t3');
+query.get(); // { total: 21 }
 ```
 
 ### `database.close()`
@@ -461,7 +469,8 @@ db.setAuthorizer((actionCode) => {
 });
 
 // This will work
-db.prepare('SELECT 1').get();
+using query = db.prepare('SELECT 1');
+query.get();
 
 // This will throw an error due to authorization denial
 try {
@@ -484,7 +493,8 @@ db.setAuthorizer((actionCode) => {
 });
 
 // This will work
-db.prepare('SELECT 1').get();
+using query = db.prepare('SELECT 1');
+query.get();
 
 // This will throw an error due to authorization denial
 try {
@@ -619,7 +629,8 @@ original.close();
 
 const clone = new DatabaseSync(':memory:');
 clone.deserialize(buffer);
-console.log(clone.prepare('SELECT value FROM t').get());
+using query = clone.prepare('SELECT value FROM t');
+console.log(query.get());
 // Prints: { value: 'hello' }
 ```
 
@@ -634,7 +645,8 @@ original.close();
 
 const clone = new DatabaseSync(':memory:');
 clone.deserialize(buffer);
-console.log(clone.prepare('SELECT value FROM t').get());
+using query = clone.prepare('SELECT value FROM t');
+console.log(query.get());
 // Prints: { value: 'hello' }
 ```
 
@@ -691,7 +703,8 @@ sqlTagStore.get`SELECT ${value}`;
 is equivalent to:
 
 ```js
-db.prepare('SELECT ?').get(value);
+using statement = db.prepare('SELECT ?');
+statement.get(value);
 ```
 
 However, in the first example, the tag store will cache the underlying prepared
@@ -855,7 +868,7 @@ targetDb.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
 
 const session = sourceDb.createSession();
 
-const insert = sourceDb.prepare('INSERT INTO data (key, value) VALUES (?, ?)');
+using insert = sourceDb.prepare('INSERT INTO data (key, value) VALUES (?, ?)');
 insert.run(1, 'hello');
 insert.run(2, 'world');
 
@@ -875,7 +888,7 @@ targetDb.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
 
 const session = sourceDb.createSession();
 
-const insert = sourceDb.prepare('INSERT INTO data (key, value) VALUES (?, ?)');
+using insert = sourceDb.prepare('INSERT INTO data (key, value) VALUES (?, ?)');
 insert.run(1, 'hello');
 insert.run(2, 'world');
 

From 7f7df06821bc06b7c9a64a473d3cb5acd981f430 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 8 Aug 2026 20:06:56 +0200
Subject: [PATCH 068/344] lib: add and test [EnforceRange] in webcrypto
 dictionaries

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65091
Refs: https://github.com/w3c/webcrypto/pull/555
Refs: https://github.com/WICG/webcrypto-modern-algos/pull/65
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/crypto/webcrypto.js              |  7 +-
 test/parallel/test-webcrypto-enforce-range.js | 35 +++++++
 test/parallel/test-webcrypto-webidl.js        | 98 +++++++++++++++++++
 3 files changed, 139 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-webcrypto-enforce-range.js

diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index 25622d94f6b2..ff8cb8062891 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -255,7 +255,11 @@ function deriveBitsImpl(algorithm, baseKey, length = null) {
     prefix, 'AlgorithmIdentifier', algorithm, i++);
   baseKey = convertSubtleArgument(prefix, 'CryptoKey', baseKey, i++);
   if (length !== null) {
-    length = convertSubtleArgument(prefix, 'unsigned long', length, i++);
+    length = webidl.converters['unsigned long'](length, {
+      prefix,
+      context: kArgumentContexts[i++],
+      enforceRange: true,
+    });
   }
 
   const normalizedAlgorithm = normalizeAlgorithm(algorithm, 'deriveBits');
@@ -1695,6 +1699,7 @@ class SubtleCrypto {
         length = webidl.converters['unsigned long'](length, {
           prefix,
           context: '3rd argument',
+          enforceRange: true,
         });
       }
     } else if (operation === 'getPublicKey') {
diff --git a/test/parallel/test-webcrypto-enforce-range.js b/test/parallel/test-webcrypto-enforce-range.js
new file mode 100644
index 000000000000..f3b3ec74ffc5
--- /dev/null
+++ b/test/parallel/test-webcrypto-enforce-range.js
@@ -0,0 +1,35 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { SubtleCrypto } = globalThis;
+const { subtle } = globalThis.crypto;
+
+const algorithm = {
+  name: 'HKDF',
+  hash: 'SHA-256',
+  info: new Uint8Array(),
+  salt: new Uint8Array(32),
+};
+const invalidLength = 2 ** 32;
+const expectedError = {
+  code: 'ERR_OUT_OF_RANGE',
+  name: 'TypeError',
+};
+
+assert.throws(
+  () => SubtleCrypto.supports('deriveBits', algorithm, invalidLength),
+  expectedError);
+
+(async () => {
+  const key = await subtle.importKey(
+    'raw', new Uint8Array(32), 'HKDF', false, ['deriveBits']);
+
+  await assert.rejects(
+    subtle.deriveBits(algorithm, key, invalidLength),
+    expectedError);
+})().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-webidl.js b/test/parallel/test-webcrypto-webidl.js
index 493d0093996b..d91099aed2bf 100644
--- a/test/parallel/test-webcrypto-webidl.js
+++ b/test/parallel/test-webcrypto-webidl.js
@@ -119,6 +119,104 @@ function assertJsonWebKey(actual, expected) {
   }
 }
 
+// [EnforceRange] integer dictionary members
+{
+  const kOctetMax = 2 ** 8 - 1;
+  const kUnsignedShortMax = 2 ** 16 - 1;
+  const kUnsignedLongMax = 2 ** 32 - 1;
+  const empty = Buffer.alloc(0);
+  const rsaKeyGen = {
+    name: 'RSA-PSS',
+    modulusLength: 2048,
+    publicExponent: new Uint8Array([1, 0, 1]),
+  };
+  const aesKeyParams = { name: 'AES-GCM', length: 128 };
+  const hmacKeyParams = {
+    name: 'HMAC',
+    hash: 'SHA-256',
+    length: 128,
+  };
+  const kmacKeyParams = { name: 'KMAC128', length: 128 };
+  const cases = [
+    ['RsaKeyGenParams', rsaKeyGen,
+     { modulusLength: kUnsignedLongMax }],
+    ['RsaHashedKeyGenParams', { ...rsaKeyGen, hash: 'SHA-256' },
+     { modulusLength: kUnsignedLongMax }],
+    ['AesKeyGenParams', aesKeyParams,
+     { length: kUnsignedShortMax }],
+    ['RsaPssParams', { name: 'RSA-PSS', saltLength: 20 },
+     { saltLength: kUnsignedLongMax }],
+    ['HmacKeyGenParams', hmacKeyParams,
+     { length: kUnsignedLongMax }],
+    ['HmacImportParams', hmacKeyParams,
+     { length: kUnsignedLongMax }],
+    ['CShakeParams', { name: 'cSHAKE128', outputLength: 256 },
+     { outputLength: kUnsignedLongMax }],
+    ['Pbkdf2Params', {
+      name: 'PBKDF2',
+      salt: empty,
+      iterations: 1,
+      hash: 'SHA-256',
+    }, { iterations: kUnsignedLongMax }],
+    ['AesDerivedKeyParams', aesKeyParams,
+     { length: kUnsignedShortMax }],
+    ['AeadParams', {
+      name: 'AES-GCM',
+      iv: Buffer.alloc(12),
+      tagLength: 128,
+    }, { tagLength: kOctetMax }],
+    ['AesCtrParams', {
+      name: 'AES-CTR',
+      counter: Buffer.alloc(16),
+      length: 128,
+    }, { length: kOctetMax }],
+    ['Argon2Params', {
+      name: 'Argon2id',
+      nonce: Buffer.alloc(8),
+      parallelism: 1,
+      memory: 8,
+      passes: 1,
+      version: 0x13,
+    }, {
+      parallelism: kUnsignedLongMax,
+      memory: kUnsignedLongMax,
+      passes: kUnsignedLongMax,
+      version: kOctetMax,
+    }],
+    ['KmacKeyGenParams', kmacKeyParams,
+     { length: kUnsignedLongMax }],
+    ['KmacImportParams', kmacKeyParams,
+     { length: kUnsignedLongMax }],
+    ['KmacParams', { name: 'KMAC128', outputLength: 256 },
+     { outputLength: kUnsignedLongMax }],
+    ['KangarooTwelveParams', { name: 'KT128', outputLength: 256 },
+     { outputLength: kUnsignedLongMax }],
+    ['TurboShakeParams', {
+      name: 'TurboSHAKE128',
+      outputLength: 256,
+      domainSeparation: 0x1f,
+    }, {
+      outputLength: kUnsignedLongMax,
+      domainSeparation: kOctetMax,
+    }],
+  ];
+
+  for (const [dictionary, base, members] of cases) {
+    const converter = converters[dictionary];
+    assertIdlDictionary(converter(base, opts), base);
+
+    for (const [member, max] of Object.entries(members)) {
+      assert.throws(
+        () => converter({ ...base, [member]: -1 }, opts), {
+          name: 'TypeError',
+          code: 'ERR_OUT_OF_RANGE',
+          message: `${prefix}: ${member} in ${context} is outside ` +
+                   `the expected range of 0 to ${max}.`,
+        });
+    }
+  }
+}
+
 // DOMString
 {
   assert.strictEqual(converters.DOMString(1), '1');

From 5953165f53c29d90a530d3bd5c3d5b85d69dccd5 Mon Sep 17 00:00:00 2001
From: Tim Perry <1526883+pimterry@users.noreply.github.com>
Date: Sat, 8 Aug 2026 20:42:39 +0200
Subject: [PATCH 069/344] quic: fix infinite loop if STOP_SENDING received on a
 buffering stream

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64715
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/quic/application.cc                       |  6 +++
 ...test-quic-stream-stop-sending-buffered.mjs | 49 +++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 test/parallel/test-quic-stream-stop-sending-buffered.mjs

diff --git a/src/quic/application.cc b/src/quic/application.cc
index 688a1309dea5..79a3263b8537 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -410,6 +410,12 @@ class DefaultApplication final : public Session::Application {
 
   void ResumeStream(stream_id id) override { ScheduleStream(id); }
 
+  void StreamWriteShut(stream_id id) override {
+    if (auto stream = session().FindStream(id)) [[likely]] {
+      stream->Unschedule();
+    }
+  }
+
   void BlockStream(stream_id id) override {
     if (auto stream = session().FindStream(id)) [[likely]] {
       // Remove the stream from the send queue. It will be re-scheduled
diff --git a/test/parallel/test-quic-stream-stop-sending-buffered.mjs b/test/parallel/test-quic-stream-stop-sending-buffered.mjs
new file mode 100644
index 000000000000..1d41635b4575
--- /dev/null
+++ b/test/parallel/test-quic-stream-stop-sending-buffered.mjs
@@ -0,0 +1,49 @@
+// Flags: --experimental-quic --no-warnings
+
+// A peer STOP_SENDING must unschedule buffered outbound data.
+
+import { hasQuic, mustCall, skip } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { connect, listen } = await import('../common/quic.mjs');
+
+const serverStreamReady = Promise.withResolvers();
+const clientBuffered = Promise.withResolvers();
+const serverReset = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    serverStreamReady.resolve();
+    await clientBuffered.promise;
+
+    const closed = assert.rejects(stream.closed, {
+      code: 'ERR_QUIC_APPLICATION_ERROR',
+    });
+    stream.stopSending(1n);
+    stream.writer.endSync();
+    await closed;
+    serverSession.close();
+    serverReset.resolve();
+  });
+}));
+
+const clientSession = await connect(serverEndpoint.address);
+await clientSession.opened;
+
+const stream = await clientSession.createBidirectionalStream();
+const clientClosed = stream.closed.catch(() => {});
+const writer = stream.writer;
+writer.writeSync(new Uint8Array([1]));
+await serverStreamReady.promise;
+
+writer.writeSync(new Uint8Array(64 * 1024));
+clientBuffered.resolve();
+
+await serverReset.promise;
+
+await Promise.all([clientClosed, clientSession.closed]);
+await serverEndpoint.close();

From e52e573fd7a30e68a2b6c2e44ca7706ec55befed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Sat, 8 Aug 2026 16:20:54 -0300
Subject: [PATCH 070/344] doc: document sqlite parameter binding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65089
Refs: https://github.com/nodejs/node/pull/62001
Refs: https://github.com/nodejs/node/pull/62061
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/sqlite.md | 173 +++++++++++++++++++++++++++++++++++++---------
 1 file changed, 142 insertions(+), 31 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 166639ef0074..e1ce547bb6d9 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -95,13 +95,19 @@ more data types than SQLite, only a subset of JavaScript types are supported.
 Attempting to write an unsupported data type to SQLite will result in an
 exception.
 
-| Storage class | JavaScript to SQLite       | SQLite to JavaScript                  |
-| ------------- | -------------------------- | ------------------------------------- |
-| `NULL`        | {null}                     | {null}                                |
-| `INTEGER`     | {number} or {bigint}       | {number} or {bigint} _(configurable)_ |
-| `REAL`        | {number}                   | {number}                              |
-| `TEXT`        | {string}                   | {string}                              |
-| `BLOB`        | {TypedArray} or {DataView} | {Uint8Array}                          |
+| Storage class | JavaScript to SQLite                                            | SQLite to JavaScript                  |
+| ------------- | --------------------------------------------------------------- | ------------------------------------- |
+| `NULL`        | {null}                                                          | {null}                                |
+| `INTEGER`     | {number}, {bigint}, or {boolean}                                | {number} or {bigint} _(configurable)_ |
+| `REAL`        | {number}                                                        | {number}                              |
+| `TEXT`        | {string}                                                        | {string}                              |
+| `BLOB`        | {TypedArray}, {DataView}, {ArrayBuffer}, or {SharedArrayBuffer} | {Uint8Array}                          |
+
+Booleans are written as the `INTEGER` values `1` and `0`. Like any other
+`INTEGER` value, they are read back as {number} by default, or as {bigint}
+values (`1n` and `0n`) when reading BigInts is enabled. Writing a {bigint} that
+does not fit in a signed 64-bit integer throws an `ERR_INVALID_ARG_VALUE`
+error.
 
 APIs that read values from SQLite have a configuration option that determines
 whether `INTEGER` values are converted to `number` or `bigint` in JavaScript,
@@ -824,6 +830,7 @@ added:
 -->
 
 * `changeset` {Uint8Array} A binary changeset or patchset.
+
 * `options` {Object} The configuration options for how the changes will be applied.
   * `filter` {Function} for each table affected by at least
     one change in the changeset, the `filter` callback is invoked with the
@@ -852,6 +859,7 @@ added:
     applying the changeset is aborted and the database is rolled back.
 
     **Default**: A function that returns `SQLITE_CHANGESET_ABORT`.
+
 * Returns: {boolean} Whether the changeset was applied successfully without being aborted.
 
 An exception is thrown if the database is not
@@ -977,11 +985,61 @@ times with different bound values. Parameters also offer protection against
 [SQL injection][] attacks. For these reasons, prepared statements are preferred
 over hand-crafted SQL strings when handling user input.
 
+### Binding parameters
+
+The `all()`, `get()`, `iterate()`, and `run()` methods bind their arguments to
+the parameters of the prepared statement before executing it. Parameters are
+either anonymous or named.
+
+Anonymous parameters are written as `?` in SQL and are bound in order from the
+arguments passed to the method. The `?NNN` form assigns SQLite parameter index
+`NNN` to a placeholder. Avoid mixing numbered and named parameters because they
+share parameter indexes.
+
+```js
+db.prepare('SELECT ? AS a, ? AS b').get('x', 42);
+// { a: 'x', b: 42 }
+db.prepare('SELECT ?2 AS a, ?1 AS b').get('first', 'second');
+// { a: 'second', b: 'first' }
+```
+
+Named parameters begin with one of the prefix characters `$`, `:`, or `@` in
+SQL. They are bound from an object passed as the first argument. Repeating a
+name in the SQL binds the same value to every occurrence.
+
+```js
+db.prepare('SELECT $a AS a, $b AS b').get({ $a: 1, $b: 2 });
+// { a: 1, b: 2 }
+db.prepare('SELECT :a AS a').get({ ':a': 1 });
+// { a: 1 }
+db.prepare('SELECT @a AS a').get({ '@a': 1 });
+// { a: 1 }
+db.prepare('SELECT $k AS a, $k AS b').get({ k: 7 });
+// { a: 7, b: 7 }
+```
+
+The last example omits the prefix character from the object key. Bare names are
+allowed by default; see [`statement.setAllowBareNamedParameters()`][] for their
+caveats.
+
+Binding a key that does not name a parameter of the statement throws an
+`ERR_INVALID_STATE` error unless unknown named parameters are ignored. See
+[`statement.setAllowUnknownNamedParameters()`][].
+
+See [Type conversion between JavaScript and SQLite][] for the values that can be
+bound. Binding any other value throws an `ERR_INVALID_ARG_TYPE` error.
+
 ### `statement.all([namedParameters][, ...anonymousParameters])`
 
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
     - v23.7.0
     - v22.14.0
@@ -991,8 +1049,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|string|Buffer|TypedArray|DataView} Zero or
-  more values to bind to anonymous parameters.
+* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+  Zero or more values to bind to anonymous parameters.
 * Returns: {Array} An array of objects. Each object corresponds to a row
   returned by executing the prepared statement. The keys and values of each
   object correspond to the column names and values of the row.
@@ -1000,7 +1058,8 @@ changes:
 This method executes a prepared statement and returns all results as an array of
 objects. If the prepared statement does not return any results, this method
 returns an empty array. The prepared statement [parameters are bound][] using
-the values in `namedParameters` and `anonymousParameters`.
+the values in `namedParameters` and `anonymousParameters`. See
+[Binding parameters][].
 
 ### `statement.close()`
 
@@ -1021,7 +1080,6 @@ added:
 
 * Returns: {Array} An array of objects. Each object corresponds to a column
   in the prepared statement, and contains the following properties:
-
   * `column` {string|null} The unaliased name of the column in the origin
     table, or `null` if the column is the result of an expression or subquery.
     This property is the result of [`sqlite3_column_origin_name()`][].
@@ -1059,6 +1117,12 @@ execution of this prepared statement. This property is a wrapper around
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
     - v23.7.0
     - v22.14.0
@@ -1068,8 +1132,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|string|Buffer|TypedArray|DataView} Zero or
-  more values to bind to anonymous parameters.
+* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+  Zero or more values to bind to anonymous parameters.
 * Returns: {Object|undefined} An object corresponding to the first row returned
   by executing the prepared statement. The keys and values of the object
   correspond to the column names and values of the row. If no rows were returned
@@ -1078,7 +1142,8 @@ changes:
 This method executes a prepared statement and returns the first result as an
 object. If the prepared statement does not return any results, this method
 returns `undefined`. The prepared statement [parameters are bound][] using the
-values in `namedParameters` and `anonymousParameters`.
+values in `namedParameters` and `anonymousParameters`. See
+[Binding parameters][].
 
 ### `statement.iterate([namedParameters][, ...anonymousParameters])`
 
@@ -1087,6 +1152,12 @@ added:
   - v23.4.0
   - v22.13.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
     - v23.7.0
     - v22.14.0
@@ -1096,8 +1167,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|string|Buffer|TypedArray|DataView} Zero or
-  more values to bind to anonymous parameters.
+* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+  Zero or more values to bind to anonymous parameters.
 * Returns: {Iterator} An iterable iterator of objects. Each object corresponds to a row
   returned by executing the prepared statement. The keys and values of each
   object correspond to the column names and values of the row.
@@ -1105,13 +1176,20 @@ changes:
 This method executes a prepared statement and returns an iterator of
 objects. If the prepared statement does not return any results, this method
 returns an empty iterator. The prepared statement [parameters are bound][] using
-the values in `namedParameters` and `anonymousParameters`.
+the values in `namedParameters` and `anonymousParameters`. See
+[Binding parameters][].
 
 ### `statement.run([namedParameters][, ...anonymousParameters])`
 
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
     - v23.7.0
     - v22.14.0
@@ -1121,8 +1199,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|string|Buffer|TypedArray|DataView} Zero or
-  more values to bind to anonymous parameters.
+* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+  Zero or more values to bind to anonymous parameters.
 * Returns: {Object}
   * `changes` {number|bigint} The number of rows modified, inserted, or deleted
     by the most recently completed `INSERT`, `UPDATE`, or `DELETE` statement.
@@ -1136,7 +1214,8 @@ changes:
 
 This method executes a prepared statement and returns an object summarizing the
 resulting changes. The prepared statement [parameters are bound][] using the
-values in `namedParameters` and `anonymousParameters`.
+values in `namedParameters` and `anonymousParameters`. See
+[Binding parameters][].
 
 ### `statement.setAllowBareNamedParameters(enabled)`
 
@@ -1147,14 +1226,15 @@ added: v22.5.0
 * `enabled` {boolean} Enables or disables support for binding named parameters
   without the prefix character.
 
-The names of SQLite parameters begin with a prefix character. By default,
-`node:sqlite` allows binding named parameters without this prefix character in
-the parameter object. With the exception of the dollar sign character, these
-prefix characters require extra quoting when used in object keys.
+The names of SQLite parameters begin with a prefix character. However, with the
+exception of the dollar sign character, these prefix characters also require
+extra quoting when used in object keys.
 
-This method enables or disables support for bare named parameters, which do not
-require the prefix character in JavaScript code. There are several caveats to
-be aware of when bare named parameters are enabled:
+To improve ergonomics, `node:sqlite` allows bare named parameters, which do not
+require the prefix character in JavaScript code, by default. This method can be
+used to disable that behavior, requiring the prefix character when binding.
+There are several caveats to be aware of when bare named parameters are
+allowed:
 
 * The prefix character is still required in SQL.
 * The prefix character is still allowed in JavaScript. In fact, prefixed names
@@ -1248,11 +1328,18 @@ class execute synchronously.
 
 <!-- YAML
 added: v24.9.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|string|Buffer|TypedArray|DataView}
+* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Array} An array of objects representing the rows returned by the query.
 
@@ -1266,11 +1353,18 @@ called directly.
 
 <!-- YAML
 added: v24.9.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|string|Buffer|TypedArray|DataView}
+* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Object | undefined} An object representing the first row returned by
   the query, or `undefined` if no rows are returned.
@@ -1284,11 +1378,18 @@ called directly.
 
 <!-- YAML
 added: v24.9.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|string|Buffer|TypedArray|DataView}
+* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Iterator} An iterator that yields objects representing the rows returned by the query.
 
@@ -1301,11 +1402,18 @@ called directly.
 
 <!-- YAML
 added: v24.9.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62001
+    description: Add support for boolean values in bound parameters.
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62061
+    description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|string|Buffer|TypedArray|DataView}
+* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Object} An object containing information about the execution, including `changes` and `lastInsertRowid`.
 
@@ -1671,6 +1779,7 @@ callback function to indicate what type of operation is being authorized.
   </tr>
 </table>
 
+[Binding parameters]: #binding-parameters
 [Changesets and Patchsets]: https://www.sqlite.org/sessionintro.html#changesets_and_patchsets
 [Constants Passed To The Conflict Handler]: https://www.sqlite.org/session/c_changeset_conflict.html
 [Constants Returned From The Conflict Handler]: https://www.sqlite.org/session/c_changeset_abort.html
@@ -1719,6 +1828,8 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3session_create()`]: https://www.sqlite.org/session/sqlite3session_create.html
 [`sqlite3session_delete()`]: https://www.sqlite.org/session/sqlite3session_delete.html
 [`sqlite3session_patchset()`]: https://www.sqlite.org/session/sqlite3session_patchset.html
+[`statement.setAllowBareNamedParameters()`]: #statementsetallowbarenamedparametersenabled
+[`statement.setAllowUnknownNamedParameters()`]: #statementsetallowunknownnamedparametersenabled
 [busy timeout]: https://sqlite.org/c3ref/busy_timeout.html
 [connection]: https://www.sqlite.org/c3ref/sqlite3.html
 [data types]: https://www.sqlite.org/datatype3.html

From 4674a1036840e42b88547ed9e2dab3f2873c20f0 Mon Sep 17 00:00:00 2001
From: Hallison Pereira Melo <hallss93@hotmail.com>
Date: Sat, 8 Aug 2026 22:18:55 -0300
Subject: [PATCH 071/344] quic: convert incoming :status header to number

Signed-off-by: Hallison Melo <hallss93@hotmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
PR-URL: https://github.com/nodejs/node/pull/63589
Fixes: https://github.com/nodejs/node/issues/63557
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 doc/api/quic.md                               |  5 +-
 lib/internal/quic/quic.js                     | 15 +++--
 .../parallel/test-quic-h3-callback-errors.mjs |  4 +-
 test/parallel/test-quic-h3-close-behavior.mjs |  4 +-
 .../test-quic-h3-concurrent-requests.mjs      |  2 +-
 test/parallel/test-quic-h3-datagram.mjs       |  4 +-
 test/parallel/test-quic-h3-error-codes.mjs    |  4 +-
 test/parallel/test-quic-h3-goaway.mjs         |  2 +-
 .../test-quic-h3-header-validation.mjs        |  4 +-
 .../test-quic-h3-informational-headers.mjs    |  8 +--
 test/parallel/test-quic-h3-origin.mjs         |  4 +-
 test/parallel/test-quic-h3-pending-stream.mjs |  2 +-
 .../parallel/test-quic-h3-post-filehandle.mjs |  2 +-
 test/parallel/test-quic-h3-post-request.mjs   |  2 +-
 test/parallel/test-quic-h3-priority.mjs       | 10 +--
 test/parallel/test-quic-h3-qpack-settings.mjs |  2 +-
 .../test-quic-h3-request-response.mjs         |  4 +-
 test/parallel/test-quic-h3-settings.mjs       |  6 +-
 .../test-quic-h3-status-code-type.mjs         | 64 +++++++++++++++++++
 .../test-quic-h3-trailing-headers.mjs         |  4 +-
 ...est-quic-h3-zero-rtt-rejected-settings.mjs |  2 +-
 test/parallel/test-quic-h3-zero-rtt.mjs       |  4 +-
 22 files changed, 114 insertions(+), 44 deletions(-)
 create mode 100644 test/parallel/test-quic-h3-status-code-type.mjs

diff --git a/doc/api/quic.md b/doc/api/quic.md
index 9b0254337d76..b23f27984fc0 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -3980,8 +3980,9 @@ A few things to note:
   the request is `HEADERS` followed by `END_STREAM`.
 * The `onheaders` callback receives the response pseudo-headers and
   regular headers in a single object with lowercase string keys.
-  After the callback returns, the same object is also accessible
-  via [`stream.headers`][].
+  For incoming headers, the `:status` pseudo-header is converted to
+  a `number`, matching HTTP/2 behavior. After the callback returns,
+  the same object is also accessible via [`stream.headers`][].
 * Reading `for await (const chunks of stream)` consumes the response
   body. Each iteration yields a `Uint8Array[]` batch of chunks.
 * HTTP semantic helpers (URL parsing, method/status validation,
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 666e1f7b013b..f645998e628d 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -1285,14 +1285,19 @@ function parseHeaderPairs(pairs) {
   assert(pairs.length % 2 === 0);
   const block = { __proto__: null };
   for (let n = 0; n + 1 < pairs.length; n += 2) {
-    if (block[pairs[n]] !== undefined) {
-      if (ArrayIsArray(block[pairs[n]])) {
-        ArrayPrototypePush(block[pairs[n]], pairs[n + 1]);
+    const name = pairs[n];
+    let value = pairs[n + 1];
+    // Match HTTP/2 behavior: incoming :status is exposed as a number.
+    if (name === ':status')
+      value |= 0;
+    if (block[name] !== undefined) {
+      if (ArrayIsArray(block[name])) {
+        ArrayPrototypePush(block[name], value);
       } else {
-        block[pairs[n]] = [block[pairs[n]], pairs[n + 1]];
+        block[name] = [block[name], value];
       }
     } else {
-      block[pairs[n]] = pairs[n + 1];
+      block[name] = value;
     }
   }
   return block;
diff --git a/test/parallel/test-quic-h3-callback-errors.mjs b/test/parallel/test-quic-h3-callback-errors.mjs
index f4a9477ca873..be8ed391b8d5 100644
--- a/test/parallel/test-quic-h3-callback-errors.mjs
+++ b/test/parallel/test-quic-h3-callback-errors.mjs
@@ -151,7 +151,7 @@ async function makeServer(onheadersHandler, extraOpts = {}) {
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
     ontrailers: mustCall(function() {
       throw new Error('ontrailers sync error');
@@ -265,7 +265,7 @@ async function makeServer(onheadersHandler, extraOpts = {}) {
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-close-behavior.mjs b/test/parallel/test-quic-h3-close-behavior.mjs
index d25cd50e4ef5..e3b73ce9b0b9 100644
--- a/test/parallel/test-quic-h3-close-behavior.mjs
+++ b/test/parallel/test-quic-h3-close-behavior.mjs
@@ -62,7 +62,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall((headers) => {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
@@ -74,7 +74,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall((headers) => {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-concurrent-requests.mjs b/test/parallel/test-quic-h3-concurrent-requests.mjs
index c81403bf1362..5bd5635008ca 100644
--- a/test/parallel/test-quic-h3-concurrent-requests.mjs
+++ b/test/parallel/test-quic-h3-concurrent-requests.mjs
@@ -72,7 +72,7 @@ const requests = paths.map(mustCall(async (path) => {
       ':authority': 'localhost',
     },
     onheaders: mustCall((headers) => {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
       headersReceived.resolve();
     }),
   });
diff --git a/test/parallel/test-quic-h3-datagram.mjs b/test/parallel/test-quic-h3-datagram.mjs
index 4d081a9f1bce..38aeb971c8fe 100644
--- a/test/parallel/test-quic-h3-datagram.mjs
+++ b/test/parallel/test-quic-h3-datagram.mjs
@@ -87,7 +87,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
@@ -151,7 +151,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall((headers) => {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-error-codes.mjs b/test/parallel/test-quic-h3-error-codes.mjs
index cd5c9ff0a25a..3a91a2e8f056 100644
--- a/test/parallel/test-quic-h3-error-codes.mjs
+++ b/test/parallel/test-quic-h3-error-codes.mjs
@@ -55,7 +55,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
@@ -106,7 +106,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-goaway.mjs b/test/parallel/test-quic-h3-goaway.mjs
index c3b6e3ae246a..bb0bf8e966c1 100644
--- a/test/parallel/test-quic-h3-goaway.mjs
+++ b/test/parallel/test-quic-h3-goaway.mjs
@@ -78,7 +78,7 @@ dc.subscribe('quic.session.goaway', mustCall((msg) => {
   await clientSession.opened;
 
   const onClientHeaders = mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '200');
+    assert.strictEqual(headers[':status'], 200);
     if (++clientHeaderCount === 2) {
       bothHeadersReceived.resolve();
     }
diff --git a/test/parallel/test-quic-h3-header-validation.mjs b/test/parallel/test-quic-h3-header-validation.mjs
index 873991a89864..a75a884c39b9 100644
--- a/test/parallel/test-quic-h3-header-validation.mjs
+++ b/test/parallel/test-quic-h3-header-validation.mjs
@@ -91,7 +91,7 @@ const decoder = new TextDecoder();
     },
     onheaders: mustCall(function(headers) {
       // Client should also receive lowercased response header names.
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
       assert.strictEqual(headers['content-type'], 'text/html');
       assert.strictEqual(headers['x-response-header'], 'ResponseValue');
 
@@ -148,7 +148,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall((headers) => {
-      assert.strictEqual(headers[':status'], '204');
+      assert.strictEqual(headers[':status'], 204);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-informational-headers.mjs b/test/parallel/test-quic-h3-informational-headers.mjs
index 1bab5b26d436..357b507ae0db 100644
--- a/test/parallel/test-quic-h3-informational-headers.mjs
+++ b/test/parallel/test-quic-h3-informational-headers.mjs
@@ -34,7 +34,7 @@ dc.subscribe('quic.stream.info', mustCall((msg) => {
   assert.ok(msg.stream, 'stream.info should include stream');
   assert.ok(msg.session, 'stream.info should include session');
   assert.ok(msg.headers, 'stream.info should include headers');
-  assert.strictEqual(msg.headers[':status'], '103');
+  assert.strictEqual(msg.headers[':status'], 103);
 }));
 
 // quic.stream.headers also fires for the final response headers.
@@ -89,12 +89,12 @@ const stream = await clientSession.createBidirectionalStream({
     ':authority': 'localhost',
   },
   oninfo: mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '103');
+    assert.strictEqual(headers[':status'], 103);
     assert.strictEqual(headers.link, '</style.css>; rel=preload; as=style');
     clientInfoReceived.resolve();
   }),
   onheaders: mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '200');
+    assert.strictEqual(headers[':status'], 200);
     assert.strictEqual(headers['content-type'], 'text/plain');
     clientHeadersReceived.resolve();
   }),
@@ -107,7 +107,7 @@ const body = await bytes(stream);
 assert.strictEqual(decoder.decode(body), responseBody);
 
 // stream.headers should return the final (initial) headers, not 1xx.
-assert.strictEqual(stream.headers[':status'], '200');
+assert.strictEqual(stream.headers[':status'], 200);
 
 await Promise.all([stream.closed, serverDone.promise]);
 await clientSession.close();
diff --git a/test/parallel/test-quic-h3-origin.mjs b/test/parallel/test-quic-h3-origin.mjs
index 05e7d166585e..9f80449b6b65 100644
--- a/test/parallel/test-quic-h3-origin.mjs
+++ b/test/parallel/test-quic-h3-origin.mjs
@@ -77,7 +77,7 @@ const decoder = new TextDecoder();
       ':authority': 'example.com',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
@@ -173,7 +173,7 @@ const decoder = new TextDecoder();
       ':authority': 'custom-port.example.com',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-pending-stream.mjs b/test/parallel/test-quic-h3-pending-stream.mjs
index 836c032e2b99..a6e9c8cfd912 100644
--- a/test/parallel/test-quic-h3-pending-stream.mjs
+++ b/test/parallel/test-quic-h3-pending-stream.mjs
@@ -64,7 +64,7 @@ const decoder = new TextDecoder();
     priority: 'high',
     incremental: true,
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-post-filehandle.mjs b/test/parallel/test-quic-h3-post-filehandle.mjs
index ce6bec75c57a..a4c583463d24 100644
--- a/test/parallel/test-quic-h3-post-filehandle.mjs
+++ b/test/parallel/test-quic-h3-post-filehandle.mjs
@@ -76,7 +76,7 @@ writeFileSync(testFile, testContent);
     },
     body: fh,
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
       clientHeadersReceived.resolve();
     }),
   });
diff --git a/test/parallel/test-quic-h3-post-request.mjs b/test/parallel/test-quic-h3-post-request.mjs
index adf874a0e8aa..c5d9635a640c 100644
--- a/test/parallel/test-quic-h3-post-request.mjs
+++ b/test/parallel/test-quic-h3-post-request.mjs
@@ -84,7 +84,7 @@ const stream = await clientSession.createBidirectionalStream({
   },
   body: encoder.encode(requestBody),
   onheaders: mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '200');
+    assert.strictEqual(headers[':status'], 200);
     clientHeadersReceived.resolve();
   }),
 });
diff --git a/test/parallel/test-quic-h3-priority.mjs b/test/parallel/test-quic-h3-priority.mjs
index fcf7210b703c..10be3d6f216e 100644
--- a/test/parallel/test-quic-h3-priority.mjs
+++ b/test/parallel/test-quic-h3-priority.mjs
@@ -67,7 +67,7 @@ const decoder = new TextDecoder();
     priority: 'high',
     incremental: false,
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
@@ -85,7 +85,7 @@ const decoder = new TextDecoder();
     priority: 'low',
     incremental: true,
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
   assert.deepStrictEqual(stream2.priority, { level: 'low', incremental: true });
@@ -99,7 +99,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
   assert.deepStrictEqual(stream3.priority, { level: 'default', incremental: false });
@@ -113,7 +113,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
   // Default priority initially.
@@ -215,7 +215,7 @@ const decoder = new TextDecoder();
     },
     body: encoder.encode('signal'),
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
   assert.deepStrictEqual(stream.priority, { level: 'default', incremental: false });
diff --git a/test/parallel/test-quic-h3-qpack-settings.mjs b/test/parallel/test-quic-h3-qpack-settings.mjs
index e56730531c0f..f30b7163cf6b 100644
--- a/test/parallel/test-quic-h3-qpack-settings.mjs
+++ b/test/parallel/test-quic-h3-qpack-settings.mjs
@@ -35,7 +35,7 @@ async function makeRequest(clientSession, path) {
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
   const body = await bytes(stream);
diff --git a/test/parallel/test-quic-h3-request-response.mjs b/test/parallel/test-quic-h3-request-response.mjs
index e359e492f753..cde16684d7e9 100644
--- a/test/parallel/test-quic-h3-request-response.mjs
+++ b/test/parallel/test-quic-h3-request-response.mjs
@@ -93,7 +93,7 @@ const stream = await clientSession.createBidirectionalStream({
     ':authority': 'localhost',
   },
   onheaders: mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '200');
+    assert.strictEqual(headers[':status'], 200);
     assert.strictEqual(headers['content-type'], 'text/plain');
     clientHeadersReceived.resolve();
   }),
@@ -106,7 +106,7 @@ const body = await bytes(stream);
 assert.strictEqual(decoder.decode(body), responseBody);
 
 // stream.headers should return the buffered response headers.
-assert.strictEqual(stream.headers[':status'], '200');
+assert.strictEqual(stream.headers[':status'], 200);
 
 await Promise.all([stream.closed, serverDone.promise]);
 await clientSession.close();
diff --git a/test/parallel/test-quic-h3-settings.mjs b/test/parallel/test-quic-h3-settings.mjs
index 3a2bd9387f57..733d3865e872 100644
--- a/test/parallel/test-quic-h3-settings.mjs
+++ b/test/parallel/test-quic-h3-settings.mjs
@@ -71,7 +71,7 @@ const decoder = new TextDecoder();
       'x-second': 'two',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
@@ -129,7 +129,7 @@ const decoder = new TextDecoder();
       'x-long': longValue,
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
@@ -185,7 +185,7 @@ const decoder = new TextDecoder();
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
 
diff --git a/test/parallel/test-quic-h3-status-code-type.mjs b/test/parallel/test-quic-h3-status-code-type.mjs
new file mode 100644
index 000000000000..a1bc7178e17a
--- /dev/null
+++ b/test/parallel/test-quic-h3-status-code-type.mjs
@@ -0,0 +1,64 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Verify incoming :status is exposed as a number, matching HTTP/2 behavior.
+// See https://github.com/nodejs/node/issues/63557
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const codes = [200, 204, 404];
+let serverResponses = 0;
+const serverDone = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall(async (ss) => {
+  ss.onstream = mustCall(() => {
+    if (++serverResponses === codes.length) {
+      ss.close();
+      serverDone.resolve();
+    }
+  }, codes.length);
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  onheaders: mustCall(function() {
+    const status = codes[serverResponses - 1];
+    this.sendHeaders({ ':status': String(status) }, { terminal: true });
+    this.writer.endSync();
+  }, codes.length),
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+await clientSession.opened;
+
+for (const expected of codes) {
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': '/',
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+    onheaders: mustCall(function(headers) {
+      assert.strictEqual(typeof headers[':status'], 'number');
+      assert.strictEqual(headers[':status'], expected);
+    }),
+  });
+  await stream.closed;
+}
+
+await serverDone.promise;
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-trailing-headers.mjs b/test/parallel/test-quic-h3-trailing-headers.mjs
index e19886fa5bad..f4ffc223d4d5 100644
--- a/test/parallel/test-quic-h3-trailing-headers.mjs
+++ b/test/parallel/test-quic-h3-trailing-headers.mjs
@@ -94,7 +94,7 @@ const stream = await clientSession.createBidirectionalStream({
     ':authority': 'localhost',
   },
   onheaders: mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '200');
+    assert.strictEqual(headers[':status'], 200);
     clientHeadersReceived.resolve();
   }),
   ontrailers: mustCall(function(trailers) {
@@ -114,7 +114,7 @@ assert.strictEqual(decoder.decode(body), responseBody);
 await clientTrailersReceived.promise;
 
 // stream.headers should still be the initial headers, not trailers.
-assert.strictEqual(stream.headers[':status'], '200');
+assert.strictEqual(stream.headers[':status'], 200);
 
 await Promise.all([stream.closed, serverDone.promise]);
 await clientSession.close();
diff --git a/test/parallel/test-quic-h3-zero-rtt-rejected-settings.mjs b/test/parallel/test-quic-h3-zero-rtt-rejected-settings.mjs
index c17f2ad3994c..755bde188e0b 100644
--- a/test/parallel/test-quic-h3-zero-rtt-rejected-settings.mjs
+++ b/test/parallel/test-quic-h3-zero-rtt-rejected-settings.mjs
@@ -74,7 +74,7 @@ async function getTicket(endpointOptions) {
       ':authority': 'localhost',
     },
     onheaders: mustCall(function(headers) {
-      assert.strictEqual(headers[':status'], '200');
+      assert.strictEqual(headers[':status'], 200);
     }),
   });
   const body = await bytes(s);
diff --git a/test/parallel/test-quic-h3-zero-rtt.mjs b/test/parallel/test-quic-h3-zero-rtt.mjs
index ef51c63ee8aa..f836caa1ec4f 100644
--- a/test/parallel/test-quic-h3-zero-rtt.mjs
+++ b/test/parallel/test-quic-h3-zero-rtt.mjs
@@ -83,7 +83,7 @@ const s1 = await cs1.createBidirectionalStream({
     ':authority': 'localhost',
   },
   onheaders: mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '200');
+    assert.strictEqual(headers[':status'], 200);
   }),
 });
 const body1 = await bytes(s1);
@@ -111,7 +111,7 @@ const s2 = await cs2.createBidirectionalStream({
     ':authority': 'localhost',
   },
   onheaders: mustCall(function(headers) {
-    assert.strictEqual(headers[':status'], '200');
+    assert.strictEqual(headers[':status'], 200);
   }),
 });
 

From dad9548fbc8bd8b88bedf233c309d3d799e75eee Mon Sep 17 00:00:00 2001
From: Naman Trivedi <trivenay@amazon.com>
Date: Mon, 3 Aug 2026 22:29:08 +0000
Subject: [PATCH 072/344] http: emit drain on socket takeover and avoid stale
 HWM reuse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When OutgoingMessage transitions from pre-socket buffering (Path B) to
socket-connected writing (Path A), the backpressure domain changes —
subsequent writes go directly to the socket, which enforces its own
backpressure via socket.write() return values.  The OM should emit
drain at this transition point to signal that its buffer is clear and
the caller can resume writing under the socket backpressure regime.

Previously, _flush() gated drain emission on writableLength === 0
which included socket.writableLength.  This conflated two independent
backpressure domains: the OM pre-socket buffer and the socket kernel
write queue.  When the socket had a higher writableHighWaterMark than
the OM (e.g. agent-reused socket from a prior request), the socket
was never backpressured and never emitted drain, causing a permanent
deadlock.

Additionally, avoid reusing a pooled socket in http.Agent when its
writableHighWaterMark differs from the request highWaterMark, so that
the user backpressure threshold is respected for the common case of
the built-in Agent.

Signed-off-by: Naman Trivedi <trivenay@amazon.com>
Fixes: https://github.com/nodejs/node/issues/64680
Refs: https://github.com/nodejs/node/pull/64653
Refs: https://github.com/nodejs/node/pull/62936
PR-URL: https://github.com/nodejs/node/pull/64991
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 lib/_http_agent.js                            | 10 ++++
 lib/_http_outgoing.js                         |  6 +-
 .../test-http-agent-highwatermark-reuse.js    | 56 ++++++++++++++++++
 .../test-http-outgoing-flush-drain.js         | 57 +++++++++++++++++++
 4 files changed, 127 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-http-agent-highwatermark-reuse.js
 create mode 100644 test/parallel/test-http-outgoing-flush-drain.js

diff --git a/lib/_http_agent.js b/lib/_http_agent.js
index eb58650f8851..9e3129100f90 100644
--- a/lib/_http_agent.js
+++ b/lib/_http_agent.js
@@ -392,6 +392,16 @@ Agent.prototype.addRequest = function addRequest(req, options, port/* legacy */,
   const sockLen = freeLen + this.sockets[name].length;
 
   // Reusing a socket from the pool.
+  // If the caller specified a highWaterMark that differs from the pooled
+  // socket's writableHighWaterMark, sync the socket's HWM so that
+  // backpressure semantics match what the caller requested.
+  if (socket && options.highWaterMark != null &&
+      socket.writableHighWaterMark !== options.highWaterMark) {
+    debug('sync reused socket HWM (socket=%d, request=%d)',
+          socket.writableHighWaterMark, options.highWaterMark);
+    socket._writableState.highWaterMark = options.highWaterMark;
+  }
+
   if (socket) {
     asyncResetHandle(socket);
     this.reuseSocket(socket, req);
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index 41465bf42196..b266cf49971e 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -1230,12 +1230,14 @@ OutgoingMessage.prototype._flush = function _flush() {
 
   if (socket?.writable) {
     // There might be remaining data in this.output; write it out
-    this._flushOutput(socket);
+    const ret = this._flushOutput(socket);
 
     if (this.finished) {
       // This is a queue to the server or client to bring in the next this.
       this._finish();
-    } else if (this[kNeedDrain] && this.writableLength === 0) {
+    } else if (this[kNeedDrain] && ret !== false) {
+      // Socket accepted all data without backpressure - it won't emit
+      // drain, so we emit it since the OM buffer is now clear.
       this[kNeedDrain] = false;
       this.emit('drain');
     }
diff --git a/test/parallel/test-http-agent-highwatermark-reuse.js b/test/parallel/test-http-agent-highwatermark-reuse.js
new file mode 100644
index 000000000000..b78b475ef6f1
--- /dev/null
+++ b/test/parallel/test-http-agent-highwatermark-reuse.js
@@ -0,0 +1,56 @@
+'use strict';
+
+// Regression test: when a pooled socket's writableHighWaterMark differs from
+// the new request's highWaterMark, the agent must sync the socket's HWM so
+// that backpressure semantics match what the caller requested.
+//
+// See: https://github.com/nodejs/node/issues/64680
+
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+
+const server = http.createServer(common.mustCall((req, res) => {
+  req.resume();
+  req.on('end', () => res.end('ok'));
+}, 2));
+
+server.listen(0, common.mustCall(() => {
+  const port = server.address().port;
+  const agent = new http.Agent({ keepAlive: true });
+
+  // Request A: creates socket with HWM=1MB.
+  http.request({
+    host: 'localhost', port, method: 'POST', agent,
+    highWaterMark: 1024 * 1024,
+  }, common.mustCall((res) => {
+    res.resume();
+    res.on('end', common.mustCall(() => {
+      // Wait for socket to return to pool.
+      setTimeout(common.mustCall(requestB), 100);
+    }));
+  })).end('x');
+
+  function requestB() {
+    const freeCount = Object.values(agent.freeSockets).flat().length;
+    assert.strictEqual(freeCount, 1);
+
+    // Request B: HWM=10KB — agent must sync the reused socket's HWM.
+    const reqB = http.request({
+      host: 'localhost', port, method: 'POST', agent,
+      highWaterMark: 10 * 1024,
+    }, common.mustCall((res) => {
+      res.resume();
+      res.on('end', common.mustCall(() => {
+        server.close();
+      }));
+    }));
+
+    reqB.on('socket', common.mustCall((socket) => {
+      // Socket HWM must be synced to the request's value.
+      assert.strictEqual(socket.writableHighWaterMark, 10 * 1024);
+    }));
+
+    reqB.end('y');
+  }
+}));
diff --git a/test/parallel/test-http-outgoing-flush-drain.js b/test/parallel/test-http-outgoing-flush-drain.js
new file mode 100644
index 000000000000..12b5a5036cce
--- /dev/null
+++ b/test/parallel/test-http-outgoing-flush-drain.js
@@ -0,0 +1,57 @@
+'use strict';
+
+// Regression test: when _flush() hands buffered data to a socket whose
+// writableHighWaterMark is higher than the OutgoingMessage's kHighWaterMark,
+// drain must still fire.  Previously, _flush() gated drain emission on
+// writableLength === 0, which included socket.writableLength — but the
+// socket was never backpressured (data < socket HWM), so drain never fired.
+//
+// See: https://github.com/nodejs/node/issues/64680
+
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+
+// Server that delays reading to keep socket.writableLength > 0 during flush.
+const server = http.createServer(common.mustCall((req, res) => {
+  setTimeout(() => {
+    req.resume();
+    req.on('end', () => res.end('ok'));
+  }, 500);
+}, 2));
+
+server.listen(0, common.mustCall(() => {
+  const port = server.address().port;
+  const agent = new http.Agent({ keepAlive: true });
+
+  // Request A: creates socket with HWM=2MB.
+  http.request({
+    host: 'localhost', port, method: 'POST', agent,
+    highWaterMark: 2 * 1024 * 1024,
+  }, common.mustCall((res) => {
+    res.resume();
+    res.on('end', common.mustCall(() => {
+      // Wait for socket to return to pool.
+      setTimeout(common.mustCall(() => {
+        // Request B: default HWM (64KB), reuses socket (HWM=2MB).
+        // Write 500KB: above OM HWM (64KB), below socket HWM (2MB).
+        const reqB = http.request({
+          host: 'localhost', port, method: 'POST', agent,
+        }, common.mustCall((res2) => {
+          res2.resume();
+          res2.on('end', common.mustCall(() => {
+            server.close();
+          }));
+        }));
+
+        const result = reqB.write(Buffer.alloc(500 * 1024));
+        assert.strictEqual(result, false);
+
+        // Drain must fire — no deadlock.
+        reqB.on('drain', common.mustCall(() => {
+          reqB.end();
+        }));
+      }), 100);
+    }));
+  })).end('x');
+}));

From d8acfc45f117ba362f4afdca03ffee0eae16ce95 Mon Sep 17 00:00:00 2001
From: Luan Muniz <luanmuniz@users.noreply.github.com>
Date: Sun, 9 Aug 2026 09:43:52 +0200
Subject: [PATCH 073/344] benchmark: add test runner hooks and options

Add benchmarks for node:test hooks and test options.

The hooks benchmark covers before, after, beforeEach,
and afterEach, with a none mode as the baseline.

The test options benchmark covers skip and todo behavior.
This adds coverage for part of the benchmark/test_runner gaps
tracked in the issue.

Refs: https://github.com/nodejs/node/issues/55723
Signed-off-by: Luan Muniz <luan@luanmuniz.com.br>
PR-URL: https://github.com/nodejs/node/pull/63754
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
---
 benchmark/test_runner/hooks.js        |  51 ++++++++++++
 benchmark/test_runner/test-options.js | 114 ++++++++++++++++++++++++++
 2 files changed, 165 insertions(+)
 create mode 100644 benchmark/test_runner/hooks.js
 create mode 100644 benchmark/test_runner/test-options.js

diff --git a/benchmark/test_runner/hooks.js b/benchmark/test_runner/hooks.js
new file mode 100644
index 000000000000..dc73ff4fb1e1
--- /dev/null
+++ b/benchmark/test_runner/hooks.js
@@ -0,0 +1,51 @@
+'use strict';
+
+const common = require('../common');
+const { finished } = require('node:stream/promises');
+const reporter = require('../fixtures/empty-test-reporter');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  describe,
+  it,
+} = require('node:test');
+
+const bench = common.createBenchmark(main, {
+  n: [1000],
+  hook: ['before', 'after', 'beforeEach', 'afterEach'],
+}, {
+  // We don't want to test the reporter here.
+  flags: ['--test-reporter=./benchmark/fixtures/empty-test-reporter.js'],
+});
+
+const hookList = {
+  before: before,
+  after: after,
+  beforeEach: beforeEach,
+  afterEach: afterEach,
+};
+
+const noop = () => {};
+
+function run(loopAmount, hookFn) {
+  for (let i = 0; i < loopAmount; i++) {
+    describe(`${i}`, () => {
+      hookFn(noop);
+      it(`${i}`, noop);
+    });
+  }
+
+  return finished(reporter);
+}
+
+function main(params) {
+  const hookFn = hookList[params.hook];
+
+  bench.start();
+
+  run(params.n, hookFn).then(() => {
+    bench.end(params.n);
+  });
+}
diff --git a/benchmark/test_runner/test-options.js b/benchmark/test_runner/test-options.js
new file mode 100644
index 000000000000..1d608c1f9ccb
--- /dev/null
+++ b/benchmark/test_runner/test-options.js
@@ -0,0 +1,114 @@
+'use strict';
+
+const common = require('../common');
+const { finished } = require('node:stream/promises');
+const reporter = require('../fixtures/empty-test-reporter');
+const { it } = require('node:test');
+
+const bench = common.createBenchmark(main, {
+  n: [10000],
+  option: [
+    'none',
+    'skip',
+    'skip-with-message',
+    'skip-method',
+    'skip-method-with-message',
+    'todo',
+    'todo-with-message',
+    'todo-method',
+    'todo-method-with-message',
+  ],
+}, {
+  // We don't want to test the reporter here.
+  flags: ['--test-reporter=./benchmark/fixtures/empty-test-reporter.js'],
+});
+
+const noop = () => {};
+
+const allTests = {
+  'none': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, noop);
+    }
+
+    return finished(reporter);
+  },
+  'skip': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, { skip: true }, () => {
+        throw new Error('This test should not run.');
+      });
+    }
+
+    return finished(reporter);
+  },
+  'skip-with-message': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, { skip: 'skip reason' }, () => {
+        throw new Error('This test should not run.');
+      });
+    }
+
+    return finished(reporter);
+  },
+  'skip-method': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, (t) => {
+        t.skip();
+      });
+    }
+
+    return finished(reporter);
+  },
+  'skip-method-with-message': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, (t) => {
+        t.skip('skip reason');
+      });
+    }
+
+    return finished(reporter);
+  },
+  'todo': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, { todo: true }, noop);
+    }
+
+    return finished(reporter);
+  },
+  'todo-with-message': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, { todo: 'todo reason' }, noop);
+    }
+
+    return finished(reporter);
+  },
+  'todo-method': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, (t) => {
+        t.todo();
+      });
+    }
+
+    return finished(reporter);
+  },
+  'todo-method-with-message': (loopAmount) => {
+    for (let i = 0; i < loopAmount; i++) {
+      it(`${i}`, (t) => {
+        t.todo('todo reason');
+      });
+    }
+
+    return finished(reporter);
+  },
+};
+
+function main({ n, option }) {
+  const runOption = allTests[option];
+
+  bench.start();
+
+  runOption(n).then(() => {
+    bench.end(n);
+  });
+}

From 5a852b22d49fe9bf1aed425463b83acb448fc128 Mon Sep 17 00:00:00 2001
From: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Date: Sun, 9 Aug 2026 09:44:02 +0200
Subject: [PATCH 074/344] sqlite: check null returns from sqlite value
 functions

sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: https://github.com/nodejs/node/pull/63288
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/node_sqlite.cc | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index e3604d97bc53..027372e42daa 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -121,6 +121,10 @@ inline MaybeLocal<String> Utf8StringMaybeOneByte(Isolate* isolate,
       case SQLITE_TEXT: {                                                      \
         const char* v =                                                        \
             reinterpret_cast<const char*>(sqlite3_##from##_text(__VA_ARGS__)); \
+        if (v == nullptr) [[unlikely]] {                                       \
+          THROW_ERR_MEMORY_ALLOCATION_FAILED((isolate));                       \
+          break;                                                               \
+        }                                                                      \
         const int v_len = sqlite3_##from##_bytes(__VA_ARGS__);                 \
         (result) =                                                             \
             Utf8StringMaybeOneByte((isolate), std::string_view(v, v_len))      \
@@ -138,7 +142,9 @@ inline MaybeLocal<String> Utf8StringMaybeOneByte(Isolate* isolate,
             sqlite3_##from##_blob(__VA_ARGS__));                               \
         auto store = ArrayBuffer::NewBackingStore(                             \
             (isolate), size, BackingStoreInitializationMode::kUninitialized);  \
-        memcpy(store->Data(), data, size);                                     \
+        if (data != nullptr) [[likely]] {                                      \
+          memcpy(store->Data(), data, size);                                   \
+        }                                                                      \
         auto ab = ArrayBuffer::New((isolate), std::move(store));               \
         (result) = Uint8Array::New(ab, 0, size);                               \
         break;                                                                 \

From 9633bb0f2957acbbc85a5f91d6c938b21b33df69 Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Sun, 9 Aug 2026 17:06:32 +0900
Subject: [PATCH 075/344] doc: fix permission documentation examples

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64897
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 doc/api/permissions.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index c387e899cf1a..0b46f42d982a 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -138,7 +138,7 @@ const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');
 // Drop read access to /etc/myapp after initialization
 process.permission.drop('fs.read', '/etc/myapp');
 
-// This will now throw ERR_ACCESS_DENIED
+// This will now return false
 process.permission.has('fs.read', '/etc/myapp/config.json'); // false
 
 // Drop child process permission entirely
@@ -219,7 +219,7 @@ $ node --permission index.js
 * `index.js` will be included in the allowed file system read list
 
 ```console
-$ node -r /path/to/custom-require.js --permission index.js.
+$ node -r /path/to/custom-require.js --permission index.js
 ```
 
 * `/path/to/custom-require.js` will be included in the allowed file system read

From 7fc8a3ad8cd289f8f7476dd409ec82400212cf27 Mon Sep 17 00:00:00 2001
From: kyungrae2002 <148605113+kyungrae2002@users.noreply.github.com>
Date: Sun, 9 Aug 2026 17:06:42 +0900
Subject: [PATCH 076/344] test,doc: cover and document multi-byte offset/size
 in randomFill

Signed-off-by: kyungrae <kyungrae2002@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64834
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 doc/api/crypto.md                   | 18 +++++++----
 lib/internal/crypto/random.js       |  2 +-
 test/parallel/test-crypto-random.js | 49 +++++++++++++++++++++++++++++
 3 files changed, 62 insertions(+), 7 deletions(-)

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 6811bfb40d91..659905e17482 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -5608,9 +5608,12 @@ changes:
 
 * `buffer` {ArrayBuffer|Buffer|TypedArray|DataView} Must be supplied. The
   size of the provided `buffer` must not be larger than `2**31 - 1`.
-* `offset` {number} **Default:** `0`
-* `size` {number} **Default:** `buffer.length - offset`. The `size` must
-  not be larger than `2**31 - 1`.
+* `offset` {number} The start position, in elements for a `TypedArray` and in
+  bytes for an `ArrayBuffer` or `DataView`. **Default:** `0`
+* `size` {number} The amount to fill, in the same units as `offset`.
+  **Default:** `buffer.length - offset` for a `TypedArray`, or
+  `buffer.byteLength - offset` for an `ArrayBuffer` or `DataView`. The `size`
+  must not be larger than `2**31 - 1`.
 * `callback` {Function} `function(err, buf) {}`.
 
 This function is similar to [`crypto.randomBytes()`][] but requires the first
@@ -5745,9 +5748,12 @@ changes:
 
 * `buffer` {ArrayBuffer|Buffer|TypedArray|DataView} Must be supplied. The
   size of the provided `buffer` must not be larger than `2**31 - 1`.
-* `offset` {number} **Default:** `0`
-* `size` {number} **Default:** `buffer.length - offset`. The `size` must
-  not be larger than `2**31 - 1`.
+* `offset` {number} The start position, in elements for a `TypedArray` and in
+  bytes for an `ArrayBuffer` or `DataView`. **Default:** `0`
+* `size` {number} The amount to fill, in the same units as `offset`.
+  **Default:** `buffer.length - offset` for a `TypedArray`, or
+  `buffer.byteLength - offset` for an `ArrayBuffer` or `DataView`. The `size`
+  must not be larger than `2**31 - 1`.
 * Returns: {ArrayBuffer|Buffer|TypedArray|DataView} The object passed as
   `buffer` argument.
 
diff --git a/lib/internal/crypto/random.js b/lib/internal/crypto/random.js
index a75c14fd2a1c..919ad68f5617 100644
--- a/lib/internal/crypto/random.js
+++ b/lib/internal/crypto/random.js
@@ -168,7 +168,7 @@ function randomFill(buf, offset, size, callback) {
     size = buf.length;
   } else if (typeof size === 'function') {
     callback = size;
-    size = buf.length - offset;
+    size = (buf.length ?? buf.byteLength) - offset;
   } else {
     validateFunction(callback, 'callback');
   }
diff --git a/test/parallel/test-crypto-random.js b/test/parallel/test-crypto-random.js
index ceaa859a0e03..88b6fcba84d7 100644
--- a/test/parallel/test-crypto-random.js
+++ b/test/parallel/test-crypto-random.js
@@ -218,6 +218,55 @@ common.expectWarning('DeprecationWarning',
   }));
 }
 
+{
+  const buf = new Uint16Array(10);
+  const before = Buffer.from(buf.buffer).toString('hex');
+  crypto.randomFillSync(buf, 1, 8);
+  const after = Buffer.from(buf.buffer).toString('hex');
+  assert.notStrictEqual(before, after);
+  assert.deepStrictEqual(before.slice(0, 4), after.slice(0, 4));
+  assert.deepStrictEqual(before.slice(-4), after.slice(-4));
+}
+
+{
+  const buf = new Uint32Array(10);
+  const before = Buffer.from(buf.buffer).toString('hex');
+  crypto.randomFillSync(buf, 1, 8);
+  const after = Buffer.from(buf.buffer).toString('hex');
+  assert.notStrictEqual(before, after);
+  assert.deepStrictEqual(before.slice(0, 8), after.slice(0, 8));
+  assert.deepStrictEqual(before.slice(-8), after.slice(-8));
+}
+
+{
+  const buf = new Uint16Array(10);
+  const before = Buffer.from(buf.buffer).toString('hex');
+  crypto.randomFill(buf, 1, 8, common.mustSucceed((buf) => {
+    const after = Buffer.from(buf.buffer).toString('hex');
+    assert.notStrictEqual(before, after);
+    assert.deepStrictEqual(before.slice(0, 4), after.slice(0, 4));
+    assert.deepStrictEqual(before.slice(-4), after.slice(-4));
+  }));
+}
+
+{
+  const buf = new Uint32Array(10);
+  const before = Buffer.from(buf.buffer).toString('hex');
+  crypto.randomFill(buf, 1, 8, common.mustSucceed((buf) => {
+    const after = Buffer.from(buf.buffer).toString('hex');
+    assert.notStrictEqual(before, after);
+    assert.deepStrictEqual(before.slice(0, 8), after.slice(0, 8));
+    assert.deepStrictEqual(before.slice(-8), after.slice(-8));
+  }));
+}
+
+{
+  // randomFill() with an offset and no size must not throw for types
+  // without a .length property, matching randomFillSync().
+  crypto.randomFill(new ArrayBuffer(10), 2, common.mustSucceed());
+  crypto.randomFill(new DataView(new ArrayBuffer(10)), 2, common.mustSucceed());
+}
+
 {
   [
     Buffer.alloc(10),

From 5b64b377391008cd2c7fa745c371447e80fd13d4 Mon Sep 17 00:00:00 2001
From: Brian Muenzenmeyer <brian.muenzenmeyer@gmail.com>
Date: Sun, 9 Aug 2026 03:06:52 -0500
Subject: [PATCH 077/344] doc: report proper return type on urlPattern.test

Signed-off-by: bmuenzenmeyer <brian.muenzenmeyer@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64831
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/url.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/api/url.md b/doc/api/url.md
index bdc27144fa3a..7759c03a15e7 100644
--- a/doc/api/url.md
+++ b/doc/api/url.md
@@ -830,6 +830,7 @@ console.log(myPattern.exec('https://nodejs.org/docs/latest/api/dns.html'));
 
 * `input` {string | Object} A URL or URL parts
 * `baseURL` {string | undefined} A base URL string
+* Returns {boolean}
 
 Input can be a string or an object providing the individual URL parts. The
 object members can be any of `protocol`, `username`, `password`, `hostname`,

From 31c1bcb627056f20b25f0e75b9dce2729d93e9f8 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 9 Aug 2026 12:42:30 +0200
Subject: [PATCH 078/344] tools: delay removal of `commit-queue` label
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The removes the possiblity for a PR to drop from the queue if the CQ job
is cancelled (or times out) in the middle of handling a PR.
This increases the window for two concurrent CQ jobs to pick up the same
PR, but that's an unlikely scenario.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65101
Refs: https://github.com/nodejs/node/issues/64972
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 tools/actions/commit-queue.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index aa63a442377a..b6e62139d626 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -15,7 +15,7 @@ COMMIT_QUEUE_FAILED_LABEL="commit-queue-failed"
 commit_queue_failed() {
   pr=$1
 
-  gh pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}"
+  gh pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
 
   # shellcheck disable=SC2154
   cqurl="${GITHUB_SERVER_URL}/${OWNER}/${REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
@@ -47,9 +47,6 @@ for pr in "$@"; do
     continue
   fi
 
-  # Delete the commit queue label
-  gh pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL"
-
   if jq -e 'map(.name) | index("commit-queue-squash")' < labels.json; then
     MULTIPLE_COMMIT_POLICY="--fixupAll"
   elif jq -e 'map(.name) | index("commit-queue-rebase")' < labels.json; then
@@ -114,6 +111,9 @@ for pr in "$@"; do
   gh pr comment "$pr" --body "Landed in $commits"
 
   [ -z "$MULTIPLE_COMMIT_POLICY" ] && gh pr close "$pr"
+
+  # Delete the commit queue label (but ignore errors, it's no big deal if a closed PR still has the label)
+  gh pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL" || true
 done
 
 rm -f labels.json

From 8f5f48ad9690b033bc9cfc26ff756b78139dac79 Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Sun, 9 Aug 2026 20:38:10 +0900
Subject: [PATCH 079/344] doc: fix broken internal links

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64901
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 doc/api/child_process.md                | 2 +-
 doc/contributing/large-pull-requests.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index e90759b16d3f..913542c2dc06 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -2390,7 +2390,7 @@ or [`child_process.fork()`][].
 [`subprocess.stdin`]: #subprocessstdin
 [`subprocess.stdio`]: #subprocessstdio
 [`subprocess.stdout`]: #subprocessstdout
-[`util.convertProcessSignalToExitCode()`]: util.md#utilconvertprocesssignaltoexitcodesignalcode
+[`util.convertProcessSignalToExitCode()`]: util.md#utilconvertprocesssignaltoexitcodesignal
 [`util.promisify()`]: util.md#utilpromisifyoriginal
 [synchronous counterparts]: #synchronous-process-creation
 [v8.serdes]: v8.md#serialization-api
diff --git a/doc/contributing/large-pull-requests.md b/doc/contributing/large-pull-requests.md
index 8920ffdcbb37..6660fb0d48f1 100644
--- a/doc/contributing/large-pull-requests.md
+++ b/doc/contributing/large-pull-requests.md
@@ -8,7 +8,7 @@
   * [Review guide](#review-guide)
   * [Approval requirements](#approval-requirements)
   * [Dependency changes](#dependency-changes)
-* [Splitting large pull requests](#splitting-large-pull-requests)
+* [Avoiding large pull requests](#avoiding-large-pull-requests)
   * [Feature forks and branches](#feature-forks-and-branches)
 * [Guidance for reviewers](#guidance-for-reviewers)
 

From b5182f0a1ce120e3365907beff948ecac1371d26 Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Sun, 9 Aug 2026 20:55:05 +0900
Subject: [PATCH 080/344] lib: use validateArray for array arguments

Replace manual ArrayIsArray checks that throw ERR_INVALID_ARG_TYPE with
the shared validateArray helper. The error code, argument name and
expected type are unchanged, so the thrown error stays identical.

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64959
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
---
 lib/internal/streams/iter/broadcast.js |  9 +++------
 lib/internal/streams/iter/classic.js   |  6 ++----
 lib/internal/streams/iter/push.js      | 11 +++--------
 lib/internal/tls/secure-context.js     |  6 ++----
 lib/tls.js                             |  6 ++----
 5 files changed, 12 insertions(+), 26 deletions(-)

diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 5eadbb0da49f..4799554b4f50 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -33,6 +33,7 @@ const {
 } = require('internal/errors');
 const {
   validateAbortSignal,
+  validateArray,
   validateInteger,
   validateObject,
 } = require('internal/validators');
@@ -559,9 +560,7 @@ class BroadcastWriter {
   }
 
   writev(chunks, options) {
-    if (!ArrayIsArray(chunks)) {
-      throw new ERR_INVALID_ARG_TYPE('chunks', 'Array', chunks);
-    }
+    validateArray(chunks, 'chunks');
     const signal = getWriterSignal(options);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
@@ -620,9 +619,7 @@ class BroadcastWriter {
   }
 
   writevSync(chunks) {
-    if (!ArrayIsArray(chunks)) {
-      throw new ERR_INVALID_ARG_TYPE('chunks', 'Array', chunks);
-    }
+    validateArray(chunks, 'chunks');
     if (this.#isClosedOrAborted()) return false;
     if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
diff --git a/lib/internal/streams/iter/classic.js b/lib/internal/streams/iter/classic.js
index 6796fa4cefc3..0769348a3981 100644
--- a/lib/internal/streams/iter/classic.js
+++ b/lib/internal/streams/iter/classic.js
@@ -12,7 +12,6 @@
 //   toWritable(writer)           -- stream/iter Writer -> classic Writable
 
 const {
-  ArrayIsArray,
   ArrayPrototypePush,
   NumberMAX_SAFE_INTEGER,
   Promise,
@@ -41,6 +40,7 @@ const {
 } = require('internal/errors');
 
 const {
+  validateArray,
   validateInteger,
   validateObject,
 } = require('internal/validators');
@@ -619,9 +619,7 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writev(chunks, options) {
-      if (!ArrayIsArray(chunks)) {
-        throw new ERR_INVALID_ARG_TYPE('chunks', 'Array', chunks);
-      }
+      validateArray(chunks, 'chunks');
       getWriterSignal(options);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 1b0b5b35dab2..cc7bfc900cec 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -6,7 +6,6 @@
 // with built-in backpressure.
 
 const {
-  ArrayIsArray,
   ArrayPrototypePush,
   PromisePrototypeThen,
   PromiseReject,
@@ -21,13 +20,13 @@ const {
 
 const {
   codes: {
-    ERR_INVALID_ARG_TYPE,
     ERR_INVALID_STATE,
   },
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
 const {
   validateAbortSignal,
+  validateArray,
   validateInteger,
 } = require('internal/validators');
 
@@ -629,9 +628,7 @@ class PushWriter {
   }
 
   writev(chunks, options) {
-    if (!ArrayIsArray(chunks)) {
-      throw new ERR_INVALID_ARG_TYPE('chunks', 'Array', chunks);
-    }
+    validateArray(chunks, 'chunks');
     const signal = getWriterSignal(options);
     if (!signal && this.#queue.canWriteSync()) {
       const bytes = convertChunks(chunks);
@@ -648,9 +645,7 @@ class PushWriter {
   }
 
   writevSync(chunks) {
-    if (!ArrayIsArray(chunks)) {
-      throw new ERR_INVALID_ARG_TYPE('chunks', 'Array', chunks);
-    }
+    validateArray(chunks, 'chunks');
     const bytes = convertChunks(chunks);
     return this.#queue.writeSync(bytes);
   }
diff --git a/lib/internal/tls/secure-context.js b/lib/internal/tls/secure-context.js
index 41c3bb57acd8..862d7501a1d9 100644
--- a/lib/internal/tls/secure-context.js
+++ b/lib/internal/tls/secure-context.js
@@ -26,6 +26,7 @@ const {
 } = require('internal/util/types');
 
 const {
+  validateArray,
   validateBuffer,
   validateInt32,
   validateObject,
@@ -212,10 +213,7 @@ function configSecureContext(context, options = kEmptyObject, name = 'options')
   }
 
   if (certificateCompression != null) {
-    if (!ArrayIsArray(certificateCompression)) {
-      throw new ERR_INVALID_ARG_TYPE(
-        `${name}.certificateCompression`, 'Array', certificateCompression);
-    }
+    validateArray(certificateCompression, `${name}.certificateCompression`);
 
     if (certificateCompression.length > 0) {
       // Pack length + algorithm IDs into a single Uint32 for a cheap
diff --git a/lib/tls.js b/lib/tls.js
index 296f6189da17..d2ecc7f0a583 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -70,7 +70,7 @@ const { canonicalizeIP } = internalBinding('cares_wrap');
 const tlsCommon = require('internal/tls/common');
 const tlsWrap = require('internal/tls/wrap');
 const { domainToASCII } = require('internal/url');
-const { validateString } = require('internal/validators');
+const { validateArray, validateString } = require('internal/validators');
 
 const {
   namespace: {
@@ -206,9 +206,7 @@ function getCACertificates(type = 'default') {
 exports.getCACertificates = getCACertificates;
 
 function setDefaultCACertificates(certs) {
-  if (!ArrayIsArray(certs)) {
-    throw new ERR_INVALID_ARG_TYPE('certs', 'Array', certs);
-  }
+  validateArray(certs, 'certs');
 
   // Verify that all elements in the array are strings
   for (let i = 0; i < certs.length; i++) {

From 001c37c0a24cc6ac5f4f9c53bb0fa74b8270bf5e Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Tue, 28 Jul 2026 00:37:53 +0800
Subject: [PATCH 081/344] url: bounds-check short Windows file URL paths

Check the decoded pathname length before reading the drive letter and
colon. This prevents an out-of-bounds read for short URLs such as
file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64788
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 src/node_url.cc          |  6 ++++++
 test/cctest/test_path.cc | 24 ++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/src/node_url.cc b/src/node_url.cc
index 9553942496f8..38aa7fc48eb1 100644
--- a/src/node_url.cc
+++ b/src/node_url.cc
@@ -665,6 +665,12 @@ std::optional<std::string> FileURLToPath(Environment* env,
     return "\\\\" + ada::idna::to_unicode(hostname) + decoded_pathname;
   }
 
+  if (decoded_pathname.size() < 3) {
+    THROW_ERR_INVALID_FILE_URL_PATH(env->isolate(),
+                                    "File URL path must be absolute");
+    return std::nullopt;
+  }
+
   char letter = decoded_pathname[1] | 0x20;
   char sep = decoded_pathname[2];
 
diff --git a/test/cctest/test_path.cc b/test/cctest/test_path.cc
index 9e860d02cf77..1fd991340452 100644
--- a/test/cctest/test_path.cc
+++ b/test/cctest/test_path.cc
@@ -8,6 +8,7 @@
 #include "v8.h"
 
 using node::BufferValue;
+using node::NormalizeFileURLOrPath;
 using node::PathResolve;
 using node::ToNamespacedPath;
 
@@ -93,3 +94,26 @@ TEST_F(PathTest, ToNamespacedPath) {
   EXPECT_EQ(data.ToStringView(), "hello world");  // Input should not be mutated
 #endif
 }
+
+#ifdef _WIN32
+TEST_F(PathTest, NormalizeShortFileURLPath) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv, node::EnvironmentFlags::kNoBrowserGlobals};
+  v8::TryCatch try_catch(isolate_);
+
+  EXPECT_EQ(NormalizeFileURLOrPath(*env, "file:///"), "");
+  ASSERT_TRUE(try_catch.HasCaught());
+
+  v8::Local<v8::Value> exception = try_catch.Exception();
+  ASSERT_TRUE(exception->IsObject());
+  v8::Local<v8::Value> code;
+  ASSERT_TRUE(exception.As<v8::Object>()
+                  ->Get((*env)->context(),
+                        v8::String::NewFromUtf8Literal(isolate_, "code"))
+                  .ToLocal(&code));
+  ASSERT_TRUE(code->IsString());
+  node::Utf8Value code_value(isolate_, code);
+  EXPECT_EQ(code_value.ToStringView(), "ERR_INVALID_FILE_URL_PATH");
+}
+#endif

From 1d9dd252f19da35454af2fcf96201e169f5d7878 Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Mon, 27 Jul 2026 16:02:41 +0800
Subject: [PATCH 082/344] sea: reject malformed --node-options values

Propagate tokenization errors from ParseNodeOptionsEnvVar through
FixupArgsForSEA and abort startup with an invalid command-line status
instead of applying partially parsed options.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64803
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node.cc                                   |  9 +++++-
 src/node_sea.cc                               | 10 +++++--
 src/node_sea.h                                |  4 ++-
 ...ble-application-exec-argv-extension-cli.js | 30 +++++++++++++++----
 4 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/src/node.cc b/src/node.cc
index b5455fe40356..00282634419d 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1631,7 +1631,14 @@ static ExitCode StartInternal(int argc, char** argv) {
 
 int Start(int argc, char** argv) {
 #ifndef DISABLE_SINGLE_EXECUTABLE_APPLICATION
-  std::tie(argc, argv) = sea::FixupArgsForSEA(argc, argv);
+  std::vector<std::string> errors;
+  std::tie(argc, argv) = sea::FixupArgsForSEA(argc, argv, &errors);
+  if (!errors.empty()) {
+    for (const std::string& error : errors) {
+      FPrintF(stderr, "%s: %s\n", argv[0], error);
+    }
+    return static_cast<int>(ExitCode::kInvalidCommandLineArgument);
+  }
 #endif
   return static_cast<int>(StartInternal(argc, argv));
 }
diff --git a/src/node_sea.cc b/src/node_sea.cc
index 1be41e6f1414..9b8454039129 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -283,7 +283,9 @@ void IsExperimentalSeaWarningNeeded(const FunctionCallbackInfo<Value>& args) {
       sea_resource.flags & SeaFlags::kDisableExperimentalSeaWarning));
 }
 
-std::tuple<int, char**> FixupArgsForSEA(int argc, char** argv) {
+std::tuple<int, char**> FixupArgsForSEA(int argc,
+                                        char** argv,
+                                        std::vector<std::string>* errors) {
   // Repeats argv[0] at position 1 on argv as a replacement for the missing
   // entry point file path.
   if (IsSingleExecutable()) {
@@ -303,8 +305,10 @@ std::tuple<int, char**> FixupArgsForSEA(int argc, char** argv) {
       for (int i = 1; i < argc; ++i) {
         if (strncmp(argv[i], "--node-options=", 15) == 0) {
           std::string node_options = argv[i] + 15;
-          std::vector<std::string> errors;
-          cli_extension_args = ParseNodeOptionsEnvVar(node_options, &errors);
+          cli_extension_args = ParseNodeOptionsEnvVar(node_options, errors);
+          if (!errors->empty()) {
+            return {argc, argv};
+          }
           // Remove this argument by shifting the rest
           for (int j = i; j < argc - 1; ++j) {
             argv[j] = argv[j + 1];
diff --git a/src/node_sea.h b/src/node_sea.h
index dd0b89db841e..b147caefa5e5 100644
--- a/src/node_sea.h
+++ b/src/node_sea.h
@@ -70,7 +70,9 @@ struct SeaResource {
 bool IsSingleExecutable();
 std::string_view FindSingleExecutableBlob();
 SeaResource FindSingleExecutableResource();
-std::tuple<int, char**> FixupArgsForSEA(int argc, char** argv);
+std::tuple<int, char**> FixupArgsForSEA(int argc,
+                                        char** argv,
+                                        std::vector<std::string>* errors);
 node::ExitCode WriteSingleExecutableBlob(
     const std::string& config_path,
     const std::vector<std::string>& args,
diff --git a/test/sea/test-single-executable-application-exec-argv-extension-cli.js b/test/sea/test-single-executable-application-exec-argv-extension-cli.js
index 3999cf0cbaec..82f539063341 100644
--- a/test/sea/test-single-executable-application-exec-argv-extension-cli.js
+++ b/test/sea/test-single-executable-application-exec-argv-extension-cli.js
@@ -20,18 +20,36 @@ tmpdir.refresh();
 
 const outputFile = buildSEA(fixtures.path('sea', 'exec-argv-extension-cli'));
 
+const env = {
+  ...process.env,
+  NODE_OPTIONS: '--max-old-space-size=2048', // Should be ignored
+  COMMON_DIRECTORY: join(__dirname, '..', 'common'),
+  NODE_DEBUG_NATIVE: 'SEA',
+};
+
 // Test that --node-options works with execArgvExtension: "cli"
 spawnSyncAndAssert(
   outputFile,
   ['--node-options=--max-old-space-size=1024', 'user-arg1', 'user-arg2'],
   {
-    env: {
-      ...process.env,
-      NODE_OPTIONS: '--max-old-space-size=2048', // Should be ignored
-      COMMON_DIRECTORY: join(__dirname, '..', 'common'),
-      NODE_DEBUG_NATIVE: 'SEA',
-    },
+    env,
   },
   {
     stdout: /execArgvExtension cli test passed/,
   });
+
+// Test that malformed --node-options values are rejected.
+[
+  ['--no-warnings "', /unterminated string/],
+  ['"--no-warnings\\', /invalid escape/],
+].forEach(([nodeOptions, stderr]) => {
+  spawnSyncAndAssert(
+    outputFile,
+    [`--node-options=${nodeOptions}`],
+    { env },
+    {
+      status: 9,
+      stdout: '',
+      stderr,
+    });
+});

From ad7c67026b14907425e494239089fa00abfe80b5 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Fri, 7 Aug 2026 20:14:51 +0200
Subject: [PATCH 083/344] lib: harden webidl dictionary member reads

Member descriptors are plain object literals that spell out only the
members they need, so createDictionaryConverter() reading the optional
validator, defaultValue and required members off them resolves through
%Object.prototype%.

Copy each descriptor once at construction time with every key present.
They keep an ordinary prototype because a null-prototype object literal
lands in V8 dictionary mode, and dictionaries with no defaults and no
required members now skip steps 4.1.5 and 4.1.6.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65115
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/webidl.js | 56 +++++++++++++++++++++++++++++++++---------
 1 file changed, 45 insertions(+), 11 deletions(-)

diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 13575d4f730d..7f61bae8c21f 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -20,6 +20,7 @@ const {
   NumberIsNaN,
   NumberMAX_SAFE_INTEGER,
   NumberMIN_SAFE_INTEGER,
+  ObjectPrototypeHasOwnProperty,
   ObjectPrototypeIsPrototypeOf,
   SafeArrayIterator,
   SafeSet,
@@ -699,16 +700,47 @@ function createDictionaryConverter(
   const dictionaries = ArrayIsArray(members[0]) ? members : [members];
   const sortedDictionaries = [];
 
+  function ownMember(member, key) {
+    return ObjectPrototypeHasOwnProperty(member, key) ? member[key] : undefined;
+  }
+
+  // Dictionaries with no defaults and no required members skip steps
+  // 4.1.5/4.1.6 entirely, keeping the absent-member path free.
+  let anyMissingMemberHandling = false;
+
   // Web IDL dictionary conversion steps 3-4 process inherited dictionaries
   // from least-derived to most-derived and sort only within each dictionary.
   // Callers with inheritance pass one member array per dictionary level.
   for (let i = 0; i < dictionaries.length; i++) {
-    ArrayPrototypePush(
-      sortedDictionaries,
-      ArrayPrototypeToSorted(dictionaries[i], compareMembers),
+    const sortedMembers = ArrayPrototypeToSorted(
+      dictionaries[i],
+      compareMembers,
     );
+    // Definition sites spell out only the members they need, so reading the
+    // optional ones below would resolve through %Object.prototype%.
+    // Re-materialize each descriptor once with every key present, copied from
+    // own properties only. The ordinary prototype is deliberate: nothing
+    // consults it now, and detaching it measurably slows these reads down.
+    for (let j = 0; j < sortedMembers.length; j++) {
+      const member = sortedMembers[j];
+      const defaultValue = ownMember(member, 'defaultValue');
+      const required = ownMember(member, 'required');
+      if (typeof defaultValue === 'function' || required) {
+        anyMissingMemberHandling = true;
+      }
+      sortedMembers[j] = {
+        key: ownMember(member, 'key'),
+        converter: ownMember(member, 'converter'),
+        defaultValue,
+        required,
+        validator: ownMember(member, 'validator'),
+      };
+    }
+    ArrayPrototypePush(sortedDictionaries, sortedMembers);
   }
 
+  const hasMissingMemberHandling = anyMissingMemberHandling;
+
   return function(jsDict, options = kEmptyObject) {
     // Step 1: reject non-object, non-null, non-undefined values.
     if (jsDict != null && type(jsDict) !== 'Object') {
@@ -747,14 +779,16 @@ function createDictionaryConverter(
           member.validator?.(idlMemberValue, jsDict);
           // Step 4.1.4.2: set idlDict[key] to the IDL value.
           idlDict[key] = idlMemberValue;
-        } else if (typeof member.defaultValue === 'function') {
-          // Step 4.1.5: store the member default value.
-          idlDict[key] = member.defaultValue();
-        } else if (member.required) {
-          // Step 4.1.6: required missing members throw.
-          throw makeException(
-            missingDictionaryMemberMessage(dictionaryName, key),
-            makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
+        } else if (hasMissingMemberHandling) {
+          if (typeof member.defaultValue === 'function') {
+            // Step 4.1.5: store the member default value.
+            idlDict[key] = member.defaultValue();
+          } else if (member.required) {
+            // Step 4.1.6: required missing members throw.
+            throw makeException(
+              missingDictionaryMemberMessage(dictionaryName, key),
+              makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
+          }
         }
       }
     }

From d8a0f288ab3aa45f4d527d21eba785da867d34cc Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Mon, 10 Aug 2026 03:10:51 +0800
Subject: [PATCH 084/344] src: match cmd.exe case-insensitively in task runner

Use a case-insensitive suffix comparison for ComSpec so uppercase and
mixed-case CMD.EXE paths use the correct /c invocation.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64907
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 src/node_task_runner.cc        |  6 +++++-
 test/parallel/test-node-run.js | 22 ++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/node_task_runner.cc b/src/node_task_runner.cc
index 2b3e005abf34..9263a502a45f 100644
--- a/src/node_task_runner.cc
+++ b/src/node_task_runner.cc
@@ -60,7 +60,11 @@ ProcessRunner::ProcessRunner(std::shared_ptr<InitializationResultImpl> result,
   }
 
 #ifdef _WIN32
-  if (file_.ends_with("cmd.exe")) {
+  static constexpr std::string_view cmd_exe = "cmd.exe";
+  if (file_.size() >= cmd_exe.size() &&
+      StringEqualNoCaseN(file_.data() + file_.size() - cmd_exe.size(),
+                         cmd_exe.data(),
+                         cmd_exe.size())) {
     // If the file is cmd.exe, use the following command line arguments:
     // "/c" Carries out the command and exit.
     // "/d" Disables execution of AutoRun commands.
diff --git a/test/parallel/test-node-run.js b/test/parallel/test-node-run.js
index 7c1f6609f6f1..ece9e48878b3 100644
--- a/test/parallel/test-node-run.js
+++ b/test/parallel/test-node-run.js
@@ -37,6 +37,28 @@ describe('node --run [command]', () => {
     assert.strictEqual(child.code, 1);
   });
 
+  it('recognizes cmd.exe case-insensitively', {
+    skip: !common.isWindows,
+  }, async () => {
+    const env = { ...process.env };
+    const comspecKey = Object.keys(env)
+      .find((key) => key.toLowerCase() === 'comspec');
+    assert.notStrictEqual(comspecKey, undefined);
+    const comspec = env[comspecKey];
+    assert.match(comspec, /cmd\.exe$/i);
+    delete env[comspecKey];
+    env.ComSpec = comspec.replace(/cmd\.exe$/i, 'CMD.EXE');
+
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run', 'pwd-windows'],
+      { cwd: fixtures.path('run-script'), env },
+    );
+    assert.strictEqual(child.stdout.trim(), fixtures.path('run-script'));
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+  });
+
   it('adds node_modules/.bin to path', async () => {
     const child = await common.spawnPromisified(
       process.execPath,

From 64a8843ff25122f5932daed0b4f218144f04eba1 Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Mon, 10 Aug 2026 03:11:12 +0800
Subject: [PATCH 085/344] sea: reject trailing content in config JSON

Ensure the on-demand parser reaches the end of the document after
reading the root object. Reject concatenated JSON values with
TRAILING_CONTENT

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64774
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 src/node_sea.cc                                |  8 ++++++++
 ...est-single-executable-blob-config-errors.js | 18 ++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/src/node_sea.cc b/src/node_sea.cc
index 9b8454039129..1518b32ebc4a 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -541,6 +541,14 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
     }
   }
 
+  if (!document.at_end()) {
+    FPrintF(stderr,
+            "Cannot parse JSON from %s: %s\n",
+            config_path,
+            simdjson::error_message(simdjson::TRAILING_CONTENT));
+    return std::nullopt;
+  }
+
   if (static_cast<bool>(result.flags & SeaFlags::kUseSnapshot) &&
       static_cast<bool>(result.flags & SeaFlags::kUseCodeCache)) {
     // TODO(joyeecheung): code cache in snapshot should be configured by
diff --git a/test/sea/test-single-executable-blob-config-errors.js b/test/sea/test-single-executable-blob-config-errors.js
index 322f430aad81..9562faad6b79 100644
--- a/test/sea/test-single-executable-blob-config-errors.js
+++ b/test/sea/test-single-executable-blob-config-errors.js
@@ -47,6 +47,24 @@ const { spawnSyncAndAssert } = require('../common/child_process');
     });
 }
 
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('trailing-content.json');
+  writeFileSync(
+    config,
+    '{"main":"bundle.js","output":"sea.blob"}{}',
+    'utf8',
+  );
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /TRAILING_CONTENT/,
+    });
+}
+
 {
   tmpdir.refresh();
   const config = tmpdir.resolve('empty.json');

From 3126ce57792b8a0df5e60781d2743071520c04d4 Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Mon, 10 Aug 2026 03:11:28 +0800
Subject: [PATCH 086/344] sea: handle NUL bytes in asset keys

Construct the asset lookup string_view with the explicit Utf8Value
length so embedded NUL bytes do not truncate keys.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64773
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 src/node_sea.cc                          | 2 +-
 test/fixtures/sea/assets/sea-config.json | 2 ++
 test/fixtures/sea/assets/sea.js          | 6 ++++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/node_sea.cc b/src/node_sea.cc
index 1518b32ebc4a..901f2a95529c 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -841,7 +841,7 @@ void GetAsset(const FunctionCallbackInfo<Value>& args) {
   if (sea_resource.assets.empty()) {
     return;
   }
-  auto it = sea_resource.assets.find(*key);
+  auto it = sea_resource.assets.find(std::string_view(*key, key.length()));
   if (it == sea_resource.assets.end()) {
     return;
   }
diff --git a/test/fixtures/sea/assets/sea-config.json b/test/fixtures/sea/assets/sea-config.json
index 78a64534b44e..979bda0dca13 100644
--- a/test/fixtures/sea/assets/sea-config.json
+++ b/test/fixtures/sea/assets/sea-config.json
@@ -2,6 +2,8 @@
   "main": "sea.js",
   "output": "sea-prep.blob",
   "assets": {
+    "a": "utf8_test_text.txt",
+    "a\u0000b": "person.jpg",
     "utf8_test_text.txt": "utf8_test_text.txt",
     "person.jpg": "person.jpg"
   }
diff --git a/test/fixtures/sea/assets/sea.js b/test/fixtures/sea/assets/sea.js
index e1a2189aa4da..b6b775fdd159 100644
--- a/test/fixtures/sea/assets/sea.js
+++ b/test/fixtures/sea/assets/sea.js
@@ -54,6 +54,12 @@ assert(isSea());
 const textAssetOnDisk = readFileSync(process.env.__TEST_UTF8_TEXT_PATH, 'utf8');
 const binaryAssetOnDisk = readFileSync(process.env.__TEST_PERSON_JPG);
 
+// Check asset keys containing NUL.
+{
+  assert.strictEqual(getAsset('a', 'utf8'), textAssetOnDisk);
+  assert.deepStrictEqual(Buffer.from(getAsset('a\0b')), binaryAssetOnDisk);
+}
+
 // Check getAsset() buffer copies.
 {
   // Check that the asset embedded is the same as the original.

From f32a8631ad07811411ca2f5c4802e0251c77528b Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Mon, 10 Aug 2026 03:11:39 +0800
Subject: [PATCH 087/344] sea: avoid dangling CLI option pointers

Reserve exec argv storage before inserting configured and CLI-expanded
arguments so vector reallocation cannot invalidate pointers in argv.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64755
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 src/node_sea.cc                                             | 5 +++--
 test/fixtures/sea/exec-argv-extension-cli/sea-config.json   | 1 -
 test/fixtures/sea/exec-argv-extension-cli/sea.js            | 2 +-
 ...single-executable-application-exec-argv-extension-cli.js | 6 +++++-
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/node_sea.cc b/src/node_sea.cc
index 901f2a95529c..81d47c11ffab 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -325,10 +325,11 @@ std::tuple<int, char**> FixupArgsForSEA(int argc,
                      cli_extension_args.size() + 2);
     new_argv.emplace_back(argv[0]);
 
+    exec_argv_storage.reserve(sea_resource.exec_argv.size() +
+                              cli_extension_args.size());
+
     // Insert exec argv from SEA config
     if (!sea_resource.exec_argv.empty()) {
-      exec_argv_storage.reserve(sea_resource.exec_argv.size() +
-                                cli_extension_args.size());
       for (const auto& arg : sea_resource.exec_argv) {
         exec_argv_storage.emplace_back(arg);
         new_argv.emplace_back(exec_argv_storage.back().data());
diff --git a/test/fixtures/sea/exec-argv-extension-cli/sea-config.json b/test/fixtures/sea/exec-argv-extension-cli/sea-config.json
index 0ec0d706b384..cb4606558c7f 100644
--- a/test/fixtures/sea/exec-argv-extension-cli/sea-config.json
+++ b/test/fixtures/sea/exec-argv-extension-cli/sea-config.json
@@ -2,6 +2,5 @@
   "main": "sea.js",
   "output": "sea-prep.blob",
   "disableExperimentalSEAWarning": true,
-  "execArgv": ["--no-warnings"],
   "execArgvExtension": "cli"
 }
diff --git a/test/fixtures/sea/exec-argv-extension-cli/sea.js b/test/fixtures/sea/exec-argv-extension-cli/sea.js
index e9585483fcc2..11bc7fa36560 100644
--- a/test/fixtures/sea/exec-argv-extension-cli/sea.js
+++ b/test/fixtures/sea/exec-argv-extension-cli/sea.js
@@ -3,7 +3,7 @@ const assert = require('assert');
 console.log('process.argv:', JSON.stringify(process.argv));
 console.log('process.execArgv:', JSON.stringify(process.execArgv));
 
-// Should have execArgv from SEA config + CLI --node-options
+// Should have all options from CLI --node-options
 assert.deepStrictEqual(process.execArgv, ['--no-warnings', '--max-old-space-size=1024']);
 
 assert.deepStrictEqual(process.argv.slice(2), [
diff --git a/test/sea/test-single-executable-application-exec-argv-extension-cli.js b/test/sea/test-single-executable-application-exec-argv-extension-cli.js
index 82f539063341..8055fe642ece 100644
--- a/test/sea/test-single-executable-application-exec-argv-extension-cli.js
+++ b/test/sea/test-single-executable-application-exec-argv-extension-cli.js
@@ -30,7 +30,11 @@ const env = {
 // Test that --node-options works with execArgvExtension: "cli"
 spawnSyncAndAssert(
   outputFile,
-  ['--node-options=--max-old-space-size=1024', 'user-arg1', 'user-arg2'],
+  [
+    '--node-options=--no-warnings --max-old-space-size=1024',
+    'user-arg1',
+    'user-arg2',
+  ],
   {
     env,
   },

From 73de450845ab044d8054dfc80c14ab52bcdfb096 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 9 Aug 2026 21:26:21 +0200
Subject: [PATCH 088/344] tools: use the read-only token when filtering PRs in
 CQ

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65169
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 .github/workflows/commit-queue.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 16cb6fef3e3a..641fe2a71742 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -58,6 +58,8 @@ jobs:
   commitQueue:
     needs: get_candidate_prs
     if: needs.get_candidate_prs.outputs.candidates != ''
+    permissions:
+      pull-requests: read
     runs-on: ubuntu-slim
     steps:
       # Install dependencies
@@ -78,13 +80,13 @@ jobs:
           ncu-config --global set branch "${GITHUB_REF_NAME}"
           ncu-config --global set upstream origin
           ncu-config --global set username "$USERNAME"
-          ncu-config --global set token "$GITHUB_TOKEN"
+          ncu-config --global set token "$GH_TOKEN"
           ncu-config --global set jenkins_token "$JENKINS_TOKEN"
           ncu-config --global set repo "${REPOSITORY}"
           ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
       - name: Filter Pull Requests
@@ -154,7 +156,7 @@ jobs:
           echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
         env:
           CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         if: steps.get_mergeable_prs.outputs.numbers != ''
@@ -167,6 +169,8 @@ jobs:
 
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''
-        run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
+        run: |
+          ncu-config set token "$GH_TOKEN"
+          ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}

From 8765afd4c2769f7ea0e1a06cdad0828ce65d7aa0 Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:32:48 +0800
Subject: [PATCH 089/344] process: validate resource stats array offsets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Assert that the internally allocated Float64Array views used by CPU,
thread CPU, memory, and resource statistics have zero byte offsets.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65098
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 src/node_process_methods.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/node_process_methods.cc b/src/node_process_methods.cc
index 1c695be2d5fa..8f800be35431 100644
--- a/src/node_process_methods.cc
+++ b/src/node_process_methods.cc
@@ -107,6 +107,7 @@ inline Local<ArrayBuffer> get_fields_array_buffer(
   CHECK(args[index]->IsFloat64Array());
   Local<Float64Array> arr = args[index].As<Float64Array>();
   CHECK_EQ(arr->Length(), array_length);
+  CHECK_EQ(arr->ByteOffset(), 0);
   return arr->Buffer();
 }
 

From 8b0bdd931ce2321a8bf3c269889a34d4aa5b0a23 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sun, 2 Aug 2026 21:34:44 +0000
Subject: [PATCH 090/344] ffi: shrink trampoline placement probe window

AllocateCodeNear() searched 1024 pages in each direction for a free
page next to the native target, one MAP_FIXED_NOREPLACE mmap per
candidate. Every probe is expected to fail, so an exhausted window cost
up to 2048 failing syscalls before taking the plain-mmap fallback that
was already there, all to enable a jmp rel32 instead of movabs+jmp.
Resolving a fast-eligible signature plateaued at ~790us, against ~28us
for one that allocates no trampoline.

Reduce the window to 16 pages per direction, bounding the exhausted
case to 32 probes while still covering typical per-library symbol
counts. Placement stays opportunistic: the caller already emits the
absolute form when EmitJmpRel32() reports the target is out of range.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/64969
Fixes: https://github.com/nodejs/node/issues/64968
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 benchmark/ffi/get-function.js | 48 +++++++++++++++++++++++++++++++++++
 src/ffi/platforms/x64.cc      | 11 +++++++-
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 benchmark/ffi/get-function.js

diff --git a/benchmark/ffi/get-function.js b/benchmark/ffi/get-function.js
new file mode 100644
index 000000000000..3c1e2e974ce6
--- /dev/null
+++ b/benchmark/ffi/get-function.js
@@ -0,0 +1,48 @@
+'use strict';
+
+// Measures symbol resolution rather than call throughput. Creating a callable
+// for a fast-eligible signature emits a native trampoline, so this benchmark
+// covers the trampoline allocation path that the call benchmarks never reach.
+//
+// The `fast` variant is eligible for a generated trampoline; `slow` exceeds the
+// x86_64 register budget and falls back, so it resolves without allocating one.
+// Comparing the two isolates trampoline creation cost from the rest of symbol
+// resolution.
+
+const common = require('../common.js');
+const { DynamicLibrary } = require('node:ffi');
+const { libraryPath, ensureFixtureLibrary } = require('./common.js');
+
+const bench = common.createBenchmark(main, {
+  signature: ['fast', 'slow'],
+  n: [1e3],
+}, {
+  flags: ['--experimental-ffi'],
+});
+
+ensureFixtureLibrary();
+
+const signatures = {
+  fast: { name: 'add_i32', return: 'i32', arguments: ['i32', 'i32'] },
+  slow: {
+    name: 'sum_8_i32',
+    return: 'i32',
+    arguments: ['i32', 'i32', 'i32', 'i32', 'i32', 'i32', 'i32', 'i32'],
+  },
+};
+
+function main({ n, signature }) {
+  const { name, ...definition } = signatures[signature];
+  const lib = new DynamicLibrary(libraryPath);
+
+  // Warm up one-time initialization (libffi setup, executable memory probe) so
+  // it is not attributed to the measured resolutions.
+  lib.getFunction(name, definition);
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    lib.getFunction(name, definition);
+  bench.end(n);
+
+  lib.close();
+}
diff --git a/src/ffi/platforms/x64.cc b/src/ffi/platforms/x64.cc
index e105eabc13db..d5c15c381574 100644
--- a/src/ffi/platforms/x64.cc
+++ b/src/ffi/platforms/x64.cc
@@ -294,7 +294,16 @@ void* AllocateCodeNear(uintptr_t target_address, size_t code_size) {
     const uintptr_t base = target_address & ~(page_size - 1);
     // Search a small window around the target first. Shared libraries usually
     // leave nearby holes, and keeping the trampoline close enables jmp rel32.
-    constexpr uintptr_t kMaxPages = 1024;
+    //
+    // The window doubles as the capacity of the near-text region: every
+    // trampoline keeps one page in it, so about 2 * kMaxPages trampolines per
+    // library can use jmp rel32 before the window is full and later ones take
+    // the far placement below. Each candidate costs an mmap syscall that is
+    // expected to fail, and a layout with no hole within a few pages of the
+    // text rarely has one further out either, so a wide window mostly buys
+    // failed probes. Keep it small enough that an exhausted window costs a few
+    // microseconds while still covering typical per-library symbol counts.
+    constexpr uintptr_t kMaxPages = 16;
     for (uintptr_t i = 1; i <= kMaxPages; i++) {
       const uintptr_t delta = i * page_size;
       const uintptr_t candidates[] = {

From 3e6688c5e34dc377d90e701925e061a9ef906f4e Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sun, 2 Aug 2026 23:08:03 +0000
Subject: [PATCH 091/344] ffi: reuse the callable created per symbol

CreateFunction() ran on every getFunction() call, every getFunctions()
call, and every read of the functions accessor, each time emitting a
trampoline, allocating an FFIFunctionInfo, and on the SharedBuffer path
an ArrayBuffer. lib.functions.foo was therefore a different function on
each read, and calling through the accessor in a loop leaked a page per
iteration until GC: 20000 calls grew RSS by 58 MiB.

Cache the created callable per symbol in function_wrappers_, and
memoize the JS wrapper composed around it. Both entries are weak, so
dropping the last user reference still releases the wrapper and its
trampoline. The JS side stores a WeakRef because V8 can keep a raw
function alive after the wrapper is gone, and a strong value would pin
every wrapper for the lifetime of the library.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/64971
Fixes: https://github.com/nodejs/node/issues/64970
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 doc/api/ffi.md                       |  4 ++-
 lib/ffi.js                           | 37 +++++++++++++++++--------
 src/node_ffi.cc                      | 28 +++++++++++++++++++
 src/node_ffi.h                       |  6 +++++
 test/ffi/test-ffi-dynamic-library.js | 40 ++++++++++++++++++++++++++++
 5 files changed, 103 insertions(+), 12 deletions(-)

diff --git a/doc/api/ffi.md b/doc/api/ffi.md
index 09b78d64fc68..158aadffa3e3 100644
--- a/doc/api/ffi.md
+++ b/doc/api/ffi.md
@@ -363,7 +363,8 @@ The returned function has a `.pointer` property containing the native function
 address as a `bigint`.
 
 If the same symbol has already been resolved, requesting it again with a
-different signature throws.
+different signature throws. Requesting it again with the same signature returns
+the same function, as does reading it from [`library.functions`][].
 
 ```cjs
 const { DynamicLibrary, suffix } = require('node:ffi');
@@ -766,5 +767,6 @@ and keep callback and pointer lifetimes explicit on the native side.
 [Permission Model]: permissions.md#permission-model
 [`--allow-ffi`]: cli.md#--allow-ffi
 [`ffi.toBuffer(pointer, length, copy)`]: #ffitobufferpointer-length-copy
+[`library.functions`]: #libraryfunctions
 [`using`]: https://tc39.es/proposal-explicit-resource-management/#sec-using-declarations
 [type names]: #type-names
diff --git a/lib/ffi.js b/lib/ffi.js
index cde6cca7a86e..edb12ed4ed45 100644
--- a/lib/ffi.js
+++ b/lib/ffi.js
@@ -7,6 +7,8 @@ const {
   ObjectGetOwnPropertyDescriptor,
   ObjectKeys,
   ObjectPrototypeToString,
+  SafeWeakMap,
+  SafeWeakRef,
   SymbolDispose,
 } = primordials;
 const { Buffer } = require('buffer');
@@ -80,23 +82,36 @@ function makeSignature(argumentTypes, returnType) {
   };
 }
 
+// The native layer hands out one raw function per resolved symbol, so the
+// wrapper composed around it is reused too, otherwise every read of
+// `library.functions` would return callables that are not identical to the
+// previous read's. The entry holds a WeakRef because V8 can keep a raw function
+// alive after user code drops the wrapper, and a strong value would then pin
+// every wrapper for the lifetime of the library.
+const wrappedFunctions = new SafeWeakMap();
+
 function wrapFFIFunction(rawFn, owner) {
-  let argumentTypes;
+  if (rawFn === undefined || rawFn === null) {
+    return rawFn;
+  }
+  const cached = wrappedFunctions.get(rawFn)?.deref();
+  if (cached !== undefined) {
+    return cached;
+  }
   let returnType;
-  if (rawFn !== undefined && rawFn !== null) {
-    const sbArguments = rawFn[kSbArguments];
-    argumentTypes = sbArguments ?? rawFn[kFastArguments];
-    if (sbArguments !== undefined) {
-      returnType = rawFn[kSbReturn];
-    }
+  const sbArguments = rawFn[kSbArguments];
+  const argumentTypes = sbArguments ?? rawFn[kFastArguments];
+  if (sbArguments !== undefined) {
+    returnType = rawFn[kSbReturn];
   }
-  const wrapped = wrapWithSharedBuffer(
+  let wrapped = wrapWithSharedBuffer(
     rawFn,
     argumentTypes === undefined ? undefined : makeSignature(argumentTypes, returnType));
-  if (wrapped !== rawFn) {
-    return wrapped;
+  if (wrapped === rawFn) {
+    wrapped = wrapWithRawPointerConversions(rawFn, argumentTypes, owner);
   }
-  return wrapWithRawPointerConversions(rawFn, argumentTypes, owner);
+  wrappedFunctions.set(rawFn, new SafeWeakRef(wrapped));
+  return wrapped;
 }
 
 const rawGetFunction = DynamicLibrary.prototype.getFunction;
diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 638ad4feafdf..1e1fc5654591 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -83,6 +83,12 @@ void DynamicLibrary::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackFieldWithSize(
       "symbols", symbols_size, "std::unordered_map<std::string, void*>");
 
+  tracker->TrackFieldWithSize(
+      "function_wrappers",
+      function_wrappers_.size() *
+          sizeof(decltype(function_wrappers_)::value_type),
+      "std::unordered_map<std::string, v8::Global<v8::Function>>");
+
   // FFIFunctionInfo instances and their sb_backing ArrayBuffers are
   // owned by V8 function wrappers and reachable only via weak references,
   // so they are deliberately not counted here.
@@ -108,6 +114,7 @@ void DynamicLibrary::Close() {
 
   symbols_.clear();
   functions_.clear();
+  function_wrappers_.clear();
   callbacks_.clear();
 }
 
@@ -259,6 +266,19 @@ MaybeLocal<Function> DynamicLibrary::CreateFunction(
   Isolate* isolate = env->isolate();
   Local<Context> context = env->context();
 
+  // Creating a callable emits a trampoline, allocates an FFIFunctionInfo, and
+  // on the SharedBuffer path allocates an ArrayBuffer, so reuse the one already
+  // handed out for this symbol. `PrepareFunction()` rejects a request that uses
+  // a different signature, so a hit always describes the same signature. An
+  // empty handle means the wrapper was collected; fall through and rebuild.
+  auto cached = function_wrappers_.find(name);
+  if (cached != function_wrappers_.end()) {
+    if (!cached->second.IsEmpty()) {
+      return cached->second.Get(isolate);
+    }
+    function_wrappers_.erase(cached);
+  }
+
   auto info = FFIFunctionInfo::Create(env, fn, this);
 
   DCHECK_EQ(fn->args.size(), fn->arg_type_names.size());
@@ -454,6 +474,14 @@ MaybeLocal<Function> DynamicLibrary::CreateFunction(
     }
   }
 
+  // A strong handle would root the callable, which holds the library object
+  // through FFIFunctionInfo, so neither could ever be collected. Weaken the
+  // stored handle instead, so the cache lasts exactly as long as user code
+  // keeps a reference. SetWeak() runs after the move into the map because
+  // moving a handle relocates the underlying slot.
+  function_wrappers_.emplace(name, Global<Function>(isolate, ret))
+      .first->second.SetWeak();
+
   return ret;
 }
 
diff --git a/src/node_ffi.h b/src/node_ffi.h
index 07bd0163db75..7758380138fd 100644
--- a/src/node_ffi.h
+++ b/src/node_ffi.h
@@ -169,6 +169,12 @@ class DynamicLibrary : public BaseObject {
   std::string path_;
   std::unordered_map<std::string, void*> symbols_;
   std::unordered_map<std::string, std::shared_ptr<FFIFunction>> functions_;
+  // Callables created for `functions_`, so repeated resolution of the same
+  // symbol reuses one wrapper instead of emitting another trampoline. The
+  // handles are weak: an entry disappears once user code drops the wrapper,
+  // which keeps the map from rooting the library through the wrapper's
+  // FFIFunctionInfo.
+  std::unordered_map<std::string, v8::Global<v8::Function>> function_wrappers_;
   std::unordered_map<void*, std::unique_ptr<FFICallback>> callbacks_;
 };
 
diff --git a/test/ffi/test-ffi-dynamic-library.js b/test/ffi/test-ffi-dynamic-library.js
index 2a6aa4129e95..82400335a12f 100644
--- a/test/ffi/test-ffi-dynamic-library.js
+++ b/test/ffi/test-ffi-dynamic-library.js
@@ -176,6 +176,46 @@ test('getFunction caches signatures consistently', () => {
   }
 });
 
+test('resolving the same symbol reuses one function', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+  const definitions = { add_i32: fixtureSymbols.add_i32 };
+
+  try {
+    // Every resolution used to build a new callable, allocating another
+    // trampoline and making `lib.functions.add_i32` a different function on
+    // each read.
+    const fn = lib.getFunction('add_i32', fixtureSymbols.add_i32);
+    assert.strictEqual(lib.getFunction('add_i32', fixtureSymbols.add_i32), fn);
+    assert.strictEqual(lib.functions.add_i32, fn);
+    assert.strictEqual(lib.getFunctions().add_i32, fn);
+    assert.strictEqual(lib.getFunctions(definitions).add_i32, fn);
+    assert.strictEqual(fn(20, 22), 42);
+  } finally {
+    lib.close();
+  }
+});
+
+test('a dropped function wrapper is collectable', async () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+
+  try {
+    // Caching the wrapper must not pin it, so that dropping the last user
+    // reference still releases the wrapper and the trampoline it owns.
+    let fn = lib.getFunction('add_i32', fixtureSymbols.add_i32);
+    const ref = new WeakRef(fn);
+    fn = null;
+
+    await gcUntil('a dropped function wrapper is collectable', () => {
+      return ref.deref() === undefined;
+    });
+
+    fn = lib.getFunction('add_i32', fixtureSymbols.add_i32);
+    assert.strictEqual(fn(20, 22), 42);
+  } finally {
+    lib.close();
+  }
+});
+
 test('FFI functions keep their owning library alive', async () => {
   let lib = new ffi.DynamicLibrary(libraryPath);
   const addI32 = lib.getFunction('add_i32', fixtureSymbols.add_i32);

From c89878c3c8317d0a9a62a7ae29b968e2440ac8c2 Mon Sep 17 00:00:00 2001
From: "Kamat, Trivikram" <16024985+trivikr@users.noreply.github.com>
Date: Mon, 27 Jul 2026 19:45:54 -0700
Subject: [PATCH 092/344] sqlite: reject deserialize() while in a callback

deserialize() could be called from a user-defined function invoked
during statement execution, tearing down the database connection while
sqlite3_step() was still using it. Reuse the existing callback depth
check to throw ERR_INVALID_STATE instead, matching the guard already
in place for close().

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/64796
Refs: https://github.com/nodejs/node/issues/64795
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 doc/api/sqlite.md                      |  7 +++++--
 src/node_sqlite.cc                     |  4 ++++
 test/parallel/test-sqlite-serialize.js | 17 +++++++++++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index e1ce547bb6d9..449e88bfb3a5 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -621,8 +621,10 @@ added: v26.1.0
 Loads a serialized database into this connection, replacing the current
 database. The deserialized database is writable. Existing prepared statements
 are finalized before deserialization is attempted, even if the operation
-subsequently fails. This method is a wrapper around
-[`sqlite3_deserialize()`][].
+subsequently fails. An [`ERR_INVALID_STATE`][] error is thrown if the method is
+called while a database callback is on the stack, for example a user-defined
+function, an aggregate function, an authorizer, or a changeset filter or conflict
+handler. This method is a wrapper around [`sqlite3_deserialize()`][].
 
 ```mjs
 import { DatabaseSync } from 'node:sqlite';
@@ -1788,6 +1790,7 @@ callback function to indicate what type of operation is being authorized.
 [SQL injection]: https://en.wikipedia.org/wiki/SQL_injection
 [Type conversion between JavaScript and SQLite]: #type-conversion-between-javascript-and-sqlite
 [`ATTACH DATABASE`]: https://www.sqlite.org/lang_attach.html
+[`ERR_INVALID_STATE`]: errors.md#err_invalid_state
 [`PRAGMA foreign_keys`]: https://www.sqlite.org/pragma.html#pragma_foreign_keys
 [`SQLITE_DBCONFIG_DEFENSIVE`]: https://www.sqlite.org/c3ref/c_dbconfig_defensive.html#sqlitedbconfigdefensive
 [`SQLITE_DETERMINISTIC`]: https://www.sqlite.org/c3ref/c_deterministic.html
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 027372e42daa..80da5bc0d9bf 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1858,6 +1858,10 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env,
+      db->IsInCallback(),
+      "database cannot be deserialized while in a callback");
 
   if (!args[0]->IsUint8Array()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
diff --git a/test/parallel/test-sqlite-serialize.js b/test/parallel/test-sqlite-serialize.js
index 77b9d9c5f483..e54cfa3c6a75 100644
--- a/test/parallel/test-sqlite-serialize.js
+++ b/test/parallel/test-sqlite-serialize.js
@@ -190,6 +190,23 @@ suite('DatabaseSync.prototype.deserialize()', () => {
     });
   });
 
+  test('throws if called while in a callback', (t) => {
+    const source = new DatabaseSync(':memory:');
+    const serialized = source.serialize();
+    source.close();
+
+    const db = new DatabaseSync(':memory:');
+    t.after(() => db.close());
+    db.function('deserialize_database', () => db.deserialize(serialized));
+    const stmt = db.prepare('SELECT deserialize_database()');
+
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: 'database cannot be deserialized while in a callback',
+    });
+    t.assert.strictEqual(db.isOpen, true);
+  });
+
   test('throws if buffer argument is not a Uint8Array', (t) => {
     const db = new DatabaseSync(':memory:');
     t.assert.throws(() => {

From 3f4b80ebb53073de852bc1444361ec552234cc96 Mon Sep 17 00:00:00 2001
From: Abdelrahman Awad <abdelrahman.awad@sentry.io>
Date: Wed, 15 Jul 2026 15:39:34 -0400
Subject: [PATCH 093/344] diagnostics_channel: mark TracingChannel as stable

Promotes the diagnostics_channel.tracingChannel() factory and the
TracingChannel class from experimental to stable.

TracingChannel has been available since v18.19.0 / v19.9.0 with an
unchanged surface and now has broad adoption: fastify, pino, mysql2,
redis, ioredis, mongoose, graphql, h3, srvx, and the Vercel AI SDK
publish TracingChannel events natively, and it is consumed by
OpenTelemetry, Sentry, Datadog, and New Relic. The last behavioral
wart, tracePromise stripping custom thenables (#59936), was resolved
in #61766.

This mirrors the scoping in #45290: BoundedChannel, the bindStore /
runStores store helpers, and the concrete built-in channels stay
experimental.

Signed-off-by: Abdelrahman Awad <abdelrahman.awad@sentry.io>
PR-URL: https://github.com/nodejs/node/pull/64525
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 doc/api/diagnostics_channel.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/doc/api/diagnostics_channel.md b/doc/api/diagnostics_channel.md
index f98d90ab2a19..e3a6a5e3fa98 100644
--- a/doc/api/diagnostics_channel.md
+++ b/doc/api/diagnostics_channel.md
@@ -237,9 +237,13 @@ diagnostics_channel.unsubscribe('my-channel', onMessage);
 added:
  - v19.9.0
  - v18.19.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64525
+    description: Marked as stable.
 -->
 
-> Stability: 1 - Experimental
+> Stability: 2 - Stable
 
 * `nameOrChannels` {string|TracingChannel} Channel name or
   object containing all the [TracingChannel Channels][]
@@ -744,9 +748,13 @@ The scope must be used with the `using` syntax to ensure proper disposal.
 added:
  - v19.9.0
  - v18.19.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64525
+    description: Marked as stable.
 -->
 
-> Stability: 1 - Experimental
+> Stability: 2 - Stable
 
 The class `TracingChannel` is a collection of [TracingChannel Channels][] which
 together express a single traceable action. It is used to formalize and

From 7f31f6226ee62f472d431b9e6191555eb60fa354 Mon Sep 17 00:00:00 2001
From: "Kamat, Trivikram" <16024985+trivikr@users.noreply.github.com>
Date: Wed, 29 Jul 2026 08:07:21 -0700
Subject: [PATCH 094/344] sqlite: isolate applyChangeset filter errors

Track filter callback failures within each applyChangeset() invocation.
Returning false from xFilter is not a SQLite error. This previously left
the database-wide suppression flag set, which could hide the next
unrelated SQLite error.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/64823
Fixes: https://github.com/nodejs/node/issues/64822
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/node_sqlite.cc                   | 11 ++++++-----
 test/parallel/test-sqlite-session.js |  7 +++++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 80da5bc0d9bf..0898e450a503 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -2326,6 +2326,7 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
 
   Local<Function> conflictFunc;
   Local<Function> filterFunc;
+  bool filterCallbackFailed = false;
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
     if (!args[1]->IsObject()) {
       THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2387,25 +2388,25 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
 
       filterFunc = filterValue.As<Function>();
 
-      context.filterCallback =
-          [env, db, &filterFunc](std::string_view item) -> bool {
+      context.filterCallback = [env, &filterFunc, &filterCallbackFailed](
+                                   std::string_view item) -> bool {
         // If there was an error in the previous call to the filter's
         // callback, we skip calling it again.
-        if (db->ignore_next_sqlite_error_) {
+        if (filterCallbackFailed) {
           return false;
         }
 
         Local<Value> argv[1];
         if (!ToV8Value(env->context(), item, env->isolate())
                  .ToLocal(&argv[0])) {
-          db->SetIgnoreNextSQLiteError(true);
+          filterCallbackFailed = true;
           return false;
         }
 
         Local<Value> result;
         if (!filterFunc->Call(env->context(), Null(env->isolate()), 1, argv)
                  .ToLocal(&result)) {
-          db->SetIgnoreNextSQLiteError(true);
+          filterCallbackFailed = true;
           return false;
         }
 
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
index c36b4352a341..2a72740bf899 100644
--- a/test/parallel/test-sqlite-session.js
+++ b/test/parallel/test-sqlite-session.js
@@ -404,6 +404,13 @@ test('filter handler throws', (t) => {
     name: 'Error',
     message: 'Error filtering table data1'
   });
+
+  t.assert.throws(() => {
+    database2.exec('CREATE TABLEEEE');
+  }, {
+    code: 'ERR_SQLITE_ERROR',
+    message: /syntax error/,
+  });
 });
 
 test('database.createSession() - filter changes', (t) => {

From 7074ae30fa7be606139f88da14ff52c426b4566a Mon Sep 17 00:00:00 2001
From: "Kamat, Trivikram" <16024985+trivikr@users.noreply.github.com>
Date: Sun, 2 Aug 2026 22:58:25 -0700
Subject: [PATCH 095/344] test: allow half-open CONNECT tunnel sockets

CONNECT tunnels are full-duplex. When the upstream socket receives a
FIN while the client-to-upstream pipe is still draining, the default
socket behavior can produce EPIPE or ECONNRESET errors.

Keep the upstream socket half-open so both directions can drain.
Separate request logs from transport errors to verify that teardown
completes without errors.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/64973
Refs: https://github.com/nodejs/reliability/issues?q=%22test-https-proxy-request-invalid-char-in-url%22
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 ...-https-proxy-request-invalid-char-in-url.mjs | 17 ++++-------------
 test/common/proxy-server.js                     |  9 ++++++++-
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
index 80c7be4931cd..888137b9a5a6 100644
--- a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
+++ b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
@@ -82,19 +82,10 @@ for (const testCase of testCases) {
           proxy.close();
           server.close();
           assert.deepStrictEqual(requests, expectedUrls);
-          const logSet = new Set(logs);
-          for (const log of logSet) {
-            if (log.source === 'proxy connect' && log.error?.code === 'EPIPE') {
-              // There can be a race from eagerly shutting down the servers and severing
-              // two pipes at the same time but for the purpose of this test, we only
-              // care about whether the requests are initiated from the client as expected,
-              // not how the upstream/proxy servers behave. Ignore EPIPE errors from them..
-              // Refs: https://github.com/nodejs/node/issues/59741
-              console.log('Ignoring EPIPE error from proxy connect', log.error);
-              logSet.delete(log);
-            }
-          }
-          assert.deepStrictEqual(logSet, expectedProxyLogs);
+          const requestLogs = logs.filter((log) => !('error' in log));
+          const errors = logs.filter((log) => 'error' in log);
+          assert.deepStrictEqual(new Set(requestLogs), expectedProxyLogs);
+          assert.deepStrictEqual(errors, []);
         }));
       }
     }));
diff --git a/test/common/proxy-server.js b/test/common/proxy-server.js
index a2f8bd12e625..723fe0ea5c6b 100644
--- a/test/common/proxy-server.js
+++ b/test/common/proxy-server.js
@@ -80,7 +80,14 @@ function createProxyServer(options = {}) {
 
     const normalizedHostname = hostname.startsWith('[') && hostname.endsWith(']') ?
       hostname.slice(1, -1) : hostname;
-    const proxyReq = net.connect(port, normalizedHostname, () => {
+    // A CONNECT tunnel is full-duplex. Keep the upstream socket writable after
+    // receiving a FIN so that the client-to-upstream pipe can finish draining.
+    // The reverse pipe will end `res`, and `res` will in turn end `proxyReq`.
+    const proxyReq = net.connect({
+      port,
+      host: normalizedHostname,
+      allowHalfOpen: true,
+    }, () => {
       res.write(
         'HTTP/1.1 200 Connection Established\r\n' +
         'Proxy-agent: Node.js-Proxy\r\n' +

From 59d7e22a129dd1685ad2bb3adeae58e62ed73c52 Mon Sep 17 00:00:00 2001
From: Tim Perry <pimterry@gmail.com>
Date: Sun, 9 Aug 2026 22:38:43 +0200
Subject: [PATCH 096/344] test: avoid deadlock issue in pipeline http2 tests to
 fix flakiness

This does not solve the remaining underlying deadlock issue, but does
bound the test behaviour in a way that seems to avoid failures in
practice. Deadlock fix to come separately later.

Co-authored-by: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65079
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 test/parallel/test-stream-pipeline-http2.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/test/parallel/test-stream-pipeline-http2.js b/test/parallel/test-stream-pipeline-http2.js
index c35cd696bd1e..8ffee7786838 100644
--- a/test/parallel/test-stream-pipeline-http2.js
+++ b/test/parallel/test-stream-pipeline-http2.js
@@ -27,10 +27,12 @@ const http2 = require('http2');
       client.close();
     }));
 
-    let cnt = 10;
+    let received = 0;
     req.on('data', (data) => {
-      cnt--;
-      if (cnt === 0) rs.destroy();
+      received += data.length;
+      // Bound the data that flows before teardown - bytes per data event vary
+      // by platform, and letting this run longer hangs on macOS.
+      if (received >= 32 * 1024) rs.destroy();
     });
   }));
 }

From 10b2c8a87309e2153341475c7442841419adf216 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Mon, 10 Aug 2026 14:55:09 +0200
Subject: [PATCH 097/344] tools: fix GITHUB_TOKEN permissions for CQ workflow

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65192
Refs: https://github.com/nodejs/node/pull/65169
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
---
 .github/workflows/commit-queue.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 641fe2a71742..a4d61132deea 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -59,7 +59,10 @@ jobs:
     needs: get_candidate_prs
     if: needs.get_candidate_prs.outputs.candidates != ''
     permissions:
+      checks: read
+      contents: read
       pull-requests: read
+      statuses: read
     runs-on: ubuntu-slim
     steps:
       # Install dependencies

From fc038a0ef5bb0129dda189b100ccac3d3924ced6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 15:06:56 +0000
Subject: [PATCH 098/344] tools: bump js-yaml from 4.2.0 to 4.3.1 in
 /tools/eslint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65130
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 tools/eslint/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json
index 82bdd3efb8c2..fc7840daff98 100644
--- a/tools/eslint/package-lock.json
+++ b/tools/eslint/package-lock.json
@@ -1408,9 +1408,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "funding": [
         {
           "type": "github",

From 5506f77924308a0822787888784dc676c0cea79c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 15:07:09 +0000
Subject: [PATCH 099/344] tools: bump js-yaml from 4.2.0 to 4.3.1 in
 /tools/lint-md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65129
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 tools/lint-md/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/lint-md/package-lock.json b/tools/lint-md/package-lock.json
index 9f4539b0837e..1ab4268328b2 100644
--- a/tools/lint-md/package-lock.json
+++ b/tools/lint-md/package-lock.json
@@ -326,9 +326,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "funding": [
         {
           "type": "github",

From 50174cb94a2e099cdef508144cd46a0cf1780b91 Mon Sep 17 00:00:00 2001
From: Chengzhong Wu <cwu631@bloomberg.net>
Date: Mon, 10 Aug 2026 11:07:35 -0400
Subject: [PATCH 100/344] build: deprecate always enabled `--enable-static`

`libnode.a` is now always produced, unless configured with flag
`--shared`. This deprecates the no-op flag `--enable-static`.

Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: https://github.com/nodejs/node/pull/65103
Refs: https://github.com/nodejs/node/issues/65026
Refs: https://github.com/nodejs/node/pull/63626
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 configure.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/configure.py b/configure.py
index 6ddc73c301ef..b663ba85f58e 100755
--- a/configure.py
+++ b/configure.py
@@ -1101,7 +1101,7 @@
     action='store_true',
     dest='enable_static',
     default=None,
-    help='build as static library')
+    help=argparse.SUPPRESS) # Deprecated
 
 parser.add_argument('--no-browser-globals',
     action='store_true',
@@ -2075,9 +2075,6 @@ def configure_node(o):
   if options.v8_options:
     o['variables']['node_v8_options'] = options.v8_options.replace('"', '\\"')
 
-  if options.enable_static:
-    o['variables']['node_target_type'] = 'static_library'
-
   o['variables']['node_debug_lib'] = b(options.node_debug_lib)
 
   if options.debug_nghttp2:
@@ -2120,10 +2117,13 @@ def configure_node(o):
   else:
     o['variables']['coverage'] = 'false'
 
+  if options.enable_static and options.shared:
+    error('--enable-static must not be set with --shared')
+  if options.enable_static:
+    warn('--enable-static is deprecated and libnode.a is always produced')
+
   if options.shared:
     o['variables']['node_target_type'] = 'shared_library'
-  elif options.enable_static:
-    o['variables']['node_target_type'] = 'static_library'
   else:
     o['variables']['node_target_type'] = 'executable'
 

From b1aa78a57e2ff482af4ab73a1821798444c8d35f Mon Sep 17 00:00:00 2001
From: Meghan Denny <meghan@bun.sh>
Date: Mon, 10 Aug 2026 08:51:40 -0700
Subject: [PATCH 101/344] test: fix hidden error in
 test-http-server-stale-close.js
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/nodejs/node/pull/59357
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ryuhei Shima <shimaryuhei@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 test/parallel/test-http-server-stale-close.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/parallel/test-http-server-stale-close.js b/test/parallel/test-http-server-stale-close.js
index 60112f708628..d33c756a4a30 100644
--- a/test/parallel/test-http-server-stale-close.js
+++ b/test/parallel/test-http-server-stale-close.js
@@ -31,7 +31,7 @@ if (process.env.NODE_TEST_FORK_PORT) {
     method: 'POST',
     host: '127.0.0.1',
     port: +process.env.NODE_TEST_FORK_PORT,
-  }, process.exit);
+  }, () => process.exit(0));
   req.write('BAM');
   req.end();
 } else {

From 631d3aa37bed2d6bf5249a1ee2dde0890de7435e Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 10 Aug 2026 20:35:36 -0400
Subject: [PATCH 102/344] deps: update libffi to 3.8.0

PR-URL: https://github.com/nodejs/node/pull/65154
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 deps/libffi/ChangeLog                         | 607 ++++++++++++++++++
 deps/libffi/README.md                         |  22 +
 deps/libffi/configure                         |  28 +-
 deps/libffi/configure.ac                      |   2 +-
 deps/libffi/doc/libffi.info                   | 132 +++-
 deps/libffi/doc/libffi.pdf                    | Bin 178018 -> 210793 bytes
 deps/libffi/doc/libffi.texi                   |  98 +++
 deps/libffi/doc/stamp-vti                     |   8 +-
 deps/libffi/doc/version.texi                  |   8 +-
 deps/libffi/generate-headers.py               |   4 +-
 deps/libffi/include/ffi.h.in                  |  12 +-
 deps/libffi/libffi.map.in                     |   9 +
 deps/libffi/libtool-version                   |   2 +-
 deps/libffi/src/aarch64/ffi.c                 | 120 +++-
 deps/libffi/src/aarch64/ffitarget.h           |   4 +
 deps/libffi/src/debug.c                       |   3 +-
 deps/libffi/src/ia64/ia64_flags.h             |  11 +
 deps/libffi/src/ia64/unix.S                   |   6 +
 deps/libffi/src/java_raw_api.c                |   3 +-
 deps/libffi/src/pa/ffitarget.h                |   9 +-
 deps/libffi/src/powerpc/darwin_closure.S      | 131 ++--
 deps/libffi/src/powerpc/ffi_darwin.c          |  23 +
 deps/libffi/src/powerpc/ffi_linux64.c         | 137 +++-
 deps/libffi/src/powerpc/linux64_closure.S     |  15 +
 deps/libffi/src/prep_cif.c                    | 110 +++-
 deps/libffi/src/raw_api.c                     |   8 +-
 deps/libffi/src/tramp.c                       |  12 +-
 deps/libffi/src/x86/ffi.c                     |   2 +-
 deps/libffi/src/x86/ffi64.c                   |  56 +-
 deps/libffi/src/x86/ffitarget.h               |  19 +
 deps/libffi/src/x86/win64.S                   |   5 +
 deps/libffi/src/x86/win64_intel.S             |   5 +
 deps/libffi/testsuite/Makefile.am             |  14 +-
 deps/libffi/testsuite/Makefile.in             |  14 +-
 .../closure_thiscall_fastcall_pop.c           | 131 ++++
 .../libffi.call/many_large_structs.c          |  88 +++
 deps/libffi/testsuite/libffi.call/plan_size.c |  77 +++
 .../testsuite/libffi.vector/cls_vector.c      |  67 ++
 deps/libffi/testsuite/libffi.vector/ffitest.h |   1 +
 .../libffi/testsuite/libffi.vector/vector.exp |  59 ++
 deps/libffi/testsuite/libffi.vector/vector.h  |  32 +
 .../libffi.vector/vector_args_spill.c         |  85 +++
 .../testsuite/libffi.vector/vector_double2.c  |  53 ++
 .../testsuite/libffi.vector/vector_double4.c  |  81 +++
 .../libffi.vector/vector_float32x2.c          |  53 ++
 .../libffi.vector/vector_float32x4.c          |  54 ++
 .../testsuite/libffi.vector/vector_hva.c      |  74 +++
 .../testsuite/libffi.vector/vector_int32x4.c  |  54 ++
 .../testsuite/libffi.vector/vector_validate.c | 103 +++
 .../testsuite/libffi.vector/vector_vec3.c     |  73 +++
 50 files changed, 2565 insertions(+), 159 deletions(-)
 create mode 100644 deps/libffi/testsuite/libffi.call/closure_thiscall_fastcall_pop.c
 create mode 100644 deps/libffi/testsuite/libffi.call/many_large_structs.c
 create mode 100644 deps/libffi/testsuite/libffi.call/plan_size.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/cls_vector.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/ffitest.h
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector.exp
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector.h
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_args_spill.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_double2.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_double4.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_float32x2.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_float32x4.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_hva.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_int32x4.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_validate.c
 create mode 100644 deps/libffi/testsuite/libffi.vector/vector_vec3.c

diff --git a/deps/libffi/ChangeLog b/deps/libffi/ChangeLog
index 0dde93e6adad..f64d5d5c46ac 100644
--- a/deps/libffi/ChangeLog
+++ b/deps/libffi/ChangeLog
@@ -1,3 +1,610 @@
+commit 12ffd1f9dc56fcea79d2f742f424301ae668d663
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 8 18:08:29 2026 -0400
+
+    README: order 3.8.0 notes by decreasing importance
+    
+    Lead with new capabilities (VECTOR types, ffi_call_plan_size, ppc64
+    _Complex long double), then correctness fixes by severity, then the
+    trampoline caching optimization.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit 8f2a41d9d89dd8ee2c2438f1e2f9cf04aa9a53d4
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 8 18:05:33 2026 -0400
+
+    Release 3.8.0
+    
+    Bump version to 3.8.0, soname to libffi.so.8.5.0 (libtool 13:0:5) for the
+    new public interfaces added this cycle (FFI_TYPE_VECTOR, ffi_call_plan_size),
+    date the README history section, and update doc/version.texi.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit d956fe177ccfd4bb91ae7cb3ccaa0f8935a76522
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 8 17:38:40 2026 -0400
+
+    testsuite: distribute plan_size.c
+    
+    The ffi_call_plan_size test added in #1006 was not listed in EXTRA_DIST,
+    so it would be omitted from release tarballs (it still runs from a git
+    checkout, where dejagnu globs *.c). Add it alongside the other plan_*.c
+    tests.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit 670a0327b7d1576712a3cad7b9297f59f23d5430
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 8 17:09:22 2026 -0400
+
+    README: note i386 BSD small-struct register return
+    
+    Follow-up to #1010, which returns small structs in registers on i386
+    FreeBSD/OpenBSD but did not update the History section.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit f744bc303fa4c69f1202ce283b866ebc768e0432
+Merge: abc18be0 5b8fa3fe
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 8 17:09:02 2026 -0400
+
+    Merge pull request #1010 from DTW-Thalion/x86-bsd-small-struct-return
+    
+    x86: return small structs in registers on the BSD i386 targets
+
+commit abc18be0d9ba9cc37c955b317e63cd52fd0d90ee
+Merge: ed742112 5f24e6a0
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 8 16:57:36 2026 -0400
+
+    Merge pull request #1006 from rvandermeulen/call-plan-size
+    
+    call_plan: add ffi_call_plan_size to report a plan's allocation
+
+commit ed7421122880e4daff87f1c8623d508a2e2c5c9a
+Merge: e43f2548 e6db2d38
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 8 16:41:24 2026 -0400
+
+    Merge pull request #1009 from libffi/fix-jumptable-desync-family
+    
+    Fix FFI_TYPE_LAST/vector jump-table desyncs on ia64, ppc64 (BE ELFv2), and aarch64
+
+commit e6db2d38decee8bf6321472dff5147ad311e639a
+Author: Anthony Green <green@moxielogic.com>
+Date:   Fri Aug 7 17:00:49 2026 -0400
+
+    aarch64: reject sub-4-byte vector lanes in HVA classification
+    
+    is_vfp_type() maps a homogeneous vector aggregate's lane width onto the
+    S/D/Q register classes via FFI_TYPE_FLOAT + intlog2(reg_size) - 2, and
+    encodes the result as an AARCH64_RET_* code.  A lane narrower than 4 bytes
+    (e.g. a struct of two 2-byte vectors, which libffi's own initialize_vector
+    accepts) yields intlog2(reg_size) < 2, producing a code below
+    AARCH64_RET_S4.  extend_hfa_type() then computes a negative jump-table
+    offset (h - AARCH64_RET_S4) and branches before its table -- a wild
+    computed branch during ffi_call argument marshalling.
+    
+    Such a type has no short-vector register class under AAPCS64, so reject it
+    in is_vfp_type() (returning 0 routes it through the generic aggregate
+    path).  Fixing it at the source covers both the argument path
+    (extend_hfa_type) and the return path.  Verified on aarch64 (Fedora under
+    qemu-aarch64): a call passing such an HVA segfaults before the fix and
+    returns correctly after it.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit 159268174ece06f6854c6d1bca1a9b95961f6ae9
+Author: Anthony Green <green@moxielogic.com>
+Date:   Fri Aug 7 08:18:51 2026 -0400
+
+    powerpc64: fix big-endian ELFv2 closure returns of 5/6/7-byte structs
+    
+    On big-endian ppc64 ELFv2, ffi_closure_helper_LINUX64 returns the load
+    codes PPC64_LD_STRUCT_5/6/7 (17/18/19) for closures returning a 5-, 6-,
+    or 7-byte struct, but linux64_closure.S only defined return jump-table
+    entries through PPC64_LD_STRUCT_3 (16).  The E() macro places each 16-byte
+    slot with .align 4 (no .org), so codes 17/18/19 fell through into the
+    .Lmoredouble continuation: the closure loaded FP registers and returned
+    without writing r3, so the ELFv2 caller read back the computed jump
+    target -- a libffi code address -- as the struct value (wrong result plus
+    a code-pointer disclosure).  Little-endian ELFv2 is unaffected (those
+    codes alias PPC_LD_R3/I64); big-endian ELFv1 returns structs by reference
+    and never emits the codes.
+    
+    Add the three missing handlers, loading the struct right-justified into
+    r3 per the ELFv2 convention.  Verified on big-endian ppc64 ELFv2 (Adélie
+    Linux under qemu-ppc64): testsuite/libffi.closures/cls_{5,6,7}_1_byte.c
+    abort before the fix and pass after it.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit 3fdd99b5d2fb4c8f940d82fc4b1e530e743c685b
+Author: Anthony Green <green@moxielogic.com>
+Date:   Fri Aug 7 06:11:00 2026 -0400
+
+    ia64: fix return jump-table desync after FFI_TYPE_LAST bump
+    
+    The .Lst_table/.Lld_table return-value dispatch tables in unix.S are
+    indexed by the FFI_IA64_TYPE_SMALL_STRUCT/HFA_* codes, which are
+    FFI_TYPE_LAST-relative, but the tables hardcoded 20 entries assuming
+    FFI_TYPE_LAST == FFI_TYPE_COMPLEX (15).  The conditional __int128
+    support added in 3.6.0 advanced FFI_TYPE_LAST to SINT128 (17), and
+    FFI_TYPE_VECTOR advanced it to 18, shifting SMALL_STRUCT to 19 -- so a
+    small-struct return dispatched to the HFA-ldouble handler's 16-byte
+    stfe store, an out-of-bounds write past rvalue, and HFA returns indexed
+    off the end of the table entirely.
+    
+    Add the missing UINT128/SINT128/VECTOR slots to both tables (pointing at
+    the existing not-implemented void handler, matching FFI_TYPE_COMPLEX)
+    and a FFI_TYPE_LAST tripwire, mirroring the pa and win64 guards.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit 5b8fa3fed84ce17768eeb379f5b81663172482e9
+Author: Todd White <todd.white@thalion.global>
+Date:   Fri Aug 7 19:40:05 2026 -0400
+
+    x86: return small structs in registers on the BSD i386 targets
+    
+    i386 FreeBSD and OpenBSD return a struct of 1, 2, 4 or 8 bytes in eax and
+    edx, as Darwin and win32 do. ffi_prep_cif_machdep applied the size test
+    only under X86_WIN32 and X86_DARWIN, so on these targets it recorded
+    X86_RET_STRUCTPOP and allocated a return pointer the callee never writes,
+    and a struct return through ffi_call or through a closure read a value
+    that was never stored.
+    
+    configure.host already maps i?86-*-freebsd* and i?86-*-openbsd* to
+    TARGET=X86_FREEBSD, and include/ffi.h.in defines that name, so extend the
+    condition to it. Sizes 3, 6 and 12 continue to be returned in memory.
+
+commit 5f24e6a05574b1aa74cca77b1ecd6413a8105f62
+Author: Ryan VanderMeulen <rvandermeulen@mozilla.com>
+Date:   Wed Aug 5 11:09:51 2026 -0400
+
+    call_plan: add ffi_call_plan_size to report a plan's allocation
+    
+    ffi_call_plan is opaque, so an embedder that tracks the memory a long-lived
+    plan holds has no way to ask how big it is.  The only options are to hardcode
+    a guess or to hardcode knowledge of the private struct layout, and both go
+    stale silently on the next release.
+    
+    The x86-64 backend records the byte count in ffi_plan at the point it is
+    passed to malloc, so the reported value cannot drift from the allocation it
+    describes; ffi_call_plan_size adds that to the handle and treats a signature
+    with no fast path as owning nothing beyond it.  The generic backend's plan is
+    a bare handle, so it reports sizeof (struct ffi_call_plan).  The counter lives
+    in ffi_plan rather than in the handle so that only plans that actually own a
+    move-list pay for it, and plans without one pay nothing.
+    
+    Computing the size in the query from cif->nargs instead would duplicate
+    build_plan's allocation formula in a second place, and would report the wrong
+    number if the cif were re-prepared with a different argument count after the
+    plan was built.
+    
+    The new symbol gets its own version node rather than joining
+    LIBFFI_CALL_PLAN_8.4, which shipped in 3.7.0: adding to a released node would
+    let a binary that needs ffi_call_plan_size look satisfiable against a 3.7.x
+    library that exports the node without the symbol, turning a clean link error
+    into a runtime failure.  libtool-version is left alone, since rule 2 in that
+    file defers version updates to immediately before a release.
+
+commit e43f254881f9010a26c48f595928461c0432c7b4
+Merge: 2fd434cd 04d721cc
+Author: Anthony Green <green@moxielogic.com>
+Date:   Thu Aug 6 00:40:32 2026 -0400
+
+    Merge pull request #1008 from libffi/fix-win64-vector-small-struct-flags
+    
+    x86: fix Win64 small-struct returns broken by FFI_TYPE_VECTOR
+
+commit 04d721cc448316dbba5af506be46315efabd80e3
+Author: Anthony Green <green@moxielogic.com>
+Date:   Wed Aug 5 22:59:29 2026 -0400
+
+    x86: fix Win64 small-struct returns broken by FFI_TYPE_VECTOR
+    
+    Adding FFI_TYPE_VECTOR (#1000) moved FFI_TYPE_LAST from FFI_TYPE_SINT128
+    (17) to FFI_TYPE_VECTOR (18).  The Win64 return pseudo-types
+    
+      FFI_TYPE_SMALL_STRUCT_1B/2B/4B = FFI_TYPE_LAST + 1..3
+    
+    are FFI_TYPE_LAST-relative, so they shifted from 18/19/20 to 19/20/21.
+    The win64.S / win64_intel.S return-value dispatch is a computed jump
+    table indexed by cif->flags (base + flags*8) whose handlers are emitted
+    contiguously right after FFI_TYPE_SINT128, with no slot for value 18.
+    Under the sequential E() variant used by the MSVC/ml64 build, the
+    size-1/2/4 small-struct handlers therefore sat one 8-byte slot below the
+    flag values ffiw64.c now emits, so small structs returned by value were
+    written with the wrong width (or fell off the table into abort).  This
+    showed up as 14 execution failures in the "Windows 64-bit Visual C++" CI
+    job (s55, struct3, struct_by_value_small, struct_return_2H, the small
+    cls_* / single_entry_structs closures, and bhaible DGTEST 47/53/55).
+    
+    Add an FFI_TYPE_VECTOR abort stub between SINT128 and SMALL_STRUCT_1B in
+    both tables so the jump table stays contiguous and the small-struct
+    entries realign with their (shifted) code values.  Win64 does not marshal
+    vectors -- ffi_prep_cif_core rejects them since FFI_TARGET_HAS_VECTOR_TYPE
+    is undefined there -- so the slot is never reached at runtime.
+    
+    Also add a pa-style compile-time tripwire to src/x86/ffitarget.h so the
+    next generic type added bumps FFI_TYPE_LAST and #errors until the win64
+    tables are updated in step.  32-bit x86 is unaffected: sysv.S indexes its
+    store table by the independent X86_RET_* enum, not FFI_TYPE_LAST.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit 2fd434cd9ada4d3d97b355e62c3ce3a969682230
+Merge: a00279c2 2aa33761
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sun Aug 2 10:18:45 2026 -0400
+
+    Merge pull request #1005 from libffi/tramp-cache-unsupported-verdict
+    
+    tramp: cache the static trampoline "unsupported" verdict
+
+commit 2aa33761c0536339f9f322902b9bb3a981114724
+Merge: 76883c62 a00279c2
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sun Aug 2 10:18:33 2026 -0400
+
+    Merge branch 'master' into tramp-cache-unsupported-verdict
+
+commit 76883c628a5273f71fb025e75bf1076adae3bb4b
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sun Aug 2 10:05:22 2026 -0400
+
+    tramp: cache the static trampoline "unsupported" verdict
+    
+    ffi_tramp_init() bailed out with a plain `return 0` when the system page
+    size exceeds the trampoline code table mapping, without recording the
+    outcome in tramp_globals.status.  Because that early return was the only
+    failure exit that left status as UNINITIALIZED, every subsequent
+    ffi_tramp_alloc()/ffi_tramp_is_supported() call re-ran the full
+    initialization (ffi_tramp_arch(), sysconf(), etc.) instead of
+    short-circuiting on the cached verdict like the other two failure paths.
+    
+    The comparison is between two process-lifetime invariants -- map_size is
+    a compile-time constant from ffi_tramp_arch(), and page_size is fixed for
+    the life of the process (and only checked when sysconf() returned a valid
+    value) -- so it can never flip.  Caching FAILED is therefore safe and
+    matches the intent of the status field.
+    
+    Affects hosts with pages larger than the 16K table, in practice 64K-page
+    aarch64 kernels, where static trampolines are correctly declined but the
+    decline was recomputed on every closure allocation.  No functional change
+    on 4K/16K-page hosts.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit a00279c2dc8e191ae5136b46bf6ae0e7a8da5b7a
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 1 07:17:23 2026 -0400
+
+    Note unreleased development changes in README history
+    
+    Add a "Development source only" History block for changes on master
+    since 3.7.1: FFI_TYPE_VECTOR SIMD support (#1000), powerpc64 _Complex
+    long double (#1003), and the powerpc Darwin closure fix (#1002).
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit ce77ca107a5cb0d10d5525c9422f0207e6c79ebf
+Merge: d257b084 19dbdb53
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sat Aug 1 07:09:17 2026 -0400
+
+    Merge pull request #1000 from edusperoni/feat/vector-types
+    
+    Add FFI_TYPE_VECTOR: vector (SIMD) type support with libffi-computed layout
+
+commit d257b08495e95248f66b7bd50dd106ea19124df9
+Merge: 333d87cf b2170647
+Author: Anthony Green <green@moxielogic.com>
+Date:   Tue Jul 28 00:47:29 2026 -0400
+
+    Merge pull request #1004 from libffi/fix-1002-ppc-darwin-closure
+    
+    powerpc: fix Darwin closure returns broken by #951
+
+commit b2170647583461f42dc2d9f201211fcafda2429f
+Author: Anthony Green <green@moxielogic.com>
+Date:   Mon Jul 27 20:08:15 2026 -0400
+
+    powerpc: fix Darwin closure returns broken by #951
+    
+    PR #951 (840add3b) changed the shared PowerPC closure helper,
+    ffi_closure_helper_common, to return a small PPC_LD_* jump-table index
+    instead of the ffi_type*, and rewrote aix_closure.S to consume it -- but
+    left darwin_closure.S expecting the old ffi_type* and dereferencing it.
+    With the helper now returning a small integer, ffi_closure_ASM
+    dereferenced e.g. 0 (PPC_LD_NONE, a void return) as a pointer, faulting
+    on a load from address 0.  This crashed essentially every closure call
+    -- including every gobject-introspection signal handler -- on 32- and
+    64-bit PowerPC Darwin (SIGBUS at ffi_closure_ASM, dar=0; issue #1002).
+    
+    Convert darwin_closure.S to the PPC_LD_* convention, mirroring
+    aix_closure.S: drop the ffi_type* dereference, use the returned index
+    directly, and reorder the return-value jump table into PPC_LD_* order
+    (NONE, R3, R3R4, F32, F64, F128, U8, S8, U16, S16, and on ppc64 U32, S32).
+    
+    Darwin, unlike AIX, returns small structs by value in registers, which
+    the existing assembly handles (Lsmallstruct/Lfour/Lstructend).  The
+    helper's return code is a single small integer with no room for
+    cif->rtype, which that assembly needs, so for a by-value struct return
+    the helper now stashes cif->rtype in the first parameter-save slot (dead
+    by return time) and returns a new PPC_LD_STRUCT code; the PPC_LD_STRUCT
+    fragment recovers it and drives the unchanged struct machinery.  By-
+    reference struct returns still return PPC_LD_NONE.
+    
+    Based on the approach in a patch by Sergey Fedorov (@barracuda156); the
+    jump table here is reordered to the PPC_LD_* layout so that float,
+    double, long double, sub-word and 64-bit returns also dispatch correctly.
+    
+    I have no PowerPC Darwin hardware; the jump-table fragment offsets were
+    checked by assembling for powerpc and powerpc64, but runtime
+    confirmation on 10.5/10.6 is still needed.
+    
+    Fixes #1002.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit 333d87cf201ee279c9870fb5ad3e48e3a08aa6e5
+Merge: 46cb2e38 d7cd3a61
+Author: Anthony Green <green@moxielogic.com>
+Date:   Mon Jul 27 08:52:34 2026 -0400
+
+    Merge pull request #1003 from libffi/fix-ppc64le-complex-longdouble
+    
+    powerpc64: implement _Complex long double for both IBM-128 and IEEE-128
+
+commit d7cd3a6194885c85255c77782a05a153a42b29a5
+Author: Anthony Green <green@moxielogic.com>
+Date:   Mon Jul 27 07:06:39 2026 -0400
+
+    powerpc64: implement _Complex long double for both IBM-128 and IEEE-128
+    
+    Complex support for POWERPC64 ELFv2 (f0ca157, #970) defined
+    FFI_TARGET_HAS_COMPLEX_TYPE, which flips complex.exp from marking the
+    libffi.complex suite UNSUPPORTED to running it.  _Complex long double
+    was deliberately deferred with FFI_BAD_TYPEDEF, so ffi_prep_cif failed
+    and every libffi.complex/*longdouble* test aborted.  This was not caught
+    upstream because an XFAIL entry in the rlgl CI policy masked the FAILs.
+    
+    Implement both long double formats:
+    
+      - IBM-128 (double-double): each _Complex long double is passed and
+        returned as four doubles (real hi/lo, imag hi/lo) in f1-f4, with a
+        GPR shadow doubleword per FPR, and returned as a double homogeneous
+        aggregate.
+    
+      - IEEE binary128: real in v2, imag in v3; each half occupies a vector
+        register (or a 16-byte-aligned parameter save slot with two GPR
+        shadow doublewords) and is returned via the vector-homogeneous
+        small-struct path.
+    
+    discover_homogeneous_aggregate now accepts FFI_TYPE_LONGDOUBLE as a
+    _Complex inner type so struct-of-complex-longdouble is treated as an HFA.
+    Covers ffi_prep_cif, ffi_prep_args64, and the closure decode/return
+    paths.
+    
+    Fixes #1001.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+commit debc00a0114d8530d6d691862028c607aa17dd6a
+Author: Anthony Green <green@moxielogic.com>
+Date:   Sun Jul 26 07:28:36 2026 -0400
+
+    Update doc version
+
+commit 19dbdb53e869e07fbff05c86d634e8c08c9a7f61
+Author: Eduardo Speroni <edusperoni@gmail.com>
+Date:   Tue Jul 21 20:32:24 2026 -0300
+
+    testsuite: fix vector suite CI failures on gcc and MSVC
+    
+    Two fixes for the libffi.vector suite:
+    
+    - vector_double4.c: the non-aarch64 branch built its own void_args
+      array and never read the already-populated args, tripping gcc's
+      -Wunused-but-set-variable (an excess-errors FAIL on Linux x86-64
+      with gcc; clang does not emit this warning).  Use args for the
+      negative argument-passing check instead.
+    
+    - vector.exp: the suite only probed FFI_TARGET_HAS_VECTOR_TYPE, but
+      the tests are written with the GCC/Clang vector extension.  On
+      Windows ARM64 the aarch64 port enables the feature while MSVC
+      cannot compile __attribute__ ((vector_size)), so every test failed
+      to build.  Add a compile probe and mark the suite unsupported when
+      the compiler lacks the syntax.
+
+commit 71a95a2cd433b151b3fcf83a0a830eb9aa38fa3a
+Author: Eduardo Speroni <edusperoni@gmail.com>
+Date:   Tue Jul 21 16:44:26 2026 -0300
+
+    testsuite: add libffi.vector suite for vector (SIMD) types
+    
+    Model a new testsuite/libffi.vector/ directory on testsuite/libffi.complex:
+    vector.exp reuses the same dg/run-many-tests driver and skips every test as
+    "unsupported" on ports whose headers do not define
+    FFI_TARGET_HAS_VECTOR_TYPE (libffi_feature_test), so unsupported targets
+    still compile the gating cleanly.
+    
+    Vector types are built with the portable __attribute__((vector_size)) via a
+    small make_vector_type() helper (vector.h); each test cross-checks the value
+    returned through ffi against a direct native call.  Coverage:
+    
+      - vector_float32x4 / vector_float32x2 / vector_double2 / vector_int32x4:
+        pass and return 8- and 16-byte float, double and integer vectors
+        (float32x4 is the vec4 shape of libffi/libffi#773);
+      - vector_args_spill: ten vectors interleaved with int/double scalars,
+        exhausting the vector argument registers and spilling to the stack;
+      - vector_vec3: Clang-only ext_vector_type(3), verifying the 12->16 byte
+        power-of-two padding matches a natively compiled callee (a no-op on
+        other compilers);
+      - vector_double4: on AArch64 a 32-byte vector round-trips (by reference /
+        in memory); elsewhere ffi_prep_cif must return FFI_BAD_TYPEDEF, checked
+        for both return and argument;
+      - vector_hva: a struct of two identical vectors (HVA) passes and returns
+        on both AArch64 (Q-register pair) and x86-64 (SSE struct classification);
+      - cls_vector: a closure receiving vector arguments and returning a vector;
+      - vector_validate: heterogeneous lanes, an empty vector, and a non-scalar
+        lane are each rejected with FFI_BAD_TYPEDEF, and a well-formed vector is
+        accepted with the computed power-of-two size and min(size,16) alignment.
+    
+    The files are added to testsuite/Makefile.am EXTRA_DIST, matching how
+    libffi.complex is distributed.
+    
+    References: libffi/libffi#414, libffi/libffi#773.
+
+commit 93b274cec912ac2395575a8bd4dfcb527f61599c
+Author: Eduardo Speroni <edusperoni@gmail.com>
+Date:   Tue Jul 21 16:32:04 2026 -0300
+
+    x86-64: marshal vector (SIMD) types per the System V psABI
+    
+    Define FFI_TARGET_HAS_VECTOR_TYPE for the SysV x86-64 backend (ffi64.c;
+    32-bit x86 and the Windows ffiw64.c backend are excluded) and integrate
+    FFI_TYPE_VECTOR into the existing psABI classifier without restructuring
+    it:
+    
+      - classify_argument gains a FFI_TYPE_VECTOR case: an 8-byte vector is
+        one SSE eightbyte (X86_64_SSE_CLASS); a 16-byte vector is one %xmm
+        register (X86_64_SSE_CLASS + X86_64_SSEUP_CLASS).  The existing
+        INTEGERSI/SSESF/SSEDF/UINT128 handling is untouched, and the SSE+SSEUP
+        argument marshalling already merges both eightbytes into one %xmm.
+      - ffi_prep_cif_machdep classifies vector returns symmetrically: 8 bytes
+        in %xmm0 (UNIX64_RET_XMM64), 16 bytes in %xmm0 (UNIX64_RET_XMM128).
+      - Vectors wider than 16 bytes return FFI_BAD_TYPEDEF from
+        ffi_prep_cif_machdep, for both returns and arguments.  Correct
+        %ymm/%zmm passing needs unix64.S register-save changes and is left as
+        a v1 limitation rather than silently passing them in memory.
+    
+    Closures need no separate change: the closure paths reuse
+    classify_argument for arguments and cif->flags for the return.
+    
+    References: libffi/libffi#414.
+
+commit 5eaa8a389de61fc3b056f62c48ceade1931b5413
+Author: Eduardo Speroni <edusperoni@gmail.com>
+Date:   Tue Jul 21 16:30:12 2026 -0300
+
+    aarch64: marshal vector (SIMD) types per AAPCS64
+    
+    Define FFI_TARGET_HAS_VECTOR_TYPE for AArch64 and teach is_vfp_type to
+    classify FFI_TYPE_VECTOR, so ffi_call and closures pass and return
+    vectors the way AAPCS64 (and current GCC/Clang) do:
+    
+      - 8- and 16-byte vectors travel in a single V/Q register (a Short
+        Vector), for float, double and integer lane types alike;
+      - homogeneous vector aggregates -- a struct of up to four identical
+        8- or 16-byte vectors -- travel in that many consecutive V/Q
+        registers (an HVA), e.g. struct{float32x4 a,b} in {q0,q1};
+      - a bare vector wider than 16 bytes (e.g. a 32-byte double4) has no
+        short-vector register class, so is_vfp_type returns 0 and the
+        existing composite path passes it by invisible reference and returns
+        it in memory -- exactly what a natively compiled callee expects.
+    
+    is_simd() reports the width of one Neon register slot (a bare vector's
+    whole size, or one lane vector of an HVA); is_vfp_type() encodes
+    num_registers slots of that width onto the existing AARCH64_RET_{D,Q}*
+    codes via intlog2.  is_hfa0/is_hfa1 recurse through FFI_TYPE_VECTOR so
+    HVA homogeneity is checked, and the three fundamental-type dispatch
+    switches (machdep return, ffi_call_int, ffi_closure_SYSV_inner) route
+    FFI_TYPE_VECTOR through is_vfp_type alongside FFI_TYPE_STRUCT.
+    
+    Ported from the battle-tested NativeScript aarch64 vector marshaller,
+    adapted to the FFI_TYPE_VECTOR API and extended so that integer-lane
+    vectors (e.g. int32x4) are classified into V registers too -- the
+    original only handled floating-point lanes.
+    
+    References: libffi/libffi#414, libffi/libffi#773 (aarch64 vec4 return).
+
+commit b6b8be54acc90f7db1dcf3d1c91238a5a9bca185
+Author: Eduardo Speroni <edusperoni@gmail.com>
+Date:   Tue Jul 21 16:26:33 2026 -0300
+
+    core: add FFI_TYPE_VECTOR fundamental type with computed layout
+    
+    Introduce a portable API for marshalling vector (SIMD) types -- the
+    values produced by GCC's __attribute__((vector_size)) and Clang's
+    ext_vector_type.  This answers the stalled PR #414 and the maintainer's
+    2018 design questions
+    (https://sourceware.org/legacy-ml/libffi-discuss/2018/msg00020.html):
+    rather than requiring callers to hand-compute a vector's size and
+    alignment (and gating the feature behind configure), libffi now derives
+    the layout itself and the type code is defined unconditionally.
+    
+    A vector is described exactly like a struct: type == FFI_TYPE_VECTOR and
+    a NULL-terminated elements[] array, except every element must point to
+    the SAME fundamental scalar (float, double, or a fixed-width integer
+    UINT8..SINT64) and the count is the number of lanes.  The caller leaves
+    size and alignment at zero; ffi_prep_cif computes:
+    
+      size      = lane_size * count, rounded up to the next power of two
+                  (matches Clang ext_vector_type storage: 3 x float -> 16,
+                  3 x double -> 32; GCC vector_size already requires pow2
+                  totals so it is identical there);
+      alignment = min(size, 16).
+    
+    Validation (identical scalar lanes, count >= 1, scalar-only) yields
+    FFI_BAD_TYPEDEF otherwise.
+    
+      - include/ffi.h.in: FFI_TYPE_VECTOR = 18 (after SINT128 = 17),
+        FFI_TYPE_LAST bumped.  Defined unconditionally, no configure gating.
+      - src/prep_cif.c: initialize_vector() computes the layout in
+        initialize_aggregate; ffi_type_contains_vector() rejects vectors
+        (including nested in structs, argument or return) with
+        FFI_BAD_TYPEDEF on any port that does not define
+        FFI_TARGET_HAS_VECTOR_TYPE -- no aborts.  Vector returns reserve the
+        hidden return-pointer slot like structs.
+      - src/raw_api.c, src/java_raw_api.c: plumb FFI_TYPE_VECTOR alongside
+        FFI_TYPE_STRUCT, mirroring how FFI_TYPE_COMPLEX is handled.
+      - src/debug.c: ffi_type_test requires elements != NULL for vectors.
+      - src/pa/ffitarget.h: bump the FFI_PA_TYPE_LAST tripwire; PA gates
+        vectors out in prep_cif so its jump tables are never reached.
+      - doc/libffi.texi: new "Vector Types" node documenting the API, the
+        computed-layout rule, the psABI framing, and the per-port support
+        table.
+    
+    No port defines FFI_TARGET_HAS_VECTOR_TYPE yet, so this commit rejects
+    every vector signature; the per-architecture ports follow.
+    
+    References: libffi/libffi#414, libffi/libffi#773.
+
+commit 46cb2e3871059f7f5113329ddcca818de3a8cfae
+Merge: ca86812c 8cd11a77
+Author: Anthony Green <green@moxielogic.com>
+Date:   Fri Jul 10 16:51:18 2026 -0400
+
+    Merge pull request #998 from bgilbert/tests
+    
+    testsuite: Remember to distribute tests added for 3.7.1
+
+commit 8cd11a772d8a0b687f43390697baa002ae6504d5
+Author: Benjamin Gilbert <bgilbert@backtick.net>
+Date:   Fri Jul 10 11:56:55 2026 -0700
+
+    testsuite: Remember to distribute tests added for 3.7.1
+
+commit ca86812cd430cff3018e491ba75a4f3c9ea969d2
+Author: Anthony Green <green@moxielogic.com>
+Date:   Fri Jul 10 10:56:47 2026 -0400
+
+    ci: Don't publish rlgl reports on tag pushes
+    
+    A tag and its commit fire two CI runs at the same SHA.  Both run the
+    publish-reports job, which deploys a fixed-name github-pages artifact
+    via actions/deploy-pages; the two deployments collide and one fails
+    with BlobNotFound (seen on the v3.7.1 tag run).  The same-SHA branch
+    push already publishes the reports, so gate the job off tag pushes.
+    
+    Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
+
 commit 5c1c43091ed611fdea774374355eb938c73a9157
 Author: Anthony Green <green@moxielogic.com>
 Date:   Fri Jul 10 09:50:53 2026 -0400
diff --git a/deps/libffi/README.md b/deps/libffi/README.md
index 19f78f632b0c..797d0fd9aa8e 100644
--- a/deps/libffi/README.md
+++ b/deps/libffi/README.md
@@ -201,6 +201,28 @@ History
 
 See the git log for details at http://github.com/libffi/libffi.
 
+    3.8.0 August-8-2026
+        Add FFI_TYPE_VECTOR (SIMD) type support with libffi-computed
+          layout, for aarch64 and x86-64 (#1000, closes #773).
+        Add ffi_call_plan_size to report the total memory a reusable call
+          plan owns, for embedders that account for the memory held by
+          long-lived plans.
+        Add powerpc64 ELFv2 _Complex long double support for both
+          IBM-128 (double-double) and IEEE-128 formats (#1003, closes #1001).
+        Fix powerpc64 big-endian ELFv2 closures returning 5-, 6-, or
+          7-byte structs: missing return jump-table entries produced a
+          wrong result and leaked a libffi code pointer.
+        Fix ia64 return-value jump-table desync after the FFI_TYPE_LAST
+          bump, which corrupted small-struct and HFA returns.
+        Fix powerpc Darwin closure returns broken by #951 (#1002).
+        Return small (1, 2, 4 or 8 byte) structs in registers on the i386
+          FreeBSD and OpenBSD targets, matching the platform ABI and
+          fixing a segfault on struct returns through ffi_call and closures.
+        Cache the static trampoline "unsupported" result on hosts whose
+          page size exceeds the trampoline table mapping, avoiding
+          redundant re-initialization on every closure allocation
+          (e.g. 64K-page aarch64).
+
     3.7.1 July-10-2026
         Fix aarch64 ffi_call memory corruption when passing many large
           structs by value.
diff --git a/deps/libffi/configure b/deps/libffi/configure
index e050ddc8675d..7b8a4cb375d1 100755
--- a/deps/libffi/configure
+++ b/deps/libffi/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for libffi 3.7.1.
+# Generated by GNU Autoconf 2.71 for libffi 3.8.0.
 #
 # Report bugs to <http://github.com/libffi/libffi/issues>.
 #
@@ -621,8 +621,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libffi'
 PACKAGE_TARNAME='libffi'
-PACKAGE_VERSION='3.7.1'
-PACKAGE_STRING='libffi 3.7.1'
+PACKAGE_VERSION='3.8.0'
+PACKAGE_STRING='libffi 3.8.0'
 PACKAGE_BUGREPORT='http://github.com/libffi/libffi/issues'
 PACKAGE_URL=''
 
@@ -1417,7 +1417,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libffi 3.7.1 to adapt to many kinds of systems.
+\`configure' configures libffi 3.8.0 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1489,7 +1489,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libffi 3.7.1:";;
+     short | recursive ) echo "Configuration of libffi 3.8.0:";;
    esac
   cat <<\_ACEOF
 
@@ -1628,7 +1628,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libffi configure 3.7.1
+libffi configure 3.8.0
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2259,7 +2259,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libffi $as_me 3.7.1, which was
+It was created by libffi $as_me 3.8.0, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3233,10 +3233,10 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 ac_config_headers="$ac_config_headers fficonfig.h"
 
 
-FFI_VERSION_STRING="3.7.1"
-ffi_version_major=`echo "3.7.1" | cut -d. -f1`
-ffi_version_minor=`echo "3.7.1" | cut -d. -f2 | sed 's/[^0-9].*//'`
-ffi_version_micro=`echo "3.7.1" | cut -d. -f3 | sed 's/[^0-9].*//'`
+FFI_VERSION_STRING="3.8.0"
+ffi_version_major=`echo "3.8.0" | cut -d. -f1`
+ffi_version_minor=`echo "3.8.0" | cut -d. -f2 | sed 's/[^0-9].*//'`
+ffi_version_micro=`echo "3.8.0" | cut -d. -f3 | sed 's/[^0-9].*//'`
 FFI_VERSION_NUMBER=`expr ${ffi_version_major:-0} \* 10000 + ${ffi_version_minor:-0} \* 100 + ${ffi_version_micro:-0}`
 
 
@@ -3986,7 +3986,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libffi'
- VERSION='3.7.1'
+ VERSION='3.8.0'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -20661,7 +20661,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libffi $as_me 3.7.1, which was
+This file was extended by libffi $as_me 3.8.0, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20729,7 +20729,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-libffi config.status 3.7.1
+libffi config.status 3.8.0
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
diff --git a/deps/libffi/configure.ac b/deps/libffi/configure.ac
index 3370acc3a396..826b453b8353 100644
--- a/deps/libffi/configure.ac
+++ b/deps/libffi/configure.ac
@@ -2,7 +2,7 @@ dnl Process this with autoconf to create configure
 
 AC_PREREQ([2.68])
 
-AC_INIT([libffi],[3.7.1],[http://github.com/libffi/libffi/issues])
+AC_INIT([libffi],[3.8.0],[http://github.com/libffi/libffi/issues])
 AC_CONFIG_HEADERS([fficonfig.h])
 
 dnl Derive the version macros from AC_INIT so they cannot drift when the
diff --git a/deps/libffi/doc/libffi.info b/deps/libffi/doc/libffi.info
index b43246f8ed4e..4c1abc85f777 100644
--- a/deps/libffi/doc/libffi.info
+++ b/deps/libffi/doc/libffi.info
@@ -301,6 +301,7 @@ File: libffi.info,  Node: Types,  Next: Multiple ABIs,  Prev: Simple Example,  U
 * Type Example::                Structure type example.
 * Complex::                     Complex types.
 * Complex Type Example::        Complex type example.
+* Vector Types::                Vector (SIMD) types.
 
 
 File: libffi.info,  Node: Primitive Types,  Next: Structures,  Up: Types
@@ -660,7 +661,7 @@ functions ‘ffi_prep_cif’ and ‘ffi_prep_args’ abort the program if they
 encounter a complex type.
 
 
-File: libffi.info,  Node: Complex Type Example,  Prev: Complex,  Up: Types
+File: libffi.info,  Node: Complex Type Example,  Next: Vector Types,  Prev: Complex,  Up: Types
 
 2.3.7 Complex Type Example
 --------------------------
@@ -746,6 +747,92 @@ compilers that support them:
    The new type descriptors can then be used like one of the built-in
 type descriptors in the previous example.
 
+
+File: libffi.info,  Node: Vector Types,  Prev: Complex Type Example,  Up: Types
+
+2.3.8 Vector Types
+------------------
+
+‘libffi’ can marshal vector (SIMD) types -- the values produced by GCC's
+‘__attribute__((vector_size (N)))’ and Clang's ‘ext_vector_type’ -- on
+the platforms listed in the support table below.  A vector is described
+just like a structure, except that every element pointer refers to the
+_same_ fundamental scalar type and the number of elements is the number
+of vector lanes.
+
+ -- Data type: ffi_type
+     ‘size_t size’
+          This must be set to ‘0’.  ‘libffi’ computes the storage size
+          (see below) from the element type and lane count.
+
+     ‘unsigned short alignment’
+          This must be set to ‘0’.  ‘libffi’ computes the alignment.
+
+     ‘unsigned short type’
+          For a vector type, this must be set to ‘FFI_TYPE_VECTOR’.
+
+     ‘ffi_type **elements’
+          This is a ‘NULL’-terminated array of pointers to ‘ffi_type’
+          objects.  Every entry must point to the same scalar element
+          type, and the number of entries is the vector's lane count N
+          (N >= 1).  The element type must be one of ‘ffi_type_float’,
+          ‘ffi_type_double’, or a fixed-width integer (‘ffi_type_uint8’
+          through ‘ffi_type_sint64’); ‘long double’ and aggregate
+          element types are not permitted.
+
+Computed layout
+...............
+
+Because the caller leaves ‘size’ and ‘alignment’ at ‘0’, ‘libffi’
+derives them so that applications need not encode compiler- or
+platform-specific rules:
+
+   • ‘size’ is lane\_size \times N rounded _up_ to the next power of
+     two.  This matches Clang's ‘ext_vector_type’ storage -- for example
+     a three-lane ‘float’ vector occupies 16 bytes and a three-lane
+     ‘double’ vector occupies 32 bytes.  GCC's ‘vector_size’ already
+     requires power-of-two byte totals, so the rule is identical there.
+
+   • ‘alignment’ is ‘min(size, 16)’.
+
+   If the element list is heterogeneous, empty, or uses a disallowed
+element type, ‘ffi_prep_cif’ returns ‘FFI_BAD_TYPEDEF’.
+
+psABI framing
+.............
+
+At the call boundary the platform's processor-specific ABI (AAPCS64 on
+AArch64, the System V x86-64 psABI on x86-64) decides how a vector is
+passed and returned, independently of which compiler produced it.  The
+historical divergence between GCC's ‘vector_size’ and Clang's
+‘ext_vector_type’ concerns only in-memory _layout_ (notably the padding
+of odd-lane vectors such as ‘float3’); the power-of-two size rule above
+pins that layout down, so a value marshalled by ‘libffi’ matches what a
+natively compiled caller or callee expects.
+
+Per-port support
+................
+
+Port                 Vector support
+--------------------------------------------------------------------------
+AArch64 (AAPCS64)    8- and 16-byte vectors in a single V/Q register;
+                     homogeneous vector aggregates (structs of up to
+                     four identical 8- or 16-byte vectors) in
+                     consecutive V/Q registers.  A bare vector larger
+                     than 16 bytes (for example a 32-byte ‘double4’)
+                     has no short-vector register class and is passed
+                     and returned in memory, exactly as AAPCS64 and
+                     current compilers do.
+x86-64 (System V     8- and 16-byte vectors in an SSE register (‘%xmm0’
+psABI)               for returns).  A bare vector larger than 16 bytes
+                     needs ‘%ymm’/‘%zmm’ register handling that this
+                     port does not yet implement, so ‘ffi_prep_cif’
+                     returns ‘FFI_BAD_TYPEDEF’ for it.
+Other ports          Not supported: ‘ffi_prep_cif’ returns
+                     ‘FFI_BAD_TYPEDEF’ for any signature that mentions
+                     a vector type, including one nested inside a
+                     struct.
+
 
 File: libffi.info,  Node: Multiple ABIs,  Next: Reusable Call Plans,  Prev: Types,  Up: Using libffi
 
@@ -795,6 +882,14 @@ prepared ‘ffi_cif’.
      is harmless.  The ‘ffi_cif’ the plan was built from is not
      affected.
 
+ -- Function: size_t ffi_call_plan_size (ffi_call_plan *PLAN)
+     Returns the total number of bytes ‘libffi’ allocated for PLAN,
+     including any internal argument-placement data it owns.  Returns
+     zero when PLAN is ‘NULL’.  The result does not include the
+     ‘ffi_cif’, which the caller owns.  This is intended for embedders
+     that account for the memory held by long-lived plans and would
+     otherwise have to guess at the size of an opaque type.
+
 
 File: libffi.info,  Node: The Closure API,  Next: Closure Example,  Prev: Reusable Call Plans,  Up: Using libffi
 
@@ -1056,6 +1151,7 @@ Index
 * ffi_call_plan_alloc:                   Reusable Call Plans. (line  12)
 * ffi_call_plan_free:                    Reusable Call Plans. (line  32)
 * ffi_call_plan_invoke:                  Reusable Call Plans. (line  22)
+* ffi_call_plan_size:                    Reusable Call Plans. (line  37)
 * ffi_closure_alloc:                     The Closure API.     (line  19)
 * ffi_closure_free:                      The Closure API.     (line  26)
 * FFI_CLOSURES:                          The Closure API.     (line  13)
@@ -1075,6 +1171,8 @@ Index
 * ffi_type <1>:                          Structures.          (line  10)
 * ffi_type <2>:                          Complex.             (line  15)
 * ffi_type <3>:                          Complex.             (line  15)
+* ffi_type <4>:                          Vector Types.        (line  13)
+* ffi_type <5>:                          Vector Types.        (line  13)
 * ffi_type_complex_double:               Primitive Types.     (line  82)
 * ffi_type_complex_float:                Primitive Types.     (line  79)
 * ffi_type_complex_longdouble:           Primitive Types.     (line  85)
@@ -1101,6 +1199,7 @@ Index
 * ffi_type_void:                         Primitive Types.     (line  10)
 * Foreign Function Interface:            Introduction.        (line  31)
 * size_t:                                The Basics.          (line 125)
+* size_t <1>:                            Reusable Call Plans. (line  37)
 * unsigned int:                          The Basics.          (line 122)
 * unsigned long:                         The Basics.          (line 117)
 * void:                                  The Basics.          (line  72)
@@ -1118,21 +1217,22 @@ Node: Using libffi4569
 Node: The Basics5172
 Node: Simple Example11346
 Node: Types12403
-Node: Primitive Types12914
-Node: Structures15231
-Node: Size and Alignment16342
-Node: Arrays Unions Enums18613
-Node: Type Example21590
-Node: Complex22896
-Node: Complex Type Example24410
-Node: Multiple ABIs27462
-Node: Reusable Call Plans27849
-Node: The Closure API29566
-Node: Closure Example33908
-Node: Thread Safety35552
-Node: Memory Usage36385
-Node: Missing Features37660
-Node: Index38037
+Node: Primitive Types12967
+Node: Structures15284
+Node: Size and Alignment16395
+Node: Arrays Unions Enums18666
+Node: Type Example21643
+Node: Complex22949
+Node: Complex Type Example24463
+Node: Vector Types27536
+Node: Multiple ABIs31575
+Node: Reusable Call Plans31962
+Node: The Closure API34155
+Node: Closure Example38497
+Node: Thread Safety40141
+Node: Memory Usage40974
+Node: Missing Features42249
+Node: Index42626
 
 End Tag Table
 
diff --git a/deps/libffi/doc/libffi.pdf b/deps/libffi/doc/libffi.pdf
index 250d34faf71159260bc7d8905a68cd9885767592..75458a8f7d5d231e322b5f49c1af24ca709ae283 100644
GIT binary patch
delta 100558
zcmZU)LzpH?uy$LvZQHhOn_afeuWZ}uvTb(Rwr$)0KIe??b7wir9KE?BV#UD?%=rym
z{Usz|Kw*doDeRUHT#_pQ4iv4sCbBD%Q~pq#e@SMQ!Uorg|7sJq#D)*c#2d?;CG+<a
zM(r5UQmI)uWx#Wz54lBdF>hsbJFdUeLh1D5G>VEB<i|<wNNxV?ct>59q18aOrnqTm
z!JSHOCD69J>>AeZPx$@2a$widKb~nGhWZA8ZH6k|>*9v5!nae-s(lU@2=54+t6%kB
zUlO<Tq5KV8=k26dhm<6<peLA_v0)Nk(-gFGA$!`w7PJ&N8X;mfn3CBvjGm=Z75ffJ
zj<THau^U;`MM<-X;BH2BzZubrQYNQA!_|N21%YG44qYRWpx8yRuE{!a8Y`^p9#s@E
z)$P-bbNtnVr=SA_mxaOtELs>dMqD=22YP@}n^2(}5J4&onntjqK)}ern5C16sZpCO
zaO*^XnUj^-Q9-%bS(67KsQ@Kf=k}WtNI&^yNJs^RaLM}yd?>|2mutdNdQzzc;&|mL
zV%oOU3w!%qb{{vn>+2;_nT_~pVg3B4A169Zk%$0Wl+R=(D8{sT(+<DA%jFAWk>FQG
z0w$N4&|v%9quD0N_}P>!rrqf840-cQfr@qOhjH$8vUGVJd41xLK|sEoK6UD2;Y<{)
z&P3C2$81o=<X<JG@P_l#bw)%53w*`lcmB}9WX=-Uj|FB1{^3DsB<Xl)X%YhY{YvMo
zy7Y5YoEZ*kc!jejsS8(+2#Mp3>b0gxXP?Zn)h-u;N|2%sIZrukgZSs7s&1sA0(=Qw
zM9p&^TDXR$ru4_;HbC8O56`!qz~}e&`Qu`fi{ZO?qkOyv-jrj{j3Wf(+7dj87B}QE
z8|esN#ZiLtHko|uRqc!i5B@&e^rD>(+w&F`8{iFTeIZiuixoa^{*+KCk@^=%^dLOw
z_Fh=o={-E}Od^w$(4Z%)6R!WNVn6Qu{#NxaOY4LG=BKw*9nfVP!4P{You`lXw=$3>
zrh?a1+dgTcKXwbW7QrPy|H=m}w)UPv^;c4mhl#B+H<sr0%790w$qZ0-jC0>n5hNTX
zPND|M&bWHXV;3>R&&+gYi2K2Ebdj)ug^PvCArv>C^FwdXbP%us>hSzR)r(uOkAcXy
zpItLbQNedR3~){K=T4xuY?iq+OV#HvQ(qL3wQ^1{YaMT-k<VfoH&xV~{0I{SYB_0*
zhIB?SU_HB%z<1gb*A>7Az9=BOW{ByPMf01Ln!{lCRPJP<*tT=s(m|rXFx_NS8)FQ*
z*lX;E6_@gLJHS+y(%LV`d>DK8j(i@U_W?ct1KuOj0H~fI>3O<lqMgi8u>TeRHHa1u
z;ik<xUN=<j!sIbCg1n3iBc3<+Iy49025}NWp={QKv=4@LO#4z1A>VS*CV_Q(ZIr2N
zY#gQ);W>8;8uK(Qk5Jr;LrfD91!mJ?_fwtgfOH3yh5Yx<6}x|d!Uc*h1=&Qc=7@$M
z@Q0M;15ofoGF6DVHUT?KIEN!D8A4!+#igjNshcLg_pRO|?VK|-liHeZgqVFs+}G>-
zopV8yhZUf?Sm9tUiwkn1sfx}ey|dsC7e@X3t`57$fXwv7%-1ouWcdZcsh~g*Yfat$
zPz+W5^ysy~rrv6q?W!;qA>_%27W^mk@7r6~0)S?k85&is{cS`|?i-gC3$*JYLOV~o
z;h#n{FQu1?UQ9H$qoRzFL-FeLR{aXKRfy!3Xfc(~J}wK=UdNCWE*d5i)kCp%`f_V&
zDqmIh(pWNjbJ%DLz2}+eN6agYl8<zGDta+p;88O8g1nXa0SzN^5+lJ1?CyKyOD&UF
zH9%MD#FV{8H76sRR_C*+2L9WC>mOYq;&N5%zY8+5uyK~2W)QoiFs!q33XAIA1qyX^
zJ?oK$?0NdXsB8F>Qe5ht3d~_nTPY`94N_vD&3=|dgA4-J)mkRXM?U^@z^(St>c+$W
zh(sWsS;kRGfygnLT+(kGQ}xEjiXg%BYyfRiqZx}x{YRm@c^?w_)dXk3CrSon?{f?v
z69PtXz`5weitr)?hKSOMD@zv9OkzC)g&~w!ltKA<l=32yuc@Eiu+S&NGEVwvbm)M(
zK^$m80<Xkc0+pezUaK7>Ui@Ct1S%;&aC^Sp90y-Y+=?zQ*-Ym`AnIAEW5Ktv7$5~}
zhtEIV;Y+#qW57tk(?m?DK425I&D^}OlP?$@{~>E$$R{EV6G?{QO3Z=<@7$e4-UB8~
zAI=0$`9OkwRlTD{T+TZX4nd9i(o(C8ej?bJKIXUR@d(Jj=#ow@%}f@7#~OCEA1!zp
z<e=k{ldT(fLQY89qiIca2blBn5D?4O$`fNv`d-A?G@^US8s|}dz8&h}3b~_<wGDcE
zMzNyPD9^L>i(%tTsAGb@vse&5F&jI_oozhBT+tu$o;rS@)YV1D>=<Q2`}1v-0Qu(+
z@+;cqgUu_$yQepc&!@j!sMNrnyOtjCEmVGVVT1cDX3FK+n1F8Y<mp#`1HiC3jgSWr
zBTY2WrIil-<l`Fxd-^T*J{HQ-Ivpj3={;RoiL%Kwpl0E?Csk9$;76P$KspNy8cah6
zgJ60X$i)KT#ygn?d!>{sST^+`5-T61G-IV%F8>Og2Tkt$hv9HiYpUex)Xdu9qa|D6
z%$nXVGz45f;aNq~u)*)l4FK-yFw1N<W_!9q%AteqcG*JU<*L2UieIkfJpg5HNr2w1
zDM^@Flfy!K<(8Q^g%<%#0t|Y(#XV|COT$0XRo<T?C?V~w_j1<G5|KlQ$hA?M?hnCI
zxi)XdL{w>PziT^KD$BU#Nf(Kq7ScQ0t#tF8rw@^E)*4DcWpasIsD~ozr1JU0ZFp+N
zqJuy}_|+l1H3~UV-?@MPsJ_nd@N|<Bq%c&X5S8=~Pw-SAdG&naJE;ceE)2eA<K<B#
zT*~bC{)2GDB^wvU%-+<+)!EF*?te}W#?~-g$;=3-U@V+m|M$}lYwOl+a-jIn*4@b>
zVMk!ylPJsND<~w}!`O0e=g`+%Mpws)Z-SVPFO!c`zl`3(g)a>!x-6815|YJA4DLI=
zO>?sCirpP%(`{H%YnLue-#n2uF1*wiW&?iiLU?<S&;~P4s=6o{cZTl6B<Z4AdOJ2}
z<+stZ4TCpL{BHpAUGOC-fu0@ksZqfIH#0vXW%Zq3jC)huC^cCE$A<6kn^DTT+Yx3H
z;@)}gCEp?5TGUbw=}N5hD7-KFC{jFBwd9UUV-aX3+tioO2hm?g4#Kd;8`ZMjdN_(?
zEwAsNHIBjkc5BUgs_%acV8x0{mHSxsqlo>wKigT_3|Iigk^8EV(KgGl&xvYm1!Iau
zr!X)5{*61TF~sndkhcK}v`k|edl3fgc<I}O*D$*5i5$5ebe=QmIR|kZz8oiN(8WYL
zhniNHixI1i*XxQaA62FYxUT?a5=VG`SXI3eB{DkqXxGi08PM`zXnaWZ-cU8KH5p_!
z(LN4NDOEtN_QC2~>iV%LWFFM8k=>O%+SNnlzbP>zGv}wD!!%z*SSCfStT#uu<NPXN
zbmr)i97wm}l!!I7*Gj%6q|s%op@cGNj>;EJ3<H=Ow<2{`IoNCVygKYiZJc<VdU9gM
zRk-mGv-6DTP%BwNCc<^p&{msnu$<PUFW=e;{T)EM{C3CDLcPczK%Ra}gAJV3!Gkz>
z=}sXt{9xiA$PT4{|3Zt`xNNyKz4{zBRM$G-HdBG<tR)Fs1~D+P@s0;%vv97`-Z?;*
zgbY<mi4W}SoczcS&R!2Q6XIk_WGloN;DiaztY(8Yk;*na!M;pFIHW)*Od2AaGMo~L
z+P?uGKF!p7$MM+_)IIN}?25S17|h?5)1Q=rs2~P0738*`XmZqPMPt*zf!s_siGjAU
z$8Z584IJq)!@g=CR`f(jt!%iQNP8ywSbh8p;3CeYhs>AZkChD>;(u#)D5Q?u-IIiI
z{BEROTPqfcWc(T{Hj*ToJn{?XdabZRgvtSXH(Kt+E)$>l{+?_Kj=IOs`|C73P+B)~
zaa}kgze3s!s?%s^N@-o50Ji_KoBpAWgq3I-&RU3F@Xy1j^qpb%*&l}{g1qU|FW1_w
z$sB_h$uYMfeS(a7XXs~f6j6dZr^(wY3PW)sYAremzQ5aXy^B)K%pP6)dOH1($Y}uQ
zr{f)r;GJlEl!IExXdc}W($R%v<7Kv0eg!Vs=d+3DP6{L1X!dxgh!Nw#Gv=t`{wj(1
zmS-#!;&Ioz!RzY}9hdSPW1PU12OK!EtYOsV6Lp)1gFp!TX+qI;9LVqhBcu#)9Fzoh
zlPHiA_RqPpYIs4Cd_;C){oN<8Wqv@JX0B=juSr<&lTs&%K8DsP@ej~kYLhctjggHb
z63^QpNY%kxozU^B4Ze`>1S9a{KfJBD2EJ5wXHK~8Y<k56f*S1b;^grR-WZY@^%z|u
zw0^$k0!;^c1}I2!Z)0w&xy9_tD{pTzClE48P_Q=cj14wW2!mp$KMEE_qMHCU2#r$P
z5)r>iG0(l;nRAsC{JBJPJ>BYHsy?jWAhQ|_7wC6v7lG4^)0G@ap{T1)dXBx?t-6)^
zh!WJwwo<|kZ#N^dlm{!boo=ts{pIOb!keG(o9EZMUA`IXRc#{8egR-#I^>jEs{F2O
zO@~N`o6WBfzoEmg+mTVmmnQ%tM%qu}SzZ(vT5-2u`<!z#i2F1&=C!uu?QG4UfX+m%
zRiwum_HF-cP1752>BaPP*XC>gLrp=&xwp&W&0LR35tCxlQv7uAD<VGfy=8|^Pl+})
zqW^#_ny*6gTo!m@G-A{>6j9NtyUp4uh#sA-JZQ;ZS?*7YvPnF)`wqaCN^8-3_oc0M
zk-L5ZybPRb!7p~XsFBCJwvTBA!3sr?x|RgXn=2hP#M2oz0sp%a=HN_{C{ijvhE3$~
zMgmwANBiX+Y#!{WobFm0Z<&jtfIRtbfXmCYdU-kx_`l&k^h;ET6^5~2h<buYE&76Q
zS~U@KIZ5vsGJ--_Y+JyY)tWvi>WCf8p$I@t6VX+3Wq&*;>%}P6*{R_Sx$<jY#)Q0q
zUZcsL4WuY<_fy#R;$WJa5oYsHm-6LC=29zW+YGGc4xGJlSukaeSx$Q`u>g03Y#_{-
z-BWv_SOKG1!XR_Bnn+0#-rTQ5ZN3eCm#!Wk{3O`VI()(}Zx^7ryC|2l-srwqxC3=t
znIi*!fvBJ{H^!dEL0+ElS6j0)Al=Gqph&<z5mY0%>ZYvwI&SR%!zIg+-0~i+xvm+I
zWwtIg6-iJg7Vp%r$VPnip^pf8otMvBA4mUk^@uUUee!u%k*!Mh2nnC>C%NjONdwMS
z+7OqXdVo)W(hsN{7<F81=2wrk=Tbz;D(<DiXEEl9?LpT=|H_aIk_75dn&StT2s4}J
z&ZSMYY?WYbE{p8!1Zo&q*b~wLeJfkrHIGu#FlVmMb{u)yn?}>=lNQoixncc)LfoJ!
z`<;x=KQCp643J&)564%8Bi}n(kDg|btBqmAeFT40L<8ia>}w+-WJ~eJ);d6Hk*L(q
zA!r_DTXYU{z}NX8u?Mrdj`ItfTI99s1)RPQX-18~QR=-J8x01Kqs=9(t=OM6#P~ID
zMeVG67Bt2~vH-5Y?4^7i5bKm&u&t8RxtG$?*o<gbZEDxesnDa%p$M3@mIej}mj+7G
z;10y2<^Ud~Rcu@<bm-RWFf{}OG(u}Jvqo_cTqiTBorN|YAz$zoRdP(p=Zq`^kg%^v
zSBo%Ez}qTC&IiL(cX~$m3ohU&o3^1<RdPZ}$hQTYLFHEoY;&XAI*yVYX2@kPe}bw)
zq*q&`2c>7Jc>r`16l5jT#%7DA-ehXf^cYCY2LQdhm>gOszG#q%zjTGg%NyK9Et5Le
zt+Y^S&v0Pw4=<?Qr30U@doMPf`Qq4YwYkco;(v5vFF&6i&(ZYH51!XTl}`fIM^Bwl
z7_dODjL0+UUg7iLq}#CX?B`Wz+3ms1swfp8Zke91Jyb6aNeS+12n)n;EN9P-7Q+{<
zS^%WTo|i2K)%j+X7013Gr|7&)SxKrEheh(rQe@5i#+i0Z4Mjx&dNqy}d$LQ8ZDEd7
z;7={KMPV+!1+UUZGXqlSmIaiy-rN6fFxhOX8<w=<`0jI@U+hT#JxyZ(C0t^eBy)0e
zW*NTG@5oI{*buxcF!~t<8bTx~C8dfL1Q?B_C}6O!pfPF=4laKc8^z3~Qdy3(5ciS8
zV58m}Mv9DJ$73ivCM#-@F{Dw|MJ5RkghN#E0U6@hj?W*Ccf^7GQbzN0w<YDMVc6mL
zH}YWzz>4+lsDm;)saaWD^m6Dcmer9~cLt|-(!#R-b)qTg6fiO9&s8VEdvv~|1~~1+
zc|k+0VS{S?YzH|lr>pHXi?Hnjvz4zY85qf8yXvh+@T&|D3^a^o5qwJv^5^1tm1@!>
z+h>9F4v&t5CZMh5$u7o)(@=rY-JUUcpj;ItAPD(<nqML~C?VXRyLi5CIRGp$WJZqk
z+flSmnL|>e7{OL@d7mV`zh-qn0M^5$JGGavKGye^C4koQC{4LZ%ea!y?#nuy_|t;@
znA>n~i{zvlY{ZTcQi7H**<;$CVN3tkuw236W(!91P^V-{0vn_l?C;^PHto}sIFP*0
zzti_yi~2TAtorF~X2&1N#{lWYOoT_k^cNyx$#&@f2Z{0imx;OAiI|A~2afspU>N1h
z>@8d^iCEb=k`pDU0mC}m@msCPfLFtY_)em#sQjd)vbBh4G^^|l%%=f%xV)iF^&VO~
zvKmH(pZ6I@DZktqj{$lWJV#k&wD6qSUAS=$=&uI(JX;mw13mNXgEtbVo@;y2SWbZ7
zz*jpx+?IkwZ@2$_`l^hb7Rssg499BQVnyxbbl2JPPLB5`z`!mP3HkTLnzkg$|EAJg
zQa}9SL=bvWQ#Y?9NL)^@r|)Mo`nC=-E9#Mw0YP#{SAT?4ZbZcTMzf3+o0ZtgjZZ^U
zx5Vq|#Cnp%=cZQ6)E)t2C9U!-l^d`8d2wI~zt*-xe-CofWaQiax2KKWH}SlD_mC_z
zipQmSX<5Asu<>-dBB+7?jUhCg#`b1;L7OL$e_l}+w}SYQ>mLIMIlh`PKb786bAyI^
zzWt!h6VF#fpZUz}oG@pJ4mvjya~b(=hmXjh)&UqfzVk%d&ny=fm)?KQlznPg<w%1Y
ze$L|k{c{Jc(K<p&eHepynB7_L|FEHI75Ls;chNTjkic<+cYE?#RGrKMS?w(=ORN^I
z^>f~=oM7-hKJ9Y(zLxA`;Md30q)UTFgzf675op(5ZA}=hSTZ7$_lBS##%yCjb{b)s
zl{;yJmbJX4X=BX%hoM-0QV+cq8!~I-ZL~dM_nAph<-HaAS-|ACyu`eQFm}g_bA)wm
z?&J*y;2)V?$(drbh^AAENvYcA;9A$eUV?+(4Opo<>ubHE6?S@kdbiuev&h=#G#N8c
ztcP9PaE{HC8R3~{HPC3Qs+KdheGhCP9c|(}sUY%EF(BOS>75XBt%WrOT08knq>FYb
z$x#kg2%avJ#r7w{psp>dlRzgBoOIE;u7^4WgmhoNo83|KNgH<r$`9jM1}S>I3aqEx
z!K|Uu)@Si@-nAn)OgMsvPj6!WKKMIH#8O%Uv!#zcMs9CWP8hX*iI{p}P}1cl!%K7$
zMVAsinT^q)TX-v=zg#S578fRG5}Pxho>Rf6R*%b#=tW72rTrD0VQhp4)~HF*f`WGi
zY-9$l(&Wxy6U6)5EB(G3XhT#cD85Xr#F$QUGb!J7VE2lRZW&>rAMrKJ>p;<367Gwi
z33#AQ-$hOV>$b_u!k>~fFhk3~Y5h~fAT`!(Mt_5Glw3*fbecD#CxcRBuf4tY>!tmJ
zZV}uE&Pc9$H}^^N=2q+^_Um!u?OY=Q2rxl{UA0E2VL!IO>EnE3=2pH+Of+n&Ilo^D
zgU@B^Z>v4$bk%(RWVaY;j#^~P_C|m5L+oJ79X>Db+pAhslUV)q>1G^<s7_bgep;f+
zS`5xH17TO^AJImJ6~G#8vq3d$Sb9jb>d!uLN-Jg6a~x_Z6cfThdAhKy%!=6qET)2J
zIhV_LyTN|h=~(mD2O-r#|B3f5Mw}+O1J_LjfKwI3gung$10IxiH*)UTMnN+U{19sQ
zeRxU;(A&hcF54po5w<0BLkPrkH6ncaTRQWXp93pSnHv~2F{R))EJTvATU3@=;IODI
z69p^petW54kGHWsv~<v9J0Y$NP(PD0t7RYcPvmT*B9Ij?W$nqwdfl+9_O|@`4T8A#
zk`^+ozy>K&bQ2iL>3n;LiSV94N8gQ)yBz9TcP%yl17bh}$FI1oSKFiqh={6@a=*+D
zi<k9?S7fRj*r1E1jsq&VTb+}z$By+hOG*%I2rEs1kkJ=ptR2G!3=H-gaI7^57ENqS
z1BFPVISa!s7tl2xk}Vr?CHoctJoB&I6}gcHRHN9X@$xOe3@>Oe)IHlOVDdfZN@Q=Z
zZ#AeafRP;lqqG+f1Rlun$zltphQgXDAnvU<XmQ12dxSGKj=s+yqX<^qZF0aNy^8Th
zZyuQ?X65`$lpMzQE!q?epf@K)G0e>#fI$P?Y+X~jaBZr0$pgQd9e#n41Xx$DZ@q?u
z%%kd;!9?D0Wjm>LvG;(%kA-@pEj5IUVv|WXg?2kDc#!`grAd3|_h&ftXMpU@(YG?Q
ztK>`jyUmwU_Gp^*PgriT!=1?-{tnpad+fm35!;y}`k1bN7a6e?Am9$4q#x!u)j+wX
zY>EI@=fIgR>V67La@39bK1~VvERzH*km>FrpmUnQv>=nl9mBMO%~a3osN9!T<e>y2
zfs_+wp!w+JJxac}9Wp(T!roE^kRHJ!`)4QyMSIV_oPc&&7NVItM3Si5x2D}iSLzf{
zK{w8cf+v}FE(v1|FnV%l@hv%O%UPn|t0}>{;utlNi1i4Gz>YV_s-@|CRfvH8lbw5O
zF-b1Va0r(1&`cgaA5Z7Seg3D(o*zy`*@-J1T_gg(W^yu3{Q7;*j1~pFW9MIrUyXG?
zW6yTW36f)z>|$yAyDk4sjr^ucYM8Y!8;p4se@1EC$_>ybAas=>d7#Zh-3oebU-D84
zo>i4Y)VkmZQN!Y7IJ0IB=?nFSn7hnFD{4Y3f(!eVT>j5)B1+iKs>*&U<NJWDrj1Bj
zK5XUPfUaoWoJT0)ziK)joQW8{w%IGb9v`HJVodM^-nJUfKQzIOkg~eXYodm^2po6#
zi<1mYZM&Qn07iAyG;|t{akOMy!^Hpqq0u|-n%b{mLxordFxEcG8rrFd!xNaTH*zCE
z_RN?+cD6xC^=K(;V_S{B_}?7G;9HjojlIN1vc53{uF)uHKvZ{oNHf=dI&qaJU58HM
zDq;9vSO!wO<#>~-9PWRMe?B3SEEl;Mqp5lGppJ}`0drZ!LkvA0;fyxRL{b<iEe0k(
z0iglL=vm|uTBYj5^|5D^Pw1uDKrLSEpnb~mX{>Dh)4;IYqp-MZ*)N{;`lr;f{qnP{
zPD;AdiyfF>Dm?~5rEGV<2G0^Ib1=_&ju}Amr%o2yJ+viUk}&Q>Kx84#@jx{RDguJ}
zx0SnBfN=k1IHR^JWM0#VL!*QMHhSRGM><82BDB5WP=$jSz`WhXlGU4dc`2O+U%s+m
zzs<=)ZmL0uHG-1hF>57NBxFu$+B$g-g{ej43FbNwiCZSWxE7uS(M=bWI=xA5E!3r=
zb0(f5*U%Pnh|Hx1RsLeT#3Jt$sC;<k3<CQ*AjnddF-!NOL^No}{WA2KZiN(yUyXCm
zOM{g~%KtgT8*x;!mkh>rq}VF$(~3`U@<*%kGA`#B=*vT_e+k(8pD551eURY94bdK1
zrXHTWoXRLY5~Ho>KhPCE8u@r5DRO0Sf|{~Y!2<D7dKV64VBfoJTHga?3DIEvX;=DF
zz%tbR`d{4i22*Dgo|TXxV~)~UL<r)zX=%@7?lMtCJrA3%M`BxVu9pH=kj(r_?c&n0
zepN<L&8AWxG#jsmESv!o$!S$$()>{pzJ<r<`z69ORUaCp$m}8!9~}5T1Kf)wm<ww3
z_XeY~QsuPPYY^hY*=DR_Wu5ZS12l0L00A5Lf@qdf#h(ywuJrzwolabwxlZg9wT{8G
z>%tE<>Wr?R<gS5(u*F>1vo06$w#NZMg*w{3uO?OYt8?6sZQ+%TnjPf-1|LU{Dwx1}
znumz;pvDEdF#cTITEzatWW(=0x%6rN^+do8-0+$nZ2H?B?vPwJ6LB#H_*rrGfVE<p
zkDD^W6;}%<i_>TXD*RciY2YUHOtSe%mS@ETSC6G&$Xe(}rZHL2PoLjmeck7@5v+@K
z;ohAfoX+sg0LQJx+hp$a+w$&!8jv<SUrqvy+%H%|BvGxSG{IygE7-=Ng`G!7>gn}_
z7mXI;#y1kK7j11gVT#EhtMaK`0720HAT#z$9<PtjOX6VuOFz=l*wXY2{}r@jhh2{%
z1!dn7ds)nl$OI8wytu9lk8*0kGd3S~5^ctonx9P$G%??E_cc@yONgkm!QovOs+X%x
z)P>S>p#B`{4jgBD!FJuM47P=8w*j0rOn!_t598Unr$*#(p+OJ7KC1a0pnxa3^D%O&
z-0HKQgi;jmdImCd(%+k>jNhH=&S74>X}yMt2}#Zt)51-m7q2>|yR4)L((Tzbq|?|Q
zr%_lSBzv_E@OF1G3h4cQpMG^%b%)<$$3IZ80)8FeAc59gbuN}!iZv16Cc53fYbDgF
z`89SBRGn;qk!0i!Va(<MTn(sZEyeNi0$HAj%p9bekls0pdweB6%j#lzRKd$e4HNPB
zlB{m}7nkkzH^4_0#uGx)puj$0-z{oBo9+!U?<M5<>k<lAk{SRf%lJ^Vd%UE(EPp(^
z?np$@6l5B~CX1dypE(zMjuhSDV$IEyc2L;DCk~=t)Q`?7ZZGKqKC9?OjOO55PeOz-
zAbz(cId7u;Th@`CWk?0<SWRr<y7lg1iRZV137<5mN1>>P922M2e)2@1<byfi!cbHu
zXnu1ZkLw6%4oVV)LB1fnQ<^MRT8IV)NSShEt6Xm)Zd4Umwes5Gj^T2o(`Kj*zj(C9
zIMS&}EL%F^AUgs8c%0b|e+^~lSs-tc%rL%2XSFm@g`f!)YVX-f{1iZ-)&q0`LT*bd
zFub9U;kcG}?z^7qex&p*`MF4hRIfHU!yP>vF<@2qo;>3?_h);)Z0Twcs7oHvCq~W4
zR>JhG8WnC2Ao+wDsRPdTPE$dNXHefWC<7a0l?>AMEIaD}px)02B~5;ulk=FEH4o?W
zXHXq0trh(=kmLyE=0bDgpoL?f7o{(m75%(Ie{r8rQEF(vYN|&{a4WQOcKF6T=!)W&
zn|l<I>gzfCc|6Z%&Kjev@8*8aB6A#Es0KThb=;wAE%`9q*Ei3?Z?>x!Rc)L#(_6Ya
z@gQw}39m0f<~9G<UBF^u{{PpAEF7H7$$`Ao0Gx66!}j|f!$RG1K3HN7kgFVuNwUmA
zIgHb#^VRq?s%Wc7*Y=pQ$L9(WU_H}0_p)zaBrPzdPnkz~7=Ukb87?XLWa{=6<E;v$
z-7RPH+h_icQ=bDQu18aDUzgu&_HE0~UCOc53}@TuyLwyrbokM0*+C)W=Cy)MX2k0z
zAXkOw-9mHu6^uvI<5$M3bsO4-OtF2#zx#WCo6tcrM<+rPC7jo=Kmps+h9grwMphin
z|IOdVjAiMw*ZP89QGf*8k!jO$#<>QZU`zT^q15%{w3O$~?%g+A4m;;D8_zH=`!~ka
zc|3Cp51Iv2>NGt5`~>LMf34rDmNVWSaB4=H*&1=*{XW{&=Vgzv*1j~Q)nRG@u<tCS
zCyj^=fPLQl!x2_u)jQ;CJDC)cRN_(y3yi~@tmcY?nrkdFuH36@gqqUOlxX;=J1w%5
zqmBC_*s5;0mHYS1Z2}CF^=a#`q1H&8MHsc#ZM!KEOxwCPgma7P2wD2WLbIVIKtE>|
ze#5qr@#8_Len9)#l5cTa54&9j5+!c*B6)RzvfG02FD2(6^1pm*?iTWCTX}rc;y!|U
z6F4PHq(c<yk`5pBW(-Nw3RK`Yt$Dl(Z5ZLAy6*VU9fIimwQ3I$s~7}ZY2R}z$AKL_
z{ofr%5^u0SL1P^xM|zZQhrs$y06OR;PB88yEMOHRqP2=({=7<;^V<t(SL%cq#-H9^
zo_uJ3NMp`OK}~Mtgcjc&k}pS4hk(e+o&4}%Sl0G?sJLwo%=nrMMMoAUw)0JB#Vj_Y
z*Qz)IT(LW?PmhA8F5~z$0aP&gjcCNY${Pqw?zuQqc(9(m!MS&S1*LW(K*L_;U7Ldk
zpVL~P@oUr|g%;`k8`FX(9C3903#@;45Q6%v(v#1SA5CH=n;Xu6A)`y?L&0ZC#$Wa0
zHcj?#f#zv`9atVDQS8YhMEFoA&rNn$)Cbf%E)gT;AC()(Mse?XjC9CTzUhw2Nv!R>
z0y<Kby;a?SDK=%Wf<oFr08$OuJ9tonZ@R5HWuRqz%?%9+2m?2Vzpi$0btIx^CGN+y
zqMbG#UoV2&K?+T>qphJQ&CS;Kv7h>`7#$2WjtjoD*o-Y<;SUJW7-;3ruX{7D*~K?v
zT`Q8Fy9nz(>y_d&0iq5&E0-r1`VM<e6VcEp9jY<LzX&p|ki9S)KoWdj0ihy;3=yX+
z9c$A_EYU$P{)-<M0d$y(E(Mt(*x&^gY#>tO5Y|58aU59z5fJqnSGseXLseIqu>isz
z=ilUlEnzUrE*bJ&O?E!tLR3Q~nK*J!qUnDJh4h3`1u5+}L5RH`&F?rywK>0K?LvvJ
ze)EX>bc*Ig0(pH(025PgS>g?wLaoYc&QkC36ck6y3<6^D0kH&;iG>flgebHX_dwT{
zTI2;0^x_?ex+J+`^El3<cP*;{`bqI0^;CI1BajPf`yDCwv?jXP3HzQb6&x<?Tsw+O
z%Bg^oiH4MpLfS()>1<ZJoe;`Q&<#C$&!B>a8N{U=<6`G10Hf?=>y*Mq*L|o8!b~=O
z(WF+)h_!BlE=}JANYT?jc5@gY(H>(vcO$!;heaF>hPCdixDEWR%pjf?QIp>38=(`J
zZ^E02CtVt8gUrotUM1RX;hA=PUS=v|LldBVXI2~jmF`dr8oUr=KAegH4$rLNx^T5S
z?}x%UD?$7yKyO4VC$_38DVvQ$o>qa@;SzRlNFxIweSY7cD)-P<at+CBFN6N7tN7EG
z=|a4&V)DmH%O^R9bYZC@*_|IA#oJ-l@oi1GwnC5$PQyYkYvU3G?~py`yj5nmxanP)
z%h3Ubj@;@hU%_$rkrXxRr+X9;3=1BNHq3PEL$W<aK#7D(bOpE?j!w*9$dQZ&Bx<zy
zr+Q}FIoVTVwLhTbwJYO&va4H9eW8?b-+?x`z=m%nJLpi@KC5MHt%V37VgIQ;>XNcO
z*5y_DzgR}%!F$DDrS5#CNQojBj?ab@a#@DqEtpHlErg}%X8SrNaP~~-6HV4y$GwiB
z!_|f%07|Cs1C<xE%|fqJlJ|ylr@soKkH<5e1YjD;Fh2QI10`rIU0760kaTH$Dv5*o
z3eZacBa<@&jwb{hC8*%qM1gtSE8n}=TfYvQ&213kLU`1U+-H2xnKmWYH`ZPn!mp|W
zy$;uXLxiK&<@czW`TNM2T0TP3ZN1}dzl*Uv09K%8brY~a=-3(_lC`T@p$v+>fLp3J
zv5R7+Ce}OK<IJgSQi;Z(`c^8kDWs~L!CF*`+yk?zzox3LZnFpa({U|mh$I)Eo+UN}
z?ola}7ggsBHMj-6kN{Nb3DX~Wq}`9Cy(9{FiLkhak}~QMoT!GbHL{W6ZFXSBp{_Cz
z0KUsmw+i6GA$l*|S`Utbsebm<$ms4_g=t?xc>V7VUzSuN>zP~nylFL@;U0p#_k+i+
zEgQr`ynR+sRp@Q|`#5n9)%SWt`VkwEbKf(UrRCTwg1taW=lz~<Ssy>k?Lg#~dVbGX
z<2+nOFV8|Ro<*usU38PVjLi%p!Yn!vV8Y+;MpKUVS)`}|n+&JtE~sKi|M-V@PQ)Bl
z5Dr&At$=~*ux^o^?w=6UYVaYdrafEp8s-$7Mai3-zvyLtTLNp;BT~^Do7hZ&{Uhtq
zp~$^+UfBpSmRPYfAWUT}+J`&W0JlqbP%cfpcm3>g7WLc>bB_10Or6MR0G>S>uy%pf
z(|lb2O<-*8L|EPNlHyTj&h^PIA6SM=WQQ+OnT@zj>Gcg(+!C*@xie%dN}Hxwb0X8e
z$Gs%@SI?Z3FV`r)e5*j+!hpO!!wm3STDYsNRtOsBrN!SaY{Jy&6p$q><1o`36x>fO
z*9-M&k=4AoCh)2OVJ5L4+#o^(5S*faRd=Eo6W!FqX~f#P2t7Z|N5`SNq3JBYG^r{a
z{`cwxM&RN<eWjN6=~Z1HrLQU6c9@R#fkyN_hU3pDzZ$M=s_Cwb?ra$n;<?eupl)ei
z^SJQ$dugo#N(saN<=iy`9G_%Q3U|UV%1<#_DGO57i=J+U2zI3NqOTkbKwhD$<nJ33
zAf78(AgyevdP9mWq^}X_1m8oVNV*8*#}2aZ{j_{9ik@^}F<V<S#4u<^Y@+sH(O5CZ
zQLrq0E6~=NL^JdfMzfEEeXDC>^rvZ6y?SDym|-K$zI4$46#6*!R+_E;tk>1gtI$n%
zM^m4WgV#%<k=U(78zIgSK(*b*c_$!M#xA^nGUMQ=5h9CgzDCdAQO7<U>K>cFa0i^U
z;z&IxFW#4=efq>_61>1?64DFey3csxi~X8<edd$!WH{3`kR+<H{(8?gE<aP<U0Gm0
zm}P-Vp3-89{<%}aCo2(ucL}zEyk@5KhL1{FtvH?8D}3NZ<%Bm3Xz$G;o|=Wk>{j{5
z7VFtdgAh~eitjbTLM7|`Wf<_Kn}v`lauZw%YM-RzCqFCv+=hg<M7mX;bABG}mxG)c
zByZ}_A1+rY6M*!CBM<_@i#I*wA<;kfG>k_u(x?=X+K8kioZF^@^C6TP?0c*ZW>AF#
zf2cvHf+}+fXpr9oPWWF&1z}?UUyGKN>HplGR82dFO%9}=JVT>DLPWU8q)FcTE5KIi
zXxgx7SX+pqxLA#1!(wLA1?9!-^}oG`(FRvz+TlRZ;sm#OK6zcqL6`(zd*TQ5Br?he
zqtUj2lXLz1dZuW>oqQvk)1X4$2H!4$u5S1s@E4^6a?b{a(%O~xgXl;5bdIFR5?N}1
z+t{q^>MQ7}%VZT~llsH8CStg3`VjIk0z%sB<?gKgis)280wGu#onaAd*%?!uayOI-
zq0t3yfcOAs?4M~0+RIi{Th*1!e~vj=BhWCxSR&^(irsX?nM_V#$+_iMslk@Q5h!a7
zoc0d49QguM9i`9@f6LnrL+>XE(#hNb8J=mp(`g$%3%aQv^wSF8*T&}%1a1p7n!F9F
zno|VYlFp-QOQEuk5o%JHsv)4LHDRjEka<H?K%@?)6{!_h8y#RGEqLW#dJu)lY4|p&
zLjpi7Dy+oTfp95UDiml5AyiMKF1MX?p(rR<rdHaO#TJgC&_x272OrGOzG!a%QJ#M7
z45d?TWNi-`iogtY!tT@+NtS11P@5ehRgJ1FH)oBkVOy<yqB|ppv5hxP@3RQ2MY;yk
z3yC{5o!Ij90-~21iM1_T*N`mS{Y*!*YYhEV=^Yo^<?*HllQfe%Bv20qV8tcx4;O6J
zT;^C1i~I}S3u0HDk*OjE7Z*N&spShet&s3yyCcl{RC(|ql(2Q#QRX4l09CPQI#Kxv
z6z?UzgZ!Fw9#YHhG<N%RKnq@RG4qnHjSb%e^8FYwKo2KP=%6yKl*WUI)BPbSQ<6Ta
zu>xyyy0Sc!+eSMXrX*p<A4RWpb3x#|RaN4Oce3+bI1hHEwOX9wJcABU08v4RlFBxv
zTyz4>3<MoTbeq6)8$cOQQoiuM<E!{8&pnCT9*`IkiQl~1iUbBYvRXG`X`3ErxVA!q
zYi!uge6bRozQ7))dV+AvQkX#iLQ&|l*-S@o-xcBLo={|SDd=>*GstmPgeF18maN;F
zR-hvs{+Y9@nYvV%@dgE8i|}A<#n7gs1X;!)LM|zGPfRF0iwc39Vn+1aG=HjN=6Ps2
zNtVt*qKf{B_FlPjHj}GmmC~=1`I$CYbUjN|(5`dMtrQ=S?egA>zmu7hEvauk@bM`(
z0J&hSvV|pi?C#77{?>Z*jp<p(IqvliEaTxmTv><Fz%=LH(Ha0mJ2qN9$_$Hs9{-3y
z4ibnP<mA9~Sd*ij5EL2l_9I-yzVD8pO87gnk!kYFL0RF`Xa-F1^)z%>Or=z`&bn9B
zk8J1+KHu08OdP!298M2yN8C>Y<pe&=<}5sP7;!hjJ;=lnYh>A0<PaF)9O7}~-rTAh
zRLFwbNJizITnYh{we;}y2<_19VI`Y_Z|hD#tUTN&Hc6Njo8BlZ9WHApIHQ8J`$S7g
zy1ZKgWjvoRiEAD+N#<E~=tq?5*arr-d#y*VI4Yuwxg6dNs~N&>m_}uwbOlaLy3<9H
z?rrMof+NGzD|-@Hxx}^~9W|Yx8G!=a*_ed7?Pt9?ywm|pt=ifYHup57t+WVO+_yF+
zi~ZryzA4?6Gtz2@a+$GwB^F;9ds$D9PB0Y?m%H}%b%FprhuYnpb$#0r1(bnqN=UZ2
zy?wz%f9nc5_E(B&&cBz6gd>G$kRQ6QYRTV*>eVM0B9p~ShFTxO@i;byuRb3&9HVPC
zA+dy`$vlLYRj$QOJWtnSF9XlYtq_C5PO{&aZWsBT0N}8k0ssHa%>P+Dh(H5n;^6+@
z#e-#SJBKX}l>Z{LK@-n$<DYCaqqmI{VOF!19$R{Wn-gJe=zzXcPp8a*#=(XY;_I$M
znCP`kD;_65njJD3j?;fi<P<C8)}1&U;H@YEGc%=H>D_pdFZ$csqlf4qn=${Ms10Ob
zS?b~axal!nx^a)0_8^Fnq0K}+{rJFe9uS?o!@EeYsWKtu->65ODpn_N(#5OuS-ZMw
z-hpD3IE1X2E~w}Kd=));m==lDH^-6UYpKV>5qF9$E7mFHGTg3ax({%i1V5D{w{AE{
zx(~tHHiwo;KD&K-6HqYz>Jn`KnE)PMeVI$se2a4!`#ejnu#tWEZPwTSIVLsr16;I4
z1iLF-%nDL;7-g^QpfohOt)rg1Q$S_@DDf6uzYw_mz2u<_?P;?_OC-$yoYqVRg+Tq0
zr6ZmbO>UZXDkX&f5SuXdy_L$xtsk>*hJ~oD*#uX$*(Bs~k#OjwhYTD@M*Vy1W!qI#
z8x&M!X94HU*R9yi$5Fw0GuKkg4)}S3*39Xf8V;hRP^Up+q)lw{ZBWU%Cn4t^a8^o-
zI&<zgn6K4+7$YhP3>X}vi|k$2JxoiI^eA?T66RAKXoq@N*0kZ$K*}*qn$lJ_CAvMP
zxr=$Aa*`^yG|Bd}%c;1H*muvJKdua)UUyEtC-F8*CyBSeCv<5-(>Cp71x)qPS-VD8
z?N9dH=*`voSt<>ML!?*I^WWaV`V>sJVHhFMIGp#i#S-sARE=s~&^D(u_V6y13X1CF
zvXPj8QoJvNay3fEhcVJfD)MRhNwT1ifjP-<LAVKrsnI?JQ%ClU0<B*vaK`xNR5rv9
zXr%@;Ku>x~toRc?+A`Sd0qW5}(DDn~Z>N5&L4Pu#4Jfqej)=C;_Uy5v%LDO3+Zs2*
zz^4u~;hS=Xt(bS_wy&qR%wg_^mWixZq2|tZL0LGl^tLSOK6gIBUz?w*@dCsH|1#)l
zLH)CFC_dj-+iA|Qlaj5+ZJlE{Qd4F^E=%s;Y()?^P-Xk5>>)@H0yvT2@I%jCQvO?A
zjt#fx#f_~Fz)Lr|<wJoc*QSWGD&96l)MPiuz@jBaO*;YQSb$uUA{ZUP4JkcHLCf1%
z-LSJ;1$wZUQ8A^Xk3tkm3xaqB(ypII)2`p+4dE>L;8qf-<5$*PwFBJ=rE_l%i8Zrs
zf82NlhP5DG(w=Ic0F*vAu?bhw6ORQ@14Y=~SB$}tag^Iz_@H9t^Y{G`>#;gVMY;~Y
z8?#a};X*I+RO7fS>8ruBDtQIc^{Djy+XEr*;b}g{v}jx&=eY#R7ianEiC_QUJBx~J
z6P-g`HzD3*Z(-IlzB%0)9!TP}YX!)jSW*>*vFo#?DcUoP0k6Y_mobc=Gi`7JL!p!d
zzIqElPF5TUmtf9JPzlFakUDpMP++?sR7$WyoE{E_VDP<8Uo6*@o@R;M7x_*pAp`R0
zzFgjRz{Z8!NG5vjGCo?XO`$544WR24#}<2x8Bk33$sy=OpaP*V1l~c#X}=q7B}|>>
zG%>ZTpL=ls=`f9V?}Bs)B1!o&r2s1kbs-x;jv!n|OByRX`3io`Z<GO)amr=JDRKY1
ztQzHj7CKbPr#GH{@sQx9WZY7vJ!kGVLVtla{lt1Ld><7nQRu>Q>WuyZPeqnlL=KWu
zt~IQp*4+R45zw;jOP7IOb~=maSq9}Va}=$m4)s~Y00&3b1%b#@6y`*_{lEU-8JOh#
zc1!a8kxf?9Dqa&8l6*(V&RY+2hied>M)gzV_~da<Bk9PSNL(^G<<PHxq>>^kV11gn
zT~lH4g-x-mxgd`{dvA||%pTUHcUU9L<xUVSu$SrpJZf67i3t7>hqH5Uc+n8f3uE1j
zT)<(+0CtR6-UBx8zSnCIbgsn^F85AYT%iFab_572edVUcLioV!j*QYDC%EE3RVlhZ
zxPn?h`YlhztxzEhvKc%eZM(r_iJlGh*LNotgq}M=4ueVj?LL(Xn7ENHu1Z!ME2ryH
z(O!_sI8SOn1mh<>^T!NqNjsM9B>x6Ho(Rkx0A~*0bMfWy)DcFvGnV&rK7C>S;<m2l
zt6iVpQ<#pM-)n$}rHC(KlR1k*{+2Wb+*p1v)_7$}fsamOf-f0mbS&GNY3mw4kKg&%
z43u1U-kQ){!lnoQV7>x(T?4y67;Y3>ckf&4&Oo~U)$If0TuE;`yhBk}S30O0{(v<^
zK!W?XV}2$f7i_!s#M3HI7Uh76R2gz^8Ch63KV4F4y^_d`z1|r=wO(Qy(;U!N@Rv6h
z_2};0nWL(kJ0Ba!p*eIq{I>eXl1o{QE{sNhU{HghAs^uV;o#!od2^PrHxu7Er7uU(
z=ZW8tTIyTti$={~UpdCUO29OfQS~n$ATd4%9ZNAc^^}P%=i}ipJO^KlU`uE(q4G^o
z<u(F}>lhk&0rOvnKN9O71fCguwZo29aY5*wRaXRx(;v-%-O(r9ZGQ7!kV(&<kardf
zubdzIlk}65?p=0(++!I%_(<A~Lt*3f*#^{7d;gnG-q529ir&F7^Xl)%#q=d3z??XJ
zkk74}Xf*Df$pi(fTkJuX;OlJ=TShL9+V9m5kmF^*RHzWhVehiT)sxqRh>%%+6o~?C
zQl;`R>$2x(u|M=O*Xchq#AcBxMQJf&=%OBBJp-n<!gu=*@pb(>ky9|X`z=kPe!o^n
zGtSe9N+iraoEgo)b`HbePbevjRC6zMz}`OuLwhFaAo$j(jP}<~ebq=*f7$kJH~tqG
zB+6>!|FD7UKWsn+V`bv}zf$WuS3mx+6+P_sRTHbHF**xfQ2g1Ra|}YaSt=p77*pQJ
z)6Q$Pe3jtMg!8<PkvtJaJeM@T04ggN*_j#jme+Uq5sx4#DQwUp^D}-n$~H}Q9LCHd
zJD#!eWAX7*`*Hepw|mc^&GnyIvG4QU!E9Yi-hB+Z_J9RqS9?YH^%Wrhk#p4U{qevM
z5s*tgpiMrJ1=#a?K98;=+*oNr8k#Im3BIg19&w>)*ZARy`ELNQyjC%+g3J8-X*_=V
zIT<v|_<8s_ta9T0<E=dA)zP~%b6nC%u}Y5WG5)Nr<#FCyGWfG?-}d^?V7CN5*9AeA
z`uOYc=fJNxt1f%i{TOh1Cx1AOAzSkFMF?AUVn+JijpS}Xz)=?e6FmCtrt0@n_(X50
zIKBGpzDdQ<Haa@2a`d?PzTw-*o7=PUtu~%T%R$q7P(r13!qadR=Cs?F-v}YU!OM{0
zl>bKX(_TOG)otkTnmuCX!lj>eBP8)tW<#p|g;N%ec-&!2mj$S=e4qE&d0h_^n5><>
zeG!0}5#!!61OKV7>F3P9jqi=Ud~fYoV9@)XxU|Rfcb4`vV8qLs1y~Ary>Dmxhucef
z7;UO<r%zv-cvWi|UfR?$ymLZX9sW*N+$%Cjb;9BpOs^P901D{0>p56oMW;?!upeVJ
zm@8t+Td-9}VgZJktX4SJlM<BXY3L(M^xnuGgPU(O4-d<@y9ULF;HtIQyJdate~!D~
zNxXkYZ+|x*KLd+jqC}W93oLk8<+S|Ee*W7<OIl^;8p+^TSNkq>nqg5+h{b&_Z=n6I
zoSQNiz&8{SAb81sb^}y~b)!6Leja{&$v*eEc61_z$^vd4?R%&L@mw<PuW#wckvt1m
z#XJ-7LRVqQVB)Q>_De>-NsM4i^|@6gSaTys-f2}**Qyc2&0F0PILkV1{VMN1U^K}4
z0~{H&^P<c2#OrP6x4?B0n@W-o*ALh|8bdAd8qJ2<aW0}(Wiu#1UwAFySPwBA7WwY`
zeu2_t@&Lf>sXW|yGRzu$sSzW@sS+_&YDw6O9flci$F{7p-LBE~w*ll4jdX3Z{4FXR
zEAp9ot@GW3BUR~%z8PrJ$?_^vY_yg$b{a8Un%cxHZSPGz)$MSq!ky@?8BuUv1K0^4
zXDUs_$%on~pt$2GSuWY+kxfU^S*GBuTMmO;2Y^FoJDJgw!H=zKsUI#moEojtCpE!-
z>0!teo(flIUzJGg{YYUpgvdm!;3{n^Zd77QL(a&#Nuod8U7OdM%Sjj+?kpprIZ^Q3
z>BZxjWDYSr>{-$VDx-#fBE?*vy;9mspT(^Qt53d{wD<{DB%3=kg0vrV+&TO~pbAN5
zr~!$1xvJjtqo-&^F425W1WcM?<Bpm&qrS(z+;(AO(No7rzs8v+LVkGVLcH7vYzWs-
zN?9(jY)%9~saflHM1_d19t?q>iW*G^(Tq=6>V$AK%L;L-v4^}OsV7@1@;Q)dq2^Jz
z5f?vi=T8m+Hbz?`_p&%;SfaabG=mCptbmxm-2W0zwpiqHAmO&NY7)4I?izn*U2ro6
zu+%DZ@yc*UJwj-vJ4&*+5X;S@sP)CvvcGvb{5sV;F<v6+GMU;1DAd|>@xpP#y}%fz
zJ3_O$${fY_Ib_|(F!H1yx2`iE%35$Fpg#MNfIX~J9Pq4anY!6Fg*Y4V`&$})z5uH8
zeuf6R{~W~`^yuq{leIrTa?PQ@oNjT(=cjELThA;@a3J#{?}02Ca+O{J?I*WC+}mqc
zZeR8cBsRY)<QoD55h2lSC`TJckVhI&VnJ7iJOh@YN>eXP>~<=&bKSdSy})l$AE)Tc
z`yxguu=savXnGXl7NbF}l)S|bg#e7q1apf)W+PAMel)X~Z^|8x;Aw(`lE=hyYFoK@
zqxg~pgw<k)0ldrvdm7yg6-YPB_b>PQUj9+R%dc57b;*ZM2SNu=5hH;H#(V{o+=trD
znO=P9@w9iTkhx8IXtU42z-f>I{!4skN1g;jQgdx+<s-z1D2KuX5i!`@a)99FvS;kA
zSE*07d~~Cn>^CLmHtQT`G{+|+#Cdk6n=S;T#~3Gil@b3>(A{?ci3ghKYDL$oLY#x)
zp=I2aq16oizaeh3vFM=8xBcnk&fcAX<$9XDxlb!A+ikfN^iKGZ+%@n20s^t(|FQLz
zL3spSmpBA>2^uuGyIXK~hY;M|87#QFySqzpg1fuByW6vQ->q-=$L^1w>YlFZJALN%
z?W&%0?oi5+HZ9pFo5fq6FYFCUB{bdS1P=lW#=4F%ov+aj-BN|92boyXicy`O>s%J-
zCv_P=ovVijqyF3XOXU~zUh=we4H2h&x|ruV0>Z-bQn|yPZ-Sd8)<1n+`Mif>g>|oc
zUc0u-#{pXFU&;y`_}im~%KqTy7;G1FH%D*tAuu+cMvK9VX(Cqn^bXd>ut6hpAm-~+
zMr9O&v-w=)S{}b?CYy(uIY!jqX(IMZ&J{!(=N2Jn+Yr}XKHSwd6OVWMKVMfXCQkPD
z^4>j~_%}8Qd$znrQrBWWt3!C|-%$uDt3hPkf549i6brUP2f=lJ@`0JrVccMx5VdaX
zG<FH}X0Ycise1nNYaCeg5(zeB;2wPsyz>-W_I<xi;>w<<OCluOzQOti@TSHk+w&5m
zm>Y3mafr2N`R6N?%tWzD+!!3-fxYg{Ege3IrL{WjlRWUeU6n;`Fta{OM8~fau^l|B
zx#`2R4xy?FoW)H(Fk@@?+t8QTdB4q#U5>7yYxIBIf<H7$;d;45L(ZrIV8Kk+m4<Ct
zU#{x{bOg<s70$Vx5PCuaM;jCNWcT2#VyP!o!GcLt4w`G?sn+He_AG#o<f+$WHz9Ng
zu|k3orP0pRz{Id(2&N!vowLR2lX34dz~7Q);fp;nEzPxjG-S+Q6v&b^_#RZ4OIM-U
zTg+Dc1u(l7kCgWn{+WK@`fXV0#?6rcK!hArV8!zL7P+-wxeeblg;b9Y$RDva8hWRe
zR`POB@<j8s(vYS98^`p5!$kT3%!-<Fkr0=dlIBc4x*?hjrJ?vgMog<@uR71Mo0Kq4
zqh&BCXin6l0;BtoohZ4(^YCT0z81GZF|AoNCD%XJ<@a6g16&te?@YGoWnhR#+kNvP
zSmZqwSr1Tr(3i&I(3>L;+YZk=4|xB9fXTi(?H`5b{Wg!s#(`#^{{OX{WijaS2diDq
z%MPwJ1`ErbYRG?RC!~V=zW~~6eK%G8^YTZ|>#F@(bU*Z&j61v=77`%15>o-k?R&0h
zh`S@`5xnR$UKEg3UCbgd`?vH7PXF6kSwY6Y?dQ4bIaHeQT}i6NlE4|$HI;Ql330=4
z^ao2Gxu3_X>rkpsYH8-b82t|@*>qDHFwxW|Y`Q6=9?w-T6u&o3CI5dYyA$~0a{cew
zP^6B}w%`J`bDQ`O|DVZ@q^X_gAhuXsWz{|!<=0>CbDeSBGFkl>sKo%*v=Yumfvm?h
z3tCsR(*OGkt1sA89ENI(3_wZI_AJL%$5*<zrj^<9Z}0S{At(au{{Qw`A!Y?+O4R>6
zg#E`bz*3B9$7=qtu+`=B_V>x48yaBLJ#eHUwjDY6p$fOo{~G0qHv<0pK^d1&Yx&N$
z^c56poXcpv(^YO?U(0?s*S6j*$WfxOM7$oIaXqAP3F=K4FS<!_a0X*378MFL=7}#b
z{)1y|FN+}uZMZDR_@}Sj;~}C!{3(1;XTRqdIP5sKM|N<bS%lXl9E~)Y%jw3=K&n4Y
zB;d!8Ub1`J@;_b}lN1=wER=fAMZJK*Uy8S0FTKKj$_N6+=o4x49ZLNQ{sl8Ktk`31
zl;nOiJi7I=pr>~u@7m|2j|+DP@%nWRaWwDqyeNGCpFCnk270XeIrS1%)ma2J)%t-z
zB$_bCKd*27xhw86NtOC#m>#Po`e^RY2qeM|*`W}*gj22r)HrzlKL_2(?<G`4+su85
zWBc3Z<#=gonWcb17t1_)IF6b8=%pvj_qg^;D)3qgx4iVS7B9a7C+5#1e$bJs+CGCy
zsn5f%!;*gBa?mN2cf3t|5N@5^R{{eZp=sT}uSVldTO^L};(BmD=s*ZxRmw#Y%HnyE
z+5eBGgqe$t?Z3y26IyH0_(NzuM;iA9AF-xORg8XyLiP2+ez;8J{NzgawVOp3;_8L9
zI6^OPnO`|lFr_lu{}x&M^^D)oXO{D*=`CzD#s&l@LpYGk31MnF<$i@~`6WyNTiwgD
zc@%5)B~wHWw@@*OvN8{wPs=>E82zgvR3G&b39@<gZ>t0_fNnSVi9J@e!_FU5D1edu
zpQLRRF#>8dGO&k1qpXK|y3n0LtIzP8fciF@AFch@`?B6Yzrb@G%h~*?WyJ%G2q1g6
z39Y`sF!pQr#9##~j=+136Z-Qj_AW{f$1>U@Os`8)u4H0&Ft+x=#geMhCqkus%iJl)
zM1BtQS1QF01iBznke=K8Arzte3dz$khjFfz{d9UAq2&jh2A+^wv8pMr^|mbo>Y89E
zbkP`1++g+)bxS0dDRb4aezCz|*_ZpHAE8v68zCcY;c%f~X<x^q`+W_~>+e<0pB9pi
z4*-YOQKkwdJ0^gD-{fkigG<^WgNyj<hpwVP`fQEb2Sg=g>jfSmGr<XH+GeA|`wCNX
z*D(>384mItO6Fuv2-a-3B5FY@?|^e7d`bVZL;ab(?14=T?!Q~+he)07e~yWdi7rds
z_N^UPxHNlaTH`A($+2uTrj+`ZLR9p!dfMMD3v&s6`t&bw^?WMX9q!C&U2j_@TB)Dz
zpJUc6AAm1&cgDn(t>_@1Cu>?)+6Kd=9fN60s_Ne!l!md2JB^5`9iKj-$4v8gqkt*9
zYr<o^{;oG$ApuBj_Zw2#saUXqt!?Z!oe&*3IiN#Jw<Bxg_Y>3hgH~!+hEEp)vHI3k
z6Jp#l3lbZF@miqpTtlS&snTE*;ohi9WJXu!6oAv?aaA;Wv0Y@r)^DuyLc*8U)d@PW
zb^jb%c<)X)sTi0zI5#b$^0C)p*oHim8(*o&60aWCE5uJ2RA>FAkF45(G}lePN#A$x
z@_ZQbcGg~@u+#t|mt!>e_;}PQ`PJx}BNLVX4MR&?b{{&bfW`;<pwv805kg9a{4SnK
z3Gji}iK0H!N6;O^u{7YFWRd%PsR6tOXj1#`-p<ZYB*MNc(R~+(?N`({7H)eJv9?3D
zlV@*))ZZxBAETL=A-X*!qE?EQ@>ofWVKEixGuhdqva4y&@U?k;>kvpLB(^Dxc`*#I
z4*TAuIipA{JV4g>5lcvxrnqT=XhDD>4Zx-?qu0?XA;W)>*n90C=T1+~f|?nk2)&qg
z<PvTcOSQBX@2VeaX1$0S^sx4x-lIorz{XNDEgZ`5`D_Uv)Kou3ru87FJz%0W5$jyH
zMnTz+yyrM;Zb{48z3^;GNJ-!#?i@F|cYZFSsna4-=e9&|7!l17MA&+FbU+i-13up`
zM5h2&wvQG!&L<qVC(Z^P1NZf*8tl6rTaIoJS37sN4u8%R<HzmX!iIrwSGt}7a-arr
zo#6}I6--+}iVO|4_N__0*pCG@!fX&1W30Uv^5K4RD2s8^OOusKURH-S+1)=vd~727
z*B9STaV0@gA-*~s<NgF2(CXViQoqDb!_Z%>*N2*%DIaTE5(+}Z;p9-I!Bq|9Fr_lI
zv4a}ImMjMCAFea;G1}76jop{~dLFu)3mql^Kfy9R+6cEa?VcB@wuatA|M?M=1an;j
zO0@|&Mu?lL4rw9ghvKQ0I;<6C*RNretYh5ZbQ{+BeQLxiE7iS%4AVhtK!N_dWfHL+
zjg{=Cc!W`)?xS5SKzKS^ako|xaS`P>7s%}O2TmgzDevX(!jJl5{EfqL^9}qk#~DS|
zg39<~-?=a&<Zm~<F}(*1k?>I6MVNYsa|Ysk9b%&d({!_Ei@5b8@@SaDJxCxs4=mcG
z{E|hDXb7|F>%c2{<C@3^Aes1T^qoFNJ>>7hfs0fiaTR0De9d~zYz<)yuYL~M{1I%`
zq;A`u)KEh7(o~rwPqs7PiTejwNa25Pl@QkC=*GJ8UAV8_H10io2v`iwMVAmx@npMn
zbm>r@xi8*S?r9C3y-CzZn-Ma)b#ze|tlzw@W;+gz5!PI-eh1t-I(Ql`-F<ANiuRJC
zHF)$-+>7=e2Jq=q0wvg+2WLPr4T*KfkDwH3S-1+cL6wcQ<>S_>HR&Rbt2~=3mO2B4
za%CMlt0+r~WN+=?P{cM>N(knM38j@3>hTB7%b*;+vP1%__z#+cG-nnbg$k>z$Rdt4
z3+L)mIeODoIDpc!yYU0>O_s(7Hm|u@J={>O)qp|}rQzq-vqAE>apoM3)cmg|gkvT(
zg>&VYVG}Wq>O4My%JS!w2mv%!St4=i+3Hl~mUAxLsN)$TFO572Viov2)Z)pG%315)
zKP#!=Ip_7>qHOc0Sh;69^NSv2cUBcG6||6Bb6aaLLWN|+^NJEI$4f7ov#Gl1|M3mf
z(sHDV@)}c+7-v{3PNg~%v8$?BlV{kJJQd30b?(*f0;TQJo8EnMJ_Ri&kKj|#h#|hC
zF|%>A{m<UYLc+<ymEf>~1<A$2nQ#+N4Ma7=vJtF)<*1aP5{tp@WEGA4+8IRRX=jWW
z%v=zOP3{@C`DMlmom3iCOs4TT=y)b<)5|+P)9aG^3AFUu#cnlmepL0g^5*gM)zy?<
z&zBoNkzE$=x7b}Elpi`6G?E7@Di{<z0+_!@(D}KiJsZShN?Pm&*x@OR#5amhG$3~y
zJ}}qLIvn+0E)xd+i=vYRm{1=WswM<E4LB4;ke|>E2r6Hf0xTRAr4>m?6f8Gbq;DN=
z1xs;qv)Z25>s~GcL<g>`XbUE(tDAV`#v?TO<q$qZBo+(_Zk6cJc@7O;7|dBokqhzS
zqXu19`O&<wAt*Puq@)C_e?$)K0I;N*n1H<wD!2gWVd6}!fE|aqj$jhP*oAugE9)0a
zm}`dO_GY{!zLL-Xt(vJP3LHG7FV>b5?@|&!m3F(BTS!BV@Ol|9_#LD2lgba}dT9kr
z2qL$8>?7%;0+rx}7Z2iherD!3Njt7tWJ3gr9<Z3C1?Xvga{(|Yi#uA>0Ki^!V_%ey
z#2%{um2&%O@*9{5w++~S@V3GIdTzD7S!0GDKEX{y{&o!uXGvvHqmmFecW<mYXP?2F
zN>F=WF6YoC{qvD2Vcd6x!YP9u?C8e25AnXi4J}3DFK!MYWi+2yj>e?#H516eFri@n
zLP|_<U{2sY9l4JI-J@q7yue>yULeB`_xXjZAQQZqlibkPUT1j%B`*fQ9}-5W{m<Wb
z@6VHGPEsg;Fb@0gUk#BO0?EFBbUp?V8$JT<7`Cu3p_!mJ%~7DhK40HES-Rs=kl@3v
zKkc5c-muu*OJ9c-qn}Xrx_xeMzcc!w2x`LhFp@(+`T22Ph}&WNf&hjBXn#;s6tG`T
zYNG^pBiP=_T?{&3-eUx}|6nIr_XCz@#WqT@VYXjuh9~?;g^nk1jzL<d-723T%+HEZ
zkla3~{hNs!)NV`0SqliX7tGa*wh2J5hb|KOu!4Op&0rS#v@88~J~cgBfXV?nQxO-n
z9TY;g2zh=(-LV}7>={#|unCZwKm|#Ht{(=h!G2^$+TS^!Yb2n1P#_>cLvE~^ibMb6
z=*5rNZoS%!wih=U3UW-7JFA``u^zC{3flgR>%(xnShyZoXVx$drkX8u7&v$mrQ;0D
z9wcr-Kl;(6>m{FXaPR=_Zdm~J`G+V#=HTE*a&PBMhVKWEoOfUU5DO>;gueOZ-U)8|
z_~o7n=E4b0Ul3mxqr4I;Vv-zx;(tcq&u=U|n6?5|SHaJ~^;HTK%w2%+7pg%;#Sz1h
z(e1%Gcy1Vl&x21`vh%TEi}iN_jB2^dqr#T>wk=bb$u^=f3b&Rx1x6YN!V!5Ey%+0w
zjV<`M*ivA_e#grKuZFd8UFg{+_K$I{p=k9fD_O6eFaHYG7A=lJAeh9t=eQ~RBLR*Z
zvvL*RsLGTAjlNorf!srIG`&?#2ecsRA8+<?;woYjY(>7&Y^#r3T6zSc^c=LDke^Et
z*7wKmL8M;W=~DFBDbseW+O5+=`|XP3D@#<YcK1Ngy7uw%v8*{>UCejS5H9ciCFObZ
zK_BVx{6nHhv#=liu5vJd^z-YmU-Us4c9oSqH7F1fcrcZ2PPSGs52oz{<H`N9z5T1a
z@9B#Xqf(t5o!JFLowo<h=lOYfk`iYx++1)=*@OPrVY4r54arJc{d(>t_>C9x?Y<HQ
zKL}7C=(8xRq+7egdqt?L_#!JmqM!M#QH<ljSR9tNI9mJL`&ALv(u4Z0zIZ`NX6F?{
zAj`r(8r|>~+)J=2x+op91{$&T{@HJCJcs1EBhgCp)#jXxNvzE^R)B_vT_6ats-51K
z!&u2uu_X%v;w(u+3;~<;JA)i{=6!n~vKJt*=rIiwN7M(a&%3Dd;C^yCj5=--+kU%6
z^{opr)RRw*?VinZWCQhpxnTi}m&yWFW-P~bRR9YYU(b1#mbn2}@P48Z<;W0DnJ%^a
zAN?+!q#~_D$<mdQ;N`PDkyzf6H^MlwhkB43(x5-4vg?Xt4}575+;^Pr&ZeP8uM`;O
z3NhL#`l-3Xd$~y{R$H&D?p5pCB8~g8DISxqEHz#KWlM*QKB2B0>iX|m8&S{fP<z=g
ztMk{|U6*Qqyxo!Zz4ooGKJ<dv7?=`wDNXqtl32ErKlJ!)QHUwFuTKN5ukP}Xp|D{l
zG(D-??u_Ry38_RSHc`h$LQ+-Cb!NcRNtWDn{0Ovi#9dPCQ4xgzkxwjnX^gM8Ruq=P
z-lnST<B!2AsP*-~Q9}<+K_MP5P-VOY`!M;ZC9hpb=#Q#+%y|(bR}G?TL)l_&Tz7_G
zB6=|U^wSFtQsIr3zo+D%JT9cqqiEF;C1_QNVa&$9@JDGLO%rMPhwhM?_)!2+6k@~<
znnA;^l`bo^gZo!k76;jCX0992V&mInO-RdvE-;9xcVw=ZRNBNro$qna)>8<u9Xl4t
zBnR%A-q)H1qW5?;Z_UTKnR6e!kW%_%<VBW6370j3E^;s2TqoM2(uUHo_nl@@k{a#N
zDm<8UhEuM@1YTFEUl;itl^lUwQ}wWvg-MKz?4^EG3Tad*7Ky8RV}xSt$Sj)8i=R<{
zrfKZFGTlICdG@a*vTn?dEG_d%vu0;4{+bFb;6Kd#2NBqC64CH?c0P#-T9VS?dGzk8
z#^t*#kUd(NtIDjslZvC|_oBZVHK_e3k<}m&f4)|-bmxESVMTfjiwm$Cfk{#2MaTT)
z=O@O0G#nT~B5rf59KfX?j*)2^N)*z*-}^1L%DLV}|MoNA6XTl11}+$5>pZs8B>3tE
zJi+}t?1>sK_Q#z%-lVAL8qMF6TO%6lr_kkRc`%u|z(KqQ)^-2NGI{*2R%<t}6a?k0
zaQ)hv!Zz(^nEbNGCJ10rM(22OgF>U?zEO_vYdfhTj&DUl^G~nUucV@nP%pDzQob)|
z6ys2=i>`nv8s5{YSV?LR=@l`NM#SZ{Kc7EQjCIbrP?;KNanL_3X71eSNjyOlW8FAr
zt_BHT2Ep;Xq_LfFn8eyq2uM|N>W!7a(VNN059sg)*kX~h7taG8{+9ctL>0-zPAoO^
zGSybCfvrBSv39O0?RtgC7u4Tc4B~Z4L!qnC-IG%AH#u?zGrajS%=y2>tF5V1E&9ea
zN+7G>Q&TGHYgf20@lW|4vV7TSXbS9P8A!^Dsod}CD|Mw#m(DGujVztP8Gvc2?F60E
zg5#|^Nd_#=Y^(wCDXy)!n;3F`Z5kfHg=dLsuc}g`<b0kMmTcZVBJsb$Z-!4EdWdKI
z>RxvjoWA$FH##+^ZpO-(w9MmV5__vw8TljcK`+rgUq3a*_}R$E+nlt<RJM3h?B=@|
zBfY`5P<y5va^3InGE`!TkSVX+x~Y2fg$E8Ji(o{5v`!W<Xs3@4Dq7~%`zYmg>9WHj
zyM=S(Zp}D|*pXQ}Z5u|@6Qw4Z$5hNDQG>?xh+B@6aN|6Ma?qn%|4}hl>z&L$yd@0|
z#*4^1eu`7${cV8l1YhTZGBjR;OV)4?FGu&-B#DJ8g`F9b;@-)PStt_m7VoJG!BT(u
z!uXTpXWSD|rF+yaf~1*#WuKimw4m`z@4f@qfz&UCe>_3&R*|ENXC?h&H7;+qq<<D<
zj+x`F+W%Ju&b!re$b$c+lAi5CC3BP6Dd*JL@!JfBhfCAi$IUOzoj@?6c1bAmR;PAv
zv+u>OEDGTwgWEe|p!mo)MAc@xM^D;|@BEJYiq~j>?Q{qw-|n=6#h{V#6j2L#=)<LA
zK_z?HM$rD+fmK#Hb&eDXh1_glG2?D&o>y^Ck%k?=)pFJ%N6g(N3g1Jam7JOhiN4^E
zdLF43HLD^`ij6<{OL@p@O=_Is0vsRHE4SIHs>aAv>}~#n^)(JPt&(UG2u4OdD87q}
zwdxXpd<-#xf#A<mk0B3=qVEj@$BW>3DWN2$xXsWF-XC#d0}(G)E8-7i#oVjJzT8~R
zh#%mcldLfKY=hs+A6+FI)0)~sLj~a!eiywPC0|9SfMDLir9z)8?ys+$rw9TWp*o&1
zf*h-YdA3SEBdz%U989QA3JHDmw}-H%Qk#PSr}smY7|&PE3X8L*@R!?*(3g~;FC-dA
zbP{)AQ0s0>&&CLU`WPps%HMvcZQ00fYo)=w-e$uJsC877Y`L2dIsA(Cif3^$fz?R-
zj2_}KP5;6BHb_r<0S!vp5?h{>xM1V+LT~uZA%;x1T#?VX7oZp;XDeW6;G|p$t)RmK
zY(6$@9Oe}%q^(VPgE4l^nBBKe!>yV+dOb^RW+!)FaMAo~q?T~vP=e#7s>fHDzHq3Q
z$TnW#j1#Z!b+vQoCToypDSutj>s5^YIGydoX?b>O2%slwxAx+f)z>uUZpaAlUCB$H
zkg?15CP2iT0}YZJJr~xPR94ou1`FN*vyx~8DBC?3Uh=d8&!(+l+KYcdb$5jo-LPT?
zxfsz_^!p38#AqKE;K`fClpggrvfV#_OxFNTDgOi#^OOSjb5({BUKy=4b#2v(cU0`g
zeU9%WLU1srrx}kC8>;@35eiT7e#O}|UM+{L1_lWMbcrX%+NmCp>in?3%MvsJ$I36V
zG=AS*T3!~OP(nug&=s{X9QGdI77pE$D$5$+dDLMi^C5hyT+0Iz<QXF{VgvY<{T`qy
zuTDB{L`S4gs*9c^$b@Xj@B8yQ3Z4^a9E@5xNsbu!@G&rawn&+M9C;Wxq;*k7Ga6|g
zgsctb1rHt<R9nbi{dlK)@p<imSo^tG9r`egL57A=t5cQTC_FVMi>dh@#8;^#sG1$`
zsOLUQ##IX$`<$Q1nUFyQ%P+O$PLvC&F%MmPg;xF%5$t+guX{~mWzygarqVi+2pf<K
zRsyRCuf#?$<Hl%jH1T{-5PV+=Oz_a{-6cntc;H})qWA`Q1TiCySmOHth_qT=i&S=-
z0^s(N#xFr|TXaD_wl&WUF3n)-!0!16daN$>NhKA|%fPmR*pcy-Jkz>EwA%gtx}xwH
zok^E4Kg(L=3P%d6ykSk^@J|Z(JnZhM?~5KLe>E+>^NTYTGFso>mn6@;BH)c&jkKL-
z^bJ}IBBVp7b&T|dj{PD4V({^n*GM7qQ_K{6WjlE7R9E^LhkN~;X1B$zC(Vg5`AJD2
zpl_6v%X~ra+Ns_B-hjL!J>h(6;PY2=H8Km6j3Q+&mfdktT|b=wa5LGx+&mw;O|UB}
zG7lrid@6AR-S_c>-`L#AHbH=B6l^b<WbaXbRzpjjOb)MDr;Zq4D^VsL&4(Ph=jqP7
zV@sc{?~VV+y-`o3*&)%<51zr7g(&HF2tUMCvOa|xKG)Ggy^Bv~!#P8Ioc61z&LzI`
zs8WH$&XLI?aQhv+k1b(3%$r~P%D1(xvsF}%yoEX|(oE{a6D-?F28lZHoJJD$#$`@)
z!nf^!?V-Aw72y;pPaT@)gHa}Z?h|cN@<8T~dS=4PmHx&--SStm=j+fapZZvr=#=~G
zcKw-d-I)t|&=9L|_dN|o|8Qc^r<UG@<9EVz(X|kWT)}IRqs2#uQE$DT@bJww?w=L8
zwYf=@3ra_{x_TKYSW5y*dZ8-l>+ohYAhkOtigE?L0e@xS%=)at#A{>noA`(I8hizH
zS?b#1Y;sF<Ji4?@5(<-Pz$63w>8pCtcLC9xU5QY{CzleYpNa8fFKU|ni$DFWn{SsR
zmq_whQ@&~Z`TImzV!K?Ea#R6(oZ=9iY?(eGf)iA(<q+_NwVZ83pzvUh$8hns#04_Q
zT&gQFvDI7&IBVZtig1!?==*?J1vtXL-UxUpe_w)0WmeE#1PV9>&b1C3QSIi5@#<nN
zQewOYph)U*f1zA;N~~wNFD?j*g@wd+4&948Rr9d=M_I$@@UFBbcZhq)+ehw~&^@WK
z*p}koi49lj5uS*(;D8rZSoffzug9u(qb>Sk`>x;ua-Sn+6BzeThYGSTVQ9aHYVQ7}
zhc-K17gpF80m!9aFws7T*Lk_Id3XXay>BjOk}&(cUii|xM+AQgzU)#H9Z%S5UX+_P
z92K_?HlOUi;bdNE2F<miL>5s&9n^5A1v39OQ%($}EdDwbP|;6*RB6dmS?Ki9b%?@&
z>AGG3JYnhyIE?IiS#{_gr7us9NHlt@p0*ReRpmqvN;p?VsWI~Q&U|C%&4+HfVNIlD
zQM`$5@9ccgM5rs`^FrtpXWq=*za&?`oy-9zt{a^v|0=FRo?WmPL$9KudnA=gC;omQ
zuXYUA+GN&sbmV$f(H@41?^AY1HK*md{3j|K$jQmf{szPNj{@RozHuoM#f@DuMwcdz
zyt}}OVGzxlVz_qXn+|TPVsplo*NE4xe%EStD$+1MIFQKTM4EQz_Fg3UqvYG5(nUBj
zZJhz}A~8K>C!^S96sMdmbPkKmlDwNmA1kFu^Uv|>7hTpm>6Pw<L1CMWL@+x%#PHxu
zK(^q7Re#?W>B(2lMm{bsgh@abzghq-dmXDeX08~KvAqywh=4;~m$QmB`_a(8$^gi-
zDpaar(@A+}MrWq^E?|VZkVCj5?jzC5y)HRnPo+yJ?Z90BwU_~TWD5o|@Sa~&e??vk
zGexY<IFM~_Rywqba8j1Tb_*En%nDTk*Q!ltXgZ1e=9)o8SP>t?qce|pw1}rMb~wAZ
zh*BF#av}y{&q^1DHW4WNj1)JsxcMhhW~vtFcXg%$<HD@6IUJCj;fB<2^QWeGcvoF2
zt~oaej)~4URn^uSL1=2&NTvjSULFE!X$20o5uw5sF?Je})q*jy*#b`27B?mU&kQAf
zImIxqVDT|8vx|kE<H~x75#@JUS>4CZ_Em4bU#ii2XyUOaYo3!(DPNZQXV7v-#sfTm
z@Y2p6fMQFinO~Zv_ua`ciiOI3G>R<}qPHXDJ9>&5qfBb~)54Qs?Q{;$XG1@CKgs#j
z#s3bAEOzCTHp+4S#418XQ^&diVy9bZ8b-ozpkw^cn>CfY;`Qn1hh*gEl<?dX!qpBI
zh|Bh0Q!-U88dV@hM|C3>*F5gic(hF{eyF%Twm#|%u=hs?FPmR7WgFtOdLyC+JgG^K
z@iC&12V>oBYBeMgIci#7OUbG80Hk_CZTW`6_k;1C6~}cWR4P(!*C-zVQP}Mrdp#ve
z-|f;5u_d0b)ATq8t?@W|uA}JuFv?<+g1;;B=_VvIi3fbfzHp7UFFhqJ=eQewW4K59
zNOEotGKUQTuQIg$a^)PXB4llxPj$4B{?}MJTh~LMJ<GfE%>c<{V7Rq5li?(^;p}k;
z?(gEzDuZD}lQh20jc=zZuqUu4&iJA{>v;S1SMlBIz-E+wnQCrwHtRCqv+}1CmL8(`
zi-W<!tC+!8UH3j0bEGXgliTk{rd1<}qZe5ns5o=O<iW%p*oGcdfPh0s*z9mN^weGS
z8boZu-VIV#=;dA%^V+Z_8vWM*#yiN$3vW|CBZ1&>Y&Dn7zbW6y0sW|^yZI{BLGY3*
zOD(#Jgl?+m;VH*UZp<mX2<<hjq&keS;MJ<1#cF(gy_hsLB7#v|Yf}Z@cj#pO=0PDY
z=*oAiF|G{NWR8MwnuyXr!BO@S?jz=q-@zI>+iAO*ja1Drtl<9|)dU8hL}$xZ$QV9!
z^cvh%tZ-#ViHtth01L`6+rd(v<eHkhc7<l;brZza=aFX9kxY$rh&N?tTth!WhV`7)
zJjQS>_nIs6gw%QKA*X(me~6di*a+5a>6bPv5))XEw0>1iS&k7R6b+oyjTt{nMI~2=
zZSG~czCVk6Q?53x!~Ls1&ke>Sl>Q#BS+wBILMM{Hfdi!r4=f`Iw9Exr>6D_w7P>dm
z>n-yP*SW3ouZ5!TPS(#cP!Vpv?ba@cNMjQ=EX+_VKT`+=*KxLu^bog_G7BKxiVL3_
zgu10tBEtmF?Qf1IM|t_DwMfKxOkVbzxyR#p5OV!#ou3jJ3`1au*JzxgWn*=B%tyGe
z)>QfMt6)KY1<rlHb-6PWiQ`gbOk5rjCE02cowxt&vWa2$mB!m}tq<(B6kxX7<@P|=
z!Fz8cWJtF-onMXP6YnIK2anX(<;&%lUbdN2SQ7ARDT*`VbteGDnW*BhR1Zc@ht?ce
zDD00SAeUl1cp+=1+QPlPlpiPH{0c2mw)b89gL6n|1K1B8+x)G}F8C&{#GyxNY|rR-
z#(<B%`?J&WHrLs++|c7#bQ|ZWXMl{B&{r)fea#;pF-r5?9c3uQO0Rl}M(=6I?MDP5
zw;Z08=<19|=3-1cmf6pDC!ygx4wWrWH=c;<(Gcl(#xJYo_6$%H2LxLYFSqgPnhnW2
zX7ik^-9UFzZ$FFMb!H+xi<&!$i{`PsK(Sss*t|hdI8Q%V%+_z~-csYb^MgRf9W-sJ
zUkZCMmcbLXR=2V+zuPg1_op{T$mmxLPPj{WvZ<IA)6ti28Xn8i5Yv7U3=Ufh;AiKJ
z3a}a%H<stEj07ShA_o?HAHb!^`0FiGz`J=LD+8c+So3n#&|6Nly@{F=FAXr4x*4W&
znI4ZoPD$FI`Kr3pV>KPOaJKn4ptRMoW0&`N2?mQ}mTB_;QW*7}m{`X%kzira=pxES
zcgp2sYziHaRJeW3D!pwE#(|yYR(}+jH#bkJ6BK+O*vDoyn#$sO7;@*8&GYo8oRH>8
z<p6A7eH4<1t9rbe*7Q9FpO#?wB{Zi<24r74eIz_`&MOLT1RX`L{))qOJISTBAV3kL
zU?{W*V$#D#>e1o1p!b=|!Vn>KPT=k@-4Ne_%^kjtmAd<eMRRdG$*y-Gxl}yL(Xvlr
z9%9U;KF@|NO{m!)WtQOtyQ9WH{~Vg{jR)FAdDZlz_q2&tSAehI9tqk%|FWg_k>u=7
zd;|vAsc-ET>Ff->vq)RI&i$>)u662q<GTs6U5C?Us^Y#}$C{<Ip6A!4yiDS*9n<kX
z(iOfa@cQa?C3=l`s4DX35}cbf_R)qkV?0?CO&3=q3>(3JEtMj9P0VvA_}INBvH?(W
zXwm%fSbruDCnY<#pV;z1P_JB<at3`SJvx7~((>waFv;4+{)v*7hnmS*kT}&qA>9`l
z#ZQ?%sB!&+jtsdf<7J^@Rj~5kw>IY>r%ipE%ANre=~rJLy8^l(;*jJ3vQFDKwHL_#
zX3s<(uqV_%63tJ>(ik+l^xl(9G6_JPfLFa?=P*65%j*pBlIZ%F07MBXxbYAv2@V(e
zrhHaY-%Y1SZufV#>Xn7ndWTZHAnL2f*}0K5$Qd&${Y{cKBpK$38&fVP!{kg0nx#mK
z>UTsqFL*iXE%|5dpr>>7>`}TueKtXgu4{vf_27KbDGU&i7REL--W@)xa`eD@>(m|s
z4g7oDozy>tmXSYO;g_dIUByt#9g@__P}2)Kh_xhM!TxJ|ip*4jg{24x3g>G3sOxV?
zlF^R{%0h8SO34OK%l&50UQEoh{dAQWP)%+g2X0Bu`-oShF(&DB-Fe%mQc0<SZAITM
zeOtzKn<#$xrEoRfoBe=fU3&)prd}a&xmD0Ja~$oxSxR`b=tuGAB$&S%?hPJdCiXIs
zKK^Qy7^H2CQnsqMSV#5nr}!>lmM?)~RPTeu>ZOA+()>mrdE8*;Z$Pm|lAtN2bu6t{
z{o)5|S-rpb9k!^NKCPecCGgC!H@A8irD1Z5YwA6M!|L*?^*FS5PNWB@wPYvPnQeD?
zbuaX$7Kqw|Ny?zVrE~NgfI3(v{{U&Gtj*w%H2EZC*K>Q+Iewe6x=xbi$PP_q{jd#m
zoRv{(`d7mvPUAnQJv>XC`-0cP__n|c+t$zZVXoR5ru1b@RSy`>9Hcm`g{PAt=cZ(d
zv7+Uu=;A_Z%tI}?++G1&Y}NkCrz0MxOj4BGov4~Pd^Ad=u&14)o1D=qxk2mhu&$b1
z;6&0t+Ka~SJTZj>uf`p#&{0_OxRB?I^*0d++*wwqR{!CWr$l+YKEW@&uQOH(aRDg>
z>T<Xy(S-_NEXkGvz63a8xFYIGDgv@YBU&h(Ev|4aZr-M<ho->K_zPwzI%sEuWPgWU
z`Yjd?oLH$yO2mwe8Yu(%awfhelu?(FllAe%2cHib4sC-?2>I?{R669#_L7s)_Yu#d
zf^>=#&38|X>JR3sb838Oq2dFiGW)}!0!J3N_Z@4U={W3)F`>rV?o0V3t`>iut2_%a
z7OTntOR0E=j!}R<VLE@b1#-MOVNNY39_Pi{uQh2Ptzko-o}9AipemBODSfVuB>?>I
zm8DqC&CPf{lrDD+WMx6I=CJyekv*G-_if_zN!NVdXRJG7e0Ni4(GD#W8oyNw`UWYt
zx-e@2S$*~++`unnP7Q&*1(W%t9DD~bDfHcW1tN9KmS7+Vb-Q5o2d>qkYes*aF{^=V
z9Cyx6Zp!Q^6xo1QINbX%TPUwOMNW{-=*{)_tI{Uy?ZB{_RT&Et0_es1U#!Vcim}*{
z#o&DYx=RJ84RQ!{beAF6JHiqwf7H^vQtiIGM->dO<gXq+-*40ux;@K?yO+@iz{FVB
z5W=!m9(@O#%aNvwf=hxb`u3n5iRc>K4-q<N-WdARPeKO7j<yoS_97*@?@OY&qrVOx
zBT<=-bs6(Z()3L`zQ&PdDEb^%87dOmfsR*{^A5vmw%m%OcNrlxl5Q|oJ1B@hNVcb<
z<?J~9;-0!iEgsjX47942Qa6oA$EvYp>%vxJPb7e+Kc_?7&QjU7W@QLZeb&sIV{c{=
z>zie+F)pck&YNXH7|NyHIGLBr?yihSqeL3bbEA7@D~)#JVF{#+k8zX!3&}++_gE;O
zKQ<s4)bae#LDIyv?@B8qN786Ivkf_9g4N!(2ZVC<fwYR3bWtDP_#G#dWejFtb#^1Z
z!fXMSxW*m~QWaR9(eS8j=P?ZF`_Cxpm+9?_{idJ$_Sl+U`7?CuVolI2(IphMeERvm
zav^6QmqsV>G~hZ{Li*?Sg^w%7gyCL`727E?J6A|Y2bUF2=^kH<xX5MtuS87+;<9Vh
z5ityt*qnLJn#^Y6K7O_KcWKtjvGge-Quv}<Bj%KLl{ge{Ia0lXz^eSQmr{BmATU#?
z93e32SeRM4|1WicnT?a3>3^E6B>$&M!py<M%AU{*K?OuTK`UnJ%t6D8+Pk&%Ze*dZ
zZ)_O(_2R8(L4|BH_;3Gf2ev~!ZKLY;9b{@aZeD>ZF6qk+)t^o`J6}&Wr-bCH^C#&n
zcg$fD9i8n>OwEiiz(Q%mPimdOmY2D-{uR`+GIpVA*B;O^T3M5yAx>;TV2>c~u3>K3
zS%w_YH~$b-dVCBP>(l^Q>jbgv0k!M_y}S%YU~T;l`o<Fg4TfHPNrK=<iXb#O1AZJJ
zNq>2~4-KQG)!vnLmlFfV<Kzj(D=5e~x3vSN<VAw}%k~sZk<FzEX0<!Z+}09S(Txoj
zT(9$!3OXydsiGnQjJ6^q1U90q6Cr|ZSvnNR{<013*aTAwuIFdymJ7YjI08nY;<epf
zR7au=$yO=M0CFtl)&Ap|8sP888Av!xaJ+qsy?bZ~4h6X>4_i7$1D2TOhYTX6eUIpY
zdUkUHJEuDb$vs^iccc3gd?ItObGkLUvAA4AaBG6o3A+mU)h9wkRFu$S^vw6}GUfwi
zSrL0W9cAs*!;|ypQP*xK#bDG*YJMjfeZZL$Gi+d{uAZi@kSk#E>w|VeCxe2JuAlJY
z!XLSsArx4k0*8Q{*m}Jjc)bd-I@><p*}fzG^~JHa_FX3UcLqj9G34+H(s$Y$yUC0%
zH!&0N$MD;x#>RUGJFs9`;6e&cR*OJ4^7OSM#OK8?(Aax%@6^!9%ooEKO2}i_dZ?}s
z;d=*W7gz}0URxo-9DwH&=UaUPB%RP<H5h9y)-d>u!Xqc^^sT}3#Y>=YHkeOy%Z)K?
z?Z?C2mO`){hUw0+;n73L=M$N!np!M&3Yy7#%RY!_pr3#rTwr`X6U-FZ))fHb<)sqz
zOUXdme(Ls6l@$h62VN*tRt6T4`GE`$x*kphDcV6^Fvp*rB=>%xiK6{yjy55%jT~W4
z!#z`0;BDX&<gpGyegSbF046U0;XOzvE-@o(W6Spsfc6Qz7eA8l)&Q)VluHv2HVBx6
zTduu3Amt{1khUJP1aAZYI!kb2_gRBhf~9Q-HKXm5Lf=AZm-^{WRDswTK=oFiP3Ep7
zu({y{2*))Q&^_amgO7l>-I|H*o2yT2$He{?!}i+k`&C>#@?kVKV1ozCiPD3K$nhZZ
z%L|_Z+1Az%<!y~e8;l>6{S%BfBCz002X0#~lelLVE%JE@;{e!!sSW=$dBxcUuMPhY
z?f_H25ey~np?NXrAA>PWdJS9#ubc%?sr=L)Q9Q@;pAGt-uuE=X9l$gfK66{R9t1-X
zddhELI~U4c{&RVN?aa#kFz5#b%YsM*z$#XV?~8liyF=e5%r4EJ7GFV{t*xK+%WI%8
z&{<lo_B$ldMGgHqa;-kpJ-CCiBNu-_{G2>Ji+)eFEtgL*{6UQOna}&j9~8G8_45Jc
zIl1>$!QalN_R+B(hUY!-#uV}cva78A4c0rs8U$P4J@O)PzNXiI`b_nP|8!yVfbyi{
zA`h(FS!QjjFWx8!x^IU2v~%fw5^W0_*|CE}(cS<Ze+B>(^xN+eq}cQE!_A}p@)N3q
z@V=zTE(NBdf*tocrnocA{=xoTqGyfO?Vlwp|2N{{n;#$v*XR~+eUP8s*G^C{s6q44
z*6@1m?BJ^6%I54d5agQz?w>8>)PDdiarczR(Uf=bv?UhCm-<90Fs^)MQ8L5&Mi<Dt
z4iG8r#Gh0&1aS7W<d2Yb9#`<jJ9CoK{$dmuqJOX_*1=F)%l6KR!k909T18DMwuhxc
zh!H=7kwgtmV;6h$G06033b4-8CTZU<z02HqR#bzpz2tu_;y;5K^^N?^cwTm?aW_oH
zpEAKTWc~vm3TsN~D8poGPo?J%OF|E;A)xP`Ke4es`SVb|D}IE6iS#wA-yZwr*v7G6
zVBD)l&D_4#8AB26cqc(<!!TNI?m3jOczB2YHPJgN0U_qqQtD^pH2J*0>FKzd=w=h0
zCI?R&dpKy0OR@ve#*Bw=Qr9Iz+j_qw%hQ%hz*L{m?q(dJ{RT%2XJIlBNB6396lkNf
z553N<IxB-88oKYAaxKi`bndIo3L!>O!S+aogNK2A{xCB?6YPcwC8u*pJ!n6DdQSDs
z&vfnD>+HVI$V_zgo0{ofoaV=xO${I+%47SOw3W+#BU;>Nlkjq{g}+-+hl?*|GkwkK
zn9!UE)=l9&waQVRtn&!H4v*XZ1Onl1+b6`$qWD{;DI!>Www<kmqx^JZAn!}xRmdqq
zJbO7m3itf2nOS9b>fptP4Tq++H&4-3=K2ytA+-ArW7L-h+-S%lFdpWLSaV{1wN)du
zydSfY=`(l`5}0qF3q#e_1ilm|#&VfWF&xdyzt0l(vT!_9$V5Y@nAKTE17b{afkF=Z
zLHWYpF(VZu6!S3of)Ww}ItWG5sOJmK=A5kbm}YxYi(l3XULPD`Z`!hHd|T`+*9>KJ
z!o)j5<*f#{buEA#u9||DGz>^AQ+d_r(MjBmq7qeR-J+9f#4^^!G3AYlUsicz))>Ye
zQ$br%{nW14>Ly-XpBeG^fV;o`PGE+M#lJLd<F)<$j=okgqq>Pob;Q0Zta!3+PXxOR
zP9s4rlz*R5lqbU>L2HC*q$nMzSNv-JZg*t%Hor;{boS_^=C}^Ct4vxA)^AkC;7(Wq
zn4uq_$UKr+S`UD6lX>Au7EeKANw@t5;aN9WKNnhbGHC3II*D-vfW%=yQTooqr0FnF
z-w^xpw$VU`WdTv?YyI<^(fvJ()Va^Z4S}fOVn1vY)Y#YM5L)4&H{L=j!iy}@twXe0
zJk$<N8WOXBycF!*gtfrLH-nEIjm1F)V^-Ss8IrtB(coF161^2F1nG;q$}hqmrt~aJ
z@<?%#_@3Xs?*t;g0H38Cl4gGD=&L;bYG51Pd~-=RvIoxoNs<EM!u78a-3;1D*Zvw;
zqcv<+?3=MS%lNp#HP9tFpM?IXi(US02}Z^xUI}Nk91D)|$w5R;F478WubGeG-r*{u
z?6+FNPR3o`!E1Um0|B=VguL=1&@ZB>b=?+}NQ@dr!{D;_z|=xoH8@u>N>yZmiMF!)
z;aetT=GKod!OzyPv6TvuM)F1%tM<rZgxh<ZvaF9^12Sxr{)8wV{()k+jd++V8+4+F
zDi%8ALO9`I+*JrCXs0w@-=_K9Y5-wy?REwqLd;3aJM_T`WE>eW(4><jTK_PN)49b*
zC?imN>y^Pu1~%2<d+9Dpj3_vZdoOyOD4G+lJs`LKoxqRo<n-~OF8@R&L4ao-dDg&7
zLJ_ruS9>!ytbUslz1u62JYq4%4`Gp?^a+wXXtj%JnF6~Il>OBp>Sq-%qfiYSbU!*Z
zxcHmOc<7~B?VjWUWzUHE!XKSxX%3Gf$6Y%NJ)Y>f8~6j%CZBUG=HcImqiFn52rSs6
zq7&$8*w#m-(_Gr23AET7B#mhoT11-)`k<7eal_ZyTnVzRWiu;Hh>6-t7tuCIdg-tp
zn&#vDL7pqK-a{vL&erFZv0gd-sw&u6n8HeaX~6l*?ap2WEo{X!Zc?9%q37#8TrH_t
zACbtpCh!n3BB7RL*x|Q#G=B^3Oj$9wOiv)A!Omt|a4izsP2~l9axmW7WZ)adLZ*>J
zK;nrA`A_rfYxWmDJKbOeeuhj*xa8>7w5_M~ywLc4WP!LRE1$TeSc1Yli>m7~Zc*6v
zrN4+YJZay^W)X|zuIEeqJpz*Lv;=Lv;7yl|I`Frxgfz`3cs6Bx@3t5I%<Wd)c)|BM
zY&3EjTlJ?U9YVuathrs5CQM^TzKtC+-?ZDLHBGSDh(4;B6WJnND;f7mF7?`5FF8-t
zcCT#ju$n}ZJ~`W*a_XahJ^XjlsoalhJ(m1ctX20Qt!gq0xRJ<TyJJI)-S>364ANDC
z#X$ekkAVjS51OoG>`LB?{x%_>3EMbzI9+vydhFLE-ZNY$ey>c8c)4YyI?|_4k?5Ho
zB8PxT&FJkgSddo@J-GULfDfu5bR{}VkJ!&*iS9iJd-I9C9kOs!hG(PB(G5l?L^)`Y
z4s%G~;BT`_;?B$u{mQ<vH-F-@_)1xdxd5e&ojiNPp&S;<9^Alh>#^h|y<pD5(RU=A
z$fK{9eCei)u(36eny&jkw?7pDKe31QC@?9j8~0QW;awZ0m8IZzgnX~FGITuZapGEP
z!ZL2N^>~osHlc%xqHWHzAvV(`@MzsZ8FEcZL`O?E?4t!0Sm=L#p{xs>9u*tL1Np6(
znu}7s8Dv}B5l}9!Zqu$!_+5iXMTnudZGXZU?<br%^QbON;^3$#562BQ6_QJ&DSJL0
zLt{6Q4R;YsCnVFfoKD7)d#u(n)x4r4=}s4fED#A;Yy4@CxTN6nkUbycnG`FB6pvE0
z{wPLS<V?Zn=*!^X^W)n)0kXyGfR^jf49Z+qWyuhCPtukeBMWKulbg9zjVk%P$Isn@
zmp-d-7IWbTUKe`2k>MmYd{*-jt9shp3gT|uPYq~|hVl-SkJ}K3P$ru&SA;wc36brY
zaQ)&rN0x8j6Y)YR^KZ3w7U(8hc9Unn1P7GJ2*9ZM%Zi&h|6N0Tu&UN?1zyIpwydV9
z`PsAk;ya31U{|%(rXMN&<SnZ8S-aBPh@Mx$k%yzY97WY>?QX&sYn%RJSr%<nCUIwp
z>mTJHo66?{$DWQA!so8W{mm6Ett$tX&nxG8met$0%xF*gqR8q7V8wkt0oUBtg4&wA
zA}0dUXd!u62N~#y$M3Sez->y=Jb_gm(=1MC9l6AP7_;%5!)=FJqD>u{#$Ws^!$9N?
z+0^g{a`r`MCXJn&9p>s?V=4GcKC#36M2Vhj?$`{D#cP^e{TdyU%y|o37FUP58`@TF
zcTI{-HfJask#BLyc;V(?4zmQX1$34V(JHGol92J+ejLUWf|LJ#=IOXBd91fCy9r@K
z<Yda~yzRMNKJQZ!l3)MByD2C_ceRv8$?C&cAryt6Pen0g(9>*=T_OovSR^TaY*6-m
z4oh2zs!4M=+~s}&g=Sa0xXM7J?Tz>g!2Ox1pqCdrl3n>DOLPp9EyYPTG%v+G`fhe~
zVVXU=B@WR<-aswA0jL<R9<bY}TRte86kd&#R9f3lE}bW<&uQ|=aEMf0Fo&(CWmz5L
z{N0R*ti_^KS?~A?oYeS&oHP1#dPdh&UX14BUWB4}m>hw*Z@)F=E8{f#jfiiPBoZ&o
zYFs#*(=kCUx>3--a@_wwq&FgzN7X)q`OjFLG4!=BWpE8>02!B%t?|116!{pZ?qzQ7
z+Icm!IfX4D8yNvczvbqkIbxvq{p2kJjiboSpTO7N(+*H)JPND={<ys&|1FD3S`t0G
z`WdrRXU56ff-UkKT}ssco!akOg_!BcMk-d4fqscz^iE|r-$^2_oJl6|EKZFtlpOy#
z!j7^maaBYE3P8}8))!P-KJIBeX%*`H9`Ge4n!Msnq5cRfn;LmU0hjIuk9Fi5yEqv-
zWp}rzDf(gm`R2{OT-$yg`Kc#61qkb9XAb#*X>kr=R`NDf2TeawOPJMaH`rNYgN8!r
z$H8Rod{4i%m09*F_IqA}uP#^i1MLnWP-$39mYhoY3e4QF*kQ>Kxt$<)Y3@a*(~)#m
zhi)Z87(@_Qg#`Cw1a4S%KezUAPjI}5N<T}nu?od>^79q{@saxh>Yy>!7{x4C+tB-U
zh;VFHFw`4~a}Xguc-Fo-b7${tnR12ynFgcS6B7ESCHiOi4ol3xlU5~qQDn!WazQPp
zwxg5q1X%w~;2x*#-|O8TJ_L?4=hOA~K>lPAuS#;P*@`>z@qJ-(FP~XUQaB;GLDO`n
z0srsQcz3jeQPIbInWUUg+*LC{91gzChWQjf%Zx#}N@oB`Vf3uXQr7D!w`83T`rF4Z
zyv4Jd{(h?89YL&#Q4%CZt8L26Ind1sR^#L-w?HGJ=nB4BBLmTRs>pYNQC{gft<-@G
z^yX~Tj_8AG9Y-nrD79tZ;ydnRd>l>jAO*YUPTOI`L@R9;GFc*alyscIvJoGm2BJ16
zqyEhAaG~A=Y_|3z<9Mny17iZ@Ml3G$HxR;$y7DppK#Ss%fs_L}pH3dm0d|$d4CeP&
zdf?+b-r;ysEnzc981pc6yB3^{ZdW&CQz$x~TekQ%36C_MLP^Hj=691x@r?xTR7}1<
zjJxA=PQS=OlAsP5agXr6JEn`fH-gW$cf<Db8KKdSA9rFIP-V2!mxytz7(cekeUU%d
z#)F5t;Zz7Lkj;{I@65<_cyCsn7#kPWEP>svU-v5W$Wg0z%37n9sLSEUC;Ca?WXn#l
zpWXMFyz(*{!$S4YM#8EFP6HC`EO>mPqcDg$qsYp~H6uc8v9Z;<o@vzDsQ(LRK$yRC
zhW2|AL0YpA2`kD^i9vx?H|_LR5TM^Jh*#9i@8mQG^YkshY3T6Iv9b_`nSaEM3WC>!
z{={^DXU%)gr&z!>c|?rheaJ7cGgh}{^V=Tmev_$k9ZQKK^f?dSEYS0+ZO8bo?dzyQ
zUvqyhl2>_nSz^ey>q&03X*Cg6AIoD^@k_sQi|^g=!;826OFQ7YpXAk0Tx~D8)A2WL
z(UvM-9Ggx9yA)>`jcA$DP|tXbS$}BzSTBu#kDQONMoecMjoBR3sr$|RK9&3EjWq2N
z9y#B*8@aV$gNIPEUgz(fso>)*Y5<`&V@*XLCE%^3E~l{OMQme~)1Nf-nWO<Sevp`y
zenw-;e@b2tN)+c&g$*Vy7*<XN*Pl+vpMRUCuV~%9XWQtN0zL$$lfL7l4)+1k2Wu#Q
zrI}z;CG@4*QtB9XnC%63SoT#bcj1FTE}lBxAeq|)++*_JzZ#UTUwUi`ww1X^N;<HY
zJI&T!_X=BLAYJpNuDq`H>-KIgY0iCqd8q0$>P5<ZE^ux}WNg_IK|0^DcVODEQFM^B
zlts2jDp8Xrsn&$9tk*@Y=IhP4R|>;_EBW%8Esq{4KxEioC`Mj3fTtuJD2Eeyen7h@
z%5rPl?IWl%+?y)AN5yJZutROGRv#3;<<L$J%@DG4m66Ynjm;NHwyK2YW~`BYl)>JJ
zOh$9Y00S&kGNLJVll8rM2xWX-U@L8)KoUTLjJLp3hr6gO@8zk|^te%`kX(F!3Lu%f
zxH|qI71t*?NS22-txpl=$%YMqvGanIexv8(6CBfby-vmwijRECH#$VysE1JBGj423
zZDoPt-xd&WwsR=2Jy(9LndcpT1$kQ#^<61Dyx^8e7BB@o10fu|vlD83KB(L>-}w^W
z4a3N4Czdzuj}7G=cE`M*ht#Qm1e2wWgQacW29BG;`WY617cCsntHopy2x&m|{%eIR
zv4&bVHMSyOkHkqp^OQoai>^<EL_H-J(tU`8k7=oa&HE-Qhaz-~@42+&<MNWoDYQ<B
zd&s7<q_?Za;uv_4><bpCsL$V@O(i8!SGg#<z6$Ceja2x-@CNcyFSVwB9|YR6a>zE?
zM$lFkdq9~9j)^5>-ue!`*WFG)s_L@qmhxFDW5T)3+Arcq#G+*q3b8vT{-WpXEb`3+
zHv%79JnGvS6DkkEitm*s!C|dF$55%yee>AfzR$IB9dYE_aNA|K>vz-Lq^(L;?1aT<
z(bUV6v#`1Tq^~H7N4LCxxS5~(#hVNpYd7tXq3E%vBbbHcJA%@6pWl43?t#xi+4fz)
zcXX<qXFY$BOXlHQ(VQ*#(qA?dLNd0<{(9~*!@V-1+Kj1JKf|*uIB07aT{ldmDQy!>
ztbo_lP5Vg3IVxaMB+4ru=dZ(Pyr0&oMk&23s@3mm7%8!CfznxjPmZv_7P!q2<hB9x
z!~5E77w=ne+Bc%(a<K07>DOAN$Zxrg)W4<)tl%N8h6y!wXspLS@x(7FcOLwD+?>;%
z;HWWL!M~4(MD>=gK79s&l=5aK%3of*EIW+VUn!P_o>;6*ZVAPBqz@2ZhL6RPNuP%;
zbk5=%uy0~pbR_+MAZoHs!@~A~+L&#|hq-oks-;*wFR&oTlF*>fQi65ygq(Bf&w5b5
z*S3|Yao1I0jXWms*FvKDd@^YyE29MpY(D_dB7PEGW)O>&)HKQZ79}I*`p>UqR$I!K
zf^0pD0C8vDJ@yUF0Hj&Y$K^VI`%_y)wJ*#?0ZlvLHkq1#W0#bbh?Qr(;=PJ87HGrY
zJ%)G%g5-@j*7Re5KHp4BeHolGyVY>cA3@*sH$Hj~q7JYEV2jT~bYF_wQkV`crav0|
z>f&*XNjt5cTk1Y+A(ZUpgOHxrN1wq$wX84p5((th(a%FhkAj5zX@RLt%hM(&TJj`)
zBgcA<MCC7kP7+IAzwMWYvJ(icC|`#p+N39Nn@7;ugOZTo=!ZR4C8e6bE)b<2jhon{
zVyzB`JF&mw-tv;6`2|!5$ybiQa$e74Xmpo!Av@OBUXd8$h8D(<p(fa~akbq@aW23D
zb?iTpeh*Jm`4qm~pn;GCp+Ka>UnlMVfzfoL!!)0N^>H!0jjkT?6|oEI`|K;2zs$OM
za(JI)`-?-z3^kIxzu@YqXWF)#m#GrvrK&j|-;~1xRf@jx*WljD*54lC5t{lviWUc_
z$Euy_zt=76BjBbQJOtL(C`VCg3=b7s-)Ay3@g&?lZyPE0&UigZTeRFL5Et{1*HV+p
zuRCpjCNO2}I5_p-k}CLXOECJne7De+=BcXnVuv#;$A;74f{~Xls-^5d<DEX>oM#5(
zqN68pQ8=JXh^EN>TE--TP2M8IdC%ex87Cn>4>`K(7_9eo>iriFGtXb`$G9Qn&!N5A
ztoF&h-@68hQYAOr*<H_ZvBmM+4G}q`6z4C07>#)DmL~74a|Sxe>(v8fHx)FRzv2Zy
za(D$ZTf<|)mCaSN)IonTG^=t4zwg-Mj<~MbZuO3fCu;qvyqnd~VvpWFb<COTOvk89
z!huwB9UYp!cujwtX^8z4;ewJ9#hnHXiAJwrW*3y9Xryn4(;PVdIjqlg7q=6d4E9TZ
zzaQ)V4;?(X5swGE9aajlh$=rAB)X(Vb$8eO<f{QAEm8ZjL(@I#s&m8Y7G`EcrLbY_
zh4aRE6m5Pdt3E?}g*=*<iuzNCqUpdRlP^ZOyqdJx;t@_CrGxzM9;^d6*^frIW-n;e
zd{HT&-uJxj`%aTx7Q2!4J7b5!=~YsHi7EvZ&v+AnC2-=8sjrt`^|am@u0|CF=aW(C
z<WZ+6Mp=d%ux8+Yu4JfFiwy`PcC%~^!j;9hjtmIZJw1=})5sw&WN)OGUsPd184*&%
zwm+Uu1A9WZ<6myq+&%P!`cPk-xET|KqdV2kL+g{EBQ~_-aDVYP;XGy+a@sh5H9fAh
zd9rZSm>4=rr&%)G?1GomAO8JqP5&@ZWT=aVQi>0>gJ8s;*(jJ84H@b&4F_b*XD+sD
z>JZDf$jWrbIv3g%D}{^aaM~i(r@+Jgg>SQHI#``nyD|xMu?_jn#RiL2DIAP;U1_qo
z=$P{bb2>r6XdW1mjuDQe9QuiW7cz~SB4AOmTF$Jph%splHw6$AlJ?yy-jFaSD7{e^
zF^0HbdK?hfOJA`pnh*ul*tnn+d0D{v+?k1z>QA}D_f?b1S0y7EX{N7Ya&*%9wHxj1
zM9+A5=NjQX{YXcYMesOM>9p6*CbuMB-?G7R{nvTV-rkQ^hAucaoNnoVs;;P?Suo7_
z1{aj|3A(!Ae&he{EBZ{|@3-M_@O3}7HEILaiyA2aRLX-)JwN+M!)AZ_5uFet53V9>
zd=b?AD4xvNIL!zjq^K#wKLN$xWjpXVEIeWD956<eojVz_QuJ~yNOjM#68|l^NUzJs
zTE)MFj<BWNfjMP8nJT7#1mD}Ai=)7m>f-!S9M*Bmaxtv>1|KgPD3nD}ZGA?$hYwX-
z5!FPq`*q54N_UVkl->iYT*8gmZq?HH@<URG+eb<szK{X`C(2M#cYW(LN@(m8l?><w
zQH00*%3%rX`}?KQ_x>N?AO~g5dd;BxT829D7%JP6Wf$<_-aVp!3CXbTgs~l1f4Jam
z)P{+p1q2V?KL!h7tuSMh-KR(BBEU={{vxXJN;mdk^$3?bEcqpKK_{gAE$i!TK`7_W
zBq{%qKo8lo-*msk)&>E@*MST!RtWhTuF{;wuWS*NP*1ZHF!=Xzw!Qs6@X{JHjt3?S
zhDPs8v~0S&W|iE35-qAut#_uog8FG4sYOOKNku-)c68*nI-Mc(BqA6K(!#}A+0fy9
z%E6HsT-{N4AZ+?HRxbzi3PmT;(0U$U!2#Wbf<1*<^N~`r-ovN>PkIiakveib;S>Y%
zDY7ppDM~L&iMeXa?PwR~!ywA%gkL)0quXBag_}f_pq~SOe@bdI&C<|%#%@fuU4Ac!
zRz%S~xM6!}bVlEnRs9h>epe>6DYQ@Qp~%1GuuFR7Y*I`<K@Q6NxNTkn_&#6_3SMN|
z{#+atnV|pdS9THS>nRD(V`t0qy&V7_=kYkPfjYk_(XOg38r^{FcTI6AZ(w_VXIMO(
zQIxT~H^q~Gkgz>ge0EfpWZipGM6{q;i=&slNp{|E55Q!Sqn)_>Dq~08AkRWr2|hm4
zA_;TbilFvr$|y~tui)e@Q1-pZxmbA0^2j4(sejnJiT~VvvKBc<^+iXGJ>rHGW+tdx
z?jlt9YOPO?(Pa2VC8!M3T%Ucr2*gRd1XabxSEn?8to0bJ=j2MZ<k8EcPC|6dG|-x>
zW2xKJ*%*K4vM}RSxb#$(jnqsfl^hknq#9Pnt74TkT!StK2jih08G4NKBa@m`10iZ5
z%W@G}Fxn?SBIrxGQZKos+o6}O-){fd&2Ogg>&fufUzT|OGy_>xIze(O`))c-G?VaY
zKvJ`RQ)8``Y-W>A(@8J!n_*nnVi@Qdf{O(z%n?}yBJU&EOVJx6GpzfIai>P7=$Zkv
zSQK*ACayXcD=Zm}JS5({7aeq&r!^sTi_{=XzpXn8z|#9!5gR*<3zWT+qJ9KNjWvPx
zS$3!qK?_Et0*S3!T_|wLr;)j-ax?E}HE%(Gi|Srj9*9MXS4cW&esUv${U<jp9ohx1
z<+clqTKqMxo-;+*NozCil|@9jgzk49q;&e{jqRITX$axmq37<ziWO?FDuAgkqWeYI
zH&I_?!ec?bKPX9&>CFiIG@~0-Ipx^{i9<R7a>R=`7;NtfjRHc08#LD6-w+@x;3RW@
z9to0DXxQM@(l0;{GZY6@P*v^ru+<$vusoW3RP}P8S6l~OE~H%!=YH;i7|?|#T{kNf
z2yXUV1vj0$j?{0B<K_dSP=CbjAQuMsmByd&b&*20k%Lgze<l{NPVz)v*oy_7^fN@S
z>N{~%6EcaW|3DbZrZYK1XWv*7<_}wc_X2m~k!DyqKE=nByyl6)($0YJ!b}e3UWA^S
z5uwvL?uqOn{K{ZR9prnPW`^f_lmx9?FPDbmC>qJSIK>Z9iESYOa;?bsh^SyCHW^o2
zsBkfuGU$hz^@}N)2uX9#@~5#px%`cOu?s*nXj=zr$*uO{mo8Hr_Zq!5ikRwuF4>Ty
zc2CL=?5$1?gA)FGS6fr_Ltb|{;$aHTWyv;Dc(Zu%z5xllZP%X!PGs)-r~yOp_CIzz
zVhF#tA%2`47*#KOH%z9fvOFMpX3Lz7G4l9%yMdhBX%UVHQz*alwKZ!)4v0i2R=>l-
zTL`imB5tyTg4~q;ysM5fW0^gF-2>Ug*>+2)fp5#{6_#J3wJ8+7<0k5REhMLbzELqS
z0jj=>jpPiaS<IHg+#ylq(q(sj98eTw3iX3SeysRVuwH&WK~(ZMl&}QFi_4M<-)#Fc
zRr$+vlprj9vQp^W7IzCr2(Ox8w`UtT*_ls<N~=rxB>Rx6BCcs6g4pbTbJimFsvx&F
zuUKJ?z^85N9$^f`Bhvupnz`5=O=tibQT5}(J$B0mu78)Tt9;HUp-tpm&dRL<S7$`}
zP3CPM<<5@w1;LbR8jq!3<HvZd^b!x}(gX+en@>cY=15{$0P5AXcJ;;0>R-^o^cd^|
zuK~)dT2l<F)%!a&Olh5ecJ47m@KggcQ3zwFcIVJv6=0j*g&vL9#VBpS(M_h8H62sI
zR)<@|8Qydhi-$~wwMo#N?iPc9H@X`&gDi?L=)D!B%E*M@V6v;Os{JXt-)FW21v-2w
z|CD;g+3{73(h?hS74f0;HK;6rf`7&1nszEjksbRx^a(*Lmje%fw`W_a_4!>>7CCeI
zTJ_q<z3QX@$abEUi1n(*=Vp5^0bK~VFT_i$n0eg%4Lnk`4^=SByA=#Jp@C1VT}-e-
zcLh27%Sq7@Yu2)1P7(C-r)I?qz1teH#}xPM3n7q5@mbpsGQod2#Fh^H6vYT>=8>Lq
zz?d?fk3~>ufC4gqt7p)L1Nm-QBRs8|t`;mJesiMDC`g%p8DG5Bg6cqL93t>jAdznL
z69|Cg;6~)0v}_N(XL}Vhx1BhyXv%=9^+HdMnk#I6P)g(o=^BtIzjA$G(b2YB9IHDK
z?+dB?7^(t?C}UIEDnZpwsVel2a7VZR9p!#zJdz)yr<_NBNd<*!5lK+GY5TbQytSYT
zn)RAM>xiY88y287gI?VL9hlZ!wb)Vln4pbqRgeyw#9d{?ya7fChOiFt3H;#;_<)0g
z!kH+ZY;f{}fFp7jQtPur+C>SX?oCwqHVXb{$>V(<Jbt6;9So`!c~_CeotAvf5H~Zj
zHHF9p+3U!EA9Bd6vte1F{;t-MDwq~xfaJp^kQen>lP3e~=DY*SD`{INnT231LmSN=
zdG0A6O2&0*JF#ciw@cTiQprVN{m{>J1>bM4@>L|pu&xTHYesB?q8y2I*Sj?78gp@r
zYo`d6g%_eI+s`j*_jx&d+)=K5EG_rBF@j1FkMcu*-kE0brhQcLOtXZujOuX9CfP06
zKIT!7QhCexm(c6Tlmc!a*P>V}#l5Dww%;POWe;Ueyq(^6ONl~N7<vqtOL1<$;}4!m
z!}N@IpDp_lSf)hhal*LHsEYaUEoB>ilOtZ$t5YbOn#?eLdDubfUWbx5&ClO>w{0x@
ziD$uo;&GFW1v@unWTHz7G-``^%hDe!*70Jc?Lf+O*@6L^g?c5`(O2k6j3b<K16Bf2
z5G|QWJSqn!J!#oICfQ=;lvO<?wUp?S&3La1TsFu15N>-^ESie)fpS!$vRb^OYm5;h
zlU_Ww*~B70XomzQwTQZTXO}I#YYNf#Xt2<K0l_!|ZJYV!q3B0X%`=F7r1)W20E8sW
z%VQG*AY3Qx(Mdcmx@hKw`l?gY__q60+oDOAG^{7x7jwegc3Gb;++6TZt^K<h{>Nyz
zTU8z^iteOu3_4k(i}UBc^@I5duRoPI(viSQNNT7bF>1I|8Z_GiUowk!7KJ^3R-7__
z_2Todl~yxH0r1$PGo7A=gQz*>buh3G2|YR@lArZeNXee%>c{vf`n_>0SZt;>u`(tj
zTm{{rrSv3sp3=YUx;~ZR_Em_;Jer)Z&4GnzbU*UHtHqm)|A45qOz0<4!$B48t$~Hl
zrjKlThI?EL>5bCldLbyqPju*-5q~OwI?PY=wTCBs)52*jOA;l%N~KA5wZ6NFY<V*7
z-4Bpz*Wi!CWR`jCl5!tA|8l_}cC9T$dZ#Fk7f~TQOfJ5`Fd5NIhNyTa0)1wDDW9!z
zWR6SHo9xqz7RO~0$NDeeP~mg&aBHQQ;yoeWUx`V5WP)SI;~2E5@f6q!lKBCDAW&Ib
z-{nYj5`jM$9ca>2p(?!!&2M@=^2}~x;v-PO<SFlggq57T{7q!CgU1>Peb>Hjp8cu3
zA+ST%$EBW)Hqzw|4)bGAU+V7NPY7noA?176LG<2TG{HmT0b0u>*06@$@iH>suZBEf
zVbOv-mWB<Y1WL;&O2a%PA8sCh*JhyZOe9fiuqAuKT0fPqm7k5tK(CAotnutUR@Kay
zUq*y5qlFDCp+^Yu9f7mcKM;Z+9E>{=4h|niws%nrk25IG-AE-^H4qE^Op_{{Yf$jH
zNN|M6cxtozI*7l&<J-TRh|lqdBR(xlR+78^{g|^FgGaqb5|ht8(fW0NM_m7QpRDi3
z!;g-ngjBOlZO=yjr9ueui(fv??NzlN*50UXjV_!PqQ8a?eDewW3=T5_<JOtw6WX}K
z0Wr<Cj`;hIjuICZaL)xZ(;WsDTDfM;R~CJz-xi&~6Pa$JnGpMYNB(ktg_w3%TqrkG
z#!LdEvYq?g^N~8<M5#`Hos2&0f_0%vjOx1E?|Hw&{2V`YL?_ORf8q7-2r%#9os6y{
zC0+Uq!rjsR*>dOi%WX^7$p3;_<;6&4s6F-5jbM}trb`zSo5SeQ_|g5Ic^FRKS0aiU
z4atFA07bgmr$AkvN6J+?VXRt5294FZ<{YxHFYS(S<HSBqW(AyobVB#a&@>Ai4*&*r
zPBvcziM)0swxY~9Frm7Gv{XfVWQrM|p?%9|+W5gb^-NBgd|}$1AK_{H6Y7YI_pRfg
zalfQQrnvVwFsLIQUJR4Tp_1~&h*V^~z4#9D<bv9tHaaOTup+b&-pi*C%`?Q5nRf9m
zBlL4K_?K&!KDPgV@=&%9>cJ^l(`0RZxa)MLb<|CZGzxbSFsVi`A4zao8%8TDa#Gjl
zt|%2xC>Lj|^ScI$v(w~46JE$!>)E3ZJK@QHWpfBC+~36qu5g!LrcP*@q&rZ^iFzyP
zk}V2wuH&qNJ&dZz=g}eYqSm7Vbusdy^Oi=83Vdny5uS{HY~rtBl^<aseAO@_2#dmx
z6yX84x~Y!+KfEC?q$acTn6RZQ^Wbdn;;|Au4qkWeEcZ2EZ>~e_TL-v0t7%u7`Umno
zL{Qzwo%l%%@r!G^lPPy*Tc*lkh2`j?e~3}B;d8F0p2T{ZtbOJ*I~)#l^m8zcod?_s
za5&39E985B=htF)GibM^L(mA^FW=@d7>`=0*ztx(PJ~k)r;lteWLsK(7R`IVphV8A
zA<9LnyN9*v<>)QAOj8#@*E&IFOtg~EoG2E<EW2AkieFcaXNhUMP(w+uA0iGn#pf&8
zqDq%+MwdD9>d!<}cUan7aQ;%l#Y@Wc5~7YL`Xd#8^AgT;{2A@T5hL`a!vN(yEQaH*
z-e6JS&_rQCh@NO~48QM=cz}R5D0{=!cs0#FmkzPSRC}h`d`_+Z>-a7;G7qh;=c+~s
z;Tm2S^4aX#V6!Q}0zPi+y6bTsq|=&@+qm+wjTq1ejLW@$ckl90d6*T%l@3E(p48+$
z7UA@NuqDN>DYMvZ{d1jTvvd}WdNc*EEBnPPP6BgP1d>w;ei8qyONOcFon^@diJ59_
z(bEapD_qfX_^g1Nd>>EW-f4mOvJL<D0(MT%_f4}=JJyAkX>sUvA2U1pcG<rePl}W+
zf9CDe*Hj?X+#ut(<$KL>B60vHAQhKtpj*g)B_7Q!G!;V#S<u~LH4u*^;6)#Don|bi
zt>i>t$xFf_YCIPmlL^evFR7%igNhczgyYUF`=FAG`Wvn!i2Qmd=%7W06bE{JFC-o=
z#q*5c7Y6j$<Ft2q0#aGHmt69)zVZpLhICaYX7|hNCr&0&trO3MaYnKyAb*D$U`;%K
z!NU5uU>7UN4!fD)G*{Od<h*%B0L~fHGG9RA!aG)od(c?U6+n+%vfI`EMcnbkbBb#X
zu&QLuG}}A%e@6YaLmGIA<HAV_NZK^)o{;yU4Z9<5DggWT-M+^`4xb^o=E(M>>ZO{v
zBvU??HcWM)0Woz+%@(@t>0jWZv8gbBz$vPv-yy_fc5n|28yvBvOWT_IU!|XqmD<ct
zvU!JHr0$l-bh)H{Mq`}n0g19gp&o=lngDT+!*Mp9)rZJ%!bZqEdD)&q1@}HN4>iWt
z&H7v(lgGr*-Gv_;K7ffbFM>vJ*QHYjv5n4fp}%;b@JSHL*!kqRC6UEQPNJrN4U1a<
z8v7b(jOOH5J6@9z1;7|mH3Fe1sWk%-QvPP!{@>rhqR2A~$G_b5A|XH-jKEZgFd=*-
z4@WIg&{@azglp}pf0aYEwh4KEScp0^xA{^3_j~j~^x^iB7Bka6DQ7=mil}9*JNI|0
ziz*tH8=;mwXgcC06X#wk%Eq66_QKyG%K;^Zi$e9Gs;=RqUcL4XlG~~;PpJ}CMW{#l
zlg(J-=gunE3r<vP+mrcLmYSHk>_v`}khg-*#@P5Rt_QDonMj=aK#wEd!+OO-<7P|y
ztFUI!K@LV&y6=g3FZN*-s{#4~`qhFUbEjO!(9i2aCgrrDP`iM*a-PM1!rXg#m=CBU
z)cy|OoOqgVGF_$yE(Rr{7RI%db%K2L{T#i^_>TBMlsh3Ffl!HxJ2>cb7O&@fEaS#V
zQsO~<W*sVeg^RXzl%8J>l^I<)&M{RfK4nj&A?68@tx2UtvH9*h)pHpHBm>pER5FI`
z-pjUlx_v>KD7ZfAXC`ugtIcDg1?XWt<E037{Tg8xnGFDhE8c9KEOnXh0KCKe4(-^_
z`zV<gQRi)=h+BG1HB3_k7<gt=oi~}h)%{aJ(|~UzmONd}1t%Hq6Hbg%@Wf?Miy|6l
zk`Q^}f+Fa{f#q_5-q#&=Tu&n0USW}t?^%oOzw-$R@I9<n7qE(dH(|BZX2GPFYVh>;
z{duBbVJPyob${rzdamjh6Te-m^+m_yvT#v{qSArj{aWEnZ9%K&GX~szg$Xa(?P~J*
zw=aaB->qS_>_PE!AvKXc;oq}`D;zd11o3~H1e2PsMmF|)AoAkvZzJFsGZViXj%Q^6
zJd;Tf8L8oneA6g@(0*x@If_<_9tFF6hTAC^&Z!{8SV|HaH9R8J%(k<SH}d&O%e+%|
zH4HgFkO7A=qeDzIS8x+mPL%Z{5cmCtT++34sk7S_|8-*=z0A-%ev~^DpGW0R@G%WY
zrUnNw_`*!WNVz(KOW{MZEw%a&XD$la1NGVvFGaL&`=l~|)m_i#ZcQT`E+2qr9j>jT
z=ezJe@rQAEN9+*_YZFHpXW{8e2-=h87QeFDwv?n3?N>P(vywtOhcbzmXomIK;ysgP
zip3|yg5SM5+ABd3+&#*1G3+(9eYd_`E|jqDB+wHLJ}WSI<&T?UGdsr$q`nofm-jf&
zl!G4Or)6+|M?zu|@#t6RrbJ;~XXYHy6$5DKXPg7Vd2DJ6$}qVpv~BSoKxA8a+SQQ@
zFRigO%+#P3StVPTcF&0y+7s6z<a-@45s8yx-p|SOP~H_XkdnCm6u?J8#pRJp?qqab
zUxD#GeWdU6!TbW7YV2~1uDAhA6Lu%FTmu0KA0dB#@hM^O!TXe5y3l?Lp#5cqt6Iw@
z6(XFzc#?qP3;P5nT`F%e_OF~OKqbl%_yqTeI4<)E<0->CbOB`I_-H_w>($Yz$P)f-
z#l?5?ViuIQCK1U|Tum71nxL?HMmaF6KKYzNB9P6UtTZg~2}Uht&g1umE*EjoGX7?*
zk}NiVXMNd_4Hgr}D%p=T>N4-(ZXwLItQ`N3=6E2rW^V4BmxFj$%cR)z-scvJdjA2i
z)PBX%t$mJ-(5)FC;l}S+Mrz$w=raFeDFhO)PqF6*lg<q}l4U5UXcoT_@@QS&CvxNU
zw&fbw!(_3rD<#g+O&j}r-^r>o>IC{%Lh$f^U*DyN(@mL>I=pB@#RFlD!{OToK4m>1
zY!iNXluLISlNUdyvi8X*(i8+r(uZ0c9d3_}{oYF##;;_JzGQ*yfYDjZ?diDb0_rFl
zQPlg+tZ7p#si3kTs16#S*~eiP#IV2EM2#v;Ney@D^^qM!3~}J5x50^*p8p&`CQ)^N
zjuiDPOC8s__0BTCiy6t7dTn+tfBTPpJV&5`7->iI8+zZ-x@36UTIFqtx@!z<hveA}
zFx>G*3X^_q;A!1$HWpeCe5LJ}qK{~O2RanI|1BPF?NdS{8AJi?$>AHWphI1hM_bNN
zbZsU~dV*FVGRhe-SvyumF*(M`gv5=14PezpK5FMB7f4-xy>dPjiJ6@+9ee~XMN^}_
zb5%COQ1Em%;A;<eUQL;@0k%v^pUwU<#CcG)$wNP5rk4_af8K{*zLXV!a+ka&I1gVB
z<Gq;+hZn5vYQ&aE)}5g9JFsHJClF|Z#4ekFzjn+`s;>IN^|Jo$fxL+{l4Kcwuv*)K
z%U;>7LLr52iXCUXyfPSUJi3#W+$KsmITatw|0(tnj$o-;<k~#uMdxrB46*b`DDG?m
zRh%x+z^WIra@>*7x6?JA76Y9h9#CK|uZoON&?cRAEJ-e-gABPYLvVhF*uoFdIz>FW
zRKwP72+v&@`ORtLFezw#di1w{uHSJ*;90nJrhXdw)M(wMEd9i;cZ?){%t!@U=52{n
zD&`iC9_TCGJ@pWhO?-8)Ykk<A+OeNA!l89>90+5_0n>;S$|VPx#%plZ8+A<joCq<J
zkuv#i=PPpX9CBQgp_W;(CDu=I0i+-|Re!`yG5Ni*X^8KV6Dbcv8R(0D`OiTtOxSd2
z72k+jP=mVF@$nADyADd>_eS2Gph$R1>lLR-*KwxQ?-{-@38XG?%cKnM+Z0xFdoeZI
zUvxSVWxWJy`$X3$aW{CNqcLti1FmaZuyeTG$+lVYj$H!19o9qyDlvy?73rC;W4IDL
zwp))h^O;VZXHjvL1%eZQ_~x+?G*#gQoQI_qmhJP>(tCgd6j~vIT`aI|f)pRao}vi+
zo~@R0{U7T(XchQg1f30!@6__F*W^NetL+Dx^e>F4py^>8P3W!$sbL&U`5dulDV%$`
zY#Awy<^=o>`ijnkl>8`T&i{cl4ne7$5iY8b?AP{~BA?B5wxeZ#Vtw8UF|?5P2>9BF
z7oPpXt%yd=qlYE8M(b!dMsamBZ7X+OL5x5uBXBTjO1OtAr_qtIdnug%V=BqnM7~7|
zaaQNyc0~kYZZ))5UFyIuo@$@EU)&<rhHM;Jh8?0w4?DLqNi`I|Tpb}Yha8qMJXCPF
zE6r^r=_R)>kDGOW=ui(omG4P>Gh$WUWDpeCDP-{rz1aSplH9sHF%Uw&^D_T)IG7~K
zuxe3nNYARlGZuJDNJ2|vj2gujra^R?ib|OF#X&`4fB1V2RhGi4HI9IZ^bQ41cRR66
z!5YiP0>!Itwc&YJM3~mOMbj#Uhi)HdT`<Mds~bmA81DOjYWpO>WI@xN5OPO20`&|L
z0o`2_Don_{14Lw5tx&<d8-KN2{?0Rg1C?+2eyF2do0To8`VgaSx>*`atK0isz6<NY
za*@6ZD3~z1@Xp<}d{fjF_QWt%Dgo6*$@BovmP_3cy6%MVYxJ4nk_xGk0$APqvBq8?
zT+<lFd4vXk`gc^HmJ^|^zMxlBFU985jv%~bToVE-;7z{)waQIC{TH9Kc(8A5vD*H)
z6~8}f=;-0AYNM}aj+YF5@{jHn8zVH{PjPxbJg|bw^c?7!<RVVRjg><Ml)kK+9@8|g
zOsq6N<9Xf>lV_5-1n-e+UgEO}tsZC#GpJ1BMoO=LfPUOb;_5S!QLk8Q=u}|ID358L
z?n-Tm!X)fqSHP(MmKwn8{_b}yY|hD4zLmeD!h2e+3v@RUM*XdcOC8-ODoBgAzF}tW
z&;r3fu1a7|HVEe@l6XBTF=p^tdQPYUe5oL~#z-lC_-hodKs9*hVaHP9o27yhH(z^z
z-t5bNQFX?iynbr4c|=*pXENL-PMtf>CsBMYlpvtq=Phpq?9%TMCD`+HrOJCfST5w~
zTMF*jmHEfNO&^{bYN8|aQf=4V@*K5=k{jAzgc}rZCg7=`Un0B!bI8nO+vPkiOyc`Z
zFUAtaub&Jk(s&m1N<ZH{>%8*IW^0?~VR&$VGtuLU?UBSkNw~n8r36*RZBj=lkw)y^
z-kz1)bc3z*ZNBaazD!iEGHd<-E8vO=`+jGP@b%8xRDHk8gEmkpk0Z3{9{Y<moKZq)
zr&Zg+t`(~F8E+)Jh}~*90}=OCPa!6qfbo!=9Bo`sqy2Fja*NR-P^}PIS;Jk(oFZ|5
zEJ^YtvY@_Q)=y--j@NPB3cyQA*cxoJpJYX3rn2%F!WNzjO}}XW_+c@M?%CN>-3m3Q
zIspccr^fW#R4e^qbj;Ql0?sdEbJ@=bnbDc&#RM6S39mGFhrtS4h={v)LB`@<TRl4(
z)GIjem?oM#a4#=@Vf0JdkEygg0Br7m5agALmYaK`f089FfogTv68lX?ts`eYCDOgJ
zl#6P39?PJ){veNxm<f{w;4fKt0XXb89JWkiSdF|z`W6d!@>z1ly!)2bA!VQD1E_wu
ze3-6YdS^R5mfi8dr3Np;!e9$a{&D{+4m+{=m^hLmv&vLY-XmHrNEE&DQ^)atIc*Xy
zD})CWbuzeTOmlQT4IQCrf@mO>PrN|IR8yO2aK>QB<{_?pqECyAF_6c-`zO*N(Nbjo
zHw-dsDo4s#5k4sY(P&&A*uJo^R=4$w6gO!jpip)D_&WZ*xXcB)u?5-u1g?rY4aw<V
zK8^QaT9<we>ywalxDj`~;uYL~OL~P74Oj>{YYg||PI~x$B)}@;^r?RIh`~ngM!xpl
zC+i@xpA+t=N?zod7{x`nRH!GWp9=R4gWpSFB)<$Ae$0ea!X#ATOR1pdF=#+f9b#%0
zP19~=_OBPqy<W`^P+eu{9Nb!qbRJQ$7z^QFZ9;}>5Y#hA*5BkNq*|+gE7Te~M{+mB
zn`adN0s3?j`vj4HC~uUdZOF~x)If;(+c|L+D+EQsw1o3WQCV*zv1^r_{iXXkYz~W?
zby0`c;8<M4GIc9yji+u%3!?ujbVz1n<bvIGn$!#YWTGYo!W@1HP_6BDo{*Z?k!*H%
zi1?7wYOi_;NK&@SV7(uIDg`M7Z}?mS{X|MvarB8+Y=G2oH4Nl~iw!|>LlaC!dlY_h
z23I1OR0r7``mNDt!M$c)y;r8@+-xVWlL(ZIa!Pz$wE^MJ^Izrna?yg7>%}$Rt27}e
zTpwN4d+|{dA7znV7JpN)O2gUyi3uwqi4+24#f?}R)NNL`wE--DT{hTlNMV{?P^-ol
z%6CWW!!j#v-Ia0CH6y-a7v2Z7vh-Obr)ovaMD@JSq5Fx2O}fQkAF=rq`{jl&M9Qv;
z;5cQFB$|f4!#uM319W|$hR0)Po%K5Jel<(=t~(O)k7wysivX!y31UGj4qm|ATJQ51
z$twpb0c?*qT8gfJyVsBRGu^`^(jP?t3^F_<bRoOUMqz+21~v8C0<3HU0IDw=wpDtt
zP3`WAma|Sqg>a|aN}e>`v>!DnwHnRnn&_#%t`a_s<@`#Jy~$13Cm?}Ub#ps;E<O&S
zbn`v?-bJEU=9uXr<m)AGa805?gF~ot^qYZYQXns)3R8F=*K}D8fxv2f@mPHQ&}rH=
z8tfhg13jm_`~Lu{0w89W!2$vl0XCPRhXE8RH8D2|FHB`_XLM*XAU8EQHVQ9HWo~D5
zXfq%%3NK7$ZfA68AUHNKIg`N$DSx*IRFm5hHjIEs5dlF2X#oK#LK1rKy-EkE2?Piw
z2_*C)NN-B-O}c_qsnVni2-2m46e$8qlg<}C=iYPg{r|PTZ)L6IeP*7SJ+t>SI|&=}
z6FnYT8zdB_ghXI?z`P(afV`%rDi{O+f%thrAU<L?Hhnn83HC2LF`FUG6@Lv!BE<fK
zA@2%<V6Zj?2nI{kL?QrcZcYF&KL9Kw1{M|rfdG6Ukm$dNNLMj{0>m9|1JL9Js38$B
zG%=ez66NIzx3kA!*ZJ2YfWw*-02UP$e*7mKAnOcsg<C@q08I$S9_EZ)(Hi0e&_i0o
zVHmIfO2HvvkHMhCfItrq4}V^WGnyCaYA40{7~lcN*aLK7Xqc-z%m(ngWq=mM8TNN;
zyu@q(eS0|iFNYq|7UKbNg#oYzC%82XfyRcoA#7l-0PN}jJyi{WHVTILi>&b%;W6Ov
z%>jUU!T(P8cl7T>aKxWrh_yA+83jRj!4Y-<TeuSppsl3Ai}A!f27f>hHou7wCo~cp
z4{?XUogh#w;ZNxhfRd~Z0D|rC@BYx%u5c6v&5MRR{q7O?I}LW56%jV_NM~ml0)r<0
zU7rHn6=sdycQ4@IhwF$ydLVrMg>2yn8{6M)*tns91_-!|8%$N<Zw}T({Ey8Jh5-nI
zM1=W81OYG?0L;_c9)I|I0evqN?2i-t+l=kO&j*D>0c^2t!2IC0Fzg4h4;tbQ17KX;
zV17RT>G*F%3<d*i;MN!b6lMoU5dV`MYlhkWg|X-F3ikw<g0S)f13<rD|9&#ZD$E9n
zaPs<x{^y8+3UWqIbk(^3Zu#F%IXR>!z=wyQ55U7G2m*jX0)HX^VeEt7f9H7uf&X2{
zf5fUHY>|N9$$r<1-Kc-n?Ebe1IR2gxPQZUB(?VjU3j=WcqjWQnAjlf~2L6B6`=5~i
zKbil|@_$wO|5l{r=H&Fp&+!-G|Ko=^!=1eTW?-f3hQW@3CK5Xgi2tP;!Ty?EO_&Yb
z&G~=5su&1%9DigHc34UCfCYF#0)N@zXeGEO%;pIkV{QMJZ2qzv{2n+bI0E(riH85a
zVz5yl(Es?bQ)camy++VjZT{tgps^!|`E!uJF$_CY|6PY7!WwDwd;0hUg#Zv&SBMue
z_VBSt5a0vGj;RgI^N+d#KwbnAgAD;-d-em^B3+4pAAhv42mq+{+w=#C3Il+Ue<Ltf
zi9p!Dp%5PcX!rZt!|vEW6hQzG{vQyV&gmbBl@t*19}r7M{{#833BCWo|7ywF&D9m#
z^B*l@`~4UGbGyJ`o-k|T=}Dxuc(6ltaPvu}ES(3>+K|M}z0?z9KAxch3qnk{;;7|v
zyk1u3jDPwYrRgrPl7&N?mYmB;_QKSG&uR_RJ1>D_9wwy?J0@uC<n{55@dTe=^emHP
z4LGlilI0l1ie0;Lo-jm_w-ZU**mdi%k@-HV?);MA!A@18B&-(Ftkv3HS(2$iO)qNr
z{i`mf5!$D}CU{8mDCev5%b=BLvxpR}bQX1q)_+stc#jJ5rQZI&If^cZ4^e???$6hL
zu!dqN6vg}K6$EZo7|!M0xyUJY-%h{l168J!*|zB}UF1wYsn*)JU)|p}XXZ$37q+)b
zw2cOT_daEyK+RFfrMl+kuSeR<W`{B1)%Qvz{6ZUcromM@7T$hka8wHmQTLh|?;KgW
zaDP)zQ8gXz3FdgL883NNw))+#maQem-8K}r=}~1e#i}AVbtdPQpKVZH535tw+%ZSU
zxDlVJNUD9azEshiXmC@2F$F(AsXIKi+~5wd_FM0*LX%@3Z-J}4gVt6#_8FIoC`8QN
zXz!((Ip6exS7&=*;Kz5?X;snk-X6}&$A7*Rp3CMMz0Sx&zqj7a&VoBjQxq?vkzxR*
z?AKduk-;%EyiE}-Z)aD!!jBlsaAR$7O0;rI&kh5rKlLD+arlYdO9G?Mw!JU6ank`>
z#He@PH{U$DCvG^}W+&8}*G+;eHU0Sdr&Lplc7U3Ivn*)vQkTDOvXP6b&!?3;kAJ#p
z^{yzzatPdQZCEpLRa=J4-j9cJmg5EKb1I#_pw0M~(ao|;hmAQ=oMTmV<2$#TOC$pc
zc|~7;%iKQXx1)P-kSTeG$+Xpy=^A>Cw7mC2j^40f@vP_hz^%G{BNnC|THMvTtc;E&
z$o?kssS;W{jx#v1fNjr)Z@<waT7T>P+c6cXBL%;sAB3}6aor|Kcba$JRe>FzmIv9D
z+#zTKLt7g&)!smSty=A4ilNUqKX{k~?OB_$gB%inR2$<6d!5)3Q>NO}>eYwjvEO{=
zcNcZVGrDCvX#s$oPg)Xp(>V!v8*UzKAaoCw+88WjU@{doT)5u8$#F?WaDU!<(Lv4^
zy=fV8p?WVC(fq?NUpnSKwupwtr~mLCXe5M?41@?+$`Pz=QQo{eciuB}2HxWynV}fF
zLH6CKwwkXWh0Ihq&n%6=YxR`sx1Ca{IWuK4*H=9L;E=A{7wHe=J||gSrQQOhr;^V*
ziL81X&&8vv4|6iIRG1Ba&3^^j)G^luh}#I{<?9!cO$&-WUO988dT6cwl51{KoZEZ&
z-Yw(kio4#Vj)40GI%A6--BJ*j9;nb7I7aoXaY&t<JwzJzdE!@`WcZeCW1Ykg2la~=
zW2}x1PR9#umWR%)=HzLjD?D96xoh_wAsPeE9?YGl>JL8w`+N?he1AZN$c=b0k*zf2
z1J!RCY_=r`{koI;)+a(^belcAy`8w<I7@V;zi8>~*KX~ilyo5F%<4P++%J8|U0sj#
zv1KvhFvbj6;~p_^pD3bfgMt174Yk+#PQx9);M_3G`iya2P!o%Az`hG6c**w6ul?@&
zNFrxts0hBE?wE0s*MI%H5}D|Cd=5$47R}2+P2_Ctw_h4$HH9qsNR7t;bIU4T%R3_%
z*FZyTWqz+vv-fSj`PfqnNJZX_yk+5`Q1n9vrgLa>rweZj0=F?4u~?F6tCc21-G=jv
z(^m(|bvMc~z|PMZdk>Fp<BhPqRkz+;w<IP$l)CtMp^qGqEPvplr)>B*aOPDIF#Qlk
zNx+(BFhmb23aAdq64c>)$}dKfRZrI^VWK?Z13tO7HdLjp#1rDMbk$@ziNJ)|1Ox=l
zztP$b<ukX2Lza&P4z4Bl7(ThCy?6JTt+2P?`k<mdUFB<b_{Ai`gR=I4=5{{+W3Jk+
zNOwU$-ZzD!MSu4zb6A8R&F?7gz)UvN{bKQiUi0~>2Z44i4J)aK-bde>9RwB&wfhf5
zfc72b;=_BcoOY!=;unm!B)+Pc#8md+d%E9kq4Wz_RpMdIV99_|F>};<J1XetLNVes
zy>~Vp3L3hy97$HSXpaTnju8l)rX4QU%w0Rka%EWAjemyeys4@t;wbtiJ`h-`Lu$Yj
zERTY2e3B7A>6FJ2g>AAcnQ}xC=Us%H#-0{Q57ET9;zaJGHaA%wmWSM;7`4?VG+OwK
zyHb)<;&uv}{}mVG2#hahuMj-C{c*J9w07bPQD7C%qK1j#(>KuX0>;^<gCMs-2WlzB
zamVU_YJX<q?skpX*1D5dy>SL9mB$$?0L?I`Gkq2MKE&viS4J1ipr_~h0v#fYKbIMa
z4B=-Q@-=4yRG6o&uG4up2F`1hvnM@BRGu&Z%hZPQ0!4Afdq-4nYz-@UC$bi`1{iz+
zs^j80P1y>0x-8`~5P1<-d-zp7S5X1haIu}uLVuGS6DlrDs=Sb%pX(gTcT+s`tMyt^
z@yxtxIT81zo3afzo~zZ-GM*A}GxgCqLPBy)slDe0ZBwfP?xsxHs&dVn+R{qmYTl*h
zALC?e{`tC`Ji+Bnd7U=L%{DWhr_9l`jM>|2oy01f^sYL`v9%03g2(yK^l6|Pen6=q
zL4U`)-)VkH>UiX7UkOtSUW7lS6HA(UoM&K3t?@)UuC}-TzLtFXx}N6o1blCTbVe%a
z4n@!Kukf|oYd`t9rW_s`b!I7SiEKo%?vMHIXEWC;MK1OaMmAhM*qqTw5Vw3rY@?H`
zrpj8^l-z03$MJ=R+F93SgYs9tnkh}Zzklr{IiBd_<WixUulFs%XZd6P9srW}+pp>M
z9^aG(zmyIlBsrLr9q(TBa^iTtqH&{f81p`t32)CJ_U`WY4Wf41QfHY_F6#4GeJat|
zS;a=&LL+TEo|)vy57A_mDx0WvnmZ5`0!9`>Gw*`S4szh=7-O)agW*k|EO5jDcz-ZR
zzbeU4<8oBc%SheVJ7Dx+CFO_jOdaM{frFgQW{9C=x%V{xOuPQ1nt$`UX?1Ju)dauQ
zrF-rb3gH@La9h*R=uO5k?>9;l9?V8s>SpEJYCi9*iJx)7g*aiv5_&=yaII6<yw!VX
z`g$ZzP7{vmHuVUDC1=*tw1aU=7=O9q9X$+bp@FsF_fPW6GEvWw-Gb!3o*D|D+GJBB
z>z-Y9YZWnk)+GdJMD1kS_IR%IDR3k|A4KF<&rD{{!slY%43E5yMw50<H^&5hJ>zv<
zAgsh=JWw=!&4X8VS^xd$&PGs4pm$61+Dq5+n`B!{qpXE;Z%8z7fswJ_#D5y(sE+`X
z3sdX?%5>SILtr-{kU82akU0J@$v3?zfuo9AAZM|dWAlex^(7C5WAppQ?4D%D!sWyB
z_v(!0&QbF+3zh}4kJhK!pEixP-z9v^stY4>9#=5MdmGapgYqBvQT`)>gur+%LH1I_
zS=M{{=vyYfO{<nT%W9fG4S&H%d`T;6vH3XVUIVSXa?zcD1g+0Gl`py$eZ>Llw|0fd
z+hrGjjrUqvt+qOd0ZDN0<2<c-8E}1NP{hV{CPZiU<)BV(eK}z!PNIKn?MXB%3eVwf
zKzq-oM<*tP8(y*iFE3DgGoD?4F%D=kDC{2if!;7_%5n(t%Of`Hz<;R7Z{6DKKV?h<
z5-TjP0p9l$`M_aaE4S0|$|PP@(6w$2U;1|N`lMJ_hB=*pUgU>!6jRSUlP65&-u*=1
zKtKJo;R?kHVE;)DDJFZzs`w^eNhQV^hja1%LIMBHGR&gx8a%^^6~yN0$b2cECKe#N
z`OR{O=e?h!zs88nw|||o4$=W-$u5gh`!8FZjujb=a3T@tSlo#W+T#9+r}8y#Tqq&g
zHjVbL(DbKKyABmAN>uuD&7VmhvqJWQ9_Y?io}q0M-{lv4F>?;Eb_64<xYwT%h7GPS
z;s<<C+zNy4MLm`;cRA=}54|*|+*Zxc=owGNcWp77t?PLH@qha3xh@Q8<sQG><Z5#t
zCH;MPyu2dQc0zvW9zoUX$ws4_$EeWp14n|qprJn5TqbgkX>-k0+9?V$B66zZxmb(9
zw<8nUNmWks!=Jq*=?_aRyag4b18KckubvNB?<{}@9Q7hmFI!}P;My0vqDewp!mVzq
zeM-1;jB0KiRDV{qA7|f?z84e%$fsN?r?X1RT9FZrVopVx$!H`%^i#}rF(lu~yxS@s
zJ>dHA%RoGoM{(rAT1W!&y*~8oe4F5EMSa^v3twWZROxqhPZ$2q!ljRvm|}*v8Jn@6
zeMgL@*up{igOcltaWWN6iM)G!7E7)*g<?4z3@TD(uz!u2Cxi1f<Kh*+zVuGL3ifk0
z%G~7nS*y7$JLHYFLPPyxv!kakJJAg?RF(<oW*}}#_KH$?TQHe+ykbXbiqme?g1wot
z74*h2gi)j*y`Gh0VZYD9fS<C$CH>v_(ca2|{7sh9YxlOOh9ie73Y-|})SR=q0a=Ez
z`gK9x5`VN<t9dV-xC&o+NK3V}Q`@_0YpT1eS2#}!e;qQz2=iyRcrf4>Uw{vQy>U>9
z(4>U9OUHBIn$IG^=13wkV<?w0_~oY_yp`{TBFbzO5vZZ&kJ~-<nm@(HlFks99jw-R
z0o!zf%x~hen?OmCUuR@On3L=LR~3lH9*T(Het-6A|K0Tg8lNG@VyjZpPX0$;+`GVe
z>C=tvDeqh2F_z{D&945~znLlt6%jzp1xe?@hLHSgVP(4)jj5*}>BPuR<s?N}k8b_!
z-KJs9;HnpjJ38yLcO^Sw4kBWLm5FZ*+zA*p>gFx6@&BcK1yW319wNdiSdam)))mHh
z!hb6x4d1xjjvH*KC{27zK8gBfSD<yn!^?be(kych&FA90dnKLC`=wC5?(A6H=jcek
zQQ$dwXnRh_%VMp(y>ap-f>y`vr7oK#&kw5hijuuS#o>kK@#d}o{rGl2(xzS2=jS^a
zeDk#B4@nEd@YAlgx=o2HQ-~+xt=%rY8h;IR109#}VzIwSYWpMTN<Rg*g$DaJ8$TJ(
zHEikT*z{f)*>d)AZ+X$Fh2hE>{F!b|j-!xPHTWQ&#8MpNIKIG>k+mhjz*bybcT=h4
zbT5te_R0KC^@AIDvf4Qu<)P@0wpDB#bLXfbg;^CAKK7fbJg7(#^*#T}2<XZoKYz2N
zo8p1aW?~8<$F_omc#T74SAYH4;<W18DIc1OA+K)nT=tz^sB*$5Exq1I>mI)Gi>4{p
zyS$<EE5Z}<FD&Hca+jkvDybyrU1LYAlJ}`Hom}2>@R`rIrD?(FveY*cK{X8DrHe;V
z;N)LFNi1Sg_wP{Mqp*77uXoKPsee9yEv<OEu1=Sc!Cu3C5Rva{#>z*;YC07S^qfTT
zx8iJnH8FTq<`Q(XmJ8P^*A?*kmn_NK1Ot(t-fm<p7Ycow{*+X)@Yu<*7%GF%;XW7?
z*Np&jK#jkPMr6lF@Oce~R!|2|*ZDEN-%#KDqHd@k^srRq!E$tV5=v35)uTTvdxU>l
z(fTe)LQZE{r=;r9W<;@Cuhox_iN>6|o_h=No3VIZo<xEpyfgMC4+)zTRA{$yra^tU
z*0ug08mZL^Z?A+l>;)Ezx!_ax^x1o<&%e7;5|=Q!&iNd2;os@IUs}ING)_Tzs1I~)
zyDVa=*puyoZZ-GjzdK)bDr0l<J_LWIL;TU-5)_`uYYC{E)y?m(ODjJ7sf!r>mBg~O
z?D%j#=P+JIFZaw>jfC_1P{j<Nj)2PVapI`EfwY1IXTU)6o_RsWWx;OJ`ycUTUl%r&
zKlf66NVthppRUikp{jYj>=lKRE<!B;)MW6jtZ#dmBWWe{pywv;%{UAx<&b}fV?QH2
zZ-YPrdYY7((|Ch;C5I-Qn^9bnGy`9G_SrLU5prQYR}_0_HEV?9(ds9e6~fx0)F_B%
zKzK*;eX583)iB@l)I(^+SH?7w+Zc^7k&!A;N`JWT@Yq(XHY4Yv%jY$6r6dedvUUz`
zzNBY$VN>_bs2S2PMV9N`lGlF;<d@tj6{FgsYoW4!gEX(qNS3`U$R102T1I~;HMsfy
zW&7eQA#K7i2f3LQ5$O==;BRXRH{ZwL#L=6+IP_9ToNl}2Y*b|VFdiBOxlZ==;G|Hs
zS|WSf35P&@AwB389$vL9eH06SpR5e~x|dAL4)xcu=Rg925Zv};B=CRuC1&ISi6=?Y
z!4dZ$HJ5PRp31Q0iH^h}4cHy69ncu0f1_sBaY8V~#u$B;tn#8N$i~qKCA{Y1r8_Fo
z%ed@GB6-M@=^l=Mp*&3GS839?>usGjepoTg!wJXz>1;T;$Wf+|p1fjY7xntamFtis
zu!^jW9jv79r)d7Ong4&)VzC|@J-cRuS4_T%d_f`+^mL`6D2AIz*5jUfKJl*>0R7vz
zOrm^6p;ZPaBiAqq0)eX&&3?-V=KA4j{*O}KD;UnDb-aijmO?&f7c3_}`#_TF%TsBs
zL5?4M_)Z_6B4^jzzmI|fH}jfK<Lp7G@Oa@{W$vf#137ZhRf~U-ZCjEJgk0={f%?Lw
zBL2_9VjrfCF7>oIC3T1}-K%4&?rv$YS39pS`jAVX$Keoj4PE1+mh{C$(>=BxO#t2P
z207L5RlfU#mN0Dcz$xnmk0$<l#l*$*Qi(QbKZU2HbGGJ`;+Z#6FsQF^uC&Ic43Av#
zS;BcgdneWNF9d%*#RVtNG#YuOLGR{yCRS$jtmJRwJQsF>>8BS^7fV13Nl++Eb^XF<
zB}U&!+bWcP^oIbiwkNA+yyrKHpD#{~8)$RO2JA%Cm8mRuK{d>QlgLBwBBP)mg9C7}
zUIL?L?tT0e^_u3ki%ETak8iKhE@Ap*t@h7_TxYiSH4=Z=#f(fMyPDJD04sKH3TicM
zq@p9jaMf>Rkjk9%PnhlMX^Dxv%BOy0hre00NN6Cvz_~iE3uPNQpFu{~2c&LDMGBFw
zboKgkrV?q#6PLd3HTDqv1Y{Xl_H|4v;egSy0%;c1N?Vml8kQ0mdyhV3(}OgRkPq!q
zBl??cUHgA)H+Xb&Iiw1?hR%paOTPE<35MG@Z|pVss`3iDeX!DblK*S+Ij7an*C{$W
zy>*)$7q@;1BnZ+Z)mRh<Ed)QO(p;=ShBFWfDsx#$f6`UbEFoR$47i#Yv|D+xg=)8*
zS;R%)UE#C}_JGN3$_g6ecGSDJ@0w~5do{Qay_0`yuVd|$c|;rDFSN;Qw7o<;6nmz4
zudYY6aZl*v@wux02iCBdt0Aw9>9E~|8!E{tc;ouDp|yRsIgJzh?BXk>&UvxM4sz{+
zP1c8fk%Y_&VkJ0H6gVMloVd5BAT%o(nw|-leZ4G}8YySe^c^;Lxz5DGCP90A=E9yF
z-<y8~P$cC~M4GwidGXx^8M4s>P>G`#HRc*Rp`bmklREXCq$%!t87UYq&kXX-*vpM8
zdD?PXGW_IMJpoSr<a<3MX8yFg-1k`BJCVr>g=sT(p^Jo9UV*1uxf>A5Szkm>0;d!>
z`Bf$3>-<}mr@r>?Q3`_9Ecc#Z9zNO+U2A`BjNrYYoTs=;sHZk;G>|m-=7AQeEdJB4
zBd#H*UssqvB6k|7zZbCN1Q}l{jdt>!>~rSgvs#$kS+4ShzXa&M?vce8yq2WUw%ht7
zkAR4HbCvN8!>)u1=5CpfKWEHD9auloGgAflRzIE^a~Zvd(7-2sb`n+2rt(VPTZDg3
zB(m)yZ1TR5OKm?oC50gmmv`X926E#b>eGFa4hw|5_r-CrS+piWqRjAfZV4t{jydzs
zhaN!`?!g~tVmVl^?UTIZW=*H_<4Yc;owr`H<8(Os>i~pj^PjPm>vBn9Ot;5w)8#j>
zFG7mVh+kOH_;9VKO?fTBpVO5!`nrGG45^0DJ`!2D?H>9NR|MTZIPpYiVRTUV832wJ
zggD5`y=cjEs$Rd{yYsmP;yI-wcY|{=xFt4Cf{)q^mRWRv$xfuo(Y>b-BGOhd#qXTU
z+`)8m%XX&{`0k6T;wfV>4PQ7jBhS+{;}Ts--BD>&5HlaV=m^p7rdWEDzpsDt!d`%f
z^(c~x09S+(+Vc4g%HqASkngO_b`hmYR@8*(Ol|{yMK7jgkb7-pbTA;dcdL~*SB7<m
ziM%;LVU)&<HNJ2Cc@ANYNwxEXuc<kQQS(%HOiZpN^KB)5-d|`O;IIH4SzKI*N_FWA
zkAs9Bkder#?hI?-FHwE<FI<0olK&Ltw!{eGd?ITG>E6L`bSm-26xmL{RB3Kj9HcvC
zO}H#V9VcJilTO_-0MvMNs@BiDm*S?h#Nvc~OrpQ_<jm(=O<*#kb))Q-aI<OYD_?fg
zxy=3DO2vvxy_^Tr4-0gp98!-4#61_w*3@g9>_**bjd?f^4SdA&ZmoavJ+;CYO^mTO
zM2M^4i92)QaGB(oTE$BqotJz%Nrnq^<=oI(EMw_!zey`z<EwGR`%)=;DR03j4e2j5
z=v~&F4pghyQX?Q9w-~*miH{QV5tz|$abpMg6dJIW7_Pq88-F8pK+dGZX2lEDIUc8P
z;m>WX;nKJ^r}j$wh@OAQnt#!fsjgB8Jppm>><=#HQ0YC*nv>}kul!LI-4*sMLhCHR
zB^<~sJHcafXU7o7R#t~!S2u;Uid*EErGXHa(fNoB2{!v;({g$1td$dQbS%&9{*S3o
zM{W&NGb{i?1-cJ*a%v$jrYe=^dI*kn;->3`&<pw<B$`d(9pry_?~DUqHJ(d8^xp{J
zPIS%r3btV6zKa}xYql)-!J6nhml@Pz!R*FLB#X?1Puacb?+h*Zu^QiqU;nzN7uB;)
za<g<oLMRk-8Ad>@3()Di$Yboe6T&JHsY5k+M*-#-o(*5zwJ_FQeo2;Qwh(rd&gBST
zPNo)-w=}BdwA+7d4LQw=@z`A4%KLsi_HnN=fK6?J`O$dCrw?_vGKh9Dy!&rgJK{@A
zn?{7SrNvZQwThFn(rHcEX(D~V;)H^ufwH12(dzwbYEX$18V{2`n~$11cw!$3sV<Kz
zeRM8k-j<`c#D$sABqEcW;6P=Zj&x}e7wA0j^W!hWm>7QpDHYPvj+K&ZW45QALpmFR
zA=Lwl{6&5?JF+MiM9TRwR1qjdlM+tVlh6qjP2`uk8%QEvMe$Tl{HyAU`g5IoC*EMs
zlOpO<XdBoR%}guf@j0KJsfnX+)mn%1x~T#Abdwid^F8l)@r#(*9p<AKgHNB#o2({$
zZL~nJcs+kbiI}K4r|3#Mw|wMKBU3k+T-_!g^1*)V56Ch{xPMUFIVCNM=b#En$*ukP
zJ_0h2IW+6LuaeeSDH370s53Vq+-5sSLQVxFIxghCnmu1Oxhl9nJsd{uN&7yz4+qoT
ze(7HxLz;T<bN=fWiOE&m1N1aQyfSU1EhXtSQRaW%oUdl%y@>aegug(hH(sOpbS^{9
zVkg|hIjW}_0N-YH9`=%%e$@OTFI+!(^wG=om3DVcGV9saM({IIfd>Q$>^xwbs@CD`
zW*Jg?`m`I+IGy|$&M4mP*Ke8WR7LM?QKPjB+(j+hyx-^CH4Q{;0Ts3+%Y}PI_P&_S
zF5Q3g4VTvFEIoBNZ~3f+^dSt%sfu5inHi)}RF7%dFV+1#uv?fx)qP=aa#TUxCF-c&
zgrL@{;d(8*F@`)EQEZy2?lMQ73r|h$R~6W&b$&Ek4Bt`RO^t!oc06O1VZAr5z|z6}
zse9;1Z1Y61RIdI`J%ME^&7QwiLdvtUmk57<prV?sl2!g*T8ZHWpOqZbjj4wNmTu0M
z915|WInKc;ec?GCZxSLEnnI$}g%rY&o>%Jy;N9hWXLd!;J+GsHZ1Nr5#_xNlQ|IVm
z{2PL#=ig(7BVC-C+U1>#zqutoJqeaIQ1hcNGxQ*AbW*TXRidk*TdtW0sSEo2Z0&!v
z4QMkry~C;6^HG~Js(ym#O<3UmhhR_Ni^%vqt`#P&`&%U|(6if4Ym+6tNK1i8`O^pC
z;k5(&tC`QH=m<LQGtmzlyXDKPAem)xA7zC31O#q9o&kxPFLn*A4PJlT`PxnumdRhK
z8O5IsompgP_%vzc<35=Ao-dOx6j5R2T79XJ_tm}MI)i)rwe=ILZ;GW*7rvTLFNBSQ
zI`Q>q>qB^1t%ap|CIctUX_0RGFC{;L{E;)hZ=cS#`Z}Et@!J&OvC);93gEql4?5E6
zwaN9W=jlL#q6q#E4nM60m%#!86ahGwp@#t!vtijE8v`;iFqff+0TV1THaIp4FHB`_
zXLM*XATl#EGBOG;Ol59obZ9dmFbXeBWo~D5Xdp5)I5IMm!2&0LjJ5?-6l%CGOoMcn
z#L(T{-7O`ZLwBb%C@CS`At5c@UDDkk-Q9V|z4zI=&;PG=?{Y1i=k0jj`G$f-S(QP=
z)ZQ2<X>aGkz{1GP3lLLy$HEL?W@ck#W@d$_pir}Pu>t-ghNsW~Iyqa~+wuNkAm#)#
zaskQ2ja)!>3ift?09jWX01F#{g_D<si<g-hz{<?b^FN06PP_ndBR5M^fC3{x*4_^2
z3{N3u@8IcVX>Q>HO7lM-0n{cm02Uq|F8aUR0V1|QCrc9}JAi_biv`dYl+nb<2B2zh
zVhMEd{7(pKehU{D2VN#7cXxM2BU@)idna>28hU`crHciB;2qEz=;Q`81^j9lplD<Z
z{JS$ocnW};g{AY~a#edX7k48kAOIw=u`~hNIfFc0?M#7A08ny(s*F59$pL8hx3T=+
z2K0b`W&>bhWcfGTKi<CrS=#;OY-D0$Z|h)W=V@tY4luK{0RogH<r!T(T<8HtcBa1!
zjclClLH<U6Zbp_iM#dn6zbZEZNQ$Tcj6e<k)1I@5lcj@;Go!Pm&94@jeuV)|S;Ed#
z%-+@(Xy@V#|EoT6ODCWSXzZR$e{a^>&feY5`yXItX=iHos|izA2PSnpOGj6rjQBq$
zAQAj;nK{q}z`@MS%*De706GGI9wrt{zrw3|IspHFQnLIKgF5i_cCdE<n1PxA`dXR+
zLI1&fI~%zH0WMCiKws}a75_!>EGz(1OA{A>G0@!74*qv^kQiw8HwG==$<hO$!wljc
z3xN68zkfgJf#_vwZ)fBA+x)NnGRcW*$;nC4{oV1uI#E%34}doVJ2QZRm4g|;@{43#
zpbx%({|%#TWcg1SfB4GSnb`w){;n1@rvItf?H>YA|8pEPfd9r)v<I;k2%!E=a$RN)
zW)sjKmj7p}|K;-k$M9cK{%<7z-vvp!+SvT1rv6L+|4|#+TH1L2V*nzps|)A=6zoA~
zVE4aGHGzL0tpd>0($)5VYh_%FK!+e=XKwR<?-(teB`rOGrplHsCKi9Q<!`zAuPd{$
zv;!*JJ6rzxS^+SCR`b7fpwlw327PrngDClz3JAKK|E83%GqE@Qbz-a>oB$&yCnHaI
z(2_xj1K`a9x<yl<$6q7{FfrQMyMSB(p!R$LX7*0-zc$Lr0bmmOCHfn20+>X9BQ5}c
zlh|*>4PX-gjd%b|68|DDW&o4qZ^Qy%lKPEU0Zh`r5gUL><~IUmm-~%C+2wyDP<Dmi
z2$Ws%Hv(l>`WJD7vMc{apzJEY5h(k+-w2dl^*3S%Fsc1Upjy;_BTy|GzY(Yw&EE)A
z%lqF5REyTXhzDe8^e<uuWjAsLvB}bZ+4{E$$ldri0+nm*WMpCu1U)}yF2Ch$|H}V9
zp??*id?x=Q4p1-?dm9ja{>{n$OJZyLyNX}DVlw>$f>Hv1M*wvS{7(iJR!|6_t*Mc-
z#UC<IJs|e|DdYSV$I%sZv%f=w8aDe4K?Y`jK=xnI@{gDx{2Owx{eo`4D`WY8CHNhj
z<CnR;tJ5FZKnCW2Kv4YO)v<&2Y2oQ$0kr$W0wnt*KQpLxt3M!Uch-ME&}jc`4K#P#
zKUxFL^mk+qkgFZ&VE@pAdbj^w49MC3KWb1j4!_l)U=E;n*zP|RU}yP9`d<RDgQ|7_
zQOf?0mHrx)<8O+9f;+m}y8umpjcxuDk&XSg;(xJ<^B>KB?Rox@{@0l0*Czki0}E)Z
z&c9~?a&iXRTK<=o9KURUZhvfp0~Ev=^vM0&7ifmgHvb_V3#h8!X+f_ClZ%BD@DJ{S
z=H}vV|Azx8hU*^?v_iK(AgD6;Kj;VY_V@#W!h8M!K|}QVT^uNq7trZ{?^OT!1~zeZ
z0<Fm9uQw8OApe8^`o#kTdH_w}7iR5E_=2sfgIn$@Mc%qIY>x^|QEY1_(=d21IJLSy
zAj5v4sYnl8bGi}vGT4Q>yeUC_Exbtl?0wi+0~^*9uhRVJ^JEbFZeqI`etsOgZ!G^%
z<a;mS8v+J3;T@l6M<0!U0Bgub@OD{>Y)4maWaV6pJNF(bkMF%DOT(eF+bTO1oN@?H
zC6f$M>XEtuh0_!{#u+oXq%bZFgmARzXC5fi*Edt>S!1unvaxjVzDH4P1>V~0tkL%~
zUMr<)tj-;H<apY+gpk+h!xNO=qI-$5ICI`b1<QT&9*z73#92sx^hwJMsEm88X%&|5
zBJAqBtK5bc+E})-zW{=%-u7W^#a9*AV;VS-Dq&SL8$@8ZRIynD3HRE}L|0mFG&;?!
zk_Z-gCcnP|rjfKP4*eTCy&r2FR|bdr7;Zz8n(hYchc-KXH4BA$g$T^uS!g9Jbi$XH
zc+&`zpi5jvAUZUEfijq=^owp^xSybnLioJ{&qW{bSvK;SnYFp0yTOMEPB^lC&ZB+H
zYR?qg)~C_tY~0cHf?k6-6<>|plg`fa@hsRR4AVoYbJ8R_Kjo~(P^s`$18b*)N|?^p
z%di>6i#>_u<2E?v&-=*>*kz=;x97?S!*v5at?qg97*8~R%G8@bbL6RzY#l`~jO^70
z42TAW^zhu6?rq$B`zET7wQsL+e^%!HQFJi+ry5sq&Zo9_{#hN)N-0tz5fEQ*H)p!v
z7?T~ViMo;4*2kb|stG)7j&yu|a;Gnm5vQOkSWxJd+vgASS<ssoFX+ar^cTkdbY1Vy
zTHUI2M-7I5n2x#<O_9E{1W9JlI#{o9{(>+1R#ojTm&|J&tb1;9WRv8_#3s47O_^>X
zdrt#^k0UY#(k7OYWNy<x^>R&sIx_slEWBY=-Cd++k)SGVx(~Q^G%yS$N(S4?#*8UA
zdL#|VFQ!Ugl`o*fe4UNYwA%2>5Pl$zX%HxP)~#ND#k}SZ`6i&-p#@I9CNA_*{ou{`
z&J*XCtVs{492L9%Z*Nn>@wO~0C}tBfN#-Wt<ypaSs&q0_(XKWN{Afrb%|hM>!kO%$
zMZke=^3PCV4phe^p1;FTW|PPv31;A}LZd=ke;F4+mPM&xgkI>W7Ly$XlXWQpqwMzP
zg89sUSp`oPpfTP(-f=iHD?Rfz{xX88cnDc?&fJ|;k|QC;{ap1UxlhGwfV~R;=<a9|
z0>XshhdTZYA{ORiAGnlP{^ot#)0+DG`SjI6i?h}2;I*=Sf4JJ(%E~mMK|DjDORmI2
zYy^YhY-pV?ZI|30%KYpsGlZ7{E@OAnV2db!NPL_rjSap|a;_}<Y>%nxVqnmgsn|8r
zE@jmdQ@%HzxJ0urA54fSbk`hD{dJp~cG#8J-AHuO3~ptbaw|{2S3F_$?U+R1Gp`YT
zyHJq5SIE+0E**|>^X6Q`O_<fa>jpqLWjPL}lCt3m+(IT~s7-3gF)qvD9t_fS(&I>f
z4as>MeH7CcmC9^|CnEG*qDBsvqYCY2RbrmfNGj))Q6?w1dE9>}ZD5GUS=Z^nJ)8!P
z3`X4b<HO;}4bM@sQkW+gS9pcp$`0eD(7W1yP$*^X!Sz~ojZ4W6o93iVZKnN-)Z2yh
zZQ_-ueY9vzs3%V@0o#NI_s7`nPu(+r^DLJ#N}=M-=&_!wM>`m`L-*GBofh(JQ$<~|
zhP3?AMWvhBG2sGDRuAGmZbuS%)5-G9xAuo0wpcWnA_qhTgsZL|j!Br~I<<1_z3$16
z@5gWZ{V96N+9w9F+<&hAWYx1T>0Ser8$1iiSo}b7-OCZRJ&}aL;jLvshMP}+G=(c3
z@Z`J=>{wg{5K1By1>?%waj0InQx-EEPE}T9N_pKC@f_d^3{b^wQ4c@2$UIpnKGe*5
zZz-Vzkds*;<=sqXY_Xs%Yrl3-4v;Dw9oY5=*K5v%mf_}?*)AJXFfSxS(>@rc9>VtI
z#IMCOnO%2h*tAk8OR(nf5^0Ek(5Q;aGwtw~V4rYcl!#@D<gMLi*zlEm|L8!VCTp61
z4{aw26GsXc0hSCF%<cVd-aZbkvquewddoob48mCC#ZS)1UID=XV|FS@6K(B<Ahs3B
zb4y|GmDB%Qc9nkXt&vM6F`Tdx%V7>v2AJeIaY7xNClOi7rU{CI!rZujRIm2)iVmc0
z>1&hMSfr#M%o}u@lKXF@U9y7ZK&W{Q(HKop0^eN?n$J+nssl@wc=S1^0jq_l@6fRu
zunSt7C8PQwOInpP824J`p(gx2?x4Qn8t9C^*Z7Er(|>uTl3jtMru=&C7L<Jt4;-S8
zb9h<A4|4Leh<|8^cf~$`{~R1?NN3}X4|fYxxt;xNAZ&)i$%ZezrflRk;f1F@f@M&d
zHG<iv{f&i)wq&b63cVsmfv(@!!9SGGd!=OfO+c9n8}^=t2H$*6%gDzmWF+)*B}S#p
zbxZmdZtichL_tU0p&{m30=fe0!laVx4|0-sYB|P_$+2x30ns*p)Hdejof(V9lVwpW
zBn^8dGl?@lbbmhI8?mdf;8YHO0DR-waMUPhC>$;T#5wC*ALlxoMyJ^!d&PFb!ItIi
z=JU=H$Y*-t=|!WRl{g`U7vz=%xhaabMJPyd@sP{NTfR`ni_Dw9{b^^z=?NYt`zA(G
zsrG_j?#=e0@<_gaQnZK&?vPt(yx;1iO)lkb?VZ;4Tn*L2D46Er_;wIwM=o=K9N+~H
zE0xLejpf3m>l@=t{4Ozg?*1Mx5$S@NEH-d>PsR(KY>&o`6&Dr}*RqlfL<f;EMjiG%
z)p=H9_XIi<fJ<@yi6Rgm*MdNNxOxSlmo$Zh=)=}GJ~}Rc2i<&k4?J|O4Jmm26%L8=
zk>$O3EOde_gXP9VsoLA0XZ!xtL?Vbb^%xT;EQZV6u8fzibSIk&qz{*Zd}s82UV}9g
z6!7-V6>HfZkOR!g&VgvN19<3~ERr5$C)0aLYXI{X+t{dD4-L=j+C{X93{pKZuMfCM
zg$`~Pok$sfgrTu1H}kzkj839FpUAQ78nnd9#8@7BTuMxZ$!?3d!N#o>!=@wTD#5d-
z`0_dqrsHh_Bp;|@5auHlFT=lr^R53ZFnuZQdOQY?D?@!+qiqT2@B5nbWwRF}7^4Kz
zx#KGjf2~vul9+^Hh{k@d#d_;t4+WM={HSDsy>e@R&&C8=kRN%;=T_1QHnx^qWu7^n
zBkd?>o-lAK!_6`xq$8(A&3j(Ogo2|1=c()dgnD9O7_%V6bbUh2l@Ll+c6an*8!v<%
z@@ZDhQ;cf&m5{z8B_89~ylqmYuUQyFBbwc`lIVIXOkWK>OCnXO-h3QP&{g@;^;VL$
zWZ6=G4f{N5PhSymV``A6U>KAis!E~uU9m}yE2aXD?p@04k&aVA+S7p6buY%TmLt%&
zrD~o4u^{4hUMo!b;R=3K5?oy(_vrE^@@z^jsAC32I+CioRuEiUMR*iNW?|ihB5&(8
zF}*{lh=!|&vh69`V$?1Ju?lZri)wnwsH;wYt^1tny_4VcS_+e$f!!BKS@|4n1UTwM
zVfgCZ>>uN)@MX1%gx+$JwQEaf`qpX2t6g>nAFz)N<ty^^;FgT?)pNibd%d4NqPuOJ
z%C9Xq?c}n@U$G>U`(ZfQioBjUf5GhPyS%W|UW24fX%;BH9df=tvroe`7WR(yoJD|t
zBM}oLj_}4Yfn(J4)2=%@CE8)eu|rrlb_g+dR!%l0XPD5vsTiG3qm<`&Xoo^?K(WC<
z^lAK%R>Qsbz&O~GSVw0z+VACA<Q7Ey)1X?^t9&RdEA)z0$Zfg>4hG`jvgLX%touE<
zQ6335-b}tNeBx3VuDSaH2`oI^9oM#h<QpwvPgT7S=OI}TDP{LI_M)@<rSWfw6EoaM
znD6)M!zB{}5m(k8PKqVgjC4K*n%yaTu=`7gWMlapz-m6#@GVIZ&0?ZzVUV(kUU4j3
zKJDE7l-4Dk`lbVO$C5aja%{q(c*j%XAjrxk+bsHgS?kOMc@kb{PJLDEfu%x!kL)6-
zQ@+7H5-;W4+YrD@{EnPQj}w#f<AbedIgMp4Ubx%fzE#(aW>JKE&pT0l!gr!ZHtmNV
z-wm?ov@&?BITQ*jpw@OymM~AlVKJhc%TQ|H`V~DgS>=bU_b%j+_^uizoE(Z%Y7+Pl
zlx)qayl*6jkzOm@MHzOH$uDbvdE+-Q!?>VDa4tM=hxN@V5!K-8$Zk2H3l6DG>1oqN
zL=l=n9?32-B1s6^U=>^6AY{oLGp_bSCU##8Uz8zH<@j-toM_nU87Hu(u5+2VBDMiu
zFk#Q8UBw|b6#rYU-xN(pXkEsAZNUXo6d$ZA9u=Z~<2CP=3zTe?mGA+7rpLGMK@!x=
zQbT;BO;}4Rju6qs{R!4;RE=kusC=3HpB>-Y&2PB|xY)>xvBbac0dS1qC&4?$&h<D>
z76b@wMT~o~h^f+b5acPdbblZM4nnB1jv%molTB1u918woLw!C~OAbfW1RPY^X0mlq
z<dEY6*L((s`_ObR&954Ng-a)vt!p<<Rj|88sr$C~_Uv|F6~SPt113m*Bx-#*Ism&T
znFg1Eo7UPcn##hHqu4Vkkf>-lB6>^{5M3CS(R=H!3d3>>AiJDuLbE^~)=>$Sw<ytK
z*be-l>h$7i!~sxH){-io8RsM7fr=u~gDRfD(E`Jc2odJ+k6T%Po1n&rze|r5M9An4
zsvi`WwhGHd-E_us!V2_QPK4iK>=IlYpRK6K8M96*U$p7rqfD$I<KJCOt-Jt!rZJn?
zlJrV5tnaTE%H5PP0TWi0rcC62g>H#EfdabOfpKF5WJm@Q=x%CMm9X_*8kLEVczU*M
z@}5u8VP=|;<awNbK_><pk14#&e)`E|=F7I0n0EN%YyT#xRB<9&*)Eltg7XCIH1T^)
z^=IFwo7(yYt)AK_eFXpMISQ+heiG@n(+DN$SGd8EXkvr=x(L3#u<FqZzt|1g2DcpK
z>HxiEGI;U@*b<Z_DlrS80FD&?U{%~_!sg>2m7V9p@nyJw8E;aJN^ATXFjGYQOu|F=
zZR|C{YZRz2Vql!W>I=!14Clt}w7jjB4B32aAlwMc4V$QBY_gyI)~iUiYo2nhr<A*f
zj=U3cVI(S&PX$IDjP~>q0_H6am8>BRGwM&$HXZIB5X-n-J(tOyE)rKRzqrDi`I<O(
z({Xfqejs^&UeTM$czAo)afGZ+Uk2Xhl1;N?$t!)4-KG@MvqW8P08|RtCzRA^dvP3x
z!4@oa-COTrkmCLL^Ss9^C^IBYT3eSQM*Y}rz5|R1Y20g5A9wwSXp|>~zoObkLmis{
zZu$Geb)gnpOxd_QY=$Ye;9Ek=%{gh|<<9|TV?ob<)(!6%57Vxn-KhNgZ5h$2MpQSu
z#G8i~Y&@Tcak=8La}l+!XT`pk_1f;&>ep3BxpEjtrNQ3SF0g!kL~&t?oJM$Aj~d=M
zgI{O=RK-$e_tD@{T+r76hHl5K#GJ>1obaKj7hF&HRN>xmUVpMtO74b_;~PxAd;eiG
z)Rv5YljEsK5u2Gv;F=birE95w*UDD+MeD@r(ImQ-6Y4&p`1K8MOw^(&5$wAH$Q3}m
zhzlCxAw$V$dQ6&)CZm%4!6u81F&>@iLf2O~)m>a3xj4LFv>r9NVx#xuTkhtA@pVc;
zIvWrk5pNy)gYrC~WT+EgTdYty<O@q=I!tPReSIv5I>=+a#5XY1$GSedH)}=FwLX_>
z^NybG_KfBCrn9tP)Y|wh06X6HgB!Zu2}9ufK$RX5W6dsq+^b3L(_iF#d%~3IIq_&{
zbe4nubpR<`r(!f5)o`+HSRym8%N@TH`pAgrEn<$>j^%~CQ7{g=uhmfH?x65vUih|u
zZ?B&R%Fd}~9W-ppwq2NWbTYFYEwVRqg^iGQvDan9mm%~B!G>M#V`2ve`3cH_yhq4W
zIYU8!VNDT5mtkV=$x8d6bBR!s+mGfxech)|v~gIo&niPdixiE`Lg<!S+E#-z?MdH6
zEflK1Y4Mu4G(RvOG1`j$>{=t4J(0qH-;MG9!E>ddq;wqOfwl!=!2ITwUFbclUe{;#
zBI(qT+_briRQ=9zM|q%qb$YV;@#P1^+k&{baW26ln!fzY6luH9nGj7yWg=Xp``+TA
z@A#QmU7i(s`>*bux4-&7TJy-fzlt-<D^8z)+;|;(ex$=#`1)Srs4x+AfbrmeCrQV6
zHz}>`k}4N+$D$Td1suU1^r_Vn5+UW}g2<jMBHg#0kL``kaOjKZ0@sO(Iosr%Zq=&z
zYFcQY$d+)+<&$37M+;AOh0?&rsBVsKyYKxZaZEL&<Y(#WcCnqYN~K=%*Y%kiiXCgZ
zp$2cjEh2kSO7HKriAueK#fx2kgb~?pf#|7eS$hie!h%*b{F)YqTM8{71z+cK2VXz@
z1g;-zh|A9SBsDd?NAaB~6mtq6!0A&P5E<A*FvER@NY0B(Q1<164kw*zk-M298;w=V
zu1A)<ebC*-f4<e9j)x?~heY5@dDG!@@D3oZ+Y^W+?K;i*s?z&Bo=la0p~5y`%;!PY
z5KYW>Nvt}|TViF5cDzK<;369f%Op6Iqx5=`PUxhu8qkI3p;y@m(;`T-ahlaxtLJZ%
zaSzF1--fEQn=>xShf1$VSww|lSsbogrKr*=b0IxFay3reA*9B8EIcoHinFWuiU6zn
zzH^1SiocYm*<xLD7ABy7mEEjSQoP<GW{GkByBY+IzAE$t15t>byYDkS!bfez1_`Wj
zG4QL3TLdkHsCUr7TCc9@n=`hSNnQB5d6(mt7p<QhhA}vj9}LnwI-`Oh)iZq}sNTob
z_J;*a38SdbqH@Y0=n|&{?=Ig6KJgA}7(7A@3eJ4xp_O6w#h$8v)g|?w$AUX$Q(yGz
zJ0Eo2l1w*)9A3x|xmI2)8lsW-{E-_a@JYQO{lT54{LCC9{0ElfH1E2p6<I-J#WL1M
z3s}c~go5-IXL}@uM&USkIY=q4m`&0$AC>Vih@Fy$ZGiTLm$Oeupl@D}{7j81MtA|Q
zzgfwQZA)R72-|6Y%<P#e0&9-|UhJ&Schma$_$S$P-R1AtL}dgQ*d|Adxc*P~C_XSh
zT-vNyCi>DucAZ|rvC2Cp%3tt?W!<{y<%oU2-(1v$jD68q{rou{KKUt4CAdasd6i$i
z^F1#CRN&&0kO|!l#d_77W5woWQB@9}(7T|{@8D4-nWWu+vpwnG&G*#yTUNI8jf*vV
z;b4}it7*vrk?t_1cY8Eg;gRv1A^Mn#Bu-`BT3!YG1)-EUPDy+srZQr04VgX$_`)+-
z0l+!Ebbr`fpbS5Ur^~V9(~bnlG2qRuXcnk$D@Tl!i<C%F1@&O}EI;6UAD<kSIAxt5
zmsaNL#Hk>EI@a3K9Av1L97LB;h@I0*9T5GrkwuOUrgzRt!LQP|v+-dE(n9|y(dPc}
zQKesAKiOixx9L|0_laOaFv|za17dqP9;f&bb#FVbAHJNbdY1yq2Ajv&0iSBs04*wN
z4k`tT?{o^oZ<XxxpEZ>@OBhZ2ewN`2lkCnV?TP4r<Co*?$|005i`DZ{xGWFPhBPxl
z@2Ju>Xm%p$G+^WakPZ>8N2Nu{jHj64i9bl)BS`Q?mk<r4Kq)3oO15BiTy2@!-`!jE
ziqCt3i`7fBsn~67!w>s!(GMeA=wORcBE6~W%>uK`@_Bi=1n$?ktOb1{V`qpUEC2YD
zsN&;)M#-#bl)*{5Y;$~o*dAeGBsqb!)oJe8N$t$=#0|>SVmD0U+X%HyVXKCG216T_
zNM&x#c0w4Dez(Z_WC-o=w8O2fwO?72Do-%V`*y{&fILtW2X8a9n_sTT7c^@r-O;E6
z>jQ)%V_TNMkY($yJ==uka_u<i+cUB$m%XNc0dm7lSxC1x_ff?oTPvcX4rk6$f`^Uz
zJY<NUkiMvmWwZ|`)?(?pCeO~HVNMwRWbJvYs?G;d5ANIV9-KH)h>DaNt4AAi;Kj;b
zY;t?kFV9YX&blO71@rCDoqyhNqiCIr2D$W`LH7b8b2g^T_~q%mc2Kj8Sz~g=3P;<2
z>ALRTvCGK^4FRN~7Ru$fF?lbT8`W$YX|GtbS`ZPNZW22@Ci`3-YmcB`wx_$Eaj0vE
zHG;mGJ@vrW$kv{+UCP;IyR(N{U@N<K)9&$oNFKh{#8fug0o38`d|^bZWgaK(Y>v5D
zyT+>(H;d5>N|#jGpiX5h?wSgkIw0tO{lnabCe_;y-?@aimgSV10oefeppgpBkK3-M
z&Ng4&Rk0W70z?y9hNQ<_jb~=loAWQQ4cCjcg9-B^Vn*=dfeFO!N|9BN7oqQwARj2d
zmfC#y%yy7;ONco&-4JE=6<?~V;8TM2*8Y?s31ttG#${42s|LPY%r@J-=CWLW#yv%J
zk@3z2*}F&e6xOU+me+;a#jHo)pm1xixy&Lsp<$l>n)23yi7}LxHW!P;!RSi2_C!49
z`*Vpo-&>VTc(ZJ<85wt5ng<<}2Sw7_>>o<f0vFD0xq3{RQ-T;PSRU^#(c6j2t+2rA
zq&dC{ZgjH~o};f6dQ@#koU>4Wkh2}?5-4*>x7|E!GE7O>OEMjpw8|h8PsrYXnOmE|
zm`xJ!Z93RHs!kWZa_UXv{IQdR8Y(IP6IR4kfq!uMd7M-8_24wbD>_M>Q#%ejb?^OD
z66w2EArj=Y`Q9nZuE_Myl*CIEJKU#fj%0$Zs)YJe;<t^ip6@<l%L~eXH8kv?6CJ8F
z<3)$=?lEsl6YmOQW$4P%yAJiBvU6@x#vKR~(eh&0C^6MVyDh7R-ePkIMPpJXh>qU_
zG25}kH93(Gj~f;~)U4`P#DVKvq92@Km&b&2C=Iz<9uK>OCO)WEuc58g39$+a)UU!H
zu|k0p;b%6uN%!ZUcnM8^0E0>F5bqz?#ZG+~Q<yz9Rfi7u=RW^j-j(C4K&>v#msd;4
zJFn1FEtQtnkn4xPV|5YMz>2@5)m}TFAUZHm*y)XBIV#Dv$b#g-ODc&najxf_Ep0p8
zF6@0FhnjQoM+irvB%ZDw$y*VFZF#ITJaz5obi7#W;G-Z6j~U8;kMA4L-PvQb5KenX
z-aBGWo?n#+?D#tWBWkYDYdaxlf;@O#5OZ*3u@4%IPi_DWlM^~-Z~;BsQud128E&Yy
zn9R_t`_c+0OrRKWf)jtKC7hO(#BqLQ#tJ4sbr&8p9_EF*nkgqGkrF(k(jLcc>9`8(
z9#FjFp>Fv_Uk&<yP)(*RQozONI`NY=_M@GOpQQlw^xHi-oFNf+_@HoksUp*G4X;n?
zC|74i=M~>`Zio4{-6S})Vrx{0c;@Sg--ePF7EENJGEN^u^WrZIRK{=(kh^nh>Ngjt
za*cS?a3dcPh!|`p_m4imQ^KH?3%TNc|LJR@r)aU*L+y5dwRMR3a3ajo3L`2(YIj(y
z&`{hPPxB;2Hl7;a1pfjp^u`e;@Zmn-q4>-XGrIK})805+F`zua554Mz(ArQjK`2%4
zQZS19<4{K7EtzdtmYHsQF$=17&X*>YSb?{vh4aQGmXbP@u*bOM*T7GL1J)d1CuL|K
z?G5F_e318lH5D)%R?t`X)+%KPH}g|}@~&&N(w<@go%C1Hjq#G+*H`!2((sK}>R|z)
z(0xa`dk{i4@1O)ugP4zE%1|&E-j>^xM;E8o5j=gfUe)nuS73@8EttU_z(zFM_+-Os
z!dhK{zP9<92Yj!iA^24V_Ick9dMwv<;o3#0E*%_yiLm`Z#QrjQ3jZk!wTq>&|4jRm
zqo^1)in64tR<>kP^_4B=Nb7t3$p`FpN|YKX4TxJ#UiP1u2&Jj*$??y?+uQJ&Arm^!
zjm<q*nD+>=pCY1Pgl=B76ZrQiQyXx}V-PpzyiVDE;_xZFNTjxRcd6ays`!$RBcyrn
z)k<`Kv5;g9I{9ijwE>PHLa7NSzkbA(HG^2cG}Ub!POk3iQ4un#PQ&ufX<Tjzvu-cH
zz`TA0Q!KOVp+E|jh@yA)KdCFmz#LmJ6X`zR+pvv1YEYX?!wzML&*Ej_)OEY!J4hUi
z)7HuM*4J@%p`mQ@2BV)8ht@LyGr)c3)eP@{%$6WJMH+cnfb+&C3M)*;;pNgViYnYO
zd1pGgUx~QOtv&FGm{%^|3x@*n<W4{?$}#p^QN-lcmO<S_c6EIK9=I~{clgM(TJ^vb
zeW`VMfiqZH){=n<MdJp+o2UR6k>vE8k@8`bNBUY#k!koRr<xHfZF_SCHZP~b+#_^<
ziPhnoC{b3cH(e|^(50Mg7Kx3t*tcDNvXI!{@fF#=GW!=tXEcaMEEwfzZH6%lz~p>F
z^P7jKCob+`p*wHg`+%($E3mg=C%sp(5nLJk&hN_TMx@`)s=u5sx2qlP6H8*^WMv%%
zRGQ`3X;tuDF;&1pac(&3d(=BF7d)kZZ(f(-(;aLd6{eMoTd3g9hz=epb+eU@PuIw6
z{lj6;XV2&EGg0r{SEDf#WXg5{n~-?#EZSrcGl_gRwmb<u@xh=qkS)ImQoBc~UEoIn
zOKeb)u{c8Lq=L4Z!8qrhw2_$%32md^+I~ke7q;<|%B0VHNO#ss@G<FS81nspwpThK
z$C2=nP6prnn^KwJH$%fqpQ5#fPY;BQpEjn7J~w9@MwyN*8mQ&yX+VSL=cUqF2sQ?@
zthdd;i#!A%(<HkG(v7hx1wy04Yd+E+wSmDDQMEA$@$Y#G86NrU^Ufs;0FcRRbQ)hE
zU2^shc-pO+%@}Dpt;WnS3u_^NROXE~1DSA>+Gagoe+D$l4DkEOf+^@DisHY#eUria
zvggoHSSEaxkKQ~!emz~`4P}dVrca?Mi`L-n*uWhoI;{9Z)1&VN_4!x=R<J<N=Fxsb
zt?#XoN^P%%t!%EKkis*z5_?T_fk!fffpy{A#@(vn^Q2dEZ2@JQHj-0+z48Jm0+Vrz
zRTd$W>|H0o=(zpSvId-zc+L?!6j(V%gQOu!`$*yrN))B@<AlYSAVV_S&A>hG3QlwR
zbYg<6#8IR<>P@$Xk$g;6A(AzJo-)bgP1}QR6kCNaL9y@~q}os8(C|B*PBQ#aga*m-
z<W46tisMN0TCpYk2l|SCYHx~sCTyh*_y`e6XfhipY7JqqyJMR7YV89XsV^MwDuRDn
z=^sU>*576oYXhPtO!9^Ztq>#cp$c%-yuPz+F@5J<KZ8Z_J=$5&rt=bSY75?q8+};Z
zC(+csqDUq_f9N?F1`{D<^KnhVK$`25A}&S2RF!z3S)Qy@B$MQSWrNIE*B+7$Y4fb}
zOh#e#Ln!e)pc=_PA<4)MBvZ(Mfwe2FMin{PJ83zf)4Ct#RggfXmH?wkkPYFQnnzV#
zn9j(=>hgqIO;xgfhj{XKBJK4DPm}G4!QBm`p^s6*`MAr+%r<0np^Q6IyefwRR)3<5
zg1rqEF{V<W7rexO&aeP<CJN4Q!fHS4_7kS_?pl^dJhJ#>HV5$z4-5ZS1bh3Va`U`Q
zE_#?dvG=C5%h3<tU#k_ZHmyago5;h5<q7d&-9_X9{a~y{J=jm*M8DYA=><IqVH?3p
zc^tN03*8T7c84H+T-ubg@C<+ZR^*{UrD)$cl9;RQa9%fmoUt}YQJdUj9X&}-?qhZt
zlLIi<qPDIF4XAnK0~QQH@?_GyXJNpCQQ`!(%>`eabv((2Kx0v_T=I?Ao2uyNvK%rj
zH_>~zWEU$o)>i8$7{i9VwO<brwv$h0mdX3D4&9Er%-Eg`g<uS=1^&S=F3k5IJT~1g
zRJl~e>{gb4a1q|l0>IEY9mguBlxgH+w<ym^DMNeTH(ne<L*?Fq(Y?jk$WL_5x}r%f
z2%WfTE`1s_12WVi6|i5^?n-P8(51Xok`Qp=lUQfpQQ1c#iY>cIPVEF`60z7>SvO@0
zCoB(AMc(l7QV;3-(OT{IeUL(CXpXjD%wCoScOwmdbu}H8#LAG;>0_hjYTqZAqwTdI
zqWx)nGN9=&ubh$7dx-WFYR8X&jY{W@K6K3IlK;ZKV6grWHpZ@Z=^boIhQOry;T?OB
zmE*Bm-QW$^k7BW*@154|C&PGX_xueuqi-}=q%fBB7TYpRT)n_371LNB2%6ktrI8>%
z2>Hf;K=Ukzv$njnFJUVqW6?I{=+xEEte%u@1qm5tP?5^m^Al^?ae$XshZBFOT0bN3
z<<%xg3%@mBx(zzxLV5Nu3}7=qinY#TD5^R*wt<~t8%M6;ws0`zFXGc~`e{?qx3EVz
z+?)BKzqfZ3?}2Hf80!bJR$wwC*FN--;}3m*ec|vaDD<nJWfxP*oc8{Y4@A0V7N$h<
z3lfuZjDtj}JX8$%ue00?H0j@2;=Gz2D$rBoK3TGK@9CkpJJoH7a|=lZ)cRVZ4mgC1
zQeP4-2m@@72B@E^XqD)rFg~EBGl^v(k9c)sogAq2R~D@xLU%<i>N;mHY)6i^?HY!E
zPiiSDizU^&U5;zXRgc-6Bv8P(J#dT)CD{7<%i~JztUsyJ!@3N#2?c#jjLGMp76ZfQ
zfKH-tHs_m+bDsmc)3UbfiLs|S%Jx>)cE=Q#seeW0Oiy1Gvu;5oO<$(>7LtsgOaN<y
z>>%4_IiLc%49NrsD`5^)JXM5Ua*Mcsz`2;oS!b<|Ri8eK#eCFQ+N*4K5G-JuVW1yq
zrT+FZJ@>qlgK<;NSuzlJ8An#|-p5%OXea==wt7$BgmA#A)gqi6%a7T?Nw`DlK~QVL
z6&0zApCPQ+8^P)2sJMd#@6zuK^I5c7y2Zo);jkUI#2(+6`@Q5+8jr~3<U`GW%y>Rq
zrJQn&^GoOXjmY=uOH5AOmT--|C5>&-IR7mj7x?UB;hwI-TP$g@Od}kHx{mcGaA9&9
zRWhx73$^qQIYt!U$|&X^!5cM%<dJ*j4!m6u-T?Q67i61tl^sa+fl;%Z)^Nl${r&}v
zFLJb1A{E8&Z<1De#_cZ1rK&K0O+%}Y-_fY0w3djQt!sTPvDZOn7u*A@8k(k!FtHgW
zUimDv{8RDUn{)@#Sd#>wN6jCYwp$M$B5HGRFWt<;w7qDd0_(+oYIQ|Np2ZjS<TI%k
zI*2H~5e_Q6)SoA`_Lt7zL8DC(pAH?GvI?=b7qjfsQBRkrnwJ@{&*n3K9MoD3+?Vu8
z{&>9A31;~WoT{{=xRQH9BEY(9>b}Xj9%mauxP;lIfpDUYcKl8l)#%u?q)J9zODbl?
zhm<Rm<5qSZ7Ig^lUb+gBo$K*!cDKbgpMJ04b+ceSS@CwSfs&ATa^svPz@xa1cO}m{
zx=d*&swI+LFyCS&t0M4!Sjo{EMj4u_{dlN($!(>fg;0P()J4CK8Z=?Exz##+&`VSX
zX^qu>Qj}hL8I0N}?_y&YIFh*SM~C`)6(EN|>|aTvIkU6e9@xx6AHq*F03UJ}L#MsS
zn*6yx1ulMU?94*S@0qV$W8Hdx)QY`~M4wu)?bfj%LF|KF)g&2z&!Kal?X(3Ed2p*X
z6Ik$~|Hu8v&>HDl7nD!BhuLVgvW_2p-Wf)R{V-ovU?V^PhY>TpoVYjBO^K^&Dh@(m
zf|>7tA5^uyqQsuD7<3wf+5T#QfkHbbv-!QJ-2cEJwN`~zpKD_0s2<Jc$h^1+-|KV6
zX7s~Zc57Lo_Zz5xSsOnGOFIk6dB5iVOU?1zS~gg%1e_6T-}9Ht_70W_#Y-IW&#PK9
z4&1C(eP_C_h%!qUZn;-eJ_$FIZGhZmLW|n@$tDyOC<mC$k!!catgK?8D)bxJ^K`t=
zM$!CHjWC1>R1}m@eB5MOXpq>Eu{yElw{}6a`{Zcph^C)^?>lM6Ri9OmDAQIA{LhoG
z2~=V)J<wFWe9El2T0$hS8!p-7OXl!PQ7D$CNgIqC)G;A)YZFPDKPflVLVCU3;pfZm
zEf!C0G)t1~Pl<;q#5oq(vUxV@tHp`;;+8F6!By^CaUX2~k79b~kE<7xS?Gxxc_{7|
z7(bQ`MvEwaktNuDcNAjmsw<*D(8*5474PYE*wodus)WAXaH>K_%9pcVrvD5UJz`)U
zLf^jwrC~5zwoAjfqbrPFfB*@one6O{AP>)e7JLOi?chJo@S+m)PR`-Su{hBt)0Q%3
zoLVg5E?TpSlsO&ZEl5vv|6s0(rLM6td5|g6!`VfDiadIPDU`y2<FTJl=M+O!hM*)+
zyhDp~brVZMB1$`ivxg@G;pUo&63`@TF{jc{*}aA=ToJ&nciuY@oIX$|W2a-Vyj@9H
zj7`uXyR=s)*}T#cmFrsl^=Lg8X=dzWOL|+p8C^wpB~+-?%5bVoQt^kbVEwzi?D<Sg
z!Tb4tUAX*5&WZYrHDaVYL$pVquku~DRaZ22)*ms>a!w?LT(Q5*aUnuV8Pr|+Srzc_
zu7BY{y3jTlEPV8c$!q%&Dr#?CFUNX()lz?!eP(>}wJ*te9`Gqjx5=%u<P@@i_+;;}
z<7Y?kP#5u-Fyh*6Z`0j1Tgd^wSW~%j{ZmhW#rV{^8Pyuf*A`^L#W0MLK#qPfNK<Uy
zBRl;L{ZR3vuv=z4a12=>2Wlfif6yoJ$*b^U7Pw?1Zj;X%h4ld_CM&#TW?#5NdkAqS
zno*Kqp{u^Agg|0=1%KY^zPC7V@)hUa(ME~xaU>dz+M^bGiuf8;4S}$>kB^XEHH6)N
zjIHI&%-q_}MRpz60VU-Vw3M4ROV2ezXcO0o(os_kj_T~$j-7tPJSM+bp&lM=e8_+o
zLc>b;$afr#<Sn-OR(d?_ZBJE4d=q2a^BV@3vrfiOoEPTmMl>(wnVYOXAB_F2x>Y0+
zU(R)K2o8iirgNgzQpw%BLroDcNCvKda3+7gVjegg_(|CnEXy@D5WF{*qlX9XAWVwr
z2Vce0m?-2S?9KVJj`~Fv${>oT`bp(6B)h&o7ri;Ylz#Pa{La2$rBDdZ$}YO6yhzwx
z*ChwLQ$&%PgRrQ*SVpp+Rtn>H=y%{Jh+cOi5|$?&K?dJdO*ma<mG<!de)6n;D*rH?
zaxcvY1DRb|6a#arx$^o#ZyR;WuK;O4mcJpsZVGK9ls2R$S2Qt6NUfk#)pduXy_a*f
zeTRNA#>oE1aQe1ql_C3HcSW7o7Al;Z`TVwYb-!sS#ENk@J%>gT!9eCu#WOke4(&_F
zq_tIoSoF|Vf&?dnFRr?qxzODg$rNKIe<BbY&>yPxXgnW}he&t=hzMzBf+^ope5a8!
zpI!EVM8x`5`T8Z{#K{Dr2$4OG8U1m?>UD+p&@AG|^R4PpJmbsr3O;gVxSRnu+;MVo
zeDnq96{b)6P6gD?7wr_$LrcUkHTP+1S#@+X^{U4g4`IqrNK1)WlwKV^C_E+ae_Y8-
z$=;Z+I)0B45q^2%?nPA|u3du0)2;5rAmFmc_7oYm#mb>_K^P?=2mSozChCb7fiLxz
zZ6ISvismM@eWsD2K(~!&lzy4WeZ_*q#Xraad#oEKzO*39KUf~A#(2bIT`NVR5!t0O
zzg7@bhMrgUkm|i0@0XyYGw&sAe<>GVO@J+4+-s|~D8`B;^TKDdJLZPs%x&mP+Fg@a
z#<m1U#LYb0Vmooi;jcmbDhLNI&O{p0%^e~k1QS+5aV)0|=8J#q!FjFHxrjqH8f)M<
zF@g8OfARqX`eNqg#|PvELIhz%353Dk%p9L#O@kGVFc)4nay;RRT-i97f0SlilCehI
zSKn8uFWcRiZ;ZirL{dDr^yN>-X1mrsJP0yWR%@wL@_938oB0Y_{Ya8dxakzrAQ&oc
z<snl97t4SvDQa;Gyn|ig#9g%_Yq9VeW0Jl*rtj4scJgj*%`_mtW5UB;55gPTygDmb
ze!$i7#cl%AU<iVGbhlzwe=vD)-LU=%g#yGP%^Imr&Kik)uMKI+Hx+UETtxZ2a@$w+
zm5J3dG?%@0s#TOen5HUG4_U71oER)BpkWkY!o(s7ZOUlVlm}{z`r^6O7g8w04t&@4
z6L-X3{a&-EPWG64stvJN^N%;uNMT0y`xj+*UsVSiN7=@mt(aXJf1cMW*E~8sM9Y1`
zc`-xjNEJ#{a4S50zX@Hl-<Gn76zOe94u?e2ly&wDwWv)P7qm7+l&U1IkB(yAT4^c7
z6T8yMuCv^&L(H`R{4?~yqTw2ec1$WpR1W0v@|f-jCf<YB*!5o+dT$ftnCBO?V5_j`
zZPm&5FZ<00%O@u!e>it+5fdCvu~YDPxw<<UYc%xr>NIQ&sXQf_ltXdWeXSvBEe&)V
zZBh3LfvOy%HpCpTK<|P;@!9SBk@ATNl`mV+I;gO=h_88C;VePo^SHDi_Cujc=<e1`
zN~#gygaB)lQiuvXQ!)1(Wz1AU#z-&1tE1m9D=}bKYh5N>fB3lWOV3Z#)toNEG&!$(
z;jyNW-L96_UUzkdw3=y>7bjv#;}bUG+XR6U@7q9w?uaaVaqbLuNWI1P$umA5c@D57
z?yE5Co?-GorMg1jkFL|KeA82O5Jhe8wfOv@B~+XS?OYy_wvRh~hqm*AG5~y1)WV|T
z3%EZPSKmXfe}B2Gz}(X`o<v{6a{;vAx)SAk#U4v!M?oB&Tx>rLZx76x4{v;61rSa0
zy9Nwbw)KOF$)hw7J%0d^)?p|O3|TuqG-|LiXyvu$VhE{|Y`XH-9ScFjC2||$sbfrU
z2<&9}%AS6x&(4-S_5ZY6R{YL+AYt1aPSRq6tVcz+e=<M|ebRrGO6A}kQb5d*d(Q~q
z-4urFm+u}peQR2AP(KP%4<pqP>3*oDQ<`Gm->{YGhJdLQ=>}#pW$3DlRWNj3XgjZ#
zpc;%wbLpa4gTwKJE}o^zaz#kK*x&&x<UO@n2kQ;LWV$m1;Lf#GO@2>6a58Yyf;p^i
zUaJ|Ve^^JFx<nAJ6!*#KE2#SNN>Nl1DAaAmPa8`xzm5CGTjZ?#jC1F}qv-Buv|%7T
z<&+#8xE*7krcJwX#R|j8m#N+o;4B?EjKY+WJrEFl4tt=Qg3F#mYB9h<X8W21EiyEc
z?C?-cp^r=W{yCer=hOWgl(kgB))l*JH^iZvf5YV)n>S&3S6{Mmi6?g^czuXDp-NQ3
zstg@>Q}9UTl<P*$j;fg$q`oXWUzgV~L?krya&c6ygg<?9J<p3}n}?Z!oLs`2u>C?`
z8P!im#rt_~^&r>&hO<>@Not?s4P^v3Tt!n7c9#crvFq&8Onv>MKE&4A_T8d9VbXYt
zf2bZwx}cPnd*r+H(IS;6TqQS`XMT8_^9`<(&f|E8>azJ5^!EY6CZ!^0YC1$Ida(J8
zu<R>7177vXOKJj=P>I_wSszmrR4V(wUZooF;pn*;tLa_u^=S4+gViq*6~QcVEQCC%
zcB2Eamg-TH6IDbPfsu(%;Q^Q$w<;snf5|hl*=2E!Lb9&9J-KKUKYmg_LN2;#N;WpV
zFhdxL7k(j_wFC=GCrcpdOmUH<sjT^E>^4eY1T4?@>S83=;)4SQ=xIcn2Pfz0Xd#PO
z8wm&YGS6RmQy%PRaoyxNwgjKGGTyMU0!M4?dD`{oxB(t(o5&$C@`%9$r?}pIf4V<=
z^$tE5jlDgcoWS|A;+Pl09+V5q(U?tittO;$fT;d(;7*}>s#FNoR60I8fenLwC(C{<
zEbr%;1@HR!xfN0dK0mAsQF<kal3z}YUa6f=1i%f`K(tOT+^tT1U~A%$YE%YUS7*Vv
z@2AcBy~~m$Hs3wyTlk|g06s8bf5<oNVq}|UOD-N~B0w+YDM=btJ`9WKD82H>TkzrJ
zdy9-Jnj))ok{*|Bcx3E%RH|gxI7+!8bXNo;=bufAAayIIB=aM_#BaC>Ech>GsRXa@
z=8CP%k!0TUTzlOI0vNRjX3o_4lg+{wj!w`&Zj#)k3q7<39}=oserrzbf0Y<_e6uGx
zfsi(ceON;N6D7-m?A7r8dwVK%qi*2Qaioq|iCN+2A35>#k#KrGAy>l6;Plo+(er>O
zJV%e)WA(JaT}mB&T=O$b*iI|%Xf?zbk;eVb$*b**DqPbnS+DuiG9p1Z-VOvY23r-8
zq(ZOhF1+ZHIEV5GsD}1Je@j0HVyvRZF_a-F>u9@ewGT^84*Kh=By2{isMJ#VS#g>y
zaiM!7j=1(G!U*jVG`z;Uv(4;e(){HjW5HO5#ZZduJuJx)=HLjoKf<TD>v~>qZqKAu
z?;MO)xW#?Y3z|>9L$u(pq+9TM&F>7gk9Ebv=F!xbo-ELDDH}@1f5Q6{M>b%sp4KvU
z>><Pi)@?NlM8D7JCV+Vu4&ynM<a7G&+4?oBGJPy-K|QOAMNUVyP@Tgy)zdM{<Sa?V
z##6$9bBwRF-UJH#OPHA^7O?I7-iTR2zahx##QStdLIH2LTPz+1nd}pGF6#T^FW0u*
z!m|yxzT8EgZICjde|zH#w|L&$93n~~=nRSIoKEBEb7fg2ckq0!NR=l0{ZQ@x1zW>o
z3F`cgb-lXxBR-<B#qG}THir<ny!4B4w+}n^Po55?;;{5?2(g9q6|blOTzVbyaz5{B
zh04(t!~F1D37Wp2+J~_yM}uj3iMo({LM?oSD${bw7ZPI&e;t1;E)rHlHvk%ueVgjR
z<$+crmge8{Y*{K(TIiq5yhev|7lZm@VSg({ar(`)if+pr;-L)9w^mO2qF-Y?I&id@
zgIG^$ZvRq7!s0zq)@4=c#9pnXAP)Ytj2|yN`s2)_c=XT3sDZ_;o5{6ej<tT31Z`4A
zv!J32ni=qbe<v9?H5#u}!IFUpz=5<!A;r2Z4O>Z~NA}e11iwV<qMRrV56f(}dLhIc
zl7O_H;W$6nORqrVEeooaD$+}@3<wNiitU;QQuY}Uf9R34zOe+_U54n@z3AhR*b-$O
za%j&^&G2OB{f`hd!gm`w@Vc~x-#uZqVGTA)iLkiofAmCL-WX<-lI!xcnXov7Ux*yD
z5Pd}88r5upgO`FTCfMg0EwQMdwq))R8x|seZiwuBr{=L-6appTt~xiAptXu7b~oz1
zm?<>+)$42fW{Zru^f2k;BVlRG)6pF@>xl6sTb}au!=$4(?2$eag73I>cPPsWWFEDI
zp<rPTf7ZZIyy|E6`{`*oq-80Z8o+**BE;|=_*{*9+-R5*3KzbDg>>C>A<L_i0c9lw
zY3AFsey7Xm^%X0a5p$V@g)gq}n1y0JGPAf!1+@L_`S2|qWV1{!NTQ?lDqrUk5$S`D
zrdtVsM-`W%XrG1W=7DcwSYGs<P#FW$FV7E|f5u;_tj$MPu&#wtee?!4l-@uE^A>8?
za#v}_;cCB>=;6K2##xKAH=H<&oJ*iqi#wsd{#aaD@B{NrlZznA?DwbyBo6R0+vDD7
zmLKF^Sr9+d8}B{8%e_?Rsiv<pJGJJcV6Lr)SZX|?2;$am7EPBj3RbR}#He)R#{2n@
ze<7tQQCoFeAT73xZ_LW+8CayVakAw_v=Y&2@5vPYDqn2cxi547*+;<<t^~WF*bT~@
zVph+DlB5-mu^0}<LKamsQ}64RBn|tRcCHBlOks!>5bi2ZQe1~|wDbr09z^^k^7`90
zsUPBC{u<HOQWRPMX=y1D^&&+kSW^6uf7TPrn=3r0C1juG;VPaO(fS<3{gc(Iv$ima
zn}z!QcTC0S_@XmlaxU|sL|HPhtDfF5Um&7lpc&<dmI;5>Z(YYL#VA`+ADNWM_x0en
zLAccvsR|_PG>Y)AW?>~^$?;llXONIP1PL?F`tD$~WkaA2_%EaS+{EY09c}k@e{NNB
zFeIsWQCyHxY&N>fhsWIKU@*OR0v}AHLmc9!dmrXO2~laPr7lyD1~qcqY*<3ItNF%e
zN3#V9vBiH{!|~^L#AGj1s_Tgt+t*LFt*epP_yUsSkyAe&`sH;dR#~twgC5^8)=eO0
z;WUV<?Yx8L1v`Jw){Ig#OS0`$f0~;`!={=V_$JNRr3kl9PnSpRljDB=yNs{gBIWgs
z&4ZF(zOhmYHZ@x??IfE_3LW{c9({jolk?Ju{+fg{h=_6d@jeNxknZaSY>D2fN}XX{
zk{Rj-|BFW$n5KaBxYc#+TC9w_(q~Qs@@A;b;c+<9v^R1T4?mcGh^v8-e;rP><{$NQ
zHU+4QVaLw5IZiRJd&7#o!;KEzuMIRst;s<Na84obh1DpE(0*ukE4yAVatR5f#(5HG
z&1i*8rF2T?cayCQ6XDm>)Mg-YrK1gI1t$$hc2^F_Zi0!a!-abJM43diWwd4d!f2*~
ztc7{ZHQx46tGiNGmku2*f4N_O93kypWL)0$DEJfE){i<mtCX&Iw2l65kdfr!G_Z7t
zfb8c(1GH~uPv$GF^do6-W=!X`W*&L(6VJ#zHpfZC0j?h!F`y+-d<@M55PY^V?b-3o
zYIG@$j)ynj8{D^3>ZDzUnDgl1EPOTpVJq!8HEeiYH}2DPj$(?&e+*y!5sa<;U}FPA
ziiwfk>X|%Vv2=!*sERDzp14TTt55xu{R!5*FZRJTdvXl#IU?2<tdCEgX1*?9$r3=L
zbg^$TKgLM$=y=vS>l*vY|4#rOAK~DPtN2I=q8#Pkg;-7Ns$0-!f4*?_uHA_VPVl)G
zu9BV2Ua*G`Ce6fMe^i^a&`zJ_BkTql>a|kX_H%zi;nhVccX@r^N7QwzTZrR}L81r&
z1)|#pqhdn)I&d&<D~iP>fbHN&4q8ZbX*ube&$Y|@@O0b_!Rl^ybem1o1E6%%a<Trm
za8Q;}B1dTmf;{(SDw5a|9WBfL@KU$KqwNIMjr`t3OYxGpe;rJTV3wU*tK@uUC(8r$
z$Q_&f%Ae9jGl4_4$+a6xs@toU-{4hG3qrZ3K4T9X1ik%{m&Q_V#_#j4x{;wiu9kI@
z&da#!B|UhG#}!WOd~Y@nQJLJN4&ekHj$A#siwGltLl<*MWdqf1xlnQ>zzywQB>0Dr
zq=IPIfkKS@e;xKHIgNkY3<gfjh4+og-|Uk*Ko-2{_U}|5r1!xBeeJ4=#$EvM?o%RH
zr_coZele;?OOfo|M1Kk&wA7p1Z1Y<|D;EtF<O4j&7S4dMz~OFJej2tVWa3HbiDjs+
z7YBN%K#t0|y9S+MSxvbaxBKD73$e@vDwZrpOgoQOf4Zgh^)dEZ*;z4LZ-<}{S4_&Q
z!j^_8Cl8&CM4czjR1GH}t~~{&{0#*vH1);qc9c+n-JmQDmD@FU#!G(MlV_nwMdt&)
zOY3jL>j^z8hCR<Pb=t4ES&`QAUy|I+E_cyMi-_4|Do7132kJIeI+r;<L`nvb_B(lx
zRWoFie`PLbEd#5b%ZM0{Axie0-^Vh`#$41EMd$31Xu-U2eZ~0xO-aMkt0)5!8;^Ic
zZxI7p@mj9DA%MTr_x&Aw1E9tH273xm_gvgJFGM#lQMhzM&7T9$*Z?zW{7&FMntwWA
z^`3Lz9E_VdNX|W0{tNWz2<X9I#YAxrtsN>Ne@T=@^*?u~0V4H#^ly#o7|jHJs0vNR
z0CH1~x?_Nk4THOc*{#viJpePq8Pqx~Vv3x?f>$&|Gwm#Ig_r}CMHD2^Y{>jr1%}lW
zJ_RV}SUu+wqiADTqbJPkWU3lpF{QK^r!)eo4N+mi>#G<Iei*XcT!FOPu<T&e(i&;C
ze{)rj<v`aQ+m7ofgTx;&RLlP9aH6f_h8d;Twas+}6wKre&`8w-w$A;(lB#Bu7Dqom
z-owb*Gfa{Qn5q#*ZN>fJBf*m1XI^MU@xRBNOwojHuQuzP>Pi^u2dv4CT`8b!YJfaN
z^(<TB`X3Ni<5c%BAAN*L@z7l|<coh$e`@6VNg(4lg}?Z%mocBn^o35m;HUDH-N8o5
zou@RL#W1)2&sbVDJ~l%SM}4~HM63c@o4am;09gCTUSuT7R)Y0Gh&dq*m@q=``T{hU
zl2%yx^F>L8%;NlQeI%SV!cJk+docJ$Tl;0ShE$JX<{`wyWOjI+;H4=XebDEqe>yI~
zwj(OmQK^fkrD0LnlFdoOavGCMLjv$ds0~nV+6S#Pm-9x;6)tJaMK1uW{R?$+xTu%1
zTY#69O_h279&f3Ax>|cQr!g2D3BR6rhi>#{lzD1B+=u2yeAY5=&MrVxtCs7&o&43m
zQ+B+5Haz8R7u~)YXW65nJAWeme^`F_)YNng4F3EB?Dd2fkI66@`E@(B1b=QE9}=cT
zsE}@&qW7`OO*p%#T1=cEFb`X;9pOc|$)lkS9@fB+o4r=D#&gkd;<dT(4Qw^0RIDaJ
z__a1Pt0SK0FVnUhj#9R!>O5Ctk!j)_H>#pQKo?D`rfab7&^vpqQPRoXf2lna<bnH1
zAw;$+I3cRzxN34C$HtCHo6G<Aj`?MJ$c=S7%4_x#1Ha%Q+Lsl&oU61>`i7KiVo36B
zGVRyo(}Kg1>;L39@psU;6ys;<&UM~^R@_mkh*@DQ6E7Qg?T4_usj4?(7xRy$-EevM
z@-~mye7(U*tY9mXoJ$6ce+%htoISjRC<{#pIF$p(tFr2~)<TPpHQmL+Dh;#cezC4{
z_QI7YsAN@SsKDK~{Al3w4$qMAAeZy7H)G83yNh>AvmC6gcF2}ut!&5Xw;E2Iivuq?
z*|&L%(dEa>XS$Fa<WGSyF}Y5?!LF_+6F$?Gqn|(s<ueR1czr*~e;f>zs58EKxoOI%
zApjzZ0RRXx-c%Eqz5;gSt$Neqvk+GD7qT1_vvUN+5IUI77xergF5Zl))ZKfu)6Xt$
z+O2IQ3_8<sO}8w4J3!j>;WIo9MY}pj=DQcvk-cfGuZCd7&V4C2BT!yDHUfV@;c1-A
z3w)f={DP!GE{*uje}DQxXgCc#?myU~y)i+LW`3mPK~>BD(YHkGL&%7L*-Fcv9$a}_
z&T*(A*~h&bx{?AW^fb^QJf^%cp!HE@fmqhnaI^r@Sj#z~*>v^>hM>#7S+`p5Y0A24
zgvthY8!@W6yP>hr?^GS8VQn|biL$~$u?0k32NbCvS)F4zf3yjjulQdqIPX&#kH^he
z$Lood8VEn<dt`3zYKt}CfXG3o^m>?rE1{$!WQlfS%ErwFF0KWzwNyGLHX6qqn0s<0
zW6c}K$T&QJ7~oy&UF7^!E?7FGM7$T5jsMqJ9$X|#b&oBYY|9iMyB^XAnYq4zYZs7k
z%^cA`^zlO@e^BOVi8)w(UR%t2>^T62fZ8_y4{yD`N}!?$&9pMH&<0Tf>Az}TKnPj=
zt-_<aE^?V*u`3N;RRAU?e;j--5koobo-pk_f;Hx+R)@YTzzAukd^Ex;dtUTw5Od&p
ze11*7GC6s^h+V;q<%dztoeV{Q9KvHzBn{r3uIRDZe^a?M@SG>)zb4Py1pA+`YJH+_
z%F3I=a`UcX(WLrO47s-j+-r_s;n%4SP}zN_1ys0PJA~nV<NsZpO6}g6h^s;$YAK8^
z@#{O@+7}v>pblpDBLsRj85sVG5>ULP|B{AbTUdR+Oi%aKK$}1QJO|d0*&iCns=$w;
zFFI{lf8RO)ubO-jvzHpLqYJn0M%K_ngNm36>@M6epyvlJzbg8BAwNcoYBW6|S;5Ci
z)xSxh0=gnoUJwgBCiMy2L<6YCovK4rC556m(S@l0fnj@6jM2ulU;AZbxEf<l(F)Ry
zw<f>q)#vbykGdS-W(tON#tC$hoHKOVXw7vRe{uzda+xT=By=>EtYR(XQbBG-?o+`^
zWKT$2g^SvoHQBQi+*2@CZp`0vQEx_i2I+l{O!+nB506hqegen}XGaz_^F2GtT8+&u
zw%+=kZh?gSIIA8BeY9-ofmL9fu_c~2aK1zQBueIyQvX0B9YN|1<a?L!D81i#_d3Oq
ze?<2+MP}C0^-%2K9?2Z-F+~p_RPIeN3A%Uu+w@ROgz*#MjA+V&O#RtpMvVqNZ}aa6
zDN4zJtk&L=++>UPK`?Nmsvy!0yO##reiM2t!tgv42d`nB#r#h|MPX>)Gqr;4(?&|C
z8_hte^(zZ-62Nm#EAt8q2HT_J8-Q+8f9K+r+O~}iH9gN{!`nQu-U9tfdkRa{>fd&Y
zT1x4Dn5qa8UqfSOE8k8z^(!IJldrqc!Cqros~;T&^ydLrz}IWP^J}B%Py7k_kkvyC
zTVmp<8UK-d4c(yNE(HhIKrTzU8%Tm?b)c4}WA0*S!Xfw7NAWZayNEUX!9wp>e*gip
zCF1i=Z?MO@LTAT-HyLlgCeu*|wT7Ok=VloV>o;yAJwx?digAc)GqO%Nn|$Xx(sk^n
zh&5f2{B;cme!#@dgPJh6<8B)rk+kHY+jfc%X2#=nFa?cM*uvW7Ve=KwL}aos#P7~H
zaW%jt=~SwfHbJv?h|Iput(vpHe*yse1XjWHx^p!M_Hie4Jk`!jv9a4rYne<yV!s>Y
zKAFMtwTsarQQ0JNpwXgiz-o_&@__rXP)@#0zpNq!GuvAr2=3Ym-KKJ_^c5#eJ|sz<
z50?@$y^i>=+lZnQwQ6+s&wumqE!y`cEkQc;?Ep$m&VVI3L~P88p9~T+e_?z^m{RCn
zP^9mGi{;L|wHcfX(sZ69ksv+_Ak+=o!(Bwbf#FeJ2ULcSRwXtAI!va3VcN<UT(3Yt
zGT$M~Sf$%9vhm<bZV^Gy&Ls2>d^dAini6+W(D)H*lnbiGzM^3Jg;u?#=?S)+(47?A
z)w1g35+1E(Wxw@<d1~Cye@^=~5R1&(waVI2l^Epd!U&098~MD-F%?!Lh|)+Hte}_e
zz(R@3ElLbD06X<6dH#gc13dSX6rU!_5Wi;~{LM^`f#q4|j-WrVzj%+v%+tv3TBRhK
zFp@X}9P6ihWRD6w$aOAzvAx?CTw(Y$pCKp_zOrHSgZ4#dS9ELcf1qC0-|^aHk}1Xd
zq96uZ0;(0iXbaI<--Xw(5H4!nHU{G(hzF>0;e=Y2fIADyn_0j79Rx?txtOp6hz?oC
zsdt8cQ6sWqB!Lk%UR=wWp&Pg+B93zh*!h!K0(;bl<L<^32AIQ`FM2@sGiD5sj_Xg6
za$wH&0RCsuBmp!&e<S~>!i7i{rFwV$ZfJ<iqX}%LcuZ$(#Mv_MjF{tfs*y~L&JEoU
z!Z{AtPf#hE2P>}ENGZJ13G;snK%PkUJ$uXK&@QF^1MJrgM^nZs!wPvfUA>O#4U*_u
z0+N)uRw&ntW2*l8qX)t6CEfX!=~tI#0KK=s4n<HP`$0Eme_hHOZ?J(2VupvESvj||
zQXw<=hbyn)mXX|fEoQB(-6%Eo`ecg=a9w5>2AHX1!Jhvp?LK&8IPD_bt6yUM!g1K%
zr>S(fb<5^EC56&NLrLAJ&p_cq`aGivBI)8ebQCbhB{4htbHxdiDq<-j-bfvLyVX)0
zkq0o%F^f!Je;O+6#odyUYu}oHpF*Zkp_qoVp}nW&nse!x5XfFy6-u{0Ib<Y(W>ws<
zbEGa)$O{**?Hg<WI3$5i6-rtXAFvnx<N(y)71IM)_eiBE#Ei#|MonCKrE3mW7{PIN
z$lOxCJB)_h7=^`<6N<Dza--mO?N;hs+WLeK$1Xame+R$B7R|?6?`#yCe|`Npt_UKq
zTrtd7W&)dFjD4D&9z<q<3y<>cSr6EHDe;I-d`sP4#d4h784^AXCMNKa)75Ck(duJf
z4AdphuAchKO2~nyXa*ULKG{|=;YYbqQ9LpEdQ~SRL!$|Z0>wqv5X^T<v|?j7tu2HM
z%B@%Ze`!<AbZi=pAAUe?lbJq(oYlF-FES?weLs@ekn+(~L*xn`c|_}g+*bOQA$--(
zB}SVEr6hI+-Q75+LO*X;@C~%~!=DSuRpZNJWa?F56}sxaFz99Lf{}Hy>L^7bn$|3h
zJ>A`6$s~qgwhR+Ol3D2pR}9Ja(CDyi23pEse;ID0D+0`Ajo)<yC-A&UvC(5oW*tO)
zH6D8h&ST-QOe<CGS_Yb=_-$W7s`u`wB(|bmfjg^I${bedrfFdA7lQU2$AMbrqT?m(
zCP|KL3rUdv+UCv~3uUh_Dv5W)p(7ZO4j1vk@LS0Ccv~kd(oqfz$@j<C+(dhpyC-OW
ze-tI>8;637*}{0E$tWJB<}yrmKMv05Zl@y*uLt(iqTN%hj6!0L)Kb&;o)V=^qB-?F
z;asLCYnS#cLfSzyIwtvUY=G-71Az)ZKE^Tjx`(YvIOu{u3bKI!iowRKGJ!=hHkwB7
z=4$N=!Bo=$3>&+Y*<B6U7Fm0bpjv!rf7)5vwXJM15XJTh8-Z3b4`Hs=!{XzB9UfYU
zY8lO=BCN1P*eJI9bv+fFn^Wjj#lxoL>&Y1x#9oa%BBGxd&4qZeSh-sCmX*%GLBu2V
zd})!aZnHwr7^g7*El1_aoi;^nr7BFT$Q-SK2c-f%y4*E#L^T}t3}F~5d^UP1e@Z#p
zzrS;=ZGURlp@GKht*RRwvOwuA0?|NG_X2K&u5j_7Z*A*DG^9t!v&D8hymxu)9vgeA
zSx(Y6gfuRe6bXwz*<r1RP4YoNQM7i<FJVVnDH`oQa1_F=#5E!BXZ-I%Ss(7>Rb{eq
zU#VUmiJ4iM5I|LR0N2aa4{$VHe<5FWEa}~gxly@hEo1om^`g#+Oo`y`_WCzEdcrpf
zlN%+iN%J<VeFwVa1M)W(EtGoi5n7|wFm?+Y9Ig$w$iaPt9NevL3T|y6<(Tly#b6s&
z0@1^I=`nEfZHN&kIUBvSkAL{413De+AD1bQB_k3)CwJLpb`;e!N!1M2f43p!TH?P(
ze&)>QEIHYi=70E2grkzX#`88P&Vuq>xsx>>i9F+>{n>2@m+0L*n}?MDdF?btf5l3C
zOfu~*juyY5b~Arf-z~c+)qlAwGAaT-mBl|7+##N8_S!8+^)Rnqn+|x+#wy=zmYOWr
z(9HG95pl(y+XNu`FnQ9ZfBP}nSHP5AaK<ZU4NJ#tS)<W`V_c7d&`#s}Ee&mR+E1QF
z@p%bk5=nnOtfxN*m_N(Qn4k_&E+cJdnh>5t&MrKpf0=U*zbtQ$ki}YNz&j2PEpC@*
zG12iTsPH_$x%b&z+2AJw5VAi3QWuW2ld^r~XmkDHj>4?NvTp$Ye}$3pTrMmi%qj&e
zwy*m5VP^&*txu{QivagacRl9U_zkC#v!@x$^4$_G;P>=rq#oC#56HIq?@8K`4}W?i
znQ+@}4;LE;NM7;D+de~^E^*qE2EZ9A#szV9Ax6BH84h`}wMYW?dXcm=nKtmzyFv%4
zQqBm)#k7ay4NdBGfA8nDScLsI3v5~jyMcZ2J0#17`(gMU!L$UUZATPlXX7lEO1J^f
zgWQ`T^RYgirQ}i-vNl02ODoI+)n!Bt=k4rJ4tjY_@+TG2#ew4ZTk#@<;&YRUyQi`_
zV~+=%aht0Wnl>j>IzT3W81KV(*McN6a^fpKqL?K({zj==f4Y$df2A<Dq2w+Vz^oRE
zIOd?%NUq&?Kv##7lL}6JLOmS80>^=C5M*#H5|MSFph`7UVg5L8^Y=uoq~p05(Ht>*
zAfM%bLd^I#_y4ELMB8uqM1P$TY{leb<>~<e7JY3ZmX2$(LXSuycgqHrUbn!c9X|E<
zWS0jtZV#0se=`WDT<QLi7pv`-@-Pr5pJe$<6dLeKu|)bTgY(KUf8jHH#7um30xPut
ztfgaRC}8-bXh{PX5SHv+TPe_e+yUg*W19E|obNiw10?*3L~jO8VisMDLR9#+dsv+*
zY$vTTn*l#ie`)>W`I#lZt~*}Y5>Z#w_G&Q>BrF~se;I9(nW6-w&<qvo9Do=z%!5jx
zH6G2ubIi$7q(}v{-@3;|)*G8Q4K1^Ha1OI>kA}nh(!BMQ2k<E?JD?H@95wP4!RSQ;
z6wRC-m?0t9IbP#UKA+$|aa;Z^JmLQsO+k@7eg{)lT#of?E4AZlzE|P0nOBr15Qg90
ztP<P3f6-_8l%{xdM;Q0zJsW%+1G9dI>fl6v+TO6MQ<-?r*RbayYOu#I)Mw`$M5$yi
z*I_&>kA@GYv@DeFyUxzlAOtk{T@dc+IphM|_BRv!&R7?v0C_?d_%<8ug|^UhA#C(A
z;*N{hEa{fI_?q?BenZq0n3ffv=t=prLZkELfA9mA1I4goQYHN=8&&mOquB9xyST^9
z#b0SS-FXC=Cu5?eArM20;dW~7a--1%7|_wkCggrbpw43Q3uBY81Llp}PfxVhJXQ<`
zIB*00SByu>zon$qa(XUpy*_5cf~4ZllZ9Gssnbv2hLKASoDZWnldHl-Vo5ysQpQHT
zf7UdjDJ?sR5Nr-%6C{On@52krQmbREIeC|reVq{5Wkcp3c-=s2bgM>owe%A+01kJx
zggi}P(T;FkU)4>fW0!Wr7+*0|^LU#`mbD*29Upcl6qNVLErV%Z-V+&}*MJsNhj-=A
zH&F$o4r(fzV_kfwvYhIr0q!K7{%l5Pf6!3Be8R~{>NRa9qrt-fJu}5Zr0UiDZwpTC
zQ=x^Qs^StKHl2f@Z2yBecO{W`3yV|viF%>{>g6*fm90o=OFdskGQ_a!bOf(eZv+W2
z*;7l9A&sdk?TLbx$%!8?BA;;deptsh0AHcJxxn6SK3tUvIeK0fhKr9+X^V0de}dS(
zeLSp(Upp0iqp{k?=1%GBPxrjLxRKd~9m*;1nWcJHk4==hE9MTv4^rb^o6X2M-gw)G
z%wiIyZi9?2^+`YBt4e0~-Up?mCR-oEAIj(C^%_R651C()+=}Vwn|_SNdUyR46wusN
zs8x%rUM&s4c7DwlSZotxZz7b#f1413T~tk?3+{Xv6bH6ML+sVt*=XEoBRi;UM#W{J
zDxn@j(6tPT*<`meSIw>n8E|+vN_M3Fqwa5fZub1l*n<KZ3z3r(0RQX4?|~_VJ&`My
z$n(Zcsi+hW#uV6ZZDL8RYLV&Ojfyw9pgL3$98M>#NF&)`Re!y$;_6^be@7kO+{WLy
z(QvYTVO_B9H++KD9@@REK>LT}9Hc)WQ784{5}YyDd|pif`NyD1GF<0{w;T6&QI!c$
zRBj!?)InN9{ggkTtX#%eNGM_M3_dQ1Ne&V|#|`E`S%Ca8k*97&-HhhRA2%7T15byG
zk-?m_3PimXG<TL!_`34ff3+x<ue;k-k?zTgLVl@E)7E`m=XNGBF$s19T{w+wY~`^G
z%4<wXQE`L=$lVinBPN#>50l}7&=%v+)0=w%FoEgvl1f}jeSb|Lp*2f(#~5l413?Q+
ze&CrwSyF5!eh8wjdW;^h_Dy)Q33@ig|Dhsl^oY>kF?nvID9Sb&e;#ygH2s(gu*iW}
zr6-yXkA!|Rb`-dh6${$E;H)Y*p%uIneA1suBnJcq0*lG*k}*|I@&o$hD<|eYDUHOP
zI5P>}V<Vv@#C{EFd%)p2TkmhZQyllfsl{|&e*H~j*%0le3NzraZ@<z0%PH4n_q0jA
zuWJ{uR@XpEJ>9qVe~&kY%m_`^8D5*h92qdUt|D4w`GsCBaoY0@a$X7cCf2Q3CFX;d
z6=<?SM`2&l@x&I*HC)z7ru@n?DA|FQX<VAW$~?@&MmnX(>dN8UD#mg^qj-KipNE;u
zOy3_PP7AM-E1bFDmcMTKxcET{>{l)<crZhLFxXaM7fbv}e>7^33%6?lBC4CJXcU4k
zo_E-+6FIE3AsKCT#E?q$U3G#t@U#&_I=a3#yo^WOt0eWJP+t9VCR<%D1iJE_Y}#kl
z2eQeWhoDxf?|9;;43}>c`=((%!!Dhv#Z?AY4;^BgZPc)is(EZeiaV4`+wRmwSO9%q
zVaZdf;Dgnoe`IhGQ_QLm0HAdds?IZH@-Nw+;`MCB>hsZ0N=}iN@OYzsoqlbGo&Nvu
z*-C?D*Gn!@X=<~{c~M6e{R*1m_3a40e^rZ`Eo}HYW91OoMKk~91fxgr#BR?mEPKaw
zDW=e_e9y7!n@aEr5kow_8yMZ!B8p`3$27)}t6i=)e@-inT}<tSObPXVz<FQ^Lp<Q}
zvdWidf^USkd%;EI3O<Q;@bHS%?q}W@ZvABN$;`d5WuU_~m|SZBrELc=>ol({aNVy%
zfJfOz5bK|EEJ<d}V%BcS-Eqi>plc4vyqOBHd1_25uFr>19BI~v6?NjczT@^#Dib^y
z*YwGxf6yrg*Mln67|d0VJefXEU$qCUNzt+u^r94t&;XfuHGe0nhT<fZD$sawmpJIl
z-X813l9NY;<g8W<zr8Hk|0{x{LfMjta!qcDZlqc1#=J>=GoSVnfWKi46k7yx1msPx
zp$(Gy^1(&YijOD4lu9jL)P339fiirGdejY?fBH>}caZvb?ILPdKlFJkftChof#IU{
z%wj-iRZ`QnFSLOk)&Wx>N3Yw^q~$#m-<$*?$ppcCr`#X@T{29>$=vmrY+%qLNyJ@G
zin?(u!1T?^IWnti{Sh*!@>6tOE<^$@7~vDLvR``BqE|!@=m>-yI{GA3m-$3&Y=B6P
zf97D_w+WAUZ#wX2Fl+Z#dS9E0joIsZBcm9g@VF6-CP`};0{2_4&t##X|4THkxReCX
z?{2x}VMYY$FDEq#Hz`BIMJxwXnXw^qlVP&tpd0-4iyJv<)&)l@*1@P^PSFYMG;vv(
zpf*aj;3^F+ta#yxhTSv<0H9?wPOd8Ke^@pss;U%*xxV&7X|(ibCg@&{^rz~K%5_}-
zT!VV8Gs7&e^Z<t`3rU(iQqHamqG--_kd@Jj>J4YYr4I!$8_v}}lzfwCzYVuP8>P0!
z3b*8FibjwrXf-9z;qP}CMwS)h$|poNmQ&!2!>?hS66I>r7hAJ82KqhWA{b6ue|+^B
z09<HdffAB^T*DOL>O=~3+ts$W9Au$sxfF9UX~n%H@Ei?Sk5XKLM<{|<=1QO4$p%Fw
zb0?9wPq{7@LuCO6|9duB$IVJ;Q1G?Rutk-eb5-|_ewsJ*SGC9`z)40B=WK|Ss(2mo
zG7PDJKGeZ^t^=(J+#r0&qqE!ae@ZZ%j8pQ2CgtSfZ_?H#fE@ahdx6p9KRW1atILIK
zWWMmEbCJ#Ld_+^KbfI==a;?XO=uL%?1+;DGrfM06Oj3M0hgp68Sc-lryzu`(mBsjG
zAu)q`YNv?@5y$D5w3K>KY64R~$t?!VrM@Nh22rX(x%Pg|^*Vx}$oI@HH_-t3bsR({
zpJLt@`c=SbI2xp}$jlCOE0(X^xYY}^!W1b$td^j5WXrGABN$M*xCbyRy7Z@+m%#!8
z69O?Zm!XFN6t~D!0oF1CGBLNHhXFG-12Qo-m!XFN6u0WV0TL+#GBG%pp@#t!w-e_9
z!5acHFqff+0Td}TGBye?Ol59obZ9alHZwCa3NK7$ZfA68GaxVuFHB`_XLM*FH#0Fa
zlfefme|QB{l-=4k0#ec`Js{m7-5}jvlEVxP3^TwC4I&-VU4kGT0us_7DIhJWfP{c_
z35X!ysPB8udC&i^^?hsBntAqhUw7?&-Fs#YE0dlfuYv>I9;5<?A$bM)1SA1U+J@$W
z0ssL4VLkx?Av{)ABM1@-`Wwe%H34}bAaI!Ee}6EPJV16x6!ypti6UylVE_$JC_qpc
zASfy+C?+W&01y%okocPj_mBiUvh#vC0JQl48gLj0fyb%@ck}gtI65IwdH#L`Z~!?0
zf)Wy9Jipxm3a%gz2+$4&(6&Q5fm~4;fp$=UAsh$+A$|W5f<xK~iFA|X=lAyZ=CgA}
zfAGOQ9A!Cq0NxO!6Tkq30C{+U900#s2I$zig8pia504dK<OD(dF&M(ZNN+n25C8>0
zAwUoefpYPLIe<I>sO$hkbuECd8wmD?to4V$1Ndum0D^pi{|fh)_pd+@*l%Y$AQ0~A
zW(V_yz#IW!2owa+Rng)@`XG4#b})xue?&Vd0*>;x^Rk0L?d(y6-=*6DR21|9cBl^j
z>JI_*fVd$Md<Y2iSC9O^!l1TU8Rnn_cXb89kO;hA^*w@kfPkod_vQcVa9v<<Z<znz
zD=-A+0RGj6gQpw6F%07F2~vOb7Y7C5{Tp)xAps%+5~89af&h>^0OSL7;{TPvf5_Jj
z^xOCwM)eTr?*?}RfKhFL0wG`!>I2UoVdn(`AU!-mf&Tw#_~!~wP!Qk%0U`nRAV&xc
z@88i;FbMo-jXHl1h!4P003|;`fWWWUzn-j63Uh$NpuYd6|2|@VbyY({MNRI%TK<<&
zQ4#I~@aGkh0PsqP3IGHJ1w{d3e_|qlz<<WkvxEFq$A9>$!@zKW#Gi6e`}B9oUVmwT
z<F5hX1pG6W4jiRi5P;*~LVqkEA^=3a3I3nu{@dmMr}AG>{#T*@cSS0mQ0Q+v#~;G~
zW4CjKKz;vWpp@&0L`{J<95oBD|E8LP{*10R$N}Q%`rlS{q#bG+6kv`he?{{OKI9X4
z_y>m|R3JVe2R#T9==4W5e{kbp^9F^$KzeWl<kt;@@)8jEFB@vefG((81c8#~ZxaYL
zL;uXH3<JU)ehr(Dh$z6$!^6%O4|Ue4l?cFJ5H*z!AfMl22JrL2;7F7U0M%n401WrQ
z`*pB_A^?7S)E=P(j>7*yf5HHMAjAU*1p$8@<G&3;0Df0bC=%j^%KZ!bM<GB@4-eE-
z{#FdC%D>mYuK*Cp2L!}hn1utS!kk}+wO`gM(0cQJ8O2&z?Tk(|?~f8evdz8lchbVn
zR-JNJv~{SyKa!z0Umh_z8$io-a5?7l_-$_Ra=KbR5>2^(UGa#we_-hQ>03t-g9Dt#
zaa=4TdY$AjNuQp`))Lc_J;ikPI$W$rc<a?>(M=~}%R*uo;0h=?CuT~gMaC)Qb?%}+
zGiPF1MGl)kCXOfdu*~!{Qa2vIL4O8`zff$CrT*@_ZW*67ytMQ#cc4E*_@q#?w??!&
zf{dEnPlG9MBzcgUe<CSY;|&6hO;O}rsXQ%_nY!3Df^8YYR&4plbm2f-(x9+sqoa;e
z@IBop@0&d9;Ucp#c|FS~bT%6~M&J1f?l&h#JMq+Juqd+DIG~*mXCBrFL-TtvDH#A*
z^_?GYwWr~wWf$gJ=!;FU*iS-*tv4s`U)siHCkYB!rO80We+NImR20>NGPsR^O&71F
z(*R^NtYmuX7&=VOtDYkdc=*1(?1xmEF{Z%IwwvFz5BEeK!C4OIDW-xG%{sDo`*xDv
zsEeF`ATi-m7Dd)+&cVBEI1};`rh^Rf^Dy<=I#s1C<R#`Om=jEdi3*HJ=8Uwq&@y#!
z%_YMXo=y`Jf0DTzl+(XjtP*|yLMEhHCQbaQz>|*?M|U3S?<Ek|t>4q{`F__r(ca^T
zUkJxqGr!Zq$+lF7T?6?r5z@4qc)hJ?J{5c<HoKg!_|rJZhOF$#<9u-3kN9s}XN`yX
zW(xID7SQO_uBo7Po0sqDJ1hp`=`y<~_If+m)3$une;TjOF^|aXhgBs9nZt^ql}!mE
ztx8J+6w$_(19n>NXU#YsJ@3IyXW#J!Eia@VZUnnoZ#U{3y8WndS9}B@C1Rfsmk?gB
z)_%$+;g5+QWfJs=;F~xpf!#!7h|nyI56ubOgtq~e(_Ex1+_hwR)*M4pf2Hbnblyw1
zMAlkIf5)#e=m)&OC=O8(|KX)4{OL2lnXc$NUj=wq-NBRHEh|%Z+D9SUEm%?J4_8W0
zBbrGH%@bzc7n<oQA8FkPt=kB-+^cRWhpVOe;|WsvOi_~$?XY*Xdr}9q!3i$UuS|6q
z=?$`#Q%_3vvsx0S(a(OcrLJc}8C7m69|viXf1n#U3BF=b$+JH$sU8pHj)W2@U0MN3
zia+*n;Dph6foI^M+~D#1x!Sw?jP-#RP&qmv*K!o|LA7;|LDi;Jg=@qH@drq0m}Z6U
z&{RB=`n}lK)31MQ-T!7l^3w)6Z7P-3_5L_>&{Lk{K?RcQeJR=WJ>wU-{sHUXzUc?r
ze+hq4DT899b)Jg*U{=v$7fm6P)l3!2daBo?>X{ZzmM4A^D76lghnm3aGd_B?=ItfR
z_0*>_N~Px3$&7rG<p~>DFRko+%v|}sDJ`37(qR9tmw{5+d@*LO{v#(mYQkxG8=kyD
z%8^{64i{3&ID0U3OF{io&l<g=KFfO{f19ktL48Qg&xHecAsp)SBatCyD0t6s*jP`!
z9_+6<Rz8ZL3CBMeHLqze*yrE#dYdqAS<v!ho}pQbRkuKXH%l!vB860XS&uzl<K@W5
zAg`nuo&lByW+&rPZMn1hUAfg1H?G+*F)zY7Dw&UZf{4I%RiYI6BAsLr>m%W`e`upG
z_2S^x2mp<*eo16#i!Nta13{I5*!1QUD`7Zpm@0nJRkDHKOS02b@K^uH32Tx^PM^-C
zHwyi;vep#SMs{Wcuet{o@(@B`cBNC_<+WOy!B^9-<gI`V;wg178ZmeFQ0mP)no-ve
zU36ur_J3B&&l&@g%RWJQmh|Atf6tbwHeJv^WN{IS;kaX1E;3>5U0l5xo8O*(3~vju
zo@05#7W?J&#EL{5nwGHf2GPP67WS4uac#|-Gn>iiOW#vFf>ZR>s)L1z`c=x{4nyVw
zsf6vcYfo!5!)QDOk&`S@MH!Nhg<i0aSw`zP)maI3<L%7hlNaS=R{U6_f4o6~{!x<y
zL-P64>D<rgvLS?bZpwjnV{WjakLwN7pJ)6l2z1Ir&<>qg5#KAm9_0bhTIN=DiYP-i
zzEqhkZj23vcG;C@Tb*so&G6u(@1NKs3!o{PPQ;=~x4KbYJvOCS24COTOC%ZstTFWV
zne^Q*aNj1<UbJ|KUbMfJe=4rGNZ;-n*zlTXkZ{5GC5fkOR7>`ClcISvG`9{&ai-oE
z%$<-tG6=J(TFSBaQ&o~<W(^4dEfsq+ZP%rbipGr;8|ZDbY`$rcyzThFIn)ua{9t~&
z*nz#O_e&QoZ%Y&YJ0UcF+I|4*aeQFpLKki9{3j}W*OBlVi))&`e?l!n@$v4ng*f2I
zY2!GYd;z^GCPz!H_(QAar?b<hJkHE-*zS4Ub02}`zG?lVZN>RHcksw;wBN_x*z(HP
zV+)X)VBOHNpXH9%O`Mk_4a<g#h#cgW>dYuG$v8sIL&N(nTy#tu&Aazi=B2k41MAbj
zy3~K{#a=Pk=UAK>f43HzXC)RuSGc~}a}8@liyb5S3Jq`#g-^fRD}P9>|D~0pI;_C=
zIaxqT!lD-==^^)%#G-tLzEtH#VEl*I3mD1T1G{tl)#vn-yU6))jB7PecEp07Qo~m-
zor5iARnb8Fl0AY0?EE~dM!^CFs>JTtRPKPST8@ntlbPd{e;C!WDyUe9CYaWg+;7<<
z-)3Lthbpr_d&R?%2s3R!2}jrc-n6=iLux<%PxVa;ep6b#7GVJ`(U0yh3_Ro|`o1cl
zyzkZ&Lt|lh)qJWjxEfi76IK6im3qEeVI#HWZ3hzCSvRJ3Q(%c^6zqc-(=MbB*Nf(A
zcmV>HCzOCoe>%~;T^1wnGhC_(a*E-UB|w<tCVCG;SOn<je+D;H_L|5+x=2Z*{Z6;U
z2l@lLie(*coqdh6<AQq|O<V^zGghhHOW!*x4O1tbCLPXqw`Sjw@Vndg#VAT?If%ax
z`J^?eKQrQPDV&~bKSLsRz+-$y{aFFrxyE>3^PJ4bf4QKQ50?jP^pe|Nuy*$KF@CRl
z4)l@Mp}qx%aPUQw9xn`j)_&5#E<Iu1v4RES-4o=$B#g}$3y$Sd7I~225P4h#k5Biv
zQmT+;`H7)|>*vTc5ykZq-ikJT*E!|`ug;I){n6slYWRtGLcgZBzT;AyTP~NNH5p+D
z-)v0OfAg`P-8y_NljtXB?{2RzT?xpcc4GuqtmJ!q%q6yoZRIwv^xr_}f@n6}y3hOL
z8HTa35y|KxzI<k(2^e%!qpvuRH|YwE3ii=T&K(3b^9x-nE8oXBF9lT=;?Tkb{HQ8a
zU(v5Jx<|iB*tIJ+)&I)s7dCxg<8{ltSrJWPe~&Oy-B+Nm^CchV^n>Vr%ajL2^r4R)
zD1Qh^c5|yy;i@eAR=1q#b?Bix?Jx!tgWW44nZf`|gmTr;?wLt`>)etZY|obD8eP_+
z2cwV1QS?eAv)Ls(OL5ctQ?v<0;&M(bDkMAh)@pL?1e<C0pno)JV)t9HIDM}`zsQLT
ze>*rIzgItF)SgPxo0a%cYixy3WB2gntMwyD*^On%kt9O;`KM-~9;RdRW#h=JfE={+
z2Uy=lOu}}-lg2SS?s~z27uQn(GPkkWsNXX^BDw*3y;$3bY>DGihWNmZFDYDj^xTea
z3Qu`zdEUwdI9CdZkSGm>h~<2n!B0L+f3IoGn5QES;`_?4QbtQV)G{Jan2t2aU2Tm)
z=VPYx2H`u=P<IjPJ$(V%n00kKInaoNH^|r4t)&Ow+8pgDOa%#-uIW>J?NVegIeWr#
zB%xf`N}1>^gZIoz4p6!M+~50djSZ2A@I|r8f#Y;n{ln*qS=$>qdkSThq^lk7f3L@n
zMu-?!x|b&(He$yxL>47Z90<PB1K<CETXo7aYuKMJdbZwvm+pl}QK@Cp(pxXv&-m?)
zbwA>$&boqpE>u}=^J&A1cgFbw3tGnRy-$5pM)hgDQ)M(O6<AxBofIN-zxpkhiRum`
z*GNYN9~S?XH&$P?fp{y2{KCSse{4SjU~`9juMV5KYewGEOIb6fcdlum<6-$RC?%ok
zE%TI#lG^s=bMX%@R5M9;rF}1Rbvy~|Qn7c6%R2h`N(K(mkva{<eNj-M*Tl^(3hGvo
zoK)JEL_tl4g`2nL=?kz%nvggwtgM6?wlXg3c>2L4_G_R#8qwPQYqmE-e*w}fWBo-L
z7o7}~H2bxrw>t|J+^Imq>ZeW81y6k0UH1^uS;k+3CES>7I?+q@+ZVrWu$SoMs5Ts~
z-p!OHMDH&f?RK_mAcdU@o5^Yv_{l9i+J7pea~XaBaX^m0r^6mbKp*GtPGxV-A<MiV
z&b9rlb7<71%vbmlz7}(d_6hLxG=Excy@w#-k@s55rB%^W{0`bgid}~n{>sS|!^OSN
zyn`30SF=d?SSU<Zx14B@x#xZ^EG{lARu6Y;C@_zJ;O2s>8sau3Ow)AvlabRO!q3k$
z+!&$yH7`>1H?yKK?N`ev_}xzLG@iboGfHvqRGAdVwD~!sK$6@A+a=TgfPZ~k=&Bj-
z&*mp3J=2wk73_MlZV3^4KTg@OoBQ&Zos06u-R!B+9oPv{nsz4E<%Azcu3X5Knlo=?
z9DLSNv!AxQR(R?AfMdPJmUYp;f|j_Hsa>BTmtTMlvEtKm2HsMv<gS|Wcy_3~a%hR1
zTy)gcq>Iyk$#TW=T85nFbAQNOuH24;yfBcH*h;v9CY^9+hHeIpl}kHNjjop_>uYhI
zl#;{C)y%s?9&R1fwSwf%H~A_gG{jv|z;FaTGHqX#{bEh&aeAv8CuTM0Io8iy8^&ys
zLe9Dwj+U#O;>LU0+O2qv^<f0=172)RHNzK5D_?|l(3-R?5cS?hdVik&NtB58*74d)
zy}W1Kyw9u43yhy-)Tw+kzSLuG(;SP4;I3?+GVcV5k;w^Ea-^N(Kpbdkv$Yze99^&_
z-jZ^dtMewtLTz7tJCL%Sq1f6~n7~n!Y<Trz)m)9<UNEI`txavvzu7x<(7@V!GMk!^
z2k!-oO4)~WwMPplCVw<?ZYS8jlNl}KddsXTGHoF}g9D0@Smz7p1*)3!dQSCEbQ&z1
zG1Z4{cA}mt;T#!J`Ylg^akp@#r_)nouY>Q{K16*hD+|tQu(#i=F0t4K8sK6Pg<vlR
zJuZ7nvZf>C0xq;Wg?nm<2|o`a-f1}TTHWb73)1{(>YuAUy?-n$H<u7su6<(lUDA|V
zik!rYF)^Gt^RC&N)ZH*e#$?>+QZupyKD||SDY<+mqoODP-@P{o$~}y8W2=o<p~*6n
zW-&kS-6V@NbjLjPc&d$*^_8iK;93v1SHkFgVolJ2?59=ms4IZ7H(mCZq+Orhd3<&;
zpFc#W6^y<cT7RII!X}195}}`as`^Q3IzC)Hos46UdgIB-{Iy={>XTtwdXHDf$kFvT
zr6=`rT^gZn{K+cJqQ-o+0<v3J=x5xYH1(&$1gM#Zrz<CAc7u-*Uzhhoec&2at8*1h
z@4c@@b(i=8pXEJ8?v4bBkQ^17tc{e{b61fRzp1M3zJI0{i>Wt8gk-;(Eg$gR`ZC;?
zf^C!^t0Z!*>fyL%jMYah@}4CjG9#8Ppf;hgD+cFD+LCI;#=Ll5#tuP24VJdomlY0Y
zDr9Ns`U-&Hc)SpHyq{w=X4S8c{@(O{xbA!sO_VDkU+l~H>LXkO%TB6^Ot_A;^Mg&C
zpX?!9eShtO)nxO8-BN*!L`UI|wS%4mXE`M2K?!wo=iw3SWENQu88o9DBQeYSw~Knp
zw}{B(V{?tFQUNpUcIV8j1DXN0`kH~C3*W7ucs`2AO^GH9JY{=&(<d&$cQaeswq;M_
zr3mB>QtslG!yghUiDH9FoSC)g$xgr=&v4aMwtpn$dXTB}iCBilx?{irLT4c*SIgqh
zmAYcG!7ip(F2#lA9q1!wHSD3U59muMbBQQ=q>W2o&*^*=*Md7Ze?-g?3KK`l;%7ae
zr8!QYM6#QuIZ#M&D~r_~>1<%(WI4o&`}bR&#JaXT=Z~bmH*idx*ESbVQS3nDMg7bi
zJ%0krJpKG9qc_}*?Cfh6Q<id{-g7Y(Ir#nYK4(25iM5kz=A5^VDT*=AW5@az^bX?B
zq!g|76LiZ{gui!jDc%#V5A}q#VX(YeQ6C`Oxy`rH#RC1b{eZ`q$<n=I8xqJXL7~sz
zSNui09`rO%ZvO4y(9TqC;~fU#J*N!}tACgh`=c)0o3Cv<l{Py<(vz2?=>y!D#Cu4(
zo{Cz_@!Yy7YK?-Q<+}1ktlCNHA<JJ0kR^@tURa?KGmmLn`0dvxdr!1YR49f8L~h5p
zUDUq_nM%ll(*w)j0Ej0p`<l*#k&#W6x2*-v6%i%90nDWhn`Z}!vv~P~LzWcNT7NN4
z`RMWHq!jg>^KcO{7mAgiDGykKu+@?uqw!Svj0Kz_Y7jpA#cFxdDw-tg8<F#ONB5md
z@3mNnPTUVibLCl{bTZ^MwIEF(#2C}K&;F+NVpyhZ<CC|}m*@3%&<e?DmP=ic6}^ox
z?_QgUXk~#ICe3Bx=!p?#>o1ev9e>?_N(j_}l?OPa+?Zv44ugSnd^s+vi2WI*k=@|+
z7+l@&$Gf(q!#JgG$(jDmD`o1UR7&ZZH%b`%-nGwN$+0Ux4I6%7d8Pk@VNyx!tnf6c
znbIfI8~1Z(34ORq^K#BzHi9S2VH?URvZE0JO;Wa)ME&?)KUgmr7i)|x_kV%2SXPH2
zAoLh!)eK`A=eU(htT5l0BczwljHIW7eiEgpg|7|yYa<8dl!}-3+*@yTBdq43H9nu&
zMZHhfMa^C-5qCY(WYEQ?ej5qS;c%4qwgQ)!WR3J#?gTyAjTKb+{*}R+NI}@E3U_c#
zH^*zLhOSBIju$?j-_;kR=6~g@5rKsza{CA8Id?2`{CvlgXIL;nf>j?~W<)X^3>5Zk
zIr_up{S#&G`kKmi9Yt-(UM1CR`O0th-?kX9Ug7-yOQBayY7pq3ekARyXfIX{Wn%M5
zXg#_sUmp44Fb#*-p#bw^hv&x5W3--8^iAf>pbK`-gW&)QCfSd|KYs)o;;4GtUs}(+
zO1;lHlf~=*MmM3QR(JMFh}fX4r-8`l-S#dHW0ZbB&Y8EO<3!S0`;FmETV4+HTm>}8
z{^;CKs--Sd-FN1(^4#6GBRkP<9%U}t_;2K~<a<DD-7kdGGNHZ0(MZFK%|2H8;C;?*
zem8@`%jJdc3g-JljenkanaZGKkxTBrg<3?Z#R)qN4tZTm>9@?!TlP`<uW8PXY7L>J
z`Of|4fJAB<KWr~*G~(r_Yfo7D$Ta;P>yQ`3gl%1~Ur;LVVDqelOoXOLWVET^WSr!@
z!5Y9plg~wxQ#8g4LX*w1LxNFr?^2kFy7Wz3Uxe!3e49*q$bY5l_oI~$*nH{?OszC$
zyI%P;KR-^Eu(u<#D@K}Xem|?>{PNw=4v&HeY*>9oB_@qOSMK_KOx7xal^uewL5KgA
zBsVQUY(5F9b5-TI8?dgTC(e+*p!&o}0H+<7?anEEXA!Hnen!0Iz1&IH<JxJ=?|Yl&
zBt0qI2JpoueSfJd#s~Q~`s{vlL6pje<NmA<qp|PVs9uld$|62(KDW^FlI<z*U=zDP
z-TnGg#y3I?O~RLUeDlOT{L~a^F^j&WAsGA}A~nS0u!URqr)%DW?rrZh1h7*}4o0jB
z=ErBOoB8m=UqrLzEjbCFt;vz&0B2UU9zP?Aw&>o<y?@6<r@pt9(D3?|iss(8h{sEU
zA#bLr;cUS&bG&}uLBbPpOG{QA7(+FDM3t}~1jlY~@8V5kctu0Ok(`g4VoD`VUcc8j
zD|`!2&Atc%Je*;CNxnc5V{#h&T^siDHUnGkfmh=xw>&uULC1;BNdoJc`ki<)4XxtZ
zTI*WRDt}^=8II9AuVPOyj*W~yVe#1;tY)omhDp_qI)lSG9>UtV>ay_ZWfYXlW6P|?
z0I%8{1Nu(MqT~JPH|-UJ_t{>0P^M1a5*;v>1kJO>;u<3D4-ezM&sUoz8p`K#zEkqQ
zvk`a~->kumS?8#C+oq<C`-wu-hl=l5CzYq=Vt=+7MoNiXaf*91H|692_k8}vI&e(r
z&+C&rB!b}szPY&1$97bPMaFQA*xL7LT3T9y&qw-2s2mV$3RGES4XK~~o>{88v*dIq
zV<adCj7&YJEBT@=?h61L57up)`fJ>F>u@FfB;Bma`ffL2_yY@P_5m^N-R|MOrtP{y
zXMZE9jKOUT&mD1u0*qkfS;}XU$o)>yFph{l?fBdWEViKoTO!5JhG>Gdx~SJ1S-X{W
za%-vd(0RC5Czi-+iv(&jCF<v=)3T3GUz3h1NfWbIN6-z>TfgDHdX0Z|tGjZ00DhTy
z_|UbszT9n$68ELDpN+u6d>%eOE(vgC<40Yk_jt;+XY+C?_8OL$##g(NSjAS0GX@UZ
z@7^WW?H?Iq>_EK9+r!d_9TQ34Dvb!_qWmn}17w37$_&&U4;XF!2Yl2iIG4c!0uur<
zGMAx;0Td85F)<1+Ol59obZ9alI5jwvk(w0*IW;*nlfefme|Tk78{E<^THIX<f#Oht
zyE{dSTX6^wBte2}aVb!|6e+I7y=ZZYrnp0)#fnRDKHB#^-+9lucddI@)=Ks>^UTbi
zy`R}X!bqo~{ao4_Y6((+LSWCiIk`jtvT8cY+*|-IE?!P9E*?xqMjbHB5%e!RCZit6
z)eQ`Vi2Q>gf9ndefIZseEMSjBH7Eq|!rc+T%?scb5aAXS;o<`DaB&I$iwJcU0mxZ+
zfUN;)oPZZl2*?eSQ5Nd#?FzQFgFV*y*Al>D#R}jS78d0A6AqAe0=a^%EFb_i3z!|q
z>9L}fg(E;4Y6S+ty#FHwi<lh@<}3mPdU|?tS~$6Je?nbtC0IECo?w_AKnvssa`gaN
z1Aey*P`7Xb{oNWTCL=({4(#@qLmO%X^R#dU0UiyGU@H*B?J>k1VhwTyJXQy2E2{!t
zI)fm8kyZa9Z~*>38~`^b_y4B*JNkDbFyv3Lg_RZ5$=L$p4TjhPY`~5nz)J;HPM8;r
z17HEMfBsFhaCCz{##?w;fE_I?9|?c9ZUIn`)&y8QcKCOHZdR^fXP6tO8`$x8kHFt)
z9*<cbVl4}GasokMZkWIKCkJ)~Sv{V+H}LPvb$~!UA-?}YHeiUg&F?m>-JOBD5U`6o
zNLlW0&Z7zQ-!@wi48YID#U;ce1OT}JKwegMf56`bbiAEGf1KRE&5u3!`#M9N0XC0q
zfc(KWpvNCfUpEU65CG=t4)XW?r{g~nCO0?08f*mvSb}W95X^sPe>8(^{=$#<?+W$;
zyyAM4A2)#O_ve3CCXWiUhC&>@|4sjM#Xt>pZDloG_P<;HU#E-=)C=JIoR=T)oQIza
zf56Sn!v_$2T=@TI9t{id-~0GStTMy~3K0HlyN~DeuPuB0tpS$52ZR;ypSjebkIDrB
zSpF?^V=jI!tH&?y|8Kef3HiUN{CAfBr_ld<M+)waj(_|te-Zu<zl9Un(fe=4qjKG0
zk5ixqeVhfze^d2Ae~qph$QtbK^xs}(f0)JNG)O~i9~J$an~#%=?=L&pO#$o$vep2@
ztnB_$&0lui-}B}OhJZAnZs6Z9%wrT6*MIpQhs?_1@fC4<l;$57=y8Vrv#vbE3Tpj(
z*m(E_02Z#U7T%bTcm0U?0lwUiQ)vzI`XgolkP`xhJ%#`td-Mm`KwU9^U#zeoe*kFl
z+w=!<KS~V<`UeyO03H7Ug#kdPf5S&T1EK$bJOH5cKOjE<==KjN006@N0UztS{~Pi=
zrt<y+|D!uAcURZPQU4>u$JYOa|GX<8kQc}bbAASDB^qj98`^eREluV5{QDRWA5Q;C
z^clMTraXnmmS(W5*wra-e$1S7f7jHHn5#9yJ)V+>CI<sjE(g<9zw{Up()s!}R2$0;
z4!;RP@#{S|Rd=2rDxIB1=DZMVThha3twGN-sYzBc4wvKa)0sPpVoc4Izbfnw(U=>5
za$+Nm#m1nK3kmUJBZan0XSP?$)JRWGbtp5qok)%CCp}fzxk~RF=HdU=f4@-1fe2nt
zr`p}caaK9Y+?9B@-7P?=Vm<+wWZdkQC%<{i5`5Mc`kKYkZA4r0nP`^s=ERB8$!4sw
zmTj}rz#4L28nW!#Tl%9l4CxPEmdxKwMcF##N<Kx;r|1;=@bWX4b(fbb5{WBdVD-*n
zD8PS))^dIzQ1Mf(8G<L8f9klUWKE_Qatvn>HEL*|`p$C0tuTgTLR{m(95U@sHv+Xn
z5VB*@>}MU#mV?J(HM#|DJ$Oo3jC6R>$2T;4&w}*|sQm=S4@MM)!MP-9BR9Y{W?;)8
zVIpu3q2_>MpvU?;2Rg%j+TW``9Al;!**k;T9hF^Uf$gD6?`(mre|??$yrh^s&vvUZ
z!XI|hx-R8Q!IV-uVK{l7WgexB8REB?=SBbr+f3fIY)}tJm^_5mi6KRj``p(21V3b?
zI%XZ|r#*x{)vXz^Nr=WO_aD!7i8Zz22$TAl;u~2vEYKZrxGEX_Lc6oJthdhNoFTdH
z3|vRga9sQH4QAeZf7%av^O^~gdkD+h=sXA~<sW$k%G?VOONPhH{RwN`1M+Lz5Wdk=
zY~-g3pLc%msd+Z4CSHPO!)Zx)GC5ejK^fSJqewG}-LzNwbMtlX6uk;<J{94@^@p-_
zfQ53pv3ea_$M%tC&f-2BGO=i{A|K@wd}2ZhE+ZC(v7KoHe-BDF{Wos0dm1SB^N>mm
zJA->&QOZKjJ_}kwgMqL7NWKARYUw^(O8r=!I_r2T=k`S@l0js>H&55!KQYCeR<*0B
zEV@yKk^1951;Noah?zRJIHWZiFY&a_kAA9qivfa!)z&vAwzg$$@S`=o=&i)wBrU84
zsM}RUGjbi8e=kJHReWD#kBD<QI9`BYizWb%FAN%TN;1_DJ|SRx8d+C^c@MkwV$y%m
zvoo;pPviP=CTsmVh%=v4d{s{3H9kkJChW%4I3P&w!idf$KHGT4m~{6658Wp*{{^pt
zG~=GsTZf#uue58YU#)>bNaZHkwx_+XgL#H828zUte{Z4~SCb&)`Ya*D{O-!6t4v>4
ztn-yI3T*VN+hFA;X;&tw9lN|dwC6~cCp)FtsCu|a4RGy%pqJ;Rl?^!COv&bVJ9cXZ
zZi>?MbsLOZcnSTZY4mWrgI2MJhB!SzLBdMAXE`a)sM67N#>b;`Vc00DvWPUcSyP|1
zwC;HGe-{1Kto+TpPf`;K?p~)WmR1=9?cfkslNql%;b(|hU^09Ego!?es}GyKSU3Zn
z7uKZ{dg~^Yjivd9B@#z$#cvY%#xjtG?aW1NsWffh7i?Le!PM7M2ZiZdo)sd>u^lrE
zl(l6Ne)IM=&IObRzeFgI$M^N7f19N#?Rf?~e})%<b0|4x(muV<M`#of;1`LL)DFUT
zea6#tj(`}3K@i7&YO>$a_r-(sV|eYG)xEji&-Z%bCfK^TWI_QWW1H)-#DK+<OTGwt
z)FA#X(Wj@Roh_pFa~m&0?%6NrTA*2UF<WKDtlo*7reZ|s@ZAp&Q>M1+j(Q@;yP-;0
ze@oXa1;p31aC-*Mw^s>7vWsLx5??Q^T{j8340C<Dd6P%wC{5{US#Flgyc0_$%c>Ty
z-O3Td-Q+^aVU>I|{M2YF)R&i2w=PzNdBu8#@0#}fR|a}D7KfFY@3rLZmOc$2-_TIE
z1|dS|oDcH-!L6Nd99@){3lb%wk$A4pe{oYg(Q6l^UyeH_h4PdGstTSZT|dEo)k-z|
z-mQxknum>n@aaYlc5<_0v8nPjXe=;I#D5;YT^Oh~Z(_6G`ov(~(dH!o`L)8B-yERF
z5P&7keL^0t*`I<}4dl5O0%()$y#L->x(hT-o3z%G!A5^&F+@=C!l$lTDVZzYe?4oH
zB&cRWyJ->n254xG#%#;VPyD59N5r@~*beW5VX~`YJ6%ePH$b>%+O@|H(JE`Z-lD<Q
zr>t@nN-_S9K`PQj2rKX72d%9}`7@2P`eS{&`d);&(RLpb1$+|ax!g{l#k%bus$+ii
zvhvlQ{xUx@``Qb4D!D3onVe5Of5P}QMcfBe-g&m4u|s610z5h|W?)c+?7Co)G>bY8
z9PeOSV>Ajwa-oBERe;;~+RsPh<5i>qWY)u7L?LYn-OfegkS~%?<XDce6E?*qx&n9L
zPEkRK^FF!i{I`)9gp>u?xL;2>h8cK(^!o^S#HTia#UBK6X&G6y7{6F9e+$jqm*#{B
zpe52e9g<`;xS$WqYd)8y#Tj)=RcV@fkb7Nm(qQ~CSX_&jY>4FAT7u4SaV&06xK%Au
zv-ZhY3Q%v_x^BG^5q-Iv{a$8k35lfYN}qx$MEUqIc!^s1+&N47yqL(2t)&#u!=aB_
z-Lp+Vb#h^bS5Qr$>rkT4e>0=V^gR~lP{eMhC&o}}rej;Ix;NM8eur{q<s&S4Xj(t%
zeOtpK`Z1TMW@&%-Y~=aeWq@D>S)U31`RmbL*NS2$&6HWLR~;E}X*H8<n`wg|l8s&_
zG%?_o%k&>d5M7Du!`FFBj9;4XSm0eck_i+c>7$&)I2PQhD4g}4e~lwxi}0`&rHb<V
zonOynW1pMbic^xIRoX1GV(KK-$}5Hk-b9drGL+rri9?{03RJdOll<wQ-Gs{$;_Gqg
zg3cxs4PASJ8D?^S01iK#s&01mT@tqoCE1DW**^tiWXgTFqK*)9pys?haNMuz#`AOZ
zBOpk?F0BKWUoO2De`QW*;n6S=!&ry>nyi_+#B?<7mA#z{S`*1nS$~ts?Du@qE!aDZ
zWQHFRv@tAKoJ<QMxRH+<AFbtGNW(2G%A-!X?B&YiPl3>WDh=|ekcelavj*TiLA-Tt
zWamK|30ONE?{pnv6@4Mv@*W<!_JXHj_p7%FC-)Wl1_CoEfA0-5*VYz-amg;BT02aH
zI{vk7*J^+NwgS6T@UCkz?+j^eDH|~iW}rglu7#{hn}a%ozZX1QQrIUm#fSJEC2mB+
z2|ugXE(+whdEfb}!czE4^U9UFR;g=fD>@^W3gz120Ov+q+)qoPUY)#jS>I?54HEZ#
zVJs9zdd!age++KI(cZaF1ZSqfD!K&9i#{zSALci0uGVYawnz~=nM>0Zz@CasJYOse
zDdfZq;_=QWl*WE_B700t2A^O_7^LxqpO91aO);(0!%RFnba_vPTyk5w-+~<0j1nzr
zc&-AETAY;ZqqzND?pn*uG<Zn;mMw&S77hhO4v#q0e`>5>@IkMN%=We-@PAT&6BqwZ
zKoW~_nqKIUF_jQ;8jF8gKD4?xDs-vK|Ek4o5_cEtGn{qj4D>|Y>C5`{mtc{HyJqgG
zSbWPSBpkUS;X5+_VFmLD<eAP2u3uJLO`DKBt)-AI<%>w?dT+3{<cJTy3n-~h+uG&i
z0dxkAe}2Hx%zB|G5Vu~CE&+wz@-y)qAMfRnwlx{)k2BnNs%eU7jJJ(+86R|wc@|x?
z0#7}p?3=~M9@flMQ>4NRf0cRmsDEvK66&w8WNjdd-jeVo`oJ@0;K$(@<0lKX604q^
zz&&8z0rjz^B~73TJ4r?ckIPEAjSYcja9k+<e`j-46nad^HnA$+EEE_W&g>bxg@yjn
zlue%~FWI8Dq%bow3fg#l6TSWvHzgU*@qmYdwVnw?bWIY%K35<1tHbs_KO++B?jdxy
zgRa)L9w&&|rbp7H&a*WNHk+xEXEc2S`*qHQ3P;M}5PODj$NJ6i9f!}mt3IEYiOyJ5
zf3zP(RgBzpDFp}vIgQnI;rjH>?&G(BWT!I=Em!W6)eYC%+iD^y*$5Ua)2t>OSmXMG
zmMK?Jc+98@jPTHRx)aY<rtXG*dbRl1p`6Vn-P)?SUrb`D<}4=ihRE%45=$q>tLUD9
z5=DYoHxC;7!1OOk4&@qHw$vNIBl0@&e<w3|rx$O{Omq=wavDFU`0UaqVe1@nFzA)S
zg$e9O4;GD98_wb%@Si>e67hfQSZykXg-#D^x{Orr&!>M?bg&w`SU>PB$ina|*7|gX
zbf=1lkF`zKZ$j)LD{Z&U(2vK$pX)6wA+#qgBm~{X;~u^&z^yJDjEc(D{_=7Ve_Pr^
zQZgnjIcK$X8fl{?LC?WW+|k2wWjr4dNodHgcCg2|-Hg%q=xa%x1QU}FwK5t>=6N-)
z{<U7a_BB{nI`&X6pM4o&GLd0W&OZ^m?OgHvb~_6sZlmgl*AHOdXI+Eh$7Gqxn_o1Q
zHSH`Zdn6KWQXL2$2H6m(wAHb@f3@by`Q-4p9rvM@+&Av>v47qP?C6O4E+Qcf33R^J
z0nW@fGZ{R@O$`+;=Pv5RaY*Tego%2VW8MEMouc?~P+jIT*fv?bMmoOh1DgJYj=b!U
zXeI75aCC05d8K4NZO%ZJdcoIAaE*sK9<xTMG_Poy31o($>p$q<!N1&Ye~r0Q^Rrp@
zA)}EC->QEbLXNFxnyT_&XnK~#hQ5S3BX}Jyz7+xVyKayzG~me$ni|$8?V|IPPWwsa
zFgV1lqb4S$4G#{Dt!#JD5VD~tZ;_BJ-#)Df8v%URLEs5e0XD2}b*gk4<4CMNjb%ui
znjeauo!hTb)mF#h?^Y0Be_@U4r+YRlgb4B*nj1};vaLyZVy0d>qlwf^biO1)nOl-o
zjGCFWXsj!J+Zl&yEhc3~_N9Kg@(6QXFH}@5XJw4v2X>F7=5(0a0PeqUe-Sx5S7Wm0
z33mFt-J?2OoO`iuRixGg&vB4QR8p=0AQ!t)n^o1A-Rv43Api@Af0vYw7?sA+ZK9G)
z0?i1q>BH6$XZYW;3(HS@CFIfRMH^`z{2^O^6!)^_Re0SrQRU<%&dFB<+bi)1u_LLq
zIv!QNe$!6mj_G0ul4-2a8ZmEJ*HQVqZx=;k-c4S6*57Y+nj&&pyzbmw0qXY6JJ#!Q
zm(0snPiFlhrtu82e`nj$M|VLlKhFlIc8E(VY^>2`%n4#@-4`O52CQA*qaC!}fHXB#
z1@{h#=37r>0M3gDxh4~ZcnOI!9hXWyKW_r18Fzj*^TFQmSrL4eG>{Koul9icOz&}I
zo6H&OkKNOPZb#7wUBy=2D&vE%c<Q?sj#q2LCZhxb6f6>Tf41oIo=AUoc`<}iwXn$n
z`9&4imY=&%QRcU`+5e5?T)#(|)Bt}{a9lT_z2e;LGpg1h^Pu?&(vti~ccuP3r9;*J
zaq9=v1%OU_A{5jE{d92RdK&o2oP7ss1nnk&f}rTn>%-79zK{@8^Il%(dPUvmfjr%G
zbWjr2Fw&Mme`3iM4L?|V?@}hrN4p6Tyt|YZ=6xQ5s{0bds5eJZGRp}W{!w+{;9+a_
z_=%&2Q`KvN#wUl1WzJF%4)4HjYQ7oLQMY2mFCu+j>KP4LWIG`$1{OTet})T$klkUP
zERDBwfONr#KBC(Cjgi9b*>AWKt^Et(M3)>2E09xfe-j%evpZ8!bzE;H-9%L2@-uo?
zn&}5v^OHl)(&3=eF1qmyuxFH4b~43N-@sjLZ`reDY*|acn28SZ3M~Al)^yRDjTAv5
zhtEmL1)Et9Dtp@8C++VxUswn?_$=#px#bThk6X)CqoNxqT@z*+TQ6oM+IIx9@_H>X
zLhhIye*p*`B!Ma~i?6Gkw1|zDmHC~)BrgN_B_?d83>Wz~Q`jlt-NJX@nrEAmxQ6QM
zP#lD$aBrikhOomfsyT37Ql*Ewla`R=_M%#L_|#>}+|f_EHoReY6Fw%+A6o{Clj#fN
zQaL5NM-t&xQ@|z1rB{y2OqpB6l!Q@Q0rC2te=>CWXNkXVASV4n?8^L}h9*iLL`${p
zqPp}0?`Y3L*50U7kbho6C2Tq3JIM$iUuIi=(t9rMYn1g<S0EnBuF5#NEPhvg3CLz@
zt@9WPA#nFEcX6u@?keHX{8p_{C8^b+=wy+J+IhJIUZeb;E$NNzeY<BF;x%ETOQ!lZ
ze_o$J^H+fsUbybkbAd|G;?8`_Cw67hy8aZ{5uLsbg=haklasXiNL!HV`q@Sc@}1GN
zAzXFw<#AELFYgy0HIrDWyEG7yc@P-H3<lclm}N0u(o~~NP~c`B&_2|WN<&^ffrpE9
zCBzE?4htMoY>6O0ATBg}X{eFqn07J(e}{FZ_ANUL)Lw5UB`hU_Yn4AHz6|4oVy~Qi
zd-<Z|=vTo--ThXqYuePL9CDOM_<#_NL(4snWCXcRI?4gZwPumw7KU=m%}!{YjQkGj
ziw-8&HX}<6(l6C7wfjY<0$db?tp=Z67L{9BrBQsEN$;>$9VoEm>Q5c+B#3#xe`42X
zG<#I56+--?cmN>5Hl<jGr4T<)vEeH!%M5Z<wlZ)65O8G9MF`~0q%(cXlXprxg;1cx
za%w4VJd8?*gKEn{5eE7Sc6ieDpZZ~{h^Ez`mBIm)I1<QSZ|iU9u1NCY2C#9k)JCPx
z)2BqMe$5R;`{P<ZZ1CcA<N<jWf8!(FSXoVpN|sPAz!#;dD>0eeBwBrQ=Kz**^1jsm
z$^q*5gywBpTRvKNEuSOsbDx10GW&#|vW;b^Z?4@KwtQ}6unB+2D+ou1pO6Vnm23_N
zS)0r>qTUcan|g4e(NxpGP?~LW)e4(=z2xoUTePe~jqqq$EZNZ3?2}Vgf7NMuxdr_0
zrLTvS+S+3XP)gWK%P5R8<M(Jf;=uWvvzs8dL3rPJUl(o6MI)?SQnsj0!$yIu_~QLA
z#uBH+ekzMB-P|gooaN_pbn20eC-S9Ul=JqC`^|8}{l4x)75%$J?vsqzmDH_VprHdy
zsw0O}IFSG3%2TXI6M%sAf80tNIneJuJ=mWI8==Zw*DQX-s-(B4g5nt?E1J^hQ_+ti
zyN9w)O6e4h4ZL!#AM>cXosu4K$60Prr{sKl7iuV8lbga3HnRf>Byg1`cNIFUdKc8?
zNMw&zW{|+NJ8ntvqm9tU6!O|gr12^vLLq5^<YW~iH9M+QC;4BBf6fNkQ#ltKIcB1*
zl$-8P$$&63rcSK3+DhY%;Iy19iOh!%@{FW=n=(%-OA`q{^M_mN_aj3JZd;1K8s!$I
zvV1pvCUQvI#GK=&sYH$f`N`l=D^p76H|?}bF&Ez&NbJ?I&&@5rIX`_s>9>y#Ip)>>
z(WOO(awBneFQ0>Je;H<jJ7mo2Yu?(RV?%=2w;Xu!n#B<%8!aq*JPH;fLvpxdX^ziG
z-M6{Og2t<MaU<G4N<ff`d_cr(rhm)t@iKwVU+;}DTkz#lh-1_OVmC4R?XDBdFJ04)
z2;z7W6<nZ*>7w6&3;z%m1<UC~P1&VDsbs?OXjRE!cfA(dfAF}QZXNm>=oIG1f2a3G
zg%0gN#{FpS0ko9W*t&|J3k-G9!;hgGe_bXzFG=;InqmOpi)t`@*fP$zJ?|U#l8qHm
zw~BDjxlOv6yVvaY)^CoFWijZA2%%$7fBb~Q?-R>RW`NE@L)b@}b8O#hAQ6gJca8uo
z0`EiBSN5-kf93w7)mKY?8`KqyhgQ@|8?~}jw^I!cO2&*H2`t1qru9P<)Ok`v<$>Ro
z+RxEND4dOWLm8i}7=5g($7Y+^%C(fcAg4CgHXW)ST>g&ogRUVma3{Onu^G{ad4r(R
z@*ch8dptXD1vsegSw7Wq2o}v`YohwMaY<u$maQBFf1s5Zdj8%j{r$C~Ln6G|<y;nl
z-Zr1B^@*$=p-q%j3nO(|^YFmxiIID;w$j16$-@F8a<8H*0$;>Jxk>ihG*-;LNxm3a
z@Uhaslc7I<4vj|!C`6m~sY2e2<wCps4K6D9>*PCg=SsfnW`>dZaeK*-%@k1$>tP$M
zOp7G3e^s))c1lmzC4e?mlk~%RXlJiP%B3_bR{e)M2DmHCrS39<Ugjz)mx7D*w$8Sk
zJow7fNPS#iV_na#2{46wQ2L?a7HdlJKJ~$wcB91=HvDvAV#v0L*y#jk*$K+AG{E|h
zOEcn}OXfUv4X<gQnz(4a<8bj%7~g*jO2ts8f5GdHCm-)*(wiu}l$VrmdKcR4Rq?&!
zD>#m?wuL;sf*zmkM|fDyy=w~dCGSOBq($al%iF24cW3!Gno7czd~|%7$`NtG@+&Ne
z_>-j6!%iRjFUnE%50Wke2RJz{Z_oAX5sL9@fQ>S{>RE{etf|@vF=#?)hivFW)5g#v
zf3u%h=sj6gVlVOpj$cc-zUThgHlrs|Q-L_VTs+WYj`X0`@s>4rD`WZ?v_Eo&X^PiA
z2w;A0N97)R@_1NPAWj*Uykue@c$_SWBO%8aLvI1>6UAxO;6mO*o?@|Z2EPjKN;C6w
z_ss)<3AwzPW<Jg^=C7g1a>iq}2>7}tfAH5+D(;3sL?I^8IGo(u-e<8cn*O;~vLfkc
z6t_i%*z}`6@?5t<cp{@2Iu|ieWp^$ad=+9nzG=}K&-%wry&7$<l=2NXwVd?`7D9|d
zJ6p_;LcfsG?N3$v?p2mctMk+SC<OFAI*Sar$NK!oS0CnZA*q0l!W`>J{cUQde;p?b
zS&%uBm6nI@${UUa;K2^Qj;_OLB)+_h|GUWt<e>`>@2^hih@esS_wP(DUcFp;OKB!X
zehAP)3{|;if9PFNmg0a8Kga56L8B}$!0aRX^8P5H4y!@Kr*7<%0iqA)UPf}EQ-Gdj
zO{^n3^zPk&t7-XX!Bp2Vc6G@ef4RYN&C6^4hkeXEsKSxH2M7T0G##`Frr2RXngm%G
znUy_k5IIVU=9Xc-dN*#(U{CYr?Bn37xP%kapoLvku1bM2eL!wWzR&t|e8<M#>RsW_
z{!}hJo0(a=4!Pz@AFul0ZTEpUVf40$jsh)DQ@5~q^SEU9YtW1Egymllf85$zMAJ7E
z^lZ4zYrhDvuMmI&N0QVOE^4ab@=x<jO2Y+Y^+{7BF3q^iQ85H-kU5bEZ|wZP<*nS9
z%WoDOR%b63qHx?7e0*gcm?FpM__H!0^z%m8hCyuuGt+)`rgU>!F>MUu!keKiMS-#C
zqKIa+inN`(X0O$+<;Ctke=P8x5zS@T2h9B0cV<A1viJ)<6eER#_r^8J<^CNkG`Rdz
zx>U-jog#<z+LPD?!!&Tm>82z0VVC)N&kTVTyjVrEVDWUS{LJnx;HCt6QTwTc@I*u_
z(d6iSOLDkp6?W(BLEHH&Q$>(>0>;@Hi+;3o_^b(G*V(<HxCCZmf3P-FHCX8N<UT_c
zO5}w;5}d>`YB1#K+64lzd+`D%WI8>aBeyERZHedrDg>2lpB7wxZ4WXlAX_I$VOgTu
z{xZt@YLalHG&f?zc*K{O!ClFnKa_;K@!dUBL^jddtV_B}JR-W<@`{rY7#EKIY$cP!
zlCM@f-zk`1jndFQe=X~&>S`Ij^KIxIF$FeF^7m42u81_l83APnK%6;cq~(36YK-?9
z8lL=7P)}MMS+*gLl{fFlVikD#mz7B-jW3fA4fmKMK8pT9S7kh*1OZxtH6Z&_`8GT_
zgJIwD6K*b=@rw6n(;;3Jr01`ZE=gON;;<CKuTDRTX7kaQf81Co#SBTMFz?e?`g6zx
zO`|QFA>`{YPt`4`8BYFW@DRPnk#nxzz$}X2^IwFy8_!iprKM<4OHxo4mmB=hn9N==
zo3)X!Nl`1!RV9DGT0Gug5OWzLMw_{dnqgUAUGzm6I$%=Ftk!+yP`^%m<6SQ^@iy$H
zySvMN=(f19e+i3ca6MNV;l6{7qodqPp|hpCmOS1C9g6^8593pqZ37YZNl_l|>p6;t
zjq1KQ{@0ttF%zx3&s|7v($A~b#w#&Jrxd;Cd&yU-Kp?#COiYh*gB*cxF^r2l``wOk
zaS*9r;6uR|b}v8qw-2_8@8mBCH_N=vm#z|@lKtX~f9<}i0R6DC6ATcKjQMzp^73b~
zN;URNr8kyiOw-rRL0cOsqdnUiAG2kP<um4{C6(KDbPDjPH)jj#5`UQZDp7g#B?m}1
zQ}GpGqy*q*d#6*O#jI|l`Ey{3GZhL@EcU6mjLb0;s@0=}tmcviqO({^zuSxKizt$L
zs-lm_f58%dxHI(y3!Pv$Qs8vR_j|355UP;Kpqgki__&{uP*mu|0aF&9lYZhAGX)??
zAkNAyE8LG_SVGB<S<L?S!gGRj3f`pnt*(SlOjtjO4)?$m1?_H|j;VEMa-VL5zIaCF
zX9(Dz?2w5!q8#Tamw~>o?jCI}U}gJ-|CjzrfBOVI?@!+HdkCn)v+f>PgzgM-Na~l9
zE!i(HA~(x6l~X@-^c|&U_z7STsgev1c8Fh&MUnR+pE`UM@<Z86L;i`p!Dq-1TzQ={
z6tnaeUo_+mPW<$+tXNNH7^$GKVc}?+aSO+2&cRxInNwtS`lx_d+7m+@=KP_ARUae$
ze-_+Q8>i<;uM3o&PILrTJPABO68quG<<Eh&j*!zQcSwfiSYIQPa_YuKTocM22_&Co
zNG{h`HBR-F&WB;kWZU!@G~AWRZXys=RXUWBrfS)GLh5h!X>zL|7WhEFVV<n`{O@07
zkYD2udtOqktevSLUBO+SHK&<1xRZCCe{N9+zdFBa+~P<qo!8zZOUV#iPuQT3mr9U1
zZ|heQs#4h-5>C~cK_Wv>R+k=3NYsHJ-7?636e^{BUpI{~ihg~`_*^Em$bEGq>s%q<
zzBF=U>u0nC?8y4y=YarrqvUg9pM<9g%&kF;R#+ZjSU|P76U|esh3sU17-H-Xf1XUr
z*@?{S?XIXzWNm{kpUs?}jJ;XP3n42X2Q8k^TRb}kWjiZ{u5tSxm<tV;xLo0#juIM!
z?E;g&rI2_(%`nF4aJ-e`nkC~PNmX}uX5>%4=5_{XBkCa{2dUAng3rF?_}R-R04@!v
zKAB*zyyg<mC=z>#)L@FT{fXuKf7@|2sOfC}_NJd^gd&c#6{)LG7ipV#Tl=YhxA0Hi
z5zLE{&ltu!THRd0*%qA#tCdkXUY%v$8RDDs(4*7D2%CnTgZgtXxHbjTTao5^3K#Li
zv?&$^@%A=DS2D6Ma}-%cpGh?nDxaDx%lKeN%`zL&be#H1^uGbeWVDEhf4t=tI--RV
z#;Ny+mvc2MswV3S61+9!u`+79FD;%(^}Tu@f6{vHtGQ`>GTaXA;q&vglbOoe{n4j%
z!ketN^+pPBj47pe?KxUj_YY}~)R0#{t^I8{=OxW2;Sc651fZX60y3gX$9Xl9836*l
zPhRI}r3QSV$O_rX&Boj1LX&SBTy4+KIsDuk(k^b)ma0Fkb&m-~{+OmC@M)DSuV+*c
zY`whJOLQSzvR`S&kq`G5_(i~Xd?FukhWtO9>AOLf!2$vk0Wz1MhXE9~IUfS;QUWqI
zm!XFN6t_Hb0);b^O4$yR$C4WlIWRd2FHB`_XLM*FGdVbu@scTj?OR)O6Gs+)*RSYD
zTw9sx`=u(CDvV?B8i-?=0L$_q<T2JFOO7NbkYB&w>F$w6qYD^IyDzDNQBP0zxqj!;
zBUvcJI1|b;Aq+kplZx&=Q(EIQFl{^&nls}hJ_WPh;Zrit>0YrQ=pJjiQXQc|L}=Op
ziqa|!9Fe6N`X6Y2CNN<+b{KGSf(C*KFR|5tW*}jVVv^HVqnQ-OcZ4xaN{g+=LPn3R
z2Eyt<1J9)8pkV@&PDmopq?a@hOa=v}Rx-s&Ovt2&n6R2DX-!91!<2GhYAv)T^{ivc
z1RB5&jze%TR$hR+<4gr5NN}dPq8Z6Fi7A|7T7rgfnrY>KTt_&=wDvS(nT`@V$Fw7h
zd2IJGklq+T1mUqg#5EoRO(qG<a3TmLjS6HN!Hnj-BXDCp85;(*9IA+*nbiWK2E(i|
zw97JUA+LZY)_Pjwnd9Wo5SX)|EIDV+X)?B8Uct_iE9L_<kletxASStE!N6CN2NoPO
zkV3E!pqCVXuq-zs`UoQzXawyr1WmG+P*74zLHIJfBPDh~Ly0-;0Dp2Tc1QzTLp>qA
zgK)qMhyOfblKdj#2(Dz1UPV1gA!W$Hk`TsKhv+B|)JRLvjaVbh0#LLV&cR}u)ST>%
zMcNP;Il+}IN&^Q@@e#=(BG`ko5Zn`BK}wR>i~#(9W2hJjd`LosQDg`u3AB-uBCt9d
z5yk@)mWqHU1nnijkvXIypegP;KmOP$FTUJXtb9Bgjc1**d-q`$@1GAwpE~8?cyd`y
z*gKAp<?lP?dDWk>cQVLA!@yGb!Xj{Ga0QP>w}s{b>mIWoe`IBsl~2bPV^$uqNAiIE
z^iv0a|Gtx@cZC;(8ehbqt62(D1htl<&<|v3z#<Uf9azA_qJYZ@rG++PJ<A7jw60KU
z!O@8#An$GC_)xPtR~V<~9K9?kJ#6D>cjL&KW9`RnR@FN)D_BbkqHI?rup+qi;4wS0
zYt1qnb{osEBg57#vt_rj6b}V#P6Vhng_C-J!PDyk1!XUmtyx-INR*>FOQ#Di>|R+K
zQ#dMNHA|}squgFuYEwwR$gs%x1vl$6>;t332t)~$BqVjDK4wtl3=%q*Zm;aPD;%{Q
z#16^a?8SvOHx$-FMa77-L4H?zW#?_-(fJWO#6w}_ezijwDxf8@LkNluNZA!Ti`ol+
zkVbY+6=-Poi4<+9MCim0p@(*Euk1APrcZI8jVzq;du69|VG=O4mW2#ruiPZEB~Cn%
zof3tYdap<k$dqVtBReSyW!zrbaa9PBa*7tb@Ow>|_+QxCb(|w_?=`2W*h-|FqI@WD
zP}-|@XqKEvIYqfpXusDmQ0TH{R?Y^06ra6@fifJ$CxroyqJ=Sfuk180aJEeBv@f{d
zYZ&10T6mqpKq-gnvsZ2+p!lRPP|~6JsJ+?}aUFQZCFZy?`#6#rfz0oz%?xNwQZ-N<
zt*2O@Q-s=$dT9CznSdz+*zH9(E(=2~G%B6MF`inn_!`V0<TtbqYDea*S(1K#TiET&
zoC59(Aw`~~j?=pRsF&FxFB_R6j}E$OAIvlkdN%lYM!+!y4W=vr&8=sI2fi-Q@zB0t
zStDi}OR*!!%z2VcxA9v_Fh}g2Z~+9*S^4JezgXbRNzO)h!{Pe}t}*Dg4UDn0?sz<!
zMUjrt_WQK{7+KNfVSJUG$Mg<=Rp+scZx{3O`0g={=`9}`C%OTL@@z8hcPm(hm1jrC
zth}f`&sb#s&cw3$_x}g{f8Tj0Jy2GEqDZ5)V`*&A!-fZ46P@POAuVYf)l8xCHO)AO
zz62mdv@r)6Fb_o7_{`#&XC5`k<aKD#AiXa{+%1`nJLnBprjzz1%IRu<Xt%+>Og*iO
zSHba6E=}1;ylIBj@sg3~n+j0zdE^SJ(Yo<8o0sMwfX?@RF4kgYdagP3);Ry6+YXRu
z@gymb#_<a0S+7VbgE%&EHBOEe2GF$LCIiq6eSs7g(oMQrA)=}XZ>^(X7;(<%g`Uq>
zI@OCzRL50$Y%O_%)0p;uq}jA5&&mZAA9<%Wi`8j`j#m{0R)N>+pqh(&<9fvj9Z^Y7
zSP&ZAeZq|L5eJGe;mMsIhdf|R1>#{e8C#=YW7c!b1h`oMQ;O(V2@aOf6L_>sTnC55
zFMtS1o>rJ><Pi1uk|Z#Z7Cp5%nfM|sT?L2G@uCIUi4Y5$NkXiDR*|CQph9mIFz-oH
z?OaT=)Gm|E8s16k=q;Ql&JMET(3M_zP(>o0wYCHrG#2!#z>`-j`PDc{RN_iU-y9H-
zXeQbioMB-T5uh!P{}*@E^|{7ex?jx7=sz!_e_%tI*EQ(j<cqaD+C;?_s@`oa*^ypr
zgqR7)*Z=$M*YMYW`@bv7|EB__xXRfeVJc>dbY03OoUi=%+%K{cebp*uOy+gg2%I8K
z@R(m+BdN*xlAM_4qvon+Ku7Y;XAJ?@iMHv#T#+JC)s93@*EAE89TZfxS}|Nw3bTe3
zb1Ag3E(d%=Pb=x`Wt*Spxwtn|SBtcs>Br<sSxe5@<A1Jy5pzY`qlO7qYeXFHqDH7d
z*(BG9<dDYGq(B<ynnIkHDoA_uE!UX9v*#WRRx;+_Q2iUKYoQvc5ZnN>pd6}nx+)=K
zXRfH)TN-b=Qio%bFiul{6L)%7KL@m^Z4pANJYUnM4#s$qIi}TVyjZ2<y>6^%P?(Rl
zOZY9<OtB$<S=1o*bLmR=NmuIbeXXaBoxP$i$#H7IJrGB$V`oLL$DyJ3begcv#173m
zGE-dO>FW=`)<;9q*rRzA5t`0Zx9!og*vweaubt8`U9DgEiug3G(bUMGQwxzO`6+%1
z0#ehzG`r;WK-V;ryb|}#*QV#%kQ^F2eD>1fS+Y=n8s{tFZ1IAEj`2s;v_Bc#&c>5;
ztbf_N!IR&fot(aY{EsIu4h6^ju=jDwbXstDIR4Du{Qyh+AY&*BK|x4wDW?5uG@}zp
zr+m`8eO3)VUgOr=PDxzo*$;vqp3Hi~LI3gS<FH~N-<?%Azk!hNlyCAT#0F?w_a^ij
z;8A&hR{mD@%c>lgx8<aqmb3EiAW3sP01f&f0B7gRZ(lYm_v`bgPo72P-Uzu~JEKTD
z`f-&CJJK#})b4S4SUxF#E|1Hn<w^Mh+Mbu)@}hhNtzVbD@&k15kB8$Ct~WQm@)DMa
zgvzV(>S|D44gRRgtMT2W{8(O>*I#b0t5G?BD2L@uIfBW?qY7rbttNx<W%>JEHJuGW
zip)5z{=mxV;4=(5yPi~4Is0>5-j#oppUW@hU&|)e_c8I&;p?;Wf5OBsPBsBZ%>ktS
zS4^z7nfM2xYa=_^u(1+N8^44dtMcQd>dmT2G!7JRt7z||;@Ph!&o7=u6~lTBWvDfO
zMC#g+hI*rh$-&DC`THnzdieJA^eGfN-{dmQYlV1th(hzIuwkP*DJYI|SUf{uoR-fK
z952gX5Fo!Ug~*%oE!^9i!nK3xC&bH#Nw5E@nhmR~Sv{V_fY}sC)y-vZdR<nd^zr*$
zZy19s$5#%q;hHG>Px&cF+GsGU7U9-^n^dF7KaLXjItCGi<5_k2VHg+GH)&10Tg<1)
z6s$LcB>W<5r$Z9A9lU?0@GbwUCgUYM2!0<tT>R_JMYl_M*nn>}$G5UOfx{Mb6C92K
zf-^X}pWRoHiyFBvMfH*!qT$x$w=c_fxmWpk^6SydSR1>~zgirHR1b>$FgMMA_DD&F
zX+%K30r4h~$x5H*rD0x8*QR`Nuatj&-aR_(MzdU8Y%+|b45H{on}aEA!!ANB*@bTB
zc9BwUvdfkXk_u-sKn;$j%6Fs7YBKGQC)FZmmi50^Jvcsod-~>x^zUwjg-Ean^fU4F
z#m;(E(CxRx%jS-0UH(~C?q0Qj;pAzzdw5F9z1`?qWP@M{^MVd=W}zJd;QOkb<{O>+
z;SR|Y`Ft?x53Bz8_RC~e-rNmmgWKV9Y|DG)yt9|xlNYa`=f&o}#mr+{@2IL<zXilq
zj8+0}f^AE^`=zd*k6xagka`;<RHp!??;sx#pbxL`YwG(A>gTjKx?HM%^eFDB3R0b~
z<`q8|&Tno6F2}=RZ?fnIVh2!t?hku6ttwOZkc}RI66&y;P8V&!=<enNgdKbweYGPX
z3)Y>%?eK0o?+3Ot02@mGx{S8k1;~4)_0#7^XRm*bklD}%*o+u0;cfq5#B6B-(jn;t
zDETGg<5j!nEuD<&R;^io@V0dYOV(Sh2696+Xnes>lMwi@H?86~<n3ehl93txMG#Re
zj|Y?KjI?APtDg7rjS#L=z8+l8uBVLtE-9|P7{3|;1(y{Q_ZO#q@NLUu+VW6}TF65#
z%kt2lH9cIO_9?L~k88_g<pz1^&$aH&zIB3Ya}RCq#y7ar&73)Zzd!TVX{*Ith!t0e
zCDnDq6?_M-SZ?;)(yRbgF9Sm~Y_SVqv|H@9JmxFbX#&IVK%Uj!wk^>LRD;<lk!efx
z9oTJmn{9bkz^j|7MK>L0cVM7)f7lX7uE2RIkWE9H@Evj7YTDY&SI`^WM)c~oG30lk
zx7B5}<yk?mQcLoGG|l05fR$DWZ;P`6UA-~O`tS|nob^6dQ<UxT9W?<R+)t?F(;s@q
z&8LIQDSMZG`jt-JEFDIeN_Q&#5==+Xy#F5JI#Do*o=HDTv*{OUj;9a%-PC=e;Dud#
zIMWLlp3&4I45yac%rTdk?YE7|TGrN%3Mm~YMj@BnHrFG<ur50;dDh%@TvKxCJhT{E
zBDHiJl8`XB$fcB;Ys%R<r{|nM&wt<hec$tZ&-ecQz3<0=whfRvnz8#=#)FjFQIIvO
zbBvWsYZL7QJ|)4H6^v3_k#_%cHY=bviMtQB0aAQIdVDV@#!Tg8#ei{Ii0-`ny2PAk
zUZlc=+_C5B)`SCsdy*iP8TVY)Fl7Vx?wq`zDLgGfc1=w3EboIFImHPsso#i_C|aVN
z<<<EK9jj0DFa=|DcKl3TVTKW3k~7=VIQ`(`IgKCom$8bx39L`3{sOjDHCO6GER;A@
z3MX(~<_}ZSc%G{>9l0nn6?PX-sp{xG((LZ?M&XayH=I@R+qDEs_-V<~tOq$Rzh<qp
z34ZiGP3@-bc6j`ww0R%Kps=(jwKa0@uK4SkV&Z1v11aKbdi+Fzql7mz`B0s7b#U2V
zeIj+zxkjgOwz@Yaif#2S-mbY&dWpJD(psjUgw@qFaSH5zMpr?X%33DmwYM4!>F;1z
zZAGn)2%=8y`QiuN^D5e3J$G+NZ{FsksNpoc%?!WIFQCb5O6+gs^kg6-EH3SBlc*|i
z`J#Jfx^UwB{C6r3C^f}(CN8J$BG;?j7RSdP_Vt01{pL4ame9OSE#~4LC)dH|x_~b9
z6f$oF&97eUUg^ErS!Bwdi;D5t=iqza`SvEbSohh=Kf*3NkkeicK8zw_hyZ{E@PL~M
z)WU(~L-UICMHtie0vNy&^KUT+e*=644B+_9SG9NIpceFi@Q6qR@Spo7*2<bsaWi2P
z97Q{lF{+Z!8dhzdGHIRC_0(V_Y{NCP<S;cqaTfzJDhcWv4`2D>K}LsrK5&M>#aXs!
zyJM<N1kuIqJK>e)p|#7+1_FQ|RzW+YBzrG2ve8tRsWW;sWb%p~{CRo(*@^M!&qgA}
z8M-y0OTHw1H$HZCfEq-I;T{A_fjQ;^Hnc9bMc6|UC<m7_V+Bqcw)4Jire?#+H1Us0
zQjkEwMCN%BeOdngBgNJ#Qq4Cya5+Z>V0|_o?*X-N4v6(d0C+sq;wJ<Hi@+hUvgC0V
zOSUl{i@+d`LoE(5{a7*td_yz@gG8lZXhb@Ng2!M0%mEA)N2OX@QUD@`PPZar2m~_X
z|67!0gY12o{*h-9mKf~cj2gb^aMU=aad|PKl48cAKs41fG&NPr;Tj>+@QV<NuWDEd
zYQa8Dt1K+Ud*bRv8;@Up`*6Auhea_R;y^I!{^aH8mmA^l_hrq^-B#)B{MzW6)o6G+
zC3D&wdqgK?s4k?wX~!pKQMC8@%K;Erg8<c){WALiT>Ap7;puJRC_BNfktxTl-3OWq
zX0;)Q;zN~pP&H2o3FP$V69>#sG~ZonAJnf%Dsy_19k0%bC4$8ztu-uth`5-S;qDa$
z%O4K!_I{;gG^QjFI*3wQO^C|=B|2^+(+Q8Iq-z{YA;{y|c)ipHJ$oTFbXzQ9zFwl+
z%M^k|%z~w`enoap%yVC%T-CLy;?Z{<H-!tP99I_(1}e|&W<QGDddW)x<=OczWOr{^
zZqlKK=+Vhw=nXGjzY(&}8Cyk@3|^Pqdmw$~v6j7oTp>Pv<-8U$YxUR3)&WnQg*M1A
z$3du~GNw;T7RNOhr=hYyv$qtsI?@a()$>dM1N1@nOm+nnp~uUtObVx2BTf3`dbrZR
z0s^SVxU>XCkh{e_L8AuBnW|-R<6c0e$XBXaTw5ABW!Fb0gR!{9CNZ35`c%H<&Z^<v
z>AdWgFr787FmuaOHNvf(T)LVv;g%j!^=oxz#OHPL!f~b7;=|RDk>5|Z2R;!+u=c(s
ze`1)s7%U7eE)(Xy-n4c(Q}_Zc4jkqu4b<j;@QHdKEVCETs?GoS`pgEkM_|;PT3brs
zCED43kASIe<0{a=NI4lS_AH!5hjPF=8nAAk=v04E-?E-LC^sy}x&f@M3}CFSah6a+
K!-GfZ&_4n1&pOip

delta 67925
zcmZsCV{~Rgvu<qLwr$(CZQJjgOl(YSJDE6{*tYFtl1yyh`OaDQ-XG`eAA9xM-Mg!I
zRj+!Us@i>ag>Y~M_v->0(4aKLf)M^JBspRc8FfgZxF&L-WCpIu(5E8jrxBtRYTn*P
zZF_|RE>`iweDdx)P_pbUf`MiQO_U`M(K$}9+;;T*&}(zgbvAM4aTZh8i{k4rW2&-o
z`J#KWj(5{%x*5#6+j3hcqek4O+j^V5^R#|(@rRf<Q;BERvzVGa;I+Mk=kmn-o)`Ju
zme*^M0p?Yxtby2!@EE;P8Txk3kXzgE{wq$cQ30g>Ce(nTQCvzkDQ;SkvN^3VqyP*{
ztQaPswfRUiTdo5&?<Lud2(_19QGqy>78ypb@6BLDP0<u>EJn9q4*-Toa_AA27|JP*
zcL_8=?5MC~p43Ce)O5-=%K>N(PDRNGFQbSRq-<bk3^jehj39&28aIvLM1w)#k+907
zkkX<zS>xA>VY892kT{#!!3hY!F)LU)S$o)!u(7akrv&rU0&wgTHo5NJzu>?@^*SPP
zR4E>1=8zS$9Mwx!IkpQJlT8xn=j{z0#+S{BwYLDhxJZ<`M!cO7@E`r+Zaml6!`Pr7
zFJy>V4JZt$<7At85MFIP1}HaA5$IPp0U{62EcyAl0=$}b{orX(w8lBLPqMkkG0!_O
zEjuk`MsH#;0Oo+-52YGAon<u4w)W}<0Wdzz4}%m~TZaL!w|~o1(yhUjF~gBDkXWzf
zurK9D#m6;pn2RLXm?)xNrqSx?>btiy%OUb=5kZ;%T#IpANsv|Ob>tFpSGRV?b>QCO
zRDl(}8nDz6)KhycYBNBw{s~>2FW#z&UO?p+4D|du0Ho*db_KnTzOLsx8wGveJ%|^C
zs5ws`Cj9`{t_ITv_N52??3;mBnPEG~k)<q;&C+U<<T4N>_I!g%w=!=nbI5itpL;Eq
z9!q1{i6Dl3N&EVOVs^tMFqQdGxd9iVp>qPXQ2$mxA-*>1HF_h+=_n5uE*}Nti7u6}
ztsN2(0POU<b>%%^g;ui<8gn!eHTDg*i{)EaTHLwa62v@n-d|$|BT4>1IlDc6|B;4K
zFMg`lJ?;rijPG8L24vfXeRWia++!$9)Wq8v)oR7rMh$@n?sWkU|4i~|j4q9A_2v9Q
zKVr>de^J1hf+&dVo0alU-nlL~Q^jFLZ7-&-15^a`rZ1Lu2&vJ+Oem%-57*V6hja1K
zrKHd`E$bR~upLK_2e%4d@ZW+gZOj@9sJY){-Os=v4&7onzB-JkN>iSVaJ=P9G(6`(
z7_N(8WNu}82;j7PlIXFGd976>8iQ^3pVG>kQ#UYvkVTDa!!%E_+&X!$<qP;@73PzG
z0t6nGll_mFB&I#iu4>|bFg;y+u1U0~FWRXG=sj6CXr~JP!n5H)Gi<Q^EGp3_QBpV<
z`dpS>+k@IuGm!fe3Qa0+QFwi2=dP(iXoR}J&W$HHIHn@o4(t?@BE^F<Ag72aVOJfa
zSmQ<8ncXg9+(T1|EPW=ddiub`DamZ|0+?J*iF0Fuv;uke8rvJWXly$+|9ELG>+3nT
zaCY-o(Hj_IcDR<e6Ho$kyMUr%8F&@_s`A;pf`Da|l5HhTtAcXols<k#s)cI14Q9DN
zF)mLy=~3($e|IV7X>x_JYm_Wl&h_~HjdY+jFSF9VJ*YCL$QmqyLG<d>k27~104EC6
z;NgklA6YzSY~KjBru|<Na@?1y2ho%Qyd*v66E%!gji&BHfkgB=W40%K1kh33qhbh0
z&pB%-<z*XYTkRPRzX>VzG~1MtCluo^f7{?7CJ5`1t#Y~01hCxCV?|2*`2^UqEpq&3
z;%W<Bh{)J&CzxQdv*5yiRZ*h(0Vunzr}^5&8zZ_pgO>xv!I~ez@@twu7GK!&)}|>E
z+AfsbIQgNkv*WS3>}0DM0(dAHhxLWWguVc+-7vE!SlE3i-$oni`1??5?yCBemm|%p
zf<|W#uEhTW&Y(qF64cj2mK*y`<F2Srt1?IA5<~eJQ=3)3FGLhDtp}Ib4<J5vFpz_C
zcSuO!y@*VYmv?mFmHgFLMp1-Q6vegCqUZ&Tol$w=td(lTo3{E<PIp(<d;Dj8uIgOb
zy`PxQ=E;1+te!VZk2Xd+HOdBBs<8#vW^E`tUXesB&`_t_0)g&#t9U7VUAo6y#3v(T
zjN8(P(HMtSJ);|H>P7~FBcO6kB!uv?LX-bf+j=tZ0K>3FnbxYa+7jVWf%e*%$~}3l
zOk!1=^XO)Kr#^zKX|ZMe)S;53I>g3o!psu@Sz@i3QNj=lsbFYwLQz`$tTG>VT7`Xd
zGMdC_U8(kSnJk#vEa1<8dt+j*><A1|eJQOBKaA;a%~k2!>J0?q4*+l+G6Ca|1WiD6
z7l44pOAzdt0k&wMKXfU^l3D<fJ?u=~`#a)1R3FC#jD*qVAmqAq+OUjNMZOnhlf@J?
zq1@q}K+q&6lcb1wP)ig)y39aS8+-aFjwa*CbYOsmsJk$PH(wS@&NX3Dt!DHLTUA^{
zjh+%IN2`Vg(?CP=7O=GEz~C<aqU?DL8!Gm@oIXF-dcS`P4OOY}hBxgP>b(pf7o`Hx
zBXvQ^&STEm8<CUUK$VNc!k-1KRfO!<YNksjvm-RLA4|l-kvTy%Jl?()UPzw|d@+BO
zaw?d7n84qpznv)O_rL#C^WCkPJziv`!BwNEU=N9!E@yB2`2eKdta{aTxed1c{A{*T
zkexK#rVqXEu6wT}WH!cTS)5*CL&)b*dWwNd>oLb<l>7UfUs&|Y8arow!QVPd3mJQ_
zq1yssv3ylw+0iGW`K+tOf{N5}>kzLpU_o(B3O>wXDI0J@8xwwCR+?GOrSG`QoCu*U
z4{1JL=CXJJhX7C@&nq#7?1j<#Z0iroA|hs78VUzhKFFpc?rpl9E_QZI<aX~#=2?F9
zTc1^Ak2dv*b|DaP;YwD83nU0J-G-Kt&DL+K{e^GtF(4!16!N+M8UbBbu+QHhS@<ad
z`*+5tHDA>wLG6lU$y8Sh<A`+(SDD?=Ix~1CuB4xhR07b@TAzSI>@B&-1)<-$&deH?
z8)jnf67|WmIV)P|;b~SN-3nbnyI1QYe*@R-R>JJE65XxbY*)P=0Xr2;220E)^eT8o
z(O73|HUi@^&l&r1oVcR--FVW<)zEYPjV)9%X#i*GWZ~}NW@+m9pVohf01waqWdsQS
zpAxXMr#HZZ(gB9`blnd}P=j`j``bjA+(SB8fS(rpJ3kFC)@~=1vuhbqAS5kBMWFgp
zQ$JoGSlek-k{PuOs?dTn`#qHNjk!s*Nk7Il(du$m$XIXb_`Be2n>%!Ghi3r*%Fo}N
z3<k<tL4lv=_4T!e<0=%UWZJ8pXIiV9%bk1Kfqt9E(|~0?d%_Clx|NZ&z4X=!C!Y!i
zu5UO?j~1<lMYhEA^UufU`krng8@<xJae}&l5dK4xmD-{;m`X(Vm#at3njhw=o|1-!
z<9mW`Ajnemw324E1JJ8{Wz^z9C+da{pN$s36(Yd$?qmKKd~x(5Imj`F#YaNs(j47y
zzq_=AbpWolZ<?E{`SpBtY)#Eebn13`-pYliW3!gD+I40VQc5j5M3(VPYkLrM@qf@L
zmH6nFErYG=fOf#=a>Yw9r0}j6{Z@0mf&E@4uKx+|rX`P|v|P78E)(b1u%CPvt0E;>
zCs1m>zhpU75sS6ZerlsEd6Ur<i=&AFTkxdfdjyEj_r2}N)TB3!yQEySf9oI78gtQk
z<h_1|^$eN08@q~1yxr679PXxcF<F*>b`mN*W;K4$rzXQscppS_@hvzfgJD3!u<Sle
zDMjQ+kK#j3$S##=He{1$0ZME}>B`M+GFa7GR!9&?<sqLP(&5PQ6ImM6nXw!m1@l<z
z%K>7Oe(1zw#HF{&h2m~o6+N$8(P60aKnS|F#3$3V@0`l>o4Lg2nJ|H(bF*vaT!G!C
z+G(7p#)U+gT}E-3@v8pa_`@SpeVKVkC57a7*k|U*GQS(({;Q5<X%KvR`ZiHr;9QS{
z;?M;7j6#y0vT58Eg>1>$b|v+>t7!9mo(mv&<lr?SQz*u({Y<J%KanXlkjD6Zb#67K
ziGC{~)*(vTX?R<hKvxd^t8lI`b7YunRvG<Qw3&-TWamgEjg~USe$b;|V*n{?zLOk6
z*EBEm;{MOXfZMAq%aV}##n!Qn=aONTc17opb^*(E8gem|iF=(ZZQ=gAv$7wHXu<$A
zHB~L5Hb}8Z{F6y~ZK&ynhl%Av%n7NcjD^d^_(NFhCZ=B71vF`exufld$~T`=#O~t`
zI>#(L;&$?jI~;hgY9FEFV5(l)4bYHM#hE7WVXk^N;<4X;<B82`VsUxlX%JF97BW;A
zrflILLUs@x!Vof4<aah%?{I&H8<hb(4RFzE($RyU%C3JG6f^HN3@v$;o#G|eO_!8C
z=2ir<?=VK{zJi0aaS6u!uYG;M_t1ht7qh{k5;xPR*+{${@UHug1)ZDi&%p_)1#YFy
zTK`7tlPS45-+6344O~7w&f9ZtJHa>Guh5F@;LSTF?qd-L2d1UBCJGbsB%%S5qQ4Yu
z><r1saE&3d4vhGcXM@YINiPb|V*eh_J&;)la^xm$bH0+{Ktd`fUz?j~2!l$Ik_?-=
zC85*E1j$vO{*lkbS;+g1pj#cP>LqI2OB|OcgFA2Yz|ks4K{=V}{+*NVyP=lhNeY=o
zbJh_;A3u)4z324f^)rYzK#m50C3c~Neha;I25zvlPR0d~+Sm@82X+b*G+>g{ieAD+
zZh4a_O7;D6Je@7cf&sci(1#*v#M39_h-A6bnzs<SWreYl1(uR6A3dY-7fU@PT+UVn
zq*P49w%%Y+m)_AggG|6!ZLAbCEWhSlC^>}O1_bt1i$zvu5KWFuqH+vS4891GWzS(%
zp2_Bd2pyy064;Uk+OV&1qo~^^Ef+QeW&HWDy^zFuB>q_tKwZqh<+3G75GlEz__cth
z{u36o(8ccyA`=T$Khh+T>gA7+<i5yhe!G1%Q$AyNFvT_o?(W|=4H56}<9rX>cvi@(
zl+qxY>Bf)N`_)(=t2YYZg1yw~K9+q6>)0HX`FVYbPez|)B<pUstU`?{3jJ}WKJUPU
zgAUlS>c2oag~s0=AWk6=W}bZ=Piee+>D~)b+8;+|6%ynhyR;QTe1cdMG6oSFs@%j8
zof_+;5!%*G)!l8WGxzc{&SZnUL~)+e*8O^VezN751MwschaDQg`Q^a}>t(C;Q*t#1
zUg{0^AwWtWmUmF>lQcEw&6+ENMu08r4?&-_nU>$an)61U)5i5)E)CKKIU(VV^5P>w
z5|XQ@?j2;iZ5#NIDt81H<`*RbK5WFmX}kkJTfait2^sY#-3?0!_j`^i60)ZbGNV*F
zj2spx23fr^;CUaA%`M#Xd3@@;%apqzyC2Tym@Tftq8U#CGlo{lxG_?=XFA8N9{$5)
zQ1dW<?esZ7vS?tr9Bp9y_xbD|tzushHuTbG6c@XVvKa(!UR!ScJp<&$DH<8RMufNb
z(yoor-F6u=HXeK*mo+j&2h9=z^Ikc9)%bv{N*^WRH<vWvq?6}Jr&C0;U#y_xW7T}#
zCrIy_TsJB0EAbPRif&Y6ByvR>9I~(D`;v0*j&YQ-YvUa(yO1}&<U@UVneUr%_Dv0l
zb$Z5_(H1-`d=!BfsE#^SUjS2LatPMT{K{&CFkk?K5NH*wXM3@|fPhv;vIj1$#~~m)
z?}&%gW3mL8S$qHfu_4S4y_q|=Q43N710VS$DYGJT?z?Y<0)3M7htv`q-2aX3Cujn7
zL$*4RqCM*2FbZc7ak5j)_mRA#A&b2~E-W3Q3RfO+vHn0qL*&Sb@$4$GZ530I1vs*l
zxWx3i;}_V^*wk=AQCMTet~{|KN@%a7gbxi8ZDL;lOgFSPf!}FZL!jZ)c5<o3ACU#~
zQzx=~=;_gh3^U}byEL<~$0*z=Rx4-gfHxdr5V*V}1hmKC9W=N?nWL0E(EbhGpAlfh
z2MQN0Kh~nfq_Vv)YvMEWS(M7U=TO}kbJ3#DY<}$%E&C`SR<?#~9GQC>I(~L?qAL_v
zI7@H<ARe&Wb>(3t9%MUDYStR;@P>A-F3itrT|+%x7KvEREQe7F0_&s9oeiDdrIytm
zA(CwVf~yy@h8L;_fe0()RPK-*Ab%mIhA4NDh#-zMKXFdwuNf3V6*OVn*6kS;dMHEL
zRz#cm<4(+oUgl5H8vmMiz4Nnd_(&%s8W>mta4U~*x@>d_?1Dz-u#A5&BI`os**WIm
zhhP~gHy|BA5%A|#Pn5d;DmDDIe}4=B>j?1hj5KdJY@<~OQq$j;QILVM{v9+fU_fh5
z6FUQnKN?(Uyv2xd6qq88aAS*x)gyk84DUhCxQfLySJs&mQBf3@L>Qy0wlo}ESkvDC
z=nPan3965e2w!2mT*cH$+IyKB9?p)a4{Tcs;}*yM3dc4>6#s-M((-sO(qq8rU`Bb`
z`W$`^YVS6B<yG0Bnoiu3CKAnly8F=?!UmKNr;C#6P~UpvGzja5oGiU&-oMgGLGff#
zX&$_~$6Vg<V87uB@hjS3B(%|QZnHfF*s}=4I<xK7WB*3-=ZXJ;n;v93wuS?s{|Y;J
zg_?#Ggt@1~8Qry;VP%oOd{J5O_2V0&F_^kTR^mA8r`|@BZ=&68(k4|s>Qq;C2IXs<
zLO~Gi2z7)kUSoENth%uJDp8ISsj-7U0p;3fBQCp#lb9X_c2=DjUmf`SX}l%_lsxBz
zM?T@(Z=$ZsDuj&HK-@S2j@Ycu8_I~)C|!=AqrW&+c9TIe{h)`s%>$e{7&(F-m}RDh
z4)&~!boV0@^y(7yct!;JC5d-#vP#kKJBxkx(v7;?c~hed55-X2RtcKw00C#7$&g)j
z#|#8{XM|#Ek)vRMX)+cxvX&NrJ8zq=x&slMpEtxT?iK_kGMmT+CzX$(hRY#*xBtL`
zbkF$P$h~9AZkgg&#*-g&mjhv>m~Ce>f2({48yM)s5o``BWn$JLri_eExpBr-3yaje
zk=~nmp##>K*g@kHn}sIK>MiVg(@S{Ic+|8d4L+mBpOc@&^rDswXsHH(14|?ldYW=(
z_h_AH8Uga&`!P7V5eY#XVJ1TBr|oEF|FneC!ik0}vhoGkM8&D`%IIx!>VfA~@O<+c
z-ZTD4pQVED2Wd)Rs`3sT;+jWCypq^w=afm3sk}4uyN*lEOoo8~JMZ|}Ie}*75Jng?
z9`Rq?5UJa^R8?jUA(Y>Mei0CV)4~8z&a;TX#6mrmga8mO4J#14d~-0suW_)wF2T*g
zsI<0-=9_>g&=(HkR@-!@H2x$Ob5jml?-{_MkDpo)ImA_J#Va<QwIip{;6@Hj!->(`
zBhk~Z@S?MXK$!@~kVWR|pscdDha`#X`9aSFD5aifzHi*PqFEcj1IMsA5}{qcJ99`s
z!zdKaua{x7U8!soICjNrI_MkU9(6OqD3ZUs2BxBx%Q|Ry^p*P3Kjh1!NHuU?w|Zj1
z_1&6!VuyPWx}#pvb`i}wL@Y~=or7=E?R8BoDlCcb)*dQQ;2e@9s4=f@Lh?+wmQ&!R
z`)7BXgH(O5#LvE&K~_gRMgC{Z#LNDFW2XNfGO@9-|92KuXFFlD9Tl+KJ0L<#2W>C;
zfkJ60417p5Xk+xV=?tWC6D65^(2HZ}C~D4jod51-CrC~+;9bAK47!OVNWK>oPOe3J
zY0ylnVIw^dJE=bRNm-l!GL;<4@9i{=cLtBmhCOw@ayIIfU&NF@AfsJ74-(!!4{Gxx
z4)mu{{&59Z#V3^*>eY2FQ7G=s`W;wMShn+($kMWNBY@6eX7;)N<<0GUJ(x**%8Y@;
z`>p@mjE>OUH>X~M$()J;R%h8?;7%=pBL>sKUiS)lqoINp{?t{^BG0zBUf5_|K13$Z
zv0QO^Re!-4YaYa3-%Pl5S;d<%Fn6Lyz>Xy+s^0<tneerSIF>>6tBBxZV*_Q`aW$JG
z?yIhPAB$4Q@n<w8Oq(g06)mA*D?djQe+u@m<*d{Bdsu05$1MwKcjXAb=_0%7ravO=
zk0R`Xv4c<y8~$L@2xx6%Nz&3=-W=eyn+spfFX&2VDcN+{Z?1uP1o|I1=O<z_RcBLc
z_RQgc`M4JLwVw~>B?T=|LrXoYe%SoVQy;wzPTRl8PIkVFga3H2J}00kC}6mPnU+96
z#G>FRT?<oG6Ds_}$0;r4wEK26)>#OZ>2qdofL<)G3n01NtGb!S0OzN82L>HVH`vE<
z$T6anI8{;O?uxka)9eFm%qV#h6Aqiw#NZg9l4FF=5_$%O7rJ=GLTfwU4~7;Gdu6_T
z50|>Lp}gM2?xQbbi$NC;{IMF!%T(KQ<(q#SMYWq^yN3AD+AvPM!|`uh?8J86>Ig5c
z2JXAo^&fkCa$j0`T`Kd;3EiyZc;d;jGpthDMje{{bOw4lA5{6Y=^wBNPh^)Y6|=B_
z>xEh|LZquEC%hu7b@kw}3bxugr%SQCK4_@W&$b=Fki-?uyO)l-1ll&DyHeYGNN@i6
zzDRhPU)ana;*sLAF}7WXOq$Hi6KYJo@#9H2#}RSK*37*F@Q^@LbD5j*vP8mi6nt&6
zAFR0LYC*glK6PeBCHEXapU<o}=RQOLT|xzsH>tht(u(Cr+YHn}MFOD~M2U1YjoN!%
z@7}%Zle_rtPaX;3x<dP((|_Q733BSqv|!LKoP^!GGg|3h?lis2tIPg&_fP6(nRV(<
zObf)YV?F@>o^L0|^?i%@)oqd}UeGcRC=hN!@j4VYdaOVTK7;>UzUz;0zkuKdL^wGR
zY<vA+W@ds-@_g8y;mnlx4@53{RBoAXlb=tL>!U7gHK4^o;Sq!A%-O7z(S&f3HFFio
zG5{Nb0BO&R|DyH`!_v779-x^N`}umsh|&C5S6I{=yfEHmW&~FdJs3g_Z(^~3fKVW1
z0rG1u(KWKDYBF3(DbV{bjYZ-zAoE^jV?x7xj0}5dO6^IU-ikKAR2ZXb_(S<H=eX%;
z$N?f|Hfc`KQ}M>q(SfH_hw}2ff!(Q!E{-dP$s%@G0LFu|K^N<OZtRrS@ejxa8Be3b
z+2)&yFY!TN9?rvQBVLwu+xebY_AP<y*c5Ns7xkM6T&I@Y*%mlBdyTX>z*^W;!Sv*y
z;*wrouN>u2R^?0%7794MkXWtkLz4!EQF^Y&{!lELisJa=Qe2m+cvnrPqhK(6IyHyB
z43_GtEi^pPG2oA5sOX%Lm~Lfq1><{OYuRx8JrHWtw-FKLWF6s6#-pCtj@`$~e$H0h
zLuG@ELQ{n3uZKORENIp)poIetAAi)O7)CafI>QCahBh0G<TI%~o^l`i9n{fYz^+%F
z*WjWS{XT#cO7ba;#DivTrMGlTeX4LX(QodlcgHu7;=NT3aWXF160+a|9s!a%Bi%y|
z*ouL%Y~pXEB${xTPPjDp%dzl=n2&lcqHcX%FZ=@ZNGB>OZ$JAL;FlkQt#spfTiW+B
zF<q?E0A@nAK&I4BCA@#qk8Ts>a^F|`lF;dk0(F{G^%f$8R$^WV#Z*m(776$GJtsi{
zf>99JD}&BNiX~prj*nJ>7L6JN;WGA$>7sLkGq<A&{1dGSN`-ZQ<%Y;-#X9*)>85cX
ziXsrsk3TG%_pRdq&>NydyiBM=L5q$Q4}gajlVx5osq((Q5(@f$AKn9YDq$^j?kx87
z&<KN9{c-_;FCr{zE=;;Y$GGG`g=nDo*;BXdG~tNhhX+j%COvakB`(ksiLfUYh@{Jr
zg1cwer6Y)u+|LDqfe9vgsn;;th=(V2?IMoE=Wbd^m_D%#$nCyFh-UZK{S9W1S-?I1
z-BvBh7u-<=)8;OaGMHH_yv5KOMlh8IA>94vgz*-Wo<d&weRC#~I;|Z2=THy-qbDy9
zbri%MZ+cTkZ%uo4;pS95Y!lR_0s{V#$!|oEfc?Jv-4&ft=>UKXwIi!~(tK9r%z%3a
z(%ZaG{qvqMz)$zb`f-gF+&N3{dCu@E2o!DIOcZ=+j%aWRG&W~9Vt-|jN4e={)x#{~
zM6muG=Dy;<DL0z;G|2aF`iNMh3?_y<XX5?4WjnxdqqblUJ6=9K^ytmf>i)FEi+@~~
zj{@o!t0ca5RKd9j2wY|RAa++II&fP{gvferUh;tvkO5ob#w=m`@Z|0*z!_szd?8%0
zG}q{e^YB>Qjg_d-ykU4K=NxYIgNun%zW!<P?m~&Enu6z)11V;GcA2B4RjA73ozX_U
zt&=`8$4oAK`+2oBqH3Bwh^Y%mo;Hyh>yE27jnL_2AmJ#+)GbsQvr6rN;b4>-q}8U$
zZpK#v5QqzcrCu@&czFa1>fQ@w$hZk^kT@Xte#30&sziYxU0%xHVzWn-pT9>@<5Eak
zTa7CwI+yOMB#%OBHF%s?G=uH~Z2yLcJ$qlifULZH7vXt3O#65ePp0}(j9dZplt1zv
zrnd=65iQ3un|>z#GoC~FqU7(ond<=JjcrI|yw7nGy^8kTYeR39Pf*_2duK)lEJJjq
zhq!vW(4KLqz-`p~I#+p$Uw6}YO+i*dKJxK?j%Z7{oMHPKfaOgc8h>$4So#8Q2v5fS
zUziV1iYg~MI1BH8a~&;x=S?n*pxOGHHx!xR(#WMiQR0Obr$t1ZUma`W_&ALc>v$CN
z1r-qMbKgDg5))X2kdDFqz~RaLj(}a>2nu-QAd4iwn6>9^4jC+8_kF}_vo@6<!aK$&
zjHkc?_N0KOo_3?K{SY6g^HPfjrt+$l;e)2fNg;k2Du>bMKtRlw1HUMWUjFZ@?aI>M
z8$q`+7W^Dhfo4g4J;s18pEjWl1lmufQ<b|8@A)NuF*I&n3Dz2lU^f*ZLY;m&{P+m1
zWjW55gRq_D!t`yafy6zIU28E%qx}U$KDcl~ypA5})W*YCs%kxf(Bxv0TSGLu4nPE_
z*cJ)G1C%PiB|z8lPOcOD2maxM1kC5km4(@AAk{NBdpMLQ=d~Xz+{Jp$J8~CY^IF=o
zV}mHf$r8~a#%oQ{1$|4P{;I%iNvk7Ia?8fjcrsU@p!ponn_eJQgCiS9DA0RZI5wRp
z%YhtT-t*6$#g!%2q&k`chrsDy+|0u9MVLWD{c*bLegG$D`ujhpae>bjqT52LT@0Nj
z&vXJh{~LOt+aEk>l9iPU8VQ5dH2k^Si16Nd=MIC2!w2OrkT>RD{>83DySj6F)4O_8
zxwn?P&H3tq?gmJ=xb{eHcP{9Qd@0J50D~xT#$%lC@%?p?gh35kIF#}ogE`&tRA8=#
zbZM6%1L$v*n!I<d-Ru5v9r8FoAL5Ktav}IV*J=mvA{HzSHs>f+9iWq^z0{UOF63&C
zm-*GRl_%juk>ljLQ>mWS>UzBl4K-YO^nFmo6y#^Au|pA^lsPXqNxW<_dr`!1F8iyl
zp7U>)KsgFt$hg{T%^;6EXppA<&x73COGb0+fARS$>~7=KpD=x<XZQ6db4S+=F!}y9
z-O;Q|r;u@@X1Pjl_8&tOWfz)aq}v9<K(nxSbSK+(;am_B8FfnOZ3qv^CB03ghNl54
ztU*;MaG2o)@r&6Si-qvbPuVk$Yl~PKPuS(RJy8%<ThT+?eQFa<C|^x=pghY_<dCSz
zF`$cgNulvg)^SYmr`^7X$yQ5lM#&1a)8dfdknoeq;+mOR6ml|7-36BR<G46g$x0sL
zP{Ei80+T80;WMoAjS((0?+H&ufX011w}NPOH&=9vnDX+w^aJNb8V`~Zo+~+YdiXLC
z@GpvLU{UgUOt5JUje2k_*6fngkKYACbO7o7KDd@Zk&qW9i@0i*_z>EWJqO?=o7*9e
z*3Q5^L*8MW3O86tmpWBEc0YkHtEb?3!h&Miet1nYUVOc9b%k6vP*cF1Mah6!t{f_Y
zdoH#C<Sq)Lm}1u~L=TXVnMvMZbDHS64TRq~I@gz#Ndp1?PVp0kcZR0crB?J^F|YED
zx_;f`&KN6Us^svj^j^{Nt;V^>R7|9vTN>3+k*H)9gY8(w9q2qa9ozOwi{}Z$doI7}
z5`o+zVijCbr9#ASw9DY{>Hh{#=_7UepYDd0h5f($4L2umN<TCWU|2`jc~c4{=(!#x
z8mts(GcD-z$S8ZbBDsJQydlI9CYnT_4KuDeu1WB`>TQKA_mh^NivR<v=J?9xB-_8;
z18aad*K(g>KgWVB7js(H#;dbB^Pi`F4dwd{iNf?mW6Y?mG+SgNC7v9Ho6ETRUXynG
zw|=jS@i_f;chcAz5TY6)Q7Bk|dX?9ui?l^P(t`%2w$qOqgBp*4RIHl=C)V+cOgNlF
zv@jxrmYnr3kID7sYY05vLsgPjOQn0amf>Qri}NVCEUfHD=Y^+d$Jx<IW5tSkGMZE<
zPDOUW%);IZob6HosIp~?7yjEu)O9sro6cFjt)jZRHR&=3KpEVsZx;xokAH<fsHOL}
z2~tr^40IsGO^iII_-A|tWA&3=4+<%=MojNOQJ-Y+R-GpEcK@XI=}_HH+Y=_qCE;z}
zFxK8PNR8=}b5hjCM#NXyLRxj8kuD0<6XI8jf1^OTz6LH&0bAi>2%q}_|0dC8KP1hf
zGk-ILv_;1gfZmo{QsvQ0zU8sjnD@=BM+ATMijecz3oD!gbDdmZ*8HkcFlS3_UXwiP
z5m}zc6k{NJ1f@Nb63~6g=i!BCGelSM3?D}jur)#2)4|Zpa2e$~KtNV({};+GHWYgV
z-bTj$<m#a1a4yYwIuP4XmIV3>J^a8{Y>4UF9+K1wpz#PzPMv1gS#|sqvSY1{q=AAq
zdmaJ-3zkAx0(Be+6)U$8sxK#GEWrxDQ>biN{7)!Z$nN`xof?t^rhK7V$I*+TZ7f`L
z1NaC>-j9fprVvhvXf`hzH*=yb{q?21U(j(lQ9RqoIYnAHHR)p&88s>>4zdH`H>{q(
zMw4y8cm(8#%8r^4C9-ioTDl|!#z3zsowiubCPWzDj5K74CZ4Q~O2)yDYR_^!gD|c%
zm+INi{Zt3b^wp>S6(V}^<tIW0E1#3vSo@SA^(Y)yG}RvZs?pdn(k-1v=fUx2D%M@g
zM^tdu$R-Pvj!VikF&N;nz_C^;%NV@6l!iILyf}2t#T8kkC^GJ_Cw;iJy4fCvLDodt
zo@R7Wk=l}C|142`8E(r@!aDDc9})WX^xJ{HCam4d3+jd$B>+$4b|i%-(fH0vUB0b*
zpvcu;IV+%v^%4x%W}Qda%l8yQq#uP-BCfE`p<b;HJ~)%MSpBhc1#|32h7|$5PA~$%
z#jxdRwN+B*$Z~yrC-(`zpm{RE6r*ZII9TG|AAH19->w>2rz5~8SUHJyVoVKd;%J=+
z`xSEQ=v4zxLY2)<QY+=S#h#*jsuK*ew{_M&tQ72B|N1@2Q5-B_?E>4&eG|X)caUYm
ze1>5?^80$6Z3H1knet}>7s!ZvBH<5!0=MrH#=`<<g;r*d`({NgINuB5?ED%g>ppX6
zEjW=QBX;%H!?SYP<WHMg+DLe6-=(`Jm61_Zv8}qv$)c1*0~kwcvl@N4{WK)X)lA$7
zw8g;gHintH)VkZ}%{XMc%MVRkwo0)PnTbQ{4P3o)PMo^KzAE(%aP+5NwxR<7DOg#3
zn^pgVf)x7<8<H);&xwSe@7HVV`|it?pM|JMLbJs@W1V!nk6W(SC$SbBPbRy0y?p%q
zy#_s<FJ~WvM?c9U{~<?$5KAg>3whnud)K_CE!A^gak;aZ#nX;i^##>%e~;AAcA~Hz
zQPj;~d|dQMM0P|}HUlX?$449>0!;1%?v)`aJ^o1SD?D|rD#TN6VGN&qPg2KA;*iff
z$g>Xq;=PXV#|FlhA@`lq$_~DKvjxx!=Rd7ZHx&T94ios{6d1RW>uL-)6Qp!5)3MdZ
zie3B^CPc1D7kj^tKRdZoP}2u^IF}L%jd!NgVNRH^0`c2Aluqc$Rbm0nM`h1D*H&3p
zp;5W{rA$irx%Fi?!SP9vL>0&^&2as_rN#N$`-<fv<}Hq%!jP;=vI7T6GX)k5IqK{g
zPak24xR)t|!Q9)3T`w5WBsahHG&k}(l3<YUR*(yC3JAEppMmoHzXvk2&&!}~(n=^M
zh(1wU-}ibe&o^MFs{H_O?mw-;^m1_k3DMoxsyJUaL8A)lvKTqj>^3GHQcLOu$U=(O
zgzrrbz;kE5tg7df(qG!hEJ+jiy}#V1X|N#y2ctlOa0Q#+p8L_EFkBs-?Ma_5l4hA{
z$2J}V>l(Y4OWgv=n7FY2{$7xY7Di#>dTylKB8<Nm@^v{1(C7f@zQI!vy^MEjdXGv9
zU-9QE61?~07%<Jhax%z`4pKYTcRCjKB0V26a0H|Tlo)t)bbP+fTy=Hv5ZgC9qGo+k
zFt^5a`XwLVZ!S!Hu7}NnqP(ElCH&hnoKms^O3nM{xXhW~;Ksa-qyGyQa<gFlFKI_k
z9`65w#>-q|=fe@q;oWETKl4oIu&2z{Z)u1JWRk&Hy41{)q&Al0sOPB&vRuhQZ%D(q
zGcG>No+(8(45+?3qyA~5e7*eX-ZV)kO%vav)^%CSYHa0y9bS*cJ>RarY*&JAKl6oe
z3OerxIu%}T_Xo9~^=5sB4US*_n&uLp@4G%F0J5)J6RPu_zh7_CGtqK5i>f~1owBZj
zUY-j1e`AHbm~%|@&zcU$(o?0PPS2VWE-p;RYR1Yh>jiD|1bH%BrSY0;kXL80eF3|8
zHBbUS>QdJgMhMjxhKN6v+q}C@E{Tht0UsZ`hP%QvEb!DB^<kNn^do`ihZV(dOey&;
zfK!Y~@m5GKjyhdRg7tRI1iW`U?u`b$p#xuE-yH_*(P<}tf9lls*Y<U$r(O<Y`CbgC
zuuk5(r;A}X$R(Wm%$D9ZvcbJDZN;$kBc3h+83Lkto&oyUeJWA{_Eg*4UR-CiE=@-4
z+1cz%b$H)1TX_Hbl|94U9s$fgpbMiez%WMsicF`)Wjc2L$WGR+OE2U^p#>$*yd@Tg
zTfTdt2OVPe*b1@M)GDAlV+Q^EQ@Br#mZcy~E%~tYr}?malnsHr?a*3!ve(3O>6}~I
zZ0F!b&~hGSPtP$o09p#gQrEG*yIGEFC7-S1?}ES}RmC;i>o1yU@m5LFUsWW0fYB-(
zcc-cW<!Z6#>H`)ANZJfk^%PR%98_DGbUjMhcx_oEhY~rP8N*bJnPhCsf7M2=v~eeY
zp4M9P*G02kB?<rzR-9Iin%_C`oGc}joIs_8+e68MImP?{3Et=cO>Dod7QOJ$pWmK6
z&hUlWqJ2D_M$RYGGVnQGA1BiP(w^&c_OfnT?tYAvyhie(?qWc0+#=VS(gB}23kYkm
z%%H$2<2-Er=3$)CnvSwdMFIHGiVEs9icw_--!}q6xu_Y!`vKp+9POY8IM)1kX0J(7
zH*Hqh*G|iLP()spU@BfDjs!0Vn&}R3JsxDBR-Q5>nBlc{pCnCnrvLLcfT$R6pg>L0
zEyphJdhA2m{i*_MhEnr*_Cad}WqJC^@tGM|%^u|9qkMs3iet=|WJ)EC`?N5Gi<V11
zxZvCO%S$0E$Fy^M5U=)F0p6dKS{uP>EEJA=+_l|zirmF^hHz`Z7i3k(iVy_b>9^;l
z_20KfC~5>(neb?yan~VVz#4hvzd;8BzCay);cV;3e63NWd((U83TXP1n$8SeS_dUF
zl%Y>0D(PqbZio49_GKP0##m?(&FLH_pitdP%<Ac3z^yO%OwYzjIv0Z^6e$wj3dLx{
z3GAUx)Cj7*sX!l{eOb+=xgf!F{p4Xln-Q^=^d1;}J%>N>>IN&oZ(mdWjFMN08F``L
zA#x<i$W)+!x+@X;VMps7{Nt<Y1~JWe|Gk=(itdVH)b(`yFecT8z!iH0d~1uP)@1Ac
z@*;h<`je7r<)*6gA(@~&9Xe`}98cOW>=tNbsiSHAVDwa-&if+NQK!qe)ncSMa!zt2
zUHgM#^nye>#K;3sgg44Z6FbS5sKl-g>d6Ao|J%Qv(478?1P;arB>|B;t~%E}H7|&=
z%mZYKgD$AGGC&fEP(%snei5q^A5K@=8ntrsAl{Tm-yKEE<qr?L2b$Jqurjd<5MYmL
zn^0+8g$QkESY6CYr!E@eST`b`cPa>#=n<fu^@TV6PSyY%77%eWA^Ea>9nP(J8_EU^
ziw2Ig17u1tmveY2D@H^GoeT)je22dTitQ!2oR+O)-y<YirL<U_#_M@1M&n|{$?AEy
zu!>y&Y8H=tisxNua-7y_W6u0Avcx!Ky3iaoHUeHaEWD<kmL)I%(@n+qLn$g-GLC#0
zPh1}6+Ia!D{Ee>FLgrh-6pb(kKneCMt2)-hgG6fch&s?BR|D{{TN6YZ-wnRUmA-(E
z_q)5UH{Y*z|IZJE9eown!k}GuY$&EK6S{Va(f(sxI}Cz(o)G$2=)Ip7V&;1*vz^1Y
zVD*ke+KQ$Byi>P;OwK>=wD7P0p@fGMKV#?K3Gg1uB)Fg9`8|qkWM(lyUz9BCmZLy~
zrW9^NFpe<-&L+k}3&(;JTiq>2pjI?+wZwD5;1yO>)*-bJxC&}Bler9OQ{s#_+1woh
zi&DHTC0V*%>AIo&#N(J{U$X6eIiF_0s(t^p-AQ=g;N<V8ykfNG-<b8D+k$RLVC@u-
z1o)3VK=g^woYtoUS0vOyaRwCZ$D5fld;W559-dd#BYDe+iD*p7#;eb;N6;=RK$^g)
zbA2i3r~gDQ=hrB6G6X@^RSl-*MG{CLhEih31d<{cyr;C`gFIK`?J)*q?`eAnLk$uq
z7au6Q5de_DN0k3FCf4}1i8tb=Z5HqfGIC@88?^@<-K?ll$t}k-uM14~zr-}9<-o!=
zq?wuJ_Jw9t)T9tt=Taj#m1V;9p;$4}S#b<)R781#{lC`)rn0Q)K*TdR>vc56Yc4sO
zQv1ZUH1=fU!DkO6g8yqqu+<q>&YbnE&qs(Z5TYhBu-PL3&5hB=-cKox|15m#?HaMX
zc~H6Y)AjrWRv|KKf^Xb)#rKZIKC2Q0!E~j?(v79GTZ!KV#%C-VPGH=1&-cTGn>y>?
zilChAw2-A*R&Ak!hyXJ2(Zb`dAG`=Y-Tx)`aFz3rGZe59d|D%}ps^ww-!zjFk<K@*
z0TK>ivA4|dLb<So&TB$qRn?{Do#9g^vQqqylBV?Vv|J+}o55#wBmRd1IMmV11TXub
z|HnsyKLa-Qr?@WrNcTwT>24@SgHLY<)$#r#jO9j-l{IIfjL@f_Z%D#2_lV~LAmE$9
z`JX-#`{Sdtv`nFkw(S$wjl?+S#|#2g0G0IZvk9;}*M@Ee$LpciLO==m`FV~RlVwUr
zaJ&3Q_zy8_fF0;R<PhOiM#4h*&qOZYH<!kf8lv~kUvF*7!U5lx)HgwPnv<1*9K@I_
zhAyXn+Wzf1q`7Niw2u8VKxqDn-+=JJ+B|no2T%6auAY0-W<8hk=96k~xpS9O`YpF&
z&i5r+D)Zs9>!e_7nK;Q3XYSEU)(m_2D#w51eMa1K>2NydRqtnD?KgDhCzjv;qi%X@
zH@D{}wrcJsd=JuSj}HVlyFRnd+TaH4q=X$c$pp;R1;P0}u5<wU|Cn~aG5IUh?BGxm
zK$5zA@wB%&e%|0nytfIl!7@7hkP&axFLM|)efr48tH+}H0~=xfpWHnM(iX*hybEnG
zx7%R$@p4#lF!)<ldy?^6ys@Z0PLcmuaDgNAwsU3<DTsm-(dT(XKud3BF*8zNK_lo(
zJ<DrU0V9ENyIh?BCFmjKiJW9L`FtaK)X*O~)VVJnonxAF=E%J66Fgqw$UN;EG&uKi
zFJ-luABp|{od9Cx;pF`9{EDujvpzRM;B)<)`8$g)hHM~+WU!ZEI4HhKbKu&_BdKB+
zqmCVR6u8HCP{eBVp%H)gS<5ykln3KIQFH``?D%;Iy7rIaKQhCp9W>*ruCdZ;)HwzW
zO6Wn#OsRj(TqsSF4N$WrTqzH;f5X{M)PaSO5~#U30PS>e==n`l0W~k(JO?4W)#RWk
zhl;YMWMyook_eV~gyx22YQU62*&9J>uWh*7Mv!ta1E6}LGDbE0`HdYy7?qA($&?an
z0&Mv&COI!SdY$S)YB;JwHn^2yE0`5<OjUa?*gIS+P(G~#S+!!wUh7yL2pLnlb2s2P
ziV{nzyT{9~5Y-ARKv)k#3g$~?2$%}w01tGQ#hCR?a<G1%8z?5^F8oe)UmOc7&aM?7
zmcEE$MItz5Qpn^>?ldZn<OD>}5b!xJ8pklM08R<yIN3bJnZ+y@^Jgjwfx=I<=xU!{
zupE|hP$+E|R1GQ&G8uIDa-inDv9$9Q!QY>Z4qz~rEzkqtfM2j)0}ecpIprWLG#ZJv
zc)!ju=#}~KAbZhC_UwIfa3u6)5`m^Kv9WK-myCyXYY1Z;f}t?eH?_l<Hdb9od5to;
zC@|x8a{VGodq07B?k#)hE>^*a)IU)ise(OYIx`HT?AZ6xo2G#-F>qoyX&47b<0<10
z)4jyjPH%S)fckZdw@<U4oayvcCR6P0ECu7~I&5xj>n3}LN~eSL_1EFE`(f&5E)z0c
ziKQ2(kk$GdBAv6LJfX`(W#CDkfa_uk81Fk|f=QuA0!mg-mtIbH9^<w?!`^UIc28!Y
z-f!==>uUpCo=Zl=mFuR~$B;5=*iN-4J%epMgRiV%fMWjiDg0hni-hGxWOb?PX+qDP
zk`G&8;C;|~;P<Q9*Q~``fUBoar`{RtwF9H|FHyByTHQKz;)YHKc1bj2`H-om_~=!q
zx5I<!0Y&3>>E0~^CT1a{nJ*Z$Ji+g?w+2-<z0T4@Iin;ga&6+V1>Fa-2gIM``MzRc
z6yteI05l^1ej{n3XVUQ*%#5_zr5=_X&5Vz?&1)@Vw${^+le@cZBQmig_Pc2yPIC3^
zSW14>W$gZRZMYeVbAHmzE7z1N!NMiG7}+)YT~`aS?^ICeI6<$%j*>g~<wo=KFRl|t
ze9w|NTNV*NGO=aspNr5cw;<m2#pV>~Xl-!f0G!d#ITCb1RK>r(Dv`yjIz4P|Pi2<$
zB1fj6Mf%MM&@##tYPX#C+^srot=$VeF`P(xTj;8_Mv0bEdR@Aw*YbGgy0rQ=B}p|$
zrdoHA0Uf$TD@U=-T(Y|x7`-DKolexXT&^3P(@_;?zvM#$hiwewY2Hh^nC_{s=8dhb
z0bhr&`3b9>-<sMF#?19jGilt~P4@NzPAAwgzRw)ly8#)7xlGQz`7^VQK7fXgtJ#?K
zV_$CHTTsMFXr0yZ%WWoD==%N*iYHWE?UMJeZ{1*^yZ}y$AZirq_DS1}VrJ_>V|?sn
zqqB$_TD?X2<GJqN5Rk7SREB|ko}5bufKab-2DVV9utH&+Z~$LRN1nJFj)#o01a0B-
zF)8cBaIxXnO3-Fik*@{jv~9hX+tJ&kmb(Vg3IXP2Z7%}1v>>Y1qt`4e36?7Y#lmgr
zy^WyPI$bVhAfm5#HrHx*b!3ADwtyH7c{B%=5HPW1KK)%O7T}Hl_<Hs@towZg&<T(6
zRhGaVeH4Kf2D$8&z0f+;wlzpx-5;r^M#CL{5G~((pAqxd@5L<TjB5_!q4Fd1GB%|=
z0&%=vyQuvY_=+Xvx65P(eJ$t57KQUw|HCboZd4NL_^;Br=>Efc@IG)~g4Y2xYofi`
zT6=NZ&{XGGSdXxSu=Yy2)BbE3Fy{D^%MM>1-yI*Hh_h?$#%$0YKNb()3$q&!-$-6~
zNey{>$8scm6fptcsPmiD$!F`PeZM6J_29oA<#BX*k&7(cl<dn6ri8D~%u^sL<K=M(
zIQnedY|#E}-nSiG3@=Bl&z+RP&*SP^y4f&|P#d%tWG@X*$1~zbR0T}<uQuUzf6}MA
z-DnICX9WWB)kcJ(I<HM^d&#HtO071{?BirrRTHXEc#AfUpK3>BdX{`NQbk3pcPc3c
zK3p}@{=#$p(z<>6Ue&XN*?S~Py%ph$Sxd64Rky!Ui!W(Xt<DT&!sl}zehu=59)VVi
zO7TwW1W}tYI(JHqFaxB~Wpr<*<2i2CCL>{r76R81b1O2d{4{da=KJTuXA%Qw{FW*(
z@sE|tH6EklYtTonMT@&uY`;aulROWm&<?_97=$bZ&#y2Pjb4~;WyQi_{HC^PL%@=`
zH0aPE%8RQk!nnCL;NCO5suiHsa9y(!@acHp3=-@qqb|SsQ%zWlxOwU(faZ@<Zf)OU
zlY-u6&~(dQpJ_JYmLxeCcdRM=*iS3=J5?4xr{!LG@X`O3oh#hpZ9?{@EWVjG@l>iP
z0h#OHAX{xG6aPyBhleX&H5&{Ajg^h%|3WVt2`dK|FK-HP3KN2pmzyi4AB-9h_XMdz
zu(1FMcZjl;%hKN2DL%L71decZ#S{#YzK6H<qx0V-?$UO{b1FCU`PF;gT?A+4S%0-%
z?fpzdBZHxdBcbp&RwUW0bq0YUcB%`6)mK#!OACaZ9iN<?on8PktSYRD^N+BX51eOW
zaY|S&<Fzo3Sv*O>eWxP9zjIhhKiirh$J%wkb=E)_a=I7{x~8T;w5+W1zELg-d_fOH
zwBgZ#0^}kiGgwCu%A{7-*ZVf6R#zWEGXNp5ia1*k1_1$s2S5b4go8*t)`*BcP+)GI
zz~Vlrh;<IHz|7hK)a~gdA7km`WM<~6OF_ZO$thL@pIVAvnq3sn4+zK(YvL8bJ%Vua
zfXoE>N=8rt*#Leq#-Zkc71%lLKQKo`=T<i1&!Iy2aO>#f{BX$K5jSv96p05uFM`r7
zxB+LMNHzgU$6t~K&>x+=AXrjq-(~OK55`dp4&O*nc=(&^Yv7K83=Y#EWmqdDeb%zP
zQr6zqejsxzN6ch%8-VdEL83o!&A*`Vy3xOw2w@U2RKY-YF~9WlQyPlHx|`7d>Fm+?
zUo}(ie#Z({ADxvSA3w3S3H`(PF-o5&BzE`xs{i47vZb-bz3K4{nXTm)C+nwtcvOsF
zN>**y4|o~9kKG(^^bg`}+%ep~{;8>{;c;*fUJ#M1krM>~A)w&g6!~p){4V{~@JB*=
zcdlUHgCW$|=m5sU7xc~~>>oHV9{%6JfUd8z7h{Oo0Wg*Z7B48A;3)=&{cj5Z_YZ~d
zu-)t3`2oU$!4IJz29T59ps#n?>%akpzYev6U;j$+W>l)OoRGGbzX9@J_39c+GlYA?
zef>}-CdVeAzW~2}-Ga39WPl2NXG^2n++Oo#d=JTOW^I7_d}&_!=YOd;Ui4Z6-*(}}
zz+ZL^;JmI=;K5YBaXk#JkgN`$jTyf4M?bF<zX9rB+G*dbqTjukvcGlozc0(bu=oGP
zr_Bw&o?f^Q1KkXBcH2aDt^%<gzL_<_AL^GeTbj6DdjUeW)_d<vk!xAH-)(VNO37GP
zB<Pax*5>zsxXIqXb^yk#mM}({`I+&9`f|v=zJaL^K*05;rNiS_08jVq(Js^6``yQN
z5?bqs7Ztz}mmZoL<j)_N2cUHjF{Ks~5)gaxoi7Wx^_^!1f?iykd+!gkXPATBw={$L
zRgZss1OQ=)`mlV%J_sN#7LJ7Pqj-Y81<9cJifPXPRY(S)zyoE^k<GwaWWPnPb&tMd
z+IJ5zzDcw|QtpT!h|2Gv8^AL(z6+lDmcRaU``1F}_=@q_LA^mffMUV@6uria{f^<;
z2^{fSxvu?A2+RFsj)|Mjf9bsn9X}$zF$B>5Q4W9R`{G0bz+5LQeD^(vmX%=vz;-CJ
z^xD732aP@Wu}1+EKIIvo;62tX-_QZqKZb?(Iw39qecpjw0Fp`n%hqq;b<5`G{M$_6
zx7}OBdpE|r@Rhgi)AhUUv$VjezvcD+0e(P%zptdz-_!ah?7hH$l+W^Bpwl0De<6@7
z=ntQN<DKsG{<i%Ict7Y*|K48+CTDX;&_6o#F2dQ(?jHf~7wqy6_}&87KalmE{*Uae
z@A*9b0pB%x{tf?Ui;P_y9pAr8{(k4)SL{Fd?=LP8$Q@)1zcg=W%ol9=Gr0AkN`%0T
zVQ*YuhGI`6nTEk@$+6Al2^lt#rZPQn!|_gkByp%4b#+IA`c`<E_|@yAsTMY@IbNyd
z+55#HR(Wc#1%7c7yMN-xiAYT!(FZ~XRpEW_R|jwP04vBQ@D3S@YzG%^WW`*J2e)1+
z_nN+vmC?}oJ*E9hPFaMPl4*uWwQsrsg|ienMj3Osq%h75L~yj|7w#ytw|6t>Src!6
z#4@pT@IJpH+48-#H(8?|=RDWSR9T%m@yPMCafu*r(MP8!y+jX_WN;R|iVC7-LcbQ6
z66w!32)3aB9oVZ$I+plLMkcmKaE}ZE#7a<hrb45Qm9{BFhmNdOvf6Rcvun5tr(anN
z^5C76+7Di_J-?REraJ}+^;<cgDzb)urS!yEe+<5*7J_L%3_DC(;9SJZ?eF99ou;ad
zd-D^HU1T-Nan|Yb0=grewnK0|T>4B*NZG<=>fESmoeHW>f)Ngp0f$-4NwWB03{NvP
z2Ky_}->d||35p}9AY?5^t2bmiJdxje6f#eYgM^m#`S%}%5g|4g98~vQf)`DHN_0R|
zQK^=^GF`S%BeKsCWUMN=RXPbLeHo%g=t84q^5B7X!9Tewi-5o%N#VIv_>Ey^H--0#
zM7-m*Q^nI?5RObLMNQ(or=&|J&q6-wyM2*IsVJQQk%^0+vt*RAX~gGshBJ;%UU$ea
zVskE3%o6b@tK!KI{UWUs40gnSrN%2$2pqu5OhViaB1;o&(6;QlGtV8Wqf1u%?N<4A
zxdZ=FOCGb^Gr6t1rJ=wmmQSrdt$VJpzfYLm*4@a4h73I`B6MYKfa=s$EFY@aa9@JZ
z9_3-G;!(6U-(j?gHr8Xv<3eN~)qkhBJs4A^;Nmz>BPZZuUK}+SI6WwTKE9OG+@(1C
zRlm>&x1o_3y0dc@ewU$W+*6HqY~>?c*@5rf&Zm4goFLCVC0>ZRA=nmT<oT^J#)K&>
zWB29~>^xW8?<M%use$PH+WZlmi>Vy4E3>IJ;4^fdFKAM2In3ZRoqmp5W$_Wb3ze8d
z#<}3wqDaL#T+-@u0k6=1^LyDEZ%t{+dPsHYJiXA`+G#{K-o`j~!C}=g0Yib(x;CK-
zV4=RYDGA4Wr-*mic+9$ZucmT{X^v2f^H7Pc0iS!{eBqYY#!jQs$~#fOA^E_AsfVeS
z_lX0(cbQfPA-yo=8*6+I5>Fm@#Vg_l4;p?_?x)s8DGF{L$H;|$>Rp=dNPQu<zrctm
znIt7zz2>R;rVJ3^(!TO3PG61DqdV~gh2W~g>ZA;Rz=yG^V`!({*y-G4FTf;UN>CTq
zW~fZ+sz{mDSe8w)ud75n%WbUB@l|!X&%c=ed{V=L6<bE~7(nO?Orzvt{}FTm{q1OV
zx}y)4UZ9z7q(ohR632L-t&gp01aE-bst>{ZmjU!CjCBjvfru?!%my%ZuP(6RPN8!E
zX|{v+BBxL%g?uc_gm==y7;8So@>T3vo^{u7l*6$?F8Z1`4|lib$KcaudHa~}=5OO{
z^aXjt4@H~d7$l}V27-#ml|FEiKZ@_l1)&%BlQ9zOlVSIN;Mn6^iMTyM5NdFAGPtME
zk9bySc!>Oh^q+hy^h*c9)dVYj(a_g@X`py;lBBX2Fb#s~CT7E6zOz2G#@M7<>_3iY
zuz)#MCl>#@=@Zm0JsVvYnur?X-d5BGw>gY~A+rIAE8a|{7JcDtCWuXV<SB3!Fqh~w
z(4_A7hzV7Hcu0n&=D{yKz%k*N=g(c&WG{hk;lLn?zChFzOM|JB_$YH1RodQws=GL=
zr<sF^+nn^Vwj%9i$(putc9eiui?EJCkkEdJ>n^cTuKBrkU{O1BK+Lyh!20&_wk!g@
z#UzF0#~3eDz!SiXgdTGMzHQYfG6z{{obCdahfUpo3(%gZ6lpzwB2`gWzm3ENM#4u7
z0q)^Ix3yn-i8L)!o9HKU0uA$F-}T;-$#HUSIXy_5ND-BWy~=c+?z6q7!53#=07sHe
zw6Zoizj?OUx?6G^@#QnSq6kKUo4HYk-={}53kjd#z&ah2e4AgM_le3_59CBMFOWJC
z+3a3_7$Lp(p2|!bk4MN1A6f#6fCkdg`*ra)=J6#U(<`dhM*jmHhqQ)5IL3^5F=iJ+
zwcLB6Uu~2ndn@!JQy<(INa@&X$k+1)r<;Bx3y@WSgk@<pAX+8DE1jVXh8Sep5(W^A
zh{p56@~*W_qA!Zg!;)ftevR%GbXPbn&Rw^E--&jDEXZh*lJj5soNq38oi$?@c{6j8
zU6g^}3AQZ5cOgTkYXd({Oell*%!xbPZH0#sHE$EZLkgpS2rv|%?$T+y034cgx_OD9
z81oCPSGfA5jiM-miREv=P18nrJBciO|79xMPj^$!LK09OSs1Tk`}m`8$CoV9&j5{o
zHdK!&vrgCIf&}YPX3Qde*kL5uMg|~T12ApN{^CKa@(7OXa~EzQrOxRFYyijEBDeV&
z>dKGmsjWnyFE@9<tZ=OCka|b5Ld!MeBKNs<T)@b0%=hfYU`^)3t5~445I@IdJ~V<V
zqNh_~?WvE8oMDpuqJK#{DOaX!`wRkq<k|f}%hhh^8n?%1z*n!UtC%0&*{+5(AG;aF
zLkS7la+dZJWyurqF!K&Sq_hI)+5CQ{CQYw7^<;?Sv~12OzlF!=cdH`R`;Qt|!<MrC
ziVdO&c<~U|m9Irp;rX<9p%mFVm*Hr7BUPyXqRYV%mPod<<cg&eqBT)VgLQy^ExW6d
zuTNO(Yul7kE|0JIOwUc3#|1>{HzEK1eJv3|-<e4RJz&veqQkGF7q<}Zx{SS1N!E*I
zNni{tL_@sQM6ksUA9TE|oo2t3h;I?h074N~jFWpaiuNwMBeRDl<?N7+M3y5~)EwFH
zG(s-O(hfDAzV~?xIHjS$kz161HT}$rvQ`nWy$PUJn5|Wdsbr`Hy|p>|WqrGHK~yen
z^7y7|WsNP^Otty*)9DQ2I?q%fLjuiX$FoZ{e5VT?rgg2!?Jj%WQKM(Ev7A#_JobaC
z42%vhbeZco{!7UIHzAF1g@>>5ShUSZRSM7+=Vx-J*QS!QOoc)Sd0?Y|33jOCqXxh+
zlI&HaZP8<Ay<5*f-8P&w=(6<$Wu_EI_8%vQC)n~&MM>CmU}+1IZhnL3AP%Z1y(_<3
z?M}t9kM@J$Q40(81&)<MgNiZ0;31T8xp*oDNP<5231cj@lCP`xY*Ie?s^EABRH@53
z(YBprgZhFH(bL)URM`xFX^l|+>;9{f5AAO9pH*Wj#hql5N0bPfYoEG;ykI{(2ehfK
zw>R9dR;c5}Rwy`aOh-Lmq4>2^hz2d2f4f>CCtRT4x)#jZ55vE<JCgmrO!_Hfq7r!)
zB^%IK$~rEJTBJ6{MI}>BU4Py}G>|rRRc_3pD7_Z5b<b#>tuzaNZaE}LVVPB=SPRc`
z*5YZzI#f}u;lD0VXCvDX+|)l{N>94V#O9mVTgmr)m&BFJ#MM<UFk;7WpiJQ(vA=1X
zL?|O#Pbh4=5B|m}!hF<i-ifI!$y1f3I*;fTL!C>Rd_leu6641^a%0|sfB$wHE&pcO
zc>r6Kg}6xYiy}sU5&}m(_-*-%)b^ljLm-Thp$hNj39k&uUb%m?ehB5kZ<{Br6zp5}
z$Qr-ay^ihR_xkdifpv(e6FAJ7&GxPNAns%Grw%ew5Zt5y`kWOJ0@0=Ex@mAuQuMd1
z5rhi#;=o!&MK=P8I-bJY337#&;AQ^Y*P^#Cq?Ve{Et*b$kgxKN_>0F9m9@Vz=Hy;T
z4@rK}n&Q%>k$|g-gvU+{Lm<)%v7vYFxN{|4a*`2rya7qBBLu$ekPTuyzak7J4!Pvx
zd^O5#WQyOA>Zn;I1AJ1v*DcmHG}_vkBfoPLXr~zyieW0izvqeKPqV`iRYN^KS>mc-
z%;qTG!4<84-%*wZq}1f|07-GxNicROiQLgx%=QaU${dod5(Sb%e|=*BXtT72Mpm}2
zebPCvNZpkLLN=?o3Qy-*9M!uWOnZ>Mnxwu#bdQ{eqEa{wZ}_I^LV_N{A7=EZqt2J%
zdH1e>tj#}!rZ84ly+X40cBHcAGvS1P^7iLgmp%1=IRW>%50~1dny1wxOj~Yb&{}g=
z+fVXGrNQ|Po6e#bgwAgD_!zEFuwkTpRLDO9y%F!X><|~~tz4+i-O^BBE5CaLfJq)F
z2d~@r)UtlWY>Myok)~a*#Ss;o5cCjA{cJD<4&BQB9sPxOJF(hG;vidHFPNo%TK(eD
zh(3saG)&e`lG(&428iGM3-4_-Yu%JxN`JJ>DvsLgpl6JC6&^07?)SPL14yP}(Fi|r
z#5iD12&+2lWz>A=-iZ!<Jl8Mcso$W^DJ`>K<tI+YArU>$xyZu;y!vu#)bV!{MeUU&
z8{Uf<YJOJ!`d7+ad7s6VqCvJSajQXd!${qKEJqg;!HrA4dy6I!0)zIma4dK`NrR~r
zW2;+*wArr@#I}aHPp%7Cb2O}}i7P2_yX0i2NSu#TUcb-bUP=$PE9!M6U2oNXX%HcF
z_*<XBQ@BIxnAOgro`zU*`sSmHA<SZ}lE%g9TUm?!Joi9pUZo)XO-wUMVOy^;Cz<|#
znF$P29yP_I+;0eT_Q3aA+oA2Wc$wHjIyWSMydX<#L^X}pJ*cEl@44h4iROmbA`2Yc
znO!?ANgZrf&t@+?Kz#-*cKP#je1Lz&Z7Yo#n8oiV_$vwq2pP5hY#q}oRZXs0CPw@a
z<1p;60dQ(iU+C}6xz4%ebJ-`32|sv$9`f++jMi*f{<d*+y-icRi6TQ1jLU{I@^`;#
z*)h0pDHxIKY3$8H@F)!}i4Ur}nczT~QWj?NGCffeyYwkF8SaD|T)6XH+;OZqBB_LA
zZ+Xp{in(q1W~!KH*Kq3JAwNT>Peq@Me8y?Ow4&i<zBo2?KExD0m3lmCc~GN&;xqmG
zR3^+5Vah2qVy=ESVr$+K=R?tYjjv~#oR@=$E|~JPIXTT&UQY!T8M!qNLQDP3-h_cT
zqB`)He!`D5)2frcld{^7B3Ms~%+S$+FfxkRzSM%gJlm8#`RlG-+xl;$a6!=RG;Lv;
z90vpf=8y{0fj|Y+#h=9#ku1=E+w-n4EURX&LI?iroHbklpYCF@Pe^`W*D2h*c3I|b
ze`Y5tYQtP=H(Gn!`_U8$?wlie<#DxNvv+$*dG2-Xrldos9U&8!>(B^K*R&;!aK2+>
zOTS?$Z!2Lcjc9{Vq%1{LsRmVEtA$+2-JSZN5Q0;b_m&}x8o^7T*ZV_%l%%8&M?uJ6
z1}ozHfNDX6@y@E#i(hfD`@7H{Ig?TD4u!FDZ9wRjZ7T^BZP3nDY7P%3CU*q!ssf6O
zfojHaDoZ^gG36O8H0XzdK4qbcwD;{}Fx}fcb8#Ih0xtr1j0uhk>_vHLH)n;K+wEsk
ziG^oBqRES^69LKS9{zrR;%t;D9nuhYW=t@&omYgETWv3|z{sAPbz;U~T*OoEkpZfD
z?GLqGV+KG9GZQ4=7QYyyokLlT+0qlWY|qdu@Vnfv!wMOpxp(x^fJxAq#fJk3Yr*=L
zgYqrooxIRaXgVfq(d;Q-Oi0g=dxrgNgmwk!bPX&F4dWKa=t+!!qmXc%Z$f_E>hvc5
z;JV~|1!c~Js>+=dnDX3R;=lYFC*`u7w7kN_YsuIV9)iTZfW^9&d=2Eb`KTttSyW?V
zvJ!|%RQB<Eh`^bTcdG_sXgJ_3^Crm1FT*cD2?^v?cG8Xlex2i?G9PFze=dr}=9B|}
zD<)RydaH1%@<KO%NF)AH(M0q+?*Tro?O2404(m=yuf-C2th@C6d>(iVDtf^n>l4B}
zZ3hS8DnsmWTuiaARcG|boOsLLS88~NKXq6KioG5hNB8!<ZVYM&Bi@JGI-^ymllnG!
zRibPsBqp7*R+fa3+4+d3EI$U-^x}4I_L?gZCdzusHdWq#ZBLUw9l?7DspBE1@nYQ#
zmzAt#nAdw`vXyf^XMz3GV^#jFmE)zabTF7iRKCs4>}9HJd3dD}eYZ}kdr4rx)*z}@
zh;T#lrX!&oPD3Zv6EWKeuVKCjmsqr~CY`~4a=S8_)UJqnud`l+___&Fdo9U_d1n7@
z+5ndg=oQa@8>3yEs=(wbf|F85t*O(3p9&FGS@jgxQ+Q@@U{{0qYMPYhV_!I97C*Ni
zTt98jYK*g1>o4Oz#DF7vN>!e|04x-;r^icQUp-9Q3{>7omjs^~%?$7GMLDGo;9mz%
zL=!*044P=3#nfTmMm1?l_<&WXpN53&gEY`v3=Xq@tgV%bF*sjgEbNMc1L7q4Yhv)(
zW>a3YA%CxJD^OssE5YcyjpMEbeeLl|qm(HB#+z#;06+;pBDhQ?6fLT5koL|`gwOJw
zTTZJql`Xcga?b}upLurK)HMPSX4syVYJ6=@t>BgO81nrZb{tziRi8K|Er&0^Xcz94
zl`uko>HY4~!^!0*smC&>83pusr<v+}!YZ*|4P{#i7}nVc^Xy0NV*<bwo(E~Y7PchO
zADT>s>0Wnm+C?UxR?aSV9yZ}ibaR7A&FP>{V<4N>7J3N#b7|^iBcgr<hdnYu*P!BT
zkr63+mb#T;I!7S)6(fowsonO;M%wX*l9#Q2K@e%s=Do|tYwtpejkWW^9IcR4%30_A
zs`3pxzCqDk1r~dJf7!L^HB~Loq6VD16nFW&mQzpvKH)-ow5PQ!KF9?ngf>-~ziZ=a
zyPou%ml5*BcRb|*j<WnYbg54DLjsr_fdWsBl&=6CaJ&te!}PQe+Cp6m{|4UyIXv@!
z=EzfG-Z(M1Pqdw9+cr&sAnVJ&I^v$Z?cxDcAiGpD#^Ii{eI!rPF(?S^E^q$r78<Um
z(<N_maC)NDp7ML$v^E@evd)cnZH;UMnNsgizL_tLwt+MD_GMdNzI)o^S<0m8R*tZc
zljJAGN7;4z%~<->9b5Y@?2mH38sc<+-cG|N8d97UKRsArjY=_LHQAwMrSgB0^`3D}
z9k9(YIAWus#<G*zB8`hA$y_g?6Tl>H5o7T&`hrJ`%g%w1tl9-?7fkZyxf!`%x1L}J
zk-P+VYcSa)b`N*-6MUE0Y-Mpi$Ho-Han*xo`zk+oL8s4ozc_Jkp4rz<Qmf*BC%q}B
z+E{=S_{8cF$Y2hK0b4R#$yfvRMbD_h)se4lizED|db`;(I)<S6=<{xRU6T!J>*NVr
zmIF22XChXFqML8QDGN6=Cuw?^&*4r;NnbgVp}<jS<czEXQswn^tg#yX$KpbIfV<f3
zP{c5Ky*^C)E1Ed4LvD}OJ4~d1qTv-j&<NBC^(wB;`-xY5`syM!C5OO0ii&f+$|eQ|
zJ%x}#%=z>B7$glId$S%r8@X)C*RtAEu>2|iW5YcCEG{*w46$(gFsT6F`$uy>HkRX&
zt(gl-Wp89sNWQMOeeWsa%R(38UI)xzSnYCh5ru%lX-_;yajcjVikqc>H*IwYz16Sz
zfjPwFn%NXd@?T9ub(vCe<H~7kl%xDY2whB@1F)rW%_IDRwNB5YeN;0^ez4Tj$Sx={
zA`J=3W7?cdB|Ex9wc=iGSKmK&1$$9k{BkkC3q`g6IR~XfgbH8Rip7!VYshxOB51#H
z3Op&dd^WLD9UnMOp<L8|+w6do(HZ<*wWf3EFFepeNhZl{vGYNnC#{}8{u_9(+Y~H_
zE{CDex}i-p$0R+?72{lRSF{*5hSh%SqYfz!_BF2M0<ga_`RDQk$jK_`H#;*7M!8TR
z%1yc9!h&699{N<Qoc<grJOwQj;dAg8F7RXuQojZHN*SZ_e7b~xQS2l@WKi<3S&SZj
zW<W~47JMXOuhbYIx|^nKNhJ0wNOj|aO!##kBd$FS>ANr44tIeXxwm3!BEob}*~G|%
z!&@iHacI!Nt|T#PV<)6el}8`<nfk02FLB{F{6-v+C;Qgw9jL_@h(#tw?p=p*p3{p5
zc_mA14gD19G2<0~2(hlK1k09QAUM&oPUu`?5!UDc8hOcXR3y}yVySya<MzRKL{Aos
zU%~MmD4RifA>U8&?{;%_MsNM~ujeP#6mU|_1dNTk=XXOYa#({L?5GiwbeJAqH+`xi
zsjpWo4<P&#4{|f)wn7fH<{glH#zIMt6jt^FM`+pHOk-7lUb9;6*Q}?gLk()X3b5X$
zznA3RrHU&W#Oo4ajSidd(U$FLLnTL_eyHuntVu{IQcIPdrdV_?)~GqqPR(yN3p<S@
zh|&77B`W$1NsxWuols|BUC?|=C3hzfG*T!@Ohg@YmIm{kDeQ`f>B!bCAa!O_*H9b%
zaEyx=?UAd0N_Gg&7)?t!!ZK|R_9E#H{cM;FqRUr`OQd1-Ta-b3q?C~}cd(9;vRcMZ
z!>ku<85-Hc7RAQWYPoWm8>eg1<740#OJbpGzFQMwpD7UM2fzN#PL>152C^s><<`{?
z?aYBAmJwFOPml!~w9p?fiaWe@(9#TqrF;7y)`t~;gtV+WeugLULpvD)m6w4IY`Ql<
z0Q?8DXH3lfQmS2+#&)qoErxKKVB>Z*aBPRxn-gLHg5{fQk@V=B?F&L%=PJ08KG6sB
z+Aj}i`3F}#N7#lv*^l~Xd5C3d8n+Ef0er@v{L0qhglON`ig1Vq(cx}UclpScbs>0+
z$s`(o9l|2+RX(E+4iG?$X$&S2eMELpI-SEdCe<X1fd*fK`h6W-z>tU@ti9suWkL{X
z`63B_X{}uq#OstBm>w4UmV&)1^{e%Fa|r%zTKb7{gp+W%On<I7*EXg5SC9b7lY!&e
zWmzs^gH^0EDsj$ChI0#pEF*)Wdv5%ivOp?-<9V=Mw&fQvHs9)W=$QGLun$7eUgrJ2
z!&6PAj8PM}`$`QIVqd2BuX1rneQ{@@tf&^~X7fI-)o42r+_O6AXXBZGguNf{!s1fa
z{H_j~1;hFHsP!%fE*B$c9v#MI>k|?|OV`!s50CYS2uU;QHor?BmCT{|JP}lje#jPo
z@B&toqAxA!wcPNUAM{lZ1p->o{eDUo46kIT@f{{%=OAv@EbkINqaIX`=?}KJy0@l-
z@(i#dVwFG1AA~}ep*?-KrwKIXF<hcyieVblkvPJh(S!VqpFj2neYpH}^>BCo)N*gI
zZ$duZcrpP|>p`&XI*qBh3;!zv+Wl^S&=)9q<)4}8O+Fr~zj&j$YAVo)443>n6DpWB
zogOqd9cqT@eo;?HWfF<T!0*e2Hh#33Whm&P*|gCAeMzMQ)-8Q4XS=2|?A>hGnH41t
zE#DR(Qf6;VmlJtXiK0B}$N+hx5~3dXL#5YazG@+eRqbkPZQnsp)uRYV^FghDaF1Fq
z`w~_+VcTv`x3kSaIDR~ApHx3vz3<XrM_eT$9OrFdIeNLrx&1+PLU}{$NR1W*n^b$>
zgl%?&f`>zY_X7`Rw$us!;+9~IJhlEh5<i+G_WI(R-L@=rgeD;|cRC-J2ic;K_=Y>8
zVY-GBs<~h9E<;3?yR&RusEmYv=ua?4)Vo?0f82Jg*r6sU8{6qhrJQAYh%I>)$l>r+
zxpMCW(CX87Mc6SOL!ie6iE<8I?V>=!64aNMbd|5AELWwXjDE=%0wy2u93DmzuV90Q
zv4#nO3U<Kjq42KFDbkow{n&BY9J0LI(g4zZ{{`>(z`f^1VRnYk*t8vg#fyuF33n`&
zTqCkI#qdOmVK>CCv;&84v$G`#X?iO`^TK^1c3v63BHs3B5q(H$7YmnJBs-XkEH}O<
z%jsC`7EXk<JVT?)h>*p_i;Lpsh32uu4|2B<+}cCRuMUzrDF(Y87P7Z|71U}o3F#hg
z8`B!t_K%p6&w!bEnpJ9l8h|ghwTes0WOR2MB@1bLc0N%Tmutz7Nok>XEF*@LJ<k9i
zRh%WZtK`yZCl#t=kmjj25Je@ItZr5OQi~O+k#BQI*9h6r)`{J3xYGHsKr*`og^KE@
z<SA)t>M%?b87S6RX6N?|Sr^W8!fKR<pcy(hMf7!-?E>1DA}+gsK<<S@h@;4uBN^7D
zd|rbl%)&+P0A~d#nOM%%bMgGzUq<4<!tJSJJh#ehHN)t+du?!l_IaD|xA0*f-p?I<
zqfrvaYc+bs+fmpJN=_xhim%UN)Os+baGe@r8SHU)@d(ZhL*0U9U2AME_LF4YZ3d81
zn!=qIHvMd0^vhX)E)%`|i^wJ-+u{fzBW&*TXN9OI$!wu>GD*P}(JgGO&tS3h2Lsks
zo`)*#9u(NHC3=>2TjE*svwu?wrwbLbi>LF25c4MPEt=M43XnN7WNA?>>9<U}LME-U
z*+#XQp|M4UcQ%|<jy#JIB(1y79!D<+hwp|izObBP8`xccU&5s<+V!udi<hxJuYH#I
z=EKR$B}nmwSnON;#ijr${}zs_XvG+^D=#$l>u@!gXZus3UvPM$*>@T0!WO-d(S1^X
zRdIVfO6iLgD#=dT5RUWhc+WA>g22WT2VfgQt^PfqoE;hbcbVr(uD%|@c9Ol9&o@R*
zh{~bel1MmzA2_7_t+#mOWl^_au6aS5IQXRtpuDm`MK%YjeweT69;V`6@PoRB4o?LZ
z_hht91RO8aT-GsxX9EWH+YzB_L5n|BTZ2q--41(R1y<Slc4xurH<j-<AtWQ>V*n~G
z=U2~~gtgK^?rIw7PEZ-(G&uAAyY?g$mq!xd3wj!V8l50pW$f>S?pm`{r?5yrMtx4W
zSxeTumM6sSmfas>LVL8h=cx5rm5N!06?z(mxF`Jv`jSLxzFPe*;JqM!fN_ysyjQT&
z=LD6?p1z*fxf~O6=4iCvSCA$ktcA8Dz)kmz61X_SnDBpE(waL&XJA{jt*y=^GbPlr
zncXdaEb2s6WDE3%hD>GK7m1_@Lp2VdpN!wEIq4?i(9#e=;KxC#HNVAcKB@&hwXK!N
z|I)>NInOhnJpEiB*ydHf)5epJDmL)jU^=%VeazZjN8tyvb4Q-V+l9V22|bv6J<qU;
z^%m&PouMhw9Dh5w`!Pz=F1~P~@!{Mb2iK*4Y4Xr<gmIj~zo`6()mJq!;$+3(l0HMz
zOc2DEg^i<_VWGY5hHMK7hU!e36Slo#&Z2`h0`}n9gsqo=&9Kag!1~D{%_Rp&9+aD6
zKhgpcv$zzb8T8go*0;{%^uu+W<l?Mr*6jHC(@&IPUvcJ;rBBg^rqxCy@2k?MFL056
z+s$DpNBpK^lGaUm>fw~d#+T9DXQ}i|wb2(*5_EiLk#j~nY`Jv{e0>-id>J1Je9EV!
zqQ9I!&##)qY{(G@qjKNZ9%<3Q+=$jsF7h(fj_;M$80oD_oSEq|R(<=mwtPcc_^n^s
z$n|6ozo&56{muRCc!5`AT_gfuN)c***^Ndjm(Qb~?>8pQKxn4lvTnXiwoq53d*k)8
zME};Qg9;f}7XQKKRCDl-RLNvQzRk9wMEMU6ZtX-bCi<DQd#l%J1|-mp&8JANKELn8
zX{IHCysvTUUp!J{XjkCwjLu39lM91cSJE7@oHi~aITg8hARyaZTn{BAei=o77rtf6
z#`UhzJ#66X{RY~0XcQqEs29V`c{RuAao^T)FuJ5{riHD?)$b$OMHTZNdNr5D<}*z+
z9(OR<^X&ve&j>iA2~q!e%o;E?_zsb6Vtmz-5CaioOi@WzDgSKv(>~s5w<Pb7Qt)C*
zWa0y6EDE0~%bq@=<unDQa=l-FKxi9+_bte7FqApHG>EwYToNpwa0jFL$&+EnF{aIL
z?pT@KZ?<W1?-eAvf-Z$D)}-U?G?~h{H|##fIZ0?%?>NnRu=XAM70<7?)y_OMZ-C|a
zEQqnhN5{&I4I764Q~NbRa+SV!pH}sB!hAkOPPi3p_^<RPF_=^aL{!Ot1f-T@njYN&
z^RC#>t-9y^QA=^s`-USjn}B-)qGJr=8t0CUsD+kL!nx0Z9jtMf-)%+>sm>nd&qa{s
zl~nk2;ajl><ovp-l4bn&`2AAIf=R{5rd7{=&B0-`crAEaTWpKHm?L~T(Pi)D>y30}
z#RGqSYzP6@wzr9Dje%8vpNS6Za(nX2{&pj8Yc}eO4d&n4^h4kmc;%<DhV^t<8NN%W
z@m79_BCcO+q^i<VL`VD-6kI1&U+Pf=3Yzi|&O{B@JrR6SZ`>EU^-G7OWS8wkjUn9b
zy#fhqf7@Nbae4Ph1{2jE(h(%*|Gt?fFuz@Bsh2Ej^h@}4oWLW0*`m)8+}fo>k%L%r
z`i5l#y;yaA0jB$n&R(D@7_i6Qtzo&Z7F*G+oI<REGmdu6JsJNTYQ_GF^$BfRQfIFg
ze^w^r7S<Z&GE$ZeeVS_cCtb~v7i-LE#e$2P|E&u+7Q;0sTEcf-R3GkjS+qCbA%pG2
zg%8k2$KidfinXkNMXwb_9xVnYeRi>Rs7Nyj{HY`k<@sqH${P;FOz~UM46FuGdr1dF
z7;?e+m(K{{&%c8M%2?o)ad>H%HNYG>+1vr9samM=7CejXqI?d{a0}_-1h8WjpY4_O
zh~v(z83L5+wlY6b;`Ayom;|MAtUFsT6@_sdtV2wAv~Nd$5k?=9=u^>F2zd#bJDh~h
zgrcj-%%wj->sPRd#wFX47nff*kX*H)wMX~bI>cbsFnKy<o8ZP%?`UvTo0zu{W%n>Q
z>jqaE`y<=aSe(Timl8OiH8jCx`s<7n2IZ6Cs)*;p;9bLff6M2l*tcBhJ;u=TQkg)m
zy(Jh8Ux}lC(70eNV!1E6GWyXa8!0S=Bw;NuB`*{b{iS<PFgtRWc6F05(TEbFYS5U2
z|8YdNeDmXj<r@Ug4Mt{=ab!PGN?Molys4*CA?%^69Ac&%xnYgBcRn+Zo5{E!wy>on
zJeJA*wMynXI-YN{6%|_Gx62V2jv;c$#yx3sdTfJ#jYK4gO$qt;KG>aC8@2*j^!kPr
zm%emm*;yTN5yFzTz|952MA$DFkx1>RbZ*f|Ey)G2Zg8%T4WEX}gt{tIvSM~V2c&>2
zH}h@W(JGj5GsOo)63?tCDqJ^4NFYgK^KltSQX9E18$N4rp#hHK!mMUL`tWECqXsE2
z_X+5K#cE|0|85ylUg>V!S*;3;Dx9ai9ct|gFZjXjjzQ=@pJtOEE0m&_BR_tzxcrN%
zaxEDIkOL&ebcB3YW^T==L2NE@Av20TvTHl`C3%ocv<zSrp83|=BJiQ6xkm(BBK{E3
zdcgHZ7pYt#8j|eD4LT@Q<dt}h+8Q_=0PiDz^^7T8l}Z-E7LRwg9Il<V_uIAmZ1mE5
zqt1{R5t^$gBZngNT-t*EIR7nb=n+jLC`X=%cbe3ZNzDN@8e+B!%yA*ljm(|mKD-bH
zqe*OBf1$Bae^O~N`@S!%-m{BiocM&@n8Ti%S!hNR@#A6+N!U-PT)VZy$h46sySsgV
zpqnMb-s$?Hn*T8Zhxv0;Pu&p}M`PhaPtvbdeie_Y543zM(I{B}A2UsCFR~dFF<8Y+
zxbOi66(m)9nqrRwAwWyDHB$IBrrZgo#iJ%9IP}}0bgGE+Cg+3S(YFn#AE@=}iWT_B
zG<c^>hY3z=56QpNO?q^17KP{^I`IsDJFy7MUnZgs19=M@@dId5I}Mpo7V0gDVHZ8V
z=hUyO-gMxEAaixAZF<FRew&<=1RN8y^L@qCR=%6G&NAJl<a+Wd#*r!cDbb0WBWEg@
zTFKHqkx)T$;*>^#r-GemLld_5t=;}P-!M9jM*%60o404R{F`y)xb0H#hW}81%o6N(
zjQCdj4<2~)k<0!m3_ihE!dD8Jffx379KecwZnYta&pI{*$}#5VxRR)%&1{5N+jDMs
z@#r|e{2o`mHZF17;g1=avI&W`*1NP1K=EgH$gV3&u^?CVMb#<5inQ`_L)N`xce6<6
zNq^C~u{v952spuEV@Fl)BKo|4&jiExY$%lRbkMEnDF<)Hy2T*5FkfxuqwR%!Q<}2-
z=9m5(Fz66Tsc3!RMy0*}h548)pJ{1reS)izTmV@?NMt{(koT8$-s`GLofD7f=0N|#
zGrOODsjR?H_fsYKiob8}IFJ<Pla<%1txN<B2NQekTU`gSQ~3>4!av)8($2S;)A%k=
z(AZjYjeojO63&*7N|$=5>CRqoGa~anB`&FndlECNBKUCgiDf$+N!~C;Hd(}7n`q-n
z#u95V?nw~5dL}DX{G<dE%sL_pUxx97N|}8gwid$&{)6}sx9!KVT}Cs_GbV)GvIqro
zp`LX0l{30W40c;ze&ncs2z!S{f#_E3k9XbTPs0#p!;N-SIj@+DqZy#Y(G=6ou43wC
z3QMqNj*H>gCNfA3!Q%emagW|yPSR*q+%IdwW_vTJu5%2_wW#31gx@}pfO}r`+vf92
zkZC7Z7HYEGfl)$@dZ8ndS@y!Yvw2V{GBs)K_q$-z1O>Z=Px-rlq>N;%WJVwey6WTg
z=fzR(jv>;~n4T-i`uZGrlmW%HK{w)!M~(Wmkx1#tGF0F5{CU?a4NlII5TADr_4Wya
z6#xJ@jNgoDS9Ph6FM(4{q5_|qtp!w<x|oy;Bh03<NO^DD+AEUgk1GAn$ur9+hD}h!
z8F$+(=F=Y6;MZV(WDxu^4|qB+v*!ga^0y{P=;;T9Xyw$qeTK!|5S9c(TSLE#;faJg
zUY%%jeQC#Nc{Fy`)jC@Vo5h9Ffp9Yg3i(tTRBe88$X91rCR2ebgRLg_|6)zZ<g4>>
zap#CBeCn=}<1qVEa&f`W)9n+=8dWy#saLM=^HR2)j2TLQQPqZ|dDH7uE*;qLFPJ;P
zQAMG9a5t<)+_5NRR`6f*yiY55+I2YeG%6S*C2MAS5!I*W`+_(}6c>tKKgycCLaO~C
zf0izeIb!?b65XU8YU8jEaWP|Sj&m=}J*%<G!Kbd#(dLR+%kU&@x!^N3kIz6(l-k>J
z3Tx`<XmI_1cIW!(Y=4!HmvtJIF?7~sswUm1x5a{WBRc&9H|PZlQ{7!L{vnx5H^$BT
z<C<WDYXpY7<PB|Yy&|4Iw=QPFRDsyuJgn>r$8)v{-sXwx&T=3ROeK}i!ye0eY;28k
zt(ae;_|q-!&Xr$payVs^<WDdQA>@LQ_K{W%wp=uSAo<Vzh)d|{$~4lC{WtwFWlj%2
z7^9eZW+2u1GwTTuxX3<379}yn9tL$YX`2)Cr9n(&+0mdwLQkRMoWs&?t0xh=>sqQ$
zx7K|iBw#^Hqx0(YgF1`Wym3I`RsiwZ1&W5lk+$${Wx^O2O7SMtqz9vA8j5ZZq7J`C
zuPC;EhjqYZ?Now<<*QonL()F3AhUL0zk!@xaKw{nII4`q6j`K!cdeD3*sH$cHYqPN
z9f1xK&dyNqxKns{uDM<Dnh$F@EAyPV0+&b1(>DRtoEhMu9#!*gqlL*>^>0OiCw8<W
zoALY^`%b2^V{#~Sy1p1)vq(#LBRd%ynGcA6#E`VbeptV0)mBg>sxiBZuJs|IzO4e!
zEq^HYzG#`Q68tFo>}4Ok;555DDPRgf;3XH0`Wa2eHtqS`@^Oii+kX*nz2GNikB#26
zQPMUejY-Ld`P@=pK)h`A<GiwjWFyCg+9hfTq)8n5W@mTmm&h+6g}UsQ0Tdj$VZDKW
z^5$6ACH8_5U~E~p2uu(``?5r8cJ7Ny-)#7+Bc(Szh<m)ym`}%2@n4~jd`_0>roD2P
zZfZxsk);6BCy+@MS<640g$cY(*Fg#2pE*HrW~pR~q14VX;-Q2Uo}A@WrMYe3hhH=<
z7u{`%HBcxhcg;DFSp%r}>vmbld&cU2MpBHOn|h7;Ke~?duMAu)7eRe>kI=8a!GRU`
zs0obq@$U;nBt(?~Ll!Epv9QDw+mgYVSy<-vKTp3_0@l(WoSA+Od*WisuRhYDzl<qE
zsFApVE`Iy2Dixx`DjV1Nw(lts={r@Vof*SalS|sb#!7Ip8W1Rkcz+Z+HlP20;fg*O
z*5oGw#wZye8RLey{Vv!z3??1^Mwr)|N%#cS1dEi|cOsoZ?`k^{4(EQ?jP}dddoXW&
zTJeH9HJG=Svger;wPtJ$a0yf?h^JtbbPwmmrj0>Ua3n9({mX=VJL_$S2vW_!asNEV
zc{u`52`67SS%<}!UzuV;tU>L6O|+6pwE-%d;+4wi;O0Lv_NdXD8QEE<o}&BPq}jKr
zw1!R?#|yr1qLfN%2_3xwoVfX`kGH+hHLB`oF&d=pf!DT}F0KXByV_VTrT7zUloG>7
zo$Zn72%@F^&3BVi^H3l1CO`9t@T$ZJAQ-{wU)!8T<sEn<Ru{;j4s23?v9&-zKVlG=
z#+-#DNOz_#Xj9G29B+!ASIuAEwPK3obDg1O=Tdw1#&j@AS8KrYl1ZKoCiS(sAK$ln
zMKK%iKC#D|iOi#Ydl>bt`n6y>8>#erP_$v?Tpns@Rs$2flIp4#+$z$CSRcLp68C2y
zHTBPXa}IT>xNrQ7m0eSRxu{YO+@>BJnwv741!yAU>sD~ZF`MxY1Gxel5H-)GEtJ0W
zOi;SoQ-vY%C_e{@(R-MLXPx2qIdbvWP&l7d7aX17?r{Z4tygV&za5jI2Xeb<zJ?pg
zx9uC=lSnw&%bvo3q7KVYk=(02HXb9`!1_t5bdHSi<UFfK++b;cysoMu{KKxI<rfP}
ztfp8cijrZ@B-i`$wXc);U^6Gw+Piak83f7)Z0~5rT(3eE)1h9o7CIl91I~V?wUDe2
z$ZN2T)iS1yd1BW^qV+6S8daOgYt9sRe^GHU+|ao+GB1I&xIimsGAl~>EO8FzG%sO^
zUQhn?11r3KnEn-i>{}q{Q+~FSM>1cLXZ7P6k`4`&7h1-_m#HVF>rTo|k?j_I6#Q2W
zat0Q;_*Or}plF%Q#7Jfp1uONII?gvv=F9Z>@f_^hgI(j8@0x3fbib;PGOw(FT5}Fh
z0#{lN*8=&z;bx*@uilQ3{CDl5QlM8?`<*?!^U9YL@O)c;@d;_M{Fv$W7)QnV-1|OE
zFUum2IO8dpis+D#h)>L4olb66wP7&s+iVF8Z91ep^1yEPYY`kth9Rr2u?Viyc1Ial
z6pa%TolDSjy$I{SbtX8_YMF(IvO||*7K8}mDt=9!zN<*XEX=*5BH3Oc+9g@4(=&4F
znh`?!p6IZDRpXXbl_qBzwB<9tgimjdB39wv3+9>eQ&FfD#;znVb!iA(e(PsrV)Z3!
zS-T~g4mdtfKO;qLf2<z~UahdxY~r`u)#4|!O?#;tzlrwA0Fe`FjEuLEPAKr-kUa#^
zFt)*d_-cL$*q?HaYe}!dHKKCbRJPbT2JppEhV43k1@b^W{L}tJo3s_0mo!p?n8A=J
z!l1T~WD1{Ic-7q20HbS0<$YhLd!L@-mcq;q6Qn3rbcF`RS7k5K&z)_W;&uZnGm(3@
zQRi0*ZBVX^qT6%8g4@G}4pgx}kH+<FQ3u~_TaR^7h*vmz5}u9x2r4{oLvl2K9iG7Y
z!N`1n+3w{x{I=Z>NXea#OLYth-znGT1dq;DqITN!q(n!K{o=2fxcyjZul);Z+wz0z
z$nI8kY^H$0xVBw<q1kITWq70CpmHVbVG3p8G5PWj-BTF{O?gaqN=Jo+uSW<(c&)M%
z$O?4=<SW5>N8{T{@ydOO19?xJy`k<fO8ne^)2b0*hV=-{7`TNT4C)$)?rw+1{qxJe
zzx=FIbeX>@x{$dl_=wyZIoX<_UvW2pBUhapo)?y)>s4Qx;q8TVJRt7-A!~u&6f+R}
zE(+lg9Fo*xJKw@1;`zCc6RWV4Rpo2cVbn|UkUKUMhc#P&eBj&;R@TkR$gg$uuiesr
ztzIgk$K%kn(f(;qH26jmkNdA|9a;9!W{uOSWAafS2@gmzU*aw|roWYjYSrq>*F=|`
zl@lBKfWOtC+W3(l^no-Ma4UNSdK)50gMXObYlyDHo-V9k(d3j7r@*8x@)w3oRn~=j
zYzbnwJoWnXC&SsSLhP-+|C5y#`e^%qhR`h3gzKA8m0E;-ECS7i`E8P#rk~RSw>}SE
zi7W9%(i%}J<Q`+qYD45#PEzAob3ly}TXVhv-6nEh=~myokrWnr;q>?;XL0<uRso;L
zaVtWilbNrv(obKqXGmoeXFV^6P}mmaPXj-efGly8DVqBB%5mq6Ub~DK9u|y$YRrdc
zYnv954UFmLe5%d{S1`Brup9^-_GV~#;xH~s{FC@;j0Kw#rE(4)sJyVI<k@y}^wXl!
zmJNmTV0bEtAs?^qB&(?ND4l;r@?QFTyZ{DJy$n(d1aeMi5MmE_X<rQ@J<XugmN)X7
zhUTg0P`Y>I^L~Ga4Lz1Y3_uKjyyX{!GYqf`)Sn$VmnS^`oC`5nWn20!8?VlxwOrj|
zsYd*Pseq1A)-6%!`s)~vrHoLYYMPh~aps`5*|#FMag)2tXdZsXJ?qI-gMcFCJeu$V
zZfHpfIhJ6K6F_F_l1J5<KqxrBNt6$fba|C1GJT1^Pze;sAachk99rLhc^#3B*%H|0
zRIdk{-%HM~5^!X=UC%Ge&>gpZC3o8cT_`oETQum=K6C2rVSY@XI&LS)e=7Ph_K`>U
z`$W-Q&S6s_@@H`tSx5ut{0*E`wc_C@P>`%*SP%iXnk)<KFL+*grztV*M|}h=aN-Cm
z0tQhiu&k3U_f2CL2zcXv5ZKAyg{ct*f`$*bk)AR`X-OY9(bu|9(<#D*={}t9g3CNm
zI>cpk3J+NMzuCPVTR~JKHEZ$FmukkxIPEQT)B2~=^FAw?KWhy#gZl6U9wMfHAZ^X6
zXUbCgdA22g7k9g?C{}>>vm-cs@i>Ff_b;Tf1704B`6moA)>&nLiAqYryM)VD?q;S4
z89T=s_gXZY&3W1aaah9r#xSUsZy-cC1rf@i`_DyMk3G#&E;^%$)H0BJZ!aM7{R_Rf
z=cK~XQ&gh_>J{va)T#HA@AFq)&uiAPFYFE--M#gMxER1B{eqpFr?HMzNU}}unO5j|
zp?FuAK9oi=4386kaudMTs{6gbx%tMZKOnSro`O4Qe>Y&b-J*mAyAH=zsvYGE#kgy&
z<_J&6b<lBO?y(?fx07~7Q+;?~cmC9Ft76Y7i44kv(NM2E7CGMEUPGfi$XXsqHVTQj
z4&L=AV}GS@*YrvPk4gl%3vr9ce6q&3*ih9x${V@?d4B$XjI`AU?5+i4PQpfAFqKFr
z5pXg=ZMxN7ov>$#f_kCzB%Z`@jA?w%UvcF5vdITl5e1W2zFvrmTP&KMLL7p8wYH|}
zqPV<_d2mU-K})&KmEsuuTfpbpAr}t5$~-cws8FbSk&;zT)Z}rC${AY+;x+NXSTRoO
zx2t5rsJEkkM%-x?M%|i65tYqa<GS!gj7YHu?vSCky-(8}EiZ?N)q!xnNEw=&$TctO
zekeJ1uX6#_i8WhFBF%>#20P-cy@cPRC^s9Q%947T;I_{4$8B|=!1_i?pX?;8SrP6n
z$4WjAtTj2L-7H=n%aTth?&-7(S+zm3YR1r`vF`_CEDEY=i(Jj#o*+?vd;S!oax@+r
z4IJIYdu@Frje`lG9&+!cl}ciSJU%)Zl+2u2|F|_kC)KsYf?x~$MXK2;h$*;&VX8iT
zzxPNG4^?z3yOR51NBD)BkKz$H`~Lt$bVW9o+93lVmn_`@3Advy0UsL!F*z`oQJVr3
z5;iq53NK7$ZfA68G9WTDFflTdfXoyHGBh<XG?T#sCx48$1yEcGv@Hq&5`qVJ8h3Yh
zcXy|8cTI2z8a%iJ5AN<B+}$05yS~oM+)3vCU-e#51--Vdt>-kPgbK>Ef+luGKruU8
zXIe%&1}=cGtP&#wfPsOTj)8#*hLlvr!r2=5j~Iqj4e01(VQ0(rhk>vo(9jtq6ESoK
z*~!}30)M1jtO1P707f=0Ms_X+1^^QS1Lyx3+BtFoL=0UmOaQWU04Y0Lpc4$Ku${e!
zqlKBdGl=GYJ_0C=DFKX}oa{7zxdQ}kfQ}Z%hPD7%LuYfK4T#a$&>Em@XKVp<_V`Z-
z3LbN3XL~MsdN(&WIzt;LIy*-*K1v#Zn}xGEKz|A71ax!-ngD(k43IOl0sdVX9SkWz
z#oWT_Z@IFask57*BM<-*SX&qaZJj_KF198>M*xT%pe!i^khcfg{%tJtw*d{{pWXl%
z=@|bF_mB6lKo+)tIU5=q+u7I~+Im>nngL8LtbqV|F&R2%cV`-ap{>a;LqlsPJCMJj
ztAC+|wV@Hn;IGUL0b+uR07FoL|CHxs>}X-{>_q2eVg0K_`d?u{T^6-95w^3j0opn{
z!Tick#KIA13~IXv{oj+dvbA%w_4)^xTG*PH{wl)6#hzZ(*22LBC@J!f2}lI<TV@7y
z2Cy<PFtBqn1Aq<ypu4d-{jcyU9`?Y$lz)uB#Gnd%yzK4l0j8iLfIb$cK+qo;FDFA+
zAi&wt1?c1Tr{cc|hLI6qVqxqIFanxc*uwmd4iW=R|Hh!<J6gB{v>8CV#|U8f_4Ds1
zUC?@&*x6cp{5Jn<zVsSOs!Gy=)PGm}uTDtF&K=-I%fbMlWnyIjF#cLHcF+f(|9^&2
zFtqq5jX!)PZB6X}oPTEvYSaH@?E23FQ2cWolz{)nlCuMCEf7HQd&zYeSQ(5#zZn0Y
zSN$)S|Gy3Y73Kf7<o`P%F&As=ztj|e>Hj}!LmLZgkADn6OY7ncIsjQa&>7hNZ&P*P
z-$yG8G_i28`QKVeXG72-2-=!i|9{&?3nwuPcc6)ag|o5w-`n!HT=mzLSzFiw73`cW
zemzzIw4l-aFCFN#jIBVA4kyq`{-pwfF6Y0LqPE6%CcjRMiIojt=;&zZ0RtK`2(bdZ
z7(usa0(Adti2?L<wsy`S7XYX{AAqTyBh0Ufvatf_1%HYDMr;6jq2GudKz}d%8*u>W
zMSder0KMqHh@AmIFZLTT0_eqmBPIa7#Ban5pqKoOK<v`L5r|#pHv+NC{zf2nx!(xH
zF8?p$0I@6lMj$?=-w4E~{2Q?V=v96r5WDJc1Y%eFjX><`zY&OC<2M4aYyOKkL6(O9
zA{G$4p%Z9-ES#)<n}FPnet#oSdyE_njje#77mlg(Z#nb7^1qMfUj>NI_+P{d3TA9)
z4O*CgIaz*5Y;1mK@oSUlP5yu&O5pDZph|)NVPIqeaf5ct(8>Jwgn#)sxPUJ5cNkD{
zroSP`!1NEu@(Wu05fg-eLssTr(Dio~jK2iGgR}lJw{vm)gAHV0_J0Qi#s8fh3ut!c
z9`@!y+dnKovOoA4KxJC~0YP)J`U8U6_-ARL9^3p;8mNE2BeQ~BZ9(VwhaObB-S1>T
z&UXJ%gNm{Ltp)|N2fbx&|1)kD#($*$9X1OnYkSc8*!?lSU#)WZy$+z@4lZ`iKocYD
z|3qYF`K|b08^rdH=6}EToc~DwYs~m-l7GyB5!6<v-@O1iIRR}f{=0&#zifc6e@ufF
z6vPSi3j4P%P!FA~|6DLeMo?D2X+iG>dS`P-;2(Pm>YKBh-5(C17%qQ6&<I`sfS}CW
z{#ZYdxBDLu6yD<x2x_9|@8m#{Jb{jXQ~l@pYV6_&8j<r~Z+}40f&35t>-!84=ngc7
zS(vpm<_@&13T(Nn5X5n#-5KSbBHdB{N=fUr;MnT&fbcGXvOLXy&GAMsVXzBnc}tYy
zT40d?JwU?0;Mwb_vF2S!Q=DS+qxX}3jMBtTGtB%rdf!;?kzjQ%-g{hH6@gvvX9sUJ
zKP!kv@OCNEEC&}31ciSblsmT`arf%p;-%r>*&W5*ayDt$r{YQ4NYw}(zk+GfY@_rU
zOrp2Ww0O`|$Y<_|)7Ljs$eClW1X3~7Fh0kT%z0i~>r7GiGoC9YDojotSR`0ln0OG^
z$iow4UPAkcQW$eyg?Y<;^X`p2c?6m8G)c>}NOb#5spS?*;kJME-IcDx3vG<sSqXqZ
za-2St?YPRKdQ^Q!B6+m(X8mv!=SpTPAl`nPsnANxjasLvWfJZp=VbLOU>aW2{K&VV
z)9bOuVP$ZrkM=e=sp)R8erT)HN4<c*mmk;6jgd;!Tsv%ei7OQ^398t6<V}Y<P!bi1
zX3;f);|a<zh{u1+|6J$+n{hLjfkBG{svCS5_k=ae`#j30wDwG{ZGHN~oV6RWZoq2*
zo7}5Wd(zoiE|xj7s6kpVMRuxa=jZIzXmUmFDq!t&Kr#K<dMP@cNRbDDOzbA>{CPh~
z9*d-S_s(3|V3>}-hvhxzH@XwGQq|@!tlty~w~xbVNA`bf{RV^rf_gY_O!hZ#zJC|e
zLp!ijyFV*+3l$oS+E8H+%>LY_<eS;yB%drU82%>zc59~ly%F(G6(LtboBC)(brs%+
zt&xuWCpVg6NfA==yam}_=>wh+?*-j?k-ToK3SR;A&)4<7OjWJ&cNAc7X-F$kq-ncL
z5XAbegY|!E=P%eoILaz_ImDjpVBK?*BU^+&CbmettV?wYSb7=&+^iAF5Y{ndgmYWI
zDVJ-!6cJ%BreO`Ms&0Zci@24k(|y3T<AGsFA>wzf%nYb}qsJ0}+#>R{Rhc|$)YsX#
z49iW=bb$wg=my?0C!MNQ)N7ug@4Px4n&2dBBK&`$s)z5#cc0i2GAG@|vlVUozvHBY
zVQpKKlg`Fx5YA1&$S{FnRBC6We7M@m`$S0?VH%|24{f~vAsiZPi)V%$b)YIb@mvW-
zfmt-0Fp!q3@&oyY^_Ou$1S!OFI;e%7Dq*QnFe&F^FtTnh_P1ZyDq)EI)W*BVJC0^%
zC1!tc;x5DKi-r)y=FHrP#8~5_-OiOmNxaKn{p=KZM)yXOU|}Z=KGyN1<1;c8c|#|^
z@-!dVoYvIe&!?>pnxCy^1+JAI_(Ip#R#c?&4`LbcU$Q42p~LDAXF+Kvv|VzzEAX%|
z&fs10I*;8+fGr}zbF(EkHuyM7yD%OwKc;`E3WGseq@dSGIG0vUO!?e+VB*idd^E-<
z)md{m_0?%=+GUYvaV6AF)xVW&%BeW5E`LJn+cgfyW>~}fejzJ$FPo{!P%<3t>czH(
z89%FY*9~~%nCUQ>Ld1;4dkYbtt}>}9O}8wKc{oVfNrNFiB<*DwDy$_Wp3w?}kLQ1}
zM1c?{O&;9MB+oFVmQ=<jsX#(v{dn+D(m)%Bv98^Lc{B|i84SPc$A-p|9-bp(A~lOQ
zD)$Vzl^VuMrg5?RC|knRgXy{I5}TYAGR;Pn(oB^P-`fTMed3j~eY9|mzvr8DJi0L@
z=8v)44V^QyOy^QE{-Uj@v7W0(+qZuzM{ccgyDcPHCUQE$4XL@Ki}E+KV*+{VOzs5x
z91essCX;1bICe)Lw;9#wBL;+c1uCx|eiAaoc4}tZdES%!ydS^q_a*HqZJ!uKbK6+m
zVA8cK?p_0w=|A&Jn*Ts_+0PcTIT3q{!BxwM06m{*0$nuV!FKE4vA7Dr6N7&*48)YN
zWmUd#BP*gknyM(z5cj+*<UGXW9Uzb0rWk&1k$f_jd#IW9+LlKKAbe$nka0Dhu|b2f
zsLk&n8z7QBKD6l(s8^o}F2&3(wOKYIWmxzMMfG5ia`dhzJ8mtG-t@XV-MW=jL6j+*
z3tvr;QdvlbewU{h{e%^zSU7(}@Y~vLx;1y1*N+ZZ3gV`D4Jcc&x3NUf;b33E0y(^t
z=IvrXboQuVP;Bd~pS>{>eEB5pZ6^z>k1{)zr2b*;1vjP@-eX&K|CP=6dsd}h>#d=4
z1_88yJmXO|eL9%fIYE3Kvj;wL@|H28tnA#lc(2y;iZ+Bz$!nA6ScHGrr?>Bst&8u!
z6Lm@Pl>s5=)r6weg>ZfL)F{6|E-Mc#Szys*pZcv9oGKxsH=yUWHj72}Lln0vq|@!U
z%0N!|y5B+OW9n;<YN&;N!05lcQp_rcS5bJqb`8k7hXD@J#M-|sVh1>WGLL&`h;u<d
z{}LEsKyB@X4Sfq#yq$mjqAy^I!N!a&v8G_?I^l_>I)bKOkvW3er}do?pQ?DfKN7h-
zT9&%s$lf=Y+iRtG_`P4LA~X8Fni}_fcFRcU6aqYQnLM3*#<~Sf3kS#dS^R+G?%*J^
zOkN${bpax=^#^IOJC$ss$FDJMYJO4H6xL>Co#~54lckX>gbjcD#WRUBKXf*p?+sZL
z88Iq`KLWmUZaS#tH53fz0b-r>tbXP=nM9@9B6!AhLcc5hwwKE_iz}1iiKQF$;jGvZ
zHY_ivIKWj-q%B-loSl<IQpVziEKYFV3}?gEn#}_|MCyICn0)O8kM#SUBZZM%`6xj_
z%pup{xKFE-);WJ<d$o6(J99PU3!`A_i{m>1WF0vSe$s#!EVLAQi}w}_lP>R#GO)XZ
zVL1AGJOw54W-^(<VLa$Aw6okBH&>h)1zk#u)8Xs|$LO?KzA4W$8M(z%8v~q+a!=%d
z*qG+HBEwZHu)Rddg!mt~zjITw+w0`Ixnm(~Zi>U`t+0QJmW?d$$DtwPX6i3DCW_bI
zZk!$XQs4{1S=XaXoG=<JbGXo5x=^2NEf76i@^PQheDWNunIMI+Yc5~Qa)%gT`0C{U
zVRiruS)EbLee7g<KWPnM_F@wgS?jLmab3IkVIrMKm)P?oW>SH@>qRGgI$m&0^38m2
zA)TWT=VyNsG}{JE;ZkA7haTr*69MAeLJqKTE4h&AaOn#0tSRnq9f#9#)_!6S6mMbY
zBjhf_^1->+H}XtgO1d6@g2$F3J*`o-gz@y{XD4j+q6DH8LpXKhbMn-RN5cz?8U(2w
z<e0Cw4)&0uDaMV8<=H8;_H0gk2>3)&{H2v>f|-B0<yL`nj`LV6(up$!oZMim6d(TB
zaZ&xAOD;a|c))4ux<9_2K;W%u09=|Lp884<854^ea*?$s>@LYPllm!2mD@^C-?2QW
z(d)MzBKiDGl%WyzZYnWk-4*(L1CQbe#me`ggYi0w30*j1RK?2{D(L5t`+9PK8x#F+
zvIc(vxxvb$D%EmL((KXY(9}xFv&Y(wd8tnWn%BK3KQ$eIJ}s5=xNv#lxAU4I3J+H>
zqhjEyqB+NxFA--`(g7Vah!PRxRkeKJT8aXrh>{EI&ZOVAUlY?hv<oTOd&t_Jvdl+q
z)8Q(y4m8Q9mkhh=RJzZ}H5@-puO-vl>f3)NKuF1Cqr*Z|BnrS(?PdKKPk|||mBaIr
z7OP!bI@7aCHCpYmJ^YCN(?F*Dn=bT{VXkU6cw?{EQz)|Q=Bdoua?@@OOWYOXSCUUC
zjy8g?Cr$~dU454qwpwctRLRY}MYlsv*JpOAs73-_F&?w9(1gOm1mRv7#?W-?pR|AK
zj!*G-88B>N*NyCh%$yXynvl>==-iZ#PN$N|@YuIQA~zsfqriDLeoU?5*nglK>`APn
zHXZHv^eA)<AlT5a67nn?3dsz<V&Zq5Zh?OL=J2xRdM>0}1KjW%AqUn>t_@7$QV6D*
z+XCS`80b6p9kKVC0v^h`AJ2m_-z0yR-do!V%^sA*y(dUacO_)F->(l7i}#0HS$jAs
z5?wRY4)r&^Q*dYTl?cj0^FDm1{#3)gB#u9eilm7`#4L2hx^Vfld$%E>Lp1eW`|TZL
z;%M?uV^+C4&SHB$CU&W2q36q5CwhpJusSn}t0H$aMH&QWKJBtij*&QVr`~@CKQ00#
z5>8z<RI<<q8;>$di(0HO*TDnJt{e5jaG4$@Aw4`LAw%o-Bll|ktU1ket}0g9f^x{U
z-IFEM)3A3aQO%`@wK$&&AL%V~gVuW&vI%`w4dPFZM99=}eFuuSXB9OXN#07V73?7n
zJ4@!4w!Hr|FhjSXiF+<EZ;OBS-7yhK|LWLw*{=&4zD@pV%UMtkidF{RHZeSjA4-1}
zT~9w~$qY5N_G1QmUo>~50e;2!&q8UTkkvCbU{77=GC_Gv0}NmMzID5zeM~U+_nc2t
zlpVo!>G!pH7xa<b@078~;q)4>xwf4lr7A524pH5|R|kkvFo+Lvk2ZgyEh##@i7M)k
zw^AW*Jj+1h&fxjtfMYwq?c(QbEhEerr_lpo9l=h5afq4gahS~W<KGS+_hb}SrtZM~
zroh<!5g$1CMww{@mifC>qU_>OV1hNp`BW_lG=39sP;rOe#$Jw9njKvI85rhG*}XKs
zY8WPwSh}v&I91N#5~+Xc)85;&*L_v^7F886LHHw4GvW9U?4EEMToQU(bEj}B6HA(O
z-#AaSyx|!CF_l+nVOUZZ$5;6+<1K*ra;oWrIl{2EVz7*Pu_o<~|3_uV7Y{>LfUJV1
zc+t!_H$Eq1B(5%G(FBGj7<zb+0IP58%Gv}4Hq2dG3?FQIcR+vrpooNJNDk7L6PhEM
zzx#3`%r0FQ-{Saed3pAjRZ`iabq_aLVmUF--eO9{1@H@{>BP2}XR1Mce?5QBmZUM5
zfU*QxBF`&SOY8|G(A5@<1H~_0%pX^0ORch)x%bkrRFKfaqh*Whe2N-1!<g`!`x#WC
zztNcN%k1Y3dQ*QN=C#DsqaXSGTSVeTi62V$$W3LPCf-dGXsD|``#jy$);DPO)JE#T
z`cBW0T8{J+O0=DZ%S*gM4~|3;=-=0cbMJ>#jb40;*_3K<%|@v5(_JQpAz64=jJQND
zY|ih;n#>cZjQNb${PRae=ea;!DQ5cn6vL7lUs}{;!B2n2VZjI1cIx0YvJ@B5Zymwv
z3y7Bt=EiL`y)2gun7ysvxZ;%=G?7bMXFY#fuO!^5dCI<?Qs^2w_KMGWD_Z{bly}tL
za9<DBZ{GY!-U`AXz5XP1%l_^Gu9U;YW0}P9B5~z1!3D<D$Jn8pnzhs8BjNLk?o9dv
z&Rxebf+~MaDR`T67Uix5m&8R@n|x5u5=EIlP~PtVPfV@t#bNv{I$w#){(29sI9KS#
zd5>p6Mo_ARmJVsO>QC4C4lsQ9anCJ1%=I5akshSJaw?k*b<Dh&Wg188{4F-9Qn7dF
zv{TH1w|Ev?a}ol}U;IqR0-miJl<1C9ub*AXefxiH=#a@rl()J>nuiyxJ)Q_K+2hc2
z;54sig{w<@Z4PSn>dM7kSoOtI-`&+NFy=oZI@3o?!@jIX4sV{pth0QsWGuA})qfP>
z^Ra(Ry=z)*#%WH1_fXgit}AdVdv7qWH`ypIeZ$TA{cWyW|4}pKwxpxOsbC?qsi6Ow
z<_CWZmlEHumF@0})``>ONn}k&qys#W>l?1<$VC(UcS?B>D}Xpb=MQj4w8dX&P$@T?
z42yFIo6I-IIJKt>TwbA-_b@r7W3d81^r%P|8ETMhyO|Bf)yW5FZ@zI4$8qQn_~rpA
zNs;*4Vu{2mQ&23~VO;CuZI0hT65}bdiK2fx*7e1$Su>Kl^|?fgYxH!lXDqijjj{cr
z*80-|umh(b+`#2d;0?AnWXUlB+U#=ZeoacB-Xa^$34Mmg#G`@XSvGS10DPEs`DhrD
z!DQR8XvViLH|$QRV?%r#xNOf|iwhaUKn!Fb%b|+BL4n6_VLLv(pWG35Pu1(7-X(wU
z*oHVoePytvLhwQ;x8~O>^1KXB7(x!`YuMxXNnlSaGeI`+?GfTs+JFyWP*X_SWssP2
zveG{2RLtMx`lGo|Pv_|~RV>=<v*OT3p`4Lv5cN_^+iGBj9nt&9g#y+0EuIsXW`|}Y
zhTBnJTx!I!CX#u&Q8XSrRvL;+#@~NDP_?`nFuQqW;n!f&?fSw}D3LOflR9^iqSra@
zAOp0kO8ct%^YSCyZC-5bI6L1lWnb=PvV`rIj5ke%rGo542VNq<N<8#T&d;*F{a5!+
zJNdqkR-BR=SFxtwiqa+^Hebh{AE{9m@-;+{3lfnA=ngjsJI1?-sHB#Z*%5y_7B%t9
zp>g-2PA!+<@yI3@1ox%jsK4)qwl_9IBQGNJUMI?B?~t&$Rw-kvXny!iyo6aMll00m
zT5z(*p9(fcesg@=eg8=e!$eJ7W|oF}58Vl^MEoUpU5~z@$f2eia_|P+Jfat|<o;d@
zzr-_8q{vwSj`<ddoRXTkFFSuPz-LLxqi$}nE!z^x_d1s|`1)}Jxc*a3L~6!6si{c=
z(PyGS*fDGXqfcc(a9|(S6!ZDb*Ke`$3O?LWVMJ3c(l=AYqcJL3^$23O4?26;&$oKh
zaS(Xe5U||I?>oE?l>j0-J^t_#F4JtUioMU{U&+%InFoxx-H98b2$+8_36zJqiY<*k
z{9Gb!aF&XBN6$BuE&qCwhUciZ>eq$ku3ORgwuO&!^E9)wR@c`${T_nVt_?|hFMC{!
z8;M4atdJbVq9{zKQckf`@<L*I<Z7ItgI|T~r@*|}DaM}ME9^UEjm{N@N}dwRX7hFR
z*|&bJET)ZOBK79cOLTwp)hcf&^^~C|Xz_z=-F%*DU_-U!8br~?g~6}NZ(%iIBbA_l
zwVqwmH)qT(lR7YU^UgnCUNkpY4Wco`KI*5scSZ(4sAhPFlWWA*_J;(D3m~e_BC$!r
z>JTIc?k(T&J#h`H=|8?1<eSOoq>^OtL7%GCA@Z6>gFa<eUG#tKJ0En}7E3dQ7+%N?
zx>i^#9HJEc63T(-|D>9i_TWZYc4meW_5;mfnrq#}k~puid>Jj&{GCHTY+hQ6lN~&5
zqd+W-G=w;N^cGR6x8iuno897v9e~z_r;~S(zt6WGnVA}8l(0N5U(@0lo0ftuLFUuw
z*)wHWrXF6bm|1`AYLoi;xF@MJo#kqD{8HQtbmQYiOy8$_MDMphoZBoJC;Cza_Z(ls
z(8@X{%3iRBrChscqzSyi-(S=OjU}k9e)*CH^YtlJF|bB^d6h@CQ-cc^(tmM@-<bM_
zbiMNZPr2r0A!Sz1;Jbj%YVgS745IGYp0sMSeU*cjm2H1LqayWQ=(kH0Ra7K^2)DN-
zcl(rRVG(g#L3*figpQ@%nx1()dBJ2Dj!E2tCX&K92K1qRJ}|VF0B|->ogda0h{Mle
zY0@m%R3m=Uv{-X1>UqjL3gIJVg2m$G0X^tF%MTdU<CDXpr%dzX5(?~{80GjsHMi9V
zX{*Erkwt%HW9D>I282FuW|AO->7Fx@@+da$ZhqW_FxT6_-#QpRuK4t=pLns~%Ov04
zZ6Xj4%;Le~kiZU_(=l#D)yvlNhYy>w?j^5+{?<=)zt6QQfEGm+d&N9CCGCQ+TY0<O
zXLWhDVmgz)jZ$m@!o9hqeL+3!GK@WG*s^8edTxJG=jGwqpk{igU1jP9^-g&029#_7
z{1KehsDu!)(G&v=!AJ3XSW)h%V*G(*NV%j*u@<zBt8EjzyL<Cqk$Der;d%*XMcd6C
zm|@>-nqdTUZFFHW`1f_anP3)~-Y+kgz=Im+wSdpWEVSXoWuY7R<)NF!vqF*jCuvg6
zaejZo`*?{FB)Afmr#WXQwKKyLH;7Y<-ER|d!d12eEE{rZ4XhO-6gbq|@!ksdyGGQ1
zeWO)PHQd@-o6nR~ae`9Tw<oL#<b<3!#7Wm`ez_u9P_HF(`#|Ae?<Wuu)3OAHAXR_u
z(Iz0BW6Mg@o}NXv>^TjP9&XBnzrDGSEE<2=UJ(+qKXZ!YJ8IP9B!>G8pP(|9-aedI
zi>Bl9b$0Fp>V)A2QxA@^D)*auaG!p+z{H6HB>0pVU8?9qPbQWk<J+5l85WXrrX{h;
zx8IN4c;*c@3)k5x5lX)6cQ3#(WT8rqU!Klu1vFcmHhwK%VQo8I*V+H+eDYC^7k+=J
zg=`ro`r8ZYW)-tq>MPo;=9};>SJ7Qg;{$g0wMWo5+tWRdSfn+$8a|(lo_b(wL~Bp!
z9@*@&?b$;uu$9HDY47KK&^K(&iK(m)hmc3N^9A9p7T?&YX0y$N+tpqzIT#IR5WB=n
z2em6=FxM16r~(2s9_BXH$#Fhbv-5wmFH6fe1F`^a0VCyXp*t=nPS*Ku%IFK!enRmr
zLlR>yMl-W%&AAuo2J1yyfq1#$(IZ%Kz<2^T`G`u0i(n0ShzGL#66=p&m=BX~@ldCx
z8zN2fvBfL%KF3>aA50k#lJ&r=T_)u)sbNb;?=au1FH5K2lSUO9?OqToJ*s~uGiA;)
zzAn@*W<L4^gjspcWfVg54|Dd{l(ptfj3KtPIh!XAMpd}BCt@+&pNr1<+$v_km}Y^^
zNV?fjK4>F8$Pv|M{g9X7y>M#F(WO_P;zL<Mb62`VZpSaPL<6gnV9n>->}J6`M_ws#
zuiObgXCx(IKGMNeV3laQdDwrVof5SZqdzoml|&$zkh)KpTbn_dP2%-wI@~|5N)x(r
z>`i6+v73z)EX4aZq>#NF`|$G1IGg(G;c1X(RFVjrRxEnTzQ$A%ky0x^AwueW@03MX
zMA{cJf+f;jj?+{JV!l>oJiRHA+eQ};rBHMkKIw*rU1a<t#b&Ii;Jtr+hAjz#JwCK_
z9Vr@@p&ld_wr#T5Ljim$E);8d`no9BW#!;obXNW-RI+%X@p~X@JDP|(8$8_4hJ}wc
zt9s?J;M$kShbQP|(P6CeLoOCShn<5HAC#-sKCIR8Gx71(ufiNNL4xCBXEeA<^yi*<
z@=pK*32ou-AJ>IXz3G3F89daLhmH>BzHBV-NpqJYRh8t*s3d<oFV|Hrk&sc7?uWT!
zau!fSi@T)KT05V>Kh&4q?TukPF3vK~gy6(VDvmUEs%M)mX*=2}=zSr9oOAYt4TC2m
zn64W6wj%tl<*~xx)TN)z;bN_Wn-niBdMG!pZ#-vrpUzw$Rf&J3cf^b&w=xmfkw5<<
za<0I0Cq8?EBygP%b#P>{4+@N1df)>p8&ve*0&<vz)D?jf^iXXPv4Lmzr6ooPZxP@G
zBkodDAT=|I_58||2~1|{E-ZRH#1m;XLt0!kIdDd?J(k15VfCGxU(v3+szrjH3e=H`
zWN8Giv*C5(XDfg7M_a{D7Q9f?IQ!BVLxOHF0bw%Yg(hKYo}X0_ug(h3%d4|*hq-rL
zMOigtY83G~=j#b@f{6<9CNh!erhh_lVJ{3+M6(Z&xN)fKHRma_k9bjXAROZg>TiAR
zAAMGmN1>7qy5i9IoS*0+R3!XRyHjNqWHy}mc4>tU2{(VGJ0ymGDE7UFS&|$xXN^z1
zZ=NP{;|M+Ya3AnUWaft{^?Hp-Z>)_lPzLY`x$*_i%0MojKSlSFFOnm4D81m8*d`>?
zRHwa&5y>h$p-C}@7w5EK-l*6@Oq=Z8PfU_);Ag%8D^{?R(hs3_1~MVu2nXu2DE2GJ
ztNUvel6ZexxhWf5>uRl3r)WS&y;Wo*tR#*4s$LsP?(qs;G$16h&q#L<Y|z#nB=2be
z!*O&eA_^@|nRQuIQA!=|(|4;?ZC@5y`q<ID8O#B6IK$1))=b7sRprQQTVFWA_d6N_
zUlrdyAJ{_pc+Z)YDFkxmBWdt-WA@pS7M4SrC{ur;By<WY=@1LXF14<H)i!azih{?Y
zz={?9%#1W#kX%;h887xRBTnlFTJ0LGr8)g+jZa?M#*p6N2)8+0mrIor5$|iOUaeOx
zv2tqw6%5S7c`t4qq(wU1BlbY19DD_Y*agF=;8Yr5RBS9iF*$?GM)DIf&y-2p(phX8
z#EgIVjbq?o-K#8oak%Gx57Q83<rdUd#~7wz`BqYdnVxP5PwK7-r+p-Zr-ox>M<Ohg
zCfF1y(wC(Gi3wxQ2DjMf+vPDUFkSL?ddw$zZ|(1*_!pl(lCxXYt3n}cSr64>dtYB9
zjht|r&2o|Ie;9kzMt&9$n7Ez&P(Bps%`JZ%)dGg;8T9-Gm(>3L>4r(_xJ!96opvb0
zdSsfIuYZOO8IiP=sFEL?-z+%bN2c;mIhQWp{q#myXcZrk&+!w->RT6PMSbtUKUH4g
zqU3aY1w86V$rYnxLPa&capRz#ftrJ&>hWp2pRi&D_>z5B6=2*Ce)pq<xk?SwtmuEh
zj5IfTdw6~6GWm-aJoGN|LJo9iQ2Yb=hU{9Xqkz6z``m03>{=y<sp|s1yV*rjje1Jp
zCb>IZbsN2SZ}whQwXK+6_=%RqiF@^=kATsgv#cF_vPmA-K_~U0IWA{K48;VE={060
zdV_W0J^p5bth0jYQ%D3GtCN(z{$PKeHSY>^HFCCPynm^|^wYu{9@b;`7L3naeHyfp
z^^3~Nd?bBV`;bi=7-lrX0xNiy*+SZOq8N+Mw&?+!Lf0m(W(}WTY8qrZzTL3y2bG|A
zd_APklaZ?46~=2nKrDAim)!`t(hnCxSdz-SWUFo(^nAiUVp0$xWmerb{v3a(HC}{(
zA*Kh8CzJA14&|ggOcjZFf3`3wk*;l24JJA1qT7ylCXTaj1Dwr0V)afwfH77{KN1|H
z*qN_6l55a$5MR7Go~N7J-uUMn0-j)zDw@Aui1ys)i`t(phvc5jZ@*JhA(YWwMT;K$
zJHh%T^$;_XB|m&`6Md+F(8Pc0<T7^LQtcmyjy95AqA3I@p@QiW3l(v-KTS<To0spO
zFfm(-wh_*c|9n%SA`I0K4a_>_R@XGxwFW>^cr`fqRGfIxZ?Wb#3KTYuy^Ipms)6q^
z#Azbt2b<z_@$)GI=95C#IXhaxAB7#DY5S-Uu3QH=kr?gY<qF6)*1vy;p}4SiRS0du
zb(8-RC@5W<+*-Ct<yf8t(O~?1${{!$*-}CW;ULl~a0AwAzc#vyDlW1EGacQukulUZ
zo}2c=oxEj29GYu6xEzPu*BPcT0-3rD=UCAU;ZBT~o5Y;?Aq9|P7##9~O*9|9-Nkt7
zene$_UFFoncdsB{@DP7cT45Og2PLDCpX#AZr0*c27Af&uWDsFhp`tHZYoJTX_?UaB
zs9S$TXB(oPd7?-|{$gi1Ps7>mc`9>p^fjh+yoqif{JMAFDv(G6XlYzf=N;;@>XS%@
zd-1In2LFd?6*1!nFNdyJ9mxYz%fiU}otSq68E7_O!k@E9?G=A}#nFkzkTlt*BJh!;
zX`^8f-B{#_u{K-Q70HuAyJ{RH1!ig5Z|pJifQ^kNIefF1Ym(41*gFBJv+p}vZRr=W
z+?lh+LJNBE1I}yKScrMwq2yC5PR=I~s<ctHY<=}zHlhB$@RRBD!)jzf$L&bxUQ~%B
z@FKRNBeNI>e<Ock^MYnOr@iPKl35zOl2Rj{mcERVdV-YMyIGYo=YqRR0)n?2HY=T_
z={1*njfVP-@X*cLm8JtNR&*szpGzQy-g5`rYo`@8L*;yHpr4@NkTp|Qc$Mv4Gr5S}
zBPVrOI*E-WDV=+bM0RUA+d{w&8*i-pS(#CUXhzm@j<$b@#z*DNz04>upakz8^RTL#
zeS(jx+wr3OzKXI@C6PBu2BmAjOcJ-=aGc1ts?mhpL!N8SA2Cwf)dJJ+=K8Q=-{V+K
zu5p)pr-wBUZQo)dv2MJfq1>EwQ>nciUfag*n_8UzwaeJ&vMcg^ymtpJ1?5?SIayjy
z!nTm8xM_b#k8W)cJWyy@&*<+*>g|lj>yT~-w}qnfzl`K;uMVkVsiXxnQ!tlh*82MN
z<viYhhb=LZ_S*Z74x1zLWiN~aQvFolHTa}|ku(_C(kzZHuwVW(Ne@{#w}zS##W#AD
z^|-<Qz>YrRkQvWf6B~S6_)71oq5o4D1MYa9j8}giTwfM-`Y=7r3Y+~MinZ~RWg{{2
zcUBTpGHkTvv!>frd1|}12>tITCK6B|bt+y~-qN$>hrXvUP5zS7VX)luh4oQk+m2<&
ztm6&p=WWZqZQP!|C(?#%ODi|k@2@{69|;icIx(<4bx&G4dF-GklbILAJ18{XyfkC5
zfW3d?p(Lvfvs(7~sG*e>n6@LuJj-oCsOU|KLsiP=kMSWXrBM)x;I$Kf&@rH&`f_!;
z9W1Sn)f9Gn2(9gt^DAL1zw9(tJ%kL))f~maK42|<JD?wm&4d4$eO7Vj(@jet9J~8`
zcme@~MFA#0IQXs|U})UQdRK$Tn9WyIQvZKgV)o#(FvL~=OV5BX0aM6{j%*?zAjVSv
zJqviQX=(Pkcw4vCpwIyU1a|o|ZV<Ricsp{y^y>Nk2vY6*JsQ1g6sK*2hB;nOJ0$_j
z>(mFh_GmZpU>alQ;Px#Dq4dzsN1vIM8+1;=2>j_tqep7&1?$$w@sZDT)cF8G8$o{n
z()ln-l4Nn;i1<7aNr#_spWd};t*-Q9z@p<ajF6@{6jTKdMQzr&{F17nDv_P?v3^Z(
z5qG%Z(ty;umE7AOi(K&l;ml;RYr&Q6gC@btkCJy%U*S~BYzis7W5ewbkw4&dt=Z&<
z=0oe9R4gbdT?M8L68bZPV>&M2?YV!>hosX?T^v?{gDa)d$@Li4zOTjStZoZxRVtQ+
zt`dEsOfQ^-VpY9bul)LiM?P%|CLCe#Q{?HP^mCh8fuyZTwDipYhfFDf*Q1vto$+=3
zjj~`SW@0mwZAN4TDg4L)L@(+nzNOwJlGax;4qVW;RPf!+v0~x+2AFk99uI$s=GcBD
z?F=2dR5k7^eR=E-rSrIt=QTVB;a}F7e`aHlo_+f+B71rSmdY|iLs)9{`3mQm9B(=g
z&2ec&rxI;KAm&<43KKoW`u#Xedx0m(Mm@NGgs_bkwY5UmIu({k7-?r%M1iLKXTJCp
z#Sq9croe&p?hLD;R@Xy_Rh54<r{1j3lN}RuLWa5z9o7^*t%@Xm_=igEayj~}l=9ar
zcp@cWtw{9nm<)H9s1{FsI1+{T{Sq^1K`bXE1srZW(~S33St7d_jF0SNSi|hM52ZA|
z{cWG<HmirsvZT{u&^O<|NjrWtxRoLFz8=%ImSYn>NszEbeSn=%F`$32&Z5hN9RgIF
zU`A5dJ=Q+K_(ezJbET$dgQMAn)-)-gL|&cb`tBpYE{1*n2Ay;pj?D^lP>Bl9yw9%|
z7DG^=zJb6NXrD*w;R+U(Z!DObghvd|5;rAi2Tm93`~ln4UUUA_&KvNT4}10babG5R
zu?UOC$I7116y!gb1?_*>R@0L<f^T}3LkV13aYy15mfh3U89hl5h5M!q!Q}|$>?1@#
zBQEb`<=n7jY_NmpPEQZonTME$kx0!w3TgG9p}pV6C%kOnL~Tq7hlgIzfKh%wl++`@
zwoTWf>Jau7+}IK~X=hu@74eMY#**+;FLZMPR^9|xa;^|0r@enVBUeHFPNU{Px&s}g
zJvKvs6yG-sliryh!*!MiG)RX6i0WR2qwxHM-Lw)%nv9RgH%Yt1C=ad3nN-L>4*J6%
z588RG7;$*uufLB$+m$RLR$Qu}2U%&gariXbqo79Ns70wv`9_?%$v@EqFt2gMj+_K2
zG1L>yQNDfdsf>Re12UjZx&1I<aVhFJ`f6Z#*d}I>Vc>xADqD|0d%A3(EMT_~Vo%`X
zE#8*l7;4_a(m%v^e^29X01@<Ug6Y7jG>Uf00+SPhw$~JE$l3t6&Um`K!sctMEU_e#
zfi$;c2bM?I06x6@jj2Zsl82u3Twl&S<2-Z+R8jv_tzmyWMKQHS39`#}Yx1KPj0+bt
z*cPVaVf>WZr%7*E;aH{$l#xBPJ4?O@hVe<+h_URPqNV8MFlV-EuD~@BT;>PlaQq$n
z*&rNu+F;GXjA~wso+8@b@s7EWE&_FQILT)Q2I(Az4-S<T)3vuG#@xia`+e5vRv$Wu
zWxnY*4=#TUSQf<->{2GHvF08wAv1oJ<_e@6mD=Ib{>JCY9V*#muFv_&x0}`g<Fuvg
zyaz)SQBX_k2BuhNf6Vz*vQqA0b%*ooDrpa&3={71rz25Z=&_<YYsxMh61h%61+_%$
z_QHqTs8Svqm<_tz(`wB08sX1OefF=iCt$`7PrZL<q8;0#{TYF=cPn%mG2Vlz0zjO6
z8;mM!<FcH0!?QYViklIq>aq2e?l1gq!ltvVFUmN$2?SXoD{f}$)cdJNVk)iZ2Q)sp
z04>;VVbw$*qHDKt$%&vcF5SIH9T)HcgzT+rwC#kJb};{n$YC^n{=o&uPY4C^QFCD}
z1*CsXr_jP1q?al-r-A)$>SGM#h_;6+L#0q1Mx{M>f?q!cP1=M$Lbq+|PFm@;RlD25
z@{5v}F<chC+$|PjCv?f|!icorJL=j}D8}V-)Uf(Mn*xp%)jx%>UJ-Szw3>YtOn)CN
z^6qn(lERG8SOGjDQ24Y{Male!_ZwjJ(2Rfjp~+Ztu=|<#nZWDEm$M{sM%Quka2MZf
zP4_##AWVo(yQGs@qS9?H|F8^R|IHDR<z}XHl4GTnj-!fGBIz0`OTJO=GaYoJurTNB
zypQwH6A&$4#*RUy`}?obs+y*ZIe`q-{&Lh(3XyTbEeg<%Yv!G}n>`i>eq7bj^d*0!
z6^sl^i6NxuOds8JwLVUKfpoGXuI9>0j%T;>LYu56NQBle846Etd_sRoduy>|O50D=
zo!LfwzMRPzbQgsoTp2UyT-5)Smc7{(iJ$|8$V{a~w!thah?)I<|9vA}j|QB9^qAak
zpKFx*C$#gVnGo?G^b|h{WXUTr>1cnk5d+GY5>SrwNr!Q3d5b)dHsnIyO@<ch9QEaD
zTwjuge+$K`4RW{)g{?Y!hpABj;m_``m7~r$7G8O2&RsHP9sMppS$t{Tq2sIt4~0V(
zg0o`2t)z6QajVln>*ORcN!YpBHa&M+b}T<&q?0ZN)3@Ry_E<m9f>)@YX6SzpX@mxa
zw#gkC1czMw$;eKKG`~}~k{~1Bk)gav6FWlh@r+px;8`k$;Y6-dD@{(6@XE^=3jQhT
zk9|j<WGQ6snRc^iq_7LLxn)yQ(l%A~^2Fh5b@5Y%>rhC`cE>c?C~THxA|TGwbFepD
z6`{WRebGnp%ZVW=`87zs8RCDj#rMi}t|r2kSjFW&YGpS^x^y!G1K+#HNm24NE0RZ+
zih7eUv8IZgdK>yB`fG-Y^ZT{j1<sW2Cu?<{M?PN%cMB@Tm)Enfl9PR%!Yv(=)OOvg
zL6zX6c|#PyhhdotNe?~$y5U1MiS5L+G52J&vnq@}i`@Ys#z^%sNmYL(HU)n|#oFtv
z#_|hp<&QE_&AV)vHU~^ns6&fsCeRhcS})KyI0iu#(9rYi6l9$8N;+2tD<0EFx0C}-
za9-Dsi%KZ^8{_5Wj7mEa+WN3!ZQ{5T(bgRn`)?wKNqMso7eA*4Hurp-V<seC{1N!X
zml7-!A>Zh5SkBrflu&<Vm?zNJpWGF?Yo3k=S855I@?Tb{C4Z}?J^jY2BAJ5IfN=hX
ziXj`vy&pPHSPQXeWM`x$86cHkiqd|&1gx|3hf+u^Sf;hZyHTdjW$K_WUkkvu_{M#l
ztC#j3t6enii;!v(C5bvzRvMut0)u&Co1W@IlnHKCm(T6mN7R2_4AXvw7eg)i+;d-)
zM4qHIvSTIpw5&O5&v%t$i=8t<1nP@eGPleAtbC18yUljpr$5V|4?XjnFsTY(c(TgH
z?DFbhdT#Y)+*ZR`LpM!@!Qd?tW?>4q<we@S3p4i8yjD`<Ie*Z^-uz(d_#Uzz6w2P3
zKXG#3ujI1&1I2$NjT!9$MkT5pL)}eE+>FC*zWrUhz?zdWXCIKPE*>?|W(wOqt-CL9
zTyc~w!!CoE@IL&yeU3fG0+veBY1b{`zJG9R@6v|8=^?VvSwEkCkp=<(5!v@)^6R5x
zp&;M;8WX0b976ssLafm$@o@K@g!@Pa;-*UFl#<B8`b2+@=?usgLea0ODT0zyE*Uto
zz8z1`*>4tOgk-^(1sk>Bd>YldZH_<k2|6tNX3R&)=c!|7sxe^zua3}38q%-pTkiS#
z04ph;-u@ky|3mmX^ovQQxe!*q<)vt4iOVgvH+NNJ-`6@s$`h66^QsS%96BRkpLS}X
ztN8IVQWt;weR}#oQE4pNKyhk<jR(f8RRk%J^Q~qi00em035JBQ?e0<1V;PvOa4n3r
z7g{4`*C_$w+=xwrgRrhV)u`+F9AYc%;e|nds&dEX7ei7{*$6+YdzdM!?5M#wx=Acb
zGOxF{p!!&KZOLtM5R`Zpz-r+tm1c@8uM@_H4HADkbX?FJcsOfZsYX(oLSksye>C)3
z=&VM8JH6I71(AFocsB#Xby!>^O@HTaQd#OOx7!9brHCEdS;}4jnew`$OrpC{%XXs^
zB~tVRR_D$>Xs4V{X`E4l*l3TG%F`!A;y(H@g(ntOYbg*&XVuQg_Cq0;_a&Z&E$SW@
z4qJck)7>a1mZ7GGgKRqj_N^RYC|g~4onbqcKIDV%qYPA8gPcGecekCvmjg>*5*Zup
zsO*$TPUO9kn>yJzUqATGW%NC9SjvGo8ljsjcxRzFs6OCEUt~2~lluEpW~!NwEp^6+
zvI#G%*QOZ&sunP5$lLHB5x5)133+aJsu_P)g|RDcSrd|<WAVkl_jDg~<JYP+%_3o<
z3+Xvs3f+?5=EcAD+?krW<KqZzW`ji988I`{jU~Kf7--vNCV5Tq7Uj(>XY{Zze-h-6
z?<WkD`Tk-aJIa)gnd!)!xqAE1JGm);LA!YBSW4+vYlLF+=0GT4t}-O7tK`D~9EpEA
zjM~6PLUH*W>?#54mEwmWwC*6zo46ahw9)IafIRuYy5VY*&syk1<SCPVT<>GOJls6f
zUEU~57|d#x74;;*t0%9V7m#g1Z8p816>rYpsWvg{w3o?HZ_XDx%(}OfZ!A%+s8Xi`
zFj4EPIq-X%7dKZEKs{5JwH+9sF9?4mj!AU=pqt_f*b$j^y-y%<GV){mF3q(;(^Gza
z;&h!=_gH5iT?i&S5euQ1pO-qGVez42P>;cq`v-3_#LT{T|Bmdl>B6;%E3C@M_gha%
z(v2h4T;3v{+98v^CAueh_{^61*Mg)_OhGBmerDU<pN<;2a%17GV)Sh)N9KR$jzf6?
zBu>&h!O(Ti64fZ!h!U9%0eC(QBt&j1i_sG~+&@IYGIbDV-lZD)Gi&|qS+zdL%VM@`
zy8q&(3)hAqX50cl&1i4Nd?b+6fAA4fwpG(5P<iY}JpyI@yKz5X9RF&8(0gW&5LNM8
z>?V@_Cb%!b&Mbn@Rz#y0%O!tor+!1+>?1BMxFHZ~#NQ)VJCD9yd1#0Xs}6n!ZeGJs
zYUSX|Lj^*SU!Q$WO^FqCWf5KQjB!Z!Il}k^H7=jCRh{bNmwD_o$OEi-Vz`~FeN$~t
z@AwJG`|x3u+l7V8g$(J#wQ>;G+~r!-hqA&lj0)OouSOz3r(av2Tv2~%u9VaY`cReD
zoTlRvRSUue`PD7wh5c1L%Yhp@;oR4j5*f)Jn76hxgs8<uW8mKln?>r8uEfPz<u}^3
zJ(Pw;ynVM`pF9;bMN(dG*X)7G)P;vx;bL@Rd7`ZRsSQU(_TMY*Pho|pTbv{4ygQ9{
z%C^9JBBku_?bfQV_|$(Uzck9?*|VOE?!Nu<{-aaG8V=6#ilq=qZt9OWj?t6x5Fe3<
zQnOG8!d4F9u!fd;n0y1F;TY0;;@$2|G!BUvUd<Xyz5u(jaNW{z&GNiTgFGT((>6lT
zU|l*At1KYlAF}aaEvswu+f%@Upq=B38%8Ty)m4R3!nw~g2xWir&UkfTQ?M``CczQ$
zn{M|~dtXyoH>lW;&UW6w6tY@w7)3fN5S}R|b)l}jpVM2GLb>kNWXj~;K!i8Pc|<4J
z{?Z6oah(2m-88uh)~?hUzl5m-5M0lgM=U?Oeq3|Zt2AzTXT($**v_g;^6IH9wi`TD
z6T82v<JWAZO{0IQ%k5%Ib~flU1k?WI?Rfq{fbdr1-q=dIt)>W)BA;gcc)!@oH??+&
znpTfvshwMa;<N?vX`=Ajlv<>LsUfQ|JA2}1;nXP}$*jFLLN=A;eSt>jzE3v{VS>$W
zC?7rfC#eSyCI}e9czCFvDYYxIdRn0|nEVeUB;Pjd?{9x<iPSuNTjsPpGvmlvaa-$P
zQk|v`&{H>+xuq^}WGcJSfcMG8b8qJuCSvXTq(gf(43G4#-mqTxu3y!<!O>s7gzkah
z9_}WSbhLFC7CgI{?mVs(KN>Y%nBbfOsct>-L$51eF$rY@iFa|(S7`D^*P^ouTm37}
z!9KJ*@}7T*7SttGmV7Wi0bIMPH-lWWa918QEB<?r@h4a0xv6PG^%r~z)=jkbnu+0H
zLJ`^u6)=rDFGBuXP+(5;2;Y+RT!ORlPVngUu;uzJJYNnjh}GMIocS-enWhyX`kxQp
z1PS<frYHvZH!|K8`q@0j3JD!i1k74*cp5`^ds}}fJ=ofmvd0&-8ZB_oxacLNp+5OM
z6=qW{$41S5@A&Ei+jVHML3J}62?0h?I$u0is`PG-WwiLwk^hG}d~b){hTzvc-fLAD
zEC)*quU0J2HKXVdm5~-X{i}+?`O@8}V^}**t~@wOtu1x)MOW3+W%<{JzHjG}JN~c-
z4@7_142zVya9<Cn?1(iBwRvUto^G{Ms{2-T@;qm}+;xK7{Sn&{6geAXcJMtw{|AQ6
zf0#3>Wmg)@9jaPwvGk>bYm;_f;rLF|6NY&&6T@5asLvJ_EcUPyK$L+sfWAB;43W>V
zvQ}9ZGtdJ!pX4Bw$>UwR>M|uxqE-nL$`XH;Y^!Y6Y+T$a3EzWKao%frNppq}?!4wL
zZ6r<oPM|HzULnCn6a3pLYxLVFVrGhyxh-UwxOxuWP+_}AcQ}CG_)GcS)U7-%umgH&
zbw_&c`=$-VrRsCMsE9aTgt8hbiS^JYjg?qzC4z+#oW<3{-B}L`a#drcPko^WKKFmX
zq-D)yW2xTapnPfS2V{fdBwN#3+;uSIgX!ZEJCaGr^lj~LnI`ESxcLa77^%%i6=w^U
zOpkAt!u&`M?@1;jjLLZWq8)?iBAkvnDbP~9f;BW`!=mW|<izB_(tUUzh;-SyySFtO
z%jaqit%_G<ZgsWU+Be!@h|9dT8NPqe^3wJ8C{RE^3mf@w=^&E|AF60A74!7xhj_J8
zX+?XFyw7i=n=#GJO33Ym{rcoADM{r&J*ntTnzL)P+D5Pu(cZv-N{Ouo?yAo;^5KA4
z{{(?$gmpz`=AsHE$dy=^bVcm>E8U$yN*B`rGJ80)f?p?cK`L-#<L8mG>bZYJ=^`Ea
z&5{YXl@4cu1Pz?xXZ*Pek?s)Ueszz}l1ORr{!oo^D7b22gO2BKz?EnfVb1iuYea~C
z9A3o6jIZEP8wUrRv-<YFhgLoe{EVAqqjn5aKbiogt-Sd?hNV~t94Gh9arl<Mk<(aI
zO@vhAl1@#El7)ABJk^E1y)b{~@k{UG8~%QuFq;q<^{+WqRX8JtL!>(M#~}-N<&9?2
zC&o|0Y|zJKrHgG(s$ks*DBIKA<G3aYOXI6}3{VTgh2%vMpHhFE;?40<3+l{To^NNX
z&3*Omw}o`<V!=>YzaB`ogQXLz`pFkn6OWp92%AOg*0;mFGWu{xa6W%DiucpB+BPWl
zNTaKmvU!;Gyw@*?xij6-v1GDgX;dvXXx-jA#{_@jUFq?GB6mY{B?|ixFzjp|GA%A4
zF*7mQ4Du=`JvmzP_$b)WT6gPwElac!nOnwI4=?C>)p)8ka2!4XPv+h~)mx?d)cNG|
z+Z`%zF12r~&$I*fEE9iML;8nb!oBNWN~+RV?@aV$2!`Da3CZxJ-(jj<ssv)}_omTp
zm#??P*2ns^dY}%bF-iF<tzCFC)O{etRcO{2c6!Wt-@#(=15+blv=K(V@L1h={XmKL
z#+gDM7U4`{#JXI+APYYB$kfTVK>F77@Lrcj0k2S_UHLJ)vhIHYU7YN+HpGRJ?d#@i
zw)U2L?KpEh!~}2SI~w1V=%`}Bw>B_8YA*x(6X@DyT6;?8FE8q349n}$`X=_Eo9N=x
zaBIYb@3JPp7_%`JkT`g}AWGqACV>U&v)!4Q@1}>sO<CGDAYaG_eUToa+7U6f4?oxa
zNFgS16i?XUB&>gyp6Q*cs$K#J<`5Y!Px0}<<huqV6nR@c&7jKj%wN#B)%&FhjbO|x
zT(s>r(>qLqcm|<L-<-`>vH+d;Vy=^pp-4HLa~^RwbqrJQ%DW{dwQLdHpf&Id4S7)R
z4rD~ytlUkL5L)^^uN05LW>O?Vesn(+OOf?^HiNf{vrm6Nwc*(dtl!9Wv>K1~OPm<l
zZGDiDrgy7>mM@J#s4^ivr50m=l1+$#bU|PBd{`R0QJde0^f)#;zF?DLit%n;^A){T
zx`Kje{lwSye*)tj9O94;O3Z-d!QM0zG$XwaWOFBBfiUfmfYL{_k`+$%C0M)Z%6}&7
z@ZOgA8S#Jg&G^kQ)N&OG{^Pdy69@Kk%9x6&{}W~ibQQY&PsQE>Cbk#9;UKR@hP~F5
ze>y-L0l42hu;yoZlu@u|A<*k12htfao<KF==~)}^;eHd-V{Uvyt+@f97&)zFJwpSi
zr6k`=8Q-aUV_^F|!c=xkJ!I1}u|yx#L_J5Xc4~h(-sL{*{L4<R&xCbla9s%qXn@{m
zChM%xO0G8(4$lpv65awAEYTsbUyJ13VrwfAX7>_9KkzH!*lXag<1~~Q3mQPQO4e7e
z`OMPEyjTREcJ(i;iPmv9f8^*8futD5=2&izzziQyabA)1WUPa~_L!h%{Wdy+jOl?X
zYy5vfO#e9qgxhGSK%)Gf=;VXMH3>%Sh7Xf>D9ByHr^)atV8ez2Ugl{4Zxhph>6@CW
zrrV`*W|0%(=S{)=wO7gwTB0P<3|?63NRLebqmqZw46mBrm)W{$??>XUTdy3E-R59Z
zX_Dod(9$))tm?!I?mbcw5r7X%4$UXTS?YhxFC<o^3Nn~AhZVMbpP^k{|Bx21^2@|N
zhA*Zss&8tUN@y<4{*jWIW?IR;;)<2q9x$@5{#3$Bi_>_;|K6;tD<f;Pyt%^B;gBMl
z=m!X&P*W`;FD%uP`}#C|9!b!hEdN1mfYAbB8uO2?7cvh)90s6VQ8Akfx<wbV(!YQ7
zB=sC-_jqtCSj+m|62N(%(#(6@UbBY>`jH>-y`n#DuEMi512P@InDv@Gy^!%UIPGK(
zYpLwyj`DVfzxZ{H9y%ev@kMpmCv-P)@t9p8!*Nd-fh(jkkS5}M?jRy43!YVRE<bnG
z?n<8)uJAn4G|~dN-KhUmi-C2!?lFJbC(I?=aJEf<bUUB$l&AVQMJ5Y14~f070mMTY
zR>={9p4yl(-~~{T>0dsipJb+K{^V3R<>J`L91ahszV(3}Tl0y@VHdu2Q?UNdqZA6A
z<C)obv(iS20H`7H5LSAZ`u0;aJUo2M^(Vp-mUzx-532Bn@t@6t4!syabCiEF8QTei
z65_!ct(M82UWXRLR$n`kiNt}X80{EQwT_)QnI<AR#&wCGm}8#=PTg~U-RMsci$<2-
zAgq&el28noh}eJvto^UTUIVz|Exn+59AHSccn~Rs_o(X1HsL=4JMtwo7j+tIINR-Y
z)oC>zx7_lE<+iRhArbLOufcz0qX2q9g}<3ZdX&?&2w}&ET<lqM`C3Fk?d@Mw9<oJ!
z<pQ*x^EmE2{_lA2oj(O<U6qTFp<ly{`1~5bM4*3-WQ_Kw`Um)kf4*_6V2OYNWL`=*
z${#?)79`@6SmlO0jw8Eg+iKkmBq#Kl(I8hgNj8@lf7@02YX>)LH&7IXnniej+RTte
z3Z%LgjNF-sNx=P*d~$QGrdb>YhUv5io!fY~Qd*0vU)LHl-iNI8qamr5#ht_L4W<PX
z%=zF05NwN{xp%J+!U)f}`D^ETF8e%Yz?V;+aTzaBma};}C1QZ-M0yi+WkJBhHtGn(
z2WzzA`zu9o0XC;_Q>Cx+j=R=>U4W{&(Erf2#Jb3Ey7&>sBk#g+?9c$@1sD!F*I1)0
z3yS#*K(auXj?}S^@B2-av3^~ms~6`dxYH~lG)5ztz@;h8(Hlrh5M+pGDDY0UxgwBN
zXKhwNR~l72K0TL|2Qj-fW{~m{(>?kj5hFNYpkcb)vj~^3fhC~HNbSXckC6TRcyl!M
zMH$e{y79fX8t8u+259VgD@l#bBq8YUMAH_FZ{2i4$Lnp##B}WCGB+ur%deT+v9&*2
zJ6i47WpN1^)Lc=lS;Y>rhpS4VO^6fbxFY!L$En){y0+NyK2zsI#;^rNVFBc?eB7+T
z!mG!@{jcfIF~l}E)I02dX7AvX9Bdz?^T9H?c?&1y6{^kol=Nw?dMjC<27WR+({Hv!
zXUv(cKPGCo0U%YeU|WC>$1*ROP0XvZfFZ5S?pdKq@8W&D)z>|ir!r^GtIGEDcD8ql
z(A1pWfW4b@Ib>l%<g!HOYK7LSuz9F<^JtXc7TjCd)AocYG>KP#EM0t<TOPo4Gnu6_
zuGIkgViMJB-9-t0O4N7xWya-URRDKW_AT57Pi}Bxu-#B@J*;#Cg`B>y%6#4`Gc#7t
zN8KU0Wk|O`(>ko(IFkKvy03}cvUDh5b!v>~>VP1I#AO=-+e;QYg0+NF^GXmM-<Qe3
zRLLfXQ6q^keiNd9xMR+K(!u<ak~xZ2_T&6$r#v>!z13`xOe>?Kx;TYKgo)b*s5Uv(
zu9ipWR{EG9o?AMOeQ@(o&a1#1F3JQ$nt+JsAo+96r{MO?>-uOU{Q;dUkqZX4VUSUv
zigeHzv+81M{$#^zOZ4{g?Uc~!Z*_y<czk9yn5P)>gD&%bF7mZMY+Z|4?z5|q_p}-V
zJf?dEDIu_1;b+$pO}*y+_10ROhQ$9}0G?yb-APkU{N=cn%5hf{hrC01qqNLYs?fz#
zWnP0jMow_htV#(7));<0^%E^XS7N~99lWgtHE8-yV<}^)f|vgDp0St=KR8_0xz92|
zo}{b$1O;k;jZI$|6y_-=oQ7n8xXPT?UV@f|Vm<j7z@HtBP>|oF?9B;uTW0GV&~d~T
z2C8^?LoXkbpz&y|zz;ku6`Evz!PVynF4L?c)G9T!D#I<WqzVzw^||k3_G6Refm}ec
zM?(L3iISUhLT_T8ttzv>Y@ci3>gKf+Jy~Td8l={Lf7c7t<WuXbeF@?A3FaXE!-<op
zhscM4XXK@*7V>7Wo^llMqmt!+>DjH6sx;AIFlDC3jl8auf%xBgb!WdyLKd@lDXOek
zcAdve2SH%Nzz%M?AH!<HPeypP)QK{<xd_Ruz%(BYHKPS^k`&;`#b)#Z<#_mP13(@w
z2wpCK1?M;|Ai!Bsa;RbRIZ;2UJbC7{tcDlTVjtjrkqs6lJY)p#4a)v|T7|Zj%u#Jb
zO;H8C93OpC^lTMS3lhBK3uPeWw|o2a$jB&QE57jL=iN{(uH_vdmJKxg1O-TAcu7qE
z(qauIO(*AhH+!E9T`-tI$fs&*ueu>q-+hXIpUXZEwhLq6Hg4)~7WlGH=VR76=mec|
z4w8IACKo`mqtvII&|3Befk=x;3Ub-{nHbp<@3|X`4yzi^*|875fez<;L&MC@?a{*&
zJ{7jAs*W{2A`BUD>5XU|t-qS5LcLuPTt-%rKqb<j9r%+j2Rqh`XT2o(AR1_&jlt}H
z|CpH_-Cnqi;c-7U#hANQ!q`d332pebQqB5^RXw-KC(Y+Cyvol0!VKN6eek&Ic>n>j
zW3UzgfkzKYX?D)#J%zmq<#6JW_jFxvUlTvMKjFT{!6h6B#H~(Bb`8RXzO^=$6m1-Z
zZ=5Z5?b9kqtJn{@@s;#-H3&m>${zK9X=DP6@@KsGq04AV+5`bH(37RF;TV&qJo^(t
zLP(1b{Pqd&-TXnZK>djH*9X8m?}zR|Ix+hBVmBhSl?vj4XErj?X-{H*tEd_4BUae#
z3<xIHPp&*Of6MbiR8Gaw!?%*dQkWFOG*^@cy;<TVTPR-6bk-N%Y=1$5@%h7lG+=^O
zh&8s)Q?3jnI)g{o0my4N<Ztux0ogO#M{~Eb*CUx4&u3(#S4x}$sfnB%T{5zgu;39o
zyL4REy^lD92DF_n#ZFtmx;^Ytle%zxK9Cg!L_w6~XclBKlJ=`i=v((yd-Cah)idia
z2ojNv9dQ|F+VFm?QDCGmM7WfH@$r!cSHF!d5T|(%5^U7XRSf5XSwWKd8UtD3X1|DO
zO-km2z=#~&!aMs{#mXIgFvjLfMrRvc{=#nrsV)zcdITXX;!5H?R%q9Z!6>vkzWWg-
z10pj=A5Q}>kagJyw<gChY2f=x40mv_C?tNN_y>#ZeU)X)QC*C@dqt0bfqy;YcW(Eo
z%C%c!&t)-he~KkEwvH<#L;NW26I){EQk0a~{+QzPizi!<x?2>))gO;Xw=;X(48uP=
zfNHC605%CK%;xJEX8q@nZv?IYgI6xKB{6#$6zR7HzyqjDcc5NJo;srlHm^^y$xy^i
zPX_#BypVz%ttDj{9`w(DSAG&-W2+KTEa$EGCwfc?&vO!p)ePNUfX$U~AF8qS?1(v+
z(zlscU3AjnUhXtO`hBSeci$EDjGS#;hmavkfFUzfFbvQ)An*_pArc*%qfCjj5w1s#
zf^OVl4)m0f;azwdOcCfBc(W2Lm3-3?SA7c2PsPn{`RVdw5am&SS{~3;`s;i_poJxA
zHBfcv6w~*^s7Mk^|Mq!SgX=F8DQ@J41k+q4W7wz%hBA0DF<598*ob>~15%u*77@rt
zV!+K^=$OXSR@$i}4Q!!(Fde>3l4(~+j;!}9`~Cg%WPKUV#%djCm8jOc1dGp20hFJ*
z`W@mta$TNsCepKiQ_RyF{K%u-h%MHIPXCCn2pUb4-5d8#Gwx}ab=j;A@n&fZR)`eT
zQj^SHm6M2l{YHbWFQn*av%?HEdd)X@05Hbdw|uy0ABimGxz`)&E&<?aK)1G7NyhoM
z6*SN(#IVKsl!$mSeHD_o0N)T{GmOcT3=IK@vi@a@^p%=_oEd1Ey<>69a6jL0%e&3%
z0-vQ`ffe-+;?Hyo=Gb44Zz?lzENr!{R2j2|#)(RSS?q}?d2wR--LM{sk!iJ*BZ`^m
zgEtRORN?U-MRdjO4rXh*ikzGwA<_BR*1q?;<Nc`q{*<6^oJD?LUJgYMxM><+4M-S?
zgGOZq7`M%Thq(56JnAvp;}>UVS02e79Pim!hX{VLYJ5c&3PB9vd}YfBb9kEe63~NO
z?G1d?@iI^0hRE(GxN_j7lA)PD7Os6nC6<q00`o0l1-0i3aqnxqX^4rIDsq-8WgT*?
zJNb=6P2v9_ue@}Y)!CqQ<OGrc9CS^DC*B=4uvEW)q7Y~!6U!{XF$8179d+gM&a%8<
zAPuY45Nz}g>TmOp&(bK7w{U1?VhCHZ1d0spWPveR8@g?3#e(P$aG5Qv^;l284MiNR
z#kiO!yvbvBW-Y%fZg}?I&@tdPOFiu<dI?ofJ7yFTT*5TYV$o|4ZZEW8VNr2J8HjO~
z;t-^N1|LfToiWw!gRIR9mSvxf^$o7@WV%KW*=j(edZ26fO(=+m+m4kA>}z`v=VAGx
zp^X2<gdgKqwyf|(E7!1K(_cU>CgH$u5%8=<S}c3QSg`KcjP7^a6NbV}F+SED+Q)=J
z%C_C9I8C5z!YK{*mrpk0b+@-2kYKX=5mWeo)&t_a&9F7CAV69GHKE#W_G2<gU9{-5
zgzo_wu~@T&jCcqB{QQma*9P!H3B|wIFTKRlD67M-jvTfy=@f9f|NF$9E&+;d^(NKE
zYClq+H`?q1CkQPLcgitW60G5VOYCwe;r;C-7PD%~nJ7bIDAbxUG0e@NUQio<pIs<_
zaR6c(!DhH>IpBN5>$l8$LNDfNMS|lwX@9gibsffh$Z_7lc=mi;jd>YoUE0$Yz73)=
zQIh2{%h<{$jxZ}=DcQI?Qnm(M4z}i2Sug_XcIf0fqScW3+j<DV*y!=QHN>^M4Z25p
z4@_J785LLuEPEy4xIzvDQXSq7=L>#+0JQfw)+^YGV%5~~CBjFh_RB4m;g9yNSb1<^
zfOUR8X2Ce^knGpv91EC|6h)j?S+aoi9){t}Wphs+DG$KTTQ{_=W3Vrke~tXS2s^Tv
zE2Z{HV3)BmI|+ALMqm4oyH~oml4$evOv1LpEJN+`rOE2fG!Z2u;B3JBIZs@FdC^p5
za>MM2An)OC<!gy6-FE+mcO+ALS-|NQ!#2m>#{p=qKXaY0IDF$N$Kk`2Kq4*<0Y3xz
z^8Q+$&SA?xq5HG&aN9Q21mzp&7{Yhv{Bz{c%LE5sNIsG8Z3bDYPVV_nv!hG6ZU~L2
zGqvzoklyMSz~PLsavs2jJUyj<lPQL!*v74U;VV0C|C9sfubi}5Pk2JEH=6us+I3)*
zRCk1X!yQwA4oz)}EL#v8C#TOn!*6rI5KBxVvs8<pDLuP<<SMXdhA)b#P?D_4VgMJS
zKc<yuslzwF?w1#r1!fvOV-hhwLZZnmUEuQ+Ex^PK@5$@Yg6?`nKjp4}Y}^i0B3JB;
zD-GTT9I|epms3sR#?MZi?kCIw>{BRk{c`0pz@2do#3Wi!H-bV1mUde4&N=AMZb_w9
z{>Y3vX~Z|0Hr$bzQIM^`K|wCwV5~F;tVU4g@kS0v4u+SOTsZy{fdu)|!Ae*N`vD9C
z8dnb;B*PY725)ZiMh*ynAfo<7UKrQPXaM(+enI+Hi=qA#SweQX|C}Ihai?ItBceG=
z35K9eghLe^ihPV`v;su%66Nn<{>|lA8{yV~y%g24WK(aY!_GMWncV?WqHU%h&ZdxW
zR^Mt!Xl!$hcEDM~F)6rqiY{#o*4krv-Nptblq)_Dfh4UFPWSSE`Z+u<>)yvSoaEKF
zB-$2`rbujv0$6`xVNmG?&>hT(NCVI$%ZRYsFi#rLTxUm9dscupDnkiZpEG}!Ww@#k
z=UmD4H26?*sT<kBKzd<_!ZTyVT?a^rqwOi}25Da3P*pLIY2#mv2A;p3d3cur*?(bi
z?}e6`nj8}+;AsngY#;qH4UqRj9+(!6A?8+dzO`WsWRas^ZNwO9z4{_O`OfkI<Db`?
z-ln_+uC=e24v@F-)(E$xw?Wx0eH_)g=2Kn5iPb=twm0=ahZg`3=-HXh1NMweIT0d@
z8%xFjCbbw)Qyn5rP1SXJLQa){lXo3~D-}|`2!2k@U{bSxBwW#$$1h)LzKW<N2KOZz
z8%E7qs0fBT7t<;0$?=ibpc?_lMyyw#k)UC6bewKNbVi)N<ok%>4Sc{3Hx*KT5jC!n
za6&b$SiC|DpHrVOO<Mx2J&h#~X{;pXOh}hU5qgol=%{A<m)QA?P1Dw3g72M22+E<-
z*viMk3^HebVS>3>@^LXFdN9U4qipOVDqASd6KL<K$;U%=2pOl06$;P5kuN??88i;V
zS>Udk`xT~SMSz%0i}(~ljHH%@*_cR{i2h}Py<B8V&z)n5f;hq^Z;+pAM+T2NShJ%s
z43}&haV)L4prd$D;*zJ$r}Pr&WnSwLQ^HJ=82(v*g$bWL#~B}3JmBH+M)U`jX8pr7
z+{F~~r+fT8ET-ZxMI177Z+VcI+t0uw$NX@<^vdVZRSDM-#=5gYnta<~sa3nY`3Hdr
z^jR1A?WPT4bb*Qin`P|CrDCHb_n<qk?PNdUk7$^UyQ<-2(ip<>lBASJ4(6?HCC@cj
zT~IrJK{Ev>i-bjbjx4vzWFhORd8SX$6$hLO(+u!^r65ZxHT}1IWNHB9nbW8WYB<i<
zWVQFMqP*$FSyuOFyV-XZQ{p4QHGXQ}n%Ki$%&2wLQ2sK@Y25Cd#f^=Pv_W-sf%8hN
zulHeDu{eXS&7Tn|Vl%_i^p)p%Grv1w;~=1ae%$sCRakGEW>blGZ$mbrjAz`{Muj?@
zHg3sjSS`&K8yPE?*g>!pRDB*8$)bP=V<Dly-aRc3>DA_mQW1)@8?{iAGG*F}L*6s9
zH@kHLqsQVJ2H~QNA{^Ka*lf>b5DyaGxyK`?`4}$hlqrnN2FH<291O27DvUlZeef@T
zjP5b&L>u*9A4TikTD|1l$aWk;k0{~<+f0{^PlZ*4QR|tMQrJgan$f(cUegp!E-h_h
zzBndf0y$uaNd;3>^lo}>Mv&~nfvGCW`8{1U3O?pezZIaPZ`eH?OpBwg591(IpYdBK
z(-hX9sJ}s*Z`0CoEaheHhaY$@b$4rjgu5Tt0+$B<ZJma18kTO=)Y`wutLoYWK%q66
zfdgp%EQO%x*G7TmtV{cY6K)K!|BC8yvA5^T#5wDo9h}KCisgC>Uzzhs)pkjD_F&zI
zycn-FgBL_LO+AbcDL*;A$#Y?QG+ntR(Fd&U{n5uHI+4_BpJCWt>VW(#3q6H@@MA&U
z<iN&^imf~1>gHVY8)FZ}_tUrj3(^M>$_F?5{b&d`95s`{!lTO?vK}g8D2TML5j502
zz|Q9h2fwOr`SCUB<t%P+p<u;&KvVn*K}>MDt-6dP_6JYvMd?CazV#N5*Vx2F+TbFj
zu;9hxIwsM>V@*9#9q}7Nw|kd=DJ#O;w$KEOoX9*1_1?1_;b*-CSlr$^9#A!G?Ux4>
zH26Qt-lO;=qT0W^I`DmI6wHFGy()zM!W^kTJ5;KLAYZ*;;2lie{4SeB)@aAH+es-t
zXpjr~5=ka3O6Y8euVmTT7T7qFooySaykGYu8c<}jaR6T!#ik7m7mn$Fe`*<s4-wY0
z-m=_Sz)w3|-z-&3WBlWV*g|FUP^Em~fLj@H{Is$?A8cwyFB>bi)v;*@&ST4@3Pk5|
z&!v#kz{*9)bGzsHpICc_BLxb*&s)9bvPgdFA3*a9fY<&Uhz|)^j}cG|$}lJbGPOwc
z<f9x?6vih<tvO!Lj*s1cx{B5gw3dJermoIIW)k}58BNLN4g%j@to)d{f0KRt7L#Wb
z>)3-BQXTdZxke@*`$SXUds6(0R7~UzvVpvKgSHPsKf&wrCsWSFU$}Qbx}*ioM2cO*
zXj;|Czx&WaTGmicoc&xOy;g=Y)q2hOGK4i85fEwNXzI`C=jZ-^n;|sg@7skOeoOz=
z@EO%{RcYEF01w6GrRY0g0vR!d4q5_2+CkcfoixXY#V*+!($8o++MCXmS?DsGL2<#+
zATFSYPqt)TL|!rqYVhk7d7t^379qn93Q&gMu#-IK^N#}K-KW$HO9zgnj!fn%zDl5H
zyz(r`tZhP<uKuWh>Z?&pBVx~lRJ_+eLR&w9J!d3&MRaH>8!wKyQQromApoS>YS@l>
z$>Bp*V4=LkuEr8gq=bn7I7L?1QGTjDJ>&}CIp@E^-DMS?52J}ZsjLiEs>I|*GS|~D
z@(Yml1Ni4DKG_1knww-~d7s?URJve!p&Wj+@T97Dtdc~39sSwt%~8vvCXq$cI6|Lr
zJD1|<`S75`dSL<m7~$l6hSMs<?f~)dQ%0he=P=+D6FvTw0}2b4GOZlvwcq+Qj4RT6
zgDH=&QHm^^=^lg4lHqGa-S`|oC<muBf+uQt_0I8dLiw$GoRccmP@SfcI;Yy%<WD^S
za=4l*^{m8yvs<r7UdvzZRzA8K>8^VvP}tifgiaWSG|K*2PnrREcBc3{L(!`|aaNkW
zS2Lc+UwCK_rw;;6TY1^TWeqH??laWDEw-HXRu4lyhPDpGmvxb&D0`WV9&JC)SR`hh
zV(Uy&YQyRb_JtJ-n8X8Qa4iT`Koa8rfSELc|L){}@Qn5a?Nkx?bg~n^_5wVVKtwqY
z{rt$mt^yE4Ouq=_h_mk<eAxw}JZPM80tRW@KaoWk-S;13*c1>C9sN_U?1;dfh^{u3
z2={0xl>pU&J#NsAk*6G!f})gnOn>avEg*5JBOv$N97P(H>Wy)T))G6pn%08M<Nn~;
zLu(g*fRU1_Cypt+;1K|nOVyjV&+<mMo0<<!aWl?a&Ml55Mc-+Qbf9xoHOQR%<PKPr
zjU@|wrz0(4r&49~-X9c)vLHmtKtgJA#^3U5kz`q(Fx_1cd5$ytyHCYZ{ko_BxNPgR
z@r*eFqr`+MU&24VA?LAPw$%^Cw%Co5Et#f&-r{3kaYZBgHR~9%KGU89U%a$|0dzT{
z@%v%Q>+HRyVW9IV;3PMibL}xI`khm~-XAlo9gy~+lyYZs;8w0xU<3DVL9cjDoR$_R
z!vpJyJ|`I|rt3f|8`94ka~-tqd^QtL^sXM;jSh&DnCk-CojQfUM~aByuE-&(hj2ZA
z=%C{J=5kvpmoEknbK-`Mq2^`AVnne2zj*5ASU&lDwUxqmgsZBx08mD6$Sw$}MCWIA
zkgJ^a{}8(tYG89imjziSXXX=TTqPD|j^PS$<`ScXn17?$J462Z$fFOZjd<RDGcbkT
zZ-d8qi<-?)lYz8h8Le>QGf+V*{)-8JJbfq`je#AZa@H%?WLTX{8@Gjg-4W)jdW?-~
z^l?-cqVk_o2OJV~%O;wPVtR~Jdzm2++R9jD>E%#<WqRZok1;RQd1+LQ`^xOs2XKu^
zoFoj7I1yUuq$Be(bUg7-50X7BF2XS_wg_^swbDXkfS8YLLZJ#}Ze(+Ga%Eu*Z3<;>
zWN%_>3Nbk{mm%E&6t_sK0oF1CF*&y&-2pQ;12H)^mm%E&6t`*<0um_$F*!JwA>9EK
zx05^q!5acFFqa|S0TdB5Fg6M=Ol59obZ9alHZe9blYq<=1UE4<IFrE#DSvneG+gc4
zw&)SPMjxWrLG<Xo_ZC6M7z|?uGdj_0MDK(Uy#&#F5JYcL6GTZQdM84BljMERIq&)Z
zwZ3o7T6^|$-`Cxq=eqXH+UzX)M*IqP2wR9M0*>Mr5&%j8lyr<Ngn$4bP(%O-6eeJ2
zH-@5MkiYE&?4}TRBoqOc`hO3Ek~;*1Lfe!<C^S$90S9P$zyLxb03k6cA#o`n5FiW$
zO8yN*xJv<)L7q@MfQ|q_69I=H3D}hou0HNi2S*gT&fm8HE-*JhNK#Uq?{_#r!3E+D
z1%u!K9T3V9;)1RS2EhPE2rv|a^7%&!t_O}Nl&h4WpqH1I0LTR?fPZjzkmcqBctKH)
z07D28;_eBt1N<5ppbK(={56^Y0Xx9h5sLidFhba)yg=>{0NMb9f+27uI>ZBR2XP0W
zs{@QQv;lgq5cnUk_8$Nr;IGXA2nh)NE8SnwzY;;=zk@+wFv7(Z1owf$9RT)F7zCiF
zsx5%>M)3haaJyeX5PuAbK*xhTK~NaT77h5_ItZYuU;qH2C;V$ZB-kD5ib4t?p|D>w
z3jRui-ewiJof5*u1p-GQ34Zmb40VTq(fjTr_}Ae&!x3I^zrR=ZP`I7_uQBXATm?<w
zP&W^VhVow+w29!~HU|g_APSTe6B88zK->TjZ?L1_uL8zCu78l<&fjMA3;}+w2v>kT
zdJISa)E<KVBJe|kJRty-y9Xq|?>`;?ToDKf0qme)6u=hZ0EH9$J3HD8vH!D1pT9fQ
z8(;}U(@zKh{Pp?QofVp4b_h7k=il((M=YpdV63WS!u!|A|8goSBD?{9{KAp|en~MP
zKuAbP3?MEp3V#UrXC8eJ^shetBUS@$j{r#iX&1duf4A)U7YDfh5(qcopSg4qXy!ry
zT>mEeBcLb{jJ^o{pXvTP<p0O=Us?WFqW^bCsva=dZ$H-`!2jb1xj<n)e<9G!^+2Ij
zpo2hb0sh}mGsqw5>OkzE9xngw)j)yJYEXbXpc&0Cbbns}c>j+bid2PqL+tdSD6r!n
z*8H)X{L&i?3Ww+;kkDUG7<3d6_+LJ>$iU9%rw9^F&EGBvT0{S=s{#ij?0$(&SX2xE
za(4&$5TMT*y%GiZ387VK2l4(*W`Ljo9DzcI0MIiA0PGR&1iubeNE9Gwi{2wN!O`|V
zCJ}%j7=P*xhC#r;j`5G<A4S0)?(S#>{$>Zdqrca`<qm;(L%;+Jvk0(snA7X9_KO+?
zdN2OZqqr-pozV#veNmz)j=2|pj@o!xYEy2CkL{}N4yWtSmqkp@`qT65U5t4@>dpyX
zPE*fAVW{-2D<1IY4}L%Hc7QP1A?O^&#nYqL$$$0}4H!utTVh*sCY#M(g^TxyY`*$Z
zc-@KId?>jMZ~+vbk+P)Gqn;_`c5Y)nwP0aeMGaXzB8?+=x6JS`)-V~r#(WBmJ6CLv
zrTy-+ZW)(3w6ydtr@t><<fuTaw_2<!f`XRPSCb`oIB9^EDltd135mg>D0-$;mYTpy
zTYuyd!Lf|>SbX`%bU}Yx;(&-pgM+S8@EyG;BaI$)2+>)Y+@9ql2Ahp+<L`n*cbk)<
z9r<d~*%aBU?J&-UGWM%QV0pdR)Jy=}y3P+bI@5@f(sK)K%*Do7yeFX|)?X&>UOax5
zl_(@^l_~?182I#3QA{7k<T`9`ws`d*6@NfM$4;TIfu+mhwCXW@k5AzAWgoP{oH-eO
z^0oP0`%q8h0fKFhk!mV9!Mr1D`|Va@lZNQodooiV6){w;)*PbChC4ntemc-FFBe<C
zty4|<p}ge$1Z%vh2uZ#%*_^TVCPs$tZ40Szg`jCtVhZQIGR9Ynm0}|=WI~!{Qhz0a
zfKNV59Nbbi*oh~tUB6?{^Bu=J!PfmiP#E7@E3fmR<Kq%tPEFMP1Zd-S!qrzri>crP
z@!91(#h)gDHWZ~#9_86T`w@4#dD5_-XRc5e^$-@F(lr&hZu4@4vEyNX97D#NiJjgK
z&eTnB^@htc>;nqhAvLK1*03U2MSo+wXsgmvKUK7eWj{!}{iGS+y=TO}@#H(9kmb4b
z{f%H(>#q&E`>sFA-4vAp<RqN);gTZjRXRZ&l785PQKo^)M5hwuM4*X=5aC(40EVM|
zBf$ntPHU06VB3=IX>$x&-KCoA!C5cE5=Cn*gP`VsFZdj*C`47_ho`>C$A3?P=6Yi9
zd=wB}wR=ytH?7Rv=#@isT5zK*?yr;_M>LZaSj5ka6qxI)9B5w)uiFT>+^K3QL#U_v
z5eU(EPtj5iZgF<Cd(ir~A&4%{F3ohA84a^kQjUsuGh5=PF;9MQq^xJam{o769|dZY
zVH!FLy<$?$wLL7Z8V}%&gntn!U04B%i$3&l;fFDJ+Rq?DdF{vV=ICtiGS>y1!{ivi
zJj+q6dsWtfhLvBe%3UHhNZ&(C!nDfu2B+d!H15Q{o__sf^X{o3*-snPw3&2f*T`YU
zfQLNSy>b-KND0OC9g`P1e*WvHrv?Eak<Y57Fs#(hV+n8UN_xD)DSuRwx|u?0Pt}@q
z9m}HW^2ARfrPd+JP*X%*`UlU}+?^!3p1Krf>6DyWnc<JJd}00TB^8~ISS!9are@Jh
z8t&qF8Y-pE7h&fZC_56+5>Lz9@Z}Cr59g3{IFnO9v$cn9Drj8jTVs~jWqK`SQ54&0
z466G&bAiuALcM<^Fn`4i2JaXRndocO+52gYm5n0l!U^|AEvnn|cLjGmyW__#^ILw*
zGc{|o>*dRDXR3!rB$Gc_*5{1Vd^!9f&@*v{ub-`+)zPFxNA9F<TW&Skm1j0g+>>~Y
zM&^UQ5Het0jU-vVP&Y}``amQ#+W2#wgnerSfX>IDI5M<FkAFL?o~RNiKK*5iojCk<
zm>OZ>Ws;%qON!%T`)_`c6V_zPjvr4RY!vuqX09ow4sXo{T)ydF$VCd<b1EJCEU(qr
z47{3tC2s|0l1Q$F(}}xrhSGkyr4@B`-&s$FX7^`>{HzHesq`a^Z%H4a@^qQzi!<i?
zOdeu!d^ar1MSm9Do%744vH7plj}UDk)^lu49I>B|kF3ZfV5#vNO~@9Gu&{2ygtawm
z?kpDL&u@c3M8}w`m3s>lb*t3D9Y(DA((zwYuRN?VjG_q?M2|AX6lKUh6nMfvWE!vI
zS7pZ6j<>UhPo9@iSP9~e@&^X^MNRe(%I8g|@jhk9f`1a<x-J8Q#$4fpAJ*%qKh5}+
z6X}+PVC*}xBfpn_JIDoKw9KvQ7E*_7e6BQI+!z}O?E;l$S)F{9o8cqG+&!{I<-?LQ
z97)9zZ}g%(du&Q@4Zn@lNhTNptg-ZWSqxmyZ+9oqpSQS+ows*O7u7vX``XpN;W^JF
z=}hQD7Jo<Gpq}L8Dov+6IJXW+cB0)C%9)TlFbuP*T*|ifRa25<We@R(EERdNe639z
z6?-;ZWT^j@?MqXO)J?~G?!k^Ym3#AFi|jZndp~#4^S3k-z7xg}r0)Z;AI1elE_Bhy
z&VQsKbQun>et1Rqwm_R$V*Jg?!ZYyjal<%*a(@A{GA3JFz36?b*2k0M#$4`<Q#`j^
z-nkE83!l`!(YB(z>{|pBHaa7**N^$->+pc&rnuMioF_TswG(G$D5KKBLJ~W<rCM_;
zYznSWi_q}5=gzuj4Hj>9Rp%dkRSc+0`{rEtp%-t(aF=UwX53nMo}Cnksc?0@;}X_}
z5q~>I@(t$i5{j69w^MeX*5Gq1RaIEN&vOd@<oHETX7YXBCkcglOm9<E8o+VyUoT)K
z>GW^U309pkQg5T?!?CW^Az2X%`bzcRJazXrS=Gb>2#a@!_VDs@tr~>#6=)LP#HR52
zZ`N>aw3yBuuEeO7R>H(XwCw54D1DdR^M7o1Wqzo!`f--uAC55B0Tgp}-R(`Sjo7F4
z75rG&xZpdb-TN@iza?7v7E}Lyev<F2K$TtB#u&PXMwiXU3InT=mH1J0?^bE&n-w-v
zTDm(>u+G{s_3L~~4C7#L<d{wYW4L}aPyGuBq%6MJzPJ;^%Xu;KF4Kj&5VtsfX@5MF
z_1Q%4eh3?oasFp;eMPUS9JGs^JlgkoQ=-4mzpF^r?#9W-IO|z(Z-c4Jz?bw@TDOuB
z2c;p}#N)*M`8Tauw<LXW+CCdcDJ=&IzC}H0P3+5vz$rm6^6aKd#`e39&uBc&M>tiR
z>}s7+csu2{3f$(y9lhYS6{?wieSb*UtC0;;*4{UGh$Rwy-l)$HN1U`Db#OkIu;^I9
zh4AkP30@G#=7|T#@~DX3OSg+WEJVbm`B^EI%d-8%QoZf#z%miV^AgdDF^%IC^PXS#
zNAT`w(P$OoNFu&Z%gexF>6vQ|kB~J5afrZdOw{wSp6yyfZPVx{C+}{qE`MBzC}E&6
zA}e;v9Rb$j#|dp^Hm?ktpbUX@8?JB8`r?>|@bHjHn4&%c=ArRe3{#`8xDUTD6d334
zVicd*32EgOI9F7R#5gSlRutgV!-2ju<!Y}OSDD?So8q@YWo8E7*nPvM?`pnonKv(_
zE9enHY4`x&cD@wAp1v2|XMdS|uaGfR`JT%AkR(^vYE_<!($m`I49|Ucy=l8KxH$Yy
zA=wm`y<{j)HT{mc)M@9Y>_B^#6wm0gHlsb}=rgKb$s`U?l9MzqqaRfpF!DC{#G*oy
zLvM{1&sMOxRuAR}(?(9;g@?x@3XF@~x8Zwd<9F(2jN4PldNUI~Xn&8b5NmGlAAPe{
zhL&Di79U6<A3XoqEZoC#NV#khdFh{xk#-OFyQpc{w*90@%$A#eaKQQ1l)ubPY!>?e
zOpmCZzkV<7S7estVF^=Qz{clf9s)*Q2Umq4z8b!68Gok=VNo)r!4UE6(;32~{j}<a
z^mzu-K!I<9s-^VwgMTf<z=AZCVa{r645k1pgBOI*k&d>DSU>0mWMkIF^=MBs5>YQ-
zQ@fTHd}DL4r7#sJQnF@1^{q>h$@Jt2+kvD?K`V8FlMKOAD>*>L*XMp-IMp^Jq9W%-
zs(TL8U3K@LD`tM($lg&Xtsr0RaC<#|FigU{@@9GRegj?%Q-5S(!o;4?D}DRB?{8Ng
z^UWId<%ylFx8pFpa4#&eOkC>reEf;9y`lEUGn$jGK<{%kwwpZqu%fMTfq?v$u{$Fv
zO{Fv+$2(O=GgH7dwONTFGIy)G?OAAUG4l*}lndYrZhGOqjW(2M<&s}mc$(!)1a9t-
z@73kda7oWydVeWv&hpMB6>>NvKL(>FHoIY+GF4LldhuN1y)(^BBF+P!iyU1KB2Wt6
zR#9n3pFnZ{J|;@HzUXZfO!zfvv$KMRRU|i!&IL(eqfx<^8;i6BcmrL?GhE!v_!*8;
z9_u*9fke(LusjCI+TAOTra}J)D`S0y>F1qHlXSZ^<bO9?3+22iVB)Hv#s~RNd^lZp
zkPk9Vz6DFVve<NDmKd}zo^Eg!>t?If@2}!y$P#1rm5#n~vZ^PCAB&jFYUcaOEhz5>
z$>?5$-|Dc16EQyXbEC1f;F4uskl^|Hv~zIOxztDG0<jizf$<R#bR4a|-a{0x?6uZ%
zVO1DJ*ndHvK(%f6!cQfMYN)99saNm<?P?~O02`I*>ZT(dD(B4Cna$am&FcPkH5K*&
z*uFXcvYNC_3EM19{%H94hsg7@bXR7WLG_DdgD;uU*tV;sRD!O@w;GOLFc>Ghb*fHE
zVB7qhQ6Nj|f^Sn8yvMsKaM6nM<M5S!Fw>Qb8-MI_v~CF%9~q~v-_Ch?$jL)}?PeZi
zd<%YrdO$xD>wF}LFIOh)Ld%^yJZ^u|QoWnHx>j)EbB}Ai`Z4>WUpYN#2}`>HQ;r~z
z1G(bea$>)!SixI4<NkDCWo6$IHM!`Zr^WEh;3eB7+iMw0x=$f<IdWTe@*-evQY(>i
zx_>m{tr><H40ax!0Ck35y3B7yxzb8@FIO{g2HjmdXlsNhov!m#$>>PCqQK!uMpWvq
z8t3_%(xbFiS8nVo?lat<IX28$WCh%{Gh8i~*+mU^baYw?8tTG`-1<E^8mouSl~z8B
z=wdW#KSb7f8S8uaB~l~XTgPiI^mCu`@_#?CD$6%{nqI4VYI32^+NL!Y5y4y0K4sAf
z5vPy?R&b@B;Y01{>9e%!r5&8{B)iGEEHwBNVquS8o$g6Lo}t?OqA-E4E>-{P#j1rm
zqpeVK!&;mAfM2s$=zyWM#bg#OF(1JTHr3MiY3j-gN2YXgu19!2lj$v#`pfL9GJkC$
zJp=uUk+^3IXZdPc^ZJf;Pju@oo3S;9Y__6;l<*IXsePBH>~C-0elVSu5_=VV>+yZ`
zud<5JtR`ps_39Ga;{e0kxFjKXi-C_ygUHr&g`MpSK*tCVO>vRufuvjYN1m%&T_=HB
zAI$u6bf%X@<mTd^mFXN=eU~z$m4Bur^JGp4C(XbyUz5fOQ)EuM9bIBh5ig*>sv#|x
z$6{O<1rWH?grwfVIy14_comu?Gie_4^UigWX#Ja*Aon00l&p_Tbp+3Pu&okS=M!t9
z4pbk#f_rT~jI;5guQ>JU_|~J7^ZC3%2JK+X?a+MvWDao@iUjk_L(NxO%YWhi;_>7&
zCg~;*Zq{#g(w85NQqy`oJBAOgPL-b2$#rRlwh1PwvWl4q)Bt5SaWPMLKWZ6FhXH9>
zho&ngWwwJ4k>8egL%k82R;zR6EF)f5VtPvg0Z(&-P}{?SqGSgJrfb7xb-a~iMNO4e
zZ>|`{W9m$hAz80x%ldsbKYtIsO~y0Mi&YZ6Qge4$Gr@gJDmuazADJG@;a?Nq&=rIK
zBy~xxd}CfBH+_pJzZzG^^YaRq6Ah{)bbSRtbU0oBKiti>8nfy%z#K8V8?HB>NEhWo
zED-xLuIk{np=Bq{L<U0lfz!P&_&+&AHs7`jRZ+|nzmX1LCOHUyq<<6m96ZY<H4lle
zl{*WMSf_ZHd7nuu${`ZFtnX`KPuV63g?wy|ab*f%h7)wg%HFT#|JXn);8Vf7^&=1E
zh@9kT;(%k0pzF61k^<MWC2gCwbe@V}-awTuUOB=+(c&l$nB<9hi@xjx+~MT5hU%u2
zTn{Q`J^|OrL~jh-Pk-zrtmI-@^r=EmTsGL*?9#cYpsWLP*u0uE^z|NNF?9|JRnG&H
zlGk&(A0)I9c1|CVbHpN~k+OuD_vq;k(<V`z=Baj6lDsP7wFkNzxcHfNu@ZiLR!6Ze
zEzbobY47wOlIFI}#ZeX6(RtE7wZM$PwMaYr$?S!2r8xPP$$yfm@>c)3xT+lD?)Y0L
zeG<vFqbk<yZii&WnCG!$eGB?~aVOG>)&}u<WyvDnyLc4uh}4C8z}v9cnpQOWiMMX@
zZ1iv;KOes*V9sEBv+_73fM1fzK=5tRXPr7oP_Ep3_rT!RR87MzCej_p4J@meV%vkR
z+t=UPwkmA4gnu7QUW}&o^J0_kpcs0}Yb?ieYNKd1^M97<$rrNgBx-~#e<MN_H_UtD
zhDOXhqH7VfU7zed(lJ$~8Ul*mjPW{ad=@s7l(kO_C~E?cPF%cgJP|=fHdfrU<~x-~
z6!-eGmehYa*-Mxu$Qu~6q?*=_am>SvvmmFc<DN%|ihny(t^7>B#~z5Mp7aQVuhM(W
z{{&f$^xiE}&wZe(MYg^XIgc~C>sWH9<)PTb-Ea&SzU4_rBYv}o<nhE<W14q4n`+L7
zWJ)(adg*?CUI&7eOGUF?=!vfAZ-jaE+Dt^N0ApCRmPMi`hFPsYPkwiB`zZ;mwO8rq
zl6Ga4`F}ZN51tdqc2+~~&L|CU2d~H6*86_A{g`|Rzr-~u!>@UzR6~qLDNXBI2}{tc
z=D7<cUd6{DqxWpD41O?8Druh-949tYduMpv{?u8_7_Qp9oQ=al^n^8RLnT>uG{V18
z`Y|?1AED<D_6z34YGcb?@GP#?eh36JhE*-ygn!QI*-8a&m`}_B%F}yB%EQhek=o;-
zj}7H(V>{O5@|U)}o85X5R`alG?@yd!UPtR<=C74VyOgz<^zdlABki-f9OS*M?2An^
zhkGoy0-tQh3aNho#$-*RAmUkhdtgm3+jFX#p;7pjCn16F<!9sO<;!8<!V;zJy|e6F
zmVep4KI2I<Y}gQ?$`8&nqUm;q3OkRv`oiV?5@c|E%w)R`qBdkN6RS6U<iGUYw3w`3
z;{Sf7(5o&z0QO5ec;KUGD_#a;;qZ=cJ;0GKi+sPIiqCJCkNu&;V`J+PM$ahb7uJlx
zb54)FA%7|s*$*N=fc4L4dfQ)G&%8>x%YQwS$?w;s7vEB&H+v~eYFOG+PvZUV>oz`f
zltCZ<iI<|oMB-Zewb6B3ZZ_*&IV{`u;LKOLr8YyuXXcU098UM}R<x^osk07YlRU0`
z4}{~*3z5_eSnp6Y%IN&dTXx3aUGA@fu7(2_%L{MHS?>xrco1Z$K$1i+c;7D6Ab(39
z9&ys)Q`WYWoMwF5w2d-&O?ProV+145bLu+-B+%0N;(5|ykS+(UJz*E1(DHqxOPL=N
zwt2OFPOY+q$F~kK6`mrK(V;<5a8vRJYk~(%KNU(%(U~j=Pd3XA3PsJmOJ*hMGB9g>
z5vq56I+=K%N6+_1s{pw9*a@6cVSmAKweoR(ew-qHXG>;VoIJ(iZf5=2#k+$oJ_S+u
zkj9E?OsZgx+|@`-<|>gD2q{pnD|kbelj<)%p9s^vtaRA+Usu(aU`kt1dtwa4Z@<lP
z>zJ{#klo85J<jq@&ZNs>%{2D+oiAl%J;}U=h{Z+&=}YE&dDjM<zH@=pDu4Uqe(d+7
z@$T5DU5(|)B0qk4{!rUfwkO}6L;UXao7W%HPl>U#h+l#P=1F@5X{j(`7JbM=umn3q
zt4YV<3pZ{-YhD9xZSORJcqzqu!&dq8<1^OH0)*i&qB(Mx97Rsn<S6mMGppK<o{~jB
ze6yKzhlN37XEVP3^($4aoqyAaM@vE>O;fZ8j$oNNeqXOZk%?zZOI96NgVh2g74RQK
zhpyc?1k+fa(J=c+?njL=B~qrZM-0phx)CW^=YfFxGt4h37sz5vk0ZKm#VEhW$6ZTo
znz3~6R^^9~;Ta!zhF71v(}#(Lga;c+kB09#W?HPCA}=904VUB?Yk$0*nMC$W{$<ib
z*AXrlRq@sh{mg}Fi|Gz_m>?5zhR)E78s=>Yhr*QE@2}?4rk-P5y}YDe=>l1Zxa}(%
zG>^oj83@MdpYql|)O1o=csXez36Li?iS;RpOSuyKcKD*R&1*Bet!Gx#r6w!&X-NXE
zMt^B5UYMn&!<+Te8GmJwg%ijp(|TJA*?_rM83i}gCv+&y2F`6rSXln^*pa~iqR&60
z6tv<>0E=EURhn)%YC6&{-KAB-r%LnZDbD+`OdFUbXE(^For4Z}@}Ee*VmO?;_0HG;
z*d!I)I!co%$a1Xm%IW*h+D|=aE)oqt#(D15ju;CJj?!ml01f8EN{hzCE&m5-`P0mo
zVG98ila8wtw`7|F?NXCi%oVq0?gEB012Qo-m+>(JN+vfkFflVVIW;v}DGD!5Z)8Ma
zbY&nYL^?7sGBz+bF)%SRH90jkmtiskjsr0_HJ9%p0~;DRG72w7X>xOPAU88P3NK7$
zZfA68ATu*HG?T#xD1Yr+TT>f37Jlbf=rPn*TCKZOl}Z(tFhhl87%r1!vUxD30dI`W
zxa}F3U%%gxWV_wQObB@QB~?MK>$!f?Icj%=60BrGNhXBBQ!%Nit(npmPs6kocv@y0
zwH>p8+MfB6+JOa$w#J%L*$tru5uzSYloo|nv<!vT`14eNk$(v&h=U_C+A-mUqj4sJ
zM4<zdC8!HiGKpe?h)PMa7zr62C>sc?Jt!N^qzRyG43n-T@|H<2K-oAZg9K&cnJOVR
zI5S1$g)Nzq7L-9$DF@0BS7{H*RxxErPYXM^l6nkNUVxXiOa%#E)-fF=#7Z4iwjLD^
zUa*vw-fsx!$bWp8>@Z{{=(xa4X-VCZ8R$%Uqe9jIV`D4`LM2N}1&n234pa=Yp2Prk
z2Ob;32j(1P5s=aahvh*rugM6Y<(;F7W1)nRM1Yr6Nfs3>82A^aWmp9Jk+DhzOMzW!
zrGv~^P&z0DTa`YLiwGQ~Dk&gHU@|B$18ZX#-XnjbLVv1CEEkUOKq3fF4o5?lplzsv
zDuX^kN}5gHmr9UGj%u)>EWuf7N7BI>(!dll(r|#K6ksL;JPArb7I{XJW8lJagJ=T0
zmgW(hwKp5DUTyG`yPJyft-)Y8-r&cRvvF)6^afuy`1WvgUX9r25*wlXvcZq4?wEa+
z))fly2Y=FvK$<#H1b|xkve4RL-WGfHit%H{e;S?)8Q*0u<R*LldISHylcjToaeB_u
z%Ysnx5KH?+mfjTv>lw@7ic*FLS&FBsIaSNbg8VPNEgbNyY$$@epQm{u%ODGlb85zN
zs^$YM!!xloqHwCg(uBg4>(x?=0`Q%))S)QVdVg7}vcNGkXQ_N)tY0fjSr$q*SV~`%
z;eM9-nOK&g@TS31xWdY{urwfzID=y!n+3;?kyHm-g<6MEXY6pw8JpR;fD>@N>}**C
zpV?VoASA7oox!PAW_HFGh;?garvMk3*=d~ZL9G=kG8A$O6$ONf^|BMbuv4f=TWGaj
zc7G+d_Y^9^U>~lPoxv72Q>c`tkn4qtK@1ETD#&CD8{}HqIa{a<72|awgj}mJttniF
zigBtiYQ5SSQ^d5I*dgKvvtI2q{8eUlMi$7W*2+$41fR?fk=}*%vXcs#U}mR~SgaW;
zLKfa;c8KtH%}^<k5Kf^Y%Az!DWv2uDm4Bh4Ln!omp@PdXwzf{}JVgg_e@6dQb`lA^
zVYmk(A|!6k7itAko_c?nX@}$??*on8LHPCPmYE4%C|oroHz^QY@6V^z^RQF6ed-Jp
z<#3#>0LpW*GZvXjW@j}rmG!X0ZZjHpYV0(DYZ&f91--?2D36xUgUuOB((nOxi+|wU
zWuJu&Ab7<1$4|erP%<Y=HkkDLU#4^RhJ$e=vu6zRY3?2p6_=|rzCg*{j9#y#x)Sjf
z2{k~8AC89I;|dZpez?2G_(^p;W|7HfBMEmu{+{snW#hB-rkFi(Czb`hdZ4-yst8Xi
z6P;%1=yb=SYYLUi)Z-j3$^enWDt`wV&`&S-;+Vx)e6LFD<2-sRX>hL<aW&l{Xa&87
z%5>7YL^+j)RvWC#)YH6JiV}lzq02_%O*1Ul7mP$NJL#~<HCNDf(v8t<Uh0DYI=B5y
ztoh6|PWLg51Y0u&1zck!DUj;1{PI8F3gD=`FX(+3$}c~*;{Rvs8ssr5rhoM|mtIj%
zD(ST;z1)wZWx4d{adWgxBTLt@?WBymfL2jEAS%(j?g-4(EgNMd5gE;E%~=hAB=XI%
zhJg2pw(3tVNs*``Uo2!UQ;##?2nE$tElXNhkIb1_Ly9@v?_8XxtSF`%Fs-&QaS%3-
z=f1c$Q&*N&M3ZOwG>_inmw$4`9)DI4>A9lqTEhg9SoTJv-tb@SUGS=$)5xwci?h=V
zMd>xlNH000F`5)e^;AaAz?UfJwtq6*$Q(bw_5*D9f-NH~D2H&EN?em-KB6f2S*oup
zy$)0-Ih=+Cd|c_>bR4Mi^bnwx`lqxh*D<)}CXQ)#s?TTX*w&314Sx!=+QSllOPMJ)
zB#Rm-L6(jswUe%t)A*^LHs&+RQ)*CB;^6@{njOfmB18?nryR=S$`t4aO-E*m6Fkfh
zBw8O0Np-IRMhTV9Q;y+r@v)h)px=U1HI>%SeMNkl)@W*Ew52T}lb_;K5QdumrQQXv
z2P#uf@=9Dco14Zp{eN%-6e+^ed{!Jw7E1M863*sVCc32TR&{sOyBQBh>C*DPbB&Sh
zz0>#mNB`P+xBXE_4D>sfHPdOv_V)0WeSV1>+Dl14aMREI*no6#s=F1gJvLzGPUq(5
zs&{#Xrnk5=RcY*{puzodr{C*t4KDi?D{*HVSJ%J6F=2y$%zulpFF@m}Gosti3%<p-
z`3`@>_xMkIpTFaW{D>d(6Mo8n;~#j3pYbm54*SCa%IoV6Kj#&Xg!l!&xajeV-k%k}
z7*0m~l3(#2@AGRu;6pwfRQ!hDRHNSToc}SY>TwS=M!e>A^=CEUb?=ss`S@y7Reb!{
zkWcuZ{FdMGzkfHAE%tiQKzK_Rw#Dn{YTF+Ex_@x;Gi>{AKiqFx8OXGB!U6LSn^rw!
z+LuC4jq7y7wn{W@o3vk4$UjD*k4L9RZ?~Y(ktpw1NS9NE%J3A0W>~Rdr8)^JyBRD$
z11@j*0U-09|I&iZNB#-W>C|Hwp#BOBosBx(uhqC;U4M+H^-%=TDsWYU^G<!mt3M{4
zeneUZTgF>|4!Ntln=9a{$N$5>X7mku0N)IPol!N2jAJdao#GP69FD8=vwoZ~ZKOG|
zHSbTI3BcFAB=sE1b)Up-1NyH7Y5sRL8ZN*fl#hYI$?qRej*kfjD`2f=uvYe2Q1Ae#
z2?cxb{eK}m+|7Qg$VH8VfR2Hd8=~Rv+4Facc9D;<%g(R6??2G?I6hdlKM+=uWrS2u
z+VEj!nuj+?GE4*d-3GRsKqf1FogJ6SK;sq1V9<{-%hA#C?)Gss%gM<q!$>+fRQ&P@
zrmzjW2(e%nYR>E;rCeo~2M&%DMUnxg;ApBm8GoEtqq;jBRr5WwsQ;tFz~0`c0o(>7
z`L`c;N&n-Oun-9rA<(HAR-=NN-?Cr)$^d)c`Ln3pqe8;guP1vur=;Acm9E8U5G-My
zzB6-Xt{pbO_XRm!u5|9%1cxUM^4_T1ue!sVyU~JrvV7E0xASKA{oy{;Ta8?ufNRu~
zfV-A}ca49zQg;UD3!x9uE=30leAO%j=793ek@0-k?{`M?02w1=b=&QCu3M+?<*4d_
zeKR)FLDR45dLAAJlj}1G+q)e6W27VtP9x?`e^Srl<O6|mMM%7Fr!PfESw1QXygk@G
z{O~41W<_|k88KSI+y2Rjc_28ZOnM(E`6c4xv>ks77SiW=*8H`VH{TyE7p%8*O3HFY
zlxX~PL!A(KyHi*3ca){;$byyQ_pd~f@AXFYnABu+CLDC84YJXP-ud{djvvj&xhKQZ
z0bp>BqwVqXv{LxCIH4_$@eOgPF_p%-$1`uG+b!lnEZIUV*g`dIp`XDPi)mk58r7CY
zFM5AQG;HCYL7H~5)t1NngLRrnk<TE{a+cGUXbHQ)tdhuuwnXaj61DS=wmeJVrKmcS
zM>ibi%V#i9J5yK`hrUg3J4`jrV;bUohcViLyv=<HzG{KHY_b>6;G9;JXp6IiUM*K*
z#eRc0hn>r+Mr0UHD9&u4J))>WA4A8*Z+m~|HTxX7f_i$SAG1|zsW=g+pvRZ*A+8ez
zljxcB`?yU%hr2R8>~~X7PGKoPuyk)@Y0J_3<Md3w<v&DU_$fh=L^A1-g2`+pMS9Gk
zuS;Z_@IsWEEFEm9qd$Q(eNm9&1nO#&rMnaA8ucs>Kj>Ze#+e|EEHg5jP-D8(ZpMHA
zb`l#PuW~=At1JPC>ns3PYQMw>y%<^I1Ii{-bEsyy{U);s8}wOx{+!{()@anZtN&f<
z62Kb{V(ks`xEiywQFi*ndNQiw$Su;*eg&mXTNp6CZ|0J4J45Qfg#=l(+(C=TmkVt2
zw-qn;k)+&`@!YgM9u3bYU3&iq?`3~0zN@Z>qr0d}4Ls2Ntnj;DUH1l;G_;327Bbc}
zYTHW8gu8dek}mHi{c#TqXx7&DK4{8p?86a}ME*Qg3u8Jfb5u?0&RJTu)9Lr=dD!m^
zFvaI7$Gz)Jc4i6{rbB<n0o({8+di`GYwRUBIxBlT9>Fq6N4*5jWtp1`mQ;T{xr#G!
z=JmRyU*?g!8xG$(+}~uOoDSo<5am1WTvX#bGWK++?PKfa1K^<Yywj=q`@OS^iym0(
zwkj>zmX^$vNr!>V=%N3cl%C0?GM^Ikzmn2Z-nXMyQpcH(N%a4hmQL)Q4s!kB<wiQ6
z=Eq&KF8xQR*rd^Sbm;Tby81F@GVbFtRma|g&RNy3<EKgQu_@`xD5@XATrW4{S5Ld_
z^=p~GfTH>r{4tW^zX$&Vd6z*G0u%u^mlHGtAq_D&T?#K#X?kTKGBG%pK{NvsY%w(;
zFd$M2FG+4@Zy+);HXtw{QVK6gL?Bx{GDSEyI72}&F*HOtMnf|-IYBr!IWj>sFf&F%
zH#IghJ|H|YML0J&LqRYxG(<Q?Lo+owK{z%!GC?#jGe$x;H8wLoT?#KuWo~D5XdpE+
zG?PJEDSsu>OK;3!6vy#%9<BPL7uBMwrd5NsF4In@7rjw6sL^WGt*Bel#FiByVS}}$
zg&hf-UnF*7!3(gl;stmGmXez9vH9dY|1+6s|IgRVY|YIY%`LsJQafkKEOV$H>ppPQ
z7)-dm`W(lTY}Y|@%bMfaG{;(~gUwLm)=-G=+kXHVpPPac95=!yj>q8`$MrA-+n^EZ
z-P%{<TN+?1G`aN@<JlHyh8@u2*8e0Ht*{+-L7Q7?J{CKnou4c-bwY>R*uB{9h8*mL
zF1PZdSnPpr*ay9kcdLAl?E%;iJ#Y{T(C4=JD?V}v4#N>BLciN`Z)^wPD2%|M+e&LJ
zN`ElSpL>dF0!H0d$79RQWaGd~%qHC)Jd6eJIg581w>9nd_<1bi-Os>TD7!t&#Uj4`
zG@OB1I0thu59eV47U2Rc!9}<Pm*EOrg=M$~*Wm`Nz)iRXx8V-l<-d%Y=uZjAOf^7U
zA`nrSNJ^0uAt^$lI@JTIh<wxpR3a)7`G2Sd2t;HiDiQgp4G2UL2<4~)$U<ZxdQlfp
zgeXF!qR67+_A)Y49wve7(Tt~e-(o=}q8E{h2uXcFG@=qwiKs*cx7QJ-s;T^(jcLH`
z&(oNS?n@tI8gzg0CZ>}6mme_=x&Qtf)3B%X|JjJATz5>Pp6=&kqB?Q$;^M`{ix@Uk
s0TK`ihy+9eTJZGtt9klVv470gdrg->Hv=3EF*i3dGB^q)B}Gq03T2czbpQYW

diff --git a/deps/libffi/doc/libffi.texi b/deps/libffi/doc/libffi.texi
index 251214f890d3..4d2802c5bd97 100644
--- a/deps/libffi/doc/libffi.texi
+++ b/deps/libffi/doc/libffi.texi
@@ -320,6 +320,7 @@ int main()
 * Type Example::                Structure type example.
 * Complex::                     Complex types.
 * Complex Type Example::        Complex type example.
+* Vector Types::                Vector (SIMD) types.
 @end menu
 
 @node Primitive Types
@@ -802,6 +803,93 @@ FFI_COMPLEX_TYPEDEF(uchar, unsigned char, ffi_type_uint8);
 The new type descriptors can then be used like one of the built-in
 type descriptors in the previous example.
 
+@node Vector Types
+@subsection Vector Types
+
+@code{libffi} can marshal vector (SIMD) types --- the values produced
+by GCC's @code{__attribute__((vector_size (N)))} and Clang's
+@code{ext_vector_type} --- on the platforms listed in the support table
+below.  A vector is described just like a structure, except that every
+element pointer refers to the @emph{same} fundamental scalar type and the
+number of elements is the number of vector lanes.
+
+@tindex ffi_type
+@deftp {Data type} ffi_type
+@table @code
+@item size_t size
+This must be set to @code{0}.  @code{libffi} computes the storage size
+(see below) from the element type and lane count.
+
+@item unsigned short alignment
+This must be set to @code{0}.  @code{libffi} computes the alignment.
+
+@item unsigned short type
+For a vector type, this must be set to @code{FFI_TYPE_VECTOR}.
+
+@item ffi_type **elements
+This is a @samp{NULL}-terminated array of pointers to @code{ffi_type}
+objects.  Every entry must point to the same scalar element type, and the
+number of entries is the vector's lane count @math{N} (@math{N >= 1}).  The
+element type must be one of @code{ffi_type_float}, @code{ffi_type_double},
+or a fixed-width integer (@code{ffi_type_uint8} through
+@code{ffi_type_sint64}); @code{long double} and aggregate element types are
+not permitted.
+@end table
+@end deftp
+
+@subsubheading Computed layout
+
+Because the caller leaves @code{size} and @code{alignment} at @code{0},
+@code{libffi} derives them so that applications need not encode
+compiler- or platform-specific rules:
+
+@itemize @bullet
+@item
+@code{size} is @math{lane\_size \times N} rounded @emph{up} to the next
+power of two.  This matches Clang's @code{ext_vector_type} storage --- for
+example a three-lane @code{float} vector occupies 16 bytes and a three-lane
+@code{double} vector occupies 32 bytes.  GCC's @code{vector_size} already
+requires power-of-two byte totals, so the rule is identical there.
+
+@item
+@code{alignment} is @code{min(size, 16)}.
+@end itemize
+
+If the element list is heterogeneous, empty, or uses a disallowed element
+type, @code{ffi_prep_cif} returns @code{FFI_BAD_TYPEDEF}.
+
+@subsubheading psABI framing
+
+At the call boundary the platform's processor-specific ABI (AAPCS64 on
+AArch64, the System V x86-64 psABI on x86-64) decides how a vector is
+passed and returned, independently of which compiler produced it.  The
+historical divergence between GCC's @code{vector_size} and Clang's
+@code{ext_vector_type} concerns only in-memory @emph{layout} (notably the
+padding of odd-lane vectors such as @code{float3}); the power-of-two size
+rule above pins that layout down, so a value marshalled by @code{libffi}
+matches what a natively compiled caller or callee expects.
+
+@subsubheading Per-port support
+
+@multitable @columnfractions .28 .72
+@headitem Port @tab Vector support
+@item AArch64 (AAPCS64)
+@tab 8- and 16-byte vectors in a single V/Q register; homogeneous vector
+aggregates (structs of up to four identical 8- or 16-byte vectors) in
+consecutive V/Q registers.  A bare vector larger than 16 bytes (for
+example a 32-byte @code{double4}) has no short-vector register class and is
+passed and returned in memory, exactly as AAPCS64 and current compilers do.
+@item x86-64 (System V psABI)
+@tab 8- and 16-byte vectors in an SSE register (@code{%xmm0} for returns).
+A bare vector larger than 16 bytes needs @code{%ymm}/@code{%zmm} register
+handling that this port does not yet implement, so @code{ffi_prep_cif}
+returns @code{FFI_BAD_TYPEDEF} for it.
+@item Other ports
+@tab Not supported: @code{ffi_prep_cif} returns @code{FFI_BAD_TYPEDEF} for
+any signature that mentions a vector type, including one nested inside a
+struct.
+@end multitable
+
 @node Multiple ABIs
 @section Multiple ABIs
 
@@ -853,6 +941,16 @@ Releases a plan returned by @code{ffi_call_plan_alloc}.  Passing
 not affected.
 @end defun
 
+@findex ffi_call_plan_size
+@defun size_t ffi_call_plan_size (ffi_call_plan *@var{plan})
+Returns the total number of bytes @code{libffi} allocated for @var{plan},
+including any internal argument-placement data it owns.  Returns zero when
+@var{plan} is @code{NULL}.  The result does not include the
+@code{ffi_cif}, which the caller owns.  This is intended for embedders that
+account for the memory held by long-lived plans and would otherwise have to
+guess at the size of an opaque type.
+@end defun
+
 @node The Closure API
 @section The Closure API
 
diff --git a/deps/libffi/doc/stamp-vti b/deps/libffi/doc/stamp-vti
index e755454e9c82..dc281e38e0f6 100644
--- a/deps/libffi/doc/stamp-vti
+++ b/deps/libffi/doc/stamp-vti
@@ -1,4 +1,4 @@
-@set UPDATED 10 July 2026
-@set UPDATED-MONTH July 2026
-@set EDITION 3.7.1
-@set VERSION 3.7.1
+@set UPDATED 8 August 2026
+@set UPDATED-MONTH August 2026
+@set EDITION 3.8.0
+@set VERSION 3.8.0
diff --git a/deps/libffi/doc/version.texi b/deps/libffi/doc/version.texi
index e755454e9c82..dc281e38e0f6 100644
--- a/deps/libffi/doc/version.texi
+++ b/deps/libffi/doc/version.texi
@@ -1,4 +1,4 @@
-@set UPDATED 10 July 2026
-@set UPDATED-MONTH July 2026
-@set EDITION 3.7.1
-@set VERSION 3.7.1
+@set UPDATED 8 August 2026
+@set UPDATED-MONTH August 2026
+@set EDITION 3.8.0
+@set VERSION 3.8.0
diff --git a/deps/libffi/generate-headers.py b/deps/libffi/generate-headers.py
index e2d2942deffb..fb58edf17b66 100644
--- a/deps/libffi/generate-headers.py
+++ b/deps/libffi/generate-headers.py
@@ -7,8 +7,8 @@
 from pathlib import Path
 
 
-LIBFFI_VERSION = '3.7.1'
-LIBFFI_VERSION_NUMBER = '30701'
+LIBFFI_VERSION = '3.8.0'
+LIBFFI_VERSION_NUMBER = '30800'
 
 def normalize_arch(target_arch):
     aliases = {
diff --git a/deps/libffi/include/ffi.h.in b/deps/libffi/include/ffi.h.in
index 35f09cf43315..cb0a7dbcaaa3 100644
--- a/deps/libffi/include/ffi.h.in
+++ b/deps/libffi/include/ffi.h.in
@@ -79,9 +79,10 @@ extern "C" {
 #define FFI_TYPE_COMPLEX    15
 #define FFI_TYPE_UINT128    16
 #define FFI_TYPE_SINT128    17
+#define FFI_TYPE_VECTOR     18
 
 /* This should always refer to the last type code (for sanity checks).  */
-#define FFI_TYPE_LAST       FFI_TYPE_SINT128
+#define FFI_TYPE_LAST       FFI_TYPE_VECTOR
 
 #include <ffitarget.h>
 
@@ -535,7 +536,11 @@ void ffi_call(ffi_cif *cif,
    ffi_call_plan_alloc returns NULL only on allocation failure; a signature
    with no fast path is still valid and ffi_call_plan_invoke falls back to
    ffi_call for it.  A plan is immutable once built, so it may be shared and
-   invoked concurrently from multiple threads.  */
+   invoked concurrently from multiple threads.
+
+   ffi_call_plan_size reports the total number of bytes libffi allocated for a
+   plan, so that callers tracking the footprint of long-lived plans do not have
+   to guess at the size of an opaque type.  */
 typedef struct ffi_call_plan ffi_call_plan;
 
 FFI_API
@@ -550,6 +555,9 @@ void ffi_call_plan_invoke (ffi_call_plan *plan,
 FFI_API
 void ffi_call_plan_free (ffi_call_plan *plan);
 
+FFI_API
+size_t ffi_call_plan_size (ffi_call_plan *plan);
+
 FFI_API
 ffi_status ffi_get_struct_offsets (ffi_abi abi, ffi_type *struct_type,
 				   size_t *offsets);
diff --git a/deps/libffi/libffi.map.in b/deps/libffi/libffi.map.in
index f4e366eb60bc..6151f10cbdce 100644
--- a/deps/libffi/libffi.map.in
+++ b/deps/libffi/libffi.map.in
@@ -69,6 +69,15 @@ LIBFFI_CALL_PLAN_8.4 {
     ffi_call_plan_free;
 } LIBFFI_BASE_8.1;
 
+/* ----------------------------------------------------------------------
+   Call plan footprint query (ffi_call_plan_size).  A fresh node because
+   LIBFFI_CALL_PLAN_8.4 has already shipped.
+   -------------------------------------------------------------------- */
+LIBFFI_CALL_PLAN_8.5 {
+  global:
+    ffi_call_plan_size;
+} LIBFFI_CALL_PLAN_8.4;
+
 #ifdef FFI_TARGET_HAS_COMPLEX_TYPE
 LIBFFI_COMPLEX_8.0 {
   global:
diff --git a/deps/libffi/libtool-version b/deps/libffi/libtool-version
index c5545eab8bf6..814c6e21d925 100644
--- a/deps/libffi/libtool-version
+++ b/deps/libffi/libtool-version
@@ -26,4 +26,4 @@
 #    release, then set age to 0.
 #
 # CURRENT:REVISION:AGE
-12:1:4
+13:0:5
diff --git a/deps/libffi/src/aarch64/ffi.c b/deps/libffi/src/aarch64/ffi.c
index 2e6a2ad2624c..1eb90dd565ad 100644
--- a/deps/libffi/src/aarch64/ffi.c
+++ b/deps/libffi/src/aarch64/ffi.c
@@ -92,6 +92,19 @@ ffi_clear_cache (void *start, void *end)
 
 #endif
 
+/* Return the base-2 logarithm of N (N assumed to be a power of two).  Used
+   to map a vector register width (8 or 16 bytes) onto the D-/Q-register
+   AARCH64_RET_* encoding.  */
+
+static int
+intlog2 (int n)
+{
+  int level = 0;
+  while (n >>= 1)
+    ++level;
+  return level;
+}
+
 /* A subroutine of is_vfp_type.  Given a structure type, return the type code
    of the first non-structure element.  Recurse for structure elements.
    Return -1 if the structure is in fact empty, i.e. no nested elements.  */
@@ -106,7 +119,8 @@ is_hfa0 (const ffi_type *ty)
     for (i = 0; elements[i]; ++i)
       {
         ret = elements[i]->type;
-        if (ret == FFI_TYPE_STRUCT || ret == FFI_TYPE_COMPLEX)
+        if (ret == FFI_TYPE_STRUCT || ret == FFI_TYPE_VECTOR
+	    || ret == FFI_TYPE_COMPLEX)
           {
             ret = is_hfa0 (elements[i]);
             if (ret < 0)
@@ -118,6 +132,33 @@ is_hfa0 (const ffi_type *ty)
   return ret;
 }
 
+/* A subroutine of is_vfp_type.  Return the size in bytes of the vector (SIMD)
+   member of TY, i.e. the width of a single Neon register slot, or 0 if TY
+   neither is nor contains a vector.  For a bare vector this is its whole size;
+   for a homogeneous vector aggregate it is the size of one lane vector.  */
+
+static size_t
+is_simd (const ffi_type *ty)
+{
+  ffi_type **elements;
+  int i;
+
+  if (ty->type == FFI_TYPE_VECTOR)
+    return ty->size;
+
+  elements = ty->elements;
+  if (elements != NULL)
+    for (i = 0; elements[i]; ++i)
+      {
+        int t = elements[i]->type;
+        if (t == FFI_TYPE_STRUCT || t == FFI_TYPE_COMPLEX
+	    || t == FFI_TYPE_VECTOR)
+          return is_simd (elements[i]);
+      }
+
+  return 0;
+}
+
 /* A subroutine of is_vfp_type.  Given a structure type, return true if all
    of the non-structure elements are the same as CANDIDATE.  */
 
@@ -131,7 +172,8 @@ is_hfa1 (const ffi_type *ty, int candidate)
     for (i = 0; elements[i]; ++i)
       {
         int t = elements[i]->type;
-        if (t == FFI_TYPE_STRUCT || t == FFI_TYPE_COMPLEX)
+        if (t == FFI_TYPE_STRUCT || t == FFI_TYPE_VECTOR
+	    || t == FFI_TYPE_COMPLEX)
           {
             if (!is_hfa1 (elements[i], candidate))
               return 0;
@@ -156,7 +198,7 @@ is_vfp_type (const ffi_type *ty)
 {
   ffi_type **elements;
   int candidate, i;
-  size_t size, ele_count;
+  size_t size, ele_count, simd_size;
 
   /* Quickest tests first.  */
   candidate = ty->type;
@@ -181,18 +223,24 @@ is_vfp_type (const ffi_type *ty)
 	}
       return 0;
     case FFI_TYPE_STRUCT:
+    case FFI_TYPE_VECTOR:
       break;
     }
 
-  /* No HFA types are smaller than 4 bytes, or larger than 64 bytes.  */
+  /* No HFA/HVA types are smaller than 4 bytes, or larger than 64 bytes.  */
   size = ty->size;
   if (size < 4 || size > 64)
     return 0;
 
-  /* Find the type of the first non-structure member.  */
+  /* Determine the width of the vector (SIMD) member, if any: 0 for a plain
+     floating-point HFA, else the size in bytes of one Neon register slot.  */
+  simd_size = is_simd (ty);
+
+  /* Find the type of the first non-aggregate member.  */
   elements = ty->elements;
   candidate = elements[0]->type;
-  if (candidate == FFI_TYPE_STRUCT || candidate == FFI_TYPE_COMPLEX)
+  if (candidate == FFI_TYPE_STRUCT || candidate == FFI_TYPE_VECTOR
+      || candidate == FFI_TYPE_COMPLEX)
     {
       for (i = 0; ; ++i)
         {
@@ -202,6 +250,63 @@ is_vfp_type (const ffi_type *ty)
         }
     }
 
+  if (simd_size)
+    {
+      /* Vector or homogeneous vector aggregate (HVA).  A single Neon slot is
+	 at most 16 bytes (a Q register).  A bare vector wider than 16 bytes
+	 (e.g. a 32-byte double4) has no short-vector register class under
+	 AAPCS64, so bail and let the generic composite path pass it by
+	 reference / return it in memory -- matching what current compilers do.
+	 The scalar lane type does not affect register selection (an integer
+	 and a floating-point 16-byte vector both occupy one Q register), so,
+	 unlike the floating-point HFA path below, CANDIDATE is used only to
+	 confirm the lanes are homogeneous.  */
+      size_t reg_size = simd_size;
+      int num_registers;
+      int first_level_element_type;
+
+      /* A Neon register slot is an S (4B), D (8B) or Q (16B).  A lane narrower
+	 than 4 bytes has no short-vector register class under AAPCS64 and would
+	 map below AARCH64_RET_S4, making extend_hfa_type() branch before its
+	 jump table; reject it and let the generic aggregate path handle it.  */
+      if (reg_size < 4 || reg_size > 16 || size % reg_size != 0)
+	return 0;
+      num_registers = (int) (size / reg_size);
+      if (num_registers > 4)
+	return 0;
+
+      /* For an aggregate, every member must itself be a vector (or nested
+	 vector aggregate) of the same register width: this rejects a struct
+	 that mixes a bare scalar with a vector even when the scalar's type
+	 matches the vector's lane type.  A bare vector needs no such check --
+	 its lanes were validated when its layout was computed.  */
+      if (ty->type != FFI_TYPE_VECTOR)
+	for (i = 0; elements[i]; ++i)
+	  if (is_simd (elements[i]) != reg_size)
+	    return 0;
+
+      /* Every lane must be the identical scalar type across the whole HVA
+	 (this rejects, e.g., an aggregate mixing float and integer vectors).  */
+      for (i = 0; elements[i]; ++i)
+	{
+	  int t = elements[i]->type;
+	  if (t == FFI_TYPE_STRUCT || t == FFI_TYPE_VECTOR
+	      || t == FFI_TYPE_COMPLEX)
+	    {
+	      if (!is_hfa1 (elements[i], candidate))
+		return 0;
+	    }
+	  else if (t != candidate)
+	    return 0;
+	}
+
+      /* Reuse the AARCH64_RET_{S,D,Q}* codes, which are laid out as
+	 (type * 4) + (4 - count) with FLOAT->S(4B), DOUBLE->D(8B),
+	 LONGDOUBLE->Q(16B).  Map the register width onto that type axis.  */
+      first_level_element_type = FFI_TYPE_FLOAT + intlog2 ((int) reg_size) - 2;
+      return first_level_element_type * 4 + (4 - num_registers);
+    }
+
   /* If the first member is not a floating point type, it's not an HFA.
      Also quickly re-check the size of the structure.  */
   switch (candidate)
@@ -614,6 +719,7 @@ ffi_prep_cif_machdep (ffi_cif *cif)
     case FFI_TYPE_DOUBLE:
     case FFI_TYPE_LONGDOUBLE:
     case FFI_TYPE_STRUCT:
+    case FFI_TYPE_VECTOR:
     case FFI_TYPE_COMPLEX:
       flags = is_vfp_type (rtype);
       if (flags == 0)
@@ -802,6 +908,7 @@ ffi_call_int (ffi_cif *cif, void (*fn)(void), void *orig_rvalue,
 	case FFI_TYPE_DOUBLE:
 	case FFI_TYPE_LONGDOUBLE:
 	case FFI_TYPE_STRUCT:
+	case FFI_TYPE_VECTOR:
 	case FFI_TYPE_COMPLEX:
 	  {
 	    h = is_vfp_type (ty);
@@ -1089,6 +1196,7 @@ ffi_closure_SYSV_inner (ffi_cif *cif,
 	case FFI_TYPE_DOUBLE:
 	case FFI_TYPE_LONGDOUBLE:
 	case FFI_TYPE_STRUCT:
+	case FFI_TYPE_VECTOR:
 	case FFI_TYPE_COMPLEX:
 	  h = is_vfp_type (ty);
 	  if (h)
diff --git a/deps/libffi/src/aarch64/ffitarget.h b/deps/libffi/src/aarch64/ffitarget.h
index 46e2687ae7fe..8ba86799e113 100644
--- a/deps/libffi/src/aarch64/ffitarget.h
+++ b/deps/libffi/src/aarch64/ffitarget.h
@@ -94,6 +94,10 @@ typedef enum ffi_abi
 #define FFI_TARGET_HAS_COMPLEX_TYPE
 #endif
 
+/* AAPCS64 passes 8- and 16-byte vectors in V/Q registers and homogeneous
+   vector aggregates in consecutive V/Q registers; see is_vfp_type.  */
+#define FFI_TARGET_HAS_VECTOR_TYPE
+
 #define FFI_TARGET_HAS_INT128 1
 
 #endif
diff --git a/deps/libffi/src/debug.c b/deps/libffi/src/debug.c
index 63321dc013cc..cf847f3b1107 100644
--- a/deps/libffi/src/debug.c
+++ b/deps/libffi/src/debug.c
@@ -54,7 +54,8 @@ void ffi_type_test(ffi_type *a, const char *file, int line)
   FFI_ASSERT_AT(a->type <= FFI_TYPE_LAST, file, line);
   FFI_ASSERT_AT(a->type == FFI_TYPE_VOID || a->size > 0, file, line);
   FFI_ASSERT_AT(a->type == FFI_TYPE_VOID || a->alignment > 0, file, line);
-  FFI_ASSERT_AT((a->type != FFI_TYPE_STRUCT && a->type != FFI_TYPE_COMPLEX)
+  FFI_ASSERT_AT((a->type != FFI_TYPE_STRUCT && a->type != FFI_TYPE_COMPLEX
+		 && a->type != FFI_TYPE_VECTOR)
 		|| a->elements != NULL, file, line);
   FFI_ASSERT_AT(a->type != FFI_TYPE_COMPLEX
 		|| (a->elements != NULL
diff --git a/deps/libffi/src/ia64/ia64_flags.h b/deps/libffi/src/ia64/ia64_flags.h
index 9d652cef14ce..bfe102c7d86f 100644
--- a/deps/libffi/src/ia64/ia64_flags.h
+++ b/deps/libffi/src/ia64/ia64_flags.h
@@ -38,3 +38,14 @@
 #define FFI_IA64_TYPE_HFA_FLOAT		(FFI_TYPE_LAST + 2)
 #define FFI_IA64_TYPE_HFA_DOUBLE	(FFI_TYPE_LAST + 3)
 #define FFI_IA64_TYPE_HFA_LDOUBLE	(FFI_TYPE_LAST + 4)
+
+/* Tripwire: the .Lst_table / .Lld_table return-value jump tables in unix.S place
+   the FFI_IA64_TYPE_* pseudo-types (which are FFI_TYPE_LAST-relative) immediately
+   after the generic FFI_TYPE_* codes.  Adding a new generic type bumps
+   FFI_TYPE_LAST, shifts those codes, and desyncs the tables -- silently
+   misdispatching small-struct/HFA returns.  When this fires: add a matching slot
+   for the new type to both tables in unix.S, then bump FFI_IA64_TYPE_LAST.  */
+#define FFI_IA64_TYPE_LAST FFI_TYPE_VECTOR
+#if FFI_TYPE_LAST != FFI_IA64_TYPE_LAST
+# error "new FFI_TYPE_* added: sync the unix.S jump tables and bump FFI_IA64_TYPE_LAST"
+#endif
diff --git a/deps/libffi/src/ia64/unix.S b/deps/libffi/src/ia64/unix.S
index 04908368c3e2..b8e347169e2e 100644
--- a/deps/libffi/src/ia64/unix.S
+++ b/deps/libffi/src/ia64/unix.S
@@ -553,6 +553,9 @@ ffi_closure_unix:
 	data8	@pcrel(.Lst_void)		// FFI_TYPE_STRUCT
 	data8	@pcrel(.Lst_int64)		// FFI_TYPE_POINTER
 	data8	@pcrel(.Lst_void)		// FFI_TYPE_COMPLEX (not implemented)
+	data8	@pcrel(.Lst_void)		// FFI_TYPE_UINT128 (not implemented)
+	data8	@pcrel(.Lst_void)		// FFI_TYPE_SINT128 (not implemented)
+	data8	@pcrel(.Lst_void)		// FFI_TYPE_VECTOR  (rejected in ffi_prep_cif_core)
 	data8 	@pcrel(.Lst_small_struct)	// FFI_IA64_TYPE_SMALL_STRUCT
 	data8	@pcrel(.Lst_hfa_float)		// FFI_IA64_TYPE_HFA_FLOAT
 	data8	@pcrel(.Lst_hfa_double)		// FFI_IA64_TYPE_HFA_DOUBLE
@@ -575,6 +578,9 @@ ffi_closure_unix:
 	data8	@pcrel(.Lld_void)		// FFI_TYPE_STRUCT
 	data8	@pcrel(.Lld_int)		// FFI_TYPE_POINTER
 	data8	@pcrel(.Lld_void)		// FFI_TYPE_COMPLEX (not implemented)
+	data8	@pcrel(.Lld_void)		// FFI_TYPE_UINT128 (not implemented)
+	data8	@pcrel(.Lld_void)		// FFI_TYPE_SINT128 (not implemented)
+	data8	@pcrel(.Lld_void)		// FFI_TYPE_VECTOR  (rejected in ffi_prep_cif_core)
 	data8 	@pcrel(.Lld_small_struct)	// FFI_IA64_TYPE_SMALL_STRUCT
 	data8	@pcrel(.Lld_hfa_float)		// FFI_IA64_TYPE_HFA_FLOAT
 	data8	@pcrel(.Lld_hfa_double)		// FFI_IA64_TYPE_HFA_DOUBLE
diff --git a/deps/libffi/src/java_raw_api.c b/deps/libffi/src/java_raw_api.c
index 114d3e47fcde..e0a02ef27432 100644
--- a/deps/libffi/src/java_raw_api.c
+++ b/deps/libffi/src/java_raw_api.c
@@ -58,7 +58,8 @@ ffi_java_raw_size (ffi_cif *cif)
 	  result += 2 * FFI_SIZEOF_JAVA_RAW;
 	  break;
 	case FFI_TYPE_STRUCT:
-	  /* No structure parameters in Java.	*/
+	case FFI_TYPE_VECTOR:
+	  /* No structure or vector parameters in Java.	*/
 	  abort();
 	case FFI_TYPE_COMPLEX:
 	  /* Not supported yet.  */
diff --git a/deps/libffi/src/pa/ffitarget.h b/deps/libffi/src/pa/ffitarget.h
index f6f09975cfac..aeaacc167ef2 100644
--- a/deps/libffi/src/pa/ffitarget.h
+++ b/deps/libffi/src/pa/ffitarget.h
@@ -89,8 +89,13 @@ typedef enum ffi_abi {
    to the default case and is mapped to FFI_TYPE_INT, so cif->flags never
    exceeds FFI_TYPE_COMPLEX and the existing tables remain sufficient.  Bump
    FFI_PA_TYPE_LAST to the current FFI_TYPE_LAST once you have confirmed any
-   newly added generic type is likewise handled (or the tables extended).  */
-#define FFI_PA_TYPE_LAST FFI_TYPE_SINT128
+   newly added generic type is likewise handled (or the tables extended).
+
+   FFI_TYPE_VECTOR (18) is likewise not reached here: PA does not define
+   FFI_TARGET_HAS_VECTOR_TYPE, so ffi_prep_cif_core rejects any vector
+   signature with FFI_BAD_TYPEDEF before machdep runs.  Bumping the tripwire
+   past it is therefore safe.  */
+#define FFI_PA_TYPE_LAST FFI_TYPE_VECTOR
 
 /* Tripwire: when a new generic type is added FFI_TYPE_LAST changes and this
    fires, forcing a review of ffi_prep_cif_machdep and the linux.S / hpux32.S
diff --git a/deps/libffi/src/powerpc/darwin_closure.S b/deps/libffi/src/powerpc/darwin_closure.S
index 3121e6ac26d3..08cbe4bc1389 100644
--- a/deps/libffi/src/powerpc/darwin_closure.S
+++ b/deps/libffi/src/powerpc/darwin_closure.S
@@ -186,19 +186,17 @@ LCFI1:
 	/* Make the call.  */
 	bl	BLCLS_HELP
 
-	/* r3 contains the rtype pointer... save it since we will need
-	   it later.  */
-	sg	r3,LINKAGE_SIZE(r1)	; ffi_type * result_type
-	lg	r0,0(r3)		; size => r0
-	lhz	r3,FFI_TYPE_TYPE(r3)	; type => r3
-
-	/* The helper will have intercepted structure returns and inserted
-	   the caller`s destination address for structs returned by ref.  */
-
-	/* r3 contains the return type  so use it to look up in a table
-	   so we know how to deal with each type.  */
-
-	addi	r5,r1,(SAVE_SIZE-RESULT_BYTES) /* Otherwise, our return is here.  */
+	/* r3 now holds a small PPC_LD_* jump-table index (see the PPC_LD_*
+	   defines in ffi_darwin.c), not an ffi_type* as this file previously
+	   assumed: ffi_closure_helper_common cannot return both an ffi_type*
+	   and the dispatch index through r3, so it returns the index.  The
+	   helper has already intercepted by-reference struct returns (writing
+	   the result to the caller`s buffer and returning PPC_LD_NONE); for a
+	   by-value struct return it returns PPC_LD_STRUCT and stashes cif->rtype
+	   in the first parameter-save slot, which the PPC_LD_STRUCT fragment
+	   below recovers.  */
+
+	addi	r5,r1,(SAVE_SIZE-RESULT_BYTES) /* Our return value is here.  */
 	bl	Lget_ret_type0_addr	/* Get pointer to Lret_type0 into LR.  */
 	mflr	r4			/* Move to r4.  */
 	slwi	r3,r3,4			/* Now multiply return type by 16.  */
@@ -218,43 +216,60 @@ LFE1:
 Lget_ret_type0_addr:
 	blrl
 
-/* case FFI_TYPE_VOID  */
+/* The fragments below are indexed by the PPC_LD_* return code that
+   ffi_closure_helper_common handed back in r3, so their order must match the
+   PPC_LD_* values in ffi_darwin.c.  Each is exactly 16 bytes (four
+   instructions), except the final PPC_LD_STRUCT fragment.  */
+
+/* case PPC_LD_NONE (void, or a struct returned by reference)  */
 Lret_type0:
 	b	Lfinish
 	nop
 	nop
 	nop
 
-/* case FFI_TYPE_INT  */
+/* case PPC_LD_R3 (one GPR: int, pointer, and on ppc64 also 64-bit ints)  */
 Lret_type1:
 	lg	r3,0(r5)
 	b	Lfinish
 	nop
 	nop
 
-/* case FFI_TYPE_FLOAT  */
+/* case PPC_LD_R3R4 (two GPRs: the 32-bit ABI`s 64-bit integer)  */
 Lret_type2:
+#if defined(__ppc64__)
+	lg	r3,0(r5)
+	lg	r4,8(r5)
+#else
+	lwz	r3,0(r5)
+	lwz	r4,4(r5)
+#endif
+	b	Lfinish
+	nop
+
+/* case PPC_LD_F32  */
+Lret_type3:
 	lfs	f1,0(r5)
 	b	Lfinish
 	nop
 	nop
 
-/* case FFI_TYPE_DOUBLE  */
-Lret_type3:
+/* case PPC_LD_F64  */
+Lret_type4:
 	lfd	f1,0(r5)
 	b	Lfinish
 	nop
 	nop
 
-/* case FFI_TYPE_LONGDOUBLE  */
-Lret_type4:
+/* case PPC_LD_F128 (128-bit long double: two doubles)  */
+Lret_type5:
 	lfd	f1,0(r5)
 	lfd	f2,8(r5)
 	b	Lfinish
 	nop
 
-/* case FFI_TYPE_UINT8  */
-Lret_type5:
+/* case PPC_LD_U8  */
+Lret_type6:
 #if defined(__ppc64__)
 	lbz	r3,7(r5)
 #else
@@ -264,8 +279,8 @@ Lret_type5:
 	nop
 	nop
 
-/* case FFI_TYPE_SINT8  */
-Lret_type6:
+/* case PPC_LD_S8  */
+Lret_type7:
 #if defined(__ppc64__)
 	lbz	r3,7(r5)
 #else
@@ -275,8 +290,8 @@ Lret_type6:
 	b	Lfinish
 	nop
 
-/* case FFI_TYPE_UINT16  */
-Lret_type7:
+/* case PPC_LD_U16  */
+Lret_type8:
 #if defined(__ppc64__)
 	lhz	r3,6(r5)
 #else
@@ -286,8 +301,8 @@ Lret_type7:
 	nop
 	nop
 
-/* case FFI_TYPE_SINT16  */
-Lret_type8:
+/* case PPC_LD_S16  */
+Lret_type9:
 #if defined(__ppc64__)
 	lha	r3,6(r5)
 #else
@@ -297,77 +312,43 @@ Lret_type8:
 	nop
 	nop
 
-/* case FFI_TYPE_UINT32  */
-Lret_type9:
 #if defined(__ppc64__)
-	lwz	r3,4(r5)
-#else
-	lwz	r3,0(r5)
-#endif
-	b	Lfinish
-	nop
-	nop
-
-/* case FFI_TYPE_SINT32  */
+/* case PPC_LD_U32 (ppc64 only; the 32-bit ABI aliases U32 to PPC_LD_R3)  */
 Lret_type10:
-#if defined(__ppc64__)
 	lwz	r3,4(r5)
-#else
-	lwz	r3,0(r5)
-#endif
 	b	Lfinish
 	nop
 	nop
 
-/* case FFI_TYPE_UINT64  */
+/* case PPC_LD_S32 (ppc64 only; the 32-bit ABI aliases S32 to PPC_LD_R3)  */
 Lret_type11:
-#if defined(__ppc64__)
-	lg	r3,0(r5)
-	b	Lfinish
-	nop
-#else
-	lwz	r3,0(r5)
-	lwz	r4,4(r5)
+	lwa	r3,4(r5)
 	b	Lfinish
-#endif
 	nop
-
-/* case FFI_TYPE_SINT64  */
-Lret_type12:
-#if defined(__ppc64__)
-	lg	r3,0(r5)
-	b	Lfinish
 	nop
-#else
-	lwz	r3,0(r5)
-	lwz	r4,4(r5)
-	b	Lfinish
 #endif
-	nop
 
-/* case FFI_TYPE_STRUCT  */
-Lret_type13:
+/* case PPC_LD_STRUCT (a by-value struct return).  This is the final,
+   variable-length fragment, so it need not be padded to 16 bytes.  The helper
+   stashed cif->rtype in the first parameter-save slot (see ffi_darwin.c),
+   because the small dispatch index in r3 left no room for it.  */
+Lret_type_struct:
+	lg	r6,PARENT_PARM_BASE(r1)	; cif->rtype
+	sg	r6,LINKAGE_SIZE(r1)	; where the struct code below expects it
+	lg	r0,0(r6)		; size => r0
 #if defined(__ppc64__)
 	lg	r3,0(r5)		; we need at least this...
 	cmpi	0,r0,4
 	bgt	Lstructend		; not a special small case
 	b	Lsmallstruct		; see if we need more.
 #else
-	cmpwi	0,r0,4
-	bgt	Lfinish		; not by value
-	lg	r3,0(r5)
+	lg	r3,0(r5)		; a <=4-byte struct, returned in r3
 	b	Lfinish
 #endif
-/* case FFI_TYPE_POINTER  */
-Lret_type14:
-	lg	r3,0(r5)
-	b	Lfinish
-	nop
-	nop
 
 #if defined(__ppc64__)
 Lsmallstruct:
-	beq	Lfour			; continuation of Lret13.
+	beq	Lfour			; continuation of Lret_type_struct.
 	cmpi	0,r0,3
 	beq	Lfinish			; don`t adjust this - can`t be any floats here...
 	srdi	r3,r3,48
diff --git a/deps/libffi/src/powerpc/ffi_darwin.c b/deps/libffi/src/powerpc/ffi_darwin.c
index 01e2a43701d7..64449c38e156 100644
--- a/deps/libffi/src/powerpc/ffi_darwin.c
+++ b/deps/libffi/src/powerpc/ffi_darwin.c
@@ -60,11 +60,13 @@ struct ffi_aix_trampoline_struct {
 # define PPC_LD_S32		PPC_LD_R3
 # define PPC_LD_PTR		PPC_LD_R3
 # define PPC_LD_I64		PPC_LD_R3R4
+# define PPC_LD_STRUCT		10
 #else
 # define PPC_LD_U32		10
 # define PPC_LD_S32		11
 # define PPC_LD_PTR		PPC_LD_R3
 # define PPC_LD_I64		PPC_LD_R3
+# define PPC_LD_STRUCT		12
 #endif
 
 extern void ffi_closure_ASM (void);
@@ -1260,6 +1262,13 @@ ffi_closure_helper_common (ffi_cif* cif,
   long             i, avn;
   ffi_dblfl *      end_pfr = pfr + NUM_FPR_ARG_REGISTERS;
   unsigned         size_al;
+  int              struct_ret_by_value = 0;
+  /* When a struct is returned by value, ffi_closure_ASM's jump-table
+     dispatch carries only a small integer return code (see PPC_LD_* above),
+     with no room for cif->rtype.  We hand cif->rtype back in the first
+     parameter-save slot -- which is dead by the time we return -- for the
+     PPC_LD_STRUCT fragment in darwin_closure.S to recover.  */
+  unsigned long *  pgr0 = pgr;
 #if defined(POWERPC_DARWIN64)
   unsigned 	   fpsused = 0;
 #endif
@@ -1275,12 +1284,16 @@ ffi_closure_helper_common (ffi_cif* cif,
 	  rvalue = (void *) *pgr;
 	  pgr++;
 	}
+      else
+	struct_ret_by_value = 1;
 #elif defined(DARWIN_PPC)
       if (cif->rtype->size > 4)
 	{
 	  rvalue = (void *) *pgr;
 	  pgr++;
 	}
+      else
+	struct_ret_by_value = 1;
 #else /* assume we return by ref.  */
       rvalue = (void *) *pgr;
       pgr++;
@@ -1480,7 +1493,17 @@ ffi_closure_helper_common (ffi_cif* cif,
   switch (cif->rtype->type)
     {
     case FFI_TYPE_VOID:
+      return PPC_LD_NONE;
     case FFI_TYPE_STRUCT:
+      /* A by-reference struct return needs nothing further here: the result
+	 was written straight to the caller's buffer.  A by-value struct
+	 return is loaded into registers by darwin_closure.S, which needs
+	 cif->rtype -- hand it back in the first parameter-save slot.  */
+      if (struct_ret_by_value)
+	{
+	  *pgr0 = (unsigned long) cif->rtype;
+	  return PPC_LD_STRUCT;
+	}
       return PPC_LD_NONE;
     case FFI_TYPE_FLOAT:
       return PPC_LD_F32;
diff --git a/deps/libffi/src/powerpc/ffi_linux64.c b/deps/libffi/src/powerpc/ffi_linux64.c
index b1f1468ed5f8..e92f88c46973 100644
--- a/deps/libffi/src/powerpc/ffi_linux64.c
+++ b/deps/libffi/src/powerpc/ffi_linux64.c
@@ -107,8 +107,13 @@ discover_homogeneous_aggregate (ffi_abi abi,
 	unsigned int inner_elnum = 0;
 	unsigned int inner
 	  = discover_homogeneous_aggregate (abi, t->elements[0], &inner_elnum);
-	if (inner == FFI_TYPE_FLOAT || inner == FFI_TYPE_DOUBLE)
+	if (inner == FFI_TYPE_FLOAT || inner == FFI_TYPE_DOUBLE
+	    || inner == FFI_TYPE_LONGDOUBLE)
 	  {
+	    /* A _Complex of an FP base counts as two of that base: an
+	       FP-HFA struct member.  For IBM-128 long double each half is
+	       itself two FPRs (inner_elnum == 2), so a _Complex long double
+	       contributes four FPRs.  */
 	    *elnum = 2 * inner_elnum;
 	    return inner;
 	  }
@@ -257,11 +262,17 @@ ffi_prep_cif_linux64_core (ffi_cif *cif)
           goto homogeneous;
 #if FFI_TYPE_LONGDOUBLE != FFI_TYPE_DOUBLE
         case FFI_TYPE_LONGDOUBLE:
-          /* Only the 64-bit long double case is wired up; IBM-128 and
-             IEEE-binary128 _Complex are left as a follow-up.  */
-          if ((cif->abi & (FFI_LINUX_LONG_DOUBLE_128
-                           | FFI_LINUX_LONG_DOUBLE_IEEE128)) != 0)
-            return FFI_BAD_TYPEDEF;
+          if ((cif->abi & FFI_LINUX_LONG_DOUBLE_IEEE128) != 0)
+            {
+              /* IEEE-128 _Complex long double: real in v2, imag in v3.
+                 Return via the vector-homogeneous small-struct path.  */
+              flags |= FLAG_RETURNS_SMST | FLAG_RETURNS_VEC;
+              break;
+            }
+          /* IBM-128 _Complex long double is returned like a homogeneous
+             aggregate of doubles: real in f1:f2, imag in f3:f4.  (For a
+             64-bit long double this reduces to the FFI_TYPE_DOUBLE case,
+             real in f1 and imag in f2.)  */
           flags |= FLAG_RETURNS_SMST;
           rtype = FFI_TYPE_DOUBLE;
           goto homogeneous;
@@ -393,11 +404,21 @@ ffi_prep_cif_linux64_core (ffi_cif *cif)
 	      break;
 #if FFI_TYPE_LONGDOUBLE != FFI_TYPE_DOUBLE
 	    case FFI_TYPE_LONGDOUBLE:
-	      if ((cif->abi & (FFI_LINUX_LONG_DOUBLE_128
-			       | FFI_LINUX_LONG_DOUBLE_IEEE128)) != 0)
-		return FFI_BAD_TYPEDEF;
-	      fparg_count += 2;
-	      intarg_count += 2;
+	      if ((cif->abi & FFI_LINUX_LONG_DOUBLE_IEEE128) != 0)
+		{
+		  /* Two IEEE-128 halves: each occupies a vector register plus
+		     two GPR shadow doublewords, the pair 16-byte aligned.  */
+		  vecarg_count += 2;
+		  intarg_count = (intarg_count + 1) & ~0x1;
+		  intarg_count += 4;
+		  if (vecarg_count > NUM_VEC_ARG_REGISTERS64)
+		    flags |= FLAG_ARG_NEEDS_PSAVE;
+		  break;
+		}
+	      /* IBM-128: each half is a pair of FPRs, and each FPR half
+		 consumes a GPR shadow doubleword -- four of each in total.  */
+	      fparg_count += 4;
+	      intarg_count += 4;
 	      if (fparg_count > NUM_FPR_ARG_REGISTERS64)
 		flags |= FLAG_ARG_NEEDS_PSAVE;
 	      break;
@@ -755,10 +776,51 @@ ffi_prep_args64 (extended_cif *ecif, unsigned long *const stack)
 	case FFI_TYPE_COMPLEX:
 	  elt = (*ptr)->elements[0]->type;
 #if FFI_TYPE_LONGDOUBLE != FFI_TYPE_DOUBLE
-	  /* 64-bit long double is equivalent to double; the IBM-128 and
-	     IEEE-binary128 variants were rejected in prep_cif.  */
+	  if (elt == FFI_TYPE_LONGDOUBLE
+	      && (ecif->cif->abi & FFI_LINUX_LONG_DOUBLE_IEEE128) != 0)
+	    {
+	      /* IEEE-128 _Complex long double: each half goes in its own
+		 vector register (or the parameter save area), 16-byte
+		 aligned, consuming two GPR shadow doublewords.  */
+	      float128 *cval = (float128 *) *p_argv.v;
+	      unsigned int j;
+	      for (j = 0; j < 2; j++)
+		{
+		  next_arg.p = FFI_ALIGN (next_arg.p, 16);
+		  if (next_arg.ul == gpr_end.ul)
+		    next_arg.ul = rest.ul;
+		  if (vecarg_count < NUM_VEC_ARG_REGISTERS64 && i < nfixedargs)
+		    memcpy (vec_base.f128++, cval + j, sizeof (float128));
+		  else
+		    memcpy (next_arg.f128, cval + j, sizeof (float128));
+		  if (++next_arg.f128 == gpr_end.f128)
+		    next_arg.f128 = rest.f128;
+		  vecarg_count++;
+		}
+	      FFI_ASSERT (flags & FLAG_VEC_ARGUMENTS);
+	      break;
+	    }
 	  if (elt == FFI_TYPE_LONGDOUBLE)
-	    elt = FFI_TYPE_DOUBLE;
+	    {
+	      /* IBM-128 _Complex long double: four doubles (real hi/lo,
+		 imag hi/lo) into consecutive FPRs, each with a GPR shadow
+		 doubleword.  */
+	      double *cval = (double *) *p_argv.v;
+	      unsigned int j;
+	      for (j = 0; j < 4; j++)
+		{
+		  double_tmp = cval[j];
+		  if (fparg_count < NUM_FPR_ARG_REGISTERS64 && i < nfixedargs)
+		    *fpr_base.d++ = double_tmp;
+		  else
+		    *next_arg.d = double_tmp;
+		  if (++next_arg.ul == gpr_end.ul)
+		    next_arg.ul = rest.ul;
+		  fparg_count++;
+		}
+	      FFI_ASSERT (flags & FLAG_FP_ARGUMENTS);
+	      break;
+	    }
 #endif
 	  if (elt == FFI_TYPE_FLOAT)
 	    {
@@ -1336,8 +1398,45 @@ ffi_closure_helper_LINUX64 (ffi_cif *cif,
 	    unsigned int j;
 	    elt = arg_types[i]->elements[0]->type;
 #if FFI_TYPE_LONGDOUBLE != FFI_TYPE_DOUBLE
+	    if (elt == FFI_TYPE_LONGDOUBLE
+		&& (cif->abi & FFI_LINUX_LONG_DOUBLE_IEEE128) != 0)
+	      {
+		/* IEEE-128: each half arrives in a vector register (or the
+		   16-byte-aligned parameter save area) with two GPR shadow
+		   doublewords.  */
+		float128 *cval = alloca (2 * sizeof (float128));
+		if (((unsigned long) pst & 0xF) != 0)
+		  ++pst;
+		for (j = 0; j < 2; j++)
+		  {
+		    if (pvec < end_pvec && i < nfixedargs)
+		      memcpy (&cval[j], pvec++, sizeof (float128));
+		    else
+		      memcpy (&cval[j], pst, sizeof (float128));
+		    pst += 2;
+		  }
+		avalue[i] = cval;
+		break;
+	      }
 	    if (elt == FFI_TYPE_LONGDOUBLE)
-	      elt = FFI_TYPE_DOUBLE;
+	      {
+		/* IBM-128: four doubles, each in an FPR (or one GPR shadow
+		   doubleword) -- real hi/lo then imag hi/lo.  */
+		double *cval = alloca (4 * sizeof (double));
+		for (j = 0; j < 4; j++)
+		  {
+		    if (pfr < end_pfr && i < nfixedargs)
+		      {
+			cval[j] = pfr->d;
+			pfr++;
+		      }
+		    else
+		      cval[j] = *(double *) pst;
+		    pst++;
+		  }
+		avalue[i] = cval;
+		break;
+	      }
 #endif
 	    if (elt == FFI_TYPE_FLOAT)
 	      {
@@ -1448,7 +1547,13 @@ ffi_closure_helper_LINUX64 (ffi_cif *cif,
 	int inner = cif->rtype->elements[0]->type;
 #if FFI_TYPE_LONGDOUBLE != FFI_TYPE_DOUBLE
 	if (inner == FFI_TYPE_LONGDOUBLE)
-	  inner = FFI_TYPE_DOUBLE;
+	  {
+	    /* IEEE-128 _Complex long double returns in v2:v3; IBM-128 in
+	       f1:f2 (real) and f3:f4 (imag), i.e. as a double HFA.  */
+	    if ((cif->abi & FFI_LINUX_LONG_DOUBLE_IEEE128) != 0)
+	      return PPC64_LD_VECTOR_HOMOG;
+	    inner = FFI_TYPE_DOUBLE;
+	  }
 #endif
 	if (inner == FFI_TYPE_FLOAT)
 	  return PPC64_LD_FLOAT_HOMOG;
diff --git a/deps/libffi/src/powerpc/linux64_closure.S b/deps/libffi/src/powerpc/linux64_closure.S
index 405b2cfc47a1..3071bec0d22a 100644
--- a/deps/libffi/src/powerpc/linux64_closure.S
+++ b/deps/libffi/src/powerpc/linux64_closure.S
@@ -345,6 +345,21 @@ E PPC64_LD_STRUCT_3
 	lwz %r3, RETVAL+4(%r1)
 	srd %r3, %r3, 8
 	epilogue
+
+E PPC64_LD_STRUCT_5
+	ld %r3, RETVAL+0(%r1)
+	srdi %r3, %r3, 24
+	epilogue
+
+E PPC64_LD_STRUCT_6
+	ld %r3, RETVAL+0(%r1)
+	srdi %r3, %r3, 16
+	epilogue
+
+E PPC64_LD_STRUCT_7
+	ld %r3, RETVAL+0(%r1)
+	srdi %r3, %r3, 8
+	epilogue
 #endif
 
 .Lmoredouble:
diff --git a/deps/libffi/src/prep_cif.c b/deps/libffi/src/prep_cif.c
index 1836270d1a9c..8a448ebbf81f 100644
--- a/deps/libffi/src/prep_cif.c
+++ b/deps/libffi/src/prep_cif.c
@@ -32,6 +32,72 @@
 
 #define STACK_ARG_SIZE(x) FFI_ALIGN(x, FFI_SIZEOF_ARG)
 
+/* Compute the machine-independent layout of a vector (SIMD) type.
+
+   A vector is described exactly like a struct -- arg->elements is a
+   NULL-terminated array of pointers -- but every element must point to the
+   SAME fundamental scalar type, and the count is the number of lanes.  The
+   caller leaves arg->size and arg->alignment as zero; libffi derives them:
+
+     size      = lane_size * lane_count, rounded UP to the next power of two
+                 (matching Clang's ext_vector_type storage, e.g. 3 x float
+                 -> 16; GCC's vector_size already requires power-of-two totals
+                 so the rule is identical there);
+     alignment = min(size, 16).
+
+   Only float, double and the fixed-width integer scalars (UINT8..SINT64) are
+   valid lane types.  Anything else -- a heterogeneous element list, an
+   aggregate lane, long double, or a zero-length vector -- is FFI_BAD_TYPEDEF. */
+
+static ffi_status
+initialize_vector (ffi_type *arg)
+{
+  ffi_type **ptr = arg->elements;
+  ffi_type *elem;
+  size_t count = 0;
+  size_t total, p2;
+
+  if (UNLIKELY (ptr == NULL || *ptr == NULL))
+    return FFI_BAD_TYPEDEF;
+
+  elem = *ptr;
+  switch (elem->type)
+    {
+    case FFI_TYPE_FLOAT:
+    case FFI_TYPE_DOUBLE:
+    case FFI_TYPE_UINT8:
+    case FFI_TYPE_SINT8:
+    case FFI_TYPE_UINT16:
+    case FFI_TYPE_SINT16:
+    case FFI_TYPE_UINT32:
+    case FFI_TYPE_SINT32:
+    case FFI_TYPE_UINT64:
+    case FFI_TYPE_SINT64:
+      break;
+    default:
+      return FFI_BAD_TYPEDEF;
+    }
+
+  /* Every lane must be the identical scalar type.  */
+  for (; *ptr != NULL; ptr++)
+    {
+      if ((*ptr)->type != elem->type || (*ptr)->size != elem->size)
+	return FFI_BAD_TYPEDEF;
+      count++;
+    }
+
+  if (UNLIKELY (count < 1 || elem->size == 0))
+    return FFI_BAD_TYPEDEF;
+
+  total = elem->size * count;
+  for (p2 = 1; p2 < total; p2 <<= 1)
+    ;
+
+  arg->size = p2;
+  arg->alignment = p2 < 16 ? p2 : 16;
+  return FFI_OK;
+}
+
 /* Perform machine independent initialization of aggregate type
    specifications. */
 
@@ -42,6 +108,9 @@ static ffi_status initialize_aggregate(ffi_type *arg, size_t *offsets)
   if (UNLIKELY(arg == NULL || arg->elements == NULL))
     return FFI_BAD_TYPEDEF;
 
+  if (arg->type == FFI_TYPE_VECTOR)
+    return initialize_vector (arg);
+
   arg->size = 0;
   arg->alignment = 0;
 
@@ -92,6 +161,28 @@ static ffi_status initialize_aggregate(ffi_type *arg, size_t *offsets)
     return FFI_OK;
 }
 
+#ifndef FFI_TARGET_HAS_VECTOR_TYPE
+/* Recursively test whether TY is, or contains, a vector (SIMD) type.  Ports
+   that do not define FFI_TARGET_HAS_VECTOR_TYPE cannot marshal vectors, so
+   ffi_prep_cif_core rejects any signature that mentions one (directly or
+   nested inside a struct) with FFI_BAD_TYPEDEF rather than aborting.  */
+static int
+ffi_type_contains_vector (ffi_type *ty)
+{
+  ffi_type **p;
+
+  if (ty == NULL)
+    return 0;
+  if (ty->type == FFI_TYPE_VECTOR)
+    return 1;
+  if (ty->type == FFI_TYPE_STRUCT && ty->elements != NULL)
+    for (p = ty->elements; *p != NULL; p++)
+      if (ffi_type_contains_vector (*p))
+	return 1;
+  return 0;
+}
+#endif /* !FFI_TARGET_HAS_VECTOR_TYPE */
+
 #ifndef __CRIS__
 /* The CRIS ABI specifies structure elements to have byte
    alignment only, so it completely overrides this functions,
@@ -129,6 +220,15 @@ ffi_status FFI_HIDDEN ffi_prep_cif_core(ffi_cif *cif, ffi_abi abi,
   cif->nargs = ntotalargs;
   cif->rtype = rtype;
 
+#ifndef FFI_TARGET_HAS_VECTOR_TYPE
+  /* Vector (SIMD) types are only marshalled on ports that opt in.  */
+  if (ffi_type_contains_vector (rtype))
+    return FFI_BAD_TYPEDEF;
+  for (i = 0; i < ntotalargs; i++)
+    if (ffi_type_contains_vector (atypes[i]))
+      return FFI_BAD_TYPEDEF;
+#endif
+
   cif->flags = 0;
 #if (defined(_M_ARM64) || defined(__aarch64__)) && defined(_WIN32)
   cif->is_variadic = isvariadic;
@@ -152,7 +252,8 @@ ffi_status FFI_HIDDEN ffi_prep_cif_core(ffi_cif *cif, ffi_abi abi,
   /* x86, x86-64 and s390 stack space allocation is handled in prep_machdep. */
 #if !defined FFI_TARGET_SPECIFIC_STACK_SPACE_ALLOCATION
   /* Make space for the return structure pointer */
-  if (cif->rtype->type == FFI_TYPE_STRUCT
+  if ((cif->rtype->type == FFI_TYPE_STRUCT
+       || cif->rtype->type == FFI_TYPE_VECTOR)
 #ifdef TILE
       && (cif->rtype->size > 10 * FFI_SIZEOF_ARG)
 #endif
@@ -316,4 +417,11 @@ ffi_call_plan_free (ffi_call_plan *plan)
   free (plan);
 }
 
+size_t
+ffi_call_plan_size (ffi_call_plan *plan)
+{
+  /* The generic plan is a bare handle; there is no separate move-list.  */
+  return plan != NULL ? sizeof (struct ffi_call_plan) : 0;
+}
+
 #endif /* generic ffi_call_plan fallback */
diff --git a/deps/libffi/src/raw_api.c b/deps/libffi/src/raw_api.c
index be156116cb0d..670d56d948a3 100644
--- a/deps/libffi/src/raw_api.c
+++ b/deps/libffi/src/raw_api.c
@@ -42,7 +42,7 @@ ffi_raw_size (ffi_cif *cif)
   for (i = cif->nargs-1; i >= 0; i--, at++)
     {
 #if !FFI_NO_STRUCTS
-      if ((*at)->type == FFI_TYPE_STRUCT)
+      if ((*at)->type == FFI_TYPE_STRUCT || (*at)->type == FFI_TYPE_VECTOR)
 	result += FFI_ALIGN (sizeof (void*), FFI_SIZEOF_ARG);
       else
 #endif
@@ -82,8 +82,9 @@ ffi_raw_to_ptrarray (ffi_cif *cif, ffi_raw *raw, void **args)
 	  break;
 #endif
 	
-#if !FFI_NO_STRUCTS  
+#if !FFI_NO_STRUCTS
 	case FFI_TYPE_STRUCT:
+	case FFI_TYPE_VECTOR:
 	  *args = (raw++)->ptr;
 	  break;
 #endif
@@ -110,7 +111,7 @@ ffi_raw_to_ptrarray (ffi_cif *cif, ffi_raw *raw, void **args)
   for (i = 0; i < cif->nargs; i++, tp++, args++)
     {	  
 #if !FFI_NO_STRUCTS
-      if ((*tp)->type == FFI_TYPE_STRUCT)
+      if ((*tp)->type == FFI_TYPE_STRUCT || (*tp)->type == FFI_TYPE_VECTOR)
 	{
 	  *args = (raw++)->ptr;
 	}
@@ -172,6 +173,7 @@ ffi_ptrarray_to_raw (ffi_cif *cif, void **args, ffi_raw *raw)
 
 #if !FFI_NO_STRUCTS
 	case FFI_TYPE_STRUCT:
+	case FFI_TYPE_VECTOR:
 	  (raw++)->ptr = *args;
 	  break;
 #endif
diff --git a/deps/libffi/src/tramp.c b/deps/libffi/src/tramp.c
index 525f81547156..a04188858af6 100644
--- a/deps/libffi/src/tramp.c
+++ b/deps/libffi/src/tramp.c
@@ -417,9 +417,19 @@ ffi_tramp_init (void)
     &tramp_globals.map_size);
   tramp_globals.ntramp = tramp_globals.map_size / tramp_globals.size;
 
+  /*
+   * The trampoline code table is a single, fixed-size mapping.  If the
+   * system page size is larger than that mapping, the static trampoline
+   * mechanism cannot be used.  Both values are invariant for the life of
+   * the process, so cache the FAILED verdict rather than re-running the
+   * whole initialization on every allocation.
+   */
   page_size = sysconf (_SC_PAGESIZE);
   if (page_size >= 0 && (size_t)page_size > tramp_globals.map_size)
-    return 0;
+    {
+      tramp_globals.status = TRAMP_GLOBALS_FAILED;
+      return 0;
+    }
 
   if (ffi_tramp_init_os ())
     {
diff --git a/deps/libffi/src/x86/ffi.c b/deps/libffi/src/x86/ffi.c
index 27f17b0c8849..a953891362d5 100644
--- a/deps/libffi/src/x86/ffi.c
+++ b/deps/libffi/src/x86/ffi.c
@@ -118,7 +118,7 @@ ffi_prep_cif_machdep(ffi_cif *cif)
       break;
     case FFI_TYPE_STRUCT:
       {
-#if defined(X86_WIN32) || defined(X86_DARWIN)
+#if defined(X86_WIN32) || defined(X86_DARWIN) || defined(X86_FREEBSD)
         size_t size = cif->rtype->size;
         if (size == 1)
           flags = X86_RET_STRUCT_1B;
diff --git a/deps/libffi/src/x86/ffi64.c b/deps/libffi/src/x86/ffi64.c
index c24db38c4364..c2c78f3fbbfb 100644
--- a/deps/libffi/src/x86/ffi64.c
+++ b/deps/libffi/src/x86/ffi64.c
@@ -330,6 +330,25 @@ classify_argument (ffi_type *type, enum x86_64_reg_class classes[],
 	  }
 	return words;
       }
+    case FFI_TYPE_VECTOR:
+      /* A Short Vector occupies SSE registers: an 8-byte vector is a single
+	 SSE eightbyte; a 16-byte vector is one %xmm register (SSE + SSEUP).
+	 Wider vectors would need %ymm/%zmm handling this port does not
+	 implement; classify them as memory here and reject them outright in
+	 ffi_prep_cif_machdep so the caller gets FFI_BAD_TYPEDEF, not a
+	 silently wrong in-memory pass.  */
+      if (type->size == 8)
+	{
+	  classes[0] = X86_64_SSE_CLASS;
+	  return 1;
+	}
+      else if (type->size == 16)
+	{
+	  classes[0] = X86_64_SSE_CLASS;
+	  classes[1] = X86_64_SSEUP_CLASS;
+	  return 2;
+	}
+      return 0;
     case FFI_TYPE_COMPLEX:
       {
 	ffi_type *inner = type->elements[0];
@@ -533,6 +552,16 @@ ffi_prep_cif_machdep (ffi_cif *cif)
 	    }
 	}
       break;
+    case FFI_TYPE_VECTOR:
+      /* An 8-byte vector returns in the low half of %xmm0; a 16-byte vector
+	 fills %xmm0 (SSE + SSEUP).  Wider vectors are unsupported here.  */
+      if (rtype_size == 8)
+	flags = UNIX64_RET_XMM64;
+      else if (rtype_size == 16)
+	flags = UNIX64_RET_XMM128;
+      else
+	return FFI_BAD_TYPEDEF;
+      break;
     case FFI_TYPE_COMPLEX:
       switch (rtype->elements[0]->type)
 	{
@@ -577,6 +606,15 @@ ffi_prep_cif_machdep (ffi_cif *cif)
       return FFI_BAD_TYPEDEF;
     }
 
+  /* Reject vectors wider than 16 bytes as arguments: correct %ymm/%zmm
+     passing needs unix64.S register-save changes that are out of scope for
+     this port, and classify_argument would otherwise silently treat them as
+     an in-memory aggregate.  */
+  for (i = 0, avn = cif->nargs; i < avn; i++)
+    if (cif->arg_types[i]->type == FFI_TYPE_VECTOR
+	&& cif->arg_types[i]->size > 16)
+      return FFI_BAD_TYPEDEF;
+
   /* Go over all arguments and determine the way they should be passed.
      If it's in a register and there is space for it, let that be so. If
      not, add it's size to the stack byte count.  */
@@ -782,6 +820,7 @@ typedef struct
   unsigned fast;        /* nonzero -> lean trampoline eligible             */
   unsigned retcode;     /* UNIX64_RET_* (low byte of flags) for the store  */
   int      thunk_n;     /* >=0 -> ffi_gp_thunks[thunk_n], else -1          */
+  unsigned alloc_bytes; /* malloc'd size, reported by ffi_call_plan_size   */
   ffi_move moves[];
 } ffi_plan;
 
@@ -828,7 +867,7 @@ build_plan (ffi_cif *cif)
   unsigned i, avn = cif->nargs;
   enum x86_64_reg_class classes[MAX_CLASSES];
   unsigned nm, gprcount, ssecount;
-  size_t argp_off;
+  size_t argp_off, nbytes;
   ffi_plan *plan;
   int all_gp64 = 1;	/* every arg is exactly one 64-bit GP move? */
 
@@ -848,9 +887,11 @@ build_plan (ffi_cif *cif)
     }
 
   /* One self-contained allocation: header + moves, released with plain free(). */
-  plan = malloc (sizeof (ffi_plan) + sizeof (ffi_move) * (2 * avn + 1));
+  nbytes = sizeof (ffi_plan) + sizeof (ffi_move) * (2 * avn + 1);
+  plan = malloc (nbytes);
   if (plan == NULL)
     return NULL;
+  plan->alloc_bytes = (unsigned) nbytes;
 
   nm = gprcount = ssecount = 0;
   argp_off = 0;
@@ -1070,6 +1111,17 @@ ffi_call_plan_free (ffi_call_plan *plan)
     }
 }
 
+size_t
+ffi_call_plan_size (ffi_call_plan *plan)
+{
+  if (plan == NULL)
+    return 0;
+  /* The move-list carries its own size; a signature with no fast path owns
+     nothing beyond the handle.  */
+  return sizeof (struct ffi_call_plan)
+	 + (plan->fast != NULL ? plan->fast->alloc_bytes : 0);
+}
+
 extern void
 ffi_call_efi64(ffi_cif *cif, void (*fn)(void), void *rvalue, void **avalue);
 #endif
diff --git a/deps/libffi/src/x86/ffitarget.h b/deps/libffi/src/x86/ffitarget.h
index d702235f90fe..eaf6a910a4f5 100644
--- a/deps/libffi/src/x86/ffitarget.h
+++ b/deps/libffi/src/x86/ffitarget.h
@@ -58,6 +58,13 @@
 #define FFI_TARGET_HAS_INT128
 #endif
 
+/* The System V x86-64 psABI passes 8- and 16-byte vectors in SSE registers;
+   this is implemented by the ffi64.c (FFI_UNIX64) backend only.  32-bit x86
+   and the Windows x86-64 backend (ffiw64.c) do not marshal vectors.  */
+#if defined(X86_64) && !defined(X86_WIN64)
+#define FFI_TARGET_HAS_VECTOR_TYPE
+#endif
+
 /* ---- Generic type definitions ----------------------------------------- */
 
 #ifndef LIBFFI_ASM
@@ -138,6 +145,18 @@ typedef enum ffi_abi {
 #define FFI_TYPE_SMALL_STRUCT_4B (FFI_TYPE_LAST + 3)
 #define FFI_TYPE_MS_STRUCT       (FFI_TYPE_LAST + 4)
 
+/* Tripwire: the win64.S / win64_intel.S return-value jump tables use one
+   8-byte slot per code value and place the FFI_TYPE_SMALL_STRUCT_* pseudo-types
+   (which are FFI_TYPE_LAST-relative) immediately after the generic FFI_TYPE_*
+   codes.  Adding a new generic type bumps FFI_TYPE_LAST, shifts those codes,
+   and opens a gap in the tables that silently misaligns small-struct returns.
+   When this fires: add a matching E() slot for the new type in both win64.S
+   and win64_intel.S, then bump FFI_X86_TYPE_LAST to match.  */
+#define FFI_X86_TYPE_LAST FFI_TYPE_VECTOR
+#if FFI_TYPE_LAST != FFI_X86_TYPE_LAST
+# error "new FFI_TYPE_* added: sync the win64.S/win64_intel.S jump tables and bump FFI_X86_TYPE_LAST"
+#endif
+
 #if defined (X86_64) || defined(X86_WIN64) \
     || (defined (__x86_64__) && defined (X86_DARWIN))
 /* 4 bytes of ENDBR64 + 7 bytes of LEA + 6 bytes of JMP + 7 bytes of NOP
diff --git a/deps/libffi/src/x86/win64.S b/deps/libffi/src/x86/win64.S
index 185f0a3048fb..f23a5fa29e8e 100644
--- a/deps/libffi/src/x86/win64.S
+++ b/deps/libffi/src/x86/win64.S
@@ -151,6 +151,11 @@ E(0b, FFI_TYPE_UINT128)
 E(0b, FFI_TYPE_SINT128)
 	movdqu	%xmm0, (%r8)
 	epilogue
+/* Win64 does not marshal vectors (ffi_prep_cif_core rejects them), but the
+   FFI_TYPE_SMALL_STRUCT_* codes are FFI_TYPE_LAST-relative, so this slot must
+   exist to keep the table contiguous and the small-struct entries aligned.  */
+E(0b, FFI_TYPE_VECTOR)
+	call	PLT(C(abort))
 E(0b, FFI_TYPE_SMALL_STRUCT_1B)
 	movb	%al, (%r8)
 	epilogue
diff --git a/deps/libffi/src/x86/win64_intel.S b/deps/libffi/src/x86/win64_intel.S
index e9eff00da3ce..807f5b3e98f7 100644
--- a/deps/libffi/src/x86/win64_intel.S
+++ b/deps/libffi/src/x86/win64_intel.S
@@ -152,6 +152,11 @@ E(0b, FFI_TYPE_UINT128)
 E(0b, FFI_TYPE_SINT128)
 	movdqu	xmmword ptr [r8], xmm0
 	epilogue
+/* Win64 does not marshal vectors (ffi_prep_cif_core rejects them), but the
+   FFI_TYPE_SMALL_STRUCT_* codes are FFI_TYPE_LAST-relative, so this slot must
+   exist to keep the table contiguous and the small-struct entries aligned.  */
+E(0b, FFI_TYPE_VECTOR)
+	call	PLT(C(abort))
 E(0b, FFI_TYPE_SMALL_STRUCT_1B)
 	mov byte ptr [r8], al ; movb	%al, (%r8)
 	epilogue
diff --git a/deps/libffi/testsuite/Makefile.am b/deps/libffi/testsuite/Makefile.am
index c14a880959d8..702461d02418 100644
--- a/deps/libffi/testsuite/Makefile.am
+++ b/deps/libffi/testsuite/Makefile.am
@@ -13,15 +13,17 @@ EXTRA_DIST = config/default.exp emscripten/build.sh emscripten/conftest.py \
 	libffi.bhaible/alignof.h libffi.bhaible/bhaible.exp libffi.bhaible/test-call.c \
 	libffi.bhaible/test-callback.c libffi.bhaible/testcases.c libffi.call/align_mixed.c \
 	libffi.call/align_stdcall.c libffi.call/bpo_38748.c libffi.call/call.exp \
+	libffi.call/closure_thiscall_fastcall_pop.c \
 	libffi.call/err_bad_typedef.c libffi.call/ffitest.h libffi.call/float.c \
 	libffi.call/float1.c libffi.call/float2.c libffi.call/float3.c \
 	libffi.call/float4.c libffi.call/float_va.c libffi.call/i128-1.c \
 	libffi.call/large_struct_by_value.c libffi.call/many.c \
-	libffi.call/many2.c libffi.call/many_double.c libffi.call/many_mixed.c \
+	libffi.call/many2.c libffi.call/many_double.c \
+	libffi.call/many_large_structs.c libffi.call/many_mixed.c \
 	libffi.call/many_small_structs.c \
 	libffi.call/negint.c libffi.call/offsets.c libffi.call/overread.c \
 	libffi.call/plan.c libffi.call/plan_mixed.c libffi.call/plan_spill.c \
-	libffi.call/plan_struct.c libffi.call/plan_var.c \
+	libffi.call/plan_struct.c libffi.call/plan_size.c libffi.call/plan_var.c \
 	libffi.call/pr1172638.c libffi.call/promotion.c libffi.call/pyobjc_tc.c libffi.call/return_dbl.c \
 	libffi.call/return_dbl1.c libffi.call/return_dbl2.c libffi.call/return_fl.c \
 	libffi.call/return_fl1.c libffi.call/return_fl2.c libffi.call/return_fl3.c \
@@ -90,4 +92,10 @@ EXTRA_DIST = config/default.exp emscripten/build.sh emscripten/conftest.py \
 	libffi.complex/return_complex_float.c libffi.complex/return_complex_longdouble.c libffi.go/aa-direct.c \
 	libffi.go/closure1.c libffi.go/ffitest.h libffi.go/go.exp \
 	libffi.go/static-chain.h Makefile.am Makefile.in \
-	libffi.threads/ffitest.h libffi.threads/threads.exp libffi.threads/tsan.c
+	libffi.threads/ffitest.h libffi.threads/threads.exp libffi.threads/tsan.c \
+	libffi.vector/vector.exp libffi.vector/ffitest.h libffi.vector/vector.h \
+	libffi.vector/vector_float32x4.c libffi.vector/vector_float32x2.c \
+	libffi.vector/vector_double2.c libffi.vector/vector_int32x4.c \
+	libffi.vector/vector_args_spill.c libffi.vector/vector_vec3.c \
+	libffi.vector/vector_double4.c libffi.vector/vector_hva.c \
+	libffi.vector/cls_vector.c libffi.vector/vector_validate.c
diff --git a/deps/libffi/testsuite/Makefile.in b/deps/libffi/testsuite/Makefile.in
index 1b29b90d3633..30b417735d5e 100644
--- a/deps/libffi/testsuite/Makefile.in
+++ b/deps/libffi/testsuite/Makefile.in
@@ -301,15 +301,17 @@ EXTRA_DIST = config/default.exp emscripten/build.sh emscripten/conftest.py \
 	libffi.bhaible/alignof.h libffi.bhaible/bhaible.exp libffi.bhaible/test-call.c \
 	libffi.bhaible/test-callback.c libffi.bhaible/testcases.c libffi.call/align_mixed.c \
 	libffi.call/align_stdcall.c libffi.call/bpo_38748.c libffi.call/call.exp \
+	libffi.call/closure_thiscall_fastcall_pop.c \
 	libffi.call/err_bad_typedef.c libffi.call/ffitest.h libffi.call/float.c \
 	libffi.call/float1.c libffi.call/float2.c libffi.call/float3.c \
 	libffi.call/float4.c libffi.call/float_va.c libffi.call/i128-1.c \
 	libffi.call/large_struct_by_value.c libffi.call/many.c \
-	libffi.call/many2.c libffi.call/many_double.c libffi.call/many_mixed.c \
+	libffi.call/many2.c libffi.call/many_double.c \
+	libffi.call/many_large_structs.c libffi.call/many_mixed.c \
 	libffi.call/many_small_structs.c \
 	libffi.call/negint.c libffi.call/offsets.c libffi.call/overread.c \
 	libffi.call/plan.c libffi.call/plan_mixed.c libffi.call/plan_spill.c \
-	libffi.call/plan_struct.c libffi.call/plan_var.c \
+	libffi.call/plan_struct.c libffi.call/plan_size.c libffi.call/plan_var.c \
 	libffi.call/pr1172638.c libffi.call/promotion.c libffi.call/pyobjc_tc.c libffi.call/return_dbl.c \
 	libffi.call/return_dbl1.c libffi.call/return_dbl2.c libffi.call/return_fl.c \
 	libffi.call/return_fl1.c libffi.call/return_fl2.c libffi.call/return_fl3.c \
@@ -378,7 +380,13 @@ EXTRA_DIST = config/default.exp emscripten/build.sh emscripten/conftest.py \
 	libffi.complex/return_complex_float.c libffi.complex/return_complex_longdouble.c libffi.go/aa-direct.c \
 	libffi.go/closure1.c libffi.go/ffitest.h libffi.go/go.exp \
 	libffi.go/static-chain.h Makefile.am Makefile.in \
-	libffi.threads/ffitest.h libffi.threads/threads.exp libffi.threads/tsan.c
+	libffi.threads/ffitest.h libffi.threads/threads.exp libffi.threads/tsan.c \
+	libffi.vector/vector.exp libffi.vector/ffitest.h libffi.vector/vector.h \
+	libffi.vector/vector_float32x4.c libffi.vector/vector_float32x2.c \
+	libffi.vector/vector_double2.c libffi.vector/vector_int32x4.c \
+	libffi.vector/vector_args_spill.c libffi.vector/vector_vec3.c \
+	libffi.vector/vector_double4.c libffi.vector/vector_hva.c \
+	libffi.vector/cls_vector.c libffi.vector/vector_validate.c
 
 all: all-am
 
diff --git a/deps/libffi/testsuite/libffi.call/closure_thiscall_fastcall_pop.c b/deps/libffi/testsuite/libffi.call/closure_thiscall_fastcall_pop.c
new file mode 100644
index 000000000000..9cc0b091943f
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.call/closure_thiscall_fastcall_pop.c
@@ -0,0 +1,131 @@
+/* Area:	closure, ffi_prep_closure_loc
+   Purpose:	Check i386 THISCALL/FASTCALL closures pop the stack correctly.
+   Limitations:	i386 + GNU inline asm only; a no-op elsewhere.
+   PR:		none.
+   Originator:	i386 closure stack-pop accounting regression.
+
+   THISCALL and FASTCALL are callee-clean: the closure must remove its
+   stack-resident arguments on return (ret $n).  When a 64-bit integer or
+   a struct argument is placed on the stack, the closure return path used
+   to compute the pop as cif->bytes - narg_reg*4 with narg_reg force-bumped
+   to 2, discounting register slots that were never used and under-popping
+   the stack.  A caller that relies on callee cleanup is then left with the
+   argument bytes where its return address should be.
+
+   This test invokes the generated closure through a minimal callee-clean
+   call site and checks that ESP is balanced across the call (delta 0).
+   Without the fix the delta is 8 (FASTCALL uint64) or 4 (THISCALL).  */
+
+/* { dg-do run } */
+#include "ffitest.h"
+
+#if defined(__i386__) && defined(__GNUC__) && !defined(__APPLE__)
+
+static uint64_t received;
+static int ran;
+
+static void
+cb (ffi_cif *cif, void *resp, void **args, void *userdata)
+{
+  (void) cif; (void) resp; (void) userdata;
+  received = *(uint64_t *) args[cif->nargs - 1];
+  ran++;
+}
+
+/* Push an 8-byte stack argument, load ECX (the thiscall "this" register,
+   ignored by the fastcall callee), call the closure, and return how many
+   bytes the callee under-popped (0 == it popped exactly what was pushed).
+
+   Every operand is read into a register up front, while ESP is still at
+   its incoming value, so nothing is referenced through an ESP-relative
+   memory operand after we start moving ESP (which would otherwise read a
+   stale slot, on clang at -O2 in particular).  The stack is then 16-byte
+   aligned at the call as the i386 psABI requires, so the -O2-built closure
+   body may use aligned SSE without faulting; the alignment cancels out of
+   the delta.  ESP is restored to its exact incoming value before the delta
+   is stored, so a wrong pop cannot corrupt our frame.  Not using EBX keeps
+   this compatible with -fPIC; the delta is returned via memory so no free
+   register is needed for it.  */
+static int
+esp_delta (void *code, uint64_t stackarg, unsigned ecxv)
+{
+  unsigned delta;
+  unsigned lo = (unsigned) stackarg;
+  unsigned hi = (unsigned) (stackarg >> 32);
+  __asm__ volatile (
+      "movl %[lo], %%eax\n\t"       /* stash all operands in registers   */
+      "movl %[hi], %%edx\n\t"       /* before ESP moves                  */
+      "movl %[code], %%edi\n\t"
+      "movl %[ecxv], %%ecx\n\t"     /* thiscall 'this'                   */
+      "movl %%esp, %%esi\n\t"       /* remember the real esp             */
+      "andl $-16, %%esp\n\t"        /* 16-byte align, then bias by the   */
+      "subl $8, %%esp\n\t"          /* 8 arg bytes so 'call' is 0 mod 16 */
+      "pushl %%edx\n\t"             /* high dword                        */
+      "pushl %%eax\n\t"             /* low dword                         */
+      "calll *%%edi\n\t"
+      "movl %%esi, %%eax\n\t"       /* recompute esp just before the     */
+      "andl $-16, %%eax\n\t"        /* pushes...                         */
+      "subl $8, %%eax\n\t"
+      "subl %%esp, %%eax\n\t"       /* eax = under-popped byte count     */
+      "movl %%esi, %%esp\n\t"       /* restore before touching memory    */
+      "movl %%eax, %[delta]\n\t"
+      : [delta] "=m" (delta)
+      : [lo] "m" (lo), [hi] "m" (hi), [code] "m" (code), [ecxv] "m" (ecxv)
+      : "memory", "cc", "eax", "ecx", "edx", "esi", "edi");
+  return (int) delta;
+}
+
+static int
+check_abi (ffi_abi abi, unsigned nargs, ffi_type **atypes, unsigned ecx)
+{
+  ffi_cif cif;
+  ffi_closure *closure;
+  void *code;
+  int delta;
+
+  closure = ffi_closure_alloc (sizeof (ffi_closure), &code);
+  CHECK (closure != NULL);
+  CHECK (ffi_prep_cif (&cif, abi, nargs, &ffi_type_void, atypes) == FFI_OK);
+  CHECK (ffi_prep_closure_loc (closure, &cif, cb, NULL, code) == FFI_OK);
+
+  ran = 0;
+  received = 0;
+  delta = esp_delta (code, 0x1122334455667788ULL, ecx);
+
+  CHECK (ran == 1);
+  CHECK (received == 0x1122334455667788ULL);
+  ffi_closure_free (closure);
+  return delta;
+}
+
+int
+main (void)
+{
+  ffi_type *fastcall_args[1] = { &ffi_type_uint64 };
+  ffi_type *thiscall_args[2] = { &ffi_type_pointer, &ffi_type_uint64 };
+  int d;
+
+  /* FASTCALL void cb(uint64_t): the uint64 is stack-resident; pop must be 8. */
+  d = check_abi (FFI_FASTCALL, 1, fastcall_args, 0);
+  printf ("FASTCALL uint64 esp delta: %d\n", d);
+  CHECK (d == 0);
+
+  /* THISCALL void cb(void*, uint64_t): 'this' in ECX, uint64 on the stack;
+     pop must be 8 (not 4).  */
+  d = check_abi (FFI_THISCALL, 2, thiscall_args, 0xdeadbeef);
+  printf ("THISCALL this+uint64 esp delta: %d\n", d);
+  CHECK (d == 0);
+
+  exit (0);
+}
+
+#else
+
+int
+main (void)
+{
+  /* Not an i386 GNU target: nothing to check here. */
+  exit (0);
+}
+
+#endif
diff --git a/deps/libffi/testsuite/libffi.call/many_large_structs.c b/deps/libffi/testsuite/libffi.call/many_large_structs.c
new file mode 100644
index 000000000000..9f766a9113c6
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.call/many_large_structs.c
@@ -0,0 +1,88 @@
+/* Area:	ffi_call
+   Purpose:	Pass many large by-value structs on AArch64.
+   Limitations:	none.
+   PR:		none.
+   Originator:	AArch64 large-struct stack accounting regression.
+
+   Regression test: on AArch64, composites larger than 16 bytes are passed
+   by invisible reference.  ffi_call copies each payload into the argument
+   slab (growing down from the top) and, once X0-X7 are exhausted, also
+   spills the by-ref pointer into the same slab (the NSAA, growing up).
+   The generic prep_cif budget in cif->bytes only charged the payload copy,
+   not the 8-byte pointer slot, so with enough large structs the two regions
+   collided and a later payload copy overwrote an already-spilled pointer,
+   leaving the callee with a corrupt pointer for a by-value argument.
+   Passing sixteen 32-byte (non-HFA) structs by value -- eight more than the
+   argument registers -- must marshal every argument intact.  */
+
+/* { dg-do run } */
+#include "ffitest.h"
+
+#define NARGS 16
+#define SSIZE 32
+
+typedef struct { unsigned char b[SSIZE]; } big_struct;
+
+/* Sum every byte of every argument.  A corrupted by-ref pointer makes the
+   callee read the wrong memory, so the sum no longer matches.  */
+static int ABI_ATTR
+sum_bytes (big_struct s0, big_struct s1, big_struct s2, big_struct s3,
+	   big_struct s4, big_struct s5, big_struct s6, big_struct s7,
+	   big_struct s8, big_struct s9, big_struct s10, big_struct s11,
+	   big_struct s12, big_struct s13, big_struct s14, big_struct s15)
+{
+  big_struct *all[NARGS];
+  int i, j, sum = 0;
+
+  all[0] = &s0;   all[1] = &s1;   all[2] = &s2;   all[3] = &s3;
+  all[4] = &s4;   all[5] = &s5;   all[6] = &s6;   all[7] = &s7;
+  all[8] = &s8;   all[9] = &s9;   all[10] = &s10; all[11] = &s11;
+  all[12] = &s12; all[13] = &s13; all[14] = &s14; all[15] = &s15;
+
+  for (i = 0; i < NARGS; i++)
+    for (j = 0; j < SSIZE; j++)
+      sum += all[i]->b[j];
+
+  return sum;
+}
+
+int main (void)
+{
+  ffi_cif cif;
+  ffi_type *args[NARGS];
+  void *values[NARGS];
+  ffi_type bs_type;
+  ffi_type *bs_elements[SSIZE + 1];
+  big_struct in[NARGS];
+  ffi_arg result = 0;
+  int i, j, expected = 0;
+
+  bs_type.size = 0;
+  bs_type.alignment = 0;
+  bs_type.type = FFI_TYPE_STRUCT;
+  for (i = 0; i < SSIZE; i++)
+    bs_elements[i] = &ffi_type_uchar;
+  bs_elements[SSIZE] = NULL;
+  bs_type.elements = bs_elements;
+
+  /* Fill struct i with the distinct byte value (i + 1) so any pointer
+     mix-up between arguments changes the total.  */
+  for (i = 0; i < NARGS; i++)
+    {
+      for (j = 0; j < SSIZE; j++)
+	{
+	  in[i].b[j] = (unsigned char) (i + 1);
+	  expected += (i + 1);
+	}
+      args[i] = &bs_type;
+      values[i] = &in[i];
+    }
+
+  CHECK(ffi_prep_cif(&cif, ABI_NUM, NARGS, &ffi_type_sint, args) == FFI_OK);
+
+  ffi_call(&cif, FFI_FN(sum_bytes), &result, values);
+
+  CHECK((int) result == expected);
+
+  exit(0);
+}
diff --git a/deps/libffi/testsuite/libffi.call/plan_size.c b/deps/libffi/testsuite/libffi.call/plan_size.c
new file mode 100644
index 000000000000..b8398fbee991
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.call/plan_size.c
@@ -0,0 +1,77 @@
+/* Area:	ffi_call_plan_size
+   Purpose:	Check that a plan reports its own allocation size, that the
+		size is stable across invocations, and that a NULL plan has
+		no footprint.
+   Limitations:	The exact byte count is implementation defined, so this only
+		checks the invariants callers may rely on.
+   PR:		none.
+   Originator:	ffi_call_plan tests  */
+
+/* { dg-do run } */
+#include "ffitest.h"
+
+static uint64_t gp2(uint64_t a, uint64_t b)
+{
+  return a + b * 2;
+}
+
+static uint64_t gp6(uint64_t a, uint64_t b, uint64_t c,
+		    uint64_t d, uint64_t e, uint64_t f)
+{
+  return a + b * 2 + c * 3 + d * 4 + e * 5 + f * 6;
+}
+
+int main (void)
+{
+  ffi_cif cif2, cif6;
+  ffi_type *args[6];
+  void *values[6];
+  ffi_call_plan *plan2, *plan6;
+  size_t size2, size6;
+  uint64_t a[6], r;
+  int i;
+
+  for (i = 0; i < 6; i++)
+    {
+      args[i] = &ffi_type_uint64;
+      a[i] = (uint64_t) (i + 1);
+      values[i] = &a[i];
+    }
+
+  CHECK(ffi_prep_cif(&cif2, FFI_DEFAULT_ABI, 2, &ffi_type_uint64, args)
+	== FFI_OK);
+  CHECK(ffi_prep_cif(&cif6, FFI_DEFAULT_ABI, 6, &ffi_type_uint64, args)
+	== FFI_OK);
+
+  /* A NULL plan has no footprint, mirroring ffi_call_plan_free(NULL).  */
+  CHECK(ffi_call_plan_size(NULL) == 0);
+
+  plan2 = ffi_call_plan_alloc(&cif2);
+  CHECK(plan2 != NULL);
+  plan6 = ffi_call_plan_alloc(&cif6);
+  CHECK(plan6 != NULL);
+
+  size2 = ffi_call_plan_size(plan2);
+  size6 = ffi_call_plan_size(plan6);
+
+  /* Every plan owns at least its handle, and a wider signature never needs
+     less memory than a narrower one of the same shape.  Targets without a
+     fast path report the same constant for both.  */
+  CHECK(size2 > 0);
+  CHECK(size6 >= size2);
+
+  /* The plan is immutable, so querying it must not disturb invocation and
+     the reported size must not drift across calls.  */
+  ffi_call_plan_invoke(plan6, FFI_FN(gp6), &r, values);
+  CHECK(r == gp6(a[0], a[1], a[2], a[3], a[4], a[5]));
+  CHECK(ffi_call_plan_size(plan6) == size6);
+
+  ffi_call_plan_invoke(plan2, FFI_FN(gp2), &r, values);
+  CHECK(r == gp2(a[0], a[1]));
+  CHECK(ffi_call_plan_size(plan2) == size2);
+
+  ffi_call_plan_free(plan2);
+  ffi_call_plan_free(plan6);
+
+  exit(0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/cls_vector.c b/deps/libffi/testsuite/libffi.vector/cls_vector.c
new file mode 100644
index 000000000000..18d8806b51b5
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/cls_vector.c
@@ -0,0 +1,67 @@
+/* Area:	closure_call
+   Purpose:	A closure that receives two vector arguments (and a scalar) and
+		returns a vector.  Exercises the closure argument-extraction and
+		vector return paths.
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef float f32x4 __attribute__((vector_size (16)));
+
+static void
+cls_vector_fn (ffi_cif *cif __UNUSED__, void *resp, void **args,
+	       void *userdata __UNUSED__)
+{
+  f32x4 a = *(f32x4 *) args[0];
+  f32x4 b = *(f32x4 *) args[1];
+  int scale = *(int *) args[2];
+  f32x4 *r = (f32x4 *) resp;
+
+  *r = (a + b) * (float) scale;
+}
+
+typedef f32x4 (*cls_vector_t) (f32x4, f32x4, int);
+
+int
+main (void)
+{
+  ffi_cif cif;
+  void *code;
+  ffi_closure *pcl = ffi_closure_alloc (sizeof (ffi_closure), &code);
+  ffi_type vec_type;
+  ffi_type *vec_elems[5];
+  ffi_type *arg_types[3];
+  f32x4 a = { 1, 2, 3, 4 };
+  f32x4 b = { 10, 20, 30, 40 };
+  f32x4 res;
+  int scale = 2;
+  int i;
+
+  CHECK (pcl != NULL);
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_float, 4);
+
+  arg_types[0] = &vec_type;
+  arg_types[1] = &vec_type;
+  arg_types[2] = &ffi_type_sint;
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 3, &vec_type, arg_types)
+	 == FFI_OK);
+  CHECK (ffi_prep_closure_loc (pcl, &cif, cls_vector_fn, NULL, code)
+	 == FFI_OK);
+
+  res = ((cls_vector_t) code) (a, b, scale);
+
+  for (i = 0; i < 4; i++)
+    {
+      float want = (a[i] + b[i]) * (float) scale;
+      printf ("res[%d] = %g (want %g)\n", i, (double) res[i], (double) want);
+      CHECK (res[i] == want);
+    }
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/ffitest.h b/deps/libffi/testsuite/libffi.vector/ffitest.h
new file mode 100644
index 000000000000..d27d362d6a6e
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/ffitest.h
@@ -0,0 +1 @@
+#include "../libffi.call/ffitest.h"
diff --git a/deps/libffi/testsuite/libffi.vector/vector.exp b/deps/libffi/testsuite/libffi.vector/vector.exp
new file mode 100644
index 000000000000..a76957ee4d33
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector.exp
@@ -0,0 +1,59 @@
+# Copyright (C) 2026 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; see the file COPYING3.  If not see
+# <http://www.gnu.org/licenses/>.
+
+dg-init
+libffi-init
+
+global srcdir subdir
+
+# The tests are written with the GCC/Clang vector extension
+# (__attribute__ ((vector_size (N)))).  A target port can support
+# FFI_TYPE_VECTOR at the ABI level while the compiler under test (e.g.
+# MSVC) cannot compile that syntax, so probe the compiler with an actual
+# compilation, not just a preprocessor check.
+proc libffi_vector_syntax_test { } {
+    set src "vecprobe[pid].c"
+    set obj "vecprobe[pid].o"
+
+    set f [open $src "w"]
+    puts $f "typedef float probe_v4 __attribute__ ((vector_size (16)));"
+    puts $f "probe_v4 probe_var;"
+    puts $f "int main (void) { return 0; }"
+    close $f
+
+    set lines [libffi_target_compile $src $obj object ""]
+    file delete $src
+    file delete $obj
+
+    return [string match "" $lines]
+}
+
+set tlist [lsort [glob -nocomplain -- $srcdir/$subdir/*.{c,cc}]]
+
+if { [libffi_feature_test "#ifdef FFI_TARGET_HAS_VECTOR_TYPE"]
+     && [libffi_vector_syntax_test] } {
+    run-many-tests $tlist ""
+} else {
+    foreach test $tlist {
+	unsupported "$test"
+    }
+}
+
+dg-finish
+
+# Local Variables:
+# tcl-indent-level:4
+# End:
diff --git a/deps/libffi/testsuite/libffi.vector/vector.h b/deps/libffi/testsuite/libffi.vector/vector.h
new file mode 100644
index 000000000000..7baf832d37e4
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector.h
@@ -0,0 +1,32 @@
+/* -*-c-*- */
+/* Shared helpers for the libffi vector (SIMD) tests.
+
+   Vectors are built with the portable GCC/Clang spelling
+   __attribute__((vector_size (N))) so the tests compile on both compilers.
+   A vector ffi_type is described exactly like a struct, except every element
+   points at the SAME scalar ffi_type and the count is the lane count; the
+   caller leaves size and alignment at zero and libffi computes them.  */
+
+#ifndef LIBFFI_VECTOR_H
+#define LIBFFI_VECTOR_H
+
+#include "ffitest.h"
+
+/* Build (into the caller-provided ELEMS array of length COUNT + 1 and the
+   ffi_type object TY) a vector type descriptor of COUNT lanes of scalar type
+   ELEM.  ELEMS must have room for COUNT + 1 pointers (NULL terminator).  */
+static inline void
+make_vector_type (ffi_type *ty, ffi_type **elems, ffi_type *elem,
+		  unsigned count)
+{
+  unsigned i;
+  for (i = 0; i < count; i++)
+    elems[i] = elem;
+  elems[count] = NULL;
+  ty->size = 0;
+  ty->alignment = 0;
+  ty->type = FFI_TYPE_VECTOR;
+  ty->elements = elems;
+}
+
+#endif /* LIBFFI_VECTOR_H */
diff --git a/deps/libffi/testsuite/libffi.vector/vector_args_spill.c b/deps/libffi/testsuite/libffi.vector/vector_args_spill.c
new file mode 100644
index 000000000000..dec6ab2e62af
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_args_spill.c
@@ -0,0 +1,85 @@
+/* Area:	ffi_call
+   Purpose:	Pass many vector arguments interleaved with scalars, enough to
+		exhaust the vector argument registers and spill onto the stack.
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef float f32x4 __attribute__((vector_size (16)));
+
+/* Ten vectors exceeds the 8 vector argument registers on both AArch64 and
+   x86-64, so v8/v9 are passed on the stack.  The scalars are interleaved to
+   make sure the two register files advance independently.  */
+static float
+mix (int i0, f32x4 v0, f32x4 v1, double d0, f32x4 v2, f32x4 v3,
+     f32x4 v4, int i1, f32x4 v5, f32x4 v6, f32x4 v7, double d1,
+     f32x4 v8, f32x4 v9)
+{
+  float acc = 0;
+  acc += 1 * v0[0] + v0[3];
+  acc += 2 * v1[0] + v1[3];
+  acc += 3 * v2[0] + v2[3];
+  acc += 4 * v3[0] + v3[3];
+  acc += 5 * v4[0] + v4[3];
+  acc += 6 * v5[0] + v5[3];
+  acc += 7 * v6[0] + v6[3];
+  acc += 8 * v7[0] + v7[3];
+  acc += 9 * v8[0] + v8[3];
+  acc += 10 * v9[0] + v9[3];
+  acc += i0 + i1 + (float) d0 + (float) d1;
+  return acc;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[5];
+  ffi_type *args[14];
+  void *values[14];
+  f32x4 v[10];
+  int i0 = 100, i1 = 7;
+  double d0 = 3.5, d1 = 0.25;
+  float r, ref;
+  unsigned k;
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_float, 4);
+
+  for (k = 0; k < 10; k++)
+    {
+      f32x4 t = { (float) (k + 1), 0, 0, (float) (100 + k) };
+      v[k] = t;
+    }
+
+  args[0] = &ffi_type_sint;    values[0] = &i0;
+  args[1] = &vec_type;         values[1] = &v[0];
+  args[2] = &vec_type;         values[2] = &v[1];
+  args[3] = &ffi_type_double;  values[3] = &d0;
+  args[4] = &vec_type;         values[4] = &v[2];
+  args[5] = &vec_type;         values[5] = &v[3];
+  args[6] = &vec_type;         values[6] = &v[4];
+  args[7] = &ffi_type_sint;    values[7] = &i1;
+  args[8] = &vec_type;         values[8] = &v[5];
+  args[9] = &vec_type;         values[9] = &v[6];
+  args[10] = &vec_type;        values[10] = &v[7];
+  args[11] = &ffi_type_double; values[11] = &d1;
+  args[12] = &vec_type;        values[12] = &v[8];
+  args[13] = &vec_type;        values[13] = &v[9];
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 14, &ffi_type_float, args)
+	 == FFI_OK);
+
+  ffi_call (&cif, FFI_FN (mix), &r, values);
+
+  ref = mix (i0, v[0], v[1], d0, v[2], v[3], v[4], i1, v[5], v[6], v[7],
+	     d1, v[8], v[9]);
+  printf ("r = %g (want %g)\n", (double) r, (double) ref);
+  CHECK (r == ref);
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_double2.c b/deps/libffi/testsuite/libffi.vector/vector_double2.c
new file mode 100644
index 000000000000..dd45878b5afe
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_double2.c
@@ -0,0 +1,53 @@
+/* Area:	ffi_call
+   Purpose:	Pass and return a 16-byte double2 vector (single Q/SSE reg).
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef double d2 __attribute__((vector_size (16)));
+
+static d2
+add_d2 (d2 a, d2 b)
+{
+  return a + b;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[3];
+  ffi_type *args[2];
+  void *values[2];
+  d2 a = { 1.5, 2.5 };
+  d2 b = { 10.0, 20.0 };
+  d2 r, ref;
+  int i;
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_double, 2);
+
+  args[0] = &vec_type;
+  args[1] = &vec_type;
+  values[0] = &a;
+  values[1] = &b;
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 2, &vec_type, args) == FFI_OK);
+  CHECK (vec_type.size == 16);
+  CHECK (vec_type.alignment == 16);
+
+  ffi_call (&cif, FFI_FN (add_d2), &r, values);
+
+  ref = add_d2 (a, b);
+  for (i = 0; i < 2; i++)
+    {
+      printf ("r[%d] = %g (want %g)\n", i, r[i], ref[i]);
+      CHECK (r[i] == ref[i]);
+    }
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_double4.c b/deps/libffi/testsuite/libffi.vector/vector_double4.c
new file mode 100644
index 000000000000..9f4473935929
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_double4.c
@@ -0,0 +1,81 @@
+/* Area:	ffi_call
+   Purpose:	A 32-byte double4 vector.  On AArch64 a bare vector wider than
+		16 bytes is passed by reference and returned in memory (no
+		short-vector register class), so the call must round-trip.  On
+		x86-64 wider-than-16-byte vectors are not implemented, so
+		ffi_prep_cif must report FFI_BAD_TYPEDEF.
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef double d4 __attribute__((vector_size (32)));
+
+/* Only called on ports that can actually marshal a 32-byte vector.  */
+static d4 add_d4 (d4 a, d4 b) __UNUSED__;
+
+static d4
+add_d4 (d4 a, d4 b)
+{
+  return a + b;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[5];
+  ffi_type *args[2];
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_double, 4);
+  args[0] = &vec_type;
+  args[1] = &vec_type;
+
+#if defined(__aarch64__) || defined(_M_ARM64)
+  {
+    void *values[2];
+    d4 a = { 1, 2, 3, 4 };
+    d4 b = { 10, 20, 30, 40 };
+    d4 r, ref;
+    int i;
+
+    values[0] = &a;
+    values[1] = &b;
+
+    CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 2, &vec_type, args) == FFI_OK);
+    CHECK (vec_type.size == 32);
+    CHECK (vec_type.alignment == 16);
+
+    ffi_call (&cif, FFI_FN (add_d4), &r, values);
+
+    ref = add_d4 (a, b);
+    for (i = 0; i < 4; i++)
+      {
+	printf ("r[%d] = %g (want %g)\n", i, r[i], ref[i]);
+	CHECK (r[i] == ref[i]);
+      }
+  }
+#else
+  {
+    /* x86-64 (and any other opted-in port without >16B support): the >16-byte
+       vector must be rejected, both as a return type and as an argument.  */
+    ffi_status s_ret, s_arg;
+
+    s_ret = ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 0, &vec_type, NULL);
+    printf ("32-byte vector return: status %d (want %d = FFI_BAD_TYPEDEF)\n",
+	    s_ret, FFI_BAD_TYPEDEF);
+    CHECK (s_ret == FFI_BAD_TYPEDEF);
+
+    s_arg = ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &ffi_type_void, args);
+    printf ("32-byte vector argument: status %d (want %d = FFI_BAD_TYPEDEF)\n",
+	    s_arg, FFI_BAD_TYPEDEF);
+    CHECK (s_arg == FFI_BAD_TYPEDEF);
+  }
+#endif
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_float32x2.c b/deps/libffi/testsuite/libffi.vector/vector_float32x2.c
new file mode 100644
index 000000000000..f613687a2988
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_float32x2.c
@@ -0,0 +1,53 @@
+/* Area:	ffi_call
+   Purpose:	Pass and return an 8-byte float32x2 vector (single D/SSE reg).
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef float f32x2 __attribute__((vector_size (8)));
+
+static f32x2
+add_f32x2 (f32x2 a, f32x2 b)
+{
+  return a + b;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[3];
+  ffi_type *args[2];
+  void *values[2];
+  f32x2 a = { 3, 4 };
+  f32x2 b = { 5, 6 };
+  f32x2 r, ref;
+  int i;
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_float, 2);
+
+  args[0] = &vec_type;
+  args[1] = &vec_type;
+  values[0] = &a;
+  values[1] = &b;
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 2, &vec_type, args) == FFI_OK);
+  CHECK (vec_type.size == 8);
+  CHECK (vec_type.alignment == 8);
+
+  ffi_call (&cif, FFI_FN (add_f32x2), &r, values);
+
+  ref = add_f32x2 (a, b);
+  for (i = 0; i < 2; i++)
+    {
+      printf ("r[%d] = %g (want %g)\n", i, (double) r[i], (double) ref[i]);
+      CHECK (r[i] == ref[i]);
+    }
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_float32x4.c b/deps/libffi/testsuite/libffi.vector/vector_float32x4.c
new file mode 100644
index 000000000000..971814aaf66c
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_float32x4.c
@@ -0,0 +1,54 @@
+/* Area:	ffi_call
+   Purpose:	Pass and return a 16-byte float32x4 vector (the vec4 shape of
+		libffi/libffi#773).
+   Limitations:	none.
+   PR:		libffi/libffi#773.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef float f32x4 __attribute__((vector_size (16)));
+
+static f32x4
+add_f32x4 (f32x4 a, f32x4 b)
+{
+  return a + b;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[5];
+  ffi_type *args[2];
+  void *values[2];
+  f32x4 a = { 1, 2, 3, 4 };
+  f32x4 b = { 10, 20, 30, 40 };
+  f32x4 r, ref;
+  int i;
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_float, 4);
+
+  args[0] = &vec_type;
+  args[1] = &vec_type;
+  values[0] = &a;
+  values[1] = &b;
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 2, &vec_type, args) == FFI_OK);
+  CHECK (vec_type.size == 16);
+  CHECK (vec_type.alignment == 16);
+
+  ffi_call (&cif, FFI_FN (add_f32x4), &r, values);
+
+  ref = add_f32x4 (a, b);
+  for (i = 0; i < 4; i++)
+    {
+      printf ("r[%d] = %g (want %g)\n", i, (double) r[i], (double) ref[i]);
+      CHECK (r[i] == ref[i]);
+    }
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_hva.c b/deps/libffi/testsuite/libffi.vector/vector_hva.c
new file mode 100644
index 000000000000..5f80da07dfde
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_hva.c
@@ -0,0 +1,74 @@
+/* Area:	ffi_call
+   Purpose:	Pass and return a homogeneous vector aggregate: a struct of two
+		identical 16-byte vectors.  On AArch64 this is an HVA carried in
+		a pair of Q registers; on x86-64 the existing SSE struct
+		classification handles it (four SSE eightbytes).  Both round-trip.
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef float f32x4 __attribute__((vector_size (16)));
+
+struct hva2
+{
+  f32x4 a;
+  f32x4 b;
+};
+
+static struct hva2
+bump (struct hva2 s)
+{
+  s.a = s.a + 1;
+  s.b = s.b + 2;
+  return s;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[5];
+  ffi_type struct_type;
+  ffi_type *struct_elems[3];
+  ffi_type *args[1];
+  void *values[1];
+  struct hva2 in = { { 1, 2, 3, 4 }, { 10, 20, 30, 40 } };
+  struct hva2 out, ref;
+  int i;
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_float, 4);
+
+  struct_elems[0] = &vec_type;
+  struct_elems[1] = &vec_type;
+  struct_elems[2] = NULL;
+  struct_type.size = 0;
+  struct_type.alignment = 0;
+  struct_type.type = FFI_TYPE_STRUCT;
+  struct_type.elements = struct_elems;
+
+  args[0] = &struct_type;
+  values[0] = &in;
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &struct_type, args)
+	 == FFI_OK);
+  CHECK (struct_type.size == 32);
+
+  ffi_call (&cif, FFI_FN (bump), &out, values);
+
+  ref = bump (in);
+  for (i = 0; i < 4; i++)
+    {
+      printf ("a[%d] = %g (want %g), b[%d] = %g (want %g)\n",
+	      i, (double) out.a[i], (double) ref.a[i],
+	      i, (double) out.b[i], (double) ref.b[i]);
+      CHECK (out.a[i] == ref.a[i]);
+      CHECK (out.b[i] == ref.b[i]);
+    }
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_int32x4.c b/deps/libffi/testsuite/libffi.vector/vector_int32x4.c
new file mode 100644
index 000000000000..eaa6b802bab5
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_int32x4.c
@@ -0,0 +1,54 @@
+/* Area:	ffi_call
+   Purpose:	Pass and return a 16-byte int32x4 integer vector.  Integer
+		lanes still travel in a vector register, unlike an HFA of ints.
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+typedef int i32x4 __attribute__((vector_size (16)));
+
+static i32x4
+add_i32x4 (i32x4 a, i32x4 b)
+{
+  return a + b;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[5];
+  ffi_type *args[2];
+  void *values[2];
+  i32x4 a = { 1, 2, 3, 4 };
+  i32x4 b = { 5, 6, 7, 8 };
+  i32x4 r, ref;
+  int i;
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_sint32, 4);
+
+  args[0] = &vec_type;
+  args[1] = &vec_type;
+  values[0] = &a;
+  values[1] = &b;
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 2, &vec_type, args) == FFI_OK);
+  CHECK (vec_type.size == 16);
+  CHECK (vec_type.alignment == 16);
+
+  ffi_call (&cif, FFI_FN (add_i32x4), &r, values);
+
+  ref = add_i32x4 (a, b);
+  for (i = 0; i < 4; i++)
+    {
+      printf ("r[%d] = %d (want %d)\n", i, r[i], ref[i]);
+      CHECK (r[i] == ref[i]);
+    }
+
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_validate.c b/deps/libffi/testsuite/libffi.vector/vector_validate.c
new file mode 100644
index 000000000000..d923ab465fe4
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_validate.c
@@ -0,0 +1,103 @@
+/* Area:	ffi_prep_cif
+   Purpose:	Validate that malformed vector type descriptors are rejected
+		with FFI_BAD_TYPEDEF, and that a well-formed vector is accepted
+		with the computed power-of-two size and min(size,16) alignment.
+   Limitations:	none.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+int
+main (void)
+{
+  ffi_cif cif;
+
+  /* Heterogeneous lanes (float mixed with double) -> FFI_BAD_TYPEDEF.  */
+  {
+    ffi_type vt;
+    ffi_type *elems[3];
+    ffi_type *args[1];
+    elems[0] = &ffi_type_float;
+    elems[1] = &ffi_type_double;
+    elems[2] = NULL;
+    vt.size = 0;
+    vt.alignment = 0;
+    vt.type = FFI_TYPE_VECTOR;
+    vt.elements = elems;
+    args[0] = &vt;
+    CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &ffi_type_void, args)
+	   == FFI_BAD_TYPEDEF);
+  }
+
+  /* An empty (zero-lane) vector -> FFI_BAD_TYPEDEF.  */
+  {
+    ffi_type vt;
+    ffi_type *elems[1];
+    ffi_type *args[1];
+    elems[0] = NULL;
+    vt.size = 0;
+    vt.alignment = 0;
+    vt.type = FFI_TYPE_VECTOR;
+    vt.elements = elems;
+    args[0] = &vt;
+    CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &ffi_type_void, args)
+	   == FFI_BAD_TYPEDEF);
+  }
+
+  /* A non-scalar (struct) lane type -> FFI_BAD_TYPEDEF.  */
+  {
+    ffi_type inner;
+    ffi_type *inner_elems[2];
+    ffi_type vt;
+    ffi_type *elems[3];
+    ffi_type *args[1];
+    inner_elems[0] = &ffi_type_float;
+    inner_elems[1] = NULL;
+    inner.size = 0;
+    inner.alignment = 0;
+    inner.type = FFI_TYPE_STRUCT;
+    inner.elements = inner_elems;
+    elems[0] = &inner;
+    elems[1] = &inner;
+    elems[2] = NULL;
+    vt.size = 0;
+    vt.alignment = 0;
+    vt.type = FFI_TYPE_VECTOR;
+    vt.elements = elems;
+    args[0] = &vt;
+    CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &ffi_type_void, args)
+	   == FFI_BAD_TYPEDEF);
+  }
+
+  /* A well-formed 3 x float vector is accepted with computed layout.  */
+  {
+    ffi_type vt;
+    ffi_type *elems[4];
+    ffi_type *args[1];
+    make_vector_type (&vt, elems, &ffi_type_float, 3);
+    args[0] = &vt;
+    CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &ffi_type_void, args)
+	   == FFI_OK);
+    CHECK (vt.size == 16);         /* 12 rounded up to 16 */
+    CHECK (vt.alignment == 16);    /* min(16, 16) */
+  }
+
+  /* An 8-byte vector gets alignment 8 = min(8, 16).  */
+  {
+    ffi_type vt;
+    ffi_type *elems[3];
+    ffi_type *args[1];
+    make_vector_type (&vt, elems, &ffi_type_float, 2);
+    args[0] = &vt;
+    CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &ffi_type_void, args)
+	   == FFI_OK);
+    CHECK (vt.size == 8);
+    CHECK (vt.alignment == 8);
+  }
+
+  printf ("vector validation ok\n");
+  exit (0);
+}
diff --git a/deps/libffi/testsuite/libffi.vector/vector_vec3.c b/deps/libffi/testsuite/libffi.vector/vector_vec3.c
new file mode 100644
index 000000000000..5a0367283023
--- /dev/null
+++ b/deps/libffi/testsuite/libffi.vector/vector_vec3.c
@@ -0,0 +1,73 @@
+/* Area:	ffi_call
+   Purpose:	Pass and return a three-lane float vector.  Clang's
+		ext_vector_type(3) has 12 bytes of data padded to 16-byte
+		storage; libffi's power-of-two size rule must reproduce that
+		layout so a natively compiled callee agrees.
+   Limitations:	Clang only (GCC's vector_size requires power-of-two totals and
+		rejects a 12-byte vector).  A no-op on other compilers.
+   PR:		none.
+   Originator:	libffi vector support.  */
+
+/* { dg-do run } */
+
+#include "vector.h"
+
+#ifdef __clang__
+
+typedef float f3 __attribute__((ext_vector_type (3)));
+
+static f3
+scale3 (f3 v)
+{
+  f3 r;
+  r[0] = v[0] + 1;
+  r[1] = v[1] + 2;
+  r[2] = v[2] + 3;
+  return r;
+}
+
+int
+main (void)
+{
+  ffi_cif cif;
+  ffi_type vec_type;
+  ffi_type *vec_elems[4];
+  ffi_type *args[1];
+  void *values[1];
+  f3 a = { 10, 20, 30 };
+  f3 r, ref;
+  int i;
+
+  make_vector_type (&vec_type, vec_elems, &ffi_type_float, 3);
+
+  args[0] = &vec_type;
+  values[0] = &a;
+
+  CHECK (ffi_prep_cif (&cif, FFI_DEFAULT_ABI, 1, &vec_type, args) == FFI_OK);
+  /* 3 x float = 12, rounded up to 16 (matches ext_vector_type storage).  */
+  CHECK (vec_type.size == 16);
+  CHECK (vec_type.alignment == 16);
+  CHECK (sizeof (f3) == 16);
+
+  ffi_call (&cif, FFI_FN (scale3), &r, values);
+
+  ref = scale3 (a);
+  for (i = 0; i < 3; i++)
+    {
+      printf ("r[%d] = %g (want %g)\n", i, (double) r[i], (double) ref[i]);
+      CHECK (r[i] == ref[i]);
+    }
+
+  exit (0);
+}
+
+#else
+
+int
+main (void)
+{
+  /* ext_vector_type is a Clang extension; nothing to test elsewhere.  */
+  exit (0);
+}
+
+#endif

From 4160dfdf811553112d19151afa26535bc385b166 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 10 Aug 2026 20:35:47 -0400
Subject: [PATCH 103/344] deps: update googletest to
 d89aac5f0dd4021198d903d39de16f896726de21

PR-URL: https://github.com/nodejs/node/pull/65153
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .../googletest/include/gtest/gtest-matchers.h | 50 ++++++++++++-------
 .../googletest/include/gtest/gtest-printers.h | 12 ++---
 .../internal/gtest-death-test-internal.h      |  5 ++
 .../include/gtest/internal/gtest-internal.h   | 14 +++---
 .../include/gtest/internal/gtest-port.h       | 31 ++++--------
 deps/googletest/src/gtest-matchers.cc         |  2 -
 deps/googletest/src/gtest-printers.cc         |  4 +-
 deps/googletest/src/gtest.cc                  |  2 +-
 8 files changed, 62 insertions(+), 58 deletions(-)

diff --git a/deps/googletest/include/gtest/gtest-matchers.h b/deps/googletest/include/gtest/gtest-matchers.h
index d7bdd047f1a6..b5950425cc69 100644
--- a/deps/googletest/include/gtest/gtest-matchers.h
+++ b/deps/googletest/include/gtest/gtest-matchers.h
@@ -45,6 +45,7 @@
 #include <memory>
 #include <ostream>
 #include <string>
+#include <string_view>
 #include <type_traits>
 
 #include "gtest/gtest-printers.h"
@@ -543,9 +544,8 @@ Matcher<std::string> : public internal::MatcherBase<std::string> {
   Matcher(const char* s);  // NOLINT
 };
 
-#if GTEST_INTERNAL_HAS_STRING_VIEW
 // The following two specializations allow the user to write str
-// instead of Eq(str) and "foo" instead of Eq("foo") when a absl::string_view
+// instead of Eq(str) and "foo" instead of Eq("foo") when a std::string_view
 // matcher is expected.
 template <>
 class GTEST_API_ [[nodiscard]] Matcher<const internal::StringView&>
@@ -569,7 +569,7 @@ class GTEST_API_ [[nodiscard]] Matcher<const internal::StringView&>
   // Allows the user to write "foo" instead of Eq("foo") sometimes.
   Matcher(const char* s);  // NOLINT
 
-  // Allows the user to pass absl::string_views or std::string_views directly.
+  // Allows the user to pass std::string_views directly.
   Matcher(internal::StringView s);  // NOLINT
 };
 
@@ -596,10 +596,9 @@ class GTEST_API_ [[nodiscard]] Matcher<internal::StringView>
   // Allows the user to write "foo" instead of Eq("foo") sometimes.
   Matcher(const char* s);  // NOLINT
 
-  // Allows the user to pass absl::string_views or std::string_views directly.
+  // Allows the user to pass std::string_views directly.
   Matcher(internal::StringView s);  // NOLINT
 };
-#endif  // GTEST_INTERNAL_HAS_STRING_VIEW
 
 // Prints a matcher in a human-readable format.
 template <typename T>
@@ -812,9 +811,26 @@ class [[nodiscard]] ImplicitCastEqMatcher {
   StoredRhs stored_rhs_;
 };
 
-template <typename T,
-          typename = std::enable_if_t<std::is_constructible_v<std::string, T>>>
-using StringLike = T;
+// Dummy function (never defined) whose return type evaluates to std::string if
+// the given type is a string-like type that can be converted to std::string,
+// either directly or through an intermediate std::string_view.
+template <class T>
+extern std::enable_if_t<std::is_constructible_v<std::string, T>, std::string>
+ResolveAsString(const void* /* preferred */);
+
+#if GTEST_HAS_STD_WSTRING
+// Same as above, but for std::wstring. In cases where both conversions are
+// possible, this overload takes lower priority.
+template <class T>
+extern std::enable_if_t<std::is_constructible_v<std::wstring, T>, std::wstring>
+ResolveAsString(... /* fallback */);
+#endif
+
+// Evaluates to the std::basic_string type that the given string-like type can
+// be converted to. Prefers std::string over std::wstring if both are possible.
+// Fails in a SFINAE-friendly way if no conversion was viable.
+template <typename T>
+using StringType = decltype(ResolveAsString<T>(nullptr));
 
 // Implements polymorphic matchers MatchesRegex(regex) and
 // ContainsRegex(regex), which can be used as a Matcher<T> as long as
@@ -824,12 +840,10 @@ class [[nodiscard]] MatchesRegexMatcher {
   MatchesRegexMatcher(const RE* regex, bool full_match)
       : regex_(regex), full_match_(full_match) {}
 
-#if GTEST_INTERNAL_HAS_STRING_VIEW
   bool MatchAndExplain(const internal::StringView& s,
                        MatchResultListener* listener) const {
     return MatchAndExplain(std::string(s), listener);
   }
-#endif  // GTEST_INTERNAL_HAS_STRING_VIEW
 
   // Accepts pointer types, particularly:
   //   const char*
@@ -844,7 +858,7 @@ class [[nodiscard]] MatchesRegexMatcher {
   // Matches anything that can convert to std::string.
   //
   // This is a template, not just a plain function with const std::string&,
-  // because absl::string_view has some interfering non-explicit constructors.
+  // because std::string_view has some interfering non-explicit constructors.
   template <class MatcheeStringType>
   bool MatchAndExplain(const MatcheeStringType& s,
                        MatchResultListener* /* listener */) const {
@@ -877,9 +891,10 @@ inline PolymorphicMatcher<internal::MatchesRegexMatcher> MatchesRegex(
   return MakePolymorphicMatcher(internal::MatchesRegexMatcher(regex, true));
 }
 template <typename T = std::string>
-PolymorphicMatcher<internal::MatchesRegexMatcher> MatchesRegex(
-    const internal::StringLike<T>& regex) {
-  return MatchesRegex(new internal::RE(std::string(regex)));
+std::enable_if_t<std::is_constructible_v<internal::RE, internal::StringType<T>>,
+                 PolymorphicMatcher<internal::MatchesRegexMatcher>>
+MatchesRegex(const T& regex) {
+  return MatchesRegex(new internal::RE(internal::StringType<T>(regex)));
 }
 
 // Matches a string that contains regular expression 'regex'.
@@ -889,9 +904,10 @@ inline PolymorphicMatcher<internal::MatchesRegexMatcher> ContainsRegex(
   return MakePolymorphicMatcher(internal::MatchesRegexMatcher(regex, false));
 }
 template <typename T = std::string>
-PolymorphicMatcher<internal::MatchesRegexMatcher> ContainsRegex(
-    const internal::StringLike<T>& regex) {
-  return ContainsRegex(new internal::RE(std::string(regex)));
+std::enable_if_t<std::is_constructible_v<internal::RE, internal::StringType<T>>,
+                 PolymorphicMatcher<internal::MatchesRegexMatcher>>
+ContainsRegex(const T& regex) {
+  return ContainsRegex(new internal::RE(internal::StringType<T>(regex)));
 }
 
 // Creates a polymorphic matcher that matches anything equal to x.
diff --git a/deps/googletest/include/gtest/gtest-printers.h b/deps/googletest/include/gtest/gtest-printers.h
index fc0913ff0094..315ce0a51016 100644
--- a/deps/googletest/include/gtest/gtest-printers.h
+++ b/deps/googletest/include/gtest/gtest-printers.h
@@ -291,11 +291,9 @@ struct ConvertibleToIntegerPrinter {
 };
 
 struct ConvertibleToStringViewPrinter {
-#if GTEST_INTERNAL_HAS_STRING_VIEW
   static void PrintValue(internal::StringView value, ::std::ostream* os) {
     internal::UniversalPrint(value, os);
   }
-#endif
 };
 
 #ifdef GTEST_HAS_ABSL
@@ -703,12 +701,12 @@ void PrintRawArrayTo(const T a[], size_t count, ::std::ostream* os) {
   }
 }
 
-// Overloads for ::std::string and ::std::string_view
-GTEST_API_ void PrintStringTo(::std::string_view s, ::std::ostream* os);
+// Overloads for ::std::string and std::string_view
+GTEST_API_ void PrintStringTo(std::string_view s, ::std::ostream* os);
 inline void PrintTo(const ::std::string& s, ::std::ostream* os) {
   PrintStringTo(s, os);
 }
-inline void PrintTo(::std::string_view s, ::std::ostream* os) {
+inline void PrintTo(std::string_view s, ::std::ostream* os) {
   PrintStringTo(s, os);
 }
 
@@ -752,16 +750,14 @@ inline void PrintTo(::std::wstring_view s, ::std::ostream* os) {
 }
 #endif  // GTEST_HAS_STD_WSTRING
 
-#if GTEST_INTERNAL_HAS_STRING_VIEW
 // Overload for internal::StringView. Needed for build configurations where
 // internal::StringView is an alias for absl::string_view, but absl::string_view
 // is a distinct type from std::string_view.
 template <int&... ExplicitArgumentBarrier, typename T = internal::StringView,
-          std::enable_if_t<!std::is_same_v<T, ::std::string_view>, int> = 0>
+          std::enable_if_t<!std::is_same_v<T, std::string_view>, int> = 0>
 inline void PrintTo(internal::StringView sp, ::std::ostream* os) {
   PrintStringTo(sp, os);
 }
-#endif  // GTEST_INTERNAL_HAS_STRING_VIEW
 
 inline void PrintTo(std::nullptr_t, ::std::ostream* os) { *os << "(nullptr)"; }
 
diff --git a/deps/googletest/include/gtest/internal/gtest-death-test-internal.h b/deps/googletest/include/gtest/internal/gtest-death-test-internal.h
index f88e2049c249..f0f93e520b7b 100644
--- a/deps/googletest/include/gtest/internal/gtest-death-test-internal.h
+++ b/deps/googletest/include/gtest/internal/gtest-death-test-internal.h
@@ -43,6 +43,7 @@
 
 #include <memory>
 #include <string>
+#include <string_view>
 
 #include "gtest/gtest-matchers.h"
 #include "gtest/internal/gtest-internal.h"
@@ -63,6 +64,10 @@ inline Matcher<const ::std::string&> MakeDeathTestMatcher(
     ::testing::internal::RE regex) {
   return ContainsRegex(regex.pattern());
 }
+inline Matcher<const ::std::string&> MakeDeathTestMatcher(
+    std::string_view regex) {
+  return ContainsRegex(regex);
+}
 inline Matcher<const ::std::string&> MakeDeathTestMatcher(const char* regex) {
   return ContainsRegex(regex);
 }
diff --git a/deps/googletest/include/gtest/internal/gtest-internal.h b/deps/googletest/include/gtest/internal/gtest-internal.h
index 2b048c5dc098..55e9966720bf 100644
--- a/deps/googletest/include/gtest/internal/gtest-internal.h
+++ b/deps/googletest/include/gtest/internal/gtest-internal.h
@@ -1451,13 +1451,13 @@ class [[nodiscard]] NeverThrown {
 // Implements Boolean test assertions such as EXPECT_TRUE. expression can be
 // either a boolean expression or an AssertionResult. text is a textual
 // representation of expression as it was passed into the EXPECT_TRUE.
-#define GTEST_TEST_BOOLEAN_(expression, text, actual, expected, fail) \
-  GTEST_AMBIGUOUS_ELSE_BLOCKER_                                       \
-  if (::testing::internal::AssertionResultExpectation gtest_are_ = {  \
-          ::testing::AssertionResult(expression), expected})          \
-    ;                                                                 \
-  else                                                                \
-    fail(::testing::internal::GetBoolAssertionFailureMessage(         \
+#define GTEST_TEST_BOOLEAN_(expression, text, actual, expected, fail)      \
+  GTEST_AMBIGUOUS_ELSE_BLOCKER_                                            \
+  if (const ::testing::internal::AssertionResultExpectation gtest_are_ = { \
+          ::testing::AssertionResult(expression), expected})               \
+    ;                                                                      \
+  else /* NOLINT */                                                        \
+    fail(::testing::internal::GetBoolAssertionFailureMessage(              \
         gtest_are_.assertion_result, text, #actual, #expected))
 
 #define GTEST_TEST_NO_FATAL_FAILURE_(statement, fail)               \
diff --git a/deps/googletest/include/gtest/internal/gtest-port.h b/deps/googletest/include/gtest/internal/gtest-port.h
index 31654b09c1dc..92e6591d2cec 100644
--- a/deps/googletest/include/gtest/internal/gtest-port.h
+++ b/deps/googletest/include/gtest/internal/gtest-port.h
@@ -293,9 +293,10 @@
 #include <limits>
 #include <locale>
 #include <memory>
+// #include <mutex>  // Guarded by GTEST_IS_THREADSAFE below
 #include <ostream>
 #include <string>
-// #include <mutex>  // Guarded by GTEST_IS_THREADSAFE below
+#include <string_view>
 #include <tuple>
 #include <type_traits>
 #include <vector>
@@ -949,21 +950,21 @@ GTEST_API_ bool IsTrue(bool condition);
 #ifdef GTEST_USES_RE2
 
 // This is almost `using RE = ::RE2`, except it is copy-constructible, and it
-// needs to disambiguate the `std::string`, `absl::string_view`, and `const
+// needs to disambiguate the `std::string`, `std::string_view`, and `const
 // char*` constructors.
 class GTEST_API_ [[nodiscard]] RE {
  public:
-  RE(absl::string_view regex) : regex_(regex) {}                  // NOLINT
-  RE(const char* regex) : RE(absl::string_view(regex)) {}         // NOLINT
-  RE(const std::string& regex) : RE(absl::string_view(regex)) {}  // NOLINT
+  RE(std::string_view regex) : regex_(regex) {}                  // NOLINT
+  RE(const char* regex) : RE(std::string_view(regex)) {}         // NOLINT
+  RE(const std::string& regex) : RE(std::string_view(regex)) {}  // NOLINT
   RE(const RE& other) : RE(other.pattern()) {}
 
   const std::string& pattern() const { return regex_.pattern(); }
 
-  static bool FullMatch(absl::string_view str, const RE& re) {
+  static bool FullMatch(std::string_view str, const RE& re) {
     return RE2::FullMatch(str, re.regex_);
   }
-  static bool PartialMatch(absl::string_view str, const RE& re) {
+  static bool PartialMatch(std::string_view str, const RE& re) {
     return RE2::PartialMatch(str, re.regex_);
   }
 
@@ -2396,7 +2397,6 @@ const char* StringFromGTestEnv(const char* flag, const char* default_val);
 #ifdef GTEST_HAS_ABSL
 // Always use absl::string_view for Matcher<> specializations if googletest
 // is built with absl support.
-#define GTEST_INTERNAL_HAS_STRING_VIEW 1
 #include "absl/strings/string_view.h"
 namespace testing {
 namespace internal {
@@ -2404,26 +2404,15 @@ using StringView = ::absl::string_view;
 }  // namespace internal
 }  // namespace testing
 #else
-#if defined(__cpp_lib_string_view) ||             \
-    (GTEST_INTERNAL_HAS_INCLUDE(<string_view>) && \
-     GTEST_INTERNAL_CPLUSPLUS_LANG >= 201703L)
 // Otherwise for C++17 and higher use std::string_view for Matcher<>
 // specializations.
-#define GTEST_INTERNAL_HAS_STRING_VIEW 1
-#include <string_view>
 namespace testing {
 namespace internal {
-using StringView = ::std::string_view;
+using StringView = std::string_view;
 }  // namespace internal
 }  // namespace testing
-// The case where absl is configured NOT to alias std::string_view is not
-// supported.
-#endif  // __cpp_lib_string_view
 #endif  // GTEST_HAS_ABSL
-
-#ifndef GTEST_INTERNAL_HAS_STRING_VIEW
-#define GTEST_INTERNAL_HAS_STRING_VIEW 0
-#endif
+#define GTEST_INTERNAL_HAS_STRING_VIEW 1
 
 #if defined(__cpp_lib_three_way_comparison)
 #define GTEST_INTERNAL_HAS_COMPARE_LIB 1
diff --git a/deps/googletest/src/gtest-matchers.cc b/deps/googletest/src/gtest-matchers.cc
index 7e3bcc0cff38..626019e2389f 100644
--- a/deps/googletest/src/gtest-matchers.cc
+++ b/deps/googletest/src/gtest-matchers.cc
@@ -59,7 +59,6 @@ Matcher<std::string>::Matcher(const std::string& s) { *this = Eq(s); }
 // s.
 Matcher<std::string>::Matcher(const char* s) { *this = Eq(std::string(s)); }
 
-#if GTEST_INTERNAL_HAS_STRING_VIEW
 // Constructs a matcher that matches a const StringView& whose value is
 // equal to s.
 Matcher<const internal::StringView&>::Matcher(const std::string& s) {
@@ -93,6 +92,5 @@ Matcher<internal::StringView>::Matcher(const char* s) {
 Matcher<internal::StringView>::Matcher(internal::StringView s) {
   *this = Eq(std::string(s));
 }
-#endif  // GTEST_INTERNAL_HAS_STRING_VIEW
 
 }  // namespace testing
diff --git a/deps/googletest/src/gtest-printers.cc b/deps/googletest/src/gtest-printers.cc
index 6d1de6d9506f..7c0ecc6ad1c9 100644
--- a/deps/googletest/src/gtest-printers.cc
+++ b/deps/googletest/src/gtest-printers.cc
@@ -515,13 +515,13 @@ bool IsValidUTF8(const char* str, size_t length) {
 void ConditionalPrintAsText(const char* str, size_t length, ostream* os) {
   if (!ContainsUnprintableControlCodes(str, length) &&
       IsValidUTF8(str, length)) {
-    *os << "\n    As Text: \"" << ::std::string_view(str, length) << "\"";
+    *os << "\n    As Text: \"" << std::string_view(str, length) << "\"";
   }
 }
 
 }  // anonymous namespace
 
-void PrintStringTo(::std::string_view s, ostream* os) {
+void PrintStringTo(std::string_view s, ostream* os) {
   if (PrintCharsAsStringTo(s.data(), s.size(), os) == kHexEscape) {
     if (GTEST_FLAG_GET(print_utf8)) {
       ConditionalPrintAsText(s.data(), s.size(), os);
diff --git a/deps/googletest/src/gtest.cc b/deps/googletest/src/gtest.cc
index 307ecc6f0b9c..3c855468268f 100644
--- a/deps/googletest/src/gtest.cc
+++ b/deps/googletest/src/gtest.cc
@@ -6930,7 +6930,7 @@ void ParseGoogleTestFlagsOnly(int* argc, char** argv) {
   std::vector<char*> positional_args;
   std::vector<absl::UnrecognizedFlag> unrecognized_flags;
   absl::ParseAbseilFlagsOnly(*argc, argv, positional_args, unrecognized_flags);
-  absl::flat_hash_set<absl::string_view> unrecognized;
+  absl::flat_hash_set<std::string_view> unrecognized;
   for (const auto& flag : unrecognized_flags) {
     unrecognized.insert(flag.flag_name);
   }

From 69e4fabb29641566a3de03e3b8cbb4e8463bbe9a Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 10 Aug 2026 20:35:58 -0400
Subject: [PATCH 104/344] test: update WPT for urlpattern to 4832db4761

PR-URL: https://github.com/nodejs/node/pull/65151
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 test/fixtures/wpt/urlpattern/WEB_FEATURES.yml | 5 ++---
 test/fixtures/wpt/versions.json               | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/test/fixtures/wpt/urlpattern/WEB_FEATURES.yml b/test/fixtures/wpt/urlpattern/WEB_FEATURES.yml
index cb82ba5cda29..f6d02d253e41 100644
--- a/test/fixtures/wpt/urlpattern/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/urlpattern/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: urlpattern
-  files: "**"
+rules:
+- "**": [urlpattern]
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index 4c01b3e53663..c423893c7a9a 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -76,7 +76,7 @@
     "path": "url"
   },
   "urlpattern": {
-    "commit": "5847ee5cfa4f710cbb78ab9ef5cc66f74433ee03",
+    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
     "path": "urlpattern"
   },
   "user-timing": {

From cc19107e5da1fdf715139231bb32473e0f14917a Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 10 Aug 2026 20:36:14 -0400
Subject: [PATCH 105/344] test: update WPT for WebCryptoAPI to 4c2fd05ed5

PR-URL: https://github.com/nodejs/node/pull/65150
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .../wpt/WebCryptoAPI/generateKey/failures.js  | 140 +++++++++---------
 .../failures_bad_algorithm.https.any.js       |   5 +
 .../wpt/WebCryptoAPI/generateKey/successes.js |  21 +++
 test/fixtures/wpt/versions.json               |   2 +-
 4 files changed, 98 insertions(+), 70 deletions(-)
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/generateKey/failures_bad_algorithm.https.any.js

diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
index 2a618ce4ab25..e4a75c065152 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
@@ -1,6 +1,3 @@
-function run_test(algorithmNames) {
-    var subtle = crypto.subtle; // Change to test prefixed implementations
-
 // These tests check that generateKey throws an error, and that
 // the error is of the right type, for a wide set of incorrect parameters.
 //
@@ -19,42 +16,83 @@ function run_test(algorithmNames) {
 // helper functions that generate all possible test parameters for
 // different situations.
 
-    var testVectors = getGenerateKeyTestVectors(algorithmNames);
+function parameterString(algorithm, extractable, usages) {
+    if (typeof algorithm !== "object" && typeof algorithm !== "string") {
+        alert(algorithm);
+    }
 
+    var result = "(" +
+                    objectToString(algorithm) + ", " +
+                    objectToString(extractable) + ", " +
+                    objectToString(usages) +
+                 ")";
 
-    function parameterString(algorithm, extractable, usages) {
-        if (typeof algorithm !== "object" && typeof algorithm !== "string") {
-            alert(algorithm);
-        }
+    return result;
+}
 
-        var result = "(" +
-                        objectToString(algorithm) + ", " +
-                        objectToString(extractable) + ", " +
-                        objectToString(usages) +
-                     ")";
+// Test that a given combination of parameters results in an error,
+// AND that it is the correct kind of error.
+//
+// Expected error is either a number, tested against the error code,
+// or a string, tested against the error name.
+function testError(algorithm, extractable, usages, expectedError, testTag) {
+    promise_test(function(test) {
+        return crypto.subtle.generateKey(algorithm, extractable, usages)
+        .then(function(result) {
+            assert_unreached("Operation succeeded, but should not have");
+        }, function(err) {
+            if (typeof expectedError === "number") {
+                assert_equals(err.code, expectedError, testTag + " not supported");
+            } else {
+                assert_equals(err.name, expectedError, testTag + " not supported");
+            }
+        });
+    }, testTag + ": generateKey" + parameterString(algorithm, extractable, usages));
+}
 
-        return result;
-    }
 
-    // Test that a given combination of parameters results in an error,
-    // AND that it is the correct kind of error.
-    //
-    // Expected error is either a number, tested against the error code,
-    // or a string, tested against the error name.
-    function testError(algorithm, extractable, usages, expectedError, testTag) {
-        promise_test(function(test) {
-            return crypto.subtle.generateKey(algorithm, extractable, usages)
-            .then(function(result) {
-                assert_unreached("Operation succeeded, but should not have");
-            }, function(err) {
-                if (typeof expectedError === "number") {
-                    assert_equals(err.code, expectedError, testTag + " not supported");
-                } else {
-                    assert_equals(err.name, expectedError, testTag + " not supported");
-                }
+// Algorithm normalization happens before generateKey looks at any other
+// argument, so these cases are independent of the algorithm under test and
+// only need to run once for the whole suite.
+function run_bad_algorithm_test() {
+    // Algorithm normalization should fail with "Not supported"
+    var badAlgorithmNames = [
+        "AES",
+        {name: "AES"},
+        {name: "AES", length: 128},
+        {name: "AES-CMAC", length: 128},    // Removed after CR
+        {name: "AES-CFB", length: 128},      // Removed after CR
+        {name: "HMAC", hash: "MD5"},
+        {name: "RSA", hash: "SHA-256", modulusLength: 2048, publicExponent: new Uint8Array([1,0,1])},
+        {name: "RSA-PSS", hash: "SHA", modulusLength: 2048, publicExponent: new Uint8Array([1,0,1])},
+        {name: "EC", namedCurve: "P521"}
+    ];
+
+
+    // Algorithm normalization failures should be found first
+    // - all other parameters can be good or bad, should fail
+    //   due to NotSupportedError.
+    badAlgorithmNames.forEach(function(algorithm) {
+        allValidUsages(["decrypt", "sign", "deriveBits"], true, []) // Small search space, shouldn't matter because should fail before used
+        .forEach(function(usages) {
+            [false, true, "RED", 7].forEach(function(extractable){
+                testError(algorithm, extractable, usages, "NotSupportedError", "Bad algorithm");
             });
-        }, testTag + ": generateKey" + parameterString(algorithm, extractable, usages));
-    }
+        });
+    });
+
+    // Empty algorithm should fail with TypeError
+    allValidUsages(["decrypt", "sign", "deriveBits"], true, []) // Small search space, shouldn't matter because should fail before used
+        .forEach(function(usages) {
+            [false, true, "RED", 7].forEach(function(extractable){
+                testError({}, extractable, usages, "TypeError", "Empty algorithm");
+            });
+        });
+}
+
+
+function run_test(algorithmNames) {
+    var testVectors = getGenerateKeyTestVectors(algorithmNames);
 
 
     // Given an algorithm name, create several invalid parameters.
@@ -108,45 +146,9 @@ function run_test(algorithmNames) {
 
 
 // Now test for properly handling errors
-// - Unsupported algorithm
 // - Bad usages for algorithm
 // - Bad key lengths
 
-    // Algorithm normalization should fail with "Not supported"
-    var badAlgorithmNames = [
-        "AES",
-        {name: "AES"},
-        {name: "AES", length: 128},
-        {name: "AES-CMAC", length: 128},    // Removed after CR
-        {name: "AES-CFB", length: 128},      // Removed after CR
-        {name: "HMAC", hash: "MD5"},
-        {name: "RSA", hash: "SHA-256", modulusLength: 2048, publicExponent: new Uint8Array([1,0,1])},
-        {name: "RSA-PSS", hash: "SHA", modulusLength: 2048, publicExponent: new Uint8Array([1,0,1])},
-        {name: "EC", namedCurve: "P521"}
-    ];
-
-
-    // Algorithm normalization failures should be found first
-    // - all other parameters can be good or bad, should fail
-    //   due to NotSupportedError.
-    badAlgorithmNames.forEach(function(algorithm) {
-        allValidUsages(["decrypt", "sign", "deriveBits"], true, []) // Small search space, shouldn't matter because should fail before used
-        .forEach(function(usages) {
-            [false, true, "RED", 7].forEach(function(extractable){
-                testError(algorithm, extractable, usages, "NotSupportedError", "Bad algorithm");
-            });
-        });
-    });
-
-    // Empty algorithm should fail with TypeError
-    allValidUsages(["decrypt", "sign", "deriveBits"], true, []) // Small search space, shouldn't matter because should fail before used
-        .forEach(function(usages) {
-            [false, true, "RED", 7].forEach(function(extractable){
-                testError({}, extractable, usages, "TypeError", "Empty algorithm");
-            });
-        });
-
-
     // Algorithms normalize okay, but usages bad (though not empty).
     // It shouldn't matter what other extractable is. Should fail
     // due to SyntaxError
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_bad_algorithm.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_bad_algorithm.https.any.js
new file mode 100644
index 000000000000..5fe0b15784e3
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_bad_algorithm.https.any.js
@@ -0,0 +1,5 @@
+// META: title=WebCryptoAPI: generateKey() for Failures
+// META: timeout=long
+// META: script=../util/helpers.js
+// META: script=failures.js
+run_bad_algorithm_test();
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
index 5006cd35ad9c..c70ecb331873 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
@@ -110,6 +110,27 @@ function run_test(algorithmNames, slowTest) {
                 assert_unreached("exportKey threw an unexpected error: " + err.toString());
             })
         }, testTag + ": generateKey" + parameterString(algorithm, extractable, usages));
+
+        // Special case for ECDH and ECDSA: check that the generated key length is consistent.
+        // Particularly for P-521, there is a high risk of the generated key being one byte short
+        // if the implementation isn't careful.
+        if (algorithm.namedCurve && extractable) {
+            promise_test(async function(test) {
+                // We run about 20 variants of this test, times 10 key generations below,
+                // so this should have a decent chance of catching issues.
+                await Promise.all(Array.from({ length: 10 }).map(async () => {
+                    const { privateKey, publicKey } = await subtle.generateKey(algorithm, extractable, usages);
+                    const [jwkPub, jwkPriv] = await Promise.all([
+                        subtle.exportKey('jwk', publicKey),
+                        subtle.exportKey('jwk', privateKey),
+                    ]);
+                    const expectedLength = Math.ceil(Math.ceil(parseInt(algorithm.namedCurve.substring(2)) / 8) * 4/3);
+                    assert_equals(jwkPub.x.length, expectedLength, "Public key value x has correct length");
+                    assert_equals(jwkPub.y.length, expectedLength, "Public key value y has correct length");
+                    assert_equals(jwkPriv.d.length, expectedLength, "Private key value d has correct length");
+                }));
+            }, testTag + ": generateKey" + parameterString(algorithm, extractable, usages) + " produces consistent length key");
+        }
     }
 
     // Test all valid sets of parameters for successful
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index c423893c7a9a..b659c868d498 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -96,7 +96,7 @@
     "path": "web-locks"
   },
   "WebCryptoAPI": {
-    "commit": "82c3d9069cf2e93e5528a1f428fa122bd9af651d",
+    "commit": "4c2fd05ed5d0b90a9e1fcdcb35f6671bd461de0d",
     "path": "WebCryptoAPI"
   },
   "webidl": {

From f45dc929136261392a9139addc08712be4619200 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 10 Aug 2026 20:36:25 -0400
Subject: [PATCH 106/344] deps: update undici to 8.10.0

PR-URL: https://github.com/nodejs/node/pull/65155
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 deps/undici/src/docs/docs/api/Client.md       |  29 +-
 deps/undici/src/lib/api/readable.js           |  76 ++---
 deps/undici/src/lib/core/connect.js           |  18 +-
 deps/undici/src/lib/core/symbols.js           |   1 +
 deps/undici/src/lib/dispatcher/client-h1.js   |   6 +-
 deps/undici/src/lib/dispatcher/client-h2.js   | 189 +++++++++-
 deps/undici/src/lib/dispatcher/client.js      | 103 ++++--
 .../lib/dispatcher/env-http-proxy-agent.js    |  34 +-
 .../src/lib/dispatcher/socks5-proxy-agent.js  |  16 +-
 deps/undici/src/lib/handler/retry-handler.js  |   9 +-
 deps/undici/src/lib/interceptor/cache.js      |   7 +-
 .../undici/src/lib/interceptor/deduplicate.js |   2 +-
 deps/undici/src/lib/llhttp/wasm_build_env.txt |   2 +-
 deps/undici/src/lib/mock/mock-utils.js        | 237 +++++++++++--
 deps/undici/src/lib/util/cache.js             |   6 +-
 .../undici/src/lib/web/websocket/websocket.js |  22 ++
 deps/undici/src/package-lock.json             |   4 +-
 deps/undici/src/package.json                  |   2 +-
 deps/undici/src/types/client.d.ts             |  40 +++
 deps/undici/undici.js                         | 323 ++++++++++++++----
 src/undici_version.h                          |   2 +-
 21 files changed, 916 insertions(+), 212 deletions(-)

diff --git a/deps/undici/src/docs/docs/api/Client.md b/deps/undici/src/docs/docs/api/Client.md
index dc6ab7a6d5f9..d48b2303f287 100644
--- a/deps/undici/src/docs/docs/api/Client.md
+++ b/deps/undici/src/docs/docs/api/Client.md
@@ -111,22 +111,35 @@ added: v1.0.0
     `autoSelectFamily` is enabled. **Default:** `250`.
   * `allowH2` {boolean} Enables HTTP/2 support when the server assigns it a
     higher priority through ALPN negotiation. **Default:** `true`.
-  * `useH2c` {boolean} Enforces h2c (HTTP/2 cleartext) for non-HTTPS
-    connections. **Default:** `false`.
-  * `maxConcurrentStreams` {number} The maximum number of concurrent HTTP/2
+  * `useH2c` {boolean} _Deprecated: use h2Options.useH2c instead_ Enforces h2c (HTTP/2 cleartext) for non-HTTPS
+  connections. **Default:** `false`.
+  * `maxConcurrentStreams` {number} _Deprecated: use h2Options.useH2c instead_ The maximum number of concurrent HTTP/2
     streams for a single session. Once h2 is negotiated this — not `pipelining`,
     which is HTTP/1.1 only — is the ceiling used to dispatch in-flight requests.
     It may be overridden by the server's `SETTINGS_MAX_CONCURRENT_STREAMS`
     frame. **Default:** `100`.
-  * `initialWindowSize` {number} The HTTP/2 stream-level flow-control window
-    size (`SETTINGS_INITIAL_WINDOW_SIZE`). Must be a positive integer.
-    **Default:** `262144`.
-  * `connectionWindowSize` {number} The HTTP/2 connection-level flow-control
+  * `connectionWindowSize` {number} _Deprecated: use h2Options.connectionWindowSize instead_ The HTTP/2 connection-level flow-control
     window size set via `ClientHttp2Session.setLocalWindowSize()`. Must be a
     positive integer. **Default:** `524288`.
-  * `pingInterval` {number} The time interval, in milliseconds, between HTTP/2
+  * `pingInterval` {number} _Deprecated: use h2Options.pingInterval instead_ The time interval, in milliseconds, between HTTP/2
     PING frames. Set to `0` to disable PING frames. Applies only to HTTP/2
     connections and emits a `ping` event on the client. **Default:** `60e3`.
+  * `h2Options` {object} Set of options for HTTP/2 sessions
+    * `useH2c` {boolean} Enforces h2c (HTTP/2 cleartext) for non-HTTPS
+    connections. **Default:** `false`.
+    * `maxConcurrentStreams` {number} The maximum number of concurrent HTTP/2
+      streams for a single session. Once h2 is negotiated this — not `pipelining`,
+      which is HTTP/1.1 only — is the ceiling used to dispatch in-flight requests.
+      It may be overridden by the server's `SETTINGS_MAX_CONCURRENT_STREAMS`
+      frame. **Default:** `100`.
+    * `connectionWindowSize` {number} The HTTP/2 connection-level flow-control
+      window size set via `ClientHttp2Session.setLocalWindowSize()`. Must be a
+      positive integer. **Default:** `524288`.
+    * `pingInterval` {number} The time interval, in milliseconds, between HTTP/2
+      PING frames. Set to `0` to disable PING frames. Applies only to HTTP/2
+      connections and emits a `ping` event on the client. **Default:** `60e3`.
+    * `settings` {object} `SETTINGS` frame options. For full reference, take a
+      look to [HTTP/2#Settings Object](https://nodejs.org/api/http2.html#settings-object)
   * `webSocket` {Object} (optional) WebSocket-specific configuration.
     * `maxFragments` {number} The maximum number of fragments in a message. Set
       to `0` to disable the limit. **Default:** `131072`.
diff --git a/deps/undici/src/lib/api/readable.js b/deps/undici/src/lib/api/readable.js
index 71d90d457b34..e3dd3dcce4b7 100644
--- a/deps/undici/src/lib/api/readable.js
+++ b/deps/undici/src/lib/api/readable.js
@@ -15,7 +15,6 @@ const kContentType = Symbol('kContentType')
 const kContentLength = Symbol('kContentLength')
 const kUsed = Symbol('kUsed')
 const kBytesRead = Symbol('kBytesRead')
-const kPreservedBuffer = Symbol('kPreservedBuffer')
 
 const noop = () => {}
 
@@ -326,36 +325,14 @@ class BodyReadable extends Readable {
    */
   setEncoding (encoding) {
     if (Buffer.isEncoding(encoding)) {
-      // Preserve raw Buffer chunks for the consume path (body.text(),
-      // body.json(), etc.) before super.setEncoding() replaces them
-      // with decoded strings. Without this, the consume path would
-      // lose access to the original bytes — some of which may be held
-      // by the decoder for incomplete multi-byte sequences, and the
-      // rest converted to strings that can't be safely concatenated
-      // byte-wise.
-      const state = this._readableState
-      const buffer = state.buffer
-      if (buffer && state.length > 0) {
-        const bufferIndex = state.bufferIndex ?? 0
-        const preserved = []
-        const source = typeof buffer.slice === 'function'
-          ? buffer.slice(bufferIndex)
-          : buffer
-        for (const data of source) {
-          if (Buffer.isBuffer(data)) {
-            preserved.push(data)
-          }
-        }
-        if (preserved.length > 0) {
-          this[kPreservedBuffer] = (this[kPreservedBuffer] || []).concat(preserved)
-        }
-      }
-
       // Delegate to Node.js Readable.setEncoding() which initializes a
       // StringDecoder and re-encodes already-buffered chunks. This properly
       // handles multi-byte sequences split at chunk boundaries for the
       // for-await / on('data') paths. Without this, Node.js uses
       // buf.toString(encoding) on each chunk, producing U+FFFD for split chars.
+      //
+      // The consume path (body.text(), body.json(), ...) copes with the
+      // decoded strings this leaves in state.buffer, see consumeStart().
       super.setEncoding(encoding)
     }
     return this
@@ -464,17 +441,7 @@ function consumeStart (consume) {
 
   const { _readableState: state } = consume.stream
 
-  // If setEncoding() was called, state.buffer may contain decoded strings
-  // (which would break Buffer.concat in chunksDecode). Use the preserved
-  // raw Buffers (saved before super.setEncoding() in setEncoding()) for
-  // byte-level accurate consumption. Otherwise read from state.buffer.
-  const preserved = consume.stream[kPreservedBuffer]
-  if (preserved && preserved.length > 0) {
-    for (const chunk of preserved) {
-      consumePush(consume, chunk)
-    }
-    consume.stream[kPreservedBuffer] = null
-  } else if (state.bufferIndex) {
+  if (state.bufferIndex) {
     const start = state.bufferIndex
     const end = state.buffer.length
     for (let n = start; n < end; n++) {
@@ -486,14 +453,29 @@ function consumeStart (consume) {
     }
   }
 
+  // If setEncoding() was called, state.buffer holds decoded strings, which
+  // consumePush() turns back into bytes. The trailing bytes of a multi-byte
+  // sequence split across a chunk boundary are not part of any of those
+  // strings, they are held inside the decoder until the rest arrives, so
+  // take them from there.
+  const decoder = state.decoder
+  if (decoder != null && decoder.lastNeed > 0) {
+    consumePush(consume, Buffer.from(decoder.lastChar.subarray(0, decoder.lastTotal - decoder.lastNeed)))
+  }
+
   if (state.endEmitted) {
-    consumeEnd(this[kConsume], this._readableState.encoding)
-  } else {
-    consume.stream.on('end', function () {
-      consumeEnd(this[kConsume], this._readableState.encoding)
-    })
+    // No `this` to read the consume off here: consumeStart is a free function, called from
+    // the queueMicrotask above. The callback below does have one, because the emitter passes
+    // the stream as its receiver. Returning matters too - consumeEnd() clears consume.stream,
+    // which the resume() below would then dereference.
+    consumeEnd(consume, state.encoding)
+    return
   }
 
+  consume.stream.on('end', function () {
+    consumeEnd(this[kConsume], this._readableState.encoding)
+  })
+
   consume.stream.resume()
 
   while (consume.stream.read() != null) {
@@ -583,7 +565,7 @@ function consumeEnd (consume, encoding) {
 
 /**
  * @param {Consume} consume
- * @param {Buffer} chunk
+ * @param {Buffer|string} chunk
  * @returns {void}
  */
 function consumePush (consume, chunk) {
@@ -591,6 +573,14 @@ function consumePush (consume, chunk) {
     return
   }
 
+  if (typeof chunk === 'string') {
+    // Buffered before the consume started, while an encoding was set.
+    // consume.length has to stay a byte count and chunksDecode()/chunksConcat()
+    // only work on bytes, so re-encode. A string's own length is in UTF-16 code
+    // units and Uint8Array.prototype.set() ignores a string argument entirely.
+    chunk = Buffer.from(chunk, consume.stream._readableState.encoding)
+  }
+
   consume.length += chunk.length
   consume.body.push(chunk)
 }
diff --git a/deps/undici/src/lib/core/connect.js b/deps/undici/src/lib/core/connect.js
index ad962c31944a..f729dfb0526d 100644
--- a/deps/undici/src/lib/core/connect.js
+++ b/deps/undici/src/lib/core/connect.js
@@ -105,13 +105,27 @@ function buildConnector ({ allowH2, preferH2, useH2c, maxCachedSessions, socketP
 
       port = port || 80
 
-      socket = net.connect({
+      const connectOptions = {
         highWaterMark: 64 * 1024, // Same as nodejs fs streams.
         ...options,
         localAddress,
         port,
         host: hostname
-      })
+      }
+
+      const family = net.isIP(hostname)
+      if (family !== 0 && servername && servername !== hostname) {
+        connectOptions.host = servername
+        connectOptions.lookup = (_hostname, lookupOptions, cb) => {
+          if (lookupOptions.all) {
+            cb(null, [{ address: hostname, family }])
+          } else {
+            cb(null, hostname, family)
+          }
+        }
+      }
+
+      socket = net.connect(connectOptions)
       if (useH2c === true) {
         socket.alpnProtocol = 'h2'
       }
diff --git a/deps/undici/src/lib/core/symbols.js b/deps/undici/src/lib/core/symbols.js
index 8bad25eed9fd..badecb709086 100644
--- a/deps/undici/src/lib/core/symbols.js
+++ b/deps/undici/src/lib/core/symbols.js
@@ -56,6 +56,7 @@ module.exports = {
   kCounter: Symbol('socket request counter'),
   kMaxResponseSize: Symbol('max response size'),
   kHTTP2Session: Symbol('http2Session'),
+  kHTTP2Options: Symbol('http2 options'),
   kHTTP2SessionState: Symbol('http2Session state'),
   kRetryHandlerDefaultRetry: Symbol('retry agent default retry'),
   kConstruct: Symbol('constructable'),
diff --git a/deps/undici/src/lib/dispatcher/client-h1.js b/deps/undici/src/lib/dispatcher/client-h1.js
index abf381f65a46..9f6f17c1579b 100644
--- a/deps/undici/src/lib/dispatcher/client-h1.js
+++ b/deps/undici/src/lib/dispatcher/client-h1.js
@@ -1052,7 +1052,7 @@ function onSocketClose () {
 
 function clearIdleSocketValidation (socket) {
   if (socket[kIdleSocketValidationTimeout]) {
-    clearImmediate(socket[kIdleSocketValidationTimeout])
+    clearTimeout(socket[kIdleSocketValidationTimeout])
     socket[kIdleSocketValidationTimeout] = null
   }
 
@@ -1061,14 +1061,14 @@ function clearIdleSocketValidation (socket) {
 
 function scheduleIdleSocketValidation (client, socket) {
   socket[kIdleSocketValidation] = 1
-  socket[kIdleSocketValidationTimeout] = setImmediate(() => {
+  socket[kIdleSocketValidationTimeout] = setTimeout(() => {
     socket[kIdleSocketValidationTimeout] = null
     socket[kIdleSocketValidation] = 2
 
     if (client[kSocket] === socket && !socket.destroyed) {
       client[kResume]()
     }
-  })
+  }, 0)
   socket[kIdleSocketValidationTimeout].unref?.()
 }
 
diff --git a/deps/undici/src/lib/dispatcher/client-h2.js b/deps/undici/src/lib/dispatcher/client-h2.js
index 19622db68ace..bc401008f004 100644
--- a/deps/undici/src/lib/dispatcher/client-h2.js
+++ b/deps/undici/src/lib/dispatcher/client-h2.js
@@ -26,10 +26,7 @@ const {
   kStrictContentLength,
   kOnError,
   kMaxConcurrentStreams,
-  kPingInterval,
   kHTTP2Session,
-  kHTTP2InitialWindowSize,
-  kHTTP2ConnectionWindowSize,
   kHostAuthority,
   kResume,
   kSize,
@@ -41,7 +38,8 @@ const {
   kEnableConnectProtocol,
   kRemoteSettings,
   kHTTP2Stream,
-  kHTTP2SessionState
+  kHTTP2SessionState,
+  kHTTP2Options
 } = require('../core/symbols.js')
 const { channels } = require('../core/diagnostics.js')
 
@@ -51,6 +49,14 @@ const kRequestStream = Symbol('request stream')
 const kRequestStreamCleanup = Symbol('request stream cleanup')
 const kRequestStreamState = Symbol('request stream state')
 const kReceivedGoAway = Symbol('received goaway')
+const kGoAwayReplayAttempts = Symbol('goaway replay attempts')
+const kRefusedStreamRetry = Symbol('refused stream retry')
+
+// RFC 9113 section 8.7: a client SHOULD NOT automatically retry a request more
+// than once. Without a budget a peer that keeps refusing turns one request into
+// an unbounded connect/refuse/reconnect loop that never settles and starves the
+// event loop.
+const MAX_GOAWAY_REPLAY_ATTEMPTS = 1
 
 let extractBody
 
@@ -179,12 +185,24 @@ function completeRequest (client, request, resetPendingIdx = false) {
   }
 }
 
-function canRetryRequestAfterGoAway (request) {
+function canReplayRequest (request) {
   const { body } = request
 
   return body == null || util.isBuffer(body) || util.isBlobLike(body)
 }
 
+// Count a GOAWAY refusal against the request's replay budget. A peer that
+// refuses every connection must eventually surface an error to the caller
+// rather than being retried forever. Kept separate from canReplayRequest so
+// that the REFUSED_STREAM retry, which has its own single-attempt limit, does
+// not consume this budget just by asking whether the body can be replayed.
+function registerGoAwayRefusal (request) {
+  const attempts = (request[kGoAwayReplayAttempts] ?? 0) + 1
+  request[kGoAwayReplayAttempts] = attempts
+
+  return attempts <= MAX_GOAWAY_REPLAY_ATTEMPTS
+}
+
 function closeStream (stream, code = NGHTTP2_REFUSED_STREAM) {
   if (stream != null && !stream.destroyed && !stream.closed) {
     try {
@@ -197,19 +215,44 @@ function detachRequestStreamForClose (request) {
   const stream = request[kRequestStream]
 
   clearRequestStream(request)
+  severRequestStream(stream)
 
   return stream
 }
 
+// Unbind a stream from its request for good. releaseRequestStream() alone
+// leaves the 'close' listener attached and kRequestStreamState populated, so a
+// stream abandoned here would still run completeRequestStream() later — and
+// splice out the request that has since been requeued onto another session.
+function severRequestStream (stream) {
+  if (stream == null || stream[kRequestStreamState] == null) {
+    return
+  }
+
+  stream[kRequestStreamState] = null
+  stream.off('close', completeRequestStream)
+  // Upgrade streams use their own close cleanup, which would otherwise release
+  // the session a second time after the stream has been severed for GOAWAY.
+  stream.off('close', onUpgradeStreamClose)
+
+  if (stream[kHTTP2Session] != null) {
+    closeStreamSession(stream)
+  }
+
+  if (!stream.destroyed && !stream.closed) {
+    stream.once('error', noop)
+  }
+}
+
 function connectH2 (client, socket) {
   client[kSocket] = socket
 
-  const http2InitialWindowSize = client[kHTTP2InitialWindowSize]
-  const http2ConnectionWindowSize = client[kHTTP2ConnectionWindowSize]
+  const http2InitialWindowSize = client[kHTTP2Options].sessionOptions?.initialWindowSize
+  const http2ConnectionWindowSize = client[kHTTP2Options].connectionWindowSize
 
   const session = http2.connect(client[kUrl], {
     createConnection: () => socket,
-    peerMaxConcurrentStreams: client[kMaxConcurrentStreams],
+    peerMaxConcurrentStreams: client[kHTTP2Options].maxConcurrentStreams,
     settings: {
       // TODO(metcoder95): add support for PUSH
       enablePush: false,
@@ -223,13 +266,16 @@ function connectH2 (client, socket) {
   session[kSocket] = socket
   session[kHTTP2SessionState] = {
     idleTimeout: null,
+    // Armed while the peer advertises MAX_CONCURRENT_STREAMS = 0 and we have
+    // work that cannot start. See setNoStreamsTimeout.
+    noStreamsTimeout: null,
     // Sockets start out ref'd. Session ref/unref proxies to the socket, so a
     // single cached flag lets us skip redundant uv ref/unref calls, provided
     // every ref/unref of the session or its socket goes through
     // refH2Session/unrefH2Session.
     refed: true,
     ping: {
-      interval: client[kPingInterval] === 0 ? null : setInterval(onHttp2SendPing, client[kPingInterval], session).unref()
+      interval: client[kHTTP2Options].pingInterval === 0 ? null : setInterval(onHttp2SendPing, client[kHTTP2Options].pingInterval, session).unref()
     }
   }
   session[kReceivedGoAway] = false
@@ -369,7 +415,74 @@ function resumeH2 (client) {
     } else {
       clearHttp2IdleTimeout(session)
     }
+
+    if (client[kMaxConcurrentStreams] === 0 && client[kRunning] === 0 && client[kPending] > 0) {
+      setNoStreamsTimeout(session)
+    } else {
+      clearNoStreamsTimeout(session)
+    }
+  }
+}
+
+function clearNoStreamsTimeout (session) {
+  const state = session[kHTTP2SessionState]
+
+  if (state?.noStreamsTimeout != null) {
+    clearTimeout(state.noStreamsTimeout)
+    state.noStreamsTimeout = null
+  }
+}
+
+// A peer is allowed to advertise SETTINGS_MAX_CONCURRENT_STREAMS = 0 to refuse
+// new streams (RFC 9113 §6.5.2), and is expected to raise it again later. Until
+// it does, busy() reports the client as permanently busy and queued requests
+// cannot open a stream — which means no per-stream timeout covers them, and no
+// reconnect can happen either, so the SETTINGS frame that would lift the limit
+// can never arrive. Give the peer headersTimeout to start honouring requests
+// before failing them; a request that cannot even be sent has missed the same
+// deadline as one whose headers never arrive.
+function setNoStreamsTimeout (session) {
+  const client = session[kClient]
+  const state = session[kHTTP2SessionState]
+  const timeout = client[kHeadersTimeout]
+
+  if (!timeout || state.noStreamsTimeout != null) {
+    return
+  }
+
+  state.noStreamsTimeout = setTimeout(onNoStreamsTimeout, timeout, session).unref()
+}
+
+function onNoStreamsTimeout (session) {
+  const client = session[kClient]
+  const state = session[kHTTP2SessionState]
+
+  state.noStreamsTimeout = null
+
+  if (
+    client[kHTTP2Session] !== session ||
+    client[kMaxConcurrentStreams] !== 0 ||
+    client[kRunning] !== 0 ||
+    client[kPending] === 0
+  ) {
+    return
+  }
+
+  const err = new HeadersTimeoutError(
+    `HTTP/2: server did not accept a new stream within ${client[kHeadersTimeout]}`
+  )
+
+  const requests = client[kQueue].splice(client[kPendingIdx])
+  for (let i = 0; i < requests.length; i++) {
+    if (requests[i] != null) {
+      util.errorRequest(client, requests[i], err)
+    }
   }
+
+  // Drop the unusable session so the next request gets a fresh connection,
+  // whose SETTINGS may well allow streams again.
+  session[kError] = err
+  resetHttp2Session(session, err)
 }
 
 function clearHttp2IdleTimeout (session) {
@@ -527,7 +640,7 @@ function onHttp2SessionGoAway (errorCode, lastStreamID) {
     if (request != null) {
       streamsToClose.push(detachRequestStreamForClose(request))
 
-      if (canRetryRequestAfterGoAway(request)) {
+      if (canReplayRequest(request) && registerGoAwayRefusal(request)) {
         retriableRequests.push(request)
       } else {
         util.errorRequest(client, request, err)
@@ -552,6 +665,7 @@ function onHttp2SessionGoAway (errorCode, lastStreamID) {
   }
 
   clearHttp2IdleTimeout(this)
+  clearNoStreamsTimeout(this)
 
   if (!this.closed && !this.destroyed) {
     this.close()
@@ -576,6 +690,7 @@ function onHttp2SessionClose () {
   }
 
   clearHttp2IdleTimeout(this)
+  clearNoStreamsTimeout(this)
 
   if (state.ping.interval != null) {
     clearInterval(state.ping.interval)
@@ -687,6 +802,16 @@ function completeRequestStream () {
 
   if (state.pendingEnd && !state.request.aborted && !state.request.completed) {
     state.request.onResponseEnd(state.trailers || {})
+  } else if (!state.request.aborted && !state.request.completed) {
+    // The stream closed without a complete response and without reporting an
+    // error. finalizeRequest() below frees the queue slot either way, so
+    // without this the request would simply vanish and its caller would never
+    // hear back.
+    util.errorRequest(
+      state.client,
+      state.request,
+      new InformationalError('HTTP/2: stream closed before the response was complete')
+    )
   }
 
   finalizeRequest(state)
@@ -1286,6 +1411,38 @@ function onEnd () {
   }
 }
 
+function retryRefusedStream (stream, state) {
+  const { client, request } = state
+
+  if (
+    state.responseReceived ||
+    request.aborted ||
+    request.completed ||
+    request[kRefusedStreamRetry] ||
+    !canReplayRequest(request)
+  ) {
+    return false
+  }
+
+  // RFC 9113 section 8.7 permits retrying REFUSED_STREAM, but says clients
+  // SHOULD NOT automatically retry the same request more than once.
+  request[kRefusedStreamRetry] = true
+
+  // Detach the failed attempt before moving the request back to the pending
+  // queue. The peer only reset this stream, so the HTTP/2 session remains
+  // usable for the retry. Severing also drops the 'close' listener, so the
+  // abandoned stream cannot later complete the retried request.
+  detachRequestStreamForClose(request)
+  state.stream = null
+  state.requestFinalized = true
+
+  completeRequest(client, request)
+  client[kQueue].splice(client[kPendingIdx], 0, request)
+  client[kResume]()
+
+  return true
+}
+
 function onError (err) {
   const stream = this
   const state = stream[kRequestStreamState]
@@ -1295,6 +1452,18 @@ function onError (err) {
   }
 
   stream.off('error', onError)
+
+  if (typeof stream.rstCode === 'number' && stream.rstCode !== NGHTTP2_NO_ERROR) {
+    err.http2ErrorCode = stream.rstCode
+  }
+
+  if (
+    stream.rstCode === NGHTTP2_REFUSED_STREAM &&
+    retryRefusedStream(stream, state)
+  ) {
+    return
+  }
+
   state.abort(err)
 }
 
diff --git a/deps/undici/src/lib/dispatcher/client.js b/deps/undici/src/lib/dispatcher/client.js
index 8a4f65171bd9..d620e8310cfb 100644
--- a/deps/undici/src/lib/dispatcher/client.js
+++ b/deps/undici/src/lib/dispatcher/client.js
@@ -53,10 +53,8 @@ const {
   kHTTPContext,
   kMaxConcurrentStreams,
   kHostAuthority,
-  kHTTP2InitialWindowSize,
-  kHTTP2ConnectionWindowSize,
   kResume,
-  kPingInterval
+  kHTTP2Options
 } = require('../core/symbols.js')
 const connectH1 = require('./client-h1.js')
 const connectH2 = require('./client-h2.js')
@@ -76,6 +74,16 @@ function getPipelining (client) {
   return client[kPipelining] ?? client[kHTTPContext]?.defaultPipelining ?? 1
 }
 
+let h2NamespaceOptsWarning = false
+function emitH2OptionsNamespaceWarning (optName) {
+  if (h2NamespaceOptsWarning === true) return
+
+  process.emitWarning(`Use h2Options.${optName} instead. ${optName} for H2 will be deprecated in future major.`, {
+    code: 'UNDICI-H2-OPTIONS'
+  })
+  h2NamespaceOptsWarning = true
+}
+
 // Protocol-aware dispatch ceiling. h1 RFC7230 pipelining is unrelated to h2
 // stream multiplexing — over h2 the ceiling is the (server-confirmed)
 // maxConcurrentStreams. Before a context is attached we use the h1
@@ -128,7 +136,8 @@ class Client extends DispatcherBase {
     initialWindowSize,
     connectionWindowSize,
     pingInterval,
-    webSocket
+    webSocket,
+    h2Options
   } = {}) {
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -216,24 +225,55 @@ class Client extends DispatcherBase {
       throw new InvalidArgumentError('allowH2 must be a valid boolean value')
     }
 
-    if (maxConcurrentStreams != null && (typeof maxConcurrentStreams !== 'number' || maxConcurrentStreams < 1)) {
-      throw new InvalidArgumentError('maxConcurrentStreams must be a positive integer, greater than 0')
-    }
+    // We validate only if allowH2 is enabled or null (enabled by default)
+    if (allowH2 !== false) {
+      // Prioritise new h2Options object, otherwise fallback to prior configuration options
+      if (h2Options != null) {
+        if (h2Options.useH2c != null && typeof h2Options.useH2c !== 'boolean') {
+          throw new InvalidArgumentError('h2Options.useH2c must be a valid boolean value')
+        }
 
-    if (useH2c != null && typeof useH2c !== 'boolean') {
-      throw new InvalidArgumentError('useH2c must be a valid boolean value')
-    }
+        if (h2Options.settings?.initialWindowSize != null && (!Number.isInteger(h2Options.settings.initialWindowSize) || h2Options.settings.initialWindowSize < 1)) {
+          throw new InvalidArgumentError('h2Options.settings.initialWindowSize must be a positive integer, greater than 0')
+        }
 
-    if (initialWindowSize != null && (!Number.isInteger(initialWindowSize) || initialWindowSize < 1)) {
-      throw new InvalidArgumentError('initialWindowSize must be a positive integer, greater than 0')
-    }
+        if (h2Options.maxConcurrentStreams != null && (!Number.isInteger(h2Options.connectionWindowSize) || h2Options.maxConcurrentStreams < 1)) {
+          throw new InvalidArgumentError('h2Options.maxConcurrentStreams must be a positive integer, greater than 0')
+        }
 
-    if (connectionWindowSize != null && (!Number.isInteger(connectionWindowSize) || connectionWindowSize < 1)) {
-      throw new InvalidArgumentError('connectionWindowSize must be a positive integer, greater than 0')
-    }
+        if (h2Options.connectionWindowSize != null && (!Number.isInteger(h2Options.connectionWindowSize) || h2Options.connectionWindowSize < 1)) {
+          throw new InvalidArgumentError('h2Options.connectionWindowSize must be a positive integer, greater than 0')
+        }
+
+        if (h2Options.pingInterval != null && (typeof h2Options.pingInterval !== 'number' || !Number.isInteger(h2Options.pingInterval) || h2Options.pingInterval < 0)) {
+          throw new InvalidArgumentError('h2Options.pingInterval must be a positive integer, greater or equal to 0')
+        }
+      } else {
+        if (useH2c != null && typeof useH2c !== 'boolean') {
+          emitH2OptionsNamespaceWarning('useH2c')
+          throw new InvalidArgumentError('useH2c must be a valid boolean value')
+        }
+
+        if (maxConcurrentStreams != null && (typeof maxConcurrentStreams !== 'number' || maxConcurrentStreams < 1)) {
+          emitH2OptionsNamespaceWarning('maxConcurrentStreams')
+          throw new InvalidArgumentError('maxConcurrentStreams must be a positive integer, greater than 0')
+        }
 
-    if (pingInterval != null && (typeof pingInterval !== 'number' || !Number.isInteger(pingInterval) || pingInterval < 0)) {
-      throw new InvalidArgumentError('pingInterval must be a positive integer, greater or equal to 0')
+        if (initialWindowSize != null && (!Number.isInteger(initialWindowSize) || initialWindowSize < 1)) {
+          emitH2OptionsNamespaceWarning('initialWindowSize')
+          throw new InvalidArgumentError('initialWindowSize must be a positive integer, greater than 0')
+        }
+
+        if (connectionWindowSize != null && (!Number.isInteger(connectionWindowSize) || connectionWindowSize < 1)) {
+          emitH2OptionsNamespaceWarning('connectionWindowSize')
+          throw new InvalidArgumentError('connectionWindowSize must be a positive integer, greater than 0')
+        }
+
+        if (pingInterval != null && (typeof pingInterval !== 'number' || !Number.isInteger(pingInterval) || pingInterval < 0)) {
+          emitH2OptionsNamespaceWarning('pingInterval')
+          throw new InvalidArgumentError('pingInterval must be a positive integer, greater or equal to 0')
+        }
+      }
     }
 
     super({ webSocket })
@@ -243,8 +283,8 @@ class Client extends DispatcherBase {
         ...tls,
         maxCachedSessions,
         allowH2,
-        useH2c,
         socketPath,
+        useH2c: h2Options?.useH2c ?? useH2c,
         timeout: connectTimeout,
         ...(typeof autoSelectFamily === 'boolean' ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : undefined),
         ...connect
@@ -280,16 +320,20 @@ class Client extends DispatcherBase {
     this[kMaxResponseSize] = maxResponseSize > -1 ? maxResponseSize : -1
     this[kHTTPContext] = null
     // h2
-    this[kMaxConcurrentStreams] = maxConcurrentStreams != null ? maxConcurrentStreams : 100 // Max peerConcurrentStreams for a Node h2 server
-    // HTTP/2 window sizes are set to higher defaults than Node.js core for better performance:
-    // - initialWindowSize: 262144 (256KB) vs Node.js default 65535 (64KB - 1)
-    //   Allows more data to be sent before requiring acknowledgment, improving throughput
-    //   especially on high-latency networks. This matches common production HTTP/2 servers.
-    // - connectionWindowSize: 524288 (512KB) vs Node.js default (none set)
-    //   Provides better flow control for the entire connection across multiple streams.
-    this[kHTTP2InitialWindowSize] = initialWindowSize != null ? initialWindowSize : 262144
-    this[kHTTP2ConnectionWindowSize] = connectionWindowSize != null ? connectionWindowSize : 524288
-    this[kPingInterval] = pingInterval != null ? pingInterval : 60e3 // Default ping interval for h2 - 1 minute
+    this[kHTTP2Options] = {
+      pingInterval: h2Options?.pingInterval ?? pingInterval ?? 60e3,
+      connectionWindowSize: h2Options?.connectionWindowSize ?? connectionWindowSize ?? 524288,
+      maxConcurrentStreams: h2Options?.maxConcurrentStreams ?? maxConcurrentStreams ?? 100, // Max peerConcurrentStreams for a Node h2 server
+      sessionOptions: {
+        // HTTP/2 window sizes are set to higher defaults than Node.js core for better performance:
+        // - initialWindowSize: 262144 (256KB) vs Node.js default 65535 (64KB - 1)
+        //   Allows more data to be sent before requiring acknowledgment, improving throughput
+        //   especially on high-latency networks. This matches common production HTTP/2 servers.
+        // - connectionWindowSize: 524288 (512KB) vs Node.js default (none set)
+        //   Provides better flow control for the entire connection across multiple streams.
+        initialWindowSize: h2Options?.initialWindowSize ?? initialWindowSize ?? 262144
+      }
+    }
 
     // kQueue is built up of 3 sections separated by
     // the kRunningIdx and kPendingIdx indices.
@@ -672,6 +716,7 @@ function _resume (client, sync) {
     }
 
     if (!client[kHTTPContext]) {
+      client[kServerName] = request.servername
       connect(client)
       return
     }
diff --git a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
index f88437f1936a..51c50601714b 100644
--- a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
@@ -65,9 +65,10 @@ class EnvHttpProxyAgent extends DispatcherBase {
   #getProxyAgentForUrl (url) {
     let { protocol, host: hostname, port } = url
 
-    // Stripping ports in this way instead of using parsedUrl.hostname to make
-    // sure that the brackets around IPv6 addresses are kept.
-    hostname = hostname.replace(/:\d*$/, '').toLowerCase()
+    // Remove the port suffix (e.g. ":8080") and then strip surrounding
+    // brackets from IPv6 literals (e.g. "[::1]" -> "::1") so that the
+    // result matches the unbracketed form stored by #parseNoProxy.
+    hostname = hostname.replace(/:\d*$/, '').replace(/^\[(.+)\]$/, '$1').toLowerCase()
     port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0
     if (!this.#shouldProxy(hostname, port)) {
       return this[kNoProxyAgent]
@@ -119,11 +120,32 @@ class EnvHttpProxyAgent extends DispatcherBase {
       if (!entry) {
         continue
       }
-      const parsed = entry.match(/^(.+):(\d+)$/)
+
+      // An IPv6 entry with a port must be bracketed: [::1]:443.
+      // A bare IPv6 address like ::1 contains colons that must not be
+      // confused with a host:port separator, so we handle it separately.
+      let hostname, port
+      const ipv6WithPort = entry.match(/^\[(.+)\]:(\d+)$/)
+      if (ipv6WithPort) {
+        hostname = ipv6WithPort[1]
+        port = Number.parseInt(ipv6WithPort[2], 10)
+      } else {
+        // Bracketed IPv6 without port, or plain hostname[:port], or bare IPv6.
+        // Strip optional brackets first.
+        const unbracketed = entry.replace(/^\[(.+)\]$/, '$1')
+        // A bare IPv6 address contains multiple colons; a hostname:port entry
+        // has exactly one colon followed by digits. Only attempt host:port
+        // splitting when that is unambiguously the case.
+        const colonCount = (unbracketed.match(/:/g) || []).length
+        const parsed = colonCount === 1 && unbracketed.match(/^(.+):(\d+)$/)
+        hostname = parsed ? parsed[1] : unbracketed
+        port = parsed ? Number.parseInt(parsed[2], 10) : 0
+      }
+
       noProxyEntries.push({
         // strip leading dot or asterisk with dot
-        hostname: (parsed ? parsed[1] : entry).replace(/^\*?\./, '').toLowerCase(),
-        port: parsed ? Number.parseInt(parsed[2], 10) : 0
+        hostname: hostname.replace(/^\*?\./, '').toLowerCase(),
+        port
       })
     }
 
diff --git a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
index bb46b7cfa184..909c7f502478 100644
--- a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
@@ -6,7 +6,7 @@ let tls // include tls conditionally since it is not always available
 const DispatcherBase = require('./dispatcher-base')
 const { InvalidArgumentError } = require('../core/errors')
 const { Socks5Client, STATES } = require('../core/socks5-client')
-const { kDispatch, kClose, kDestroy } = require('../core/symbols')
+const { kBusy, kConnected, kDispatch, kClose, kDestroy } = require('../core/symbols')
 const Pool = require('./pool')
 const buildConnector = require('../core/connect')
 const { debuglog } = require('node:util')
@@ -226,6 +226,20 @@ class Socks5ProxyAgent extends DispatcherBase {
           }
         })
         this[kPools].set(originKey, pool)
+
+        const closePoolIfUnused = () => {
+          if (this[kPools].get(originKey) !== pool || pool[kConnected] > 0 || pool[kBusy]) {
+            return
+          }
+
+          this[kPools].delete(originKey)
+          if (!pool.destroyed) {
+            pool.close()
+          }
+        }
+
+        pool.on('disconnect', closePoolIfUnused)
+        pool.on('connectionError', closePoolIfUnused)
       }
 
       // Dispatch the request through the per-origin pool
diff --git a/deps/undici/src/lib/handler/retry-handler.js b/deps/undici/src/lib/handler/retry-handler.js
index 3fc26229a1cc..c098b510c26c 100644
--- a/deps/undici/src/lib/handler/retry-handler.js
+++ b/deps/undici/src/lib/handler/retry-handler.js
@@ -241,6 +241,11 @@ class RetryHandler {
   }
 
   onResponseStart (controller, statusCode, headers, statusMessage) {
+    if (statusCode < 200) {
+      this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+      return
+    }
+
     this.error = null
     this.retryCount += 1
     this.statusCode = statusCode
@@ -305,7 +310,7 @@ class RetryHandler {
         // First time we receive 206
         const range = parseRangeHeader(headers['content-range'])
 
-        if (range == null) {
+        if (range == null || range.end == null) {
           this.headersSent = true
           this.handler.onResponseStart?.(
             this.controllerProxy,
@@ -330,7 +335,7 @@ class RetryHandler {
       }
 
       // We make our best to checkpoint the body for further range headers
-      if (this.end == null) {
+      if (this.end == null && this.opts.method !== 'HEAD') {
         const contentLength = headers['content-length']
         this.end = contentLength != null ? Number(contentLength) - 1 : null
       }
diff --git a/deps/undici/src/lib/interceptor/cache.js b/deps/undici/src/lib/interceptor/cache.js
index f50c1b7b67dc..2d7d01f130aa 100644
--- a/deps/undici/src/lib/interceptor/cache.js
+++ b/deps/undici/src/lib/interceptor/cache.js
@@ -540,13 +540,16 @@ module.exports = (opts = {}) => {
 
   return dispatch => {
     return (opts, handler) => {
-      if (!opts.origin || arrayIncludes(safeMethodsToNotCache, opts.method)) {
-        // Not a method we want to cache or we don't have the origin, skip
+      if (arrayIncludes(safeMethodsToNotCache, opts.method)) {
+        // Not a method we want to cache, skip
         return dispatch(opts, handler)
       }
 
       // Check if origin is in whitelist
       if (origins !== undefined) {
+        if (!opts.origin) {
+          return dispatch(opts, handler)
+        }
         const requestOrigin = opts.origin.toString().toLowerCase()
         let isAllowed = false
 
diff --git a/deps/undici/src/lib/interceptor/deduplicate.js b/deps/undici/src/lib/interceptor/deduplicate.js
index e81525ac5ea7..bacfeb3fb37e 100644
--- a/deps/undici/src/lib/interceptor/deduplicate.js
+++ b/deps/undici/src/lib/interceptor/deduplicate.js
@@ -59,7 +59,7 @@ module.exports = (opts = {}) => {
 
   return dispatch => {
     return (opts, handler) => {
-      if (!opts.origin || methods.includes(opts.method) === false) {
+      if (opts.upgrade || methods.includes(opts.method) === false) {
         return dispatch(opts, handler)
       }
 
diff --git a/deps/undici/src/lib/llhttp/wasm_build_env.txt b/deps/undici/src/lib/llhttp/wasm_build_env.txt
index e4cfa0c37626..82569ca62dd1 100644
--- a/deps/undici/src/lib/llhttp/wasm_build_env.txt
+++ b/deps/undici/src/lib/llhttp/wasm_build_env.txt
@@ -1,5 +1,5 @@
 
-> undici@8.9.0 build:wasm
+> undici@8.10.0 build:wasm
 > node build/wasm.js --docker
 
 > docker run --rm --platform=linux/x86_64  --user 1001:1001 --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/lib/llhttp,target=/home/node/build/lib/llhttp            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/build,target=/home/node/build/build            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/deps,target=/home/node/build/deps            -t ghcr.io/nodejs/wasm-builder@sha256:975f391d907e42a75b8c72eb77c782181e941608687d4d8694c3e9df415a0970 node build/wasm.js
diff --git a/deps/undici/src/lib/mock/mock-utils.js b/deps/undici/src/lib/mock/mock-utils.js
index 111a860e9aee..e43f7218d0b4 100644
--- a/deps/undici/src/lib/mock/mock-utils.js
+++ b/deps/undici/src/lib/mock/mock-utils.js
@@ -17,6 +17,7 @@ const {
   }
 } = require('node:util')
 const { InvalidArgumentError } = require('../core/errors')
+const requestAborted = Symbol('request aborted')
 
 function matchValue (match, value) {
   if (typeof match === 'string') {
@@ -153,6 +154,11 @@ function getResponseData (data) {
     return data
   } else if (data instanceof ArrayBuffer) {
     return data
+  } else if (ArrayBuffer.isView(data)) {
+    // A DataView, or any non-Uint8Array typed array, is a byte container
+    // rather than a plain object. Buffer.from() cannot read one directly, so
+    // expose the bytes it covers instead of letting it reach JSON.stringify.
+    return new Uint8Array(data.buffer, data.byteOffset, data.byteLength)
   } else if (typeof data === 'object') {
     return JSON.stringify(data)
   } else if (data) {
@@ -225,9 +231,15 @@ function deleteMockDispatch (mockDispatches, key) {
 }
 
 /**
- * @param {string} path Path to remove trailing slash from
+ * @param {string|RegExp|Function} path Path, or path matcher, to remove trailing slash from
  */
 function removeTrailingSlash (path) {
+  // Registered path matchers may be a RegExp or a function, which have no
+  // trailing slash to strip; hand those back for matchValue to apply.
+  if (typeof path !== 'string') {
+    return path
+  }
+
   while (path.endsWith('/')) {
     path = path.slice(0, -1)
   }
@@ -302,9 +314,13 @@ function mockDispatch (opts, handler) {
   mockDispatch.consumed = !mockDispatch.persist && timesInvoked >= times
   mockDispatch.pending = timesInvoked < times
 
+  const hasBodyHooks = typeof handler.onBodySent === 'function' ||
+    typeof handler.onRequestSent === 'function'
+
   // Here's where we resolve a callback if a callback is present for the dispatch data.
-  if (mockDispatch.data.callback) {
-    const callbackResult = mockDispatch.data.callback(opts)
+  if (mockDispatch.data.callback && (!hasBodyHooks || opts.body == null)) {
+    const { callback, ...responseDefaults } = mockDispatch.data
+    const callbackResult = callback(opts)
 
     // An asynchronous reply options callback resolves to the reply data, so
     // the dispatch can only continue once the returned promise settles.
@@ -313,18 +329,25 @@ function mockDispatch (opts, handler) {
     if (isPromise(callbackResult)) {
       callbackResult.then(
         (resolvedData) => {
-          mockDispatch.data = { ...mockDispatch.data, ...resolvedData }
+          if (resolvedData == null || typeof resolvedData !== 'object') {
+            handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
+            return
+          }
+          mockDispatch.data = { ...responseDefaults, ...resolvedData }
           dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
         },
         (error) => {
-          deleteMockDispatch(mockDispatches, key)
           handler.onResponseError(null, error)
         }
       )
       return true
     }
 
-    mockDispatch.data = { ...mockDispatch.data, ...callbackResult }
+    if (callbackResult == null || typeof callbackResult !== 'object') {
+      throw new InvalidArgumentError('reply options callback must return an object')
+    }
+
+    mockDispatch.data = { ...responseDefaults, ...callbackResult }
   }
 
   return dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
@@ -335,12 +358,12 @@ function mockDispatch (opts, handler) {
  */
 function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
   // Parse mockDispatch data
-  const { data: { statusCode, data, headers, trailers, error }, delay } = mockDispatch
+  const { data: response, delay } = mockDispatch
 
   // If specified, trigger dispatch error
-  if (error !== null) {
+  if (response.error !== null) {
     deleteMockDispatch(mockDispatches, key)
-    handler.onResponseError(null, error)
+    handler.onResponseError(null, response.error)
     return true
   }
 
@@ -375,32 +398,107 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
     }
   }
 
+  let replyOpts = opts
+  const dispatches = mockDispatches
+
   // Call onRequestStart to allow the handler to receive the controller
   handler.onRequestStart?.(controller, null)
 
-  // Handle the request with a delay if necessary
-  if (typeof delay === 'number' && delay > 0) {
-    timer = setTimeout(() => {
-      timer = null
-      handleReply(mockDispatches)
-    }, delay)
-  } else {
-    handleReply(mockDispatches)
+  if (aborted) {
+    return true
+  }
+
+  const requestBody = dispatchRequestBody(opts.body, handler, controller, () => aborted)
+
+  if (isPromise(requestBody)) {
+    requestBody.then((body) => {
+      if (body === requestAborted) {
+        return
+      }
+
+      if (body !== opts.body) {
+        replyOpts = { ...opts, body }
+      }
+
+      sendReply()
+    }, (error) => controller.abort(error))
+    return true
+  }
+
+  if (requestBody === requestAborted) {
+    return true
+  }
+
+  if (requestBody !== opts.body) {
+    replyOpts = { ...opts, body: requestBody }
+  }
+
+  sendReply()
+
+  function sendReply () {
+    if (response.callback) {
+      const { callback, ...responseDefaults } = response
+      let callbackResult
+      try {
+        callbackResult = callback(replyOpts)
+      } catch (err) {
+        deleteMockDispatch(mockDispatches, key)
+        handler.onResponseError(null, err)
+        return
+      }
+
+      if (isPromise(callbackResult)) {
+        callbackResult.then(
+          (resolvedData) => {
+            if (resolvedData == null || typeof resolvedData !== 'object') {
+              handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
+              return
+            }
+            mockDispatch.data = { ...responseDefaults, ...resolvedData }
+            handleReply(dispatches, mockDispatch.data)
+          },
+          (err) => {
+            handler.onResponseError(null, err)
+          }
+        )
+        return
+      }
+
+      if (callbackResult == null || typeof callbackResult !== 'object') {
+        throw new InvalidArgumentError('reply options callback must return an object')
+      }
+
+      mockDispatch.data = { ...responseDefaults, ...callbackResult }
+      handleReply(dispatches, mockDispatch.data)
+      return
+    }
+
+    // Handle the request with a delay if necessary
+    if (typeof delay === 'number' && delay > 0) {
+      timer = setTimeout(() => {
+        timer = null
+        handleReply(dispatches)
+      }, delay)
+    } else {
+      handleReply(dispatches)
+    }
   }
 
-  function handleReply (mockDispatches, _data = data) {
+  function handleReply (mockDispatches, _response = response) {
     // Don't send response if the request was aborted
     if (aborted) {
       return
     }
 
+    const { statusCode, data, headers, trailers } = _response
+
     // fetch's HeadersList is a 1D string array
     const optsHeaders = Array.isArray(opts.headers)
       ? buildHeadersFromArray(opts.headers)
       : opts.headers
-    const body = typeof _data === 'function'
-      ? _data({ ...opts, headers: optsHeaders })
-      : _data
+    const body = typeof data === 'function'
+      ? data({ ...replyOpts, headers: optsHeaders })
+      : data
 
     // util.types.isPromise is likely needed for jest.
     if (isPromise(body)) {
@@ -409,7 +507,7 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
       // synchronously throw the error, which breaks some tests.
       // Rather, we wait for the callback to resolve if it is a
       // promise, and then re-run handleReply with the new body.
-      return body.then((newData) => handleReply(mockDispatches, newData))
+      return body.then((newData) => handleReply(mockDispatches, { ..._response, data: newData }))
     }
 
     // Check again if aborted after async body resolution
@@ -418,8 +516,8 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
     }
 
     const responseData = getResponseData(body)
-    const responseHeaders = generateKeyValues(headers)
-    const responseTrailers = generateKeyValues(trailers)
+    const responseHeaders = generateKeyValues(headers ?? {})
+    const responseTrailers = generateKeyValues(trailers ?? {})
 
     // Update the controller with response data
     controller.rawHeaders = responseHeaders
@@ -434,6 +532,97 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
   return true
 }
 
+function dispatchRequestBody (body, handler, controller, isAborted) {
+  if (typeof handler.onBodySent !== 'function' && typeof handler.onRequestSent !== 'function') {
+    return body
+  }
+
+  if (body == null) {
+    return callOnRequestSent(handler, controller, isAborted) ? body : requestAborted
+  }
+
+  if (body && typeof body[Symbol.asyncIterator] === 'function') {
+    return dispatchAsyncIterableBody(body, handler, controller, isAborted)
+  }
+
+  if (isIterableBody(body)) {
+    const chunks = []
+
+    for (const chunk of body) {
+      if (isAborted()) {
+        return requestAborted
+      }
+      chunks.push(chunk)
+      if (!callOnBodySent(handler, controller, chunk) || isAborted()) {
+        return requestAborted
+      }
+    }
+
+    return callOnRequestSent(handler, controller, isAborted) ? chunks : requestAborted
+  }
+
+  if (isAborted()) {
+    return requestAborted
+  }
+
+  if (!callOnBodySent(handler, controller, body)) {
+    return requestAborted
+  }
+
+  return callOnRequestSent(handler, controller, isAborted) ? body : requestAborted
+}
+
+async function dispatchAsyncIterableBody (body, handler, controller, isAborted) {
+  const chunks = []
+
+  for await (const chunk of body) {
+    if (isAborted()) {
+      return requestAborted
+    }
+    chunks.push(chunk)
+    if (!callOnBodySent(handler, controller, chunk) || isAborted()) {
+      return requestAborted
+    }
+  }
+
+  if (!callOnRequestSent(handler, controller, isAborted)) {
+    return requestAborted
+  }
+
+  return {
+    async * [Symbol.asyncIterator] () {
+      yield * chunks
+    }
+  }
+}
+
+function callOnBodySent (handler, controller, chunk) {
+  try {
+    handler.onBodySent?.(chunk)
+    return true
+  } catch (error) {
+    controller.abort(error)
+    return false
+  }
+}
+
+function callOnRequestSent (handler, controller, isAborted) {
+  try {
+    handler.onRequestSent?.()
+    return !isAborted()
+  } catch (error) {
+    controller.abort(error)
+    return false
+  }
+}
+
+function isIterableBody (body) {
+  return typeof body !== 'string' &&
+    !Buffer.isBuffer(body) &&
+    !ArrayBuffer.isView(body) &&
+    typeof body[Symbol.iterator] === 'function'
+}
+
 function buildMockDispatch () {
   const agent = this[kMockAgent]
   const origin = this[kOrigin]
diff --git a/deps/undici/src/lib/util/cache.js b/deps/undici/src/lib/util/cache.js
index d156731d1b5d..1fac28af5d97 100644
--- a/deps/undici/src/lib/util/cache.js
+++ b/deps/undici/src/lib/util/cache.js
@@ -148,9 +148,7 @@ function getMalformedRestrictiveDirectiveName (key) {
  * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
  */
 function makeCacheKey (opts) {
-  if (!opts.origin) {
-    throw new Error('opts.origin is undefined')
-  }
+  const origin = opts.origin ? opts.origin.toString() : ''
 
   let fullPath = opts.path || '/'
 
@@ -159,7 +157,7 @@ function makeCacheKey (opts) {
   }
 
   return {
-    origin: opts.origin.toString(),
+    origin,
     method: opts.method,
     path: fullPath,
     headers: opts.headers
diff --git a/deps/undici/src/lib/web/websocket/websocket.js b/deps/undici/src/lib/web/websocket/websocket.js
index e473a1bc4917..45dbce1bea93 100644
--- a/deps/undici/src/lib/web/websocket/websocket.js
+++ b/deps/undici/src/lib/web/websocket/websocket.js
@@ -25,6 +25,9 @@ const { SendQueue } = require('./sender')
 const { WebsocketFrameSend } = require('./frame')
 const { channels } = require('../../core/diagnostics')
 
+const kRef = Symbol.for('nodejs.ref')
+const kUnref = Symbol.for('nodejs.unref')
+
 function getSocketAddress (socket) {
   if (typeof socket?.address === 'function') {
     return socket.address()
@@ -68,6 +71,7 @@ class WebSocket extends EventTarget {
   #bufferedAmount = 0
   #protocol = ''
   #extensions = ''
+  #refed = true
 
   /** @type {SendQueue} */
   #sendQueue
@@ -194,6 +198,20 @@ class WebSocket extends EventTarget {
     this.#binaryType = 'blob'
   }
 
+  [kRef] () {
+    webidl.brandCheck(this, WebSocket)
+
+    this.#refed = true
+    this.#handler.socket?.ref?.()
+  }
+
+  [kUnref] () {
+    webidl.brandCheck(this, WebSocket)
+
+    this.#refed = false
+    this.#handler.socket?.unref?.()
+  }
+
   /**
    * @see https://websockets.spec.whatwg.org/#dom-websocket-close
    * @param {number|undefined} code
@@ -468,6 +486,10 @@ class WebSocket extends EventTarget {
     // once this happens, the connection is open
     this.#handler.socket = response.socket
 
+    if (!this.#refed) {
+      this.#handler.socket.unref?.()
+    }
+
     // Get options from dispatcher options
     const maxFragments = this.#handler.controller.dispatcher?.webSocketOptions?.maxFragments
     const maxPayloadSize = this.#handler.controller.dispatcher?.webSocketOptions?.maxPayloadSize
diff --git a/deps/undici/src/package-lock.json b/deps/undici/src/package-lock.json
index ecc36b1137b0..28d9db8de52e 100644
--- a/deps/undici/src/package-lock.json
+++ b/deps/undici/src/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "undici",
-  "version": "8.9.0",
+  "version": "8.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "undici",
-      "version": "8.9.0",
+      "version": "8.10.0",
       "license": "MIT",
       "devDependencies": {
         "@fastify/busboy": "3.2.0",
diff --git a/deps/undici/src/package.json b/deps/undici/src/package.json
index f6feb3f0a832..270b572dfc89 100644
--- a/deps/undici/src/package.json
+++ b/deps/undici/src/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.9.0",
+  "version": "8.10.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
diff --git a/deps/undici/src/types/client.d.ts b/deps/undici/src/types/client.d.ts
index e3b121962ef0..064d3d69f2c1 100644
--- a/deps/undici/src/types/client.d.ts
+++ b/deps/undici/src/types/client.d.ts
@@ -1,10 +1,15 @@
 import { URL } from 'node:url'
+import { SessionOptions } from 'node:http2'
 import Dispatcher from './dispatcher'
 import buildConnector from './connector'
 import TClientStats from './client-stats'
 
 type ClientConnectOptions<TOpaque = null> = Omit<Dispatcher.ConnectOptions<TOpaque>, 'origin'>
 
+// TODO: Pendings
+// 1. Reflect this on Client instantiation
+// 2. Client H2 should use this namespaced options instead.
+
 /**
  * A basic HTTP/1.1 client, mapped on top a single TCP/TLS connection. Pipelining is disabled by default.
  */
@@ -87,23 +92,31 @@ export declare namespace Client {
     /**
      * @description Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
      * @default 100
+     * @deprecated Use h2Options.maxConcurrentStreams instead
      */
     maxConcurrentStreams?: number;
     /**
      * @description Sets the HTTP/2 stream-level flow-control window size (SETTINGS_INITIAL_WINDOW_SIZE).
      * @default 262144
+     * @deprecated Use h2Options.settings.initialWindowSize instead
      */
     initialWindowSize?: number;
     /**
      * @description Sets the HTTP/2 connection-level flow-control window size (ClientHttp2Session.setLocalWindowSize).
      * @default 524288
+     * @deprecated Use h2Options.connectionWindowSize instead
      */
     connectionWindowSize?: number;
     /**
      * @description Time interval between PING frames dispatch
      * @default 60000
+     * @deprecated Use h2Options.connectionWindowSize instead
      */
     pingInterval?: number;
+    /**
+     * @description HTTP/2 configuration options
+     */
+    h2Options?: Client.H2Options;
   }
   export interface SocketInfo {
     localAddress?: string
@@ -129,6 +142,33 @@ export declare namespace Client {
      */
     maxPayloadSize?: number;
   }
+
+  export interface H2Options extends Omit<SessionOptions, keyof buildConnector.BuildOptions> {
+    /**
+     * @description Sets the HTTP/2 connection-level flow-control window size (ClientHttp2Session.setLocalWindowSize).
+     * @default 524288
+     */
+    connectionWindowSize?: number;
+    /**
+     * @description Time interval between PING frames dispatch
+     * @default 60000
+     */
+    pingInterval?: number;
+    /**
+     * @description Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
+     * @default 100
+    */
+    maxConcurrentStreams?: number;
+    /**
+     * @description Enable support for H2C (plain text)
+     * @default false
+     */
+    useH2c?: boolean;
+    /**
+     * @description SETTINGS frame object. Default to 'node:http2' defaults
+     */
+    settings?: Omit<SessionOptions['settings'], 'enablePush' | 'maxConcurrentStreams' | 'enableConnectProtocol'>
+  }
 }
 
 export default Client
diff --git a/deps/undici/undici.js b/deps/undici/undici.js
index c0505480ffe9..bb398a0686ce 100644
--- a/deps/undici/undici.js
+++ b/deps/undici/undici.js
@@ -574,6 +574,7 @@ var require_symbols = __commonJS({
       kCounter: /* @__PURE__ */ Symbol("socket request counter"),
       kMaxResponseSize: /* @__PURE__ */ Symbol("max response size"),
       kHTTP2Session: /* @__PURE__ */ Symbol("http2Session"),
+      kHTTP2Options: /* @__PURE__ */ Symbol("http2 options"),
       kHTTP2SessionState: /* @__PURE__ */ Symbol("http2Session state"),
       kRetryHandlerDefaultRetry: /* @__PURE__ */ Symbol("retry agent default retry"),
       kConstruct: /* @__PURE__ */ Symbol("constructable"),
@@ -3266,14 +3267,26 @@ var require_connect = __commonJS({
         } else {
           assert(!httpSocket, "httpSocket can only be sent on TLS update");
           port = port || 80;
-          socket = net.connect({
+          const connectOptions = {
             highWaterMark: 64 * 1024,
             // Same as nodejs fs streams.
             ...options,
             localAddress,
             port,
             host: hostname
-          });
+          };
+          const family = net.isIP(hostname);
+          if (family !== 0 && servername && servername !== hostname) {
+            connectOptions.host = servername;
+            connectOptions.lookup = (_hostname, lookupOptions, cb) => {
+              if (lookupOptions.all) {
+                cb(null, [{ address: hostname, family }]);
+              } else {
+                cb(null, hostname, family);
+              }
+            };
+          }
+          socket = net.connect(connectOptions);
           if (useH2c === true) {
             socket.alpnProtocol = "h2";
           }
@@ -7843,7 +7856,7 @@ var require_client_h1 = __commonJS({
     __name(onSocketClose, "onSocketClose");
     function clearIdleSocketValidation(socket) {
       if (socket[kIdleSocketValidationTimeout]) {
-        clearImmediate(socket[kIdleSocketValidationTimeout]);
+        clearTimeout(socket[kIdleSocketValidationTimeout]);
         socket[kIdleSocketValidationTimeout] = null;
       }
       socket[kIdleSocketValidation] = 0;
@@ -7851,13 +7864,13 @@ var require_client_h1 = __commonJS({
     __name(clearIdleSocketValidation, "clearIdleSocketValidation");
     function scheduleIdleSocketValidation(client, socket) {
       socket[kIdleSocketValidation] = 1;
-      socket[kIdleSocketValidationTimeout] = setImmediate(() => {
+      socket[kIdleSocketValidationTimeout] = setTimeout(() => {
         socket[kIdleSocketValidationTimeout] = null;
         socket[kIdleSocketValidation] = 2;
         if (client[kSocket] === socket && !socket.destroyed) {
           client[kResume]();
         }
-      });
+      }, 0);
       socket[kIdleSocketValidationTimeout].unref?.();
     }
     __name(scheduleIdleSocketValidation, "scheduleIdleSocketValidation");
@@ -8394,10 +8407,7 @@ var require_client_h2 = __commonJS({
       kStrictContentLength,
       kOnError,
       kMaxConcurrentStreams,
-      kPingInterval,
       kHTTP2Session,
-      kHTTP2InitialWindowSize,
-      kHTTP2ConnectionWindowSize,
       kHostAuthority,
       kResume,
       kSize,
@@ -8409,7 +8419,8 @@ var require_client_h2 = __commonJS({
       kEnableConnectProtocol,
       kRemoteSettings,
       kHTTP2Stream,
-      kHTTP2SessionState
+      kHTTP2SessionState,
+      kHTTP2Options
     } = require_symbols();
     var { channels } = require_diagnostics();
     var kOpenStreams = /* @__PURE__ */ Symbol("open streams");
@@ -8418,6 +8429,9 @@ var require_client_h2 = __commonJS({
     var kRequestStreamCleanup = /* @__PURE__ */ Symbol("request stream cleanup");
     var kRequestStreamState = /* @__PURE__ */ Symbol("request stream state");
     var kReceivedGoAway = /* @__PURE__ */ Symbol("received goaway");
+    var kGoAwayReplayAttempts = /* @__PURE__ */ Symbol("goaway replay attempts");
+    var kRefusedStreamRetry = /* @__PURE__ */ Symbol("refused stream retry");
+    var MAX_GOAWAY_REPLAY_ATTEMPTS = 1;
     var extractBody;
     var http2;
     try {
@@ -8523,11 +8537,17 @@ var require_client_h2 = __commonJS({
       }
     }
     __name(completeRequest, "completeRequest");
-    function canRetryRequestAfterGoAway(request) {
+    function canReplayRequest(request) {
       const { body } = request;
       return body == null || util.isBuffer(body) || util.isBlobLike(body);
     }
-    __name(canRetryRequestAfterGoAway, "canRetryRequestAfterGoAway");
+    __name(canReplayRequest, "canReplayRequest");
+    function registerGoAwayRefusal(request) {
+      const attempts = (request[kGoAwayReplayAttempts] ?? 0) + 1;
+      request[kGoAwayReplayAttempts] = attempts;
+      return attempts <= MAX_GOAWAY_REPLAY_ATTEMPTS;
+    }
+    __name(registerGoAwayRefusal, "registerGoAwayRefusal");
     function closeStream(stream, code = NGHTTP2_REFUSED_STREAM) {
       if (stream != null && !stream.destroyed && !stream.closed) {
         try {
@@ -8540,16 +8560,32 @@ var require_client_h2 = __commonJS({
     function detachRequestStreamForClose(request) {
       const stream = request[kRequestStream];
       clearRequestStream(request);
+      severRequestStream(stream);
       return stream;
     }
     __name(detachRequestStreamForClose, "detachRequestStreamForClose");
+    function severRequestStream(stream) {
+      if (stream == null || stream[kRequestStreamState] == null) {
+        return;
+      }
+      stream[kRequestStreamState] = null;
+      stream.off("close", completeRequestStream);
+      stream.off("close", onUpgradeStreamClose);
+      if (stream[kHTTP2Session] != null) {
+        closeStreamSession(stream);
+      }
+      if (!stream.destroyed && !stream.closed) {
+        stream.once("error", noop);
+      }
+    }
+    __name(severRequestStream, "severRequestStream");
     function connectH2(client, socket) {
       client[kSocket] = socket;
-      const http2InitialWindowSize = client[kHTTP2InitialWindowSize];
-      const http2ConnectionWindowSize = client[kHTTP2ConnectionWindowSize];
+      const http2InitialWindowSize = client[kHTTP2Options].sessionOptions?.initialWindowSize;
+      const http2ConnectionWindowSize = client[kHTTP2Options].connectionWindowSize;
       const session = http2.connect(client[kUrl], {
         createConnection: /* @__PURE__ */ __name(() => socket, "createConnection"),
-        peerMaxConcurrentStreams: client[kMaxConcurrentStreams],
+        peerMaxConcurrentStreams: client[kHTTP2Options].maxConcurrentStreams,
         settings: {
           // TODO(metcoder95): add support for PUSH
           enablePush: false,
@@ -8562,13 +8598,16 @@ var require_client_h2 = __commonJS({
       session[kSocket] = socket;
       session[kHTTP2SessionState] = {
         idleTimeout: null,
+        // Armed while the peer advertises MAX_CONCURRENT_STREAMS = 0 and we have
+        // work that cannot start. See setNoStreamsTimeout.
+        noStreamsTimeout: null,
         // Sockets start out ref'd. Session ref/unref proxies to the socket, so a
         // single cached flag lets us skip redundant uv ref/unref calls, provided
         // every ref/unref of the session or its socket goes through
         // refH2Session/unrefH2Session.
         refed: true,
         ping: {
-          interval: client[kPingInterval] === 0 ? null : setInterval(onHttp2SendPing, client[kPingInterval], session).unref()
+          interval: client[kHTTP2Options].pingInterval === 0 ? null : setInterval(onHttp2SendPing, client[kHTTP2Options].pingInterval, session).unref()
         }
       };
       session[kReceivedGoAway] = false;
@@ -8676,9 +8715,52 @@ var require_client_h2 = __commonJS({
         } else {
           clearHttp2IdleTimeout(session);
         }
+        if (client[kMaxConcurrentStreams] === 0 && client[kRunning] === 0 && client[kPending] > 0) {
+          setNoStreamsTimeout(session);
+        } else {
+          clearNoStreamsTimeout(session);
+        }
       }
     }
     __name(resumeH2, "resumeH2");
+    function clearNoStreamsTimeout(session) {
+      const state = session[kHTTP2SessionState];
+      if (state?.noStreamsTimeout != null) {
+        clearTimeout(state.noStreamsTimeout);
+        state.noStreamsTimeout = null;
+      }
+    }
+    __name(clearNoStreamsTimeout, "clearNoStreamsTimeout");
+    function setNoStreamsTimeout(session) {
+      const client = session[kClient];
+      const state = session[kHTTP2SessionState];
+      const timeout = client[kHeadersTimeout];
+      if (!timeout || state.noStreamsTimeout != null) {
+        return;
+      }
+      state.noStreamsTimeout = setTimeout(onNoStreamsTimeout, timeout, session).unref();
+    }
+    __name(setNoStreamsTimeout, "setNoStreamsTimeout");
+    function onNoStreamsTimeout(session) {
+      const client = session[kClient];
+      const state = session[kHTTP2SessionState];
+      state.noStreamsTimeout = null;
+      if (client[kHTTP2Session] !== session || client[kMaxConcurrentStreams] !== 0 || client[kRunning] !== 0 || client[kPending] === 0) {
+        return;
+      }
+      const err = new HeadersTimeoutError(
+        `HTTP/2: server did not accept a new stream within ${client[kHeadersTimeout]}`
+      );
+      const requests = client[kQueue].splice(client[kPendingIdx]);
+      for (let i = 0; i < requests.length; i++) {
+        if (requests[i] != null) {
+          util.errorRequest(client, requests[i], err);
+        }
+      }
+      session[kError] = err;
+      resetHttp2Session(session, err);
+    }
+    __name(onNoStreamsTimeout, "onNoStreamsTimeout");
     function clearHttp2IdleTimeout(session) {
       const state = session[kHTTP2SessionState];
       if (state?.idleTimeout != null) {
@@ -8794,7 +8876,7 @@ var require_client_h2 = __commonJS({
         const request = client[kQueue][i];
         if (request != null) {
           streamsToClose.push(detachRequestStreamForClose(request));
-          if (canRetryRequestAfterGoAway(request)) {
+          if (canReplayRequest(request) && registerGoAwayRefusal(request)) {
             retriableRequests.push(request);
           } else {
             util.errorRequest(client, request, err);
@@ -8815,6 +8897,7 @@ var require_client_h2 = __commonJS({
         client[kHTTP2Session] = null;
       }
       clearHttp2IdleTimeout(this);
+      clearNoStreamsTimeout(this);
       if (!this.closed && !this.destroyed) {
         this.close();
       }
@@ -8832,6 +8915,7 @@ var require_client_h2 = __commonJS({
         client[kHTTP2Session] = null;
       }
       clearHttp2IdleTimeout(this);
+      clearNoStreamsTimeout(this);
       if (state.ping.interval != null) {
         clearInterval(state.ping.interval);
         state.ping.interval = null;
@@ -8915,6 +8999,12 @@ var require_client_h2 = __commonJS({
       releaseRequestStream(this);
       if (state.pendingEnd && !state.request.aborted && !state.request.completed) {
         state.request.onResponseEnd(state.trailers || {});
+      } else if (!state.request.aborted && !state.request.completed) {
+        util.errorRequest(
+          state.client,
+          state.request,
+          new InformationalError("HTTP/2: stream closed before the response was complete")
+        );
       }
       finalizeRequest(state);
       closeStreamSession(this);
@@ -9333,6 +9423,21 @@ var require_client_h2 = __commonJS({
       }
     }
     __name(onEnd, "onEnd");
+    function retryRefusedStream(stream, state) {
+      const { client, request } = state;
+      if (state.responseReceived || request.aborted || request.completed || request[kRefusedStreamRetry] || !canReplayRequest(request)) {
+        return false;
+      }
+      request[kRefusedStreamRetry] = true;
+      detachRequestStreamForClose(request);
+      state.stream = null;
+      state.requestFinalized = true;
+      completeRequest(client, request);
+      client[kQueue].splice(client[kPendingIdx], 0, request);
+      client[kResume]();
+      return true;
+    }
+    __name(retryRefusedStream, "retryRefusedStream");
     function onError(err) {
       const stream = this;
       const state = stream[kRequestStreamState];
@@ -9340,6 +9445,12 @@ var require_client_h2 = __commonJS({
         return;
       }
       stream.off("error", onError);
+      if (typeof stream.rstCode === "number" && stream.rstCode !== NGHTTP2_NO_ERROR) {
+        err.http2ErrorCode = stream.rstCode;
+      }
+      if (stream.rstCode === NGHTTP2_REFUSED_STREAM && retryRefusedStream(stream, state)) {
+        return;
+      }
       state.abort(err);
     }
     __name(onError, "onError");
@@ -9633,10 +9744,8 @@ var require_client = __commonJS({
       kHTTPContext,
       kMaxConcurrentStreams,
       kHostAuthority,
-      kHTTP2InitialWindowSize,
-      kHTTP2ConnectionWindowSize,
       kResume,
-      kPingInterval
+      kHTTP2Options
     } = require_symbols();
     var connectH1 = require_client_h1();
     var connectH2 = require_client_h2();
@@ -9650,6 +9759,15 @@ var require_client = __commonJS({
       return client[kPipelining] ?? client[kHTTPContext]?.defaultPipelining ?? 1;
     }
     __name(getPipelining, "getPipelining");
+    var h2NamespaceOptsWarning = false;
+    function emitH2OptionsNamespaceWarning(optName) {
+      if (h2NamespaceOptsWarning === true) return;
+      process.emitWarning(`Use h2Options.${optName} instead. ${optName} for H2 will be deprecated in future major.`, {
+        code: "UNDICI-H2-OPTIONS"
+      });
+      h2NamespaceOptsWarning = true;
+    }
+    __name(emitH2OptionsNamespaceWarning, "emitH2OptionsNamespaceWarning");
     function getMaxConcurrent(client) {
       if (client[kHTTPContext]?.version === "h2") {
         return client[kMaxConcurrentStreams];
@@ -9697,7 +9815,8 @@ var require_client = __commonJS({
         initialWindowSize,
         connectionWindowSize,
         pingInterval,
-        webSocket
+        webSocket,
+        h2Options
       } = {}) {
         if (keepAlive !== void 0) {
           throw new InvalidArgumentError("unsupported keepAlive, use pipelining=0 instead");
@@ -9760,20 +9879,45 @@ var require_client = __commonJS({
         if (allowH2 != null && typeof allowH2 !== "boolean") {
           throw new InvalidArgumentError("allowH2 must be a valid boolean value");
         }
-        if (maxConcurrentStreams != null && (typeof maxConcurrentStreams !== "number" || maxConcurrentStreams < 1)) {
-          throw new InvalidArgumentError("maxConcurrentStreams must be a positive integer, greater than 0");
-        }
-        if (useH2c != null && typeof useH2c !== "boolean") {
-          throw new InvalidArgumentError("useH2c must be a valid boolean value");
-        }
-        if (initialWindowSize != null && (!Number.isInteger(initialWindowSize) || initialWindowSize < 1)) {
-          throw new InvalidArgumentError("initialWindowSize must be a positive integer, greater than 0");
-        }
-        if (connectionWindowSize != null && (!Number.isInteger(connectionWindowSize) || connectionWindowSize < 1)) {
-          throw new InvalidArgumentError("connectionWindowSize must be a positive integer, greater than 0");
-        }
-        if (pingInterval != null && (typeof pingInterval !== "number" || !Number.isInteger(pingInterval) || pingInterval < 0)) {
-          throw new InvalidArgumentError("pingInterval must be a positive integer, greater or equal to 0");
+        if (allowH2 !== false) {
+          if (h2Options != null) {
+            if (h2Options.useH2c != null && typeof h2Options.useH2c !== "boolean") {
+              throw new InvalidArgumentError("h2Options.useH2c must be a valid boolean value");
+            }
+            if (h2Options.settings?.initialWindowSize != null && (!Number.isInteger(h2Options.settings.initialWindowSize) || h2Options.settings.initialWindowSize < 1)) {
+              throw new InvalidArgumentError("h2Options.settings.initialWindowSize must be a positive integer, greater than 0");
+            }
+            if (h2Options.maxConcurrentStreams != null && (!Number.isInteger(h2Options.connectionWindowSize) || h2Options.maxConcurrentStreams < 1)) {
+              throw new InvalidArgumentError("h2Options.maxConcurrentStreams must be a positive integer, greater than 0");
+            }
+            if (h2Options.connectionWindowSize != null && (!Number.isInteger(h2Options.connectionWindowSize) || h2Options.connectionWindowSize < 1)) {
+              throw new InvalidArgumentError("h2Options.connectionWindowSize must be a positive integer, greater than 0");
+            }
+            if (h2Options.pingInterval != null && (typeof h2Options.pingInterval !== "number" || !Number.isInteger(h2Options.pingInterval) || h2Options.pingInterval < 0)) {
+              throw new InvalidArgumentError("h2Options.pingInterval must be a positive integer, greater or equal to 0");
+            }
+          } else {
+            if (useH2c != null && typeof useH2c !== "boolean") {
+              emitH2OptionsNamespaceWarning("useH2c");
+              throw new InvalidArgumentError("useH2c must be a valid boolean value");
+            }
+            if (maxConcurrentStreams != null && (typeof maxConcurrentStreams !== "number" || maxConcurrentStreams < 1)) {
+              emitH2OptionsNamespaceWarning("maxConcurrentStreams");
+              throw new InvalidArgumentError("maxConcurrentStreams must be a positive integer, greater than 0");
+            }
+            if (initialWindowSize != null && (!Number.isInteger(initialWindowSize) || initialWindowSize < 1)) {
+              emitH2OptionsNamespaceWarning("initialWindowSize");
+              throw new InvalidArgumentError("initialWindowSize must be a positive integer, greater than 0");
+            }
+            if (connectionWindowSize != null && (!Number.isInteger(connectionWindowSize) || connectionWindowSize < 1)) {
+              emitH2OptionsNamespaceWarning("connectionWindowSize");
+              throw new InvalidArgumentError("connectionWindowSize must be a positive integer, greater than 0");
+            }
+            if (pingInterval != null && (typeof pingInterval !== "number" || !Number.isInteger(pingInterval) || pingInterval < 0)) {
+              emitH2OptionsNamespaceWarning("pingInterval");
+              throw new InvalidArgumentError("pingInterval must be a positive integer, greater or equal to 0");
+            }
+          }
         }
         super({ webSocket });
         if (typeof connect2 !== "function") {
@@ -9781,8 +9925,8 @@ var require_client = __commonJS({
             ...tls,
             maxCachedSessions,
             allowH2,
-            useH2c,
             socketPath,
+            useH2c: h2Options?.useH2c ?? useH2c,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
             ...connect2
@@ -9817,10 +9961,21 @@ var require_client = __commonJS({
         this[kClosedResolve] = null;
         this[kMaxResponseSize] = maxResponseSize > -1 ? maxResponseSize : -1;
         this[kHTTPContext] = null;
-        this[kMaxConcurrentStreams] = maxConcurrentStreams != null ? maxConcurrentStreams : 100;
-        this[kHTTP2InitialWindowSize] = initialWindowSize != null ? initialWindowSize : 262144;
-        this[kHTTP2ConnectionWindowSize] = connectionWindowSize != null ? connectionWindowSize : 524288;
-        this[kPingInterval] = pingInterval != null ? pingInterval : 6e4;
+        this[kHTTP2Options] = {
+          pingInterval: h2Options?.pingInterval ?? pingInterval ?? 6e4,
+          connectionWindowSize: h2Options?.connectionWindowSize ?? connectionWindowSize ?? 524288,
+          maxConcurrentStreams: h2Options?.maxConcurrentStreams ?? maxConcurrentStreams ?? 100,
+          // Max peerConcurrentStreams for a Node h2 server
+          sessionOptions: {
+            // HTTP/2 window sizes are set to higher defaults than Node.js core for better performance:
+            // - initialWindowSize: 262144 (256KB) vs Node.js default 65535 (64KB - 1)
+            //   Allows more data to be sent before requiring acknowledgment, improving throughput
+            //   especially on high-latency networks. This matches common production HTTP/2 servers.
+            // - connectionWindowSize: 524288 (512KB) vs Node.js default (none set)
+            //   Provides better flow control for the entire connection across multiple streams.
+            initialWindowSize: h2Options?.initialWindowSize ?? initialWindowSize ?? 262144
+          }
+        };
         this[kQueue] = [];
         this[kRunningIdx] = 0;
         this[kPendingIdx] = 0;
@@ -10110,6 +10265,7 @@ var require_client = __commonJS({
           return;
         }
         if (!client[kHTTPContext]) {
+          client[kServerName] = request.servername;
           connect(client);
           return;
         }
@@ -11076,7 +11232,7 @@ var require_socks5_proxy_agent = __commonJS({
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError } = require_errors();
     var { Socks5Client, STATES } = require_socks5_client();
-    var { kDispatch, kClose, kDestroy } = require_symbols();
+    var { kBusy, kConnected, kDispatch, kClose, kDestroy } = require_symbols();
     var Pool = require_pool();
     var buildConnector = require_connect();
     var { debuglog } = require("node:util");
@@ -11237,6 +11393,17 @@ var require_socks5_proxy_agent = __commonJS({
               }, "connect")
             });
             this[kPools].set(originKey, pool);
+            const closePoolIfUnused = /* @__PURE__ */ __name(() => {
+              if (this[kPools].get(originKey) !== pool || pool[kConnected] > 0 || pool[kBusy]) {
+                return;
+              }
+              this[kPools].delete(originKey);
+              if (!pool.destroyed) {
+                pool.close();
+              }
+            }, "closePoolIfUnused");
+            pool.on("disconnect", closePoolIfUnused);
+            pool.on("connectionError", closePoolIfUnused);
           }
           return pool[kDispatch](opts, handler);
         } catch (err) {
@@ -11638,7 +11805,7 @@ var require_env_http_proxy_agent = __commonJS({
       }
       #getProxyAgentForUrl(url) {
         let { protocol, host: hostname, port } = url;
-        hostname = hostname.replace(/:\d*$/, "").toLowerCase();
+        hostname = hostname.replace(/:\d*$/, "").replace(/^\[(.+)\]$/, "$1").toLowerCase();
         port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0;
         if (!this.#shouldProxy(hostname, port)) {
           return this[kNoProxyAgent];
@@ -11681,11 +11848,22 @@ var require_env_http_proxy_agent = __commonJS({
           if (!entry) {
             continue;
           }
-          const parsed = entry.match(/^(.+):(\d+)$/);
+          let hostname, port;
+          const ipv6WithPort = entry.match(/^\[(.+)\]:(\d+)$/);
+          if (ipv6WithPort) {
+            hostname = ipv6WithPort[1];
+            port = Number.parseInt(ipv6WithPort[2], 10);
+          } else {
+            const unbracketed = entry.replace(/^\[(.+)\]$/, "$1");
+            const colonCount = (unbracketed.match(/:/g) || []).length;
+            const parsed = colonCount === 1 && unbracketed.match(/^(.+):(\d+)$/);
+            hostname = parsed ? parsed[1] : unbracketed;
+            port = parsed ? Number.parseInt(parsed[2], 10) : 0;
+          }
           noProxyEntries.push({
             // strip leading dot or asterisk with dot
-            hostname: (parsed ? parsed[1] : entry).replace(/^\*?\./, "").toLowerCase(),
-            port: parsed ? Number.parseInt(parsed[2], 10) : 0
+            hostname: hostname.replace(/^\*?\./, "").toLowerCase(),
+            port
           });
         }
         this.#noProxyValue = noProxyValue;
@@ -16062,6 +16240,8 @@ var require_websocket = __commonJS({
     var { SendQueue } = require_sender();
     var { WebsocketFrameSend } = require_frame();
     var { channels } = require_diagnostics();
+    var kRef = /* @__PURE__ */ Symbol.for("nodejs.ref");
+    var kUnref = /* @__PURE__ */ Symbol.for("nodejs.unref");
     function getSocketAddress(socket) {
       if (typeof socket?.address === "function") {
         return socket.address();
@@ -16085,6 +16265,7 @@ var require_websocket = __commonJS({
       #bufferedAmount = 0;
       #protocol = "";
       #extensions = "";
+      #refed = true;
       /** @type {SendQueue} */
       #sendQueue;
       /** @type {Handler} */
@@ -16167,6 +16348,16 @@ var require_websocket = __commonJS({
         this.#handler.readyState = _WebSocket.CONNECTING;
         this.#binaryType = "blob";
       }
+      [kRef]() {
+        webidl.brandCheck(this, _WebSocket);
+        this.#refed = true;
+        this.#handler.socket?.ref?.();
+      }
+      [kUnref]() {
+        webidl.brandCheck(this, _WebSocket);
+        this.#refed = false;
+        this.#handler.socket?.unref?.();
+      }
       /**
        * @see https://websockets.spec.whatwg.org/#dom-websocket-close
        * @param {number|undefined} code
@@ -16328,6 +16519,9 @@ var require_websocket = __commonJS({
        */
       #onConnectionEstablished(response, parsedExtensions) {
         this.#handler.socket = response.socket;
+        if (!this.#refed) {
+          this.#handler.socket.unref?.();
+        }
         const maxFragments = this.#handler.controller.dispatcher?.webSocketOptions?.maxFragments;
         const maxPayloadSize = this.#handler.controller.dispatcher?.webSocketOptions?.maxPayloadSize;
         const parser = new ByteParser(this.#handler, parsedExtensions, {
@@ -17247,7 +17441,6 @@ var require_readable = __commonJS({
     var kContentLength = /* @__PURE__ */ Symbol("kContentLength");
     var kUsed = /* @__PURE__ */ Symbol("kUsed");
     var kBytesRead = /* @__PURE__ */ Symbol("kBytesRead");
-    var kPreservedBuffer = /* @__PURE__ */ Symbol("kPreservedBuffer");
     var noop = /* @__PURE__ */ __name(() => {
     }, "noop");
     var BodyReadable = class extends Readable {
@@ -17489,21 +17682,6 @@ var require_readable = __commonJS({
        */
       setEncoding(encoding) {
         if (Buffer.isEncoding(encoding)) {
-          const state = this._readableState;
-          const buffer = state.buffer;
-          if (buffer && state.length > 0) {
-            const bufferIndex = state.bufferIndex ?? 0;
-            const preserved = [];
-            const source = typeof buffer.slice === "function" ? buffer.slice(bufferIndex) : buffer;
-            for (const data of source) {
-              if (Buffer.isBuffer(data)) {
-                preserved.push(data);
-              }
-            }
-            if (preserved.length > 0) {
-              this[kPreservedBuffer] = (this[kPreservedBuffer] || []).concat(preserved);
-            }
-          }
           super.setEncoding(encoding);
         }
         return this;
@@ -17557,13 +17735,7 @@ var require_readable = __commonJS({
         return;
       }
       const { _readableState: state } = consume2.stream;
-      const preserved = consume2.stream[kPreservedBuffer];
-      if (preserved && preserved.length > 0) {
-        for (const chunk of preserved) {
-          consumePush(consume2, chunk);
-        }
-        consume2.stream[kPreservedBuffer] = null;
-      } else if (state.bufferIndex) {
+      if (state.bufferIndex) {
         const start = state.bufferIndex;
         const end = state.buffer.length;
         for (let n = start; n < end; n++) {
@@ -17574,13 +17746,17 @@ var require_readable = __commonJS({
           consumePush(consume2, chunk);
         }
       }
+      const decoder = state.decoder;
+      if (decoder != null && decoder.lastNeed > 0) {
+        consumePush(consume2, Buffer.from(decoder.lastChar.subarray(0, decoder.lastTotal - decoder.lastNeed)));
+      }
       if (state.endEmitted) {
-        consumeEnd(this[kConsume], this._readableState.encoding);
-      } else {
-        consume2.stream.on("end", function() {
-          consumeEnd(this[kConsume], this._readableState.encoding);
-        });
+        consumeEnd(consume2, state.encoding);
+        return;
       }
+      consume2.stream.on("end", function() {
+        consumeEnd(this[kConsume], this._readableState.encoding);
+      });
       consume2.stream.resume();
       while (consume2.stream.read() != null) {
       }
@@ -17641,6 +17817,9 @@ var require_readable = __commonJS({
       if (consume2.body === null) {
         return;
       }
+      if (typeof chunk === "string") {
+        chunk = Buffer.from(chunk, consume2.stream._readableState.encoding);
+      }
       consume2.length += chunk.length;
       consume2.body.push(chunk);
     }
diff --git a/src/undici_version.h b/src/undici_version.h
index e6ecc19f161c..8afd91ad6f9a 100644
--- a/src/undici_version.h
+++ b/src/undici_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-undici.sh
 #ifndef SRC_UNDICI_VERSION_H_
 #define SRC_UNDICI_VERSION_H_
-#define UNDICI_VERSION "8.9.0"
+#define UNDICI_VERSION "8.10.0"
 #endif  // SRC_UNDICI_VERSION_H_

From 83169e58f319e3b2038c59c96e472db994da3af8 Mon Sep 17 00:00:00 2001
From: Trevor Burnham <trevorburnham@gmail.com>
Date: Sat, 8 Aug 2026 20:54:22 -0400
Subject: [PATCH 107/344] sqlite: reject statement-less SQL in SQLTagStore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sqlite3_prepare_v2() returns SQLITE_OK without producing a statement
when its input holds no SQL, such as a comment. PrepareStatement() only
checked the return code, so it cached a StatementSync wrapping a null
sqlite3_stmt. Executing it reached sqlite3_clear_bindings(), which only
guards against a null statement under SQLITE_ENABLE_API_ARMOR, and
segfaulted.

Reject such input instead of caching it. The StatementSync methods
already avoid the crash because their IsFinalized() guard treats a null
statement as finalized.

Fixes: https://github.com/nodejs/node/issues/65149

Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65157
Fixes: https://github.com/nodejs/node/issues/65149
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/node_sqlite.cc                        |  8 ++++++++
 test/parallel/test-sqlite-template-tag.js | 23 +++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 0898e450a503..7688ba30b899 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3659,6 +3659,14 @@ BaseObjectPtr<StatementSync> SQLTagStore::PrepareStatement(
       return BaseObjectPtr<StatementSync>();
     }
 
+    // sqlite3_prepare_v2() reports success without producing a statement when
+    // the input holds no SQL, such as a comment. Such a statement cannot be
+    // bound or executed, so reject it instead of caching it.
+    if (s == nullptr) {
+      THROW_ERR_INVALID_ARG_VALUE(env, "The SQL query contains no statements.");
+      return BaseObjectPtr<StatementSync>();
+    }
+
     BaseObjectPtr<StatementSync> stmt_obj = StatementSync::Create(
         env, BaseObjectPtr<DatabaseSync>(session->database_), s);
 
diff --git a/test/parallel/test-sqlite-template-tag.js b/test/parallel/test-sqlite-template-tag.js
index 445231bef0bd..20376e199d1b 100644
--- a/test/parallel/test-sqlite-template-tag.js
+++ b/test/parallel/test-sqlite-template-tag.js
@@ -317,6 +317,29 @@ test('sql error messages are descriptive', () => {
   });
 });
 
+test('rejects SQL that contains no statements', () => {
+  const expectedError = {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: /contains no statements/,
+  };
+
+  for (const method of ['run', 'get', 'all', 'iterate']) {
+    assert.throws(() => {
+      // eslint-disable-next-line no-unused-expressions
+      sql[method]`-- comment`;
+    }, expectedError);
+
+    assert.throws(() => {
+      // eslint-disable-next-line no-unused-expressions
+      sql[method]``;
+    }, expectedError);
+  }
+
+  // A rejected statement must not be cached, so a later valid query with the
+  // same tag store still works.
+  assert.strictEqual(sql.run`INSERT INTO foo (text) VALUES (${'bob'})`.changes, 1);
+});
+
 test('a tag store keeps the database alive by itself', () => {
   const sql = new DatabaseSync(':memory:').createTagStore();
 

From 5e387ce979c1133c89bd17974566cb6d7f32fe39 Mon Sep 17 00:00:00 2001
From: Trevor Burnham <trevorburnham@gmail.com>
Date: Sun, 9 Aug 2026 11:48:27 -0400
Subject: [PATCH 108/344] sqlite: reject statement-less SQL in prepare()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apply the same check to DatabaseSync::Prepare() so that statement-less
SQL is rejected at preparation instead of on first use. This matches
SQLite's own oo1 JavaScript API, which throws when the SQL contains no
statements rather than exposing the C API's null statement pointer.

Previously db.prepare('-- comment') returned a StatementSync whose
statement_ was null. Every method on it threw "statement has been
finalized", which was misleading because nothing had been finalized, and
the object was still inserted into statements_. Since IsFinalized() is
true for a null statement, its destructor skipped UntrackStatement() and
left a dangling pointer in the set that a later close() would finalize.

Refs: https://github.com/nodejs/node/pull/65157#discussion_r3742903347
Refs: https://sqlite.org/wasm/doc/trunk/api-oo1.md

Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65157
Fixes: https://github.com/nodejs/node/issues/65149
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/sqlite.md                          |  4 ++++
 src/node_sqlite.cc                         | 15 ++++++++++---
 test/parallel/test-sqlite-database-sync.js | 26 ++++++++++++++++++++++
 3 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 449e88bfb3a5..601961243ce2 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -662,6 +662,10 @@ console.log(query.get());
 
 <!-- YAML
 added: v22.5.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65157
+    description: Throw `ERR_INVALID_ARG_VALUE` if `sql` contains no statements.
 -->
 
 * `sql` {string} A SQL string to compile to a prepared statement.
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 7688ba30b899..97384bdf449d 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1581,6 +1581,16 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
   int r = sqlite3_prepare_v2(db->connection_, *sql, -1, &s, nullptr);
 
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
+
+  // sqlite3_prepare_v2() reports success without producing a statement when
+  // the input holds no SQL, such as a comment. Such a statement can never be
+  // stepped, and tracking it would leave a dangling pointer in statements_
+  // because its destructor treats a null statement as already finalized.
+  if (s == nullptr) {
+    THROW_ERR_INVALID_ARG_VALUE(env, "The SQL query contains no statements.");
+    return;
+  }
+
   BaseObjectPtr<StatementSync> stmt =
       StatementSync::Create(env, BaseObjectPtr<DatabaseSync>(db), s);
   db->statements_.insert(stmt.get());
@@ -3659,9 +3669,8 @@ BaseObjectPtr<StatementSync> SQLTagStore::PrepareStatement(
       return BaseObjectPtr<StatementSync>();
     }
 
-    // sqlite3_prepare_v2() reports success without producing a statement when
-    // the input holds no SQL, such as a comment. Such a statement cannot be
-    // bound or executed, so reject it instead of caching it.
+    // As in DatabaseSync::Prepare(), reject input that holds no SQL rather
+    // than caching a statement that can never be bound or stepped.
     if (s == nullptr) {
       THROW_ERR_INVALID_ARG_VALUE(env, "The SQL query contains no statements.");
       return BaseObjectPtr<StatementSync>();
diff --git a/test/parallel/test-sqlite-database-sync.js b/test/parallel/test-sqlite-database-sync.js
index af7677a3cfc0..08a636c9cbdc 100644
--- a/test/parallel/test-sqlite-database-sync.js
+++ b/test/parallel/test-sqlite-database-sync.js
@@ -397,6 +397,32 @@ suite('DatabaseSync.prototype.prepare()', () => {
       message: /The "sql" argument must be a string/,
     });
   });
+
+  test('throws if sql contains no statements', (t) => {
+    using db = new DatabaseSync(nextDb());
+
+    for (const sql of ['', '   ', ';', '-- comment', '/* comment */']) {
+      t.assert.throws(() => {
+        db.prepare(sql);
+      }, {
+        code: 'ERR_INVALID_ARG_VALUE',
+        message: /contains no statements/,
+      });
+    }
+  });
+
+  test('prepares statements that contain comments', (t) => {
+    using db = new DatabaseSync(nextDb());
+    const queries = [
+      '-- lead\nSELECT 1 AS v',
+      'SELECT 1 AS v -- trail',
+      'SELECT /* mid */ 1 AS v',
+    ];
+
+    for (const sql of queries) {
+      t.assert.strictEqual(db.prepare(sql).get().v, 1);
+    }
+  });
 });
 
 suite('DatabaseSync.prototype.exec()', () => {

From 162257b403557c20d571522bcce81cf2959eb0dd Mon Sep 17 00:00:00 2001
From: Kamal Rawal <obviouslykamal@gmail.com>
Date: Tue, 11 Aug 2026 11:18:03 +0530
Subject: [PATCH 109/344] assert: improve documentation wording

Signed-off-by: Rawal27 <obviouslykamal@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64953
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Rich Trott <rtrott@gmail.com>
---
 doc/api/assert.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/api/assert.md b/doc/api/assert.md
index 1a99709767ef..c33f4ba82336 100644
--- a/doc/api/assert.md
+++ b/doc/api/assert.md
@@ -317,7 +317,7 @@ const assert2 = new Assert({ skipPrototype: true });
 assert2.deepStrictEqual(foo, bar); // OK
 ```
 
-When destructured, methods lose access to the instance's `this` context and revert to default assertion behavior
+When destructured, methods lose access to the instance's `this` context and revert to the default assertion behavior
 (diff: 'simple', non-strict mode).
 To maintain custom options when using destructured methods, avoid
 destructuring and call methods directly on the instance.
@@ -423,8 +423,8 @@ are also recursively evaluated by the following rules.
 ### Comparison details
 
 * Primitive values are compared with the [`==` operator][],
-  with the exception of {NaN}. It is treated as being identical in case
-  both sides are {NaN}.
+  except for {NaN}, which is treated as identical when both
+  sides are {NaN}.
 * [Type tags][Object.prototype.toString()] of objects should be the same.
 * Only [enumerable "own" properties][] are considered.
 * Object constructors are compared when available.
@@ -938,7 +938,7 @@ error messages as expressive as possible.
 If specified, `error` can be a [`Class`][], {RegExp} or a validation
 function. See [`assert.throws()`][] for more details.
 
-Besides the async nature to await the completion behaves identically to
+Aside from asynchronously awaiting completion, it behaves identically to
 [`assert.doesNotThrow()`][].
 
 ```mjs

From 40b1b18839e4fffde57f76be5311904840c59487 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 11 Aug 2026 12:56:18 +0200
Subject: [PATCH 110/344] tools: remove skip logic in `commit-queue.sh`

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65162
Reviewed-By: Jithil P Ponnan <jithil@outlook.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 tools/actions/commit-queue.sh | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index b6e62139d626..9828f2d6b3e8 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -35,18 +35,7 @@ SHOULD_ABORT=
 
 for pr in "$@"; do
   gh pr view "$pr" --json labels --jq ".labels" > labels.json
-  # Skip PR if CI was requested
-  if jq -e 'map(.name) | index("request-ci")' < labels.json; then
-    echo "pr ${pr} skipped, waiting for CI to start"
-    continue
-  fi
-
-  # Skip PR if CI is still running
-  if gh pr checks "$pr" | grep -q "\spending\s"; then
-    echo "pr ${pr} skipped, CI still running"
-    continue
-  fi
-
+  
   if jq -e 'map(.name) | index("commit-queue-squash")' < labels.json; then
     MULTIPLE_COMMIT_POLICY="--fixupAll"
   elif jq -e 'map(.name) | index("commit-queue-rebase")' < labels.json; then

From 3cfe19489c3fa96d2675a99fc29401a78d7896e7 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Tue, 11 Aug 2026 07:08:57 -0700
Subject: [PATCH 111/344] src: use concepts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some general modernizations of templates

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65148
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
---
 node.gyp                               |  1 +
 src/aliased_buffer-inl.h               | 20 +++++++++++++
 src/aliased_buffer.h                   |  3 +-
 src/blob_serializer_deserializer-inl.h | 20 ++++++-------
 src/blob_serializer_deserializer.h     | 10 +++++++
 src/crypto/crypto_aes.cc               |  2 +-
 src/crypto/crypto_util.h               |  2 +-
 src/debug_utils-inl.h                  | 14 +++------
 src/json_utils.h                       |  6 ++--
 src/memory_tracker-inl.h               |  2 +-
 src/memory_tracker.h                   |  6 ++--
 src/node_concepts.h                    | 39 ++++++++++++++++++++++++++
 src/node_i18n.cc                       |  4 +--
 src/node_platform.h                    |  9 ++----
 src/node_realm-inl.h                   |  4 +--
 src/node_realm.h                       |  2 +-
 src/node_report.h                      |  2 +-
 src/node_sea.cc                        | 10 +++----
 src/node_snapshotable.cc               | 12 ++++----
 src/node_snapshotable.h                | 13 ++-------
 src/node_wasi.cc                       |  8 +++---
 src/req_wrap-inl.h                     |  3 +-
 src/stream_base-inl.h                  | 31 +++++++++-----------
 src/stream_base.h                      |  7 ++---
 src/stream_wrap.cc                     |  6 ++--
 src/tracing/trace_event_legacy_inl.h   |  7 +++--
 src/util-inl.h                         | 26 ++++++++---------
 src/util.h                             | 33 ++++++++--------------
 28 files changed, 161 insertions(+), 141 deletions(-)
 create mode 100644 src/node_concepts.h

diff --git a/node.gyp b/node.gyp
index 5fbf5e31c039..82913b344b29 100644
--- a/node.gyp
+++ b/node.gyp
@@ -254,6 +254,7 @@
       'src/node_blob.h',
       'src/node_buffer.h',
       'src/node_builtins.h',
+      'src/node_concepts.h',
       'src/node_config_file.h',
       'src/node_constants.h',
       'src/node_context_data.h',
diff --git a/src/aliased_buffer-inl.h b/src/aliased_buffer-inl.h
index da2c45321f6d..5cb36e707ce2 100644
--- a/src/aliased_buffer-inl.h
+++ b/src/aliased_buffer-inl.h
@@ -12,6 +12,7 @@ namespace node {
 typedef size_t AliasedBufferIndex;
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 AliasedBufferBase<NativeT, V8T>::AliasedBufferBase(
     v8::Isolate* isolate, const size_t count, const AliasedBufferIndex* index)
     : isolate_(isolate), count_(count), byte_offset_(0), index_(index) {
@@ -34,6 +35,7 @@ AliasedBufferBase<NativeT, V8T>::AliasedBufferBase(
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 AliasedBufferBase<NativeT, V8T>::AliasedBufferBase(
     v8::Isolate* isolate,
     const size_t byte_offset,
@@ -65,6 +67,7 @@ AliasedBufferBase<NativeT, V8T>::AliasedBufferBase(
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 AliasedBufferBase<NativeT, V8T>::AliasedBufferBase(
     const AliasedBufferBase& that)
     : isolate_(that.isolate_),
@@ -76,6 +79,7 @@ AliasedBufferBase<NativeT, V8T>::AliasedBufferBase(
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 AliasedBufferIndex AliasedBufferBase<NativeT, V8T>::Serialize(
     v8::Local<v8::Context> context, v8::SnapshotCreator* creator) {
   DCHECK(is_valid());
@@ -83,6 +87,7 @@ AliasedBufferIndex AliasedBufferBase<NativeT, V8T>::Serialize(
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline void AliasedBufferBase<NativeT, V8T>::Deserialize(
     v8::Local<v8::Context> context) {
   DCHECK_NOT_NULL(index_);
@@ -99,6 +104,7 @@ inline void AliasedBufferBase<NativeT, V8T>::Deserialize(
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 AliasedBufferBase<NativeT, V8T>& AliasedBufferBase<NativeT, V8T>::operator=(
     AliasedBufferBase<NativeT, V8T>&& that) noexcept {
   DCHECK(is_valid());
@@ -116,41 +122,48 @@ AliasedBufferBase<NativeT, V8T>& AliasedBufferBase<NativeT, V8T>::operator=(
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 v8::Local<V8T> AliasedBufferBase<NativeT, V8T>::GetJSArray() const {
   DCHECK(is_valid());
   return js_array_.Get(isolate_);
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 void AliasedBufferBase<NativeT, V8T>::Release() {
   DCHECK_NULL(index_);
   js_array_.Reset();
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline void AliasedBufferBase<NativeT, V8T>::MakeWeak() {
   DCHECK(is_valid());
   js_array_.SetWeak();
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 v8::Local<v8::ArrayBuffer> AliasedBufferBase<NativeT, V8T>::GetArrayBuffer()
     const {
   return GetJSArray()->Buffer();
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline const NativeT* AliasedBufferBase<NativeT, V8T>::GetNativeBuffer() const {
   DCHECK(is_valid());
   return buffer_;
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline const NativeT* AliasedBufferBase<NativeT, V8T>::operator*() const {
   return GetNativeBuffer();
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline void AliasedBufferBase<NativeT, V8T>::SetValue(const size_t index,
                                                       NativeT value) {
   DCHECK_LT(index, count_);
@@ -159,6 +172,7 @@ inline void AliasedBufferBase<NativeT, V8T>::SetValue(const size_t index,
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline const NativeT AliasedBufferBase<NativeT, V8T>::GetValue(
     const size_t index) const {
   DCHECK(is_valid());
@@ -167,6 +181,7 @@ inline const NativeT AliasedBufferBase<NativeT, V8T>::GetValue(
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 typename AliasedBufferBase<NativeT, V8T>::Reference
 AliasedBufferBase<NativeT, V8T>::operator[](size_t index) {
   DCHECK(is_valid());
@@ -174,16 +189,19 @@ AliasedBufferBase<NativeT, V8T>::operator[](size_t index) {
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 NativeT AliasedBufferBase<NativeT, V8T>::operator[](size_t index) const {
   return GetValue(index);
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 size_t AliasedBufferBase<NativeT, V8T>::Length() const {
   return count_;
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 void AliasedBufferBase<NativeT, V8T>::reserve(size_t new_capacity) {
   DCHECK(is_valid());
   DCHECK_GE(new_capacity, count_);
@@ -214,11 +232,13 @@ void AliasedBufferBase<NativeT, V8T>::reserve(size_t new_capacity) {
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline bool AliasedBufferBase<NativeT, V8T>::is_valid() const {
   return index_ == nullptr && !js_array_.IsEmpty();
 }
 
 template <typename NativeT, typename V8T>
+  requires std::is_scalar_v<NativeT>
 inline size_t AliasedBufferBase<NativeT, V8T>::SelfSize() const {
   return sizeof(*this);
 }
diff --git a/src/aliased_buffer.h b/src/aliased_buffer.h
index 8e988bcb010d..ff2b961724d6 100644
--- a/src/aliased_buffer.h
+++ b/src/aliased_buffer.h
@@ -29,10 +29,9 @@ typedef size_t AliasedBufferIndex;
  * observed. Any notification APIs will be left as a future exercise.
  */
 template <class NativeT, class V8T>
+  requires std::is_scalar_v<NativeT>
 class AliasedBufferBase final : public MemoryRetainer {
  public:
-  static_assert(std::is_scalar_v<NativeT>);
-
   AliasedBufferBase(v8::Isolate* isolate,
                     size_t count,
                     const AliasedBufferIndex* index = nullptr);
diff --git a/src/blob_serializer_deserializer-inl.h b/src/blob_serializer_deserializer-inl.h
index fa258dbe8144..2a2aed1171f7 100644
--- a/src/blob_serializer_deserializer-inl.h
+++ b/src/blob_serializer_deserializer-inl.h
@@ -90,8 +90,8 @@ std::string BlobSerializerDeserializer::GetName() const {
 // Helper for reading numeric types.
 template <typename Impl>
 template <typename T>
+  requires std::is_arithmetic_v<T>
 T BlobDeserializer<Impl>::ReadArithmetic() {
-  static_assert(std::is_arithmetic_v<T>, "Not an arithmetic type");
   T result;
   ReadArithmetic(&result, 1);
   return result;
@@ -158,8 +158,8 @@ std::string_view BlobDeserializer<Impl>::ReadStringView(StringLogMode mode) {
 // Helper for reading an array of numeric types.
 template <typename Impl>
 template <typename T>
+  requires std::is_arithmetic_v<T>
 void BlobDeserializer<Impl>::ReadArithmetic(T* out, size_t count) {
-  static_assert(std::is_arithmetic_v<T>, "Not an arithmetic type");
   DCHECK_GT(count, 0);  // Should not read contents for vectors of size 0.
   if (is_debug) {
     std::string name = GetName<T>();
@@ -180,8 +180,8 @@ void BlobDeserializer<Impl>::ReadArithmetic(T* out, size_t count) {
 // Helper for reading numeric vectors.
 template <typename Impl>
 template <typename Number>
+  requires std::is_arithmetic_v<Number>
 std::vector<Number> BlobDeserializer<Impl>::ReadArithmeticVector(size_t count) {
-  static_assert(std::is_arithmetic_v<Number>, "Not an arithmetic type");
   DCHECK_GT(count, 0);  // Should not read contents for vectors of size 0.
   std::vector<Number> result(count);
   ReadArithmetic(result.data(), count);
@@ -191,8 +191,8 @@ std::vector<Number> BlobDeserializer<Impl>::ReadArithmeticVector(size_t count) {
 // Helper for reading non-numeric vectors.
 template <typename Impl>
 template <typename T>
+  requires(!std::is_arithmetic_v<T>)
 std::vector<T> BlobDeserializer<Impl>::ReadNonArithmeticVector(size_t count) {
-  static_assert(!std::is_arithmetic_v<T>, "Arithmetic type");
   DCHECK_GT(count, 0);  // Should not read contents for vectors of size 0.
   std::vector<T> result;
   result.reserve(count);
@@ -224,8 +224,8 @@ T BlobDeserializer<Impl>::ReadElement() {
 // Helper for writing numeric types.
 template <typename Impl>
 template <typename T>
+  requires std::is_arithmetic_v<T>
 size_t BlobSerializer<Impl>::WriteArithmetic(const T& data) {
-  static_assert(std::is_arithmetic_v<T>, "Not an arithmetic type");
   return WriteArithmetic(&data, 1);
 }
 
@@ -303,8 +303,8 @@ static size_t kPreviewCount = 16;
 // Helper for writing an array of numeric types.
 template <typename Impl>
 template <typename T>
+  requires std::is_arithmetic_v<T>
 size_t BlobSerializer<Impl>::WriteArithmetic(const T* data, size_t count) {
-  static_assert(std::is_arithmetic_v<T>, "Arithmetic type");
   DCHECK_GT(count, 0);  // Should not write contents for vectors of size 0.
   if (is_debug) {
     size_t preview_count = count < kPreviewCount ? count : kPreviewCount;
@@ -338,18 +338,18 @@ size_t BlobSerializer<Impl>::WriteArithmetic(const T* data, size_t count) {
 // Helper for writing numeric vectors.
 template <typename Impl>
 template <typename Number>
+  requires std::is_arithmetic_v<Number>
 size_t BlobSerializer<Impl>::WriteArithmeticVector(
     const std::vector<Number>& data) {
-  static_assert(std::is_arithmetic_v<Number>, "Arithmetic type");
   return WriteArithmetic(data.data(), data.size());
 }
 
 // Helper for writing non-numeric vectors.
 template <typename Impl>
 template <typename T>
-size_t BlobSerializer<Impl>::WriteNonArithmeticVector(
-    const std::vector<T>& data) {
-  static_assert(!std::is_arithmetic_v<T>, "Arithmetic type");
+  requires(!std::is_arithmetic_v<T>)
+size_t
+    BlobSerializer<Impl>::WriteNonArithmeticVector(const std::vector<T>& data) {
   DCHECK_GT(data.size(),
             0);  // Should not write contents for vectors of size 0.
   size_t written_total = 0;
diff --git a/src/blob_serializer_deserializer.h b/src/blob_serializer_deserializer.h
index fe7989e22a35..cd63d0477675 100644
--- a/src/blob_serializer_deserializer.h
+++ b/src/blob_serializer_deserializer.h
@@ -1,7 +1,9 @@
 #ifndef SRC_BLOB_SERIALIZER_DESERIALIZER_H_
 #define SRC_BLOB_SERIALIZER_DESERIALIZER_H_
 
+#include <concepts>
 #include <string>
+#include <type_traits>
 #include <vector>
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
@@ -49,6 +51,7 @@ class BlobDeserializer : public BlobSerializerDeserializer {
 
   // Helper for reading numeric types.
   template <typename T>
+    requires std::is_arithmetic_v<T>
   T ReadArithmetic();
 
   // Layout of vectors:
@@ -63,15 +66,18 @@ class BlobDeserializer : public BlobSerializerDeserializer {
 
   // Helper for reading an array of numeric types.
   template <typename T>
+    requires std::is_arithmetic_v<T>
   void ReadArithmetic(T* out, size_t count);
 
   // Helper for reading numeric vectors.
   template <typename Number>
+    requires std::is_arithmetic_v<Number>
   std::vector<Number> ReadArithmeticVector(size_t count);
 
  private:
   // Helper for reading non-numeric vectors.
   template <typename T>
+    requires(!std::is_arithmetic_v<T>)
   std::vector<T> ReadNonArithmeticVector(size_t count);
 
   template <typename T>
@@ -94,6 +100,7 @@ class BlobSerializer : public BlobSerializerDeserializer {
 
   // Helper for writing numeric types.
   template <typename T>
+    requires std::is_arithmetic_v<T>
   size_t WriteArithmetic(const T& data);
 
   // Layout of vectors:
@@ -110,15 +117,18 @@ class BlobSerializer : public BlobSerializerDeserializer {
 
   // Helper for writing an array of numeric types.
   template <typename T>
+    requires std::is_arithmetic_v<T>
   size_t WriteArithmetic(const T* data, size_t count);
 
   // Helper for writing numeric vectors.
   template <typename Number>
+    requires std::is_arithmetic_v<Number>
   size_t WriteArithmeticVector(const std::vector<Number>& data);
 
  private:
   // Helper for writing non-numeric vectors.
   template <typename T>
+    requires(!std::is_arithmetic_v<T>)
   size_t WriteNonArithmeticVector(const std::vector<T>& data);
 
   template <typename T>
diff --git a/src/crypto/crypto_aes.cc b/src/crypto/crypto_aes.cc
index 171688b92926..bea8f5b24be5 100644
--- a/src/crypto/crypto_aes.cc
+++ b/src/crypto/crypto_aes.cc
@@ -259,7 +259,7 @@ WebCryptoCipherStatus AES_KW_Cipher(Environment* env,
 // implementation here:
 // https://github.com/chromium/chromium/blob/7af6cfd/components/webcrypto/algorithms/aes_ctr.cc
 
-template <typename T>
+template <std::integral T>
 T CeilDiv(T a, T b) {
   return a == 0 ? 0 : 1 + (a - 1) / b;
 }
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index 5c9dad13196b..dd7e0842a29b 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -732,8 +732,8 @@ class ArrayBufferOrViewContents final {
   }
 
   template <typename M>
+    requires(sizeof(M) == 1)
   void CopyTo(M* dest, size_t len) const {
-    static_assert(sizeof(M) == 1, "sizeof(M) must equal 1");
     len = std::min(len, size());
     if (len > 0 && data() != nullptr) {
       memcpy(dest, data(), len);
diff --git a/src/debug_utils-inl.h b/src/debug_utils-inl.h
index 3afab8629968..5f739246825a 100644
--- a/src/debug_utils-inl.h
+++ b/src/debug_utils-inl.h
@@ -49,10 +49,7 @@ struct ToStringHelper {
     return value.ToStringView();
   }
 
-  template <typename T,
-            typename test_for_number = typename std::
-                enable_if_t<std::is_arithmetic_v<T> || std::is_enum_v<T>, bool>,
-            typename dummy = bool>
+  template <NumericOrEnum T>
   static std::string Convert(const T& value) {
     return std::to_string(value);
   }
@@ -81,9 +78,7 @@ struct ToStringHelper {
     return utf8_value.ToString();
   }
 
-  template <unsigned BASE_BITS,
-            typename T,
-            typename = std::enable_if_t<std::is_integral_v<T>>>
+  template <unsigned BASE_BITS, std::integral T>
   static std::string BaseConvert(const T& value) {
     auto v = static_cast<uint64_t>(value);
     char ret[3 * sizeof(T)];
@@ -96,9 +91,8 @@ struct ToStringHelper {
     } while ((v >>= BASE_BITS) != 0);
     return ptr;
   }
-  template <unsigned BASE_BITS,
-            typename T,
-            typename = std::enable_if_t<!std::is_integral_v<T>>>
+  template <unsigned BASE_BITS, typename T>
+    requires(!std::integral<T>)
   static auto BaseConvert(T&& value) {
     return Convert(std::forward<T>(value));
   }
diff --git a/src/json_utils.h b/src/json_utils.h
index 06d4a7ac0905..e75556578522 100644
--- a/src/json_utils.h
+++ b/src/json_utils.h
@@ -3,6 +3,8 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
+#include "node_concepts.h"
+
 #include <iomanip>
 #include <limits>
 #include <ostream>
@@ -132,9 +134,7 @@ class JSONWriter {
   };
 
  private:
-  template <typename T,
-            typename test_for_number = typename std::
-                enable_if<std::numeric_limits<T>::is_specialized, bool>::type>
+  template <NumericValue T>
   inline void write_value(T number) {
     if constexpr (std::is_same<T, bool>::value)
       out_ << (number ? "true" : "false");
diff --git a/src/memory_tracker-inl.h b/src/memory_tracker-inl.h
index a59452fd994c..3c82983ce01e 100644
--- a/src/memory_tracker-inl.h
+++ b/src/memory_tracker-inl.h
@@ -203,7 +203,7 @@ void MemoryTracker::TrackField(const char* edge_name,
   TrackField(edge_name, container, node_name, element_name);
 }
 
-template <typename T, typename test_for_number, typename dummy>
+template <NumericValue T>
 void MemoryTracker::TrackField(const char* edge_name,
                                const T& value,
                                const char* node_name) {
diff --git a/src/memory_tracker.h b/src/memory_tracker.h
index 88987c954f4d..d7893f10b3af 100644
--- a/src/memory_tracker.h
+++ b/src/memory_tracker.h
@@ -2,6 +2,7 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
+#include "node_concepts.h"
 #include "v8-profiler.h"
 
 #include <uv.h>
@@ -229,10 +230,7 @@ class MemoryTracker {
   inline void TrackField(const char* edge_name,
                          const std::basic_string<T>& value,
                          const char* node_name = nullptr);
-  template <typename T,
-            typename test_for_number = typename std::
-                enable_if<std::numeric_limits<T>::is_specialized, bool>::type,
-            typename dummy = bool>
+  template <NumericValue T>
   inline void TrackField(const char* edge_name,
                          const T& value,
                          const char* node_name = nullptr);
diff --git a/src/node_concepts.h b/src/node_concepts.h
new file mode 100644
index 000000000000..5dbce5c6f88a
--- /dev/null
+++ b/src/node_concepts.h
@@ -0,0 +1,39 @@
+#ifndef SRC_NODE_CONCEPTS_H_
+#define SRC_NODE_CONCEPTS_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <concepts>
+#include <limits>
+#include <type_traits>
+
+namespace node {
+
+// A numeric type recognized by std::numeric_limits.
+// The is_array guard prevents a hard error from instantiating
+// numeric_limits<T[N]>, whose member functions would return array types.
+template <typename T>
+concept NumericValue = !
+std::is_array_v<T>&& std::numeric_limits<T>::is_specialized;
+
+// A numeric type or an enum (which has an underlying numeric type).
+template <typename T>
+concept NumericOrEnum = NumericValue<T> || std::is_enum_v<T>;
+
+// A type that has a valid std::char_traits specialization, as required by
+// std::basic_string and std::basic_string_view.
+template <typename T>
+concept StandardCharType =
+    std::is_same_v<T, char> || std::is_same_v<T, wchar_t> ||
+    std::is_same_v<T, char8_t> || std::is_same_v<T, char16_t> ||
+    std::is_same_v<T, char32_t>;
+
+// Test whether some value can be called with ().
+template <typename T>
+concept IsCallable = std::is_function<T>::value || requires { &T::operator(); };
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_NODE_CONCEPTS_H_
diff --git a/src/node_i18n.cc b/src/node_i18n.cc
index 3c4f419aa294..96ec2f6ee5ab 100644
--- a/src/node_i18n.cc
+++ b/src/node_i18n.cc
@@ -103,14 +103,12 @@ namespace i18n {
 namespace {
 
 template <typename T>
+  requires(sizeof(T) == 1 || sizeof(T) == 2)
 MaybeLocal<Object> ToBufferEndian(Environment* env, MaybeStackBuffer<T>* buf) {
   Local<Object> ret;
   if (!Buffer::New(env, buf).ToLocal(&ret)) {
     return {};
   }
-
-  static_assert(sizeof(T) == 1 || sizeof(T) == 2,
-                "Currently only one- or two-byte buffers are supported");
   if constexpr (sizeof(T) > 1 && IsBigEndian()) {
     SPREAD_BUFFER_ARG(ret, retbuf);
     CHECK(nbytes::SwapBytes16(retbuf_data, retbuf_length));
diff --git a/src/node_platform.h b/src/node_platform.h
index f47e2a46b66b..e98ecf322802 100644
--- a/src/node_platform.h
+++ b/src/node_platform.h
@@ -3,6 +3,7 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
+#include <concepts>
 #include <functional>
 #include <queue>
 #include <type_traits>
@@ -20,12 +21,8 @@ class NodePlatform;
 class IsolateData;
 class PerIsolatePlatformData;
 
-template <typename, typename = void>
-struct has_priority : std::false_type {};
-
 template <typename T>
-struct has_priority<T, std::void_t<decltype(std::declval<T>().priority)>>
-    : std::true_type {};
+concept has_priority = requires(T t) { t.priority; };
 
 template <class T>
 class TaskQueue {
@@ -35,7 +32,7 @@ class TaskQueue {
   struct EntryCompare {
     bool operator()(const std::unique_ptr<T>& a,
                     const std::unique_ptr<T>& b) const {
-      if constexpr (has_priority<T>::value) {
+      if constexpr (has_priority<T>) {
         return a->priority < b->priority;
       } else {
         return false;
diff --git a/src/node_realm-inl.h b/src/node_realm-inl.h
index b004bd1e1500..394ece5a8ace 100644
--- a/src/node_realm-inl.h
+++ b/src/node_realm-inl.h
@@ -92,10 +92,8 @@ inline T* Realm::GetBindingData() {
   return result;
 }
 
-template <typename T, typename... Args>
+template <std::derived_from<BaseObject> T, typename... Args>
 inline T* Realm::AddBindingData(v8::Local<v8::Object> target, Args&&... args) {
-  // This won't compile if T is not a BaseObject subclass.
-  static_assert(std::is_base_of_v<BaseObject, T>);
   // The binding data must be weak so that it won't keep the realm reachable
   // from strong GC roots indefinitely. The wrapper object of binding data
   // should be referenced from JavaScript, thus the binding data should be
diff --git a/src/node_realm.h b/src/node_realm.h
index 2ed04aa271b4..690beaf1a1aa 100644
--- a/src/node_realm.h
+++ b/src/node_realm.h
@@ -127,7 +127,7 @@ class Realm : public MemoryRetainer {
   // Methods created using SetMethod(), SetPrototypeMethod(), etc. inside
   // this scope can access the created T* object using
   // GetBindingData<T>(args) later.
-  template <typename T, typename... Args>
+  template <std::derived_from<BaseObject> T, typename... Args>
   T* AddBindingData(v8::Local<v8::Object> target, Args&&... args);
   template <typename T, typename U>
   static inline T* GetBindingData(const v8::PropertyCallbackInfo<U>& info);
diff --git a/src/node_report.h b/src/node_report.h
index 98be339ae90d..ae1e03df625b 100644
--- a/src/node_report.h
+++ b/src/node_report.h
@@ -22,7 +22,7 @@ namespace report {
 void WalkHandleNetwork(uv_handle_t* h, void* arg);
 void WalkHandleNoNetwork(uv_handle_t* h, void* arg);
 
-template <typename T>
+template <std::integral T>
 std::string ValueToHexString(T value) {
   std::stringstream hex;
 
diff --git a/src/node_sea.cc b/src/node_sea.cc
index 81d47c11ffab..03d487f1dba7 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -66,9 +66,8 @@ class SeaSerializer : public BlobSerializer<SeaSerializer> {
       : BlobSerializer<SeaSerializer>(
             per_process::enabled_debug_list.enabled(DebugCategory::SEA)) {}
 
-  template <typename T,
-            std::enable_if_t<!std::is_same<T, std::string>::value>* = nullptr,
-            std::enable_if_t<!std::is_arithmetic<T>::value>* = nullptr>
+  template <typename T>
+    requires(!std::is_arithmetic_v<T> && !std::same_as<T, std::string>)
   size_t Write(const T& data);
 };
 
@@ -150,9 +149,8 @@ class SeaDeserializer : public BlobDeserializer<SeaDeserializer> {
       : BlobDeserializer<SeaDeserializer>(
             per_process::enabled_debug_list.enabled(DebugCategory::SEA), v) {}
 
-  template <typename T,
-            std::enable_if_t<!std::is_same<T, std::string>::value>* = nullptr,
-            std::enable_if_t<!std::is_arithmetic<T>::value>* = nullptr>
+  template <typename T>
+    requires(!std::is_arithmetic_v<T> && !std::same_as<T, std::string>)
   T Read();
 };
 
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index f90e5f28ac28..7f5d9b9e1821 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -155,9 +155,8 @@ class SnapshotDeserializer : public BlobDeserializer<SnapshotDeserializer> {
                 DebugCategory::SNAPSHOT_SERDES),
             v) {}
 
-  template <typename T,
-            std::enable_if_t<!std::is_same<T, std::string>::value>* = nullptr,
-            std::enable_if_t<!std::is_arithmetic<T>::value>* = nullptr>
+  template <typename T>
+    requires(!std::is_arithmetic_v<T> && !std::same_as<T, std::string>)
   T Read();
 };
 
@@ -172,9 +171,8 @@ class SnapshotSerializer : public BlobSerializer<SnapshotSerializer> {
     sink.reserve(4 * 1024 * 1024);
   }
 
-  template <typename T,
-            std::enable_if_t<!std::is_same<T, std::string>::value>* = nullptr,
-            std::enable_if_t<!std::is_arithmetic<T>::value>* = nullptr>
+  template <typename T>
+    requires(!std::is_arithmetic_v<T> && !std::same_as<T, std::string>)
   size_t Write(const T& data);
 };
 
@@ -733,13 +731,13 @@ static std::string FormatSize(size_t size) {
 }
 
 template <typename T>
+  requires(std::same_as<T, uint8_t> || std::same_as<T, char>)
 void WriteByteVectorLiteral(std::ostream* ss,
                             const T* vec,
                             size_t size,
                             const char* var_name,
                             bool use_array_literals) {
   constexpr bool is_uint8_t = std::is_same_v<T, uint8_t>;
-  static_assert(is_uint8_t || std::is_same_v<T, char>);
   constexpr const char* type_name = is_uint8_t ? "uint8_t" : "char";
   if (!use_array_literals) {
     const uint8_t* data = reinterpret_cast<const uint8_t*>(vec);
diff --git a/src/node_snapshotable.h b/src/node_snapshotable.h
index 31be74bcfd56..18ef5fbd43fd 100644
--- a/src/node_snapshotable.h
+++ b/src/node_snapshotable.h
@@ -41,11 +41,8 @@ struct InternalFieldInfoBase {
   EmbedderObjectType type;
   size_t length;
 
-  template <typename T>
+  template <std::derived_from<InternalFieldInfoBase> T>
   static T* New(EmbedderObjectType type) {
-    static_assert(std::is_base_of_v<InternalFieldInfoBase, T> ||
-                      std::is_same_v<InternalFieldInfoBase, T>,
-                  "Can only accept InternalFieldInfoBase subclasses");
     void* buf = ::operator new[](sizeof(T));
     memset(buf, 0, sizeof(T));  // Make the padding reproducible.
     T* result = new (buf) T;
@@ -54,13 +51,9 @@ struct InternalFieldInfoBase {
     return result;
   }
 
-  template <typename T>
+  template <std::derived_from<InternalFieldInfoBase> T>
+    requires std::is_trivially_copyable_v<T>
   T* Copy() const {
-    static_assert(std::is_base_of_v<InternalFieldInfoBase, T> ||
-                      std::is_same_v<InternalFieldInfoBase, T>,
-                  "Can only accept InternalFieldInfoBase subclasses");
-    static_assert(std::is_trivially_copyable_v<T>,
-                  "Can only memcpy trivially copyable class");
     void* buf = ::operator new[](sizeof(T));
     T* result = new (buf) T;
     memcpy(result, this, sizeof(T));
diff --git a/src/node_wasi.cc b/src/node_wasi.cc
index 7ee59f463310..7d8d056620c4 100644
--- a/src/node_wasi.cc
+++ b/src/node_wasi.cc
@@ -358,8 +358,8 @@ template <typename FT,
           FT F,
           typename R,
           typename... Args,
-          std::size_t... Indices,
-          typename std::enable_if_t<!std::is_void<R>::value, bool> = true>
+          std::size_t... Indices>
+  requires(!std::is_void_v<R>)
 inline void CallAndSetReturn(std::index_sequence<Indices...>,
                              const FunctionCallbackInfo<Value>& args,
                              WASI* wasi,
@@ -372,8 +372,8 @@ template <typename FT,
           FT F,
           typename R,
           typename... Args,
-          std::size_t... Indices,
-          typename std::enable_if_t<std::is_void<R>::value, bool> = true>
+          std::size_t... Indices>
+  requires std::is_void_v<R>
 inline void CallAndSetReturn(std::index_sequence<Indices...>,
                              const FunctionCallbackInfo<Value>& args,
                              WASI* wasi,
diff --git a/src/req_wrap-inl.h b/src/req_wrap-inl.h
index ac0ca8921a1e..61d6d79116ad 100644
--- a/src/req_wrap-inl.h
+++ b/src/req_wrap-inl.h
@@ -111,8 +111,7 @@ struct CallLibuvFunction<ReqT, void(*)(ReqT*, Args...)> {
 template <typename ReqT, typename T>
 struct MakeLibuvRequestCallback {
   static T For(ReqWrap<ReqT>* req_wrap, T v) {
-    static_assert(!is_callable<T>,
-                  "MakeLibuvRequestCallback missed a callback");
+    static_assert(!IsCallable<T>, "MakeLibuvRequestCallback missed a callback");
     return v;
   }
 };
diff --git a/src/stream_base-inl.h b/src/stream_base-inl.h
index 4418cdad504f..cc468ee566a7 100644
--- a/src/stream_base-inl.h
+++ b/src/stream_base-inl.h
@@ -98,25 +98,20 @@ StreamBase::StreamBase(Environment* env) : env_(env) {
   PushStreamListener(&default_listener_);
 }
 
-template <typename OtherBase>
+template <std::derived_from<AsyncWrap> OtherBase>
 SimpleShutdownWrap<OtherBase>::SimpleShutdownWrap(
-    StreamBase* stream,
-    v8::Local<v8::Object> req_wrap_obj)
-  : ShutdownWrap(stream, req_wrap_obj),
-    OtherBase(stream->stream_env(),
-              req_wrap_obj,
-              AsyncWrap::PROVIDER_SHUTDOWNWRAP) {
-}
-
-template <typename OtherBase>
-SimpleWriteWrap<OtherBase>::SimpleWriteWrap(
-    StreamBase* stream,
-    v8::Local<v8::Object> req_wrap_obj)
-  : WriteWrap(stream, req_wrap_obj),
-    OtherBase(stream->stream_env(),
-              req_wrap_obj,
-              AsyncWrap::PROVIDER_WRITEWRAP) {
-}
+    StreamBase* stream, v8::Local<v8::Object> req_wrap_obj)
+    : ShutdownWrap(stream, req_wrap_obj),
+      OtherBase(stream->stream_env(),
+                req_wrap_obj,
+                AsyncWrap::PROVIDER_SHUTDOWNWRAP) {}
+
+template <std::derived_from<AsyncWrap> OtherBase>
+SimpleWriteWrap<OtherBase>::SimpleWriteWrap(StreamBase* stream,
+                                            v8::Local<v8::Object> req_wrap_obj)
+    : WriteWrap(stream, req_wrap_obj),
+      OtherBase(
+          stream->stream_env(), req_wrap_obj, AsyncWrap::PROVIDER_WRITEWRAP) {}
 
 void StreamBase::AttachToObject(v8::Local<v8::Object> obj) {
   obj->SetAlignedPointerInInternalField(
diff --git a/src/stream_base.h b/src/stream_base.h
index be00134eb1fc..cb795a541297 100644
--- a/src/stream_base.h
+++ b/src/stream_base.h
@@ -432,12 +432,11 @@ class StreamBase : public StreamResource {
   friend class Environment;  // For kNumStreamBaseStateFields.
 };
 
-
 // These are helpers for creating `ShutdownWrap`/`WriteWrap` instances.
 // `OtherBase` must have a constructor that matches the `AsyncWrap`
-// constructors’s (Environment*, Local<Object>, AsyncWrap::Provider) signature
+// constructors's (Environment*, Local<Object>, AsyncWrap::Provider) signature
 // and be a subclass of `AsyncWrap`.
-template <typename OtherBase>
+template <std::derived_from<AsyncWrap> OtherBase>
 class SimpleShutdownWrap : public ShutdownWrap, public OtherBase {
  public:
   enum InternalFields {
@@ -459,7 +458,7 @@ class SimpleShutdownWrap : public ShutdownWrap, public OtherBase {
   }
 };
 
-template <typename OtherBase>
+template <std::derived_from<AsyncWrap> OtherBase>
 class SimpleWriteWrap : public WriteWrap, public OtherBase {
  public:
   enum InternalFields {
diff --git a/src/stream_wrap.cc b/src/stream_wrap.cc
index b41f6ac74947..6b85d6533879 100644
--- a/src/stream_wrap.cc
+++ b/src/stream_wrap.cc
@@ -227,12 +227,10 @@ void LibuvStreamWrap::OnUvAlloc(size_t suggested_size, uv_buf_t* buf) {
 }
 
 template <class WrapType>
+  requires(std::derived_from<WrapType, LibuvStreamWrap> ||
+           std::derived_from<WrapType, UDPWrap>)
 static MaybeLocal<Object> AcceptHandle(Environment* env,
                                        LibuvStreamWrap* parent) {
-  static_assert(std::is_base_of<LibuvStreamWrap, WrapType>::value ||
-                std::is_base_of<UDPWrap, WrapType>::value,
-                "Can only accept stream handles");
-
   EscapableHandleScope scope(env->isolate());
   Local<Object> wrap_obj;
 
diff --git a/src/tracing/trace_event_legacy_inl.h b/src/tracing/trace_event_legacy_inl.h
index 4fadb6d8e38f..9030473afe96 100644
--- a/src/tracing/trace_event_legacy_inl.h
+++ b/src/tracing/trace_event_legacy_inl.h
@@ -9,6 +9,8 @@
 #error Perfetto is enabled.
 #endif
 
+#include <concepts>
+
 #include "v8-platform.h"
 #include "tracing/agent_legacy.h"
 #include "tracing/trace_event_helper.h"
@@ -558,9 +560,8 @@ static inline void SetTraceValue(v8::ConvertableToTraceFormat* convertable_value
   *value = static_cast<uint64_t>(reinterpret_cast<intptr_t>(convertable_value));
 }
 
-template <typename T>
-static inline typename std::enable_if<
-    std::is_convertible<T*, v8::ConvertableToTraceFormat*>::value>::type
+template <std::derived_from<v8::ConvertableToTraceFormat> T>
+static inline void
 SetTraceValue(std::unique_ptr<T> ptr, unsigned char* type, uint64_t* value) {
   SetTraceValue(ptr.release(), type, value);
 }
diff --git a/src/util-inl.h b/src/util-inl.h
index e357d15a1449..4ac8726aa43f 100644
--- a/src/util-inl.h
+++ b/src/util-inl.h
@@ -195,7 +195,7 @@ char ToLower(char c) {
   return std::tolower(c, std::locale::classic());
 }
 
-template <typename T>
+template <std::ranges::range T>
 std::string ToLower(const T& in) {
   auto it = std::cbegin(in);
   auto end = std::cend(in);
@@ -210,7 +210,7 @@ char ToUpper(char c) {
   return std::toupper(c, std::locale::classic());
 }
 
-template <typename T>
+template <std::ranges::range T>
 std::string ToUpper(const T& in) {
   auto it = std::cbegin(in);
   auto end = std::cend(in);
@@ -239,7 +239,7 @@ bool StringEqualNoCaseN(const char* a, const char* b, size_t length) {
   return true;
 }
 
-template <typename T>
+template <std::integral T>
 inline T MultiplyWithOverflowCheck(T a, T b) {
   auto ret = a * b;
   if (a != 0)
@@ -485,7 +485,7 @@ v8::Local<v8::Value> ConvertNumberToV8Value(v8::Isolate* isolate,
   return v8::Number::New(isolate, static_cast<double>(number));
 }
 
-template <typename T, typename>
+template <NumericValue T>
 v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                     const T& number,
                                     v8::Isolate* isolate) {
@@ -494,14 +494,10 @@ v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
 }
 
 template <typename T>
+  requires std::is_arithmetic_v<T>
 v8::Local<v8::Array> ToV8ValuePrimitiveArray(v8::Local<v8::Context> context,
                                              const std::vector<T>& vec,
                                              v8::Isolate* isolate) {
-  static_assert(
-      std::is_same_v<T, bool> || std::is_integral_v<T> ||
-          std::is_floating_point_v<T>,
-      "Only primitive types (bool, integral, floating-point) are supported.");
-
   if (isolate == nullptr) isolate = v8::Isolate::GetCurrent();
   v8::EscapableHandleScope handle_scope(isolate);
 
@@ -550,6 +546,7 @@ void MaybeStackBuffer<T, kStackStorageSize>::AllocateSufficientStorage(
 }
 
 template <typename T, size_t S>
+  requires(sizeof(T) == 1)
 ArrayBufferViewContents<T, S>::ArrayBufferViewContents(
     v8::Local<v8::Value> value) {
   DCHECK(value->IsArrayBufferView() || value->IsSharedArrayBuffer() ||
@@ -558,6 +555,7 @@ ArrayBufferViewContents<T, S>::ArrayBufferViewContents(
 }
 
 template <typename T, size_t S>
+  requires(sizeof(T) == 1)
 ArrayBufferViewContents<T, S>::ArrayBufferViewContents(
     v8::Local<v8::Object> value) {
   CHECK(value->IsArrayBufferView());
@@ -565,14 +563,15 @@ ArrayBufferViewContents<T, S>::ArrayBufferViewContents(
 }
 
 template <typename T, size_t S>
+  requires(sizeof(T) == 1)
 ArrayBufferViewContents<T, S>::ArrayBufferViewContents(
     v8::Local<v8::ArrayBufferView> abv) {
   Read(abv);
 }
 
 template <typename T, size_t S>
+  requires(sizeof(T) == 1)
 void ArrayBufferViewContents<T, S>::Read(v8::Local<v8::ArrayBufferView> abv) {
-  static_assert(sizeof(T) == 1, "Only supports one-byte data at the moment");
   length_ = abv->ByteLength();
   if (length_ > sizeof(stack_storage_) || abv->HasBuffer()) {
     auto buf_data = abv->Buffer()->Data();
@@ -585,8 +584,8 @@ void ArrayBufferViewContents<T, S>::Read(v8::Local<v8::ArrayBufferView> abv) {
 }
 
 template <typename T, size_t S>
+  requires(sizeof(T) == 1)
 void ArrayBufferViewContents<T, S>::ReadValue(v8::Local<v8::Value> buf) {
-  static_assert(sizeof(T) == 1, "Only supports one-byte data at the moment");
   DCHECK(buf->IsArrayBufferView() || buf->IsSharedArrayBuffer() ||
          buf->IsArrayBuffer());
 
@@ -649,10 +648,7 @@ constexpr std::string_view FastStringKey::as_string_view() const {
 }
 
 // Converts a V8 numeric value to a corresponding C++ primitive or enum type.
-template <typename T,
-          bool loose = false,
-          typename = std::enable_if_t<std::numeric_limits<T>::is_specialized ||
-                                      std::is_enum_v<T>>>
+template <NumericOrEnum T, bool loose = false>
 T FromV8Value(v8::Local<v8::Value> value) {
   if constexpr (std::is_enum_v<T>) {
     using Underlying = std::underlying_type_t<T>;
diff --git a/src/util.h b/src/util.h
index 48305bfdc131..a979f626bdb4 100644
--- a/src/util.h
+++ b/src/util.h
@@ -30,6 +30,7 @@
 #include "v8.h"
 
 #include "node.h"
+#include "node_concepts.h"
 #include "node_exit_code.h"
 
 #include <climits>
@@ -40,6 +41,7 @@
 
 #include <array>
 #include <bit>
+#include <concepts>
 #include <filesystem>
 #include <limits>
 #include <memory>
@@ -99,7 +101,7 @@ inline char* Calloc(size_t n);
 inline char* UncheckedMalloc(size_t n);
 inline char* UncheckedCalloc(size_t n);
 
-template <typename T>
+template <std::integral T>
 inline T MultiplyWithOverflowCheck(T a, T b);
 
 namespace per_process {
@@ -366,12 +368,12 @@ inline v8::Local<v8::String> FIXED_ONE_BYTE_STRING(v8::Isolate* isolate,
 
 // tolower() is locale-sensitive.  Use ToLower() instead.
 inline char ToLower(char c);
-template <typename T>
+template <std::ranges::range T>
 inline std::string ToLower(const T& in);
 
 // toupper() is locale-sensitive.  Use ToUpper() instead.
 inline char ToUpper(char c);
-template <typename T>
+template <std::ranges::range T>
 inline std::string ToUpper(const T& in);
 
 // strcasecmp() is locale-sensitive.  Use StringEqualNoCase() instead.
@@ -390,14 +392,6 @@ constexpr size_t strsize(const T (&)[N]) {
   return N - 1;
 }
 
-// A type that has a valid std::char_traits specialization, as required by
-// std::basic_string and std::basic_string_view.
-template <typename T>
-concept standard_char_type =
-    std::is_same_v<T, char> || std::is_same_v<T, wchar_t> ||
-    std::is_same_v<T, char8_t> || std::is_same_v<T, char16_t> ||
-    std::is_same_v<T, char32_t>;
-
 // Allocates an array of member type T. For up to kStackStorageSize items,
 // the stack is used, otherwise malloc().
 template <typename T, size_t kStackStorageSize = 1024>
@@ -511,11 +505,11 @@ class MaybeStackBuffer {
       free(buf_);
   }
 
-  template <standard_char_type U = T>
+  template <StandardCharType U = T>
   inline std::basic_string<U> ToString() const {
     return {out(), length()};
   }
-  template <standard_char_type U = T>
+  template <StandardCharType U = T>
   inline std::basic_string_view<U> ToStringView() const {
     return {out(), length()};
   }
@@ -534,6 +528,7 @@ class MaybeStackBuffer {
 // or for small data, a copy of it. This object's lifetime is bound to the
 // original ArrayBufferView's lifetime.
 template <typename T, size_t kStackStorageSize = 64>
+  requires(sizeof(T) == 1)
 class ArrayBufferViewContents {
  public:
   ArrayBufferViewContents() = default;
@@ -610,7 +605,7 @@ class BufferValue : public MaybeStackBuffer<char> {
 // silence a compiler warning about that.
 template <typename T> inline void USE(T&&) {}
 
-template <typename Fn>
+template <std::invocable Fn>
 struct OnScopeLeaveImpl {
   Fn fn_;
   bool active_;
@@ -630,7 +625,7 @@ struct OnScopeLeaveImpl {
 // auto on_scope_leave = OnScopeLeave([&] {
 //   // ... run some code ...
 // });
-template <typename Fn>
+template <std::invocable Fn>
 inline MUST_USE_RESULT OnScopeLeaveImpl<Fn> OnScopeLeave(Fn&& fn) {
   return OnScopeLeaveImpl<Fn>{std::move(fn)};
 }
@@ -676,11 +671,6 @@ struct MallocedBuffer {
   MallocedBuffer& operator=(const MallocedBuffer&) = delete;
 };
 
-// Test whether some value can be called with ().
-template <typename T>
-concept is_callable =
-    std::is_function<T>::value || requires { &T::operator(); };
-
 template <typename T, void (*function)(T*)>
 struct FunctionDeleter {
   void operator()(T* pointer) const { function(pointer); }
@@ -710,8 +700,7 @@ inline v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
 inline v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                            v8_inspector::StringView str,
                                            v8::Isolate* isolate);
-template <typename T, typename test_for_number =
-    typename std::enable_if<std::numeric_limits<T>::is_specialized, bool>::type>
+template <NumericValue T>
 inline v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                            const T& number,
                                            v8::Isolate* isolate = nullptr);

From f2cc681109bae31273dbb77ca7e3f1d628df16fb Mon Sep 17 00:00:00 2001
From: Daniel Lemire <daniel@lemire.me>
Date: Tue, 11 Aug 2026 10:09:16 -0400
Subject: [PATCH 112/344] deps: enable AVX-512 OpenSSL asm with clang

Node.js ships two pre-generated sets of OpenSSL assembly: `asm`, which
contains the AVX-512 routines, and `asm_avx2`, which does not. The
set is picked in deps/openssl/openssl.gyp based on `gas_version` or
`nasm_version`, but configure.py only reports `gas_version` when the
compiler is not clang, because clang uses its own integrated
assembler and has no GNU assembler version to report. Consequently
every clang build silently falls back to the AVX-512-less `asm_avx2`
set, with no warning.

The result is that `ossl_vaes_vpclmulqdq_capable()` is assembled as a
stub that always returns 0, so OpenSSL never selects
`ossl_aes_gcm_encrypt_avx512()` and uses the older AES-NI path
instead. On an Intel Xeon Gold 6548N this costs roughly 1.6x on
AES-256-GCM and 1.8x on both ChaCha20-Poly1305 and RSA-2048 signing.
This is not limited to custom builds: BUILDING.md documents that the
official linux-x64 binaries are produced with clang, and the shipped
v25.x and v26.x binaries contain the stub.

Accept `llvm_version` in the condition, the way
deps/openssl/openssl.gypi already does for the AVX2 set. clang's
integrated assembler has handled AVX512IFMA since 3.9 and VAES /
VPCLMULQDQ since 6.0; 8.0 is used as a conservative floor, well below
the clang 19.1 that Node.js already requires.

PR-URL: https://github.com/nodejs/node/pull/65136
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 deps/openssl/openssl.gyp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/deps/openssl/openssl.gyp b/deps/openssl/openssl.gyp
index 4e16412a0283..144085fd33df 100644
--- a/deps/openssl/openssl.gyp
+++ b/deps/openssl/openssl.gyp
@@ -36,7 +36,8 @@
           # VC-WIN64-ARM inherits from VC-noCE-common that has no asms.
           'includes': ['./openssl_no_asm.gypi'],
         }, 'gas_version and v(gas_version) >= v("2.26") or '
-           'nasm_version and v(nasm_version) >= v("2.11.8")', {
+           'nasm_version and v(nasm_version) >= v("2.11.8") or '
+           'llvm_version and v(llvm_version) >= v("8.0")', {
            # Require AVX512IFMA supported. See
            # https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html
            # Currently crypto/poly1305/asm/poly1305-x86_64.pl requires AVX512IFMA.
@@ -114,7 +115,8 @@
           # VC-WIN64-ARM inherits from VC-noCE-common that has no asms.
           'includes': ['./openssl-fips_no_asm.gypi'],
         }, 'gas_version and v(gas_version) >= v("2.26") or '
-           'nasm_version and v(nasm_version) >= v("2.11.8")', {
+           'nasm_version and v(nasm_version) >= v("2.11.8") or '
+           'llvm_version and v(llvm_version) >= v("8.0")', {
            # Require AVX512IFMA supported. See
            # https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html
            # Currently crypto/poly1305/asm/poly1305-x86_64.pl requires AVX512IFMA.

From 3ab7e7255549ccdb7b8d9af55417a4d2bba0fcab Mon Sep 17 00:00:00 2001
From: semimikoh <ejffjeosms@gmail.com>
Date: Wed, 12 Aug 2026 00:30:37 +0900
Subject: [PATCH 113/344] sqlite: check sqlite3_step() and sqlite3_reset()
 results

Signed-off-by: semimikoh <ejffjeosms@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63319
Fixes: https://github.com/nodejs/node/issues/63311
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/node_sqlite.cc                          | 77 +++++++++++++++++----
 test/parallel/test-sqlite-statement-sync.js | 76 ++++++++++++++++++++
 2 files changed, 139 insertions(+), 14 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 97384bdf449d..68554ed33b31 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -88,6 +88,17 @@ inline MaybeLocal<String> Utf8StringMaybeOneByte(Isolate* isolate,
     }                                                                          \
   } while (0)
 
+#define RESET_OR_THROW(isolate, db, stmt, ret)                                 \
+  CHECK_ERROR_OR_THROW((isolate), (db), sqlite3_reset((stmt)), SQLITE_OK, (ret))
+
+// Surface deferred SQLite errors that sqlite3_reset() returns from the prior
+// sqlite3_step(). Disables the safety-net reset guard via |needs_reset|.
+#define RESET_AND_CHECK(isolate, db, stmt, needs_reset, ret)                   \
+  do {                                                                         \
+    (needs_reset) = false;                                                     \
+    RESET_OR_THROW((isolate), (db), (stmt), (ret));                            \
+  } while (0)
+
 #define THROW_AND_RETURN_ON_BAD_STATE(env, condition, msg)                     \
   do {                                                                         \
     if ((condition)) {                                                         \
@@ -3020,9 +3031,20 @@ MaybeLocal<Object> StatementExecutionHelper::Run(Environment* env,
                                                  bool use_big_ints) {
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
-  sqlite3_step(stmt);
-  int r = sqlite3_reset(stmt);
-  CHECK_ERROR_OR_THROW(isolate, db, r, SQLITE_OK, MaybeLocal<Object>());
+  bool needs_reset = true;
+  auto reset = OnScopeLeave([&]() {
+    if (needs_reset) sqlite3_reset(stmt);
+  });
+
+  int step_r = sqlite3_step(stmt);
+  // SQLITE_ROW is accepted here (and discarded) so that run() can still be
+  // used on RETURNING/SELECT statements, matching prior behavior of
+  // ignoring the step result entirely.
+  if (step_r != SQLITE_DONE && step_r != SQLITE_ROW) {
+    THROW_ERR_SQLITE_ERROR(isolate, db);
+    return MaybeLocal<Object>();
+  }
+  RESET_AND_CHECK(isolate, db, stmt, needs_reset, MaybeLocal<Object>());
 
   sqlite3_int64 last_insert_rowid = sqlite3_last_insert_rowid(db->Connection());
   sqlite3_int64 changes = sqlite3_changes64(db->Connection());
@@ -3096,10 +3118,16 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
                                                 bool use_big_ints) {
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
-  auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt); });
+  bool needs_reset = true;
+  auto reset = OnScopeLeave([&]() {
+    if (needs_reset) sqlite3_reset(stmt);
+  });
 
   int r = sqlite3_step(stmt);
-  if (r == SQLITE_DONE) return scope.Escape(Undefined(isolate));
+  if (r == SQLITE_DONE) {
+    RESET_AND_CHECK(isolate, db, stmt, needs_reset, MaybeLocal<Value>());
+    return scope.Escape(Undefined(isolate));
+  }
   if (r != SQLITE_ROW) {
     THROW_ERR_SQLITE_ERROR(isolate, db);
     return MaybeLocal<Value>();
@@ -3107,7 +3135,8 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
 
   int num_cols = sqlite3_column_count(stmt);
   if (num_cols == 0) {
-    return Undefined(isolate);
+    RESET_AND_CHECK(isolate, db, stmt, needs_reset, MaybeLocal<Value>());
+    return scope.Escape(Undefined(isolate));
   }
 
   LocalVector<Value> row_values(isolate);
@@ -3116,9 +3145,9 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
     return MaybeLocal<Value>();
   }
 
+  Local<Value> result;
   if (return_arrays) {
-    return scope.Escape(
-        Array::New(isolate, row_values.data(), row_values.size()));
+    result = Array::New(isolate, row_values.data(), row_values.size());
   } else {
     LocalVector<Name> keys(isolate);
     keys.reserve(num_cols);
@@ -3131,9 +3160,12 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
     }
 
     DCHECK_EQ(keys.size(), row_values.size());
-    return scope.Escape(Object::New(
-        isolate, Null(isolate), keys.data(), row_values.data(), num_cols));
+    result = Object::New(
+        isolate, Null(isolate), keys.data(), row_values.data(), num_cols);
   }
+
+  RESET_AND_CHECK(isolate, db, stmt, needs_reset, MaybeLocal<Value>());
+  return scope.Escape(result);
 }
 
 void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
@@ -3150,8 +3182,10 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });
-
+  bool needs_reset = true;
+  auto reset = OnScopeLeave([&]() {
+    if (needs_reset) sqlite3_reset(stmt->statement_);
+  });
   Local<Value> result;
   if (StatementExecutionHelper::All(env,
                                     stmt->db_.get(),
@@ -3159,6 +3193,8 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
                                     stmt->return_arrays_,
                                     stmt->use_big_ints_)
           .ToLocal(&result)) {
+    RESET_AND_CHECK(
+        isolate, stmt->db_.get(), stmt->statement_, needs_reset, void());
     args.GetReturnValue().Set(result);
   }
 }
@@ -3592,7 +3628,11 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });
+  Isolate* isolate = env->isolate();
+  bool needs_reset = true;
+  auto reset = OnScopeLeave([&]() {
+    if (needs_reset) sqlite3_reset(stmt->statement_);
+  });
   Local<Value> result;
   if (StatementExecutionHelper::All(env,
                                     stmt->db_.get(),
@@ -3600,6 +3640,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
                                     stmt->return_arrays_,
                                     stmt->use_big_ints_)
           .ToLocal(&result)) {
+    RESET_AND_CHECK(
+        isolate, stmt->db_.get(), stmt->statement_, needs_reset, void());
     args.GetReturnValue().Set(result);
   }
 }
@@ -3833,8 +3875,11 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
   if (r != SQLITE_ROW) {
     CHECK_ERROR_OR_THROW(
         env->isolate(), iter->stmt_->db_.get(), r, SQLITE_DONE, void());
-    sqlite3_reset(iter->stmt_->statement_);
     iter->done_ = true;
+    RESET_OR_THROW(env->isolate(),
+                   iter->stmt_->db_.get(),
+                   iter->stmt_->statement_,
+                   void());
     MaybeLocal<Value> values[] = {Boolean::New(isolate, true), Null(isolate)};
     Local<Object> result;
     if (NewDictionaryInstanceNullProto(env->context(), iter_template, values)
@@ -3886,6 +3931,10 @@ void StatementSyncIterator::Return(const FunctionCallbackInfo<Value>& args) {
       env, iter->stmt_->IsFinalized(), "statement has been finalized");
   Isolate* isolate = env->isolate();
 
+  // Unlike Next(), the reset result is intentionally ignored here: Return()
+  // is invoked by the language during abrupt completion (e.g. a `throw`
+  // inside a `for...of` body), and throwing on a deferred SQLite error
+  // would discard the caller's already-pending exception.
   sqlite3_reset(iter->stmt_->statement_);
   iter->done_ = true;
 
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index cf0e4daa45ca..a55e19fd14f3 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -79,6 +79,28 @@ suite('StatementSync.prototype.get()', () => {
       message: /statement has been finalized/,
     });
   });
+
+  test('surfaces a deferred SQLite error from reset() even though a row was already built', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec(`
+      PRAGMA foreign_keys = ON;
+      PRAGMA defer_foreign_keys = ON;
+      CREATE TABLE parent(id INTEGER PRIMARY KEY);
+      CREATE TABLE child(id INTEGER PRIMARY KEY, parent_id INTEGER REFERENCES parent(id));
+    `);
+    // The FK check is deferred until the implicit transaction commits, which
+    // happens inside reset() here because RETURNING leaves the statement's
+    // VDBE running after the row is produced.
+    const stmt = db.prepare(
+      'INSERT INTO child (parent_id) VALUES (999) RETURNING id'
+    );
+    t.assert.throws(() => {
+      stmt.get();
+    }, {
+      code: 'ERR_SQLITE_ERROR',
+      message: /FOREIGN KEY constraint failed/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.all()', () => {
@@ -144,6 +166,25 @@ suite('StatementSync.prototype.all()', () => {
       message: /statement has been finalized/,
     });
   });
+
+  test('surfaces a deferred SQLite error from reset() even though the array was already built', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec(`
+      PRAGMA foreign_keys = ON;
+      PRAGMA defer_foreign_keys = ON;
+      CREATE TABLE parent(id INTEGER PRIMARY KEY);
+      CREATE TABLE child(id INTEGER PRIMARY KEY, parent_id INTEGER REFERENCES parent(id));
+    `);
+    const stmt = db.prepare(
+      'INSERT INTO child (parent_id) VALUES (999) RETURNING id'
+    );
+    t.assert.throws(() => {
+      stmt.all();
+    }, {
+      code: 'ERR_SQLITE_ERROR',
+      message: /FOREIGN KEY constraint failed/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.iterate()', () => {
@@ -322,6 +363,41 @@ suite('StatementSync.prototype.iterate()', () => {
       message: /statement has been finalized/,
     });
   });
+
+  test('does not replay results after the iterator is naturally exhausted', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE test(key TEXT);
+      INSERT INTO test (key) VALUES ('key1');
+    `);
+    const it = db.prepare('SELECT * FROM test').iterate();
+    t.assert.deepStrictEqual(it.next(), {
+      __proto__: null, done: false, value: { __proto__: null, key: 'key1' },
+    });
+    t.assert.deepStrictEqual(
+      it.next(), { __proto__: null, done: true, value: null });
+    // Calling next() again on an exhausted iterator must keep reporting
+    // done, not silently reset the statement and replay from row 1.
+    t.assert.deepStrictEqual(
+      it.next(), { __proto__: null, done: true, value: null });
+  });
+
+  test('propagates a pending exception when the loop body throws mid-iteration', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE test(key TEXT);
+      INSERT INTO test (key) VALUES ('key1');
+      INSERT INTO test (key) VALUES ('key2');
+    `);
+    const stmt = db.prepare('SELECT * FROM test');
+    const userError = new Error('boom');
+    t.assert.throws(() => {
+      // eslint-disable-next-line no-unused-vars
+      for (const row of stmt.iterate()) {
+        throw userError;
+      }
+    }, (err) => err === userError);
+  });
 });
 
 suite('StatementSync.prototype.run()', () => {

From 53d52731c9624de4ed3f919d67a9a417aaaabc9f Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 11 Aug 2026 19:06:25 +0200
Subject: [PATCH 114/344] tools: fix quote escaping in `update-nixpkgs-pin.sh`

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65166
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 tools/dep_updaters/update-nixpkgs-pin.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh
index e31e70b8cd7c..cd95bb811a9d 100755
--- a/tools/dep_updaters/update-nixpkgs-pin.sh
+++ b/tools/dep_updaters/update-nixpkgs-pin.sh
@@ -70,7 +70,7 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
 }:
 
 {
-  # "default" OpenSSL release line, should be kept in sync with the bundled version:
+  # \"default\" OpenSSL release line, should be kept in sync with the bundled version:
   openssl = pkgs.\(.default);
 
   # Other OpenSSL variants we want to test for:

From 43f1dc03e7b8b1b4e091255c2a4f64e9f8c237d3 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 11 Aug 2026 11:40:25 -0700
Subject: [PATCH 115/344] doc: document close() error when in a sqlite callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65090
Refs: https://github.com/nodejs/node/pull/64743
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
---
 doc/api/sqlite.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 601961243ce2..f43e27a1d8f1 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -307,7 +307,10 @@ added: v22.5.0
 -->
 
 Closes the database connection. An exception is thrown if the database is not
-open. This method is a wrapper around [`sqlite3_close_v2()`][].
+open. An [`ERR_INVALID_STATE`][] error is thrown if the method is called while
+a statement is executing, such as inside a user-defined function, an aggregate
+function, or an authorizer callback. This method is a wrapper around
+[`sqlite3_close_v2()`][].
 
 ### `database.loadExtension(path[, entryPoint])`
 

From d6059e84c09b9de9b589ce0e124b672695dfd855 Mon Sep 17 00:00:00 2001
From: Augustin Mauroy <97875033+AugustinMauroy@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:34:44 +0200
Subject: [PATCH 116/344] doc: update synopsis

Signed-off-by: Augustin Mauroy <97875033+AugustinMauroy@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65171
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 doc/api/synopsis.md | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/doc/api/synopsis.md b/doc/api/synopsis.md
index 24bb35e08f8c..85b2b4cf7470 100644
--- a/doc/api/synopsis.md
+++ b/doc/api/synopsis.md
@@ -15,15 +15,8 @@ Please see the [Command-line options][] document for more information.
 An example of a [web server][] written with Node.js which responds with
 `'Hello, World!'`:
 
-Commands in this document start with `$` or `>` to replicate how they would
-appear in a user's terminal. Do not include the `$` and `>` characters. They are
-there to show the start of each command.
-
-Lines that don't start with `$` or `>` character show the output of the previous
-command.
-
 First, make sure to have downloaded and installed Node.js. See
-[Installing Node.js via package manager][] for further install information.
+[Installing Node.js][] for further install information.
 
 Now, create an empty project folder called `projects`, then navigate into it.
 
@@ -90,5 +83,5 @@ If the browser displays the string `Hello, World!`, that indicates
 the server is working.
 
 [Command-line options]: cli.md#options
-[Installing Node.js via package manager]: https://nodejs.org/en/download/package-manager/
+[Installing Node.js]: https://nodejs.org/en/download
 [web server]: http.md

From 4e06739c7bca94ed35f696462ef0f95327b2c7bc Mon Sep 17 00:00:00 2001
From: Chemi Atlow <chemi@atlow.co.il>
Date: Tue, 11 Aug 2026 22:34:54 +0300
Subject: [PATCH 117/344] test_runner: do not tag-filter test file wrappers

Under run({ testTagFilters, isolation: 'process' }) the parent
process's FileTest wrappers have empty tag sets, so any include filter
filtered out the wrappers themselves and no test file was ever
spawned. The same applied to the single re-spawned child in watch mode
with isolation 'none'.

Exempt file wrappers from tag filtering: the filter is re-emitted to
the child process and applied there, matching isolation 'none'
results.

This also removes the testTagFilterExpressions bookkeeping and the
isolation-conditional assignment of testTagFilters, both of which
existed only to keep the parent process from filtering its own file
wrappers. The parent now always holds the canonical filter values and
re-emits them to child processes.

Refs: https://github.com/nodejs/node/pull/63221
Signed-off-by: atlowChemi <chemi@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/65170
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 lib/internal/test_runner/runner.js        | 18 +++++++++++-------
 lib/internal/test_runner/test.js          |  6 +++++-
 lib/internal/test_runner/utils.js         | 18 +++++-------------
 test/parallel/test-runner-tags-events.mjs | 14 +++++++++++---
 4 files changed, 32 insertions(+), 24 deletions(-)

diff --git a/lib/internal/test_runner/runner.js b/lib/internal/test_runner/runner.js
index a5a53e44d29a..548ed006e152 100644
--- a/lib/internal/test_runner/runner.js
+++ b/lib/internal/test_runner/runner.js
@@ -182,7 +182,7 @@ function getRunArgs(path, { forceExit,
                             inspectPort,
                             testNamePatterns,
                             testSkipPatterns,
-                            testTagFilterExpressions,
+                            testTagFilters,
                             only,
                             hasFiles,
                             testFiles,
@@ -224,8 +224,8 @@ function getRunArgs(path, { forceExit,
   if (testSkipPatterns != null) {
     ArrayPrototypeForEach(testSkipPatterns, (pattern) => ArrayPrototypePush(runArgs, `--test-skip-pattern=${pattern}`));
   }
-  if (testTagFilterExpressions != null) {
-    ArrayPrototypeForEach(testTagFilterExpressions, (value) => ArrayPrototypePush(runArgs, `--experimental-test-tag-filter=${value}`));
+  if (testTagFilters != null) {
+    ArrayPrototypeForEach(testTagFilters, (value) => ArrayPrototypePush(runArgs, `--experimental-test-tag-filter=${value}`));
   }
   if (only === true) {
     ArrayPrototypePush(runArgs, '--test-only');
@@ -284,6 +284,14 @@ class FileTest extends Test {
     this.timeout = null;
   }
 
+  willBeFilteredByTags() {
+    // File wrappers have no tags of their own. Tag filtering applies to the
+    // tests inside the file, which run in a child process (or in-process
+    // import); filtering the wrapper would prevent the file from running at
+    // all.
+    return false;
+  }
+
   #skipReporting() {
     return this.#reportedChildren > 0 && (!this.error || this.error.failureType === kSubtestsFailed);
   }
@@ -864,7 +872,6 @@ function run(options = kEmptyObject) {
     });
   }
 
-  let testTagFilterExpressions = null;
   if (testTagFilters != null) {
     if (!ArrayIsArray(testTagFilters)) {
       testTagFilters = [testTagFilters];
@@ -876,10 +883,8 @@ function run(options = kEmptyObject) {
       testTagFilters = ArrayPrototypeMap(testTagFilters, (value, i) => (
         validateAndCanonicalizeTagFilter(value, `options.testTagFilters[${i}]`)
       ));
-      testTagFilterExpressions = testTagFilters;
     }
   }
-  testTagFilterExpressions ??= options.testTagFilterExpressions;
 
   validateOneOf(isolation, 'options.isolation', ['process', 'none']);
   validateBoolean(coverage, 'options.coverage');
@@ -982,7 +987,6 @@ function run(options = kEmptyObject) {
     testNamePatterns,
     testSkipPatterns,
     testTagFilters,
-    testTagFilterExpressions,
     hasFiles: files != null,
     globPatterns,
     only,
diff --git a/lib/internal/test_runner/test.js b/lib/internal/test_runner/test.js
index 38ce54e4ea9b..a728378182df 100644
--- a/lib/internal/test_runner/test.js
+++ b/lib/internal/test_runner/test.js
@@ -656,7 +656,7 @@ class Test extends AsyncResource {
       }
 
       if (isFilteringByTags) {
-        this.filteredByTag = !evaluateTagFilters(config.testTagFilters, this.tagSet);
+        this.filteredByTag = this.willBeFilteredByTags();
         if (!this.filteredByTag) {
           for (let t = this.parent; t !== null && t.filteredByTag; t = t.parent) {
             t.filteredByTag = false;
@@ -894,6 +894,10 @@ class Test extends AsyncResource {
     return false;
   }
 
+  willBeFilteredByTags() {
+    return !evaluateTagFilters(this.config.testTagFilters, this.tagSet);
+  }
+
   /**
    * Returns a name of the test prefixed by name of all its ancestors in ascending order, separated by a space
    * Ex."grandparent parent test"
diff --git a/lib/internal/test_runner/utils.js b/lib/internal/test_runner/utils.js
index 3590d3ef79b4..982fc6ef7bfe 100644
--- a/lib/internal/test_runner/utils.js
+++ b/lib/internal/test_runner/utils.js
@@ -273,7 +273,6 @@ function parseCommandLine() {
   let testNamePatterns = mapPatternFlagToRegExArray('--test-name-pattern');
   let testSkipPatterns = mapPatternFlagToRegExArray('--test-skip-pattern');
   let testTagFilters = null;
-  let testTagFilterExpressions = null;
 
   if (isChildProcessV8) {
     kBuiltinReporters.set('v8-serializer', 'internal/test_runner/reporter/v8-serializer');
@@ -309,19 +308,14 @@ function parseCommandLine() {
     const tagFilterFlag = getOptionValue('--experimental-test-tag-filter');
     if (tagFilterFlag?.length > 0) {
       emitExperimentalWarning('Test tags');
-      testTagFilterExpressions = tagFilterFlag;
-      // Validate at parent startup so a malformed flag fails fast,
-      // independent of isolation mode. Under isolation='process' the
-      // validated strings go unused at the parent (children re-validate
-      // and apply the filter); the validation here only surfaces input
-      // errors early.
-      const validated = ArrayPrototypeMap(
+      // File wrappers are exempt from tag filtering, so holding the filters
+      // in the parent is safe under any isolation mode; under
+      // isolation='process' the canonical values are re-emitted to the
+      // child processes, which apply the filter themselves.
+      testTagFilters = ArrayPrototypeMap(
         tagFilterFlag,
         (value, i) => validateAndCanonicalizeTagFilter(value, `--experimental-test-tag-filter[${i}]`),
       );
-      if (isolation === 'none') {
-        testTagFilters = validated;
-      }
     }
 
     if (isolation === 'none') {
@@ -365,7 +359,6 @@ function parseCommandLine() {
     const tagFilterFlag = getOptionValue('--experimental-test-tag-filter');
     if (tagFilterFlag?.length > 0) {
       emitExperimentalWarning('Test tags');
-      testTagFilterExpressions = tagFilterFlag;
       testTagFilters = ArrayPrototypeMap(
         tagFilterFlag,
         (value, i) => validateAndCanonicalizeTagFilter(value, `--experimental-test-tag-filter[${i}]`),
@@ -433,7 +426,6 @@ function parseCommandLine() {
     sourceMaps,
     testNamePatterns,
     testSkipPatterns,
-    testTagFilterExpressions,
     testTagFilters,
     timeout,
     updateSnapshots,
diff --git a/test/parallel/test-runner-tags-events.mjs b/test/parallel/test-runner-tags-events.mjs
index 2f275cf876f9..7d1b35f7349d 100644
--- a/test/parallel/test-runner-tags-events.mjs
+++ b/test/parallel/test-runner-tags-events.mjs
@@ -83,9 +83,6 @@ describe('tag-bearing event payloads', { concurrency: false }, () => {
   });
 
   it('test:pass fires only for selected tagged tests when filtered', async () => {
-    // isolation='none' so the parent applies the filter directly. Under
-    // 'process', the FileTest wrapper (which has no tags) would itself be
-    // filtered out by the include filter - same wart as --test-name-pattern.
     const stream = run({ files: [fixture], testTagFilters: ['db'], isolation: 'none' });
     stream.on('test:fail', common.mustNotCall());
     // 3 db-tagged tests pass + the db suite itself.
@@ -93,4 +90,15 @@ describe('tag-bearing event payloads', { concurrency: false }, () => {
     // eslint-disable-next-line no-unused-vars
     for await (const _ of stream);
   });
+
+  it('filtering under process isolation runs the file and filters inside it', async () => {
+    // The FileTest wrapper has no tags and must not be filtered out itself;
+    // the filter is re-emitted to the child process and applied there.
+    const stream = run({ files: [fixture], testTagFilters: ['db'], isolation: 'process' });
+    stream.on('test:fail', common.mustNotCall());
+    // 3 db-tagged tests pass + the db suite itself.
+    stream.on('test:pass', common.mustCall(4));
+    // eslint-disable-next-line no-unused-vars
+    for await (const _ of stream);
+  });
 });

From 4abd1c8100a8deb41bb7ce9243924f3731b02d72 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 11 Aug 2026 23:26:33 +0200
Subject: [PATCH 118/344] meta: add support for alpha prerelease tag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63135
Refs: https://github.com/nodejs/Release/issues/1154
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
---
 .github/workflows/major-release.yml |   2 +-
 doc/contributing/releases.md        | 139 +++++++++++++++-------------
 src/node_version.h                  |  22 +++--
 3 files changed, 94 insertions(+), 69 deletions(-)

diff --git a/.github/workflows/major-release.yml b/.github/workflows/major-release.yml
index b65917f89e74..1b15a00c8df1 100644
--- a/.github/workflows/major-release.yml
+++ b/.github/workflows/major-release.yml
@@ -2,7 +2,7 @@ name: Major Release
 
 on:
   schedule:
-    - cron: 0 0 15 2,8 *  # runs at midnight UTC every 15 February and 15 August
+    - cron: 0 0 15 2 *  # runs at midnight UTC every 15 February
 
 permissions:
   contents: read
diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
index c6b51bc2acff..da61b360ac9f 100644
--- a/doc/contributing/releases.md
+++ b/doc/contributing/releases.md
@@ -422,6 +422,11 @@ already defined in `src/node_version.h`:
 #define NODE_MAJOR_VERSION x
 #define NODE_MINOR_VERSION y
 #define NODE_PATCH_VERSION z
+
+// And for alpha releases:
+#define NODE_ALPHA_MAJOR_VERSION a
+#define NODE_ALPHA_MINOR_VERSION b
+#define NODE_ALPHA_PATCH_VERSION c
 ```
 
 Set the `NODE_VERSION_IS_RELEASE` macro value to `1`. This causes the build to
@@ -431,6 +436,14 @@ be produced with a version string that does not have a trailing pre-release tag:
 #define NODE_VERSION_IS_RELEASE 1
 ```
 
+<details>
+<summary>Major version release</summary>
+
+Remove the `NODE_ALPHA_MAJOR_VERSION`, `NODE_ALPHA_MINOR_VERSION`, and
+`NODE_ALPHA_PATCH_VERSION` macros.
+
+</details>
+
 ### 4. Update the changelog
 
 _(This step will be done automatically if you are using `create-release-proposal` or `git node release --prepare`)_
@@ -900,8 +913,8 @@ project README.
 
 On release proposal branch, edit `src/node_version.h` again and:
 
-* Increment `NODE_PATCH_VERSION` by one
-* Change `NODE_VERSION_IS_RELEASE` back to `0`
+* Increment `NODE_PATCH_VERSION` (or `NODE_ALPHA_PATCH_VERSION` for alpha releases) by one.
+* Change `NODE_VERSION_IS_RELEASE` back to `0`.
 
 Commit this change with the following commit message format:
 
@@ -968,9 +981,12 @@ git restore --source=upstream/main src/node_version.h
 On the main branch, instead of reverting changes made to `src/node_version.h`
 edit it instead and:
 
-* Increment `NODE_MAJOR_VERSION` by one
-* Reset `NODE_PATCH_VERSION` to `0`
-* Change `NODE_VERSION_IS_RELEASE` back to `0`
+* Increment `NODE_MAJOR_VERSION` by one.
+* Reset `NODE_PATCH_VERSION` and `NODE_MINOR_VERSION` to `0`.
+* Set `NODE_ALPHA_MAJOR_VERSION`, `NODE_ALPHA_MINOR_VERSION`, and
+  `NODE_ALPHA_PATCH_VERSION` back to `0` (`main` should already have this, the
+  release commit will have them removed).
+* Change `NODE_VERSION_IS_RELEASE` back to `0`.
 
 Amend the current commit to apply the changes:
 
@@ -1281,9 +1297,9 @@ git node release --prepare --startLTS
 To mark a release line as LTS, the following changes must be made to
 `src/node_version.h`:
 
-* The `NODE_MINOR_VERSION` macro must be incremented by one
-* The `NODE_PATCH_VERSION` macro must be set to `0`
-* The `NODE_VERSION_IS_LTS` macro must be set to `1`
+* The `NODE_MINOR_VERSION` macro must be incremented by one.
+* The `NODE_PATCH_VERSION` macro must be set to `0`.
+* The `NODE_VERSION_IS_LTS` macro must be set to `1`.
 * The `NODE_VERSION_LTS_CODENAME` macro must be set to the code name selected
   for the LTS release.
 
@@ -1352,15 +1368,15 @@ from cutting a minor or patch release.
 
 ### Schedule
 
-New Node.js Major releases happen twice per year:
+New Node.js Major releases happen once per year:
 
-* Even-numbered releases are cut in April.
-* Odd-numbered releases are cut in October.
+* Branch-off is in October.
+* Semver-major release is in April.
 
 Major releases should be targeted for the third Tuesday of the release month.
 
 A major release must not slip beyond the release month. In other words, major
-releases must not slip into May or November.
+releases must not slip into May.
 
 The @nodejs/releasers make a call for releasers 3 months in advance.
 Currently, this call is automated in the `#nodejs-release-private`
@@ -1370,15 +1386,15 @@ The release date for the next major release should be announced immediately
 following the current release (e.g. the release date for 13.0.0 should be
 announced immediately following the release of 12.0.0).
 
-### Release branch
+### Branch-off (October)
 
-Approximately two months before a major release, new `vN.x` and
-`vN.x-staging` branches (where `N` indicates the major release) should be
-created as forks of the `main` branch. Up until the cut-off date announced by
-the releaser, these must be kept in sync with `main`.
+#### Release branch
 
-The `vN.x` and `vN.x-staging` branches must be kept in sync with one another
-up until the date of the release.
+Approximately six months before a major release, new `vN.x` and
+`vN.x-staging` branches (where `N` indicates the major release) should be
+created as forks of the `main` branch. Alpha releases should be released picking
+up commits from `main`. Target the first alpha release to be released the same
+day as the previous release line is graduated to LTS status.
 
 If a `SEMVER-MAJOR` pull request lands on the default branch within one month
 prior to the major release date, it must not be included on the new major
@@ -1386,10 +1402,9 @@ staging branch, unless there is consensus from the Node.js releasers team to
 do so. This measure aims to ensure better stability for the release candidate
 (RC) phase, which begins approximately two weeks prior to the official release.
 By restricting `SEMVER-MAJOR` commits in this period, we provide more time for
-thorough testing and reduce the potential for major breakages, especially in
-LTS lines.
+thorough testing and reduce the potential for major breakages.
 
-### Create release labels
+#### Create release labels
 
 The following issue labels must be created:
 
@@ -1404,9 +1419,9 @@ The label description can be copied from existing labels of previous releases.
 The label color must be the same for all new labels, but different from the
 labels of previous releases.
 
-### Release proposal
+#### Initial Alpha release proposal
 
-A draft release proposal should be created 6 weeks before the release. A
+A draft release proposal should be created before the release. A
 separate `vN.x-proposal` branch should be created that tracks the `vN.x`
 branch. This branch will contain the draft release commit (with the draft
 changelog).
@@ -1414,21 +1429,7 @@ changelog).
 Notify the `@nodejs/npm` team in the release proposal PR to inform them of the
 upcoming release.
 
-To keep the branch in sync until the release date, it can be as simple as
-doing the following:
-
-> Make sure to check that there are no PRs with the label `dont-land-on-vX.x`.
-
-```bash
-git checkout vN.x
-git reset --hard upstream/main
-git checkout vN.x-staging
-git reset --hard upstream/main
-git push upstream vN.x
-git push upstream vN.x-staging
-```
-
-### Update `NODE_MODULE_VERSION`
+##### Update `NODE_MODULE_VERSION`
 
 This macro in `src/node_version.h` is used to signal an ABI version for native
 addons. It currently has two common uses in the community:
@@ -1458,24 +1459,12 @@ see a need to bump `NODE_MODULE_VERSION` outside of a major release then
 you should consult the TSC. Commits may need to be reverted or a major
 version bump may need to happen.
 
-### Test releases and release candidates
-
-Test builds should be generated from the `vN.x-proposal` branch starting at
-about 6 weeks before the release.
-
-Release Candidates should be generated from the `vN.x-proposal` branch starting
-at about 4 weeks before the release, with a target of one release candidate
-per week.
-
-Always run test releases and release candidates through the Canary in the
-Goldmine tool for additional testing.
-
-### Changelogs
+##### Changelogs
 
 Generating major release changelogs is a bit more involved than minor and patch
 changelogs.
 
-#### Create the changelog file
+###### Create the changelog file
 
 In the `doc/changelogs` directory, create a new `CHANGELOG_V{N}.md` file where
 `{N}` is the major version of the release. Follow the structure of the existing
@@ -1487,7 +1476,7 @@ updated to account for the new `CHANGELOG_V{N}.md` file.
 Once the file is created, the root `CHANGELOG.md` file must be updated to
 reference the newly-created major release `CHANGELOG_V{N}.md`.
 
-#### Generate the changelog
+###### Generate the changelog
 
 To generate a proper major release changelog, use the `branch-diff` tool to
 compare the `vN.x` branch against the `vN-1.x` branch (e.g. for Node.js 12.0,
@@ -1506,14 +1495,7 @@ $ branch-diff upstream/vN-1.x upstream/vN.x --require-label=semver-minor --group
 $ branch-diff upstream/vN-1.x upstream/vN.x --exclude-label=semver-major,semver-minor --group --filter-release --markdown # get all patches
 ```
 
-#### Generate the notable changes
-
-For a major release, all SEMVER-MAJOR commits that are not strictly internal,
-test, or doc-related are to be listed as notable changes. Some SEMVER-MINOR
-commits may be listed as notable changes on a case-by-case basis. Use your
-judgment there.
-
-### Update the expected assets
+##### Update the expected assets
 
 The promotion script does a basic check that the expected files are present.
 Open a pull request in the Build repository to add the list of expected files
@@ -1522,6 +1504,39 @@ version of the release), in the [expected assets][] folder. The change will
 need to be deployed onto the web server by a member of the [build-infra team][]
 before the release is promoted.
 
+### Semver-major release (April)
+
+#### Release proposal
+
+A draft release proposal should be created 6 weeks before the release. A
+separate `vN.x-proposal` branch should be created that tracks the `vN.x`
+branch. This branch will contain the draft release commit (with the draft
+changelog).
+
+Notify the `@nodejs/npm` team in the release proposal PR to inform them of the
+upcoming release.
+
+Major release proposal should contain a single commit, the release one. All
+semver-major changes must have landed in a alpha version before the major is
+released. Semver-major changes that have missed the alpha period will be included
+in the next major release line.
+
+##### Marking a release line as "out of Alpha"
+
+To mark a release line as stable, the following changes must be made to
+`src/node_version.h`:
+
+* Remove `NODE_ALPHA_MAJOR_VERSION`, `NODE_ALPHA_MINOR_VERSION`, and
+  `NODE_ALPHA_PATCH_VERSION`.
+
+#### Generate the notable changes
+
+For a major release, all SEMVER-MAJOR commits that are not strictly internal,
+test, or doc-related are to be listed as notable changes. Some SEMVER-MINOR
+commits may be listed as notable changes on a case-by-case basis. Use your
+judgment there.
+Include the notable changes from the Alpha versions where it applies.
+
 ### Snap
 
 The Node.js [Snap][] package has a "default" for installs where the user hasn't
diff --git a/src/node_version.h b/src/node_version.h
index 2bd579a2092d..95d6aa79439c 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -31,6 +31,10 @@
 
 #define NODE_VERSION_IS_RELEASE 0
 
+#define NODE_ALPHA_MAJOR_VERSION 0
+#define NODE_ALPHA_MINOR_VERSION 0
+#define NODE_ALPHA_PATCH_VERSION 0
+
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)
 #define NODE_STRINGIFY_HELPER(n) #n
@@ -41,18 +45,24 @@
 #endif
 
 #ifndef NODE_TAG
-# if NODE_VERSION_IS_RELEASE
-#  define NODE_TAG ""
-# else
-#  define NODE_TAG "-pre"
-# endif
+#if NODE_VERSION_IS_RELEASE
+#ifdef NODE_ALPHA_MAJOR_VERSION
+#define NODE_TAG                                                               \
+  "-alpha." NODE_STRINGIFY(NODE_ALPHA_MAJOR_VERSION) "." NODE_STRINGIFY(       \
+      NODE_ALPHA_MINOR_VERSION) "." NODE_STRINGIFY(NODE_ALPHA_PATCH_VERSION)
 #else
+#define NODE_TAG ""
+#endif  // NODE_ALPHA_MAJOR_VERSION
+#else   // NODE_VERSION_IS_RELEASE
+#define NODE_TAG "-pre"
+#endif  // NODE_VERSION_IS_RELEASE
+#else   // NODE_TAG
 // NODE_TAG is passed without quotes when rc.exe is run from msbuild
 # define NODE_EXE_VERSION NODE_STRINGIFY(NODE_MAJOR_VERSION) "." \
                           NODE_STRINGIFY(NODE_MINOR_VERSION) "." \
                           NODE_STRINGIFY(NODE_PATCH_VERSION)     \
                           NODE_STRINGIFY(NODE_TAG)
-#endif
+#endif  // NODE_TAG
 
 # define NODE_VERSION_STRING  NODE_STRINGIFY(NODE_MAJOR_VERSION) "." \
                               NODE_STRINGIFY(NODE_MINOR_VERSION) "." \

From b7a23426d9d1fabba5a4c38a88ac5430cbd65d73 Mon Sep 17 00:00:00 2001
From: Max H Fisher <mfisher187@bloomberg.net>
Date: Wed, 22 Jul 2026 16:07:43 -0400
Subject: [PATCH 119/344] src: add SetAbortHandler

Signed-off-by: Max H Fisher <mfisher187@bloomberg.net>
PR-URL: https://github.com/nodejs/node/pull/64684
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 src/node.h                            | 10 +++++
 src/node_errors.cc                    | 30 +++++++++++++--
 src/util.h                            | 14 ++++---
 test/addons/abort-handler/binding.cc  | 18 +++++++++
 test/addons/abort-handler/binding.gyp |  9 +++++
 test/addons/abort-handler/test.js     | 45 ++++++++++++++++++++++
 test/cctest/test_environment.cc       | 54 +++++++++++++++++++++++++++
 7 files changed, 171 insertions(+), 9 deletions(-)
 create mode 100644 test/addons/abort-handler/binding.cc
 create mode 100644 test/addons/abort-handler/binding.gyp
 create mode 100644 test/addons/abort-handler/test.js

diff --git a/src/node.h b/src/node.h
index 18969ad90a04..1c0726a82415 100644
--- a/src/node.h
+++ b/src/node.h
@@ -853,6 +853,16 @@ NODE_EXTERN void SetProcessExitHandler(
     std::function<void(Environment*, int)>&& handler);
 NODE_EXTERN void DefaultProcessExitHandler(Environment* env, int exit_code);
 
+// Sets a process-global handler invoked when Node.js programmatically aborts.
+// Nullable strings representing the location and reason for the abort may or
+// may not be passed as a parameter to the handler. The handler should not
+// return, but node will ensure that the process exits after the handler is
+// called regardless of whether or not it returns. Passing nullptr restores the
+// default handler. This is process-global and may be invoked before any Isolate
+// or Environment exists.
+using AbortHandler = void (*)(const char* location, const char* message);
+NODE_EXTERN void SetAbortHandler(AbortHandler handler);
+
 // This may return nullptr if context is not associated with a Node instance.
 NODE_EXTERN Environment* GetCurrentEnvironment(v8::Local<v8::Context> context);
 NODE_EXTERN IsolateData* GetEnvironmentIsolateData(Environment* env);
diff --git a/src/node_errors.cc b/src/node_errors.cc
index 63db97f6a56d..2c464bb895e5 100644
--- a/src/node_errors.cc
+++ b/src/node_errors.cc
@@ -393,6 +393,30 @@ void AppendExceptionLine(Environment* env,
             .FromMaybe(false));
 }
 
+namespace {
+// Default handler: Dumps native + JS backtraces to stderr and exits. This
+// indirectly calls backtrace so it can not be marked as [[noreturn]] (see the
+// comment on node::Assert() below). `message` and `location` are ignored
+// because the assertion/fatal-error message, if any, is already printed to
+// stderr by the caller (Assert()/OnFatalError()) before this handler runs.
+void DefaultAbortHandler(const char* /*location*/, const char* /*message*/) {
+  DumpNativeBacktrace(stderr);
+  DumpJavaScriptBacktrace(stderr);
+  fflush(stderr);
+  ABORT_NO_BACKTRACE();
+}
+// Constant-initialized, so this is valid from load time, safe even for a
+// CHECK() during early startup, before any SetAbortHandler call.
+AbortHandler g_abort_handler = DefaultAbortHandler;
+}  // namespace
+
+void SetAbortHandler(AbortHandler handler) {
+  g_abort_handler = handler ? handler : DefaultAbortHandler;
+}
+AbortHandler GetAbortHandler() {
+  return g_abort_handler;
+}
+
 void Assert(const AssertionInfo& info) {
   std::string name = GetHumanReadableProcessName();
 
@@ -406,7 +430,7 @@ void Assert(const AssertionInfo& info) {
           info.message);
 
   fflush(stderr);
-  ABORT();
+  ABORT_WITH_DETAILS(info.file_line, info.message);
 }
 
 enum class EnhanceFatalException { kEnhance, kDontEnhance };
@@ -584,7 +608,7 @@ static void ReportFatalException(Environment* env,
   }
 
   fflush(stderr);
-  ABORT();
+  ABORT_WITH_DETAILS(location, message);
 }
 
 void OOMErrorHandler(const char* location, const v8::OOMDetails& details) {
@@ -620,7 +644,7 @@ void OOMErrorHandler(const char* location, const v8::OOMDetails& details) {
   }
 
   fflush(stderr);
-  ABORT();
+  ABORT_WITH_DETAILS(location, message);
 }
 
 v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
diff --git a/src/util.h b/src/util.h
index a979f626bdb4..5e9bf2b1cdab 100644
--- a/src/util.h
+++ b/src/util.h
@@ -128,6 +128,9 @@ void NODE_EXTERN_PRIVATE Assert(const AssertionInfo& info);
 void DumpNativeBacktrace(FILE* fp);
 void DumpJavaScriptBacktrace(FILE* fp);
 
+// Returns the currently installed abort handler which is never null.
+AbortHandler GetAbortHandler();
+
 // Windows 8+ does not like abort() in Release mode
 #ifdef _WIN32
 #define ABORT_NO_BACKTRACE() _exit(static_cast<int>(node::ExitCode::kAbort))
@@ -140,13 +143,12 @@ void DumpJavaScriptBacktrace(FILE* fp);
 // when generating code for them the compiler can choose not to
 // maintain the frame pointers or link registers that are necessary for
 // correct backtracing.
-// `ABORT` must be a macro and not a [[noreturn]] function to make sure the
-// backtrace is correct.
-#define ABORT()                                                                \
+// `ABORT` and `ABORT_WITH_DETAILS` must be a macro and not a [[noreturn]]
+// function to make sure the backtrace is correct.
+#define ABORT() ABORT_WITH_DETAILS(__FILE__ ":" STRINGIFY(__LINE__), nullptr)
+#define ABORT_WITH_DETAILS(location, message)                                  \
   do {                                                                         \
-    node::DumpNativeBacktrace(stderr);                                         \
-    node::DumpJavaScriptBacktrace(stderr);                                     \
-    fflush(stderr);                                                            \
+    node::GetAbortHandler()(location, message);                                \
     ABORT_NO_BACKTRACE();                                                      \
   } while (0)
 
diff --git a/test/addons/abort-handler/binding.cc b/test/addons/abort-handler/binding.cc
new file mode 100644
index 000000000000..13ceb011e57b
--- /dev/null
+++ b/test/addons/abort-handler/binding.cc
@@ -0,0 +1,18 @@
+#include <node.h>
+#include <v8.h>
+#include <cstdio>
+
+namespace {
+void TestAbortHandler(const char* /*location*/, const char* /*message*/) {
+  fputs("CUSTOM_ABORT_HANDLER_RAN\n", stderr);
+  fflush(stderr);
+}
+
+void InstallAbortHandler(const v8::FunctionCallbackInfo<v8::Value>&) {
+  node::SetAbortHandler(TestAbortHandler);
+}
+}  // namespace
+
+NODE_MODULE_INIT() {
+  NODE_SET_METHOD(exports, "installAbortHandler", InstallAbortHandler);
+}
diff --git a/test/addons/abort-handler/binding.gyp b/test/addons/abort-handler/binding.gyp
new file mode 100644
index 000000000000..55fbe7050f18
--- /dev/null
+++ b/test/addons/abort-handler/binding.gyp
@@ -0,0 +1,9 @@
+{
+  'targets': [
+    {
+      'target_name': 'binding',
+      'sources': [ 'binding.cc' ],
+      'includes': ['../common.gypi'],
+    }
+  ]
+}
diff --git a/test/addons/abort-handler/test.js b/test/addons/abort-handler/test.js
new file mode 100644
index 000000000000..4c05046c92b1
--- /dev/null
+++ b/test/addons/abort-handler/test.js
@@ -0,0 +1,45 @@
+'use strict';
+const common = require('../../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { exec } = require('child_process');
+
+const bindingPath = path.resolve(
+  __dirname, 'build', common.buildType, 'binding.node');
+
+if (!fs.existsSync(bindingPath))
+  common.skip('binding not built yet');
+
+if (process.argv[2] === 'child') {
+  const binding = require(bindingPath);
+  binding.installAbortHandler();
+  process.abort();
+  return;
+}
+
+const escapedArgs =
+  common.escapePOSIXShell`"${process.execPath}" "${__filename}" child`;
+if (!common.isWindows) {
+  // Do not create core files, as it can take a lot of disk space on
+  // continuous testing and developers' machines.
+  escapedArgs[0] = 'ulimit -c 0 && ' + escapedArgs[0];
+}
+
+exec(...escapedArgs, common.mustCall((err, stdout, stderr) => {
+  assert.ok(
+    stderr.includes('CUSTOM_ABORT_HANDLER_RAN'),
+    `Expected custom abort handler marker in stderr, got:\n${stderr}`);
+  assert.ok(
+    !stderr.includes('Native stack trace'),
+    `Expected the custom handler to replace the default dump, got:\n${stderr}`);
+
+  // The child aborts. Whether that surfaces as the SIGABRT signal or as exit
+  // code 134 depends on shell wrapping: the `ulimit -c 0 && ...` prefix makes
+  // /bin/sh wait on (rather than exec-replace itself with) the node grandchild,
+  // so sh reports the aborted grandchild as a normal exit with code 134.
+  // common.nodeProcessAborted() accepts both forms.
+  assert.ok(
+    err && common.nodeProcessAborted(err.code, err.signal),
+    `Expected the child to abort, got code=${err?.code} signal=${err?.signal}`);
+}));
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 59c71835499e..fb1bcc2ef90c 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -1201,3 +1201,57 @@ TEST_F(EnvironmentTest, LoadEnvironmentWithCallbackWithESModule) {
   printf("Frame: %s\n", *frame_str);
   EXPECT_EQ(frame_str.ToString(), "    at embedded:esm.mjs:3:15");
 }
+
+namespace {
+void CustomAbortHandlerForContractTest(const char* location,
+                                       const char* message) {}
+
+bool abort_handler_dispatch_flag = false;
+const char* abort_handler_received_location = nullptr;
+const char* abort_handler_received_message = nullptr;
+void AbortHandlerThatSetsDispatchFlag(const char* location,
+                                      const char* message) {
+  abort_handler_dispatch_flag = true;
+  abort_handler_received_location = location;
+  abort_handler_received_message = message;
+}
+}  // namespace
+
+TEST(AbortHandlerTest, DefaultIsNonNullAndSetAbortHandlerRoundTrips) {
+  node::AbortHandler old = node::GetAbortHandler();
+
+  // There should always be a non-null default handler installed.
+  EXPECT_NE(node::GetAbortHandler(), nullptr);
+
+  node::SetAbortHandler(CustomAbortHandlerForContractTest);
+  EXPECT_EQ(node::GetAbortHandler(), CustomAbortHandlerForContractTest);
+
+  node::SetAbortHandler(nullptr);
+  EXPECT_NE(node::GetAbortHandler(), nullptr);
+  EXPECT_NE(node::GetAbortHandler(), CustomAbortHandlerForContractTest);
+
+  node::SetAbortHandler(old);
+}
+
+TEST(AbortHandlerTest, InstalledHandlerIsInvokedWhenCalled) {
+  node::AbortHandler old = node::GetAbortHandler();
+  abort_handler_dispatch_flag = false;
+  abort_handler_received_location = nullptr;
+  abort_handler_received_message = nullptr;
+
+  node::SetAbortHandler(AbortHandlerThatSetsDispatchFlag);
+  node::AbortHandler h = node::GetAbortHandler();
+  // Fail cleanly (instead of crashing on a null call) if the handler wasn't
+  // actually installed.
+  ASSERT_NE(h, nullptr);
+
+  // Dispatch through the public GetAbortHandler() accessor directly (not via
+  // the ABORT() macro, so nothing terminates), and verify the message is
+  // passed through unchanged.
+  node::GetAbortHandler()("some-test-location", "some-test-message");
+  EXPECT_TRUE(abort_handler_dispatch_flag);
+  EXPECT_STREQ(abort_handler_received_location, "some-test-location");
+  EXPECT_STREQ(abort_handler_received_message, "some-test-message");
+
+  node::SetAbortHandler(old);
+}

From 3e50a2f1e9277191761ceddc3c6729d3afeb695a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Tue, 11 Aug 2026 20:47:37 -0300
Subject: [PATCH 120/344] sqlite: manage sqlite3_stmt lifetime with RAII
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62419
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/node_sqlite.cc                        | 119 ++++++++++++----------
 src/node_sqlite.h                         |  12 ++-
 test/parallel/test-sqlite-template-tag.js |  17 ++++
 3 files changed, 89 insertions(+), 59 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 68554ed33b31..9c80d18cdaab 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1590,6 +1590,7 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
   Utf8Value sql(env->isolate(), args[0].As<String>());
   sqlite3_stmt* s = nullptr;
   int r = sqlite3_prepare_v2(db->connection_, *sql, -1, &s, nullptr);
+  StatementPtr stmt_ptr(s);
 
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
 
@@ -1602,8 +1603,11 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  BaseObjectPtr<StatementSync> stmt =
-      StatementSync::Create(env, BaseObjectPtr<DatabaseSync>(db), s);
+  BaseObjectPtr<StatementSync> stmt = StatementSync::Create(
+      env, BaseObjectPtr<DatabaseSync>(db), std::move(stmt_ptr));
+  if (!stmt) {
+    return;
+  }
   db->statements_.insert(stmt.get());
 
   if (return_arrays.has_value()) {
@@ -2660,10 +2664,9 @@ int DatabaseSync::AuthorizerCallback(void* user_data,
 StatementSync::StatementSync(Environment* env,
                              Local<Object> object,
                              BaseObjectPtr<DatabaseSync> db,
-                             sqlite3_stmt* stmt)
-    : BaseObject(env, object), db_(std::move(db)) {
+                             StatementPtr stmt)
+    : BaseObject(env, object), db_(std::move(db)), statement_(std::move(stmt)) {
   MakeWeak();
-  statement_ = stmt;
   use_big_ints_ = db_->use_big_ints();
   return_arrays_ = db_->return_arrays();
   allow_bare_named_params_ = db_->allow_bare_named_params();
@@ -2677,15 +2680,15 @@ StatementSync::~StatementSync() {
 }
 
 void StatementSync::Close() {
+  db_->UntrackStatement(this);
+
   if (!IsFinalized()) {
-    db_->UntrackStatement(this);
     Finalize();
   }
 }
 
 void StatementSync::Finalize() {
-  sqlite3_finalize(statement_);
-  statement_ = nullptr;
+  statement_.reset();
   InvalidateColumnNameCache();
 }
 
@@ -2714,11 +2717,11 @@ void StatementSync::Dispose(const FunctionCallbackInfo<Value>& args) {
 
 inline int StatementSync::ResetStatement() {
   reset_generation_++;
-  return sqlite3_reset(statement_);
+  return sqlite3_reset(statement_.get());
 }
 
 bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
-  int r = sqlite3_clear_bindings(statement_);
+  int r = sqlite3_clear_bindings(statement_.get());
   CHECK_ERROR_OR_THROW(env()->isolate(), db_.get(), r, SQLITE_OK, false);
 
   int anon_idx = 1;
@@ -2735,10 +2738,10 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
 
     if (allow_bare_named_params_ && !bare_named_params_.has_value()) {
       bare_named_params_.emplace();
-      int param_count = sqlite3_bind_parameter_count(statement_);
+      int param_count = sqlite3_bind_parameter_count(statement_.get());
       // Parameter indexing starts at one.
       for (int i = 1; i <= param_count; ++i) {
-        const char* name = sqlite3_bind_parameter_name(statement_, i);
+        const char* name = sqlite3_bind_parameter_name(statement_.get(), i);
         if (name == nullptr) {
           continue;
         }
@@ -2770,12 +2773,12 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
       }
 
       Utf8Value utf8_key(env()->isolate(), key);
-      int r = sqlite3_bind_parameter_index(statement_, *utf8_key);
+      int r = sqlite3_bind_parameter_index(statement_.get(), *utf8_key);
       if (r == 0) {
         if (allow_bare_named_params_) {
           auto lookup = bare_named_params_->find(std::string(*utf8_key));
           if (lookup != bare_named_params_->end()) {
-            r = sqlite3_bind_parameter_index(statement_,
+            r = sqlite3_bind_parameter_index(statement_.get(),
                                              lookup->second.c_str());
           }
         }
@@ -2805,7 +2808,8 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
 
   for (int i = anon_start; i < args.Length(); ++i) {
     while (1) {
-      const char* param = sqlite3_bind_parameter_name(statement_, anon_idx);
+      const char* param =
+          sqlite3_bind_parameter_name(statement_.get(), anon_idx);
       if (param == nullptr || param[0] == '?') break;
       anon_idx++;
     }
@@ -2831,7 +2835,7 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
   int r;
   if (value->IsNumber()) {
     const double val = value.As<Number>()->Value();
-    r = sqlite3_bind_double(statement_, index, val);
+    r = sqlite3_bind_double(statement_.get(), index, val);
   } else if (value->IsString()) {
     Utf8Value val(isolate, value.As<String>());
     if (val.IsAllocated()) {
@@ -2841,9 +2845,9 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
       const sqlite3_uint64 length = static_cast<sqlite3_uint64>(val.length());
       val.Release();
       r = sqlite3_bind_text64(
-          statement_, index, data, length, std::free, SQLITE_UTF8);
+          statement_.get(), index, data, length, std::free, SQLITE_UTF8);
     } else {
-      r = sqlite3_bind_text64(statement_,
+      r = sqlite3_bind_text64(statement_.get(),
                               index,
                               *val,
                               static_cast<sqlite3_uint64>(val.length()),
@@ -2851,17 +2855,17 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
                               SQLITE_UTF8);
     }
   } else if (value->IsNull()) {
-    r = sqlite3_bind_null(statement_, index);
+    r = sqlite3_bind_null(statement_.get(), index);
   } else if (value->IsArrayBufferView() || value->IsArrayBuffer() ||
              value->IsSharedArrayBuffer()) {
     ArrayBufferViewContents<uint8_t> buf(value);
-    r = sqlite3_bind_blob64(statement_,
+    r = sqlite3_bind_blob64(statement_.get(),
                             index,
                             buf.data(),
                             static_cast<sqlite3_uint64>(buf.length()),
                             SQLITE_TRANSIENT);
   } else if (value->IsBoolean()) {
-    r = sqlite3_bind_int(statement_, index, value->IsTrue() ? 1 : 0);
+    r = sqlite3_bind_int(statement_.get(), index, value->IsTrue() ? 1 : 0);
   } else if (value->IsBigInt()) {
     bool lossless;
     int64_t as_int = value.As<BigInt>()->Int64Value(&lossless);
@@ -2869,7 +2873,7 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
       THROW_ERR_INVALID_ARG_VALUE(env(), "BigInt value is too large to bind.");
       return false;
     }
-    r = sqlite3_bind_int64(statement_, index, as_int);
+    r = sqlite3_bind_int64(statement_.get(), index, as_int);
   } else {
     THROW_ERR_INVALID_ARG_TYPE(
         isolate,
@@ -2884,11 +2888,11 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
 
 MaybeLocal<Value> StatementSync::ColumnToValue(const int column) {
   return StatementExecutionHelper::ColumnToValue(
-      env(), statement_, column, use_big_ints_);
+      env(), statement_.get(), column, use_big_ints_);
 }
 
 MaybeLocal<Name> StatementSync::ColumnNameToName(const int column) {
-  const char* col_name = sqlite3_column_name(statement_, column);
+  const char* col_name = sqlite3_column_name(statement_.get(), column);
   if (col_name == nullptr) {
     THROW_ERR_INVALID_STATE(env(), "Cannot get name of column %d", column);
     return MaybeLocal<Name>();
@@ -2905,10 +2909,10 @@ bool StatementSync::GetCachedColumnNames(LocalVector<Name>* keys) {
   Isolate* isolate = env()->isolate();
 
   const int reprepare_count =
-      sqlite3_stmt_status(statement_, SQLITE_STMTSTATUS_REPREPARE, false);
+      sqlite3_stmt_status(statement_.get(), SQLITE_STMTSTATUS_REPREPARE, false);
   if (reprepare_count != cached_column_names_reprepare_count_) {
     cached_column_names_.clear();
-    const int num_cols = sqlite3_column_count(statement_);
+    const int num_cols = sqlite3_column_count(statement_.get());
     if (num_cols == 0) {
       cached_column_names_reprepare_count_ = reprepare_count;
       return true;
@@ -3184,17 +3188,17 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
 
   bool needs_reset = true;
   auto reset = OnScopeLeave([&]() {
-    if (needs_reset) sqlite3_reset(stmt->statement_);
+    if (needs_reset) sqlite3_reset(stmt->statement_.get());
   });
   Local<Value> result;
   if (StatementExecutionHelper::All(env,
                                     stmt->db_.get(),
-                                    stmt->statement_,
+                                    stmt->statement_.get(),
                                     stmt->return_arrays_,
                                     stmt->use_big_ints_)
           .ToLocal(&result)) {
     RESET_AND_CHECK(
-        isolate, stmt->db_.get(), stmt->statement_, needs_reset, void());
+        isolate, stmt->db_.get(), stmt->statement_.get(), needs_reset, void());
     args.GetReturnValue().Set(result);
   }
 }
@@ -3238,7 +3242,7 @@ void StatementSync::Get(const FunctionCallbackInfo<Value>& args) {
   Local<Value> result;
   if (StatementExecutionHelper::Get(env,
                                     stmt->db_.get(),
-                                    stmt->statement_,
+                                    stmt->statement_.get(),
                                     stmt->return_arrays_,
                                     stmt->use_big_ints_)
           .ToLocal(&result)) {
@@ -3261,7 +3265,7 @@ void StatementSync::Run(const FunctionCallbackInfo<Value>& args) {
 
   Local<Object> result;
   if (StatementExecutionHelper::Run(
-          env, stmt->db_.get(), stmt->statement_, stmt->use_big_ints_)
+          env, stmt->db_.get(), stmt->statement_.get(), stmt->use_big_ints_)
           .ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
@@ -3273,7 +3277,7 @@ void StatementSync::Columns(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
-  int num_cols = sqlite3_column_count(stmt->statement_);
+  int num_cols = sqlite3_column_count(stmt->statement_.get());
   Isolate* isolate = env->isolate();
   LocalVector<Value> cols(isolate);
   auto sqlite_column_template = env->sqlite_column_template();
@@ -3288,14 +3292,14 @@ void StatementSync::Columns(const FunctionCallbackInfo<Value>& args) {
   for (int i = 0; i < num_cols; ++i) {
     MaybeLocal<Value> values[] = {
         NullableSQLiteStringToValue(
-            isolate, sqlite3_column_origin_name(stmt->statement_, i)),
+            isolate, sqlite3_column_origin_name(stmt->statement_.get(), i)),
         NullableSQLiteStringToValue(
-            isolate, sqlite3_column_database_name(stmt->statement_, i)),
+            isolate, sqlite3_column_database_name(stmt->statement_.get(), i)),
         stmt->ColumnNameToName(i),
         NullableSQLiteStringToValue(
-            isolate, sqlite3_column_table_name(stmt->statement_, i)),
+            isolate, sqlite3_column_table_name(stmt->statement_.get(), i)),
         NullableSQLiteStringToValue(
-            isolate, sqlite3_column_decltype(stmt->statement_, i)),
+            isolate, sqlite3_column_decltype(stmt->statement_.get(), i)),
     };
 
     Local<Object> col;
@@ -3317,7 +3321,7 @@ void StatementSync::SourceSQLGetter(const FunctionCallbackInfo<Value>& args) {
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
   Local<String> sql;
-  if (!String::NewFromUtf8(env->isolate(), sqlite3_sql(stmt->statement_))
+  if (!String::NewFromUtf8(env->isolate(), sqlite3_sql(stmt->statement_.get()))
            .ToLocal(&sql)) {
     return;
   }
@@ -3332,7 +3336,7 @@ void StatementSync::ExpandedSQLGetter(const FunctionCallbackInfo<Value>& args) {
       env, stmt->IsFinalized(), "statement has been finalized");
 
   // sqlite3_expanded_sql may return nullptr without producing an error code.
-  char* expanded = sqlite3_expanded_sql(stmt->statement_);
+  char* expanded = sqlite3_expanded_sql(stmt->statement_.get());
   if (expanded == nullptr) {
     return THROW_ERR_SQLITE_ERROR(
         env->isolate(), "Expanded SQL text would exceed configured limits");
@@ -3506,11 +3510,11 @@ bool SQLTagStore::ResetAndBindStatement(
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
 
-  r = sqlite3_clear_bindings(stmt->statement_);
+  r = sqlite3_clear_bindings(stmt->statement_.get());
   CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
 
   uint32_t n_params = args.Length() - 1;
-  int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+  int param_count = sqlite3_bind_parameter_count(stmt->statement_.get());
   if (param_count != static_cast<int>(n_params)) {
     THROW_ERR_INVALID_ARG_VALUE(
         env,
@@ -3547,7 +3551,7 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 
   Local<Object> result;
   if (StatementExecutionHelper::Run(
-          env, stmt->db_.get(), stmt->statement_, stmt->use_big_ints_)
+          env, stmt->db_.get(), stmt->statement_.get(), stmt->use_big_ints_)
           .ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
@@ -3602,7 +3606,7 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
   Local<Value> result;
   if (StatementExecutionHelper::Get(env,
                                     stmt->db_.get(),
-                                    stmt->statement_,
+                                    stmt->statement_.get(),
                                     stmt->return_arrays_,
                                     stmt->use_big_ints_)
           .ToLocal(&result)) {
@@ -3631,17 +3635,17 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = env->isolate();
   bool needs_reset = true;
   auto reset = OnScopeLeave([&]() {
-    if (needs_reset) sqlite3_reset(stmt->statement_);
+    if (needs_reset) sqlite3_reset(stmt->statement_.get());
   });
   Local<Value> result;
   if (StatementExecutionHelper::All(env,
                                     stmt->db_.get(),
-                                    stmt->statement_,
+                                    stmt->statement_.get(),
                                     stmt->return_arrays_,
                                     stmt->use_big_ints_)
           .ToLocal(&result)) {
     RESET_AND_CHECK(
-        isolate, stmt->db_.get(), stmt->statement_, needs_reset, void());
+        isolate, stmt->db_.get(), stmt->statement_.get(), needs_reset, void());
     args.GetReturnValue().Set(result);
   }
 }
@@ -3704,10 +3708,10 @@ BaseObjectPtr<StatementSync> SQLTagStore::PrepareStatement(
     sqlite3_stmt* s = nullptr;
     int r = sqlite3_prepare_v2(
         session->database_->connection_, sql.data(), sql.size(), &s, nullptr);
+    StatementPtr stmt_ptr(s);
 
     if (r != SQLITE_OK) {
       THROW_ERR_SQLITE_ERROR(isolate, session->database_.get());
-      sqlite3_finalize(s);
       return BaseObjectPtr<StatementSync>();
     }
 
@@ -3718,15 +3722,17 @@ BaseObjectPtr<StatementSync> SQLTagStore::PrepareStatement(
       return BaseObjectPtr<StatementSync>();
     }
 
-    BaseObjectPtr<StatementSync> stmt_obj = StatementSync::Create(
-        env, BaseObjectPtr<DatabaseSync>(session->database_), s);
+    BaseObjectPtr<StatementSync> stmt_obj =
+        StatementSync::Create(env,
+                              BaseObjectPtr<DatabaseSync>(session->database_),
+                              std::move(stmt_ptr));
 
     if (!stmt_obj) {
       THROW_ERR_SQLITE_ERROR(isolate, "Failed to create StatementSync");
-      sqlite3_finalize(s);
       return BaseObjectPtr<StatementSync>();
     }
 
+    session->database_->statements_.insert(stmt_obj.get());
     session->sql_tags_.Put(sql, stmt_obj);
     stmt = stmt_obj;
   }
@@ -3789,7 +3795,7 @@ Local<FunctionTemplate> StatementSync::GetConstructorTemplate(
 }
 
 BaseObjectPtr<StatementSync> StatementSync::Create(
-    Environment* env, BaseObjectPtr<DatabaseSync> db, sqlite3_stmt* stmt) {
+    Environment* env, BaseObjectPtr<DatabaseSync> db, StatementPtr stmt) {
   Local<Object> obj;
   if (!GetConstructorTemplate(env)
            ->InstanceTemplate()
@@ -3798,7 +3804,8 @@ BaseObjectPtr<StatementSync> StatementSync::Create(
     return nullptr;
   }
 
-  return MakeBaseObject<StatementSync>(env, obj, std::move(db), stmt);
+  return MakeBaseObject<StatementSync>(
+      env, obj, std::move(db), std::move(stmt));
 }
 
 StatementSyncIterator::StatementSyncIterator(Environment* env,
@@ -3871,14 +3878,14 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
       iter->statement_reset_generation_ != iter->stmt_->reset_generation_,
       "iterator was invalidated");
 
-  int r = sqlite3_step(iter->stmt_->statement_);
+  int r = sqlite3_step(iter->stmt_->statement_.get());
   if (r != SQLITE_ROW) {
     CHECK_ERROR_OR_THROW(
         env->isolate(), iter->stmt_->db_.get(), r, SQLITE_DONE, void());
     iter->done_ = true;
     RESET_OR_THROW(env->isolate(),
                    iter->stmt_->db_.get(),
-                   iter->stmt_->statement_,
+                   iter->stmt_->statement_.get(),
                    void());
     MaybeLocal<Value> values[] = {Boolean::New(isolate, true), Null(isolate)};
     Local<Object> result;
@@ -3889,13 +3896,13 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  int num_cols = sqlite3_column_count(iter->stmt_->statement_);
+  int num_cols = sqlite3_column_count(iter->stmt_->statement_.get());
   Local<Value> row_value;
   LocalVector<Name> row_keys(isolate);
   LocalVector<Value> row_values(isolate);
 
   if (ExtractRowValues(env,
-                       iter->stmt_->statement_,
+                       iter->stmt_->statement_.get(),
                        num_cols,
                        iter->stmt_->use_big_ints_,
                        &row_values)
@@ -3935,7 +3942,7 @@ void StatementSyncIterator::Return(const FunctionCallbackInfo<Value>& args) {
   // is invoked by the language during abrupt completion (e.g. a `throw`
   // inside a `for...of` body), and throwing on a deferred SQLite error
   // would discard the caller's already-pending exception.
-  sqlite3_reset(iter->stmt_->statement_);
+  sqlite3_reset(iter->stmt_->statement_.get());
   iter->done_ = true;
 
   auto iter_template = getLazyIterTemplate(env);
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index b4446e5db859..17025a528622 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -135,6 +135,12 @@ class StatementSync;
 class BackupJob;
 class Session;
 
+inline void FinalizeStatement(sqlite3_stmt* stmt) {
+  sqlite3_finalize(stmt);
+}
+
+using StatementPtr = DeleteFnPtr<sqlite3_stmt, FinalizeStatement>;
+
 class StatementExecutionHelper {
  public:
   static v8::MaybeLocal<v8::Value> All(Environment* env,
@@ -263,13 +269,13 @@ class StatementSync : public BaseObject {
   StatementSync(Environment* env,
                 v8::Local<v8::Object> object,
                 BaseObjectPtr<DatabaseSync> db,
-                sqlite3_stmt* stmt);
+                StatementPtr stmt);
   void MemoryInfo(MemoryTracker* tracker) const override;
   static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
       Environment* env);
   static BaseObjectPtr<StatementSync> Create(Environment* env,
                                              BaseObjectPtr<DatabaseSync> db,
-                                             sqlite3_stmt* stmt);
+                                             StatementPtr stmt);
   static void All(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Iterate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Get(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -299,7 +305,7 @@ class StatementSync : public BaseObject {
   ~StatementSync() override;
   void Close();
   BaseObjectPtr<DatabaseSync> db_;
-  sqlite3_stmt* statement_;
+  StatementPtr statement_;
   bool return_arrays_ = false;
   bool use_big_ints_;
   bool allow_bare_named_params_;
diff --git a/test/parallel/test-sqlite-template-tag.js b/test/parallel/test-sqlite-template-tag.js
index 20376e199d1b..eaa6d19fc7cd 100644
--- a/test/parallel/test-sqlite-template-tag.js
+++ b/test/parallel/test-sqlite-template-tag.js
@@ -371,3 +371,20 @@ test('tag store prevents circular reference leaks', async () => {
     return after < before * 1.5;
   }, 20);
 });
+
+test('cached statements are finalized when the database is closed', () => {
+  const db = new DatabaseSync(':memory:');
+  const sql = db.createTagStore();
+
+  db.exec('CREATE TABLE foo (id INTEGER PRIMARY KEY)');
+  db.exec('INSERT INTO foo (id) VALUES (1)');
+  assert.deepStrictEqual(sql.all`SELECT id FROM foo`, [{ __proto__: null, id: 1 }]);
+
+  db.close();
+  db.open();
+
+  assert.throws(() => sql.all`SELECT id FROM foo`, {
+    code: 'ERR_SQLITE_ERROR',
+    message: /no such table/i,
+  });
+});

From 6f9e0846eaa4aed3d4b9237fff859602055ae026 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 11 Aug 2026 19:46:06 -0700
Subject: [PATCH 121/344] ffi: validate fast pointer BigInt argument ranges

Optimized V8 fast API calls truncate out-of-range pointer BigInts.
Validate them against uintptrMax before invoking the raw function
so optimized calls match the generic and shared-buffer paths.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65032
Fixes: https://github.com/nodejs/node/issues/65031
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/ffi/fast-api.js                 | 11 +++++++
 src/node_ffi.cc                              |  6 ++--
 test/ffi/test-ffi-fast-integer-validation.js | 31 ++++++++++++++++++++
 3 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/lib/internal/ffi/fast-api.js b/lib/internal/ffi/fast-api.js
index 486a119a2e07..a232caa1af24 100644
--- a/lib/internal/ffi/fast-api.js
+++ b/lib/internal/ffi/fast-api.js
@@ -24,6 +24,7 @@ const {
   getRawPointer,
   kFastArguments,
   kFastBufferInvoke,
+  uintptrMax,
 } = internalBinding('ffi');
 
 const {
@@ -110,6 +111,14 @@ function needsPointerConversion(type) {
          needsNullPointerConversion(type) || needsStringPointerConversion(type);
 }
 
+function validateFastPointerArg(type, value, index) {
+  if (needsPointerConversion(type) && typeof value === 'bigint' &&
+      (value < 0n || value > uintptrMax)) {
+    throwFFIArgError(
+      `Argument ${index} must be a non-negative pointer bigint`);
+  }
+}
+
 function hasStringPointerArg(type, value) {
   return typeof value === 'string' && needsStringPointerConversion(type);
 }
@@ -159,6 +168,7 @@ function getStringConversionPointer(state, value, index) {
 }
 
 function convertPointerArg(type, value, stringState, index) {
+  validateFastPointerArg(type, value, index);
   if (needsNullPointerConversion(type) &&
       (value === null || value === undefined)) {
     return 0n;
@@ -261,6 +271,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
         throwFFIArgCountError(1, arguments.length);
       }
       validateFastIntegerArg(t0, a0, 0);
+      validateFastPointerArg(t0, a0, 0);
       let arg = a0;
       if (needsNullPointerConversion(t0) &&
           (arg === null || arg === undefined)) {
diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 1e1fc5654591..42c62c829168 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -1341,9 +1341,9 @@ static void Initialize(Local<Object> target,
             Boolean::New(isolate, CHAR_MIN < 0))
       .Check();
 
-  // The shared-buffer fast path uses `uintptrMax` to reject pointer BigInts
-  // that would otherwise be silently truncated by `ReadFFIArgFromBuffer`'s
-  // `memcpy(..., type->size, ...)` on 32-bit platforms. The slow path
+  // The JavaScript fast paths use `uintptrMax` to reject pointer BigInts that
+  // would otherwise be silently truncated by V8 or, on 32-bit platforms, by
+  // `ReadFFIArgFromBuffer`'s `memcpy(..., type->size, ...)`. The slow path
   // rejects the same values through `ToFFIArgument`.
   target
       ->Set(context,
diff --git a/test/ffi/test-ffi-fast-integer-validation.js b/test/ffi/test-ffi-fast-integer-validation.js
index 26d51ae4248f..1243391ac87c 100644
--- a/test/ffi/test-ffi-fast-integer-validation.js
+++ b/test/ffi/test-ffi-fast-integer-validation.js
@@ -68,3 +68,34 @@ test('fast FFI validates integer argument ranges', () => {
     lib.close();
   }
 });
+
+test('fast FFI validates pointer BigInt ranges', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+  try {
+    for (const type of ['pointer', 'ptr', 'string', 'str',
+                        'buffer', 'arraybuffer']) {
+      const identityPointer = lib.getFunction('identity_pointer', {
+        arguments: [type],
+        return: 'pointer',
+      });
+      const sumBuffer = lib.getFunction('sum_buffer', {
+        arguments: [type, 'u64'],
+        return: 'u64',
+      });
+      function callSingle(value) { return identityPointer(value); }
+
+      function callMultiple(value) { return sumBuffer(value, 0n); }
+
+      optimize(callSingle, 0n);
+      optimize(callMultiple, 0n);
+
+      const expect = { code: 'ERR_INVALID_ARG_VALUE' };
+      for (const call of [callSingle, callMultiple]) {
+        assert.throws(() => call(-1n), expect);
+        assert.throws(() => call((2n ** 64n) + 5n), expect);
+      }
+    }
+  } finally {
+    lib.close();
+  }
+});

From 9fc811a0f2c9da0fa5b80e96b56bb2ffcda414e6 Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Wed, 12 Aug 2026 18:51:21 +0900
Subject: [PATCH 122/344] typings: add credentials internal binding types

Add a CredentialsBinding declaration for internalBinding('credentials')
and wire it into InternalBindingMap.

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65036
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 typings/globals.d.ts                     |  2 ++
 typings/internalBinding/credentials.d.ts | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 typings/internalBinding/credentials.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index 83fcec8e19a5..536a8c4c2822 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -5,6 +5,7 @@ import { BufferBinding } from './internalBinding/buffer';
 import { CJSLexerBinding } from './internalBinding/cjs_lexer';
 import { ConfigBinding } from './internalBinding/config';
 import { ConstantsBinding } from './internalBinding/constants';
+import { CredentialsBinding } from './internalBinding/credentials';
 import { CryptoBinding } from './internalBinding/crypto';
 import { DebugBinding } from './internalBinding/debug';
 import { EncodingBinding } from './internalBinding/encoding_binding';
@@ -44,6 +45,7 @@ interface InternalBindingMap {
   cjs_lexer: CJSLexerBinding;
   config: ConfigBinding;
   constants: ConstantsBinding;
+  credentials: CredentialsBinding;
   crypto: CryptoBinding;
   debug: DebugBinding;
   encoding_binding: EncodingBinding;
diff --git a/typings/internalBinding/credentials.d.ts b/typings/internalBinding/credentials.d.ts
new file mode 100644
index 000000000000..8880e7e38a6f
--- /dev/null
+++ b/typings/internalBinding/credentials.d.ts
@@ -0,0 +1,18 @@
+export interface CredentialsBinding {
+  implementsPosixCredentials?: true;
+  safeGetenv(key: string): string | undefined;
+  getTempDir(): string | undefined;
+
+  getuid?(): number;
+  geteuid?(): number;
+  getgid?(): number;
+  getegid?(): number;
+  getgroups?(): number[];
+
+  initgroups?(user: string | number, extraGroup: string | number): 0 | 1 | 2;
+  setegid?(id: string | number): 0 | 1;
+  seteuid?(id: string | number): 0 | 1;
+  setgid?(id: string | number): 0 | 1;
+  setuid?(id: string | number): 0 | 1;
+  setgroups?(groups: Array<string | number>): number;
+}

From c63e873073cd675942ac78d5025fe730ea71a84c Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Wed, 12 Aug 2026 22:38:41 +0900
Subject: [PATCH 123/344] doc: fix broken fs.BigIntStats link in vfs.md

fs.md describes the bigint variant inside the fs.Stats section and has
no separate fs.BigIntStats section to link to.

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65045
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/vfs.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/vfs.md b/doc/api/vfs.md
index 7a1695d8b355..1551a18feac7 100644
--- a/doc/api/vfs.md
+++ b/doc/api/vfs.md
@@ -320,6 +320,6 @@ fields use synthetic but stable values:
 [`RealFSProvider`]: #class-realfsprovider
 [`VirtualFileSystem`]: #class-virtualfilesystem
 [`VirtualProvider`]: #class-virtualprovider
-[`fs.BigIntStats`]: fs.md#class-fsbigintstats
+[`fs.BigIntStats`]: fs.md#class-fsstats
 [`fs.Stats`]: fs.md#class-fsstats
 [`node:fs`]: fs.md

From 4018f3a776b28181eaba99b01003c77f1b0ce415 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 12:05:24 -0700
Subject: [PATCH 124/344] src: shave about 20 bytes off each TLSWrap instance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By shifting from individual bool fields to a packed struct
we can save 20 bytes per TLSWrap instance

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65144
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
---
 src/crypto/crypto_tls.cc | 74 +++++++++++++++++++---------------------
 src/crypto/crypto_tls.h  | 62 +++++++++++++++++++--------------
 2 files changed, 73 insertions(+), 63 deletions(-)

diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 8ef74aee2d0e..936c201de99d 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -240,7 +240,7 @@ int SelectALPNCallback(
     unsigned int inlen,
     void* arg) {
   TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
-  if (w->alpn_callback_enabled_) {
+  if (w->get_alpn_callback_enabled()) {
     Environment* env = w->env();
     HandleScope handle_scope(env->isolate());
 
@@ -275,7 +275,7 @@ int SelectALPNCallback(
     return SSL_TLSEXT_ERR_OK;
   }
 
-  const std::vector<unsigned char>& alpn_protos = w->alpn_protos_;
+  auto& alpn_protos = w->get_alpn_protos();
 
   if (alpn_protos.empty()) return SSL_TLSEXT_ERR_NOACK;
 
@@ -403,9 +403,9 @@ TLSWrap::TLSWrap(Environment* env,
       StreamBase(env),
       env_(env),
       kind_(kind),
-      sc_(sc),
-      has_active_write_issued_by_prev_listener_(
-          under_stream_ws == UnderlyingStreamWriteStatus::kHasActive) {
+      sc_(sc) {
+  flags_.has_active_write_issued_by_prev_listener =
+      under_stream_ws == UnderlyingStreamWriteStatus::kHasActive;
   MakeWeak();
   CHECK(sc_);
   ssl_ = sc_->CreateSSL();
@@ -444,8 +444,7 @@ SSL_SESSION* TLSWrap::ReleaseSession() {
 
 void TLSWrap::InvokeQueued(int status, const char* error_str) {
   Debug(this, "Invoking queued write callbacks (%d, %s)", status, error_str);
-  if (!write_callback_scheduled_)
-    return;
+  if (!flags_.write_callback_scheduled) return;
 
   if (current_write_) {
     BaseObjectPtr<AsyncWrap> current_write = std::move(current_write_);
@@ -465,8 +464,8 @@ void TLSWrap::NewSessionDoneCb() {
 bool TLSWrap::OnEarlyClientHello(const unsigned char* session_id,
                                  size_t session_id_len,
                                  bool has_ticket) {
-  if (!hello_emitted_) {
-    hello_emitted_ = true;
+  if (!flags_.hello_emitted) {
+    flags_.hello_emitted = true;
     Debug(this, "Scheduling onclienthello");
 
     // The hello data is only valid inside the library callback, and JS must
@@ -480,7 +479,7 @@ bool TLSWrap::OnEarlyClientHello(const unsigned char* session_id,
           if (ssl_) EmitClientHello(id, has_ticket);
         });
   }
-  return hello_answered_;
+  return flags_.hello_answered;
 }
 
 void TLSWrap::EmitClientHello(const std::vector<unsigned char>& session_id,
@@ -658,8 +657,8 @@ void TLSWrap::Start(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
 
-  CHECK(!wrap->started_);
-  wrap->started_ = true;
+  CHECK(!wrap->flags_.started);
+  wrap->flags_.started = true;
 
   // Send ClientHello handshake
   CHECK(wrap->is_client());
@@ -703,7 +702,7 @@ void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) {
     CHECK(!SSL_renegotiate_pending(ssl));
     Local<Value> callback;
 
-    c->established_ = true;
+    c->flags_.established = true;
 
     if (object->Get(env->context(), env->onhandshakedone_string())
           .ToLocal(&callback) && callback->IsFunction()) {
@@ -727,7 +726,7 @@ void TLSWrap::EncOut() {
     return;
   }
 
-  if (has_active_write_issued_by_prev_listener_) [[unlikely]] {
+  if (flags_.has_active_write_issued_by_prev_listener) [[unlikely]] {
     Debug(this,
           "Returning from EncOut(), "
           "has_active_write_issued_by_prev_listener_ is true");
@@ -735,9 +734,9 @@ void TLSWrap::EncOut() {
   }
 
   // Split-off queue
-  if (established_ && current_write_) {
+  if (flags_.established && current_write_) {
     Debug(this, "EncOut() write is scheduled");
-    write_callback_scheduled_ = true;
+    flags_.write_callback_scheduled = true;
   }
 
   if (ssl_ == nullptr) {
@@ -750,7 +749,7 @@ void TLSWrap::EncOut() {
     Debug(this, "No pending encrypted output");
     if (!pending_cleartext_input_ ||
         pending_cleartext_input_->ByteLength() == 0) {
-      if (!in_dowrite_) {
+      if (!flags_.in_dowrite) {
         Debug(this, "No pending cleartext input, not inside DoWrite()");
         InvokeQueued(0);
       } else {
@@ -805,7 +804,7 @@ void TLSWrap::EncOut() {
 void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
   Debug(this, "OnStreamAfterWrite(status = %d)", status);
 
-  if (has_active_write_issued_by_prev_listener_) [[unlikely]] {
+  if (flags_.has_active_write_issued_by_prev_listener) [[unlikely]] {
     Debug(this, "Notify write finish to the previous_listener_");
     CHECK_EQ(write_size_, 0);  // we must have restrained writes
 
@@ -830,7 +829,7 @@ void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
 
   // Handle error
   if (status) {
-    if (shutdown_) {
+    if (flags_.shutdown) {
       Debug(this, "Ignoring error after shutdown");
       return;
     }
@@ -855,7 +854,7 @@ void TLSWrap::ClearOut() {
   Debug(this, "Trying to read cleartext output");
 
   // No reads after EOF
-  if (eof_) {
+  if (flags_.eof) {
     Debug(this, "Returning from ClearOut(), EOF reached");
     return;
   }
@@ -911,8 +910,8 @@ void TLSWrap::ClearOut() {
     int err = SSL_get_error(ssl_.get(), read);
     switch (err) {
       case SSL_ERROR_ZERO_RETURN:
-        if (!eof_) {
-          eof_ = true;
+        if (!flags_.eof) {
+          flags_.eof = true;
           EmitRead(UV_EOF);
         }
         return;
@@ -1005,7 +1004,7 @@ void TLSWrap::ClearIn() {
   int err = SSL_get_error(ssl_.get(), written);
   if (err == SSL_ERROR_SSL || err == SSL_ERROR_SYSCALL) {
     Debug(this, "Got SSL error (%d)", err);
-    write_callback_scheduled_ = true;
+    flags_.write_callback_scheduled = true;
     // TODO(@sam-github) Should forward an error object with
     // .code/.function/.etc, if possible.
     InvokeQueued(UV_EPROTO, GetBIOError().c_str());
@@ -1049,7 +1048,7 @@ bool TLSWrap::IsClosing() {
 
 int TLSWrap::ReadStart() {
   Debug(this, "ReadStart()");
-  if (underlying_stream() != nullptr && !eof_)
+  if (underlying_stream() != nullptr && !flags_.eof)
     return underlying_stream()->ReadStart();
   return 0;
 }
@@ -1197,9 +1196,9 @@ int TLSWrap::DoWrite(WriteWrap* w,
 
   // Write any encrypted/handshake output that may be ready.
   // Guard against sync call of current_write_->Done(), its unsupported.
-  in_dowrite_ = true;
+  flags_.in_dowrite = true;
   EncOut();
-  in_dowrite_ = false;
+  flags_.in_dowrite = false;
 
   return 0;
 }
@@ -1216,8 +1215,7 @@ void TLSWrap::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
   Debug(this, "Read %zd bytes from underlying stream", nread);
 
   // Ignore everything after close_notify (rfc5246#section-7.2.1)
-  if (eof_)
-    return;
+  if (flags_.eof) return;
 
   if (nread < 0)  {
     // Error should be emitted only after all data was read
@@ -1225,7 +1223,7 @@ void TLSWrap::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
 
     if (nread == UV_EOF) {
       // underlying stream already should have also called ReadStop on itself
-      eof_ = true;
+      flags_.eof = true;
     }
 
     EmitRead(nread);
@@ -1256,7 +1254,7 @@ int TLSWrap::DoShutdown(ShutdownWrap* req_wrap) {
   if (ssl_ && SSL_shutdown(ssl_.get()) == 0)
     SSL_shutdown(ssl_.get());
 
-  shutdown_ = true;
+  flags_.shutdown = true;
   EncOut();
   return underlying_stream()->DoShutdown(req_wrap);
 }
@@ -1352,7 +1350,7 @@ void TLSWrap::Destroy() {
     return;
 
   // If there is a write happening, mark it as finished.
-  write_callback_scheduled_ = true;
+  flags_.write_callback_scheduled = true;
 
   // And destroy
   InvokeQueued(UV_ECANCELED, "Canceled because of SSL destruction");
@@ -1389,7 +1387,7 @@ void TLSWrap::ResumeAfterCertCb(void* arg) {
 void TLSWrap::EnableALPNCb(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
-  wrap->alpn_callback_enabled_ = true;
+  wrap->flags_.alpn_callback_enabled = true;
 
   SSL* ssl = wrap->ssl_.get();
   SSL_CTX* ssl_ctx = SSL_get_SSL_CTX(ssl);
@@ -1418,7 +1416,7 @@ void TLSWrap::SetServername(const FunctionCallbackInfo<Value>& args) {
 
   CHECK_EQ(args.Length(), 1);
   CHECK(args[0]->IsString());
-  CHECK(!wrap->started_);
+  CHECK(!wrap->flags_.started);
   CHECK(wrap->is_client());
 
   CHECK(wrap->ssl_);
@@ -1633,7 +1631,7 @@ void TLSWrap::CertCbDone(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
 
-  CHECK(w->is_waiting_cert_cb() && w->cert_cb_running_);
+  CHECK(w->is_waiting_cert_cb() && w->flags_.cert_cb_running);
 
   Local<Object> object = w->object();
   Local<Value> ctx = object->Get(env->context(), env->sni_context_string())
@@ -1685,7 +1683,7 @@ void TLSWrap::CertCbDone(const FunctionCallbackInfo<Value>& args) {
   cb = w->cert_cb_;
   arg = w->cert_cb_arg_;
 
-  w->cert_cb_running_ = false;
+  w->flags_.cert_cb_running = false;
   w->cert_cb_ = nullptr;
   w->cert_cb_arg_ = nullptr;
 
@@ -2072,7 +2070,7 @@ void TLSWrap::ExportKeyingMaterial(const FunctionCallbackInfo<Value>& args) {
 void TLSWrap::ClientHelloDone(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
-  w->hello_answered_ = true;
+  w->flags_.hello_answered = true;
   w->Cycle();
 }
 
@@ -2107,7 +2105,7 @@ void TLSWrap::GetTLSTicket(const FunctionCallbackInfo<Value>& args) {
 void TLSWrap::NewSessionDone(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
-  w->awaiting_new_session_ = false;
+  w->flags_.awaiting_new_session = false;
   w->NewSessionDoneCb();
 }
 
@@ -2188,7 +2186,7 @@ void TLSWrap::WritesIssuedByPrevListenerDone(
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
 
   Debug(w, "WritesIssuedByPrevListenerDone is called");
-  w->has_active_write_issued_by_prev_listener_ = false;
+  w->flags_.has_active_write_issued_by_prev_listener = false;
   w->EncOut();  // resume all of our restrained writes
 }
 
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index a5ded3392915..9a5f59ed472e 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -62,22 +62,26 @@ class TLSWrap : public AsyncWrap,
 
   ~TLSWrap() override;
 
-  inline bool is_cert_cb_running() const { return cert_cb_running_; }
+  inline bool is_cert_cb_running() const { return flags_.cert_cb_running; }
   inline bool is_waiting_cert_cb() const { return cert_cb_ != nullptr; }
-  inline bool has_session_callbacks() const { return session_callbacks_; }
+  inline bool has_session_callbacks() const { return flags_.session_callbacks; }
   // We need to suspend the ClientHello only for server session id
   // callbacks, and only on the first pass.
   inline bool should_suspend_for_client_hello() const {
-    return is_server() && session_callbacks_ && !hello_answered_;
+    return is_server() && flags_.session_callbacks && !flags_.hello_answered;
+  }
+  inline void set_cert_cb_running(bool on = true) {
+    flags_.cert_cb_running = on;
   }
-  inline void set_cert_cb_running(bool on = true) { cert_cb_running_ = on; }
   inline void set_awaiting_new_session(bool on = true) {
-    awaiting_new_session_ = on;
+    flags_.awaiting_new_session = on;
   }
-  inline void enable_session_callbacks() { session_callbacks_ = true; }
+  inline void enable_session_callbacks() { flags_.session_callbacks = true; }
   inline bool is_server() const { return kind_ == Kind::kServer; }
   inline bool is_client() const { return kind_ == Kind::kClient; }
-  inline bool is_awaiting_new_session() const { return awaiting_new_session_; }
+  inline bool is_awaiting_new_session() const {
+    return flags_.awaiting_new_session;
+  }
 
   // Implement StreamBase:
   bool IsAlive() override;
@@ -125,6 +129,14 @@ class TLSWrap : public AsyncWrap,
 
   std::string diagnostic_name() const override;
 
+  bool get_alpn_callback_enabled() const {
+    return flags_.alpn_callback_enabled;
+  }
+
+  const std::vector<unsigned char>& get_alpn_protos() const {
+    return alpn_protos_;
+  }
+
  private:
   // OpenSSL structures are opaque. Estimate SSL memory size for OpenSSL 1.1.1b:
   //   SSL: 6224
@@ -284,26 +296,30 @@ class TLSWrap : public AsyncWrap,
   BaseObjectPtr<AsyncWrap> current_empty_write_;
   std::string error_;
 
-  bool session_callbacks_ = false;
-  bool awaiting_new_session_ = false;
-  // 'onclienthello' has been emitted for this connection.
-  bool hello_emitted_ = false;
-  // JS has answered it by calling clientHelloDone().
-  bool hello_answered_ = false;
-  bool in_dowrite_ = false;
-  bool started_ = false;
-  bool shutdown_ = false;
-  bool cert_cb_running_ = false;
-  bool eof_ = false;
-
   // TODO(@jasnell): These state flags should be revisited.
   // The established_ flag indicates that the handshake is
   // completed. The write_callback_scheduled_ flag is less
   // clear -- once it is set to true, it is never set to
   // false and it is only set to true after established_
   // is set to true, so it's likely redundant.
-  bool established_ = false;
-  bool write_callback_scheduled_ = false;
+  struct Flags {
+    bool session_callbacks : 1;
+    bool awaiting_new_session : 1;
+    // 'onclienthello' has been emitted for this connection.
+    bool hello_emitted : 1;
+    // JS has answered it by calling clientHelloDone().
+    bool hello_answered : 1;
+    bool in_dowrite : 1;
+    bool started : 1;
+    bool shutdown : 1;
+    bool cert_cb_running : 1;
+    bool eof : 1;
+    bool established : 1;
+    bool write_callback_scheduled : 1;
+    bool has_active_write_issued_by_prev_listener : 1;
+    bool alpn_callback_enabled : 1;
+  };
+  Flags flags_{};
 
   int cycle_depth_ = 0;
 
@@ -313,11 +329,7 @@ class TLSWrap : public AsyncWrap,
 
   ncrypto::BIOPointer bio_trace_;
 
-  bool has_active_write_issued_by_prev_listener_ = false;
-
- public:
   std::vector<unsigned char> alpn_protos_;  // Accessed by SelectALPNCallback.
-  bool alpn_callback_enabled_ = false;      // Accessed by SelectALPNCallback.
 };
 
 }  // namespace crypto

From 753033c110f259c0532720139f0508bbee291dc5 Mon Sep 17 00:00:00 2001
From: James M Snell <jsnell@cloudflare.com>
Date: Tue, 4 Aug 2026 08:39:49 -0700
Subject: [PATCH 125/344] lib,src: improve histogram implementation

Several improvements:

1. In histogram-inl, Add previous locked only this->mutex while
   reading the other's fields unsafely.
2. In histogram.cc, PrepareCB now uses ContainerOf
3. In histogram.cc, BigInt value range is checked
4. In histogram.js, simplified impl and reduced duplication
5. In event_loop_delay.js, use a more consistent constructor

Adds new analytical APIs to Histogram

* histogram.ccdf(value)
* histogram.cdf(value)
* histogram.countAt(value)
* histogram.ksTest(other)
* histogram.kurtosis
* histogram.linearBuckets(stepSize)
* histogram.logBuckets(first, base)
* histogram.percentilesAt(percentiles)
* histogram.shewness

On RecordableHistogram

* histogram.recordCorrected(val, expectedInterval)
* histogram.subtract(other)

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus
PR-URL: https://github.com/nodejs/node/pull/65024
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 doc/api/perf_hooks.md                         | 240 +++++++++
 lib/internal/histogram.js                     | 212 +++++++-
 lib/internal/perf/event_loop_delay.js         |  23 +-
 src/histogram-inl.h                           | 108 +++-
 src/histogram.cc                              | 469 +++++++++++++---
 src/histogram.h                               | 133 +++--
 .../test-perf-hooks-histogram-analysis.js     | 501 ++++++++++++++++++
 7 files changed, 1530 insertions(+), 156 deletions(-)
 create mode 100644 test/parallel/test-perf-hooks-histogram-analysis.js

diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 78a3b6210326..544c25e9fdc9 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1866,6 +1866,45 @@ added:
 
 The number of samples recorded by the histogram.
 
+### `histogram.ccdf(value)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `value` {number} The value to query.
+* Returns: {number} A probability between 0.0 and 1.0.
+
+Returns the complementary cumulative distribution function (CCDF) value
+for the given value, representing the probability that a recorded value
+will exceed `value`. Equivalent to `1 - histogram.cdf(value)`.
+
+### `histogram.cdf(value)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `value` {number} The value to query.
+* Returns: {number} A probability between 0.0 and 1.0.
+
+Returns the cumulative distribution function (CDF) value for the given
+value, representing the probability that a recorded value will be less
+than or equal to `value`. This is the inverse operation of
+`histogram.percentile()`.
+
+### `histogram.countAt(value)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `value` {number} The value to query.
+* Returns: {number}
+
+Returns the number of recorded values that fall within the equivalent
+value range of the given value.
+
 ### `histogram.exceeds`
 
 <!-- YAML
@@ -1890,6 +1929,59 @@ added:
 The number of times the event loop delay exceeded the maximum 1 hour event
 loop delay threshold.
 
+### `histogram.ksTest(other)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `other` {Histogram} The histogram to compare against.
+* Returns: {number} The KS D-statistic, between 0.0 and 1.0.
+
+Computes the Kolmogorov-Smirnov test statistic comparing this histogram's
+distribution to `other`. A value of 0 indicates identical distributions;
+values close to 1 indicate completely disjoint distributions. Useful for
+detecting performance regressions by comparing before/after histograms.
+
+### `histogram.kurtosis`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The excess kurtosis of the recorded values. Measures the heaviness of the
+distribution's tails relative to a normal distribution. Positive values
+indicate heavier tails (more extreme outliers); negative values indicate
+lighter tails.
+
+### `histogram.linearBuckets(stepSize)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `stepSize` {number} The width of each linear bucket.
+* Returns: {Map} A map of bucket boundary values to counts.
+
+Returns the histogram data rebucketed into linearly-spaced intervals
+of `stepSize`. Useful for visualization and export.
+
+### `histogram.logBuckets(firstBucket, base)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `firstBucket` {number} The value of the first bucket boundary.
+* `base` {number} The logarithmic base for bucket width growth. Must be > 1.
+* Returns: {Map} A map of bucket boundary values to counts.
+
+Returns the histogram data rebucketed into logarithmically-spaced
+intervals, where each bucket's width is multiplied by `base`.
+Useful for visualization and export.
+
 ### `histogram.max`
 
 <!-- YAML
@@ -1990,6 +2082,20 @@ added:
 
 Returns a `Map` object detailing the accumulated percentile distribution.
 
+### `histogram.percentilesAt(percentiles)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `percentiles` {number\[]} An array of percentile values in the range (0, 100].
+* Returns: {Map} A map of percentile values to their corresponding histogram
+  values.
+
+Returns the values at the specified percentiles, computed in a single
+efficient pass over the histogram data. More efficient than calling
+`histogram.percentile()` multiple times.
+
 ### `histogram.reset()`
 
 <!-- YAML
@@ -1998,6 +2104,19 @@ added: v11.10.0
 
 Resets the collected histogram data.
 
+### `histogram.skewness`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The skewness of the recorded values. Measures the asymmetry of the
+distribution. A positive value indicates a right-skewed distribution
+(longer right tail, common for latency data); a negative value
+indicates a left-skewed distribution.
+
 ### `histogram.stddev`
 
 <!-- YAML
@@ -2099,6 +2218,127 @@ added:
 Calculates the amount of time (in nanoseconds) that has passed since the
 previous call to `recordDelta()` and records that amount in the histogram.
 
+### `histogram.recordCorrected(val, expectedInterval)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `val` {number|bigint} The value to record.
+* `expectedInterval` {number|bigint} The expected recording interval.
+
+Records a value with coordinated omission correction. When a system stall
+prevents timely recording, this method backfills intermediate values at
+`expectedInterval` steps between the previously recorded value and `val`.
+This compensates for measurement gaps that would otherwise underrepresent
+latency.
+
+### `histogram.subtract(other)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `other` {RecordableHistogram}
+
+Subtracts the values of `other` from this histogram. Both histograms should
+have compatible configurations. Bucket counts that would become negative
+are clamped to zero.
+
+## Histogram analysis examples
+
+The `Histogram` class provides statistical analysis methods useful for
+performance monitoring, SLO enforcement, and regression detection.
+
+### Distribution shape analysis
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+
+// Simulate a right-skewed latency distribution
+for (let i = 0; i < 1000; i++) {
+  h.record(Math.ceil(Math.random() * 100));
+}
+// Add some outliers
+for (let i = 0; i < 10; i++) {
+  h.record(500 + Math.ceil(Math.random() * 500));
+}
+
+console.log('Skewness:', h.skewness.toFixed(4));  // Positive = right-skewed
+console.log('Kurtosis:', h.kurtosis.toFixed(4));  // Positive = heavy tails
+```
+
+### SLO monitoring with CDF
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const latency = createHistogram();
+
+// Record request latencies (in nanoseconds)...
+
+// "What fraction of requests complete within 100ms?"
+const withinSLO = latency.cdf(100_000_000);
+console.log(`${(withinSLO * 100).toFixed(1)}% of requests within SLO`);
+
+// "What fraction of requests exceed 500ms?"
+const violating = latency.ccdf(500_000_000);
+console.log(`${(violating * 100).toFixed(1)}% of requests violating SLO`);
+```
+
+### Regression detection with KS test
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const baseline = createHistogram();
+const current = createHistogram();
+
+// Record baseline and current latencies...
+
+// D-statistic: 0 = identical, 1 = completely different
+const d = baseline.ksTest(current);
+if (d > 0.1) {
+  console.log(`Possible regression detected (D=${d.toFixed(4)})`);
+}
+```
+
+### Batch percentile queries
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+// Record values...
+
+// Efficiently query common monitoring percentiles in one pass
+const p = h.percentilesAt([50, 75, 90, 95, 99, 99.9]);
+console.log('p50:', p.get(50));
+console.log('p99:', p.get(99));
+```
+
+### Snapshot diffing with subtract
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const total = createHistogram();
+const snapshot = createHistogram();
+
+// Record values into total...
+// Periodically snapshot for "last interval" analysis:
+snapshot.add(total);
+
+// Later, take a new snapshot and diff:
+const newSnapshot = createHistogram();
+newSnapshot.add(total);
+newSnapshot.subtract(snapshot);
+// newSnapshot now contains only the values recorded since the last snapshot
+console.log('Recent p99:', newSnapshot.percentile(99));
+```
+
 ## Examples
 
 ### Measuring the duration of async operations
diff --git a/lib/internal/histogram.js b/lib/internal/histogram.js
index f2cf3835b9a6..c16c894dd147 100644
--- a/lib/internal/histogram.js
+++ b/lib/internal/histogram.js
@@ -1,13 +1,13 @@
 'use strict';
 
 const {
+  ArrayIsArray,
+  Float64Array,
   Map,
-  MapPrototypeClear,
   MapPrototypeEntries,
   NumberIsNaN,
   NumberMAX_SAFE_INTEGER,
   ObjectFromEntries,
-  ReflectConstruct,
   Symbol,
 } = primordials;
 
@@ -40,7 +40,6 @@ const {
 
 const kDestroy = Symbol('kDestroy');
 const kHandle = Symbol('kHandle');
-const kMap = Symbol('kMap');
 const kRecordable = Symbol('kRecordable');
 
 const {
@@ -77,6 +76,8 @@ class Histogram {
       mean: this.mean,
       exceeds: this.exceeds,
       stddev: this.stddev,
+      skewness: this.skewness,
+      kurtosis: this.kurtosis,
       count: this.count,
       percentiles: this.percentiles,
     }, opts)}`;
@@ -102,6 +103,46 @@ class Histogram {
     return this[kHandle]?.countBigInt();
   }
 
+  /**
+   * Returns the probability that a recorded value will exceed `value`
+   * (the complement of the cumulative distribution function).
+   * @param {number} value
+   * @returns {number} A value between 0.0 and 1.0.
+   */
+  ccdf(value) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateNumber(value, 'value');
+    return 1 - this[kHandle]?.cdf(value);
+  }
+
+  /**
+   * Returns the cumulative distribution function (CDF) value for the
+   * given value, representing the probability that a recorded value
+   * will be less than or equal to `value`.
+   * @param {number} value
+   * @returns {number} A value between 0.0 and 1.0.
+   */
+  cdf(value) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateNumber(value, 'value');
+    return this[kHandle]?.cdf(value);
+  }
+
+  /**
+   * Returns the number of recorded values that fall within the
+   * equivalent value range of the given value.
+   * @param {number} value
+   * @returns {number}
+   */
+  countAt(value) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateNumber(value, 'value');
+    return this[kHandle]?.countAt(value);
+  }
+
   /**
    * @readonly
    * @type {number}
@@ -172,6 +213,81 @@ class Histogram {
     return this[kHandle]?.exceedsBigInt();
   }
 
+  /**
+   * Returns the Kolmogorov-Smirnov test statistic comparing this
+   * histogram's distribution to another's. Returns a value between
+   * 0.0 (identical distributions) and 1.0 (completely disjoint).
+   * @param {Histogram} other
+   * @returns {number}
+   */
+  ksTest(other) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    if (!isHistogram(other))
+      throw new ERR_INVALID_ARG_TYPE('other', 'Histogram', other);
+    return this[kHandle]?.ksTest(other[kHandle]);
+  }
+
+  /**
+   * Returns the excess kurtosis of the recorded values, a measure of
+   * the heaviness of the distribution's tails. A positive value indicates
+   * heavier tails (more outliers) than a normal distribution.
+   * @readonly
+   * @type {number}
+   */
+  get kurtosis() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.kurtosis();
+  }
+
+  /**
+   * Returns a {Map} containing the histogram data bucketed into
+   * linearly-spaced intervals of `stepSize`.
+   * @param {number} stepSize The width of each linear bucket.
+   * @returns {Map<number,number>}
+   */
+  linearBuckets(stepSize) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateInteger(stepSize, 'stepSize', 1);
+    const map = new Map();
+    this[kHandle]?.linearBuckets(stepSize, map);
+    return map;
+  }
+
+  /**
+   * Returns a {Map} containing the histogram data bucketed into
+   * logarithmically-spaced intervals.
+   * @param {number} firstBucket The value of the first bucket boundary.
+   * @param {number} base The logarithmic base for bucket width growth.
+   * @returns {Map<number,number>}
+   */
+  logBuckets(firstBucket, base) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateInteger(firstBucket, 'firstBucket', 1);
+    validateNumber(base, 'base');
+    if (base <= 1)
+      throw new ERR_OUT_OF_RANGE('base', '> 1', base);
+    const map = new Map();
+    this[kHandle]?.logBuckets(firstBucket, base, map);
+    return map;
+  }
+
+  /**
+   * Returns the skewness of the recorded values, a measure of the
+   * asymmetry of the distribution. A positive value indicates a
+   * right-skewed distribution (longer right tail).
+   * @readonly
+   * @type {number}
+   */
+  get skewness() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.skewness();
+  }
+
   /**
    * @readonly
    * @type {number}
@@ -217,9 +333,9 @@ class Histogram {
   get percentiles() {
     if (!isHistogram(this))
       throw new ERR_INVALID_THIS('Histogram');
-    MapPrototypeClear(this[kMap]);
-    this[kHandle]?.percentiles(this[kMap]);
-    return this[kMap];
+    const map = new Map();
+    this[kHandle]?.percentiles(map);
+    return map;
   }
 
   /**
@@ -229,9 +345,34 @@ class Histogram {
   get percentilesBigInt() {
     if (!isHistogram(this))
       throw new ERR_INVALID_THIS('Histogram');
-    MapPrototypeClear(this[kMap]);
-    this[kHandle]?.percentilesBigInt(this[kMap]);
-    return this[kMap];
+    const map = new Map();
+    this[kHandle]?.percentilesBigInt(map);
+    return map;
+  }
+
+  /**
+   * Returns a {Map} of values at the specified percentiles, computed
+   * in a single efficient pass over the histogram.
+   * @param {number[]} percentiles Array of percentile values (0, 100].
+   * @returns {Map<number,number>}
+   */
+  percentilesAt(percentiles) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    if (!ArrayIsArray(percentiles))
+      throw new ERR_INVALID_ARG_TYPE('percentiles', 'Array', percentiles);
+    for (let i = 0; i < percentiles.length; i++) {
+      validateNumber(percentiles[i], `percentiles[${i}]`);
+      if (NumberIsNaN(percentiles[i]) ||
+          percentiles[i] <= 0 || percentiles[i] > 100)
+        throw new ERR_OUT_OF_RANGE(
+          `percentiles[${i}]`, '> 0 && <= 100', percentiles[i]);
+    }
+    const sorted = [...percentiles].sort((a, b) => a - b);
+    const input = new Float64Array(sorted);
+    const map = new Map();
+    this[kHandle]?.percentilesAt(map, input);
+    return map;
   }
 
   /**
@@ -263,6 +404,8 @@ class Histogram {
       mean: this.mean,
       exceeds: this.exceeds,
       stddev: this.stddev,
+      skewness: this.skewness,
+      kurtosis: this.kurtosis,
       percentiles: ObjectFromEntries(MapPrototypeEntries(this.percentiles)),
     };
   }
@@ -303,6 +446,44 @@ class RecordableHistogram extends Histogram {
     this[kHandle]?.recordDelta();
   }
 
+  /**
+   * Records a value with coordinated omission correction, backfilling
+   * intermediate values at `expectedInterval` steps between the last
+   * recorded value and `val`. This compensates for measurement gaps
+   * caused by the system being stalled.
+   * @param {number|bigint} val The amount to record.
+   * @param {number|bigint} expectedInterval The expected recording interval.
+   * @returns {void}
+   */
+  recordCorrected(val, expectedInterval) {
+    if (this[kRecordable] === undefined)
+      throw new ERR_INVALID_THIS('RecordableHistogram');
+    if (typeof val === 'bigint') {
+      if (typeof expectedInterval !== 'bigint')
+        throw new ERR_INVALID_ARG_TYPE(
+          'expectedInterval', 'bigint', expectedInterval);
+      this[kHandle]?.recordCorrected(val, expectedInterval);
+      return;
+    }
+    validateInteger(val, 'val', 1);
+    validateInteger(expectedInterval, 'expectedInterval', 1);
+    this[kHandle]?.recordCorrected(val, expectedInterval);
+  }
+
+  /**
+   * Subtracts the values of `other` from this histogram. Both
+   * histograms must have compatible configurations. Counts that would
+   * become negative are clamped to zero.
+   * @param {RecordableHistogram} other
+   */
+  subtract(other) {
+    if (this[kRecordable] === undefined)
+      throw new ERR_INVALID_THIS('RecordableHistogram');
+    if (other[kRecordable] === undefined)
+      throw new ERR_INVALID_ARG_TYPE('other', 'RecordableHistogram', other);
+    this[kHandle]?.subtract(other[kHandle]);
+  }
+
   /**
    * @param {RecordableHistogram} other
    */
@@ -328,12 +509,10 @@ class RecordableHistogram extends Histogram {
 }
 
 function ClonedHistogram(handle) {
-  return ReflectConstruct(
-    function() {
-      markTransferMode(this, true, false);
-      this[kHandle] = handle;
-      this[kMap] = new Map();
-    }, [], Histogram);
+  const histogram = new Histogram(kSkipThrow);
+  markTransferMode(histogram, true, false);
+  histogram[kHandle] = handle;
+  return histogram;
 }
 
 ClonedHistogram.prototype[kDeserialize] = () => { };
@@ -343,7 +522,6 @@ function ClonedRecordableHistogram(handle) {
 
   markTransferMode(histogram, true, false);
   histogram[kRecordable] = true;
-  histogram[kMap] = new Map();
   histogram[kHandle] = handle;
   histogram.constructor = RecordableHistogram;
 
@@ -391,6 +569,6 @@ module.exports = {
   isHistogram,
   kDestroy,
   kHandle,
-  kMap,
+  kSkipThrow,
   createHistogram,
 };
diff --git a/lib/internal/perf/event_loop_delay.js b/lib/internal/perf/event_loop_delay.js
index ebf0017b70df..4d14182c83fa 100644
--- a/lib/internal/perf/event_loop_delay.js
+++ b/lib/internal/perf/event_loop_delay.js
@@ -1,7 +1,5 @@
 'use strict';
 const {
-  ReflectConstruct,
-  SafeMap,
   Symbol,
   SymbolDispose,
 } = primordials;
@@ -26,7 +24,7 @@ const {
 const {
   Histogram,
   kHandle,
-  kMap,
+  kSkipThrow,
 } = require('internal/histogram');
 
 const {
@@ -40,8 +38,11 @@ const {
 const kEnabled = Symbol('kEnabled');
 
 class ELDHistogram extends Histogram {
-  constructor() {
-    throw new ERR_ILLEGAL_CONSTRUCTOR();
+  constructor(skipThrowSymbol = undefined) {
+    if (skipThrowSymbol !== kSkipThrow) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    super(skipThrowSymbol);
   }
 
   /**
@@ -87,13 +88,11 @@ function monitorEventLoopDelay(options = kEmptyObject) {
   validateBoolean(samplePerIteration, 'options.samplePerIteration');
   validateInteger(resolution, 'options.resolution', 1);
 
-  return ReflectConstruct(
-    function() {
-      markTransferMode(this, true, false);
-      this[kEnabled] = false;
-      this[kHandle] = createELDHistogram(resolution, samplePerIteration);
-      this[kMap] = new SafeMap();
-    }, [], ELDHistogram);
+  const histogram = new ELDHistogram(kSkipThrow);
+  markTransferMode(histogram, true, false);
+  histogram[kEnabled] = false;
+  histogram[kHandle] = createELDHistogram(resolution, samplePerIteration);
+  return histogram;
 }
 
 module.exports = monitorEventLoopDelay;
diff --git a/src/histogram-inl.h b/src/histogram-inl.h
index 3b8712c87879..7c3545f53aad 100644
--- a/src/histogram-inl.h
+++ b/src/histogram-inl.h
@@ -10,57 +10,80 @@
 namespace node {
 
 void Histogram::Reset() {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedWriteLock lock(mutex_);
   hdr_reset(histogram_.get());
   exceeds_ = 0;
-  count_ = 0;
   prev_ = 0;
 }
 
 double Histogram::Add(const Histogram& other) {
-  Mutex::ScopedLock lock(mutex_);
-  count_ += other.count_;
-  exceeds_ += other.exceeds_;
-  if (other.prev_ > prev_)
-    prev_ = other.prev_;
-  return static_cast<double>(hdr_add(histogram_.get(), other.histogram_.get()));
+  auto do_add = [&]() {
+    exceeds_ += other.exceeds_;
+    if (other.prev_ > prev_) prev_ = other.prev_;
+    // hdr_add merges all bucket counts and total_count internally.
+    return static_cast<double>(
+        hdr_add(histogram_.get(), other.histogram_.get()));
+  };
+
+  // When adding a histogram to itself, a single write lock suffices.
+  if (this == &other) {
+    RwLock::ScopedWriteLock lock(mutex_);
+    return do_add();
+  }
+
+  // Write-lock this (modified), read-lock other (only read).
+  // Lock in pointer order to prevent deadlock.
+  if (this < &other) {
+    RwLock::ScopedWriteLock lock1(mutex_);
+    RwLock::ScopedReadLock lock2(other.mutex_);
+    return do_add();
+  }
+
+  RwLock::ScopedReadLock lock1(other.mutex_);
+  RwLock::ScopedWriteLock lock2(mutex_);
+  return do_add();
 }
 
 size_t Histogram::Count() const {
-  Mutex::ScopedLock lock(mutex_);
-  return count_;
+  RwLock::ScopedReadLock lock(mutex_);
+  return static_cast<size_t>(histogram_->total_count);
+}
+
+size_t Histogram::Exceeds() const {
+  RwLock::ScopedReadLock lock(mutex_);
+  return exceeds_;
 }
 
 int64_t Histogram::Min() const {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
   return hdr_min(histogram_.get());
 }
 
 int64_t Histogram::Max() const {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
   return hdr_max(histogram_.get());
 }
 
 double Histogram::Mean() const {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
   return hdr_mean(histogram_.get());
 }
 
 double Histogram::Stddev() const {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
   return hdr_stddev(histogram_.get());
 }
 
 int64_t Histogram::Percentile(double percentile) const {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
   CHECK_GT(percentile, 0);
   CHECK_LE(percentile, 100);
   return hdr_value_at_percentile(histogram_.get(), percentile);
 }
 
 template <typename Iterator>
-void Histogram::Percentiles(Iterator&& fn) {
-  Mutex::ScopedLock lock(mutex_);
+void Histogram::Percentiles(Iterator&& fn) const {
+  RwLock::ScopedReadLock lock(mutex_);
   hdr_iter iter;
   hdr_iter_percentile_init(&iter, histogram_.get(), 1);
   while (hdr_iter_next(&iter)) {
@@ -69,37 +92,66 @@ void Histogram::Percentiles(Iterator&& fn) {
   }
 }
 
+int64_t Histogram::CountAt(int64_t value) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  return hdr_count_at_value(histogram_.get(), value);
+}
+
+bool Histogram::RecordCorrected(int64_t value, int64_t expected_interval) {
+  RwLock::ScopedWriteLock lock(mutex_);
+  bool recorded =
+      hdr_record_corrected_value(histogram_.get(), value, expected_interval);
+  if (!recorded) exceeds_++;
+  return recorded;
+}
+
 bool Histogram::Record(int64_t value) {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedWriteLock lock(mutex_);
   bool recorded = hdr_record_value(histogram_.get(), value);
-  if (!recorded)
-    exceeds_++;
-  else
-    count_++;
+  if (!recorded) exceeds_++;
   return recorded;
 }
 
 uint64_t Histogram::RecordDelta() {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedWriteLock lock(mutex_);
   uint64_t time = uv_hrtime();
   int64_t delta = 0;
   if (prev_ > 0) {
     CHECK_GE(time, prev_);
     delta = time - prev_;
-    if (hdr_record_value(histogram_.get(), delta))
-      count_++;
-    else
-      exceeds_++;
+    if (!hdr_record_value(histogram_.get(), delta)) exceeds_++;
   }
   prev_ = time;
   return delta;
 }
 
 size_t Histogram::GetMemorySize() const {
-  Mutex::ScopedLock lock(mutex_);
+  RwLock::ScopedReadLock lock(mutex_);
   return hdr_get_memory_size(histogram_.get());
 }
 
+template <typename Iterator>
+void Histogram::LinearBuckets(int64_t step_size, Iterator&& fn) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  hdr_iter iter;
+  hdr_iter_linear_init(&iter, histogram_.get(), step_size);
+  while (hdr_iter_next(&iter)) {
+    fn(iter.value, iter.specifics.linear.count_added_in_this_iteration_step);
+  }
+}
+
+template <typename Iterator>
+void Histogram::LogBuckets(int64_t first_bucket,
+                           double log_base,
+                           Iterator&& fn) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  hdr_iter iter;
+  hdr_iter_log_init(&iter, histogram_.get(), first_bucket, log_base);
+  while (hdr_iter_next(&iter)) {
+    fn(iter.value, iter.specifics.log.count_added_in_this_iteration_step);
+  }
+}
+
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/histogram.cc b/src/histogram.cc
index 5dd82c305bf7..3aa451685e86 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -7,6 +7,8 @@
 #include "node_external_reference.h"
 #include "util.h"
 
+#include <vector>
+
 namespace node {
 
 using v8::BigInt;
@@ -52,6 +54,169 @@ void Histogram::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackFieldWithSize("histogram", GetMemorySize());
 }
 
+bool Histogram::IsCompatible(const Histogram& other) const {
+  return histogram_->counts_len == other.histogram_->counts_len &&
+         histogram_->lowest_discernible_value ==
+             other.histogram_->lowest_discernible_value &&
+         histogram_->highest_trackable_value ==
+             other.histogram_->highest_trackable_value &&
+         histogram_->significant_figures ==
+             other.histogram_->significant_figures;
+}
+
+double Histogram::Cdf(int64_t value) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t total = histogram_->total_count;
+  if (total == 0) return 0.0;
+
+  hdr_iter iter;
+  hdr_iter_init(&iter, histogram_.get());
+  while (hdr_iter_next(&iter)) {
+    if (iter.highest_equivalent_value >= value) {
+      return static_cast<double>(iter.cumulative_count) /
+             static_cast<double>(total);
+    }
+    // All recorded data accounted for; remaining buckets are empty.
+    if (iter.cumulative_count >= total) break;
+  }
+  return 1.0;
+}
+
+double Histogram::Skewness() const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t total = histogram_->total_count;
+  if (total < 3) return 0.0;
+
+  // Compute mean in one pass, then variance and skewness in a second
+  // pass.  This avoids calling hdr_stddev (which internally recomputes
+  // hdr_mean), reducing the total from 4 iterations to 2.
+  double mean = hdr_mean(histogram_.get());
+
+  double m2 = 0.0;
+  double m3 = 0.0;
+  hdr_iter iter;
+  hdr_iter_recorded_init(&iter, histogram_.get());
+  while (hdr_iter_next(&iter)) {
+    double dev = static_cast<double>(hdr_median_equivalent_value(
+                     histogram_.get(), iter.value)) -
+                 mean;
+    double d2 = dev * dev;
+    m2 += static_cast<double>(iter.count) * d2;
+    m3 += static_cast<double>(iter.count) * d2 * dev;
+  }
+
+  double n = static_cast<double>(total);
+  double variance = m2 / n;
+  if (variance == 0.0) return 0.0;
+  double s3 = variance * std::sqrt(variance);  // stddev^3
+  return (m3 / n) / s3;
+}
+
+double Histogram::Kurtosis() const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t total = histogram_->total_count;
+  if (total < 4) return 0.0;
+
+  // Same single-pass approach as Skewness: compute mean first, then
+  // variance and excess kurtosis together in one iteration.
+  double mean = hdr_mean(histogram_.get());
+
+  double m2 = 0.0;
+  double m4 = 0.0;
+  hdr_iter iter;
+  hdr_iter_recorded_init(&iter, histogram_.get());
+  while (hdr_iter_next(&iter)) {
+    double dev = static_cast<double>(hdr_median_equivalent_value(
+                     histogram_.get(), iter.value)) -
+                 mean;
+    double d2 = dev * dev;
+    m2 += static_cast<double>(iter.count) * d2;
+    m4 += static_cast<double>(iter.count) * d2 * d2;
+  }
+
+  double n = static_cast<double>(total);
+  double variance = m2 / n;
+  if (variance == 0.0) return 0.0;
+  double s4 = variance * variance;  // stddev^4
+  return (m4 / n) / s4 - 3.0;
+}
+
+double Histogram::Subtract(const Histogram& other) {
+  auto do_subtract = [&]() -> double {
+    int64_t dropped = 0;
+    int32_t len =
+        std::min(histogram_->counts_len, other.histogram_->counts_len);
+    for (int32_t i = 0; i < len; i++) {
+      int64_t count = histogram_->counts[i] - other.histogram_->counts[i];
+      if (count < 0) {
+        dropped += -count;
+        count = 0;
+      }
+      histogram_->counts[i] = count;
+    }
+    hdr_reset_internal_counters(histogram_.get());
+    exceeds_ = (exceeds_ > other.exceeds_) ? exceeds_ - other.exceeds_ : 0;
+    return static_cast<double>(dropped);
+  };
+
+  if (this == &other) {
+    RwLock::ScopedWriteLock lock(mutex_);
+    return do_subtract();
+  }
+
+  if (this < &other) {
+    RwLock::ScopedWriteLock lock1(mutex_);
+    RwLock::ScopedReadLock lock2(other.mutex_);
+    return do_subtract();
+  }
+
+  RwLock::ScopedReadLock lock1(other.mutex_);
+  RwLock::ScopedWriteLock lock2(mutex_);
+  return do_subtract();
+}
+
+double Histogram::KsTest(const Histogram& other) const {
+  auto do_ks = [&]() -> double {
+    int64_t n1 = histogram_->total_count;
+    int64_t n2 = other.histogram_->total_count;
+    if (n1 == 0 || n2 == 0) return 0.0;
+
+    double max_d = 0.0;
+    int64_t cum1 = 0, cum2 = 0;
+    int32_t len =
+        std::max(histogram_->counts_len, other.histogram_->counts_len);
+
+    for (int32_t i = 0; i < len; i++) {
+      if (i < histogram_->counts_len) cum1 += histogram_->counts[i];
+      if (i < other.histogram_->counts_len) cum2 += other.histogram_->counts[i];
+      double cdf1 = static_cast<double>(cum1) / static_cast<double>(n1);
+      double cdf2 = static_cast<double>(cum2) / static_cast<double>(n2);
+      double d = cdf1 > cdf2 ? cdf1 - cdf2 : cdf2 - cdf1;
+      if (d > max_d) max_d = d;
+    }
+    return max_d;
+  };
+
+  if (this == &other) return 0.0;
+
+  if (this < &other) {
+    RwLock::ScopedReadLock lock1(mutex_);
+    RwLock::ScopedReadLock lock2(other.mutex_);
+    return do_ks();
+  }
+
+  RwLock::ScopedReadLock lock1(other.mutex_);
+  RwLock::ScopedReadLock lock2(mutex_);
+  return do_ks();
+}
+
+void Histogram::PercentilesAt(const double* percentiles,
+                              int64_t* values,
+                              size_t length) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  hdr_value_at_percentiles(histogram_.get(), percentiles, values, length);
+}
+
 HistogramImpl::HistogramImpl(const Histogram::Options& options)
     : histogram_(new Histogram(options)) {}
 
@@ -74,6 +239,14 @@ CFunction HistogramImpl::fast_get_stddev_(
     CFunction::Make(&HistogramImpl::FastGetStddev));
 CFunction HistogramImpl::fast_get_percentile_(
     CFunction::Make(&HistogramImpl::FastGetPercentile));
+CFunction HistogramImpl::fast_get_skewness_(
+    CFunction::Make(&HistogramImpl::FastGetSkewness));
+CFunction HistogramImpl::fast_get_kurtosis_(
+    CFunction::Make(&HistogramImpl::FastGetKurtosis));
+CFunction HistogramImpl::fast_get_cdf_(
+    CFunction::Make(&HistogramImpl::FastGetCdf));
+CFunction HistogramImpl::fast_get_count_at_(
+    CFunction::Make(&HistogramImpl::FastGetCountAt));
 CFunction HistogramBase::fast_record_(
     CFunction::Make(&HistogramBase::FastRecord));
 CFunction HistogramBase::fast_record_delta_(
@@ -112,6 +285,17 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
       isolate, instance, "stddev", GetStddev, &fast_get_stddev_);
   SetFastMethodNoSideEffect(
       isolate, instance, "percentile", GetPercentile, &fast_get_percentile_);
+  SetFastMethodNoSideEffect(
+      isolate, instance, "skewness", GetSkewness, &fast_get_skewness_);
+  SetFastMethodNoSideEffect(
+      isolate, instance, "kurtosis", GetKurtosis, &fast_get_kurtosis_);
+  SetFastMethodNoSideEffect(isolate, instance, "cdf", GetCdf, &fast_get_cdf_);
+  SetFastMethodNoSideEffect(
+      isolate, instance, "countAt", GetCountAt, &fast_get_count_at_);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "ksTest", GetKsTest);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "percentilesAt", GetPercentilesAt);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "linearBuckets", GetLinearBuckets);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "logBuckets", GetLogBuckets);
   SetFastMethod(isolate, instance, "reset", DoReset, &fast_reset_);
 }
 
@@ -142,6 +326,18 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(fast_get_exceeds_);
   registry->Register(fast_get_stddev_);
   registry->Register(fast_get_percentile_);
+  registry->Register(GetSkewness);
+  registry->Register(GetKurtosis);
+  registry->Register(GetCdf);
+  registry->Register(GetCountAt);
+  registry->Register(GetKsTest);
+  registry->Register(GetPercentilesAt);
+  registry->Register(GetLinearBuckets);
+  registry->Register(GetLogBuckets);
+  registry->Register(fast_get_skewness_);
+  registry->Register(fast_get_kurtosis_);
+  registry->Register(fast_get_cdf_);
+  registry->Register(fast_get_count_at_);
   is_registered = true;
 }
 
@@ -223,6 +419,39 @@ void HistogramBase::Add(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(count);
 }
 
+void HistogramBase::Subtract(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramBase* histogram;
+  ASSIGN_OR_RETURN_UNWRAP(&histogram, args.This());
+
+  CHECK(GetConstructorTemplate(env->isolate_data())->HasInstance(args[0]));
+  HistogramBase* other;
+  ASSIGN_OR_RETURN_UNWRAP(&other, args[0]);
+
+  double dropped = (*histogram)->Subtract(*(other->histogram()));
+  args.GetReturnValue().Set(dropped);
+}
+
+void HistogramBase::RecordCorrected(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_IMPLIES(!args[0]->IsNumber(), args[0]->IsBigInt());
+  CHECK_IMPLIES(!args[1]->IsNumber(), args[1]->IsBigInt());
+  bool lossless = true;
+  int64_t value = args[0]->IsBigInt()
+                      ? args[0].As<BigInt>()->Int64Value(&lossless)
+                      : static_cast<int64_t>(args[0].As<Number>()->Value());
+  if (!lossless || value < 1)
+    return THROW_ERR_OUT_OF_RANGE(env, "value is out of range");
+  int64_t expected_interval =
+      args[1]->IsBigInt() ? args[1].As<BigInt>()->Int64Value(&lossless)
+                          : static_cast<int64_t>(args[1].As<Number>()->Value());
+  if (!lossless || expected_interval < 1)
+    return THROW_ERR_OUT_OF_RANGE(env, "expected_interval is out of range");
+  HistogramBase* histogram;
+  ASSIGN_OR_RETURN_UNWRAP(&histogram, args.This());
+  (*histogram)->RecordCorrected(value, expected_interval);
+}
+
 BaseObjectPtr<HistogramBase> HistogramBase::Create(
     Environment* env,
     const Histogram::Options& options) {
@@ -261,18 +490,22 @@ void HistogramBase::New(const FunctionCallbackInfo<Value>& args) {
   int64_t lowest = 1;
   int64_t highest = std::numeric_limits<int64_t>::max();
 
-  bool lossless_ignored;
+  bool lossless = true;
 
   if (args[0]->IsNumber()) {
     lowest = args[0].As<Integer>()->Value();
   } else if (args[0]->IsBigInt()) {
-    lowest = args[0].As<BigInt>()->Int64Value(&lossless_ignored);
+    lowest = args[0].As<BigInt>()->Int64Value(&lossless);
+    if (!lossless)
+      return THROW_ERR_OUT_OF_RANGE(env, "options.lowest is out of range");
   }
 
   if (args[1]->IsNumber()) {
     highest = args[1].As<Integer>()->Value();
   } else if (args[1]->IsBigInt()) {
-    highest = args[1].As<BigInt>()->Int64Value(&lossless_ignored);
+    highest = args[1].As<BigInt>()->Int64Value(&lossless);
+    if (!lossless)
+      return THROW_ERR_OUT_OF_RANGE(env, "options.highest is out of range");
   }
 
   int32_t figures = args[2].As<Uint32>()->Value();
@@ -295,6 +528,8 @@ Local<FunctionTemplate> HistogramBase::GetConstructorTemplate(
     SetFastMethod(
         isolate, instance, "recordDelta", RecordDelta, &fast_record_delta_);
     SetProtoMethod(isolate, tmpl, "add", Add);
+    SetProtoMethod(isolate, tmpl, "subtract", Subtract);
+    SetProtoMethod(isolate, tmpl, "recordCorrected", RecordCorrected);
     HistogramImpl::AddMethods(isolate, tmpl);
     isolate_data->set_histogram_ctor_template(tmpl);
   }
@@ -305,8 +540,10 @@ void HistogramBase::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(New);
   registry->Register(Add);
+  registry->Register(Subtract);
   registry->Register(Record);
   registry->Register(RecordDelta);
+  registry->Register(RecordCorrected);
   registry->Register(fast_record_);
   registry->Register(fast_record_delta_);
   HistogramImpl::RegisterExternalReferences(registry);
@@ -345,11 +582,7 @@ Local<FunctionTemplate> IntervalHistogram::GetConstructorTemplate(
     tmpl = NewFunctionTemplate(isolate, nullptr);
     tmpl->Inherit(HandleWrap::GetConstructorTemplate(env));
     tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "Histogram"));
-    auto instance = tmpl->InstanceTemplate();
-    instance->SetInternalFieldCount(IntervalHistogram::kInternalFieldCount);
-    HistogramImpl::AddMethods(isolate, tmpl);
-    SetFastMethod(isolate, instance, "start", Start, &fast_start_);
-    SetFastMethod(isolate, instance, "stop", Stop, &fast_stop_);
+    InitTemplate(isolate, tmpl, IntervalHistogram::kInternalFieldCount);
     env->set_intervalhistogram_constructor_template(tmpl);
   }
   return tmpl;
@@ -364,21 +597,16 @@ void IntervalHistogram::RegisterExternalReferences(
   HistogramImpl::RegisterExternalReferences(registry);
 }
 
-IntervalHistogram::IntervalHistogram(
-    Environment* env,
-    Local<Object> wrap,
-    AsyncWrap::ProviderType type,
-    int32_t interval,
-    std::function<void(Histogram&)> on_interval,
-    const Histogram::Options& options)
-    : HandleWrap(
-          env,
-          wrap,
-          reinterpret_cast<uv_handle_t*>(&timer_),
-          type),
+IntervalHistogram::IntervalHistogram(Environment* env,
+                                     Local<Object> wrap,
+                                     AsyncWrap::ProviderType type,
+                                     int32_t interval,
+                                     OnInterval on_interval,
+                                     const Histogram::Options& options)
+    : HandleWrap(env, wrap, reinterpret_cast<uv_handle_t*>(&timer_), type),
       HistogramImpl(options),
       interval_(interval),
-      on_interval_(std::move(on_interval)) {
+      on_interval_(on_interval) {
   MakeWeak();
   wrap->SetAlignedPointerInInternalField(
       HistogramImpl::InternalFields::kImplField,
@@ -390,8 +618,9 @@ IntervalHistogram::IntervalHistogram(
 BaseObjectPtr<IntervalHistogram> IntervalHistogram::Create(
     Environment* env,
     int32_t interval,
-    std::function<void(Histogram&)> on_interval,
-    const Histogram::Options& options) {
+    OnInterval on_interval,
+    const Histogram::Options& options,
+    AsyncWrap::ProviderType type) {
   Local<Object> obj;
   if (!GetConstructorTemplate(env)
           ->InstanceTemplate()
@@ -400,12 +629,7 @@ BaseObjectPtr<IntervalHistogram> IntervalHistogram::Create(
   }
 
   return MakeBaseObject<IntervalHistogram>(
-      env,
-      obj,
-      AsyncWrap::PROVIDER_ELDHISTOGRAM,
-      interval,
-      std::move(on_interval),
-      options);
+      env, obj, type, interval, on_interval, options);
 }
 
 void IntervalHistogram::TimerCB(uv_timer_t* handle) {
@@ -436,19 +660,11 @@ void IntervalHistogram::OnStop() {
   uv_timer_stop(&timer_);
 }
 
-void IntervalHistogram::Start(const FunctionCallbackInfo<Value>& args) {
-  StartHandleHistogram<IntervalHistogram>(args.This(), args[0]->IsTrue());
-}
-
 void IntervalHistogram::FastStart(Local<Value> receiver, bool reset) {
   TRACK_V8_FAST_API_CALL("histogram.start");
   StartHandleHistogram<IntervalHistogram>(receiver, reset);
 }
 
-void IntervalHistogram::Stop(const FunctionCallbackInfo<Value>& args) {
-  StopHandleHistogram<IntervalHistogram>(args.This());
-}
-
 void IntervalHistogram::FastStop(Local<Value> receiver) {
   TRACK_V8_FAST_API_CALL("histogram.stop");
   StopHandleHistogram<IntervalHistogram>(receiver);
@@ -462,11 +678,7 @@ Local<FunctionTemplate> IterationHistogram::GetConstructorTemplate(
     tmpl = NewFunctionTemplate(isolate, nullptr);
     tmpl->Inherit(HandleWrap::GetConstructorTemplate(env));
     tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "Histogram"));
-    auto instance = tmpl->InstanceTemplate();
-    instance->SetInternalFieldCount(IterationHistogram::kInternalFieldCount);
-    HistogramImpl::AddMethods(isolate, tmpl);
-    SetFastMethod(isolate, instance, "start", Start, &fast_start_);
-    SetFastMethod(isolate, instance, "stop", Stop, &fast_stop_);
+    InitTemplate(isolate, tmpl, IterationHistogram::kInternalFieldCount);
     env->set_iterationhistogram_constructor_template(tmpl);
   }
   return tmpl;
@@ -497,11 +709,12 @@ IterationHistogram::IterationHistogram(Environment* env,
   uv_prepare_init(env->event_loop(), &prepare_handle_);
   uv_unref(reinterpret_cast<uv_handle_t*>(&check_handle_));
   uv_unref(reinterpret_cast<uv_handle_t*>(&prepare_handle_));
-  prepare_handle_.data = this;
 }
 
 BaseObjectPtr<IterationHistogram> IterationHistogram::Create(
-    Environment* env, const Histogram::Options& options) {
+    Environment* env,
+    const Histogram::Options& options,
+    AsyncWrap::ProviderType type) {
   Local<Object> obj;
   if (!GetConstructorTemplate(env)
            ->InstanceTemplate()
@@ -510,12 +723,12 @@ BaseObjectPtr<IterationHistogram> IterationHistogram::Create(
     return nullptr;
   }
 
-  return MakeBaseObject<IterationHistogram>(
-      env, obj, AsyncWrap::PROVIDER_ELDHISTOGRAM, options);
+  return MakeBaseObject<IterationHistogram>(env, obj, type, options);
 }
 
 void IterationHistogram::PrepareCB(uv_prepare_t* handle) {
-  IterationHistogram* self = static_cast<IterationHistogram*>(handle->data);
+  IterationHistogram* self =
+      ContainerOf(&IterationHistogram::prepare_handle_, handle);
   if (!self->enabled_) return;
   self->prepare_time_ = uv_hrtime();
   self->timeout_ = uv_backend_timeout(handle->loop);
@@ -572,19 +785,11 @@ void IterationHistogram::Close(Local<Value> close_callback) {
   uv_close(reinterpret_cast<uv_handle_t*>(&prepare_handle_), nullptr);
 }
 
-void IterationHistogram::Start(const FunctionCallbackInfo<Value>& args) {
-  StartHandleHistogram<IterationHistogram>(args.This(), args[0]->IsTrue());
-}
-
 void IterationHistogram::FastStart(Local<Value> receiver, bool reset) {
   TRACK_V8_FAST_API_CALL("histogram.eventLoopDelay.start");
   StartHandleHistogram<IterationHistogram>(receiver, reset);
 }
 
-void IterationHistogram::Stop(const FunctionCallbackInfo<Value>& args) {
-  StopHandleHistogram<IterationHistogram>(args.This());
-}
-
 void IterationHistogram::FastStop(Local<Value> receiver) {
   TRACK_V8_FAST_API_CALL("histogram.eventLoopDelay.stop");
   StopHandleHistogram<IterationHistogram>(receiver);
@@ -670,12 +875,19 @@ void HistogramImpl::GetPercentiles(const FunctionCallbackInfo<Value>& args) {
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
   CHECK(args[0]->IsMap());
   Local<Map> map = args[0].As<Map>();
-  (*histogram)->Percentiles([map, env](double key, int64_t value) {
-    USE(map->Set(
-          env->context(),
-          Number::New(env->isolate(), key),
-          Number::New(env->isolate(), static_cast<double>(value))));
+
+  // Collect percentile data under the histogram lock, then populate the
+  // V8 Map after releasing it to avoid V8 allocations under the lock.
+  std::vector<std::pair<double, int64_t>> entries;
+  (*histogram)->Percentiles([&entries](double key, int64_t value) {
+    entries.emplace_back(key, value);
   });
+  for (const auto& entry : entries) {
+    USE(map->Set(
+        env->context(),
+        Number::New(env->isolate(), entry.first),
+        Number::New(env->isolate(), static_cast<double>(entry.second))));
+  }
 }
 
 void HistogramImpl::GetPercentilesBigInt(
@@ -684,12 +896,16 @@ void HistogramImpl::GetPercentilesBigInt(
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
   CHECK(args[0]->IsMap());
   Local<Map> map = args[0].As<Map>();
-  (*histogram)->Percentiles([map, env](double key, int64_t value) {
-    USE(map->Set(
-          env->context(),
-          Number::New(env->isolate(), key),
-          BigInt::New(env->isolate(), value)));
+
+  std::vector<std::pair<double, int64_t>> entries;
+  (*histogram)->Percentiles([&entries](double key, int64_t value) {
+    entries.emplace_back(key, value);
   });
+  for (const auto& entry : entries) {
+    USE(map->Set(env->context(),
+                 Number::New(env->isolate(), entry.first),
+                 BigInt::New(env->isolate(), entry.second)));
+  }
 }
 
 void HistogramImpl::DoReset(const FunctionCallbackInfo<Value>& args) {
@@ -746,6 +962,129 @@ double HistogramImpl::FastGetPercentile(Local<Value> receiver,
   return static_cast<double>((*histogram)->Percentile(percentile));
 }
 
+void HistogramImpl::GetSkewness(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  args.GetReturnValue().Set((*histogram)->Skewness());
+}
+
+double HistogramImpl::FastGetSkewness(Local<Value> receiver) {
+  TRACK_V8_FAST_API_CALL("histogram.skewness");
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(receiver);
+  return (*histogram)->Skewness();
+}
+
+void HistogramImpl::GetKurtosis(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  args.GetReturnValue().Set((*histogram)->Kurtosis());
+}
+
+double HistogramImpl::FastGetKurtosis(Local<Value> receiver) {
+  TRACK_V8_FAST_API_CALL("histogram.kurtosis");
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(receiver);
+  return (*histogram)->Kurtosis();
+}
+
+void HistogramImpl::GetCdf(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  int64_t value = static_cast<int64_t>(args[0].As<Number>()->Value());
+  args.GetReturnValue().Set((*histogram)->Cdf(value));
+}
+
+double HistogramImpl::FastGetCdf(Local<Value> receiver, const int64_t value) {
+  TRACK_V8_FAST_API_CALL("histogram.cdf");
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(receiver);
+  return (*histogram)->Cdf(value);
+}
+
+void HistogramImpl::GetCountAt(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  int64_t value = static_cast<int64_t>(args[0].As<Number>()->Value());
+  double count = static_cast<double>((*histogram)->CountAt(value));
+  args.GetReturnValue().Set(count);
+}
+
+double HistogramImpl::FastGetCountAt(Local<Value> receiver,
+                                     const int64_t value) {
+  TRACK_V8_FAST_API_CALL("histogram.countAt");
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(receiver);
+  return static_cast<double>((*histogram)->CountAt(value));
+}
+
+void HistogramImpl::GetKsTest(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  HistogramImpl* other = HistogramImpl::FromJSObject(args[0]);
+  args.GetReturnValue().Set((*histogram)->KsTest(*(other->histogram())));
+}
+
+void HistogramImpl::GetPercentilesAt(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsMap());
+  Local<Map> map = args[0].As<Map>();
+  CHECK(args[1]->IsFloat64Array());
+  Local<v8::Float64Array> input = args[1].As<v8::Float64Array>();
+  size_t length = input->Length();
+  auto backing = input->Buffer()->GetBackingStore();
+  double* percentiles = reinterpret_cast<double*>(
+      static_cast<char*>(backing->Data()) + input->ByteOffset());
+
+  std::vector<int64_t> values(length);
+  (*histogram)->PercentilesAt(percentiles, values.data(), length);
+
+  for (size_t i = 0; i < length; i++) {
+    USE(map->Set(env->context(),
+                 Number::New(env->isolate(), percentiles[i]),
+                 Number::New(env->isolate(), static_cast<double>(values[i]))));
+  }
+}
+
+void HistogramImpl::GetLinearBuckets(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  CHECK(args[1]->IsMap());
+  int64_t step_size = static_cast<int64_t>(args[0].As<Number>()->Value());
+  Local<Map> map = args[1].As<Map>();
+
+  std::vector<std::pair<int64_t, int64_t>> entries;
+  (*histogram)
+      ->LinearBuckets(step_size, [&entries](int64_t value, int64_t count) {
+        entries.emplace_back(value, count);
+      });
+  for (const auto& entry : entries) {
+    USE(map->Set(
+        env->context(),
+        Number::New(env->isolate(), static_cast<double>(entry.first)),
+        Number::New(env->isolate(), static_cast<double>(entry.second))));
+  }
+}
+
+void HistogramImpl::GetLogBuckets(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  CHECK(args[1]->IsNumber());
+  CHECK(args[2]->IsMap());
+  int64_t first_bucket = static_cast<int64_t>(args[0].As<Number>()->Value());
+  double log_base = args[1].As<Number>()->Value();
+  Local<Map> map = args[2].As<Map>();
+
+  std::vector<std::pair<int64_t, int64_t>> entries;
+  (*histogram)
+      ->LogBuckets(
+          first_bucket, log_base, [&entries](int64_t value, int64_t count) {
+            entries.emplace_back(value, count);
+          });
+  for (const auto& entry : entries) {
+    USE(map->Set(
+        env->context(),
+        Number::New(env->isolate(), static_cast<double>(entry.first)),
+        Number::New(env->isolate(), static_cast<double>(entry.second))));
+  }
+}
+
 HistogramImpl* HistogramImpl::FromJSObject(Local<Value> value) {
   auto obj = value.As<Object>();
   DCHECK_GE(obj->InternalFieldCount(), HistogramImpl::kInternalFieldCount);
diff --git a/src/histogram.h b/src/histogram.h
index b9f968e8347c..5fbffa2a4879 100644
--- a/src/histogram.h
+++ b/src/histogram.h
@@ -11,10 +11,7 @@
 #include "uv.h"
 #include "v8.h"
 
-#include <functional>
 #include <limits>
-#include <map>
-#include <string>
 
 namespace node {
 
@@ -45,7 +42,7 @@ class Histogram : public MemoryRetainer {
   inline double Mean() const;
   inline double Stddev() const;
   inline int64_t Percentile(double percentile) const;
-  inline size_t Exceeds() const { return exceeds_; }
+  inline size_t Exceeds() const;
   inline size_t Count() const;
 
   inline uint64_t RecordDelta();
@@ -55,10 +52,31 @@ class Histogram : public MemoryRetainer {
   // Iterator is a function type that takes two doubles as argument, one for
   // percentile and one for the value at that percentile.
   template <typename Iterator>
-  inline void Percentiles(Iterator&& fn);
+  inline void Percentiles(Iterator&& fn) const;
 
   inline size_t GetMemorySize() const;
 
+  // Analysis methods
+  inline int64_t CountAt(int64_t value) const;
+  double Cdf(int64_t value) const;
+  double Skewness() const;
+  double Kurtosis() const;
+  double KsTest(const Histogram& other) const;
+  double Subtract(const Histogram& other);
+  void PercentilesAt(const double* percentiles,
+                     int64_t* values,
+                     size_t length) const;
+
+  inline bool RecordCorrected(int64_t value, int64_t expected_interval);
+
+  template <typename Iterator>
+  void LinearBuckets(int64_t step_size, Iterator&& fn) const;
+
+  template <typename Iterator>
+  void LogBuckets(int64_t first_bucket, double log_base, Iterator&& fn) const;
+
+  bool IsCompatible(const Histogram& other) const;
+
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(Histogram)
   SET_SELF_SIZE(Histogram)
@@ -68,8 +86,7 @@ class Histogram : public MemoryRetainer {
   HistogramPointer histogram_;
   uint64_t prev_ = 0;
   size_t exceeds_ = 0;
-  size_t count_ = 0;
-  Mutex mutex_;
+  RwLock mutex_;
 };
 
 class HistogramImpl {
@@ -106,6 +123,15 @@ class HistogramImpl {
   static void GetPercentilesBigInt(
       const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  static void GetSkewness(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetKurtosis(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCdf(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCountAt(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetKsTest(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetPercentilesAt(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetLinearBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetLogBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+
   static void FastReset(v8::Local<v8::Value> receiver);
   static double FastGetCount(v8::Local<v8::Value> receiver);
   static double FastGetMin(v8::Local<v8::Value> receiver);
@@ -115,6 +141,11 @@ class HistogramImpl {
   static double FastGetStddev(v8::Local<v8::Value> receiver);
   static double FastGetPercentile(v8::Local<v8::Value> receiver,
                                   const double percentile);
+  static double FastGetSkewness(v8::Local<v8::Value> receiver);
+  static double FastGetKurtosis(v8::Local<v8::Value> receiver);
+  static double FastGetCdf(v8::Local<v8::Value> receiver, const int64_t value);
+  static double FastGetCountAt(v8::Local<v8::Value> receiver,
+                               const int64_t value);
 
   static void AddMethods(v8::Isolate* isolate,
                          v8::Local<v8::FunctionTemplate> tmpl);
@@ -134,6 +165,10 @@ class HistogramImpl {
   static v8::CFunction fast_get_exceeds_;
   static v8::CFunction fast_get_stddev_;
   static v8::CFunction fast_get_percentile_;
+  static v8::CFunction fast_get_skewness_;
+  static v8::CFunction fast_get_kurtosis_;
+  static v8::CFunction fast_get_cdf_;
+  static v8::CFunction fast_get_count_at_;
 };
 
 class HistogramBase final : public BaseObject, public HistogramImpl {
@@ -165,7 +200,9 @@ class HistogramBase final : public BaseObject, public HistogramImpl {
 
   static void Record(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void RecordDelta(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void RecordCorrected(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Add(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Subtract(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void FastRecord(v8::Local<v8::Value> receiver, const int64_t value);
   static void FastRecordDelta(v8::Local<v8::Value> receiver);
@@ -211,17 +248,48 @@ class HistogramBase final : public BaseObject, public HistogramImpl {
   static v8::CFunction fast_record_delta_;
 };
 
-class IntervalHistogram final : public HandleWrap, public HistogramImpl {
+// CRTP mixin for HandleWrap-based histograms with start/stop support.
+// Provides: StartFlags enum, Start/Stop slow-path handlers, enabled_ flag,
+// and InitTemplate (shared GetConstructorTemplate body).
+// Derived must provide: fast_start_, fast_stop_ (static CFunction),
+//   FastStart, FastStop, OnStart, OnStop.
+template <typename Derived>
+class HandleHistogramMixin {
+ public:
+  enum class StartFlags { NONE, RESET };
+
+  static void Start(const v8::FunctionCallbackInfo<v8::Value>& args) {
+    StartHandleHistogram<Derived>(args.This(), args[0]->IsTrue());
+  }
+
+  static void Stop(const v8::FunctionCallbackInfo<v8::Value>& args) {
+    StopHandleHistogram<Derived>(args.This());
+  }
+
+ protected:
+  static void InitTemplate(v8::Isolate* isolate,
+                           v8::Local<v8::FunctionTemplate> tmpl,
+                           uint32_t internal_field_count) {
+    auto instance = tmpl->InstanceTemplate();
+    instance->SetInternalFieldCount(internal_field_count);
+    HistogramImpl::AddMethods(isolate, tmpl);
+    SetFastMethod(isolate, instance, "start", Start, &Derived::fast_start_);
+    SetFastMethod(isolate, instance, "stop", Stop, &Derived::fast_stop_);
+  }
+
+  bool enabled_ = false;
+};
+
+class IntervalHistogram final : public HandleWrap,
+                                public HistogramImpl,
+                                public HandleHistogramMixin<IntervalHistogram> {
  public:
   enum InternalFields {
     kInternalFieldCount = std::max<uint32_t>(
         HandleWrap::kInternalFieldCount, HistogramImpl::kInternalFieldCount),
   };
 
-  enum class StartFlags {
-    NONE,
-    RESET
-  };
+  using OnInterval = void (*)(Histogram&);
 
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
@@ -231,19 +299,16 @@ class IntervalHistogram final : public HandleWrap, public HistogramImpl {
   static BaseObjectPtr<IntervalHistogram> Create(
       Environment* env,
       int32_t interval,
-      std::function<void(Histogram&)> on_interval,
-      const Histogram::Options& options);
-
-  IntervalHistogram(
-      Environment* env,
-      v8::Local<v8::Object> wrap,
-      AsyncWrap::ProviderType type,
-      int32_t interval,
-      std::function<void(Histogram&)> on_interval,
-      const Histogram::Options& options = Histogram::Options {});
+      OnInterval on_interval,
+      const Histogram::Options& options,
+      AsyncWrap::ProviderType type = AsyncWrap::PROVIDER_ELDHISTOGRAM);
 
-  static void Start(const v8::FunctionCallbackInfo<v8::Value>& args);
-  static void Stop(const v8::FunctionCallbackInfo<v8::Value>& args);
+  IntervalHistogram(Environment* env,
+                    v8::Local<v8::Object> wrap,
+                    AsyncWrap::ProviderType type,
+                    int32_t interval,
+                    OnInterval on_interval,
+                    const Histogram::Options& options = Histogram::Options{});
 
   static void FastStart(v8::Local<v8::Value> receiver, bool reset);
   static void FastStop(v8::Local<v8::Value> receiver);
@@ -262,45 +327,45 @@ class IntervalHistogram final : public HandleWrap, public HistogramImpl {
   void OnStart(StartFlags flags = StartFlags::RESET);
   void OnStop();
 
+  friend class HandleHistogramMixin<IntervalHistogram>;
   template <typename T>
   friend void StartHandleHistogram(v8::Local<v8::Value>, bool);
   template <typename T>
   friend void StopHandleHistogram(v8::Local<v8::Value>);
 
-  bool enabled_ = false;
   int32_t interval_ = 0;
-  std::function<void(Histogram&)> on_interval_;
+  OnInterval on_interval_ = nullptr;
   uv_timer_t timer_;
 
   static v8::CFunction fast_start_;
   static v8::CFunction fast_stop_;
 };
 
-class IterationHistogram final : public HandleWrap, public HistogramImpl {
+class IterationHistogram final
+    : public HandleWrap,
+      public HistogramImpl,
+      public HandleHistogramMixin<IterationHistogram> {
  public:
   enum InternalFields {
     kInternalFieldCount = std::max<uint32_t>(
         HandleWrap::kInternalFieldCount, HistogramImpl::kInternalFieldCount),
   };
 
-  enum class StartFlags { NONE, RESET };
-
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
   static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
       Environment* env);
 
   static BaseObjectPtr<IterationHistogram> Create(
-      Environment* env, const Histogram::Options& options);
+      Environment* env,
+      const Histogram::Options& options,
+      AsyncWrap::ProviderType type = AsyncWrap::PROVIDER_ELDHISTOGRAM);
 
   IterationHistogram(Environment* env,
                      v8::Local<v8::Object> wrap,
                      AsyncWrap::ProviderType type,
                      const Histogram::Options& options = Histogram::Options{});
 
-  static void Start(const v8::FunctionCallbackInfo<v8::Value>& args);
-  static void Stop(const v8::FunctionCallbackInfo<v8::Value>& args);
-
   static void FastStart(v8::Local<v8::Value> receiver, bool reset);
   static void FastStop(v8::Local<v8::Value> receiver);
 
@@ -322,12 +387,12 @@ class IterationHistogram final : public HandleWrap, public HistogramImpl {
   void OnStart(StartFlags flags = StartFlags::RESET);
   void OnStop();
 
+  friend class HandleHistogramMixin<IterationHistogram>;
   template <typename T>
   friend void StartHandleHistogram(v8::Local<v8::Value>, bool);
   template <typename T>
   friend void StopHandleHistogram(v8::Local<v8::Value>);
 
-  bool enabled_ = false;
   uv_prepare_t prepare_handle_;
   uv_check_t check_handle_;
   uint64_t prepare_time_ = 0;
diff --git a/test/parallel/test-perf-hooks-histogram-analysis.js b/test/parallel/test-perf-hooks-histogram-analysis.js
new file mode 100644
index 000000000000..acc2b5a7eb2d
--- /dev/null
+++ b/test/parallel/test-perf-hooks-histogram-analysis.js
@@ -0,0 +1,501 @@
+// Flags: --expose-internals --no-warnings --allow-natives-syntax
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createHistogram } = require('perf_hooks');
+const { internalBinding } = require('internal/test/binding');
+const { inspect } = require('util');
+
+// ---------------------------------------------------------------------------
+// cdf(value) — cumulative distribution function
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+
+  // Empty histogram returns 0
+  assert.strictEqual(h.cdf(1), 0);
+
+  for (let i = 1; i <= 5; i++) h.record(i);
+
+  // Below min → 0
+  assert.strictEqual(h.cdf(0), 0);
+
+  // At or above some values → monotonically increasing
+  assert.ok(h.cdf(1) > 0);
+  assert.ok(h.cdf(3) >= h.cdf(1));
+  assert.ok(h.cdf(5) >= h.cdf(3));
+
+  // Well above max → 1.0
+  assert.strictEqual(h.cdf(1000000), 1.0);
+
+  // Validation
+  assert.throws(() => h.cdf('hello'), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.cdf(), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.cdf(undefined), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// ccdf(value) — complementary CDF = 1 - cdf
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+
+  // Empty: cdf=0 so ccdf=1
+  assert.strictEqual(h.ccdf(1), 1);
+
+  for (let i = 1; i <= 5; i++) h.record(i);
+
+  // CCDF + CDF === 1 for all values
+  for (const v of [0, 1, 3, 5, 1000000]) {
+    const sum = h.ccdf(v) + h.cdf(v);
+    assert.ok(Math.abs(sum - 1) < 1e-10, `ccdf(${v})+cdf(${v})=${sum}`);
+  }
+
+  // Well above max → 0
+  assert.strictEqual(h.ccdf(1000000), 0);
+
+  // Validation
+  assert.throws(() => h.ccdf('hello'), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// countAt(value) — count in equivalent bucket
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+
+  // Empty → 0
+  assert.strictEqual(h.countAt(1), 0);
+
+  h.record(1);
+  h.record(1);
+  h.record(1);
+  h.record(100);
+
+  assert.strictEqual(h.countAt(1), 3);
+  assert.strictEqual(h.countAt(100), 1);
+  assert.strictEqual(h.countAt(999999), 0);
+
+  // Validation
+  assert.throws(() => h.countAt('hello'), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.countAt(), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// skewness getter
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+
+  // Too few values returns 0
+  assert.strictEqual(h.skewness, 0);
+  h.record(1);
+  assert.strictEqual(h.skewness, 0);
+  h.record(2);
+  assert.strictEqual(h.skewness, 0);
+
+  // With 3+ values, returns a number
+  h.record(3);
+  assert.strictEqual(typeof h.skewness, 'number');
+  assert.ok(!Number.isNaN(h.skewness));
+
+  // Right-skewed distribution → positive skewness
+  const right = createHistogram();
+  for (let i = 0; i < 100; i++) right.record(1);
+  for (let i = 0; i < 10; i++) right.record(10000);
+  assert.ok(right.skewness > 0);
+
+  // Appears in inspect output
+  assert.ok(inspect(right, { depth: null }).includes('skewness'));
+
+  // Appears in toJSON
+  const json = right.toJSON();
+  assert.ok('skewness' in json);
+  assert.strictEqual(typeof json.skewness, 'number');
+
+  // Uniform distribution: zero stddev → returns 0
+  const uniform = createHistogram();
+  for (let i = 0; i < 10; i++) uniform.record(1);
+  assert.strictEqual(uniform.skewness, 0);
+}
+
+// ---------------------------------------------------------------------------
+// kurtosis getter
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+
+  // Too few values returns 0
+  assert.strictEqual(h.kurtosis, 0);
+  h.record(1);
+  h.record(2);
+  h.record(3);
+  assert.strictEqual(h.kurtosis, 0);
+
+  // With 4+ values, returns a number
+  h.record(4);
+  assert.strictEqual(typeof h.kurtosis, 'number');
+  assert.ok(!Number.isNaN(h.kurtosis));
+
+  // Appears in inspect and toJSON
+  const h2 = createHistogram();
+  for (let i = 1; i <= 100; i++) h2.record(i);
+  assert.ok(inspect(h2, { depth: null }).includes('kurtosis'));
+  const json = h2.toJSON();
+  assert.ok('kurtosis' in json);
+  assert.strictEqual(typeof json.kurtosis, 'number');
+
+  // Uniform distribution: zero stddev → returns 0
+  const uniform = createHistogram();
+  for (let i = 0; i < 10; i++) uniform.record(1);
+  assert.strictEqual(uniform.kurtosis, 0);
+}
+
+// ---------------------------------------------------------------------------
+// ksTest(other) — Kolmogorov-Smirnov D-statistic
+// ---------------------------------------------------------------------------
+{
+  const h1 = createHistogram();
+  const h2 = createHistogram();
+
+  // Both empty → 0
+  assert.strictEqual(h1.ksTest(h2), 0);
+
+  // Identical distributions → 0
+  for (let i = 1; i <= 100; i++) { h1.record(i); h2.record(i); }
+  assert.strictEqual(h1.ksTest(h2), 0);
+
+  // Same histogram against itself → 0
+  assert.strictEqual(h1.ksTest(h1), 0);
+
+  // Different distributions → D > 0
+  const h3 = createHistogram();
+  for (let i = 1000; i <= 2000; i++) h3.record(i);
+  const d = h1.ksTest(h3);
+  assert.ok(d > 0);
+  assert.ok(d <= 1);
+
+  // Symmetry: D(a,b) === D(b,a)
+  assert.strictEqual(h1.ksTest(h3), h3.ksTest(h1));
+
+  // Completely disjoint → D close to 1
+  const hLow = createHistogram();
+  const hHigh = createHistogram();
+  for (let i = 0; i < 100; i++) hLow.record(1);
+  for (let i = 0; i < 100; i++) hHigh.record(100000);
+  assert.ok(hLow.ksTest(hHigh) > 0.9);
+
+  // One empty → 0
+  const empty = createHistogram();
+  assert.strictEqual(h1.ksTest(empty), 0);
+
+  // Validation: non-histogram throws
+  assert.throws(() => h1.ksTest('not a histogram'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h1.ksTest(42),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h1.ksTest({}),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// percentilesAt(percentiles) — batch percentile query
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+  for (let i = 1; i <= 100; i++) h.record(i);
+
+  // Returns a Map
+  const result = h.percentilesAt([50, 90, 99]);
+  assert.ok(result instanceof Map);
+  assert.strictEqual(result.size, 3);
+
+  // Keys are the requested percentiles
+  assert.ok(result.has(50));
+  assert.ok(result.has(90));
+  assert.ok(result.has(99));
+
+  // Values match individual percentile() calls
+  assert.strictEqual(result.get(50), h.percentile(50));
+  assert.strictEqual(result.get(90), h.percentile(90));
+  assert.strictEqual(result.get(99), h.percentile(99));
+
+  // Single element
+  const single = h.percentilesAt([50]);
+  assert.strictEqual(single.size, 1);
+
+  // Unsorted input still works (internally sorted)
+  const unsorted = h.percentilesAt([99, 50, 90]);
+  assert.strictEqual(unsorted.get(50), h.percentile(50));
+
+  // Validation
+  assert.throws(() => h.percentilesAt('not array'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.percentilesAt([0]),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.percentilesAt([101]),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.percentilesAt([NaN]),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.percentilesAt([-1]),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.percentilesAt(['hello']),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// linearBuckets(stepSize) — linearly-spaced bucket iteration
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+  for (let i = 1; i <= 100; i++) h.record(i);
+
+  const buckets = h.linearBuckets(10);
+  assert.ok(buckets instanceof Map);
+  assert.ok(buckets.size > 0);
+
+  // All keys and values are numbers
+  for (const [key, value] of buckets) {
+    assert.strictEqual(typeof key, 'number');
+    assert.strictEqual(typeof value, 'number');
+    assert.ok(value >= 0);
+  }
+
+  // Total count across buckets equals histogram count
+  let total = 0;
+  for (const [, count] of buckets) total += count;
+  assert.strictEqual(total, h.count);
+
+  // Different step sizes produce different bucket counts
+  const finer = h.linearBuckets(5);
+  assert.ok(finer.size >= buckets.size);
+
+  // Validation
+  assert.throws(() => h.linearBuckets(0), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.linearBuckets(-1), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.linearBuckets('hello'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.linearBuckets(1.5), { code: 'ERR_OUT_OF_RANGE' });
+}
+
+// ---------------------------------------------------------------------------
+// logBuckets(firstBucket, base) — logarithmically-spaced bucket iteration
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+  for (let i = 1; i <= 1000; i++) h.record(i);
+
+  const buckets = h.logBuckets(1, 2);
+  assert.ok(buckets instanceof Map);
+  assert.ok(buckets.size > 0);
+
+  for (const [key, value] of buckets) {
+    assert.strictEqual(typeof key, 'number');
+    assert.strictEqual(typeof value, 'number');
+    assert.ok(value >= 0);
+  }
+
+  // Total count across buckets equals histogram count
+  let total = 0;
+  for (const [, count] of buckets) total += count;
+  assert.strictEqual(total, h.count);
+
+  // Validation
+  assert.throws(() => h.logBuckets(0, 2), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.logBuckets(-1, 2), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.logBuckets(1, 1), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.logBuckets(1, 0.5), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.logBuckets(1, -2), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.logBuckets('hello', 2),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.logBuckets(1, 'hello'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.logBuckets(1.5, 2), { code: 'ERR_OUT_OF_RANGE' });
+}
+
+// ---------------------------------------------------------------------------
+// subtract(other) — subtract histogram counts
+// ---------------------------------------------------------------------------
+{
+  const h1 = createHistogram();
+  const h2 = createHistogram();
+
+  for (let i = 1; i <= 10; i++) h1.record(i);
+  for (let i = 1; i <= 5; i++) h2.record(i);
+
+  const countBefore = h1.count;
+  h1.subtract(h2);
+
+  // Count should decrease
+  assert.ok(h1.count < countBefore);
+
+  // Subtracting from self zeros out
+  const h3 = createHistogram();
+  for (let i = 1; i <= 10; i++) h3.record(i);
+  h3.subtract(h3);
+  assert.strictEqual(h3.count, 0);
+
+  // Clamping: subtracting more than present doesn't go negative
+  const hSmall = createHistogram();
+  const hBig = createHistogram();
+  hSmall.record(1);
+  for (let i = 0; i < 100; i++) hBig.record(1);
+  hSmall.subtract(hBig);
+  assert.strictEqual(hSmall.count, 0);
+
+  // Validation
+  assert.throws(() => h1.subtract('not a histogram'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h1.subtract(42),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h1.subtract({}),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// recordCorrected(val, expectedInterval) — coordinated omission correction
+// ---------------------------------------------------------------------------
+{
+  // Basic recording with number args
+  const h = createHistogram();
+  h.recordCorrected(100, 10);
+  assert.ok(h.count > 0);
+
+  // Should record more values than a plain record (backfilling)
+  const hPlain = createHistogram();
+  hPlain.record(100);
+  assert.ok(h.count > hPlain.count);
+
+  // BigInt variant
+  const hBig = createHistogram();
+  hBig.recordCorrected(100n, 10n);
+  assert.ok(hBig.count > 0);
+
+  // Mixed types should throw (bigint val, number interval)
+  assert.throws(() => h.recordCorrected(100n, 10),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+
+  // Validation: non-integer
+  assert.throws(() => h.recordCorrected('hello', 10),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.recordCorrected(100, 'hello'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+
+  // Out of range
+  assert.throws(() => h.recordCorrected(0, 10),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.recordCorrected(100, 0),
+                { code: 'ERR_OUT_OF_RANGE' });
+}
+
+// ---------------------------------------------------------------------------
+// ERR_INVALID_THIS for all new methods on wrong receiver
+// ---------------------------------------------------------------------------
+{
+  const { Histogram } = require('internal/histogram');
+  const h = createHistogram();
+  const wrongThis = {};
+
+  // Methods
+  const methods = [
+    ['cdf', [1]],
+    ['ccdf', [1]],
+    ['countAt', [1]],
+    ['ksTest', [h]],
+    ['linearBuckets', [10]],
+    ['logBuckets', [1, 2]],
+    ['percentilesAt', [[50]]],
+  ];
+
+  for (const [method, args] of methods) {
+    assert.throws(
+      () => Histogram.prototype[method].call(wrongThis, ...args),
+      { code: 'ERR_INVALID_THIS' },
+      `${method} should throw ERR_INVALID_THIS`
+    );
+  }
+
+  // Getters
+  for (const getter of ['skewness', 'kurtosis']) {
+    const desc = Object.getOwnPropertyDescriptor(
+      Histogram.prototype, getter);
+    assert.throws(
+      () => desc.get.call(wrongThis),
+      { code: 'ERR_INVALID_THIS' },
+      `${getter} getter should throw ERR_INVALID_THIS`
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Empty histogram edge cases
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+
+  assert.strictEqual(h.cdf(1), 0);
+  assert.strictEqual(h.ccdf(1), 1);
+  assert.strictEqual(h.countAt(1), 0);
+  assert.strictEqual(h.skewness, 0);
+  assert.strictEqual(h.kurtosis, 0);
+
+  const empty2 = createHistogram();
+  assert.strictEqual(h.ksTest(empty2), 0);
+
+  const pctAt = h.percentilesAt([50, 99]);
+  assert.ok(pctAt instanceof Map);
+  assert.strictEqual(pctAt.size, 2);
+
+  const linear = h.linearBuckets(10);
+  assert.ok(linear instanceof Map);
+
+  const log = h.logBuckets(1, 2);
+  assert.ok(log instanceof Map);
+}
+
+// ---------------------------------------------------------------------------
+// Single-value histogram edge cases
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+  h.record(42);
+
+  assert.strictEqual(h.skewness, 0);  // Needs >= 3
+  assert.strictEqual(h.kurtosis, 0);  // Needs >= 4
+  assert.strictEqual(h.cdf(42), 1);
+  assert.strictEqual(h.cdf(1), 0);
+  assert.strictEqual(h.ccdf(42), 0);
+  assert.strictEqual(h.countAt(42), 1);
+}
+
+// ---------------------------------------------------------------------------
+// Fast API call tests for new methods
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+  h.record(1);
+  h.record(100);
+
+  // Prepare cdf and countAt methods for optimization
+  eval('%PrepareFunctionForOptimization(h.cdf)');
+  eval('%PrepareFunctionForOptimization(h.countAt)');
+
+  // Warmup call
+  h.cdf(50);
+  h.countAt(1);
+
+  // Optimize
+  eval('%OptimizeFunctionOnNextCall(h.cdf)');
+  eval('%OptimizeFunctionOnNextCall(h.countAt)');
+
+  // Fast-path call
+  h.cdf(50);
+  h.countAt(1);
+
+  if (common.isDebug) {
+    const { getV8FastApiCallCount } = internalBinding('debug');
+    assert.strictEqual(getV8FastApiCallCount('histogram.cdf'), 1);
+    assert.strictEqual(getV8FastApiCallCount('histogram.countAt'), 1);
+  }
+}

From be4e7de04c098acf786f99e6b43dc57914050db8 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 12 Aug 2026 17:55:10 +0200
Subject: [PATCH 126/344] tools: only include fast-tracked and old enough PRs
 in CQ

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65197
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .github/workflows/commit-queue.yml |  4 +-
 doc/contributing/commit-queue.md   | 77 ++++++++++++++++--------------
 2 files changed, 42 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index a4d61132deea..dff69b18564b 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -48,9 +48,7 @@ jobs:
           fast_track_prs=$(list_prs \
                   --label 'fast-track' \
                   --search "-label:blocked")
-          queued_prs=$(list_prs \
-                  --search "-label:blocked")
-          candidates=$(printf '%s %s %s\n' "$aged_prs" "$fast_track_prs" "$queued_prs" |
+          candidates=$(printf '%s %s\n' "$fast_track_prs" "$aged_prs" |
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
diff --git a/doc/contributing/commit-queue.md b/doc/contributing/commit-queue.md
index 08f01b32d4ee..6aa73f126390 100644
--- a/doc/contributing/commit-queue.md
+++ b/doc/contributing/commit-queue.md
@@ -20,32 +20,34 @@ From a high-level, the Commit Queue works as follows:
 
 1. Collaborators will add `commit-queue` label to pull requests they want the
    queue to land. The label can be added before the pull request has completed
-   its wait time, or before requested CI has finished. Required approvals must
-   already be in place. The commit queue does not request CI on its own.
+   its wait time. Required approvals must already be in place, and any required
+   CI must have completed successfully. The commit queue does not request CI on
+   its own.
 2. On each scheduled run, the queue builds a candidate list from open pull
-   requests with the `commit-queue` label and without the `blocked` label. The
-   workflow uses a five-minute cron, but GitHub Actions scheduled workflows are
-   not guaranteed to run exactly every five minutes. For each candidate, the
-   queue will:
+   requests with the `commit-queue` label and without the `blocked` label. A
+   candidate must also either have been created at least two days earlier or
+   have the `fast-track` label. Other labeled pull requests retain the label
+   until they become old enough or are fast-tracked. The workflow uses a
+   five-minute cron, but GitHub Actions scheduled workflows are not guaranteed
+   to run exactly every five minutes. For each candidate, the queue will:
    1. In the landing job, install and configure `@node-core/utils`, then run a
       metadata-only readiness check without checking out the repository
    2. If the metadata check exits with a deferrable readiness code, meaning
       the PR is only blocked on wait time, keep the `commit-queue` label and
       skip this PR until a later queue run
-   3. Check if the PR also has a `request-ci` label (if it has, skip this PR
-      since it's pending a CI run)
-   4. Check whether GitHub checks are still running (if they are, skip this PR)
-   5. Remove the `commit-queue` label and run `git node land`
-   6. If it fails:
-      1. Add the `commit-queue-failed` label to the PR
+   3. Run `git node land` for ready PRs and PRs with hard or mixed readiness
+      failures, keeping the `commit-queue` label in place during the attempt
+   4. If it fails:
+      1. Replace the `commit-queue` label with the `commit-queue-failed` label
       2. Leave a comment on the PR with the output from `git node land`
       3. Abort the `git node land` session. If the abort succeeds, continue to
          the next PR; otherwise, stop the queue in an unknown state
-   7. If it succeeds:
+   5. If it succeeds:
       1. Push or merge the changes into nodejs/node
       2. Leave a comment on the PR with `Landed in ...`
       3. Close the PR
-      4. Go to next PR in the queue
+      4. Remove the `commit-queue` label
+      5. Go to next PR in the queue
 
 To make the Commit Queue squash all the commits of a pull request into the
 first one, add the `commit-queue-squash` label.
@@ -94,11 +96,11 @@ reasons:
    without rebasing them first.
 
 The workflow starts with a small candidate job that uses GitHub CLI to fetch
-pull requests with the `commit-queue` label. It first fetches the same
-age-based and fast-track buckets the queue used before accepting early queue
-requests, then fetches the broader queue and de-duplicates the result. This
-keeps not-yet-ready PRs from crowding out PRs that the previous query would
-have selected if GitHub paginates or caps a query result.
+open pull requests with the `commit-queue` label and without the `blocked`
+label. It fetches two buckets: pull requests created at least two days earlier
+and pull requests with the `fast-track` label. The job de-duplicates the
+buckets before passing the candidates to the landing job. Pull requests in
+neither bucket remain labeled but are not processed during that run.
 
 If there are candidate PRs, the landing job installs and configures
 `@node-core/utils` once with a personal token and a Jenkins token from
@@ -123,9 +125,10 @@ states. Unknown filter failures fail the workflow before starting the landing
 script and leave PR labels unchanged so the queue can retry on a later
 scheduled run. PRs passed through with exit code `40`-`49` continue through
 `commit-queue.sh`. The workflow checks out the repository only when at least
-one PR remains after filtering. The script still applies its existing
-`request-ci` and pending-check deferrals before removing the queue label and
-reporting a hard failure.
+one PR remains after filtering. The script does not separately skip PRs with a
+`request-ci` label or pending GitHub checks. Instead, `git node land` performs
+the landing checks and the script reports any failure through the normal queue
+failure path.
 
 > The personal token needs permission for public repositories and to read
 > profiles. It is used by `@node-core/utils` and by the landing job for
@@ -139,18 +142,20 @@ reporting a hard failure.
 3. Every positional argument starting at this one will be a pull request ID of
    a pull request with commit-queue set.
 
-The script will iterate over the pull requests. GitHub CLI is used to check if
-the PR is waiting for CI to start (`request-ci` label) or still has pending
-GitHub checks. The PR is skipped if CI is pending. No other CI validation is
-done here since `git node land` will fail if the last CI failed.
-
-The script removes the `commit-queue` label, then runs `git node land`,
-forwarding stdout and stderr to a file. PRs that are only blocked on wait time
-should have already been filtered by the metadata check. If a hard readiness
-failure appears between the metadata filter and `git node land`, the landing
-job adds a `commit-queue-failed` label to the PR, leaves a comment with the
-output of `git node land`, and then aborts the landing session. If the abort
-fails, the queue stops instead of continuing in an unknown state.
+The script iterates over the pull requests. For each PR, it uses GitHub CLI to
+fetch the labels and select the multiple-commit policy, then runs
+`git node land`, forwarding stdout and stderr to a file. It does not perform a
+separate CI preflight; `git node land` performs the current readiness and CI
+validation.
+
+The script keeps the `commit-queue` label in place while `git node land` is
+running. PRs that are only blocked on wait time should have already been
+filtered by the metadata check. A hard or mixed readiness failure is passed
+through so `git node land` can produce the failure output. If the landing
+attempt fails for that or any other reason, the job replaces the
+`commit-queue` label with `commit-queue-failed`, leaves a comment with the
+output, and then aborts the landing session. If the abort fails, the queue
+stops instead of continuing in an unknown state.
 
 Fast-tracked PRs use the metadata check before checkout and the landing script.
 If the fast-track request has not yet received enough collaborator thumbs-up,
@@ -164,8 +169,8 @@ If no errors happen during `git node land`, the script either pushes the direct
 rebase landing to `main` or uses GitHub's squash merge API for single-commit and
 fixup landings. It then leaves a `Landed in ...` comment in the PR. GitHub
 closes PRs merged through the merge API automatically; for direct pushes, the
-script closes the PR. Iteration continues until all PRs have done the steps
-above.
+script closes the PR. The script then removes the `commit-queue` label.
+Iteration continues until all PRs have done the steps above.
 
 ## Reverting broken commits
 

From f77aa2f703a14ed7fba8a43137db63b4b7c9a21b Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 16:33:16 -0700
Subject: [PATCH 127/344] src: cache permission strings

Use env_property strings for permissions since those
are fixed. Avoid creating new string instances each
time.

Also use ToV8Value for a couple since we're in here.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/env-inl.h                | 16 ++++++++++++++++
 src/env.cc                   | 37 ++++++++++++++++++++++++++++++++++++
 src/env.h                    | 16 ++++++++++++++++
 src/permission/permission.cc | 32 ++++++++++---------------------
 src/permission/permission.h  |  3 ++-
 5 files changed, 81 insertions(+), 23 deletions(-)

diff --git a/src/env-inl.h b/src/env-inl.h
index 761a7bfc9955..bbeb47b72ce3 100644
--- a/src/env-inl.h
+++ b/src/env-inl.h
@@ -841,6 +841,14 @@ void Environment::set_process_exit_handler(
 #undef VY
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String>                                                 \
+  IsolateData::Name##_permission_string() const {                              \
+    return Name##_permission_string##_.Get(isolate_);                           \
+  }
+  PERMISSIONS(V)
+#undef V
+
 #define VM(PropertyName) V(PropertyName##_binding_template, v8::ObjectTemplate)
 #define V(PropertyName, TypeName)                                              \
   inline v8::Local<TypeName> IsolateData::PropertyName() const {               \
@@ -870,6 +878,14 @@ void Environment::set_process_exit_handler(
 #undef VY
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String>                                                 \
+  Environment::Name##_permission_string() const {                              \
+    return isolate_data()->Name##_permission_string();                          \
+  }
+  PERMISSIONS(V)
+#undef V
+
 #define V(PropertyName, TypeName)                                              \
   inline v8::Local<TypeName> Environment::PropertyName() const {               \
     return isolate_data()->PropertyName();                                     \
diff --git a/src/env.cc b/src/env.cc
index 87340112fbeb..7b275e09b720 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -360,6 +360,12 @@ IsolateDataSerializeInfo IsolateData::Serialize(SnapshotCreator* creator) {
 #undef VS
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  info.primitive_values.push_back(                                             \
+      creator->AddData(Name##_permission_string##_.Get(isolate)));
+  PERMISSIONS(V)
+#undef V
+
   info.primitive_values.reserve(info.primitive_values.size() +
                                 AsyncWrap::PROVIDERS_LENGTH);
   for (size_t i = 0; i < AsyncWrap::PROVIDERS_LENGTH; i++) {
@@ -419,6 +425,21 @@ void IsolateData::DeserializeProperties(const IsolateDataSerializeInfo* info) {
 #undef VS
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  do {                                                                         \
+    MaybeLocal<String> maybe_field =                                           \
+        isolate_->GetDataFromSnapshotOnce<String>(                             \
+            info->primitive_values[i++]);                                      \
+    Local<String> field;                                                       \
+    if (!maybe_field.ToLocal(&field)) {                                        \
+      fprintf(stderr,                                                          \
+              "Failed to deserialize " #Name "_permission_string\n");          \
+    }                                                                          \
+    Name##_permission_string##_.Set(isolate_, field);                           \
+  } while (0);
+  PERMISSIONS(V)
+#undef V
+
   for (size_t j = 0; j < AsyncWrap::PROVIDERS_LENGTH; j++) {
     MaybeLocal<String> maybe_field =
         isolate_->GetDataFromSnapshotOnce<String>(info->primitive_values[i++]);
@@ -520,6 +541,17 @@ void IsolateData::CreateProperties() {
   PER_ISOLATE_STRING_PROPERTIES(V)
 #undef V
 
+#define V(Name, label, _, __)                                                  \
+  Name##_permission_string##_.Set(                                             \
+      isolate_,                                                                \
+      String::NewFromOneByte(isolate_,                                         \
+                             reinterpret_cast<const uint8_t*>(#Name),          \
+                             NewStringType::kInternalized,                     \
+                             sizeof(#Name) - 1)                                \
+          .ToLocalChecked());
+  PERMISSIONS(V)
+#undef V
+
   // Create all the provider strings that will be passed to JS. Place them in
   // an array so the array index matches the PROVIDER id offset. This way the
   // strings can be retrieved quickly.
@@ -630,6 +662,11 @@ void IsolateData::MemoryInfo(MemoryTracker* tracker) const {
   PER_ISOLATE_STRING_PROPERTIES(V)
 #undef V
 
+#define V(Name, label, _, __)                                                  \
+  tracker->TrackField(#Name "_permission_string", Name##_permission_string());
+  PERMISSIONS(V)
+#undef V
+
   tracker->TrackField("async_wrap_providers", async_wrap_providers_);
 
   if (node_allocator_ != nullptr) {
diff --git a/src/env.h b/src/env.h
index c2caf9790238..c2bf9fdd497a 100644
--- a/src/env.h
+++ b/src/env.h
@@ -189,6 +189,11 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
 #undef VS
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String> Name##_permission_string() const;
+  PERMISSIONS(V)
+#undef V
+
 #define VM(PropertyName) V(PropertyName##_binding_template, v8::ObjectTemplate)
 #define V(PropertyName, TypeName)                                              \
   inline v8::Local<TypeName> PropertyName() const;                             \
@@ -234,6 +239,12 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
 #undef VS
 #undef VY
 #undef VP
+
+#define V(Name, label, _, __)                                                  \
+  v8::Eternal<v8::String> Name##_permission_string##_;
+  PERMISSIONS(V)
+#undef V
+
   // Keep a list of all Persistent strings used for AsyncWrap Provider types.
   std::array<v8::Eternal<v8::String>, AsyncWrap::PROVIDERS_LENGTH>
       async_wrap_providers_;
@@ -875,6 +886,11 @@ class Environment final : public MemoryRetainer {
 #undef VY
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String> Name##_permission_string() const;
+  PERMISSIONS(V)
+#undef V
+
 #define V(PropertyName, TypeName)                                             \
   inline v8::Local<TypeName> PropertyName() const;                            \
   inline void set_ ## PropertyName(v8::Local<TypeName> value);
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 919edd0821fd..9815073c987a 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -106,10 +106,11 @@ static void Has(const FunctionCallbackInfo<Value>& args) {
 }  // namespace
 
 #define V(Name, label, _, __)                                                  \
-  if (perm == PermissionScope::k##Name) return #Name;
-const char* Permission::PermissionToString(const PermissionScope perm) {
+  if (perm == PermissionScope::k##Name) return env->Name##_permission_string();
+v8::Local<v8::String> Permission::PermissionToString(
+    Environment* env, const PermissionScope perm) {
   PERMISSIONS(V)
-  return nullptr;
+  UNREACHABLE();
 }
 #undef V
 
@@ -192,12 +193,9 @@ MaybeLocal<Value> CreateAccessDeniedError(Environment* env,
   Local<Object> err = ERR_ACCESS_DENIED(
       env->isolate(), "Access to this API has been restricted. %s", suggestion);
 
-  Local<Value> perm_string;
   Local<Value> resource_string;
-  std::string_view perm_str = Permission::PermissionToString(perm);
-  if (!ToV8Value(env->context(), perm_str, env->isolate())
-           .ToLocal(&perm_string) ||
-      !ToV8Value(env->context(), res, env->isolate())
+  Local<Value> perm_string = Permission::PermissionToString(env, perm);
+  if (!ToV8Value(env->context(), res, env->isolate())
            .ToLocal(&resource_string) ||
       err->Set(env->context(), env->permission_string(), perm_string)
           .IsNothing() ||
@@ -263,18 +261,13 @@ bool Permission::is_scope_granted(Environment* env,
         v8::Local<v8::Context> context = env->context();
         v8::Local<v8::Object> msg =
             v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
-        const char* perm_str = PermissionToString(permission);
         msg->Set(context,
                  env->permission_string(),
-                 v8::String::NewFromUtf8(isolate, perm_str).ToLocalChecked())
+                 PermissionToString(env, permission))
             .Check();
         msg->Set(context,
                  env->resource_string(),
-                 v8::String::NewFromUtf8(isolate,
-                                         res.data(),
-                                         v8::NewStringType::kNormal,
-                                         static_cast<int>(res.size()))
-                     .ToLocalChecked())
+                 ToV8Value(context, res).ToLocalChecked())
             .Check();
         ch->Publish(env, msg);
         publishing_ = false;
@@ -333,18 +326,13 @@ void Permission::Drop(Environment* env,
       v8::Local<v8::Context> context = env->context();
       v8::Local<v8::Object> msg =
           v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
-      const char* perm_str = PermissionToString(scope);
       msg->Set(context,
                env->permission_string(),
-               v8::String::NewFromUtf8(isolate, perm_str).ToLocalChecked())
+               PermissionToString(env, scope))
           .Check();
       msg->Set(context,
                env->resource_string(),
-               v8::String::NewFromUtf8(isolate,
-                                       param.data(),
-                                       v8::NewStringType::kNormal,
-                                       static_cast<int>(param.size()))
-                   .ToLocalChecked())
+               ToV8Value(context, param).ToLocalChecked())
           .Check();
       msg->Set(context,
                FIXED_ONE_BYTE_STRING(isolate, "drop"),
diff --git a/src/permission/permission.h b/src/permission/permission.h
index 5597e5ce2445..674d99c1409a 100644
--- a/src/permission/permission.h
+++ b/src/permission/permission.h
@@ -113,7 +113,8 @@ class Permission {
   FORCE_INLINE bool warning_only() const { return warning_only_; }
 
   static PermissionScope StringToPermission(const std::string& perm);
-  static const char* PermissionToString(PermissionScope perm);
+  static v8::Local<v8::String> PermissionToString(Environment* env,
+                                                  PermissionScope perm);
   static void ThrowAccessDenied(Environment* env,
                                 PermissionScope perm,
                                 const std::string_view& res);

From 968bdd013591da9338a5747c9f276f1c99626956 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 17:01:32 -0700
Subject: [PATCH 128/344] src: use DictionaryTemplate for permission diag
 channel message

Since DiagnosticChannel permission messages always have the
same shape and should be as low cost as possible, use a
cached DictionaryTemplate for creating them

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/env-inl.h                | 10 +++---
 src/env.cc                   |  5 ++-
 src/env_properties.h         |  1 +
 src/permission/permission.cc | 60 ++++++++++++++++++++----------------
 4 files changed, 41 insertions(+), 35 deletions(-)

diff --git a/src/env-inl.h b/src/env-inl.h
index bbeb47b72ce3..e9f940c63e53 100644
--- a/src/env-inl.h
+++ b/src/env-inl.h
@@ -842,9 +842,8 @@ void Environment::set_process_exit_handler(
 #undef VP
 
 #define V(Name, label, _, __)                                                  \
-  inline v8::Local<v8::String>                                                 \
-  IsolateData::Name##_permission_string() const {                              \
-    return Name##_permission_string##_.Get(isolate_);                           \
+  inline v8::Local<v8::String> IsolateData::Name##_permission_string() const { \
+    return Name##_permission_string##_.Get(isolate_);                          \
   }
   PERMISSIONS(V)
 #undef V
@@ -879,9 +878,8 @@ void Environment::set_process_exit_handler(
 #undef VP
 
 #define V(Name, label, _, __)                                                  \
-  inline v8::Local<v8::String>                                                 \
-  Environment::Name##_permission_string() const {                              \
-    return isolate_data()->Name##_permission_string();                          \
+  inline v8::Local<v8::String> Environment::Name##_permission_string() const { \
+    return isolate_data()->Name##_permission_string();                         \
   }
   PERMISSIONS(V)
 #undef V
diff --git a/src/env.cc b/src/env.cc
index 7b275e09b720..658141f60817 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -432,10 +432,9 @@ void IsolateData::DeserializeProperties(const IsolateDataSerializeInfo* info) {
             info->primitive_values[i++]);                                      \
     Local<String> field;                                                       \
     if (!maybe_field.ToLocal(&field)) {                                        \
-      fprintf(stderr,                                                          \
-              "Failed to deserialize " #Name "_permission_string\n");          \
+      fprintf(stderr, "Failed to deserialize " #Name "_permission_string\n");  \
     }                                                                          \
-    Name##_permission_string##_.Set(isolate_, field);                           \
+    Name##_permission_string##_.Set(isolate_, field);                          \
   } while (0);
   PERMISSIONS(V)
 #undef V
diff --git a/src/env_properties.h b/src/env_properties.h
index 513f5875a8d2..d501170442e7 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -460,6 +460,7 @@
   V(naptr_record_template, v8::DictionaryTemplate)                             \
   V(object_stats_template, v8::DictionaryTemplate)                             \
   V(page_stats_template, v8::DictionaryTemplate)                               \
+  V(permission_diagnostic_channel_message, v8::DictionaryTemplate)             \
   V(pipe_constructor_template, v8::FunctionTemplate)                           \
   V(script_context_constructor_template, v8::FunctionTemplate)                 \
   V(secure_context_constructor_template, v8::FunctionTemplate)                 \
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 9815073c987a..512d95333b47 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -8,6 +8,7 @@
 #include "node_external_reference.h"
 #include "node_file.h"
 
+#include "v8-template.h"
 #include "v8.h"
 
 #include <memory>
@@ -17,11 +18,13 @@
 namespace node {
 
 using v8::Context;
+using v8::DictionaryTemplate;
 using v8::FunctionCallbackInfo;
 using v8::IntegrityLevel;
 using v8::Local;
 using v8::MaybeLocal;
 using v8::Object;
+using v8::Undefined;
 using v8::Value;
 
 namespace permission {
@@ -55,6 +58,20 @@ constexpr std::string_view GetDiagnosticsChannelName(PermissionScope scope) {
   }
 }
 
+Local<DictionaryTemplate> GetPermissionDiagnosicsTemplate(Environment* env) {
+  auto tmpl = env->permission_diagnostic_channel_message();
+  if (tmpl.IsEmpty()) {
+    static constexpr std::string_view names[] = {
+        "permission",
+        "resource",
+        "drop",
+    };
+    tmpl = DictionaryTemplate::New(env->isolate(), names);
+    env->set_permission_diagnostic_channel_message(tmpl);
+  }
+  return tmpl;
+}
+
 // permission.drop('fs.read', '/tmp/')
 // permission.drop('child')
 static void Drop(const FunctionCallbackInfo<Value>& args) {
@@ -259,17 +276,14 @@ bool Permission::is_scope_granted(Environment* env,
         v8::Isolate* isolate = env->isolate();
         v8::HandleScope handle_scope(isolate);
         v8::Local<v8::Context> context = env->context();
-        v8::Local<v8::Object> msg =
-            v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
-        msg->Set(context,
-                 env->permission_string(),
-                 PermissionToString(env, permission))
-            .Check();
-        msg->Set(context,
-                 env->resource_string(),
-                 ToV8Value(context, res).ToLocalChecked())
-            .Check();
-        ch->Publish(env, msg);
+        v8::MaybeLocal<v8::Value> values[] = {
+            PermissionToString(env, permission),
+            ToV8Value(context, res),
+            Undefined(isolate),
+        };
+        ch->Publish(
+            env,
+            GetPermissionDiagnosicsTemplate(env)->NewInstance(context, values));
         publishing_ = false;
       }
     }
@@ -324,21 +338,15 @@ void Permission::Drop(Environment* env,
       v8::Isolate* isolate = env->isolate();
       v8::HandleScope handle_scope(isolate);
       v8::Local<v8::Context> context = env->context();
-      v8::Local<v8::Object> msg =
-          v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
-      msg->Set(context,
-               env->permission_string(),
-               PermissionToString(env, scope))
-          .Check();
-      msg->Set(context,
-               env->resource_string(),
-               ToV8Value(context, param).ToLocalChecked())
-          .Check();
-      msg->Set(context,
-               FIXED_ONE_BYTE_STRING(isolate, "drop"),
-               v8::Boolean::New(isolate, true))
-          .Check();
-      ch->Publish(env, msg);
+
+      v8::MaybeLocal<v8::Value> values[] = {
+          PermissionToString(env, scope),
+          ToV8Value(context, param),
+          v8::True(isolate),
+      };
+      ch->Publish(
+          env,
+          GetPermissionDiagnosicsTemplate(env)->NewInstance(context, values));
       publishing_ = false;
     }
   }

From ec8fe275a13434ca717f66c243359e721ff2f964 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 17:10:40 -0700
Subject: [PATCH 129/344] src: make minor cleanup to permission checks

Getting the name of the channel is unnecessary.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/permission/permission.cc | 43 +++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 512d95333b47..aad50a7f4039 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -8,6 +8,7 @@
 #include "node_external_reference.h"
 #include "node_file.h"
 
+#include "permission/permission_base.h"
 #include "v8-template.h"
 #include "v8.h"
 
@@ -261,6 +262,8 @@ void Permission::EnableWarningOnly() {
 bool Permission::is_scope_granted(Environment* env,
                                   const PermissionScope permission,
                                   const std::string_view& res) const {
+  CHECK(permission != PermissionScope::kPermissionsRoot &&
+        permission != PermissionScope::kPermissionsCount);
   auto perm_node = nodes_.find(permission);
   bool result = false;
   if (perm_node != nodes_.end()) {
@@ -268,24 +271,21 @@ bool Permission::is_scope_granted(Environment* env,
   }
 
   if (!result && !publishing_) {
-    auto channel_name = GetDiagnosticsChannelName(permission);
-    if (!channel_name.empty()) {
-      auto ch = GetOrCreateChannel(env, permission);
-      if (ch && ch->HasSubscribers()) {
-        publishing_ = true;
-        v8::Isolate* isolate = env->isolate();
-        v8::HandleScope handle_scope(isolate);
-        v8::Local<v8::Context> context = env->context();
-        v8::MaybeLocal<v8::Value> values[] = {
-            PermissionToString(env, permission),
-            ToV8Value(context, res),
-            Undefined(isolate),
-        };
-        ch->Publish(
-            env,
-            GetPermissionDiagnosicsTemplate(env)->NewInstance(context, values));
-        publishing_ = false;
-      }
+    auto ch = GetOrCreateChannel(env, permission);
+    if (ch && ch->HasSubscribers()) {
+      publishing_ = true;
+      v8::Isolate* isolate = env->isolate();
+      v8::HandleScope handle_scope(isolate);
+      v8::Local<v8::Context> context = env->context();
+      v8::MaybeLocal<v8::Value> values[] = {
+          PermissionToString(env, permission),
+          ToV8Value(context, res),
+          Undefined(isolate),
+      };
+      ch->Publish(
+          env,
+          GetPermissionDiagnosicsTemplate(env)->NewInstance(context, values));
+      publishing_ = false;
     }
   }
 
@@ -294,6 +294,8 @@ bool Permission::is_scope_granted(Environment* env,
 
 BaseObjectPtr<diagnostics_channel::Channel> Permission::GetOrCreateChannel(
     Environment* env, PermissionScope scope) const {
+  CHECK(scope != PermissionScope::kPermissionsRoot &&
+        scope != PermissionScope::kPermissionsCount);
   auto it = channels_.find(scope);
   if (it != channels_.end()) {
     // Promote weak ref to strong for the duration of this call.
@@ -324,14 +326,15 @@ void Permission::Apply(Environment* env,
 void Permission::Drop(Environment* env,
                       PermissionScope scope,
                       const std::string_view& param) {
+  CHECK(scope != PermissionScope::kPermissionsRoot &&
+        scope != PermissionScope::kPermissionsCount);
   auto permission = nodes_.find(scope);
   if (permission != nodes_.end()) {
     permission->second->Drop(env, scope, param);
   }
 
   // Publish to diagnostics channel so observers can track drops
-  auto channel_name = GetDiagnosticsChannelName(scope);
-  if (!channel_name.empty() && !publishing_) {
+  if (!publishing_) {
     auto ch = GetOrCreateChannel(env, scope);
     if (ch && ch->HasSubscribers()) {
       publishing_ = true;

From ac920e0d2ba050e6b90cf4a4c529d3733fe9da9b Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 17:33:26 -0700
Subject: [PATCH 130/344] src: simplify c++ diagnostics channel API

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/node_diagnostics_channel.cc         | 14 ++++++++------
 src/node_diagnostics_channel.h          |  3 +--
 src/permission/permission.cc            |  6 ++----
 test/cctest/test_diagnostics_channel.cc |  9 +++++----
 4 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/src/node_diagnostics_channel.cc b/src/node_diagnostics_channel.cc
index cfae019da62f..ab67e6d7c5fa 100644
--- a/src/node_diagnostics_channel.cc
+++ b/src/node_diagnostics_channel.cc
@@ -178,11 +178,11 @@ void Channel::Unlink() {
   publish_fn_.Reset();
 }
 
-Channel* Channel::Get(Environment* env, const char* name) {
+BaseObjectPtr<Channel> Channel::Get(Environment* env, std::string_view name) {
   Realm* realm = env->principal_realm();
   BindingData* binding = realm->GetBindingData<BindingData>();
   if (binding == nullptr) {
-    return nullptr;
+    return {};
   }
   uint32_t index = binding->GetOrCreateChannelIndex(std::string(name));
 
@@ -208,22 +208,24 @@ Channel* Channel::Get(Environment* env, const char* name) {
              .ToLocalChecked()
              ->NewInstance(context)
              .ToLocal(&wrap)) {
-      return nullptr;
+      return {};
     }
 
     binding->channels_[index] = MakeDetachedBaseObject<Channel>(
         env, wrap, binding, index, std::string(name));
   }
 
-  Channel* channel = binding->channels_[index].get();
+  auto& channel = binding->channels_[index];
 
   // Late-bind: link to the JS channel when the callback is available.
   if (!binding->link_callback_.IsEmpty() && !channel->IsLinked()) {
     Isolate* isolate = env->isolate();
     HandleScope handle_scope(isolate);
     Local<Context> context = env->context();
-    Local<String> js_name = String::NewFromUtf8(isolate, name).ToLocalChecked();
-    Local<Value> argv[] = {js_name, Integer::NewFromUnsigned(isolate, index)};
+    Local<Value> argv[] = {
+      ToV8Value(context, name).ToLocalChecked(),
+      Integer::NewFromUnsigned(isolate, index),
+    };
     Local<Value> result;
     if (binding->link_callback_.Get(isolate)
             ->Call(context, v8::Undefined(isolate), arraysize(argv), argv)
diff --git a/src/node_diagnostics_channel.h b/src/node_diagnostics_channel.h
index 073e4e4f273b..ca68e75a4361 100644
--- a/src/node_diagnostics_channel.h
+++ b/src/node_diagnostics_channel.h
@@ -73,8 +73,7 @@ class Channel : public BaseObject {
           uint32_t index,
           std::string name);
 
-  // Returns a non-owning pointer. Lifetime is managed by BindingData.
-  static Channel* Get(Environment* env, const char* name);
+  static BaseObjectPtr<Channel> Get(Environment* env, std::string_view name);
 
   inline bool HasSubscribers() const {
     return binding_data_ != nullptr && binding_data_->subscribers_[index_] > 0;
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index aad50a7f4039..6bf3b0fe04eb 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -304,12 +304,10 @@ BaseObjectPtr<diagnostics_channel::Channel> Permission::GetOrCreateChannel(
     channels_.erase(it);
   }
   auto channel_name = GetDiagnosticsChannelName(scope);
-  diagnostics_channel::Channel* ch =
-      diagnostics_channel::Channel::Get(env, channel_name.data());
-  if (ch != nullptr) {
+  if (auto ch = diagnostics_channel::Channel::Get(env, channel_name)) {
     channels_.emplace(scope,
                       BaseObjectWeakPtr<diagnostics_channel::Channel>(ch));
-    return BaseObjectPtr<diagnostics_channel::Channel>(ch);
+    return ch;
   }
   return {};
 }
diff --git a/test/cctest/test_diagnostics_channel.cc b/test/cctest/test_diagnostics_channel.cc
index 30a004b59070..d4d1fd1c9fac 100644
--- a/test/cctest/test_diagnostics_channel.cc
+++ b/test/cctest/test_diagnostics_channel.cc
@@ -3,6 +3,7 @@
 #include "gtest/gtest.h"
 #include "node_test_fixture.h"
 
+using node::BaseObjectPtr;
 using node::diagnostics_channel::Channel;
 
 class DiagnosticsChannelTest : public EnvironmentTestFixture {};
@@ -279,15 +280,15 @@ TEST_F(DiagnosticsChannelTest, NativeChannelsGrowSubscriberStorage) {
       "globalThis.__dc.subscribe('test:cctest:grow:0', "
       "                          globalThis.__firstSubscriber);");
 
-  Channel* first = Channel::Get(*env, "test:cctest:grow:0");
-  ASSERT_NE(first, nullptr);
+  auto first = Channel::Get(*env, "test:cctest:grow:0");
+  ASSERT_TRUE(first);
   ASSERT_TRUE(first->HasSubscribers());
 
-  Channel* last = nullptr;
+  BaseObjectPtr<Channel> last;
   for (size_t i = 1; i <= 1024; i++) {
     std::string name = "test:cctest:grow:" + std::to_string(i);
     last = Channel::Get(*env, name.c_str());
-    ASSERT_NE(last, nullptr);
+    ASSERT_TRUE(last);
   }
 
   RunJS(isolate_,

From 521aaf10fce05255ca72234e61191a135574f68c Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 18:19:23 -0700
Subject: [PATCH 131/344] src: apply multiple general cleanups to permissions

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/env.cc                                 | 17 ++++++-------
 src/node_diagnostics_channel.cc            |  4 ++--
 src/permission/addon_permission.cc         |  6 ++---
 src/permission/addon_permission.h          |  6 ++---
 src/permission/child_process_permission.cc |  6 ++---
 src/permission/child_process_permission.h  |  6 ++---
 src/permission/ffi_permission.cc           |  6 ++---
 src/permission/ffi_permission.h            |  6 ++---
 src/permission/fs_permission.cc            | 10 ++++----
 src/permission/fs_permission.h             | 10 ++++----
 src/permission/inspector_permission.cc     |  6 ++---
 src/permission/inspector_permission.h      |  6 ++---
 src/permission/net_permission.cc           |  6 ++---
 src/permission/net_permission.h            |  6 ++---
 src/permission/openssl_store_permission.cc |  6 ++---
 src/permission/openssl_store_permission.h  |  6 ++---
 src/permission/permission.cc               | 28 +++++++++++-----------
 src/permission/permission.h                | 22 ++++++++---------
 src/permission/permission_base.h           | 10 ++++----
 src/permission/wasi_permission.cc          |  6 ++---
 src/permission/wasi_permission.h           |  6 ++---
 src/permission/worker_permission.cc        |  6 ++---
 src/permission/worker_permission.h         |  6 ++---
 23 files changed, 98 insertions(+), 99 deletions(-)

diff --git a/src/env.cc b/src/env.cc
index 658141f60817..13344ad135e2 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -954,6 +954,7 @@ Environment::Environment(IsolateData* isolate_data,
 
   if (options_->permission || options_->permission_audit) {
     permission()->EnablePermissions();
+    static const std::array args = {std::string("*")};
     if (options_->permission_audit) {
       permission()->EnableWarningOnly();
     }
@@ -962,29 +963,29 @@ Environment::Environment(IsolateData* isolate_data,
     // unless explicitly allowed by the user
     if (!options_->allow_addons) {
       options_->allow_native_addons = false;
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kAddon);
+      permission()->Apply(this, args, permission::PermissionScope::kAddon);
     }
     if (!options_->allow_inspector) {
       flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);
+      permission()->Apply(this, args, permission::PermissionScope::kInspector);
     }
     if (!options_->allow_child_process) {
       permission()->Apply(
-          this, {"*"}, permission::PermissionScope::kChildProcess);
+          this, args, permission::PermissionScope::kChildProcess);
     }
     if (!options_->allow_ffi) {
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kFFI);
+      permission()->Apply(this, args, permission::PermissionScope::kFFI);
     }
     if (!options_->allow_openssl_store) {
       permission()->Apply(
-          this, {"*"}, permission::PermissionScope::kOpenSSLStore);
+          this, args, permission::PermissionScope::kOpenSSLStore);
     }
     if (!options_->allow_worker_threads) {
       permission()->Apply(
-          this, {"*"}, permission::PermissionScope::kWorkerThreads);
+          this, args, permission::PermissionScope::kWorkerThreads);
     }
     if (!options_->allow_wasi) {
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kWASI);
+      permission()->Apply(this, args, permission::PermissionScope::kWASI);
     }
 
     // Implicit allow entrypoint to kFileSystemRead
@@ -1019,7 +1020,7 @@ Environment::Environment(IsolateData* isolate_data,
     }
 
     if (options_->allow_net) {
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kNet);
+      permission()->Apply(this, args, permission::PermissionScope::kNet);
     }
   }
 }
diff --git a/src/node_diagnostics_channel.cc b/src/node_diagnostics_channel.cc
index ab67e6d7c5fa..ba0492a0df5e 100644
--- a/src/node_diagnostics_channel.cc
+++ b/src/node_diagnostics_channel.cc
@@ -223,8 +223,8 @@ BaseObjectPtr<Channel> Channel::Get(Environment* env, std::string_view name) {
     HandleScope handle_scope(isolate);
     Local<Context> context = env->context();
     Local<Value> argv[] = {
-      ToV8Value(context, name).ToLocalChecked(),
-      Integer::NewFromUnsigned(isolate, index),
+        ToV8Value(context, name).ToLocalChecked(),
+        Integer::NewFromUnsigned(isolate, index),
     };
     Local<Value> result;
     if (binding->link_callback_.Get(isolate)
diff --git a/src/permission/addon_permission.cc b/src/permission/addon_permission.cc
index 66035556102f..249b266c5919 100644
--- a/src/permission/addon_permission.cc
+++ b/src/permission/addon_permission.cc
@@ -9,20 +9,20 @@ namespace permission {
 // Currently, Addon manage a single state
 // Once denied, it's always denied
 void AddonPermission::Apply(Environment* env,
-                            const std::vector<std::string>& allow,
+                            std::span<const std::string> allow,
                             PermissionScope scope) {
   deny_all_ = true;
 }
 
 void AddonPermission::Drop(Environment* env,
                            PermissionScope scope,
-                           const std::string_view& param) {
+                           std::string_view param) {
   deny_all_ = true;
 }
 
 bool AddonPermission::is_granted(Environment* env,
                                  PermissionScope perm,
-                                 const std::string_view& param) const {
+                                 std::string_view param) const {
   return deny_all_ == false;
 }
 
diff --git a/src/permission/addon_permission.h b/src/permission/addon_permission.h
index b3eed910fe9f..04e2ed6fed9a 100644
--- a/src/permission/addon_permission.h
+++ b/src/permission/addon_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class AddonPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param = "") const override;
+                  std::string_view param) const override;
 
  private:
   bool deny_all_;
diff --git a/src/permission/child_process_permission.cc b/src/permission/child_process_permission.cc
index 7d31ff24f813..25c9713e0570 100644
--- a/src/permission/child_process_permission.cc
+++ b/src/permission/child_process_permission.cc
@@ -10,20 +10,20 @@ namespace permission {
 // Currently, ChildProcess manage a single state
 // Once denied, it's always denied
 void ChildProcessPermission::Apply(Environment* env,
-                                   const std::vector<std::string>& allow,
+                                   std::span<const std::string> allow,
                                    PermissionScope scope) {
   deny_all_ = true;
 }
 
 void ChildProcessPermission::Drop(Environment* env,
                                   PermissionScope scope,
-                                  const std::string_view& param) {
+                                  std::string_view param) {
   deny_all_ = true;
 }
 
 bool ChildProcessPermission::is_granted(Environment* env,
                                         PermissionScope perm,
-                                        const std::string_view& param) const {
+                                        std::string_view param) const {
   return deny_all_ == false;
 }
 
diff --git a/src/permission/child_process_permission.h b/src/permission/child_process_permission.h
index 33612b1c10a9..59ab74bb5116 100644
--- a/src/permission/child_process_permission.h
+++ b/src/permission/child_process_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class ChildProcessPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param = "") const override;
+                  std::string_view param) const override;
 
  private:
   bool deny_all_;
diff --git a/src/permission/ffi_permission.cc b/src/permission/ffi_permission.cc
index 4b00d4c07b9c..674394144471 100644
--- a/src/permission/ffi_permission.cc
+++ b/src/permission/ffi_permission.cc
@@ -9,20 +9,20 @@ namespace permission {
 
 // Currently, FFIPermission manages a single global deny state for FFI.
 void FFIPermission::Apply(Environment* env,
-                          const std::vector<std::string>& allow,
+                          std::span<const std::string> allow,
                           PermissionScope scope) {
   deny_all_ = true;
 }
 
 void FFIPermission::Drop(Environment* env,
                          PermissionScope scope,
-                         const std::string_view& param) {
+                         std::string_view param) {
   deny_all_ = true;
 }
 
 bool FFIPermission::is_granted(Environment* env,
                                PermissionScope perm,
-                               const std::string_view& param) const {
+                               std::string_view param) const {
   return perm != PermissionScope::kFFI || !deny_all_;
 }
 
diff --git a/src/permission/ffi_permission.h b/src/permission/ffi_permission.h
index 3acd3c4642a0..fcb8b403c725 100644
--- a/src/permission/ffi_permission.h
+++ b/src/permission/ffi_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class FFIPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param = "") const override;
+                  std::string_view param) const override;
 
  private:
   bool deny_all_ = false;
diff --git a/src/permission/fs_permission.cc b/src/permission/fs_permission.cc
index 98146cf825ad..89f1c6d70c98 100644
--- a/src/permission/fs_permission.cc
+++ b/src/permission/fs_permission.cc
@@ -52,7 +52,7 @@ void FreeRecursivelyNode(
 bool is_tree_granted(
     node::Environment* env,
     const node::permission::FSPermission::RadixTree* granted_tree,
-    const std::string_view& param) {
+    std::string_view param) {
   std::string resolved_param = node::PathResolve(env, {param});
 #ifdef _WIN32
   // Remove leading "\\?\" from UNC path
@@ -137,7 +137,7 @@ namespace permission {
 // allow = '*'
 // allow = '/tmp/,/home/example.js'
 void FSPermission::Apply(Environment* env,
-                         const std::vector<std::string>& allow,
+                         std::span<const std::string> allow,
                          PermissionScope scope) {
   for (const std::string& res : allow) {
     if (res == "*") {
@@ -156,7 +156,7 @@ void FSPermission::Apply(Environment* env,
 
 void FSPermission::Drop(Environment* env,
                         PermissionScope scope,
-                        const std::string_view& param) {
+                        std::string_view param) {
   if (param.empty()) {
     // Drop all access for this scope
     if (scope == PermissionScope::kFileSystemRead ||
@@ -250,7 +250,7 @@ void FSPermission::GrantAccess(PermissionScope perm, const std::string& res) {
 
 bool FSPermission::is_granted(Environment* env,
                               PermissionScope perm,
-                              const std::string_view& param = "") const {
+                              std::string_view param = "") const {
   switch (perm) {
     case PermissionScope::kFileSystem:
       return allow_all_in_ && allow_all_out_;
@@ -287,7 +287,7 @@ void FSPermission::RadixTree::Clear() {
   root_node_->is_leaf = false;
 }
 
-bool FSPermission::RadixTree::Lookup(const std::string_view& s,
+bool FSPermission::RadixTree::Lookup(std::string_view s,
                                      bool when_empty_return) const {
   FSPermission::RadixTree::Node* current_node = root_node_;
   if (current_node->children.empty()) {
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index 0048ea2de36a..8b15b86426b9 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -16,14 +16,14 @@ namespace permission {
 class FSPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param) const override;
+                  std::string_view param) const override;
 
   struct RadixTree {
     struct Node {
@@ -146,8 +146,8 @@ class FSPermission final : public PermissionBase {
     ~RadixTree();
     void Insert(const std::string& s);
     void Clear();
-    bool Lookup(const std::string_view& s) const { return Lookup(s, false); }
-    bool Lookup(const std::string_view& s, bool when_empty_return) const;
+    bool Lookup(std::string_view s) const { return Lookup(s, false); }
+    bool Lookup(std::string_view s, bool when_empty_return) const;
 
    private:
     Node* root_node_;
diff --git a/src/permission/inspector_permission.cc b/src/permission/inspector_permission.cc
index ee775e778dcf..d884ec4d8208 100644
--- a/src/permission/inspector_permission.cc
+++ b/src/permission/inspector_permission.cc
@@ -9,20 +9,20 @@ namespace permission {
 // Currently, Inspector manage a single state
 // Once denied, it's always denied
 void InspectorPermission::Apply(Environment* env,
-                                const std::vector<std::string>& allow,
+                                std::span<const std::string> allow,
                                 PermissionScope scope) {
   deny_all_ = true;
 }
 
 void InspectorPermission::Drop(Environment* env,
                                PermissionScope scope,
-                               const std::string_view& param) {
+                               std::string_view param) {
   deny_all_ = true;
 }
 
 bool InspectorPermission::is_granted(Environment* env,
                                      PermissionScope perm,
-                                     const std::string_view& param) const {
+                                     std::string_view param) const {
   return deny_all_ == false;
 }
 
diff --git a/src/permission/inspector_permission.h b/src/permission/inspector_permission.h
index d851fb2fa253..2490149caa91 100644
--- a/src/permission/inspector_permission.h
+++ b/src/permission/inspector_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class InspectorPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param = "") const override;
+                  std::string_view param) const override;
 
  private:
   bool deny_all_;
diff --git a/src/permission/net_permission.cc b/src/permission/net_permission.cc
index 5f1cc139aa74..da42215ecfdc 100644
--- a/src/permission/net_permission.cc
+++ b/src/permission/net_permission.cc
@@ -8,20 +8,20 @@ namespace node {
 namespace permission {
 
 void NetPermission::Apply(Environment* env,
-                          const std::vector<std::string>& allow,
+                          std::span<const std::string> allow,
                           PermissionScope scope) {
   allow_net_ = true;
 }
 
 void NetPermission::Drop(Environment* env,
                          PermissionScope scope,
-                         const std::string_view& param) {
+                         std::string_view param) {
   allow_net_ = false;
 }
 
 bool NetPermission::is_granted(Environment* env,
                                PermissionScope perm,
-                               const std::string_view& param) const {
+                               std::string_view param) const {
   return allow_net_;
 }
 
diff --git a/src/permission/net_permission.h b/src/permission/net_permission.h
index 26b055b255a6..23b643a50222 100644
--- a/src/permission/net_permission.h
+++ b/src/permission/net_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class NetPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param) const override;
+                  std::string_view param) const override;
 
  private:
   bool allow_net_ = false;
diff --git a/src/permission/openssl_store_permission.cc b/src/permission/openssl_store_permission.cc
index fcae2772b3f5..e799b5373344 100644
--- a/src/permission/openssl_store_permission.cc
+++ b/src/permission/openssl_store_permission.cc
@@ -10,20 +10,20 @@ namespace permission {
 // OpenSSLStorePermission manages a single global deny state for the use of
 // OpenSSL STORE loaders.
 void OpenSSLStorePermission::Apply(Environment* env,
-                                   const std::vector<std::string>& allow,
+                                   std::span<const std::string> allow,
                                    PermissionScope scope) {
   deny_all_ = true;
 }
 
 void OpenSSLStorePermission::Drop(Environment* env,
                                   PermissionScope scope,
-                                  const std::string_view& param) {
+                                  std::string_view param) {
   deny_all_ = true;
 }
 
 bool OpenSSLStorePermission::is_granted(Environment* env,
                                         PermissionScope perm,
-                                        const std::string_view& param) const {
+                                        std::string_view param) const {
   return perm != PermissionScope::kOpenSSLStore || !deny_all_;
 }
 
diff --git a/src/permission/openssl_store_permission.h b/src/permission/openssl_store_permission.h
index d64475228e18..8cac21f9f288 100644
--- a/src/permission/openssl_store_permission.h
+++ b/src/permission/openssl_store_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class OpenSSLStorePermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param = "") const override;
+                  std::string_view param) const override;
 
  private:
   bool deny_all_ = false;
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 6bf3b0fe04eb..f16fafe5876e 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -59,7 +59,7 @@ constexpr std::string_view GetDiagnosticsChannelName(PermissionScope scope) {
   }
 }
 
-Local<DictionaryTemplate> GetPermissionDiagnosicsTemplate(Environment* env) {
+Local<DictionaryTemplate> GetPermissionDiagnosticsTemplate(Environment* env) {
   auto tmpl = env->permission_diagnostic_channel_message();
   if (tmpl.IsEmpty()) {
     static constexpr std::string_view names[] = {
@@ -93,7 +93,7 @@ static void Drop(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  env->permission()->Drop(env, scope);
+  env->permission()->Drop(env, scope, "");
 }
 
 // permission.has('fs.in', '/tmp/')
@@ -125,8 +125,8 @@ static void Has(const FunctionCallbackInfo<Value>& args) {
 
 #define V(Name, label, _, __)                                                  \
   if (perm == PermissionScope::k##Name) return env->Name##_permission_string();
-v8::Local<v8::String> Permission::PermissionToString(
-    Environment* env, const PermissionScope perm) {
+v8::Local<v8::String> Permission::PermissionToString(Environment* env,
+                                                     PermissionScope perm) {
   PERMISSIONS(V)
   UNREACHABLE();
 }
@@ -134,7 +134,7 @@ v8::Local<v8::String> Permission::PermissionToString(
 
 #define V(Name, label, _, __)                                                  \
   if (perm == label) return PermissionScope::k##Name;
-PermissionScope Permission::StringToPermission(const std::string& perm) {
+PermissionScope Permission::StringToPermission(std::string_view perm) {
   PERMISSIONS(V)
   return PermissionScope::kPermissionsRoot;
 }
@@ -206,7 +206,7 @@ const char* GetErrorFlagSuggestion(node::permission::PermissionScope perm) {
 
 MaybeLocal<Value> CreateAccessDeniedError(Environment* env,
                                           PermissionScope perm,
-                                          const std::string_view& res) {
+                                          std::string_view res) {
   const char* suggestion = GetErrorFlagSuggestion(perm);
   Local<Object> err = ERR_ACCESS_DENIED(
       env->isolate(), "Access to this API has been restricted. %s", suggestion);
@@ -226,7 +226,7 @@ MaybeLocal<Value> CreateAccessDeniedError(Environment* env,
 
 void Permission::ThrowAccessDenied(Environment* env,
                                    PermissionScope perm,
-                                   const std::string_view& res) {
+                                   std::string_view res) {
   Local<Value> err;
   if (CreateAccessDeniedError(env, perm, res).ToLocal(&err)) {
     env->isolate()->ThrowException(err);
@@ -238,7 +238,7 @@ void Permission::ThrowAccessDenied(Environment* env,
 void Permission::AsyncThrowAccessDenied(Environment* env,
                                         fs::FSReqBase* req_wrap,
                                         PermissionScope perm,
-                                        const std::string_view& res) {
+                                        std::string_view res) {
   Local<Value> err;
   if (CreateAccessDeniedError(env, perm, res).ToLocal(&err)) {
     return req_wrap->Reject(err);
@@ -260,8 +260,8 @@ void Permission::EnableWarningOnly() {
 }
 
 bool Permission::is_scope_granted(Environment* env,
-                                  const PermissionScope permission,
-                                  const std::string_view& res) const {
+                                  PermissionScope permission,
+                                  std::string_view res) const {
   CHECK(permission != PermissionScope::kPermissionsRoot &&
         permission != PermissionScope::kPermissionsCount);
   auto perm_node = nodes_.find(permission);
@@ -284,7 +284,7 @@ bool Permission::is_scope_granted(Environment* env,
       };
       ch->Publish(
           env,
-          GetPermissionDiagnosicsTemplate(env)->NewInstance(context, values));
+          GetPermissionDiagnosticsTemplate(env)->NewInstance(context, values));
       publishing_ = false;
     }
   }
@@ -313,7 +313,7 @@ BaseObjectPtr<diagnostics_channel::Channel> Permission::GetOrCreateChannel(
 }
 
 void Permission::Apply(Environment* env,
-                       const std::vector<std::string>& allow,
+                       std::span<const std::string> allow,
                        PermissionScope scope) {
   auto permission = nodes_.find(scope);
   if (permission != nodes_.end()) {
@@ -323,7 +323,7 @@ void Permission::Apply(Environment* env,
 
 void Permission::Drop(Environment* env,
                       PermissionScope scope,
-                      const std::string_view& param) {
+                      std::string_view param) {
   CHECK(scope != PermissionScope::kPermissionsRoot &&
         scope != PermissionScope::kPermissionsCount);
   auto permission = nodes_.find(scope);
@@ -347,7 +347,7 @@ void Permission::Drop(Environment* env,
       };
       ch->Publish(
           env,
-          GetPermissionDiagnosicsTemplate(env)->NewInstance(context, values));
+          GetPermissionDiagnosticsTemplate(env)->NewInstance(context, values));
       publishing_ = false;
     }
   }
diff --git a/src/permission/permission.h b/src/permission/permission.h
index 674d99c1409a..dd2d9b16ef81 100644
--- a/src/permission/permission.h
+++ b/src/permission/permission.h
@@ -100,8 +100,8 @@ class Permission {
   Permission();
 
   FORCE_INLINE bool is_granted(Environment* env,
-                               const PermissionScope permission,
-                               const std::string_view& res = "") const {
+                               PermissionScope permission,
+                               std::string_view res = "") const {
     if (!enabled_) [[likely]] {
       return true;
     }
@@ -112,32 +112,30 @@ class Permission {
 
   FORCE_INLINE bool warning_only() const { return warning_only_; }
 
-  static PermissionScope StringToPermission(const std::string& perm);
+  static PermissionScope StringToPermission(std::string_view perm);
   static v8::Local<v8::String> PermissionToString(Environment* env,
                                                   PermissionScope perm);
   static void ThrowAccessDenied(Environment* env,
                                 PermissionScope perm,
-                                const std::string_view& res);
+                                std::string_view res);
   static void AsyncThrowAccessDenied(Environment* env,
                                      fs::FSReqBase* req_wrap,
                                      PermissionScope perm,
-                                     const std::string_view& res);
+                                     std::string_view res);
 
   // CLI Call
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope);
   // Runtime Call
-  void Drop(Environment* env,
-            PermissionScope scope,
-            const std::string_view& param = "");
+  void Drop(Environment* env, PermissionScope scope, std::string_view param);
   void EnablePermissions();
   void EnableWarningOnly();
 
  private:
   COLD_NOINLINE bool is_scope_granted(Environment* env,
-                                      const PermissionScope permission,
-                                      const std::string_view& res = "") const;
+                                      PermissionScope permission,
+                                      std::string_view res = "") const;
 
   BaseObjectPtr<diagnostics_channel::Channel> GetOrCreateChannel(
       Environment* env, PermissionScope scope) const;
@@ -155,7 +153,7 @@ class Permission {
 
 v8::MaybeLocal<v8::Value> CreateAccessDeniedError(Environment* env,
                                                   PermissionScope perm,
-                                                  const std::string_view& res);
+                                                  std::string_view res);
 
 }  // namespace permission
 
diff --git a/src/permission/permission_base.h b/src/permission/permission_base.h
index 66bfd33a8787..658175611ecd 100644
--- a/src/permission/permission_base.h
+++ b/src/permission/permission_base.h
@@ -3,10 +3,9 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <map>
+#include <span>
 #include <string>
 #include <string_view>
-#include "v8.h"
 
 namespace node {
 
@@ -60,15 +59,16 @@ enum class PermissionScope {
 
 class PermissionBase {
  public:
+  virtual ~PermissionBase() = default;
   virtual void Apply(Environment* env,
-                     const std::vector<std::string>& allow,
+                     std::span<const std::string> allow,
                      PermissionScope scope) = 0;
   virtual void Drop(Environment* env,
                     PermissionScope scope,
-                    const std::string_view& param = "") = 0;
+                    std::string_view param) = 0;
   virtual bool is_granted(Environment* env,
                           PermissionScope perm,
-                          const std::string_view& param = "") const = 0;
+                          std::string_view param) const = 0;
 };
 
 }  // namespace permission
diff --git a/src/permission/wasi_permission.cc b/src/permission/wasi_permission.cc
index 00ce927eb625..cf3be848c31f 100644
--- a/src/permission/wasi_permission.cc
+++ b/src/permission/wasi_permission.cc
@@ -10,20 +10,20 @@ namespace permission {
 // Currently, WASIPermission manage a single state
 // Once denied, it's always denied
 void WASIPermission::Apply(Environment* env,
-                           const std::vector<std::string>& allow,
+                           std::span<const std::string> allow,
                            PermissionScope scope) {
   deny_all_ = true;
 }
 
 void WASIPermission::Drop(Environment* env,
                           PermissionScope scope,
-                          const std::string_view& param) {
+                          std::string_view param) {
   deny_all_ = true;
 }
 
 bool WASIPermission::is_granted(Environment* env,
                                 PermissionScope perm,
-                                const std::string_view& param) const {
+                                std::string_view param) const {
   return deny_all_ == false;
 }
 
diff --git a/src/permission/wasi_permission.h b/src/permission/wasi_permission.h
index b5cdaca928dd..1d341c1a7334 100644
--- a/src/permission/wasi_permission.h
+++ b/src/permission/wasi_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class WASIPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param = "") const override;
+                  std::string_view param) const override;
 
  private:
   bool deny_all_;
diff --git a/src/permission/worker_permission.cc b/src/permission/worker_permission.cc
index aa6867eb1e0f..395876d29cce 100644
--- a/src/permission/worker_permission.cc
+++ b/src/permission/worker_permission.cc
@@ -10,20 +10,20 @@ namespace permission {
 // Currently, PolicyDenyWorker manage a single state
 // Once denied, it's always denied
 void WorkerPermission::Apply(Environment* env,
-                             const std::vector<std::string>& allow,
+                             std::span<const std::string> allow,
                              PermissionScope scope) {
   deny_all_ = true;
 }
 
 void WorkerPermission::Drop(Environment* env,
                             PermissionScope scope,
-                            const std::string_view& param) {
+                            std::string_view param) {
   deny_all_ = true;
 }
 
 bool WorkerPermission::is_granted(Environment* env,
                                   PermissionScope perm,
-                                  const std::string_view& param) const {
+                                  std::string_view param) const {
   return deny_all_ == false;
 }
 
diff --git a/src/permission/worker_permission.h b/src/permission/worker_permission.h
index fc7abe0d50f4..4480b75646d2 100644
--- a/src/permission/worker_permission.h
+++ b/src/permission/worker_permission.h
@@ -13,14 +13,14 @@ namespace permission {
 class WorkerPermission final : public PermissionBase {
  public:
   void Apply(Environment* env,
-             const std::vector<std::string>& allow,
+             std::span<const std::string> allow,
              PermissionScope scope) override;
   void Drop(Environment* env,
             PermissionScope scope,
-            const std::string_view& param = "") override;
+            std::string_view param) override;
   bool is_granted(Environment* env,
                   PermissionScope perm,
-                  const std::string_view& param = "") const override;
+                  std::string_view param) const override;
 
  private:
   bool deny_all_;

From efb649ec2668c5b39593dd80118e1bc49e843c42 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 18:31:22 -0700
Subject: [PATCH 132/344] src: make permission storage a bit more efficient

Use a fixed array rather than an unordered list

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/permission/permission.cc | 72 ++++++++++++++++--------------------
 src/permission/permission.h  | 11 ++++--
 2 files changed, 39 insertions(+), 44 deletions(-)

diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index f16fafe5876e..fd4b1ab34907 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -141,53 +141,49 @@ PermissionScope Permission::StringToPermission(std::string_view perm) {
 #undef V
 
 Permission::Permission() : enabled_(false), warning_only_(false) {
-  std::shared_ptr<PermissionBase> fs = std::make_shared<FSPermission>();
-  std::shared_ptr<PermissionBase> child_p =
-      std::make_shared<ChildProcessPermission>();
-  std::shared_ptr<PermissionBase> worker_t =
-      std::make_shared<WorkerPermission>();
-  std::shared_ptr<PermissionBase> inspector =
-      std::make_shared<InspectorPermission>();
-  std::shared_ptr<PermissionBase> wasi = std::make_shared<WASIPermission>();
-  std::shared_ptr<PermissionBase> net = std::make_shared<NetPermission>();
-  std::shared_ptr<PermissionBase> addon = std::make_shared<AddonPermission>();
-  std::shared_ptr<FFIPermission> ffi = std::make_shared<FFIPermission>();
-  std::shared_ptr<PermissionBase> openssl_store =
-      std::make_shared<OpenSSLStorePermission>();
+  auto fs = std::make_shared<FSPermission>();
+  auto child_p = std::make_shared<ChildProcessPermission>();
+  auto worker_t = std::make_shared<WorkerPermission>();
+  auto inspector = std::make_shared<InspectorPermission>();
+  auto wasi = std::make_shared<WASIPermission>();
+  auto net = std::make_shared<NetPermission>();
+  auto addon = std::make_shared<AddonPermission>();
+  auto ffi = std::make_shared<FFIPermission>();
+  auto openssl_store = std::make_shared<OpenSSLStorePermission>();
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, fs));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = fs;
   FILESYSTEM_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, child_p));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = child_p;
   CHILD_PROCESS_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, worker_t));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = worker_t;
   WORKER_THREADS_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, inspector));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = inspector;
   INSPECTOR_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, wasi));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = wasi;
   WASI_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, net));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = net;
   NET_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, addon));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = addon;
   ADDON_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, ffi));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = ffi;
   FFI_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_.insert(std::make_pair(PermissionScope::k##Name, openssl_store));
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = openssl_store;
   OPENSSL_STORE_PERMISSIONS(V)
 #undef V
 }
@@ -264,10 +260,10 @@ bool Permission::is_scope_granted(Environment* env,
                                   std::string_view res) const {
   CHECK(permission != PermissionScope::kPermissionsRoot &&
         permission != PermissionScope::kPermissionsCount);
-  auto perm_node = nodes_.find(permission);
+  auto& perm_node = nodes_[static_cast<size_t>(permission)];
   bool result = false;
-  if (perm_node != nodes_.end()) {
-    result = perm_node->second->is_granted(env, permission, res);
+  if (perm_node) {
+    result = perm_node->is_granted(env, permission, res);
   }
 
   if (!result && !publishing_) {
@@ -296,17 +292,13 @@ BaseObjectPtr<diagnostics_channel::Channel> Permission::GetOrCreateChannel(
     Environment* env, PermissionScope scope) const {
   CHECK(scope != PermissionScope::kPermissionsRoot &&
         scope != PermissionScope::kPermissionsCount);
-  auto it = channels_.find(scope);
-  if (it != channels_.end()) {
-    // Promote weak ref to strong for the duration of this call.
-    BaseObjectPtr<diagnostics_channel::Channel> ptr(it->second.get());
-    if (ptr) return ptr;
-    channels_.erase(it);
-  }
+  auto& weak_ch = channels_[static_cast<size_t>(scope)];
+  // Promote weak ref to strong for the duration of this call.
+  BaseObjectPtr<diagnostics_channel::Channel> ptr(weak_ch.get());
+  if (ptr) return ptr;
   auto channel_name = GetDiagnosticsChannelName(scope);
   if (auto ch = diagnostics_channel::Channel::Get(env, channel_name)) {
-    channels_.emplace(scope,
-                      BaseObjectWeakPtr<diagnostics_channel::Channel>(ch));
+    weak_ch = BaseObjectWeakPtr<diagnostics_channel::Channel>(ch.get());
     return ch;
   }
   return {};
@@ -315,9 +307,9 @@ BaseObjectPtr<diagnostics_channel::Channel> Permission::GetOrCreateChannel(
 void Permission::Apply(Environment* env,
                        std::span<const std::string> allow,
                        PermissionScope scope) {
-  auto permission = nodes_.find(scope);
-  if (permission != nodes_.end()) {
-    permission->second->Apply(env, allow, scope);
+  auto& perm_node = nodes_[static_cast<size_t>(scope)];
+  if (perm_node) {
+    perm_node->Apply(env, allow, scope);
   }
 }
 
@@ -326,9 +318,9 @@ void Permission::Drop(Environment* env,
                       std::string_view param) {
   CHECK(scope != PermissionScope::kPermissionsRoot &&
         scope != PermissionScope::kPermissionsCount);
-  auto permission = nodes_.find(scope);
-  if (permission != nodes_.end()) {
-    permission->second->Drop(env, scope, param);
+  auto& perm_node = nodes_[static_cast<size_t>(scope)];
+  if (perm_node) {
+    perm_node->Drop(env, scope, param);
   }
 
   // Publish to diagnostics channel so observers can track drops
diff --git a/src/permission/permission.h b/src/permission/permission.h
index dd2d9b16ef81..d93399d07642 100644
--- a/src/permission/permission.h
+++ b/src/permission/permission.h
@@ -18,8 +18,8 @@
 #include "permission/worker_permission.h"
 #include "v8.h"
 
+#include <array>
 #include <string_view>
-#include <unordered_map>
 
 namespace node {
 
@@ -140,14 +140,17 @@ class Permission {
   BaseObjectPtr<diagnostics_channel::Channel> GetOrCreateChannel(
       Environment* env, PermissionScope scope) const;
 
-  std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
+  static constexpr size_t kPermissionCount =
+      static_cast<size_t>(PermissionScope::kPermissionsCount);
+
+  std::array<std::shared_ptr<PermissionBase>, kPermissionCount> nodes_;
   bool enabled_;
   bool warning_only_;
   mutable bool publishing_ = false;
   // Weak refs: BindingData (via BaseObjectPtr) is the sole owner of Channels.
   // Using weak refs here avoids keeping Channels alive past Realm teardown.
-  mutable std::unordered_map<PermissionScope,
-                             BaseObjectWeakPtr<diagnostics_channel::Channel>>
+  mutable std::array<BaseObjectWeakPtr<diagnostics_channel::Channel>,
+                     kPermissionCount>
       channels_;
 };
 

From d4ced88c0920460c284c3da68ad4b73ac69b1cc8 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 18:51:52 -0700
Subject: [PATCH 133/344] src: apply a modest performance perf to permissions

Improve the way the RadixTree works and apply a
fast api call.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/permission/fs_permission.cc | 21 +++++-------
 src/permission/fs_permission.h  | 58 ++++++++++++++++++++-------------
 src/permission/permission.cc    | 49 +++++++++++++++++++++++++++-
 3 files changed, 93 insertions(+), 35 deletions(-)

diff --git a/src/permission/fs_permission.cc b/src/permission/fs_permission.cc
index 89f1c6d70c98..c283fb40f091 100644
--- a/src/permission/fs_permission.cc
+++ b/src/permission/fs_permission.cc
@@ -39,10 +39,8 @@ void FreeRecursivelyNode(
     return;
   }
 
-  if (node->children.size()) {
-    for (auto& c : node->children) {
-      FreeRecursivelyNode(c.second);
-    }
+  for (auto& [label, child] : node->children) {
+    FreeRecursivelyNode(child);
   }
 
   delete node->wildcard_child;
@@ -106,7 +104,7 @@ void PrintTree(const node::permission::FSPermission::RadixTree::Node* node,
         node::DebugCategory::PERMISSION_MODEL, "%s%s\n", indent, node->prefix);
   }
 
-  if (node->children.size() > 0) {
+  if (!node->children.empty()) {
     size_t count = 0;
     size_t total = node->children.size();
 
@@ -120,10 +118,10 @@ void PrintTree(const node::permission::FSPermission::RadixTree::Node* node,
       }
     }
 
-    for (const auto& pair : node->children) {
+    for (const auto& [label, child] : node->children) {
       count++;
       bool child_is_last = (count == total);
-      PrintTree(pair.second, depth + 1, next_branch_prefix, child_is_last);
+      PrintTree(child, depth + 1, next_branch_prefix, child_is_last);
     }
   }
 }
@@ -278,8 +276,8 @@ FSPermission::RadixTree::~RadixTree() {
 }
 
 void FSPermission::RadixTree::Clear() {
-  for (auto& c : root_node_->children) {
-    FreeRecursivelyNode(c.second);
+  for (auto& [label, child] : root_node_->children) {
+    FreeRecursivelyNode(child);
   }
   root_node_->children.clear();
   delete root_node_->wildcard_child;
@@ -294,15 +292,14 @@ bool FSPermission::RadixTree::Lookup(std::string_view s,
     return when_empty_return;
   }
   size_t parent_node_prefix_len = current_node->prefix.length();
-  const std::string path(s);
-  auto path_len = path.length();
+  auto path_len = s.length();
 
   while (true) {
     if (parent_node_prefix_len == path_len && current_node->IsEndNode()) {
       return true;
     }
 
-    auto node = current_node->NextNode(path, parent_node_prefix_len);
+    auto node = current_node->NextNode(s, parent_node_prefix_len);
     if (node == nullptr) {
       return false;
     }
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index 8b15b86426b9..6af29ce7bd1b 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -5,7 +5,7 @@
 
 #include "v8.h"
 
-#include <unordered_map>
+#include <vector>
 #include "permission/permission_base.h"
 #include "util.h"
 
@@ -28,16 +28,30 @@ class FSPermission final : public PermissionBase {
   struct RadixTree {
     struct Node {
       std::string prefix;
-      std::unordered_map<char, Node*> children;
-      Node* wildcard_child;
-      bool is_leaf;
+      std::vector<std::pair<char, Node*>> children;
+      Node* wildcard_child = nullptr;
+      bool is_leaf = false;
 
-      explicit Node(const std::string& pre)
-          : prefix(pre), wildcard_child(nullptr), is_leaf(false) {}
+      explicit Node(std::string_view pre)
+          : prefix(pre) {}
 
-      Node() : wildcard_child(nullptr), is_leaf(false) {}
+      Node() = default;
 
-      Node* CreateChild(const std::string& path_prefix) {
+      Node* FindChild(char label) const {
+        for (const auto& [c, node] : children) {
+          if (c == label) return node;
+        }
+        return nullptr;
+      }
+
+      void SetChild(char label, Node* node) {
+        for (auto& [c, n] : children) {
+          if (c == label) { n = node; return; }
+        }
+        children.emplace_back(label, node);
+      }
+
+      Node* CreateChild(std::string_view path_prefix) {
         if (path_prefix.empty() && !is_leaf) {
           is_leaf = true;
           return this;
@@ -46,10 +60,11 @@ class FSPermission final : public PermissionBase {
         CHECK(!path_prefix.empty());
         char label = path_prefix[0];
 
-        Node* child = children[label];
+        Node* child = FindChild(label);
         if (child == nullptr) {
-          children[label] = new Node(path_prefix);
-          return children[label];
+          child = new Node(path_prefix);
+          children.emplace_back(label, child);
+          return child;
         }
         bool child_was_end_node = child->IsEndNode();
 
@@ -58,13 +73,13 @@ class FSPermission final : public PermissionBase {
         size_t prefix_len = path_prefix.length();
         for (; i < child->prefix.length(); ++i) {
           if (i >= prefix_len || path_prefix[i] != child->prefix[i]) {
-            std::string parent_prefix = child->prefix.substr(0, i);
-            std::string child_prefix = child->prefix.substr(i);
+            std::string parent_prefix(child->prefix.substr(0, i));
+            std::string child_prefix(child->prefix.substr(i));
 
             child->prefix = child_prefix;
             Node* split_child = new Node(parent_prefix);
-            split_child->children[child_prefix[0]] = child;
-            children[parent_prefix[0]] = split_child;
+            split_child->children.emplace_back(child_prefix[0], child);
+            SetChild(parent_prefix[0], split_child);
 
             return split_child->CreateChild(path_prefix.substr(i));
           }
@@ -83,24 +98,23 @@ class FSPermission final : public PermissionBase {
         return wildcard_child;
       }
 
-      Node* NextNode(const std::string& path, size_t idx) const {
+      Node* NextNode(std::string_view path, size_t idx) const {
         if (idx >= path.length()) {
           return nullptr;
         }
 
         // wildcard node takes precedence
         if (children.size() > 1) {
-          auto it = children.find('*');
-          if (it != children.end()) {
-            return it->second;
+          Node* wc = FindChild('*');
+          if (wc != nullptr) {
+            return wc;
           }
         }
 
-        auto it = children.find(path[idx]);
-        if (it == children.end()) {
+        Node* child = FindChild(path[idx]);
+        if (child == nullptr) {
           return nullptr;
         }
-        auto child = it->second;
         // match prefix
         size_t prefix_len = child->prefix.length();
         for (size_t i = 0; i < path.length(); ++i) {
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index fd4b1ab34907..cee5172a9ba2 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -3,12 +3,14 @@
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
 #include "node.h"
+#include "node_debug.h"
 #include "node_diagnostics_channel.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_file.h"
 
 #include "permission/permission_base.h"
+#include "v8-fast-api-calls.h"
 #include "v8-template.h"
 #include "v8.h"
 
@@ -18,13 +20,16 @@
 
 namespace node {
 
+using v8::CFunction;
 using v8::Context;
 using v8::DictionaryTemplate;
+using v8::FastApiCallbackOptions;
 using v8::FunctionCallbackInfo;
 using v8::IntegrityLevel;
 using v8::Local;
 using v8::MaybeLocal;
 using v8::Object;
+using v8::String;
 using v8::Undefined;
 using v8::Value;
 
@@ -121,6 +126,47 @@ static void Has(const FunctionCallbackInfo<Value>& args) {
   return args.GetReturnValue().Set(env->permission()->is_granted(env, scope));
 }
 
+static bool FastHas(Local<Value> receiver,
+                    Local<Value> scope_arg,
+                    Local<Value> resource_arg,
+                    // NOLINTNEXTLINE(runtime/references) This is V8 api.
+                    FastApiCallbackOptions& options) {
+  TRACK_V8_FAST_API_CALL("permission.has");
+  auto isolate = options.isolate;
+  v8::HandleScope handle_scope(isolate);
+  auto context = isolate->GetCurrentContext();
+
+  Environment* env = Environment::GetCurrent(context);
+
+  Local<String> str;
+  if (!scope_arg->ToString(context).ToLocal(&str)) {
+    return false;
+  }
+  Utf8Value utf8_scope(isolate, str);
+  PermissionScope scope =
+      Permission::StringToPermission(utf8_scope.ToStringView());
+  if (scope == PermissionScope::kPermissionsRoot) {
+    return false;
+  }
+
+  if (resource_arg->IsUndefined()) {
+    return env->permission()->is_granted(env, scope);
+  }
+
+  Local<String> res_str;
+  if (!resource_arg->ToString(context).ToLocal(&res_str)) {
+    return false;
+  }
+  Utf8Value utf8_res(isolate, res_str);
+  if (utf8_res.length() == 0) {
+    return false;
+  }
+
+  return env->permission()->is_granted(env, scope, utf8_res.ToStringView());
+}
+
+static CFunction fast_has_(CFunction::Make(FastHas));
+
 }  // namespace
 
 #define V(Name, label, _, __)                                                  \
@@ -349,7 +395,7 @@ void Initialize(Local<Object> target,
                 Local<Value> unused,
                 Local<Context> context,
                 void* priv) {
-  SetMethodNoSideEffect(context, target, "has", Has);
+  SetFastMethodNoSideEffect(context, target, "has", Has, &fast_has_);
   SetMethod(context, target, "drop", Drop);
 
   target->SetIntegrityLevel(context, IntegrityLevel::kFrozen).FromJust();
@@ -357,6 +403,7 @@ void Initialize(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(Has);
+  registry->Register(fast_has_);
   registry->Register(Drop);
 }
 

From 5954b13f887c349aad80e628a8bf9f5e76cc4f37 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 19:06:43 -0700
Subject: [PATCH 134/344] src: simplify includes in permissions

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/permission/child_process_permission.cc |  1 -
 src/permission/child_process_permission.h  |  1 -
 src/permission/ffi_permission.cc           |  1 -
 src/permission/ffi_permission.h            |  1 -
 src/permission/fs_permission.cc            |  7 ++-----
 src/permission/fs_permission.h             |  2 --
 src/permission/net_permission.cc           |  1 -
 src/permission/openssl_store_permission.cc |  1 -
 src/permission/openssl_store_permission.h  |  1 -
 src/permission/permission.cc               | 12 +++++++++---
 src/permission/permission.h                | 11 -----------
 src/permission/wasi_permission.cc          |  1 -
 src/permission/wasi_permission.h           |  1 -
 src/permission/worker_permission.cc        |  1 -
 src/permission/worker_permission.h         |  1 -
 15 files changed, 11 insertions(+), 32 deletions(-)

diff --git a/src/permission/child_process_permission.cc b/src/permission/child_process_permission.cc
index 25c9713e0570..2f1c1796db15 100644
--- a/src/permission/child_process_permission.cc
+++ b/src/permission/child_process_permission.cc
@@ -1,7 +1,6 @@
 #include "child_process_permission.h"
 
 #include <string>
-#include <vector>
 
 namespace node {
 
diff --git a/src/permission/child_process_permission.h b/src/permission/child_process_permission.h
index 59ab74bb5116..1454c8eef51b 100644
--- a/src/permission/child_process_permission.h
+++ b/src/permission/child_process_permission.h
@@ -3,7 +3,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <vector>
 #include "permission/permission_base.h"
 
 namespace node {
diff --git a/src/permission/ffi_permission.cc b/src/permission/ffi_permission.cc
index 674394144471..2989ae4179af 100644
--- a/src/permission/ffi_permission.cc
+++ b/src/permission/ffi_permission.cc
@@ -1,7 +1,6 @@
 #include "permission/ffi_permission.h"
 
 #include <string>
-#include <vector>
 
 namespace node {
 
diff --git a/src/permission/ffi_permission.h b/src/permission/ffi_permission.h
index fcb8b403c725..9562fce9f54a 100644
--- a/src/permission/ffi_permission.h
+++ b/src/permission/ffi_permission.h
@@ -3,7 +3,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <vector>
 #include "permission/permission_base.h"
 
 namespace node {
diff --git a/src/permission/fs_permission.cc b/src/permission/fs_permission.cc
index c283fb40f091..b2f3cbb31a6e 100644
--- a/src/permission/fs_permission.cc
+++ b/src/permission/fs_permission.cc
@@ -1,15 +1,12 @@
 #include "fs_permission.h"
-#include "base_object-inl.h"
 #include "debug_utils-inl.h"
 #include "env.h"
 #include "path.h"
-#include "v8.h"
 
 #include <fcntl.h>
-#include <limits.h>
-#include <stdlib.h>
 #include <algorithm>
-#include <filesystem>
+#include <climits>
+#include <cstdlib>
 #include <string>
 #include <string_view>
 #include <vector>
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index 6af29ce7bd1b..e26c7a44feaa 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -3,8 +3,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include "v8.h"
-
 #include <vector>
 #include "permission/permission_base.h"
 #include "util.h"
diff --git a/src/permission/net_permission.cc b/src/permission/net_permission.cc
index da42215ecfdc..10b635e82e6d 100644
--- a/src/permission/net_permission.cc
+++ b/src/permission/net_permission.cc
@@ -1,6 +1,5 @@
 #include "net_permission.h"
 
-#include <iostream>
 #include <string>
 
 namespace node {
diff --git a/src/permission/openssl_store_permission.cc b/src/permission/openssl_store_permission.cc
index e799b5373344..11d4ff82faf8 100644
--- a/src/permission/openssl_store_permission.cc
+++ b/src/permission/openssl_store_permission.cc
@@ -1,7 +1,6 @@
 #include "permission/openssl_store_permission.h"
 
 #include <string>
-#include <vector>
 
 namespace node {
 
diff --git a/src/permission/openssl_store_permission.h b/src/permission/openssl_store_permission.h
index 8cac21f9f288..418e93e0d899 100644
--- a/src/permission/openssl_store_permission.h
+++ b/src/permission/openssl_store_permission.h
@@ -3,7 +3,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <vector>
 #include "permission/permission_base.h"
 
 namespace node {
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index cee5172a9ba2..e7e8ba6b2ea2 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -1,7 +1,5 @@
 #include "permission.h"
-#include "base_object-inl.h"
 #include "env-inl.h"
-#include "memory_tracker-inl.h"
 #include "node.h"
 #include "node_debug.h"
 #include "node_diagnostics_channel.h"
@@ -9,6 +7,15 @@
 #include "node_external_reference.h"
 #include "node_file.h"
 
+#include "permission/addon_permission.h"
+#include "permission/child_process_permission.h"
+#include "permission/ffi_permission.h"
+#include "permission/fs_permission.h"
+#include "permission/inspector_permission.h"
+#include "permission/net_permission.h"
+#include "permission/openssl_store_permission.h"
+#include "permission/wasi_permission.h"
+#include "permission/worker_permission.h"
 #include "permission/permission_base.h"
 #include "v8-fast-api-calls.h"
 #include "v8-template.h"
@@ -16,7 +23,6 @@
 
 #include <memory>
 #include <string>
-#include <vector>
 
 namespace node {
 
diff --git a/src/permission/permission.h b/src/permission/permission.h
index d93399d07642..6ed211f955b4 100644
--- a/src/permission/permission.h
+++ b/src/permission/permission.h
@@ -5,18 +5,7 @@
 
 #include "debug_utils.h"
 #include "node_diagnostics_channel.h"
-#include "node_options.h"
-#include "permission/addon_permission.h"
-#include "permission/child_process_permission.h"
-#include "permission/ffi_permission.h"
-#include "permission/fs_permission.h"
-#include "permission/inspector_permission.h"
-#include "permission/net_permission.h"
-#include "permission/openssl_store_permission.h"
 #include "permission/permission_base.h"
-#include "permission/wasi_permission.h"
-#include "permission/worker_permission.h"
-#include "v8.h"
 
 #include <array>
 #include <string_view>
diff --git a/src/permission/wasi_permission.cc b/src/permission/wasi_permission.cc
index cf3be848c31f..5891edc92aa3 100644
--- a/src/permission/wasi_permission.cc
+++ b/src/permission/wasi_permission.cc
@@ -1,7 +1,6 @@
 #include "permission/wasi_permission.h"
 
 #include <string>
-#include <vector>
 
 namespace node {
 
diff --git a/src/permission/wasi_permission.h b/src/permission/wasi_permission.h
index 1d341c1a7334..fbca0e4e0879 100644
--- a/src/permission/wasi_permission.h
+++ b/src/permission/wasi_permission.h
@@ -3,7 +3,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <vector>
 #include "permission/permission_base.h"
 
 namespace node {
diff --git a/src/permission/worker_permission.cc b/src/permission/worker_permission.cc
index 395876d29cce..bdf0519d3bb0 100644
--- a/src/permission/worker_permission.cc
+++ b/src/permission/worker_permission.cc
@@ -1,7 +1,6 @@
 #include "permission/worker_permission.h"
 
 #include <string>
-#include <vector>
 
 namespace node {
 
diff --git a/src/permission/worker_permission.h b/src/permission/worker_permission.h
index 4480b75646d2..ba4b45319ba9 100644
--- a/src/permission/worker_permission.h
+++ b/src/permission/worker_permission.h
@@ -3,7 +3,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <vector>
 #include "permission/permission_base.h"
 
 namespace node {

From 981cfa537d2dbb54b312f79ad82428a261761a51 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 19:21:40 -0700
Subject: [PATCH 135/344] src: simplify permissions with BooleanPermissions

Most of the PermissionBase subclasses used the identical
simple pattern. Rather than define a bunch of individual
identical permissions, use a single utility definition.
Special cases like FsPermission are still possible but
the simple case is kept... well, simple.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 node.gyp                                   | 18 +-------
 src/permission/addon_permission.cc         | 30 ------------
 src/permission/addon_permission.h          | 34 --------------
 src/permission/boolean_permission.h        | 54 ++++++++++++++++++++++
 src/permission/child_process_permission.cc | 30 ------------
 src/permission/child_process_permission.h  | 33 -------------
 src/permission/ffi_permission.cc           | 29 ------------
 src/permission/ffi_permission.h            | 33 -------------
 src/permission/fs_permission.h             |  8 ++--
 src/permission/inspector_permission.cc     | 30 ------------
 src/permission/inspector_permission.h      | 34 --------------
 src/permission/net_permission.cc           | 28 -----------
 src/permission/net_permission.h            | 34 --------------
 src/permission/openssl_store_permission.cc | 30 ------------
 src/permission/openssl_store_permission.h  | 33 -------------
 src/permission/permission.cc               | 45 +++---------------
 src/permission/wasi_permission.cc          | 30 ------------
 src/permission/wasi_permission.h           | 33 -------------
 src/permission/worker_permission.cc        | 30 ------------
 src/permission/worker_permission.h         | 33 -------------
 20 files changed, 68 insertions(+), 561 deletions(-)
 delete mode 100644 src/permission/addon_permission.cc
 delete mode 100644 src/permission/addon_permission.h
 create mode 100644 src/permission/boolean_permission.h
 delete mode 100644 src/permission/child_process_permission.cc
 delete mode 100644 src/permission/child_process_permission.h
 delete mode 100644 src/permission/ffi_permission.cc
 delete mode 100644 src/permission/ffi_permission.h
 delete mode 100644 src/permission/inspector_permission.cc
 delete mode 100644 src/permission/inspector_permission.h
 delete mode 100644 src/permission/net_permission.cc
 delete mode 100644 src/permission/net_permission.h
 delete mode 100644 src/permission/openssl_store_permission.cc
 delete mode 100644 src/permission/openssl_store_permission.h
 delete mode 100644 src/permission/wasi_permission.cc
 delete mode 100644 src/permission/wasi_permission.h
 delete mode 100644 src/permission/worker_permission.cc
 delete mode 100644 src/permission/worker_permission.h

diff --git a/node.gyp b/node.gyp
index 82913b344b29..66196b411062 100644
--- a/node.gyp
+++ b/node.gyp
@@ -177,16 +177,8 @@
       'src/node_worker.cc',
       'src/node_zlib.cc',
       'src/path.cc',
-      'src/permission/child_process_permission.cc',
-      'src/permission/openssl_store_permission.cc',
-      'src/permission/ffi_permission.cc',
       'src/permission/fs_permission.cc',
-      'src/permission/inspector_permission.cc',
       'src/permission/permission.cc',
-      'src/permission/wasi_permission.cc',
-      'src/permission/worker_permission.cc',
-      'src/permission/net_permission.cc',
-      'src/permission/addon_permission.cc',
       'src/pipe_wrap.cc',
       'src/process_wrap.cc',
       'src/signal_wrap.cc',
@@ -314,16 +306,10 @@
       'src/node_watchdog.h',
       'src/node_worker.h',
       'src/path.h',
-      'src/permission/child_process_permission.h',
-      'src/permission/openssl_store_permission.h',
-      'src/permission/ffi_permission.h',
+      'src/permission/boolean_permission.h',
       'src/permission/fs_permission.h',
-      'src/permission/inspector_permission.h',
       'src/permission/permission.h',
-      'src/permission/wasi_permission.h',
-      'src/permission/worker_permission.h',
-      'src/permission/net_permission.h',
-      'src/permission/addon_permission.h',
+      'src/permission/permission_base.h',
       'src/pipe_wrap.h',
       'src/req_wrap.h',
       'src/req_wrap-inl.h',
diff --git a/src/permission/addon_permission.cc b/src/permission/addon_permission.cc
deleted file mode 100644
index 249b266c5919..000000000000
--- a/src/permission/addon_permission.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-#include "addon_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-// Currently, Addon manage a single state
-// Once denied, it's always denied
-void AddonPermission::Apply(Environment* env,
-                            std::span<const std::string> allow,
-                            PermissionScope scope) {
-  deny_all_ = true;
-}
-
-void AddonPermission::Drop(Environment* env,
-                           PermissionScope scope,
-                           std::string_view param) {
-  deny_all_ = true;
-}
-
-bool AddonPermission::is_granted(Environment* env,
-                                 PermissionScope perm,
-                                 std::string_view param) const {
-  return deny_all_ == false;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/addon_permission.h b/src/permission/addon_permission.h
deleted file mode 100644
index 04e2ed6fed9a..000000000000
--- a/src/permission/addon_permission.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef SRC_PERMISSION_ADDON_PERMISSION_H_
-#define SRC_PERMISSION_ADDON_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include <string>
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class AddonPermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool deny_all_;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_ADDON_PERMISSION_H_
diff --git a/src/permission/boolean_permission.h b/src/permission/boolean_permission.h
new file mode 100644
index 000000000000..d1a30972dcee
--- /dev/null
+++ b/src/permission/boolean_permission.h
@@ -0,0 +1,54 @@
+#ifndef SRC_PERMISSION_BOOLEAN_PERMISSION_H_
+#define SRC_PERMISSION_BOOLEAN_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+// A simple boolean permission that either denies or allows access.
+// Used for permission scopes that don't need per-resource granularity.
+template <bool deny_only>
+class BooleanPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             std::span<const std::string> allow,
+             PermissionScope scope) override {
+    flag_ = true;
+  }
+
+  void Drop(Environment* env,
+            PermissionScope scope,
+            std::string_view param) override {
+    flag_ = deny_only;
+  }
+
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  std::string_view param) const override {
+    if constexpr (deny_only) {
+      return !flag_;
+    } else {
+      return flag_;
+    }
+  }
+
+ private:
+  bool flag_ = false;
+};
+
+// Once denied, the permission cannot be re-granted.
+using DenyOnlyPermission = BooleanPermission<true>;
+
+// Apply grants access, Drop revokes.
+using AllowRevokePermission = BooleanPermission<false>;
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_BOOLEAN_PERMISSION_H_
diff --git a/src/permission/child_process_permission.cc b/src/permission/child_process_permission.cc
deleted file mode 100644
index 2f1c1796db15..000000000000
--- a/src/permission/child_process_permission.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-#include "child_process_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-// Currently, ChildProcess manage a single state
-// Once denied, it's always denied
-void ChildProcessPermission::Apply(Environment* env,
-                                   std::span<const std::string> allow,
-                                   PermissionScope scope) {
-  deny_all_ = true;
-}
-
-void ChildProcessPermission::Drop(Environment* env,
-                                  PermissionScope scope,
-                                  std::string_view param) {
-  deny_all_ = true;
-}
-
-bool ChildProcessPermission::is_granted(Environment* env,
-                                        PermissionScope perm,
-                                        std::string_view param) const {
-  return deny_all_ == false;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/child_process_permission.h b/src/permission/child_process_permission.h
deleted file mode 100644
index 1454c8eef51b..000000000000
--- a/src/permission/child_process_permission.h
+++ /dev/null
@@ -1,33 +0,0 @@
-#ifndef SRC_PERMISSION_CHILD_PROCESS_PERMISSION_H_
-#define SRC_PERMISSION_CHILD_PROCESS_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class ChildProcessPermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool deny_all_;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_CHILD_PROCESS_PERMISSION_H_
diff --git a/src/permission/ffi_permission.cc b/src/permission/ffi_permission.cc
deleted file mode 100644
index 2989ae4179af..000000000000
--- a/src/permission/ffi_permission.cc
+++ /dev/null
@@ -1,29 +0,0 @@
-#include "permission/ffi_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-// Currently, FFIPermission manages a single global deny state for FFI.
-void FFIPermission::Apply(Environment* env,
-                          std::span<const std::string> allow,
-                          PermissionScope scope) {
-  deny_all_ = true;
-}
-
-void FFIPermission::Drop(Environment* env,
-                         PermissionScope scope,
-                         std::string_view param) {
-  deny_all_ = true;
-}
-
-bool FFIPermission::is_granted(Environment* env,
-                               PermissionScope perm,
-                               std::string_view param) const {
-  return perm != PermissionScope::kFFI || !deny_all_;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/ffi_permission.h b/src/permission/ffi_permission.h
deleted file mode 100644
index 9562fce9f54a..000000000000
--- a/src/permission/ffi_permission.h
+++ /dev/null
@@ -1,33 +0,0 @@
-#ifndef SRC_PERMISSION_FFI_PERMISSION_H_
-#define SRC_PERMISSION_FFI_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class FFIPermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool deny_all_ = false;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_FFI_PERMISSION_H_
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index e26c7a44feaa..3fdb0542f681 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -30,8 +30,7 @@ class FSPermission final : public PermissionBase {
       Node* wildcard_child = nullptr;
       bool is_leaf = false;
 
-      explicit Node(std::string_view pre)
-          : prefix(pre) {}
+      explicit Node(std::string_view pre) : prefix(pre) {}
 
       Node() = default;
 
@@ -44,7 +43,10 @@ class FSPermission final : public PermissionBase {
 
       void SetChild(char label, Node* node) {
         for (auto& [c, n] : children) {
-          if (c == label) { n = node; return; }
+          if (c == label) {
+            n = node;
+            return;
+          }
         }
         children.emplace_back(label, node);
       }
diff --git a/src/permission/inspector_permission.cc b/src/permission/inspector_permission.cc
deleted file mode 100644
index d884ec4d8208..000000000000
--- a/src/permission/inspector_permission.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-#include "inspector_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-// Currently, Inspector manage a single state
-// Once denied, it's always denied
-void InspectorPermission::Apply(Environment* env,
-                                std::span<const std::string> allow,
-                                PermissionScope scope) {
-  deny_all_ = true;
-}
-
-void InspectorPermission::Drop(Environment* env,
-                               PermissionScope scope,
-                               std::string_view param) {
-  deny_all_ = true;
-}
-
-bool InspectorPermission::is_granted(Environment* env,
-                                     PermissionScope perm,
-                                     std::string_view param) const {
-  return deny_all_ == false;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/inspector_permission.h b/src/permission/inspector_permission.h
deleted file mode 100644
index 2490149caa91..000000000000
--- a/src/permission/inspector_permission.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef SRC_PERMISSION_INSPECTOR_PERMISSION_H_
-#define SRC_PERMISSION_INSPECTOR_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include <string>
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class InspectorPermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool deny_all_;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_INSPECTOR_PERMISSION_H_
diff --git a/src/permission/net_permission.cc b/src/permission/net_permission.cc
deleted file mode 100644
index 10b635e82e6d..000000000000
--- a/src/permission/net_permission.cc
+++ /dev/null
@@ -1,28 +0,0 @@
-#include "net_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-void NetPermission::Apply(Environment* env,
-                          std::span<const std::string> allow,
-                          PermissionScope scope) {
-  allow_net_ = true;
-}
-
-void NetPermission::Drop(Environment* env,
-                         PermissionScope scope,
-                         std::string_view param) {
-  allow_net_ = false;
-}
-
-bool NetPermission::is_granted(Environment* env,
-                               PermissionScope perm,
-                               std::string_view param) const {
-  return allow_net_;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/net_permission.h b/src/permission/net_permission.h
deleted file mode 100644
index 23b643a50222..000000000000
--- a/src/permission/net_permission.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef SRC_PERMISSION_NET_PERMISSION_H_
-#define SRC_PERMISSION_NET_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include <string>
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class NetPermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool allow_net_ = false;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_NET_PERMISSION_H_
diff --git a/src/permission/openssl_store_permission.cc b/src/permission/openssl_store_permission.cc
deleted file mode 100644
index 11d4ff82faf8..000000000000
--- a/src/permission/openssl_store_permission.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-#include "permission/openssl_store_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-// OpenSSLStorePermission manages a single global deny state for the use of
-// OpenSSL STORE loaders.
-void OpenSSLStorePermission::Apply(Environment* env,
-                                   std::span<const std::string> allow,
-                                   PermissionScope scope) {
-  deny_all_ = true;
-}
-
-void OpenSSLStorePermission::Drop(Environment* env,
-                                  PermissionScope scope,
-                                  std::string_view param) {
-  deny_all_ = true;
-}
-
-bool OpenSSLStorePermission::is_granted(Environment* env,
-                                        PermissionScope perm,
-                                        std::string_view param) const {
-  return perm != PermissionScope::kOpenSSLStore || !deny_all_;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/openssl_store_permission.h b/src/permission/openssl_store_permission.h
deleted file mode 100644
index 418e93e0d899..000000000000
--- a/src/permission/openssl_store_permission.h
+++ /dev/null
@@ -1,33 +0,0 @@
-#ifndef SRC_PERMISSION_OPENSSL_STORE_PERMISSION_H_
-#define SRC_PERMISSION_OPENSSL_STORE_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class OpenSSLStorePermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool deny_all_ = false;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_OPENSSL_STORE_PERMISSION_H_
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index e7e8ba6b2ea2..9bf1ee21e0af 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -7,15 +7,8 @@
 #include "node_external_reference.h"
 #include "node_file.h"
 
-#include "permission/addon_permission.h"
-#include "permission/child_process_permission.h"
-#include "permission/ffi_permission.h"
+#include "permission/boolean_permission.h"
 #include "permission/fs_permission.h"
-#include "permission/inspector_permission.h"
-#include "permission/net_permission.h"
-#include "permission/openssl_store_permission.h"
-#include "permission/wasi_permission.h"
-#include "permission/worker_permission.h"
 #include "permission/permission_base.h"
 #include "v8-fast-api-calls.h"
 #include "v8-template.h"
@@ -194,49 +187,25 @@ PermissionScope Permission::StringToPermission(std::string_view perm) {
 
 Permission::Permission() : enabled_(false), warning_only_(false) {
   auto fs = std::make_shared<FSPermission>();
-  auto child_p = std::make_shared<ChildProcessPermission>();
-  auto worker_t = std::make_shared<WorkerPermission>();
-  auto inspector = std::make_shared<InspectorPermission>();
-  auto wasi = std::make_shared<WASIPermission>();
-  auto net = std::make_shared<NetPermission>();
-  auto addon = std::make_shared<AddonPermission>();
-  auto ffi = std::make_shared<FFIPermission>();
-  auto openssl_store = std::make_shared<OpenSSLStorePermission>();
 #define V(Name, _, __, ___)                                                    \
   nodes_[static_cast<size_t>(PermissionScope::k##Name)] = fs;
   FILESYSTEM_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = child_p;
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] =                      \
+      std::make_shared<DenyOnlyPermission>();
   CHILD_PROCESS_PERMISSIONS(V)
-#undef V
-#define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = worker_t;
   WORKER_THREADS_PERMISSIONS(V)
-#undef V
-#define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = inspector;
   INSPECTOR_PERMISSIONS(V)
-#undef V
-#define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = wasi;
   WASI_PERMISSIONS(V)
-#undef V
-#define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = net;
-  NET_PERMISSIONS(V)
-#undef V
-#define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = addon;
   ADDON_PERMISSIONS(V)
-#undef V
-#define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = ffi;
   FFI_PERMISSIONS(V)
+  OPENSSL_STORE_PERMISSIONS(V)
 #undef V
 #define V(Name, _, __, ___)                                                    \
-  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = openssl_store;
-  OPENSSL_STORE_PERMISSIONS(V)
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] =                      \
+      std::make_shared<AllowRevokePermission>();
+  NET_PERMISSIONS(V)
 #undef V
 }
 
diff --git a/src/permission/wasi_permission.cc b/src/permission/wasi_permission.cc
deleted file mode 100644
index 5891edc92aa3..000000000000
--- a/src/permission/wasi_permission.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-#include "permission/wasi_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-// Currently, WASIPermission manage a single state
-// Once denied, it's always denied
-void WASIPermission::Apply(Environment* env,
-                           std::span<const std::string> allow,
-                           PermissionScope scope) {
-  deny_all_ = true;
-}
-
-void WASIPermission::Drop(Environment* env,
-                          PermissionScope scope,
-                          std::string_view param) {
-  deny_all_ = true;
-}
-
-bool WASIPermission::is_granted(Environment* env,
-                                PermissionScope perm,
-                                std::string_view param) const {
-  return deny_all_ == false;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/wasi_permission.h b/src/permission/wasi_permission.h
deleted file mode 100644
index fbca0e4e0879..000000000000
--- a/src/permission/wasi_permission.h
+++ /dev/null
@@ -1,33 +0,0 @@
-#ifndef SRC_PERMISSION_WASI_PERMISSION_H_
-#define SRC_PERMISSION_WASI_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class WASIPermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool deny_all_;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_WASI_PERMISSION_H_
diff --git a/src/permission/worker_permission.cc b/src/permission/worker_permission.cc
deleted file mode 100644
index bdf0519d3bb0..000000000000
--- a/src/permission/worker_permission.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-#include "permission/worker_permission.h"
-
-#include <string>
-
-namespace node {
-
-namespace permission {
-
-// Currently, PolicyDenyWorker manage a single state
-// Once denied, it's always denied
-void WorkerPermission::Apply(Environment* env,
-                             std::span<const std::string> allow,
-                             PermissionScope scope) {
-  deny_all_ = true;
-}
-
-void WorkerPermission::Drop(Environment* env,
-                            PermissionScope scope,
-                            std::string_view param) {
-  deny_all_ = true;
-}
-
-bool WorkerPermission::is_granted(Environment* env,
-                                  PermissionScope perm,
-                                  std::string_view param) const {
-  return deny_all_ == false;
-}
-
-}  // namespace permission
-}  // namespace node
diff --git a/src/permission/worker_permission.h b/src/permission/worker_permission.h
deleted file mode 100644
index ba4b45319ba9..000000000000
--- a/src/permission/worker_permission.h
+++ /dev/null
@@ -1,33 +0,0 @@
-#ifndef SRC_PERMISSION_WORKER_PERMISSION_H_
-#define SRC_PERMISSION_WORKER_PERMISSION_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include "permission/permission_base.h"
-
-namespace node {
-
-namespace permission {
-
-class WorkerPermission final : public PermissionBase {
- public:
-  void Apply(Environment* env,
-             std::span<const std::string> allow,
-             PermissionScope scope) override;
-  void Drop(Environment* env,
-            PermissionScope scope,
-            std::string_view param) override;
-  bool is_granted(Environment* env,
-                  PermissionScope perm,
-                  std::string_view param) const override;
-
- private:
-  bool deny_all_;
-};
-
-}  // namespace permission
-
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#endif  // SRC_PERMISSION_WORKER_PERMISSION_H_

From 3a47f1f2820999e1e643a72ecf73d1fe551027ce Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 19:25:37 -0700
Subject: [PATCH 136/344] src: apply minor namespace format tweak in
 permissions

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/permission/boolean_permission.h |  8 ++------
 src/permission/fs_permission.h      | 17 ++++++++---------
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/src/permission/boolean_permission.h b/src/permission/boolean_permission.h
index d1a30972dcee..f2fdc8a7f90f 100644
--- a/src/permission/boolean_permission.h
+++ b/src/permission/boolean_permission.h
@@ -5,9 +5,7 @@
 
 #include "permission/permission_base.h"
 
-namespace node {
-
-namespace permission {
+namespace node::permission {
 
 // A simple boolean permission that either denies or allows access.
 // Used for permission scopes that don't need per-resource granularity.
@@ -46,9 +44,7 @@ using DenyOnlyPermission = BooleanPermission<true>;
 // Apply grants access, Drop revokes.
 using AllowRevokePermission = BooleanPermission<false>;
 
-}  // namespace permission
-
-}  // namespace node
+}  // namespace node::permission
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 #endif  // SRC_PERMISSION_BOOLEAN_PERMISSION_H_
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index 3fdb0542f681..f2e1720ed9bd 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -7,9 +7,7 @@
 #include "permission/permission_base.h"
 #include "util.h"
 
-namespace node {
-
-namespace permission {
+namespace node::permission {
 
 class FSPermission final : public PermissionBase {
  public:
@@ -125,9 +123,12 @@ class FSPermission final : public PermissionBase {
           // Handle optional trailing
           // path = /home/subdirectory
           // child = subdirectory/*
-          if (idx >= path.length() &&
-              child->prefix[i] == node::kPathSeparator) {
-            continue;
+          if (idx >= path.length()) {
+            if (child->prefix[i] == node::kPathSeparator) {
+              continue;
+            }
+            // Path is exhausted but prefix expects more characters
+            return nullptr;
           }
 
           if (path[idx++] != child->prefix[i]) {
@@ -185,9 +186,7 @@ class FSPermission final : public PermissionBase {
   bool allow_all_out_ = false;
 };
 
-}  // namespace permission
-
-}  // namespace node
+}  // namespace node::permission
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 #endif  // SRC_PERMISSION_FS_PERMISSION_H_

From bf86fab458911a06a0f27c3ebb570798bd2990ac Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 22:19:37 -0700
Subject: [PATCH 137/344] test: add permission fast api test

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65158
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/permission/permission.cc                  | 38 ++++++++++++++++---
 src/util.cc                                   | 25 ++++++++++++
 src/util.h                                    |  6 +++
 test/parallel/test-permission-has-fast-api.js | 38 +++++++++++++++++++
 4 files changed, 101 insertions(+), 6 deletions(-)
 create mode 100644 test/parallel/test-permission-has-fast-api.js

diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 9bf1ee21e0af..29449c0ec028 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -127,7 +127,6 @@ static void Has(const FunctionCallbackInfo<Value>& args) {
 
 static bool FastHas(Local<Value> receiver,
                     Local<Value> scope_arg,
-                    Local<Value> resource_arg,
                     // NOLINTNEXTLINE(runtime/references) This is V8 api.
                     FastApiCallbackOptions& options) {
   TRACK_V8_FAST_API_CALL("permission.has");
@@ -148,8 +147,31 @@ static bool FastHas(Local<Value> receiver,
     return false;
   }
 
-  if (resource_arg->IsUndefined()) {
-    return env->permission()->is_granted(env, scope);
+  return env->permission()->is_granted(env, scope);
+}
+
+static bool FastHasResource(
+    Local<Value> receiver,
+    Local<Value> scope_arg,
+    Local<Value> resource_arg,
+    // NOLINTNEXTLINE(runtime/references) This is V8 api.
+    FastApiCallbackOptions& options) {
+  TRACK_V8_FAST_API_CALL("permission.has");
+  auto isolate = options.isolate;
+  v8::HandleScope handle_scope(isolate);
+  auto context = isolate->GetCurrentContext();
+
+  Environment* env = Environment::GetCurrent(context);
+
+  Local<String> str;
+  if (!scope_arg->ToString(context).ToLocal(&str)) {
+    return false;
+  }
+  Utf8Value utf8_scope(isolate, str);
+  PermissionScope scope =
+      Permission::StringToPermission(utf8_scope.ToStringView());
+  if (scope == PermissionScope::kPermissionsRoot) {
+    return false;
   }
 
   Local<String> res_str;
@@ -164,7 +186,8 @@ static bool FastHas(Local<Value> receiver,
   return env->permission()->is_granted(env, scope, utf8_res.ToStringView());
 }
 
-static CFunction fast_has_(CFunction::Make(FastHas));
+static CFunction fast_has_methods_[] = {CFunction::Make(FastHas),
+                                        CFunction::Make(FastHasResource)};
 
 }  // namespace
 
@@ -370,7 +393,8 @@ void Initialize(Local<Object> target,
                 Local<Value> unused,
                 Local<Context> context,
                 void* priv) {
-  SetFastMethodNoSideEffect(context, target, "has", Has, &fast_has_);
+  SetFastMethodNoSideEffect(
+      context, target, "has", Has, {fast_has_methods_, 2});
   SetMethod(context, target, "drop", Drop);
 
   target->SetIntegrityLevel(context, IntegrityLevel::kFrozen).FromJust();
@@ -378,7 +402,9 @@ void Initialize(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(Has);
-  registry->Register(fast_has_);
+  for (const CFunction& method : fast_has_methods_) {
+    registry->Register(method);
+  }
   registry->Register(Drop);
 }
 
diff --git a/src/util.cc b/src/util.cc
index 317b8db0daac..ce45c1ad4ede 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -468,6 +468,31 @@ void SetFastMethodNoSideEffect(
   that->Set(name_string, t);
 }
 
+void SetFastMethodNoSideEffect(
+    Local<v8::Context> context,
+    Local<v8::Object> that,
+    const std::string_view name,
+    v8::FunctionCallback slow_callback,
+    const v8::MemorySpan<const v8::CFunction>& methods) {
+  Isolate* isolate = Isolate::GetCurrent();
+  Local<v8::Function> function = FunctionTemplate::NewWithCFunctionOverloads(
+                                     isolate,
+                                     slow_callback,
+                                     Local<Value>(),
+                                     Local<v8::Signature>(),
+                                     0,
+                                     v8::ConstructorBehavior::kThrow,
+                                     v8::SideEffectType::kHasNoSideEffect,
+                                     methods)
+                                     ->GetFunction(context)
+                                     .ToLocalChecked();
+  const v8::NewStringType type = v8::NewStringType::kInternalized;
+  Local<v8::String> name_string =
+      v8::String::NewFromUtf8(isolate, name.data(), type, name.size())
+          .ToLocalChecked();
+  that->Set(context, name_string, function).Check();
+}
+
 void SetMethodNoSideEffect(Local<v8::Context> context,
                            Local<v8::Object> that,
                            const std::string_view name,
diff --git a/src/util.h b/src/util.h
index 5e9bf2b1cdab..0461a5ebb19f 100644
--- a/src/util.h
+++ b/src/util.h
@@ -912,6 +912,12 @@ void SetFastMethodNoSideEffect(
     const std::string_view name,
     v8::FunctionCallback slow_callback,
     const v8::MemorySpan<const v8::CFunction>& methods);
+void SetFastMethodNoSideEffect(
+    v8::Local<v8::Context> context,
+    v8::Local<v8::Object> that,
+    const std::string_view name,
+    v8::FunctionCallback slow_callback,
+    const v8::MemorySpan<const v8::CFunction>& methods);
 void SetProtoMethod(v8::Isolate* isolate,
                     v8::Local<v8::FunctionTemplate> that,
                     const std::string_view name,
diff --git a/test/parallel/test-permission-has-fast-api.js b/test/parallel/test-permission-has-fast-api.js
new file mode 100644
index 000000000000..526ee4f20944
--- /dev/null
+++ b/test/parallel/test-permission-has-fast-api.js
@@ -0,0 +1,38 @@
+// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-natives-syntax --expose-internals --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { internalBinding } = require('internal/test/binding');
+const path = require('path');
+
+// Test that process.permission.has() uses the V8 fast API path.
+
+// Test with scope only (no resource argument).
+function testHasScope() {
+  assert.strictEqual(process.permission.has('fs.read', __filename), true);
+  assert.strictEqual(process.permission.has('fs.write', __dirname), true);
+  assert.strictEqual(
+    process.permission.has('fs.read', path.resolve('/nonexistent')),
+    true
+  );
+  assert.strictEqual(process.permission.has('fs.read'), true);
+  assert.strictEqual(process.permission.has('fs.write'), true);
+  assert.strictEqual(process.permission.has('child'), false);
+  assert.strictEqual(process.permission.has('worker'), false);
+  assert.strictEqual(process.permission.has('invalid-key'), false);
+}
+
+// Warm up and optimize for the fast API path.
+eval('%PrepareFunctionForOptimization(testHasScope)');
+testHasScope();
+testHasScope();
+
+eval('%OptimizeFunctionOnNextCall(testHasScope)');
+testHasScope();
+
+if (common.isDebug) {
+  const { getV8FastApiCallCount } = internalBinding('debug');
+  // After optimization: testHasScope = 4, testHasResource = 3, testHasInvalid = 1
+  assert.strictEqual(getV8FastApiCallCount('permission.has'), 8);
+}

From 5b5509d0d362a34112ec9529fadf31b4aa1a90d0 Mon Sep 17 00:00:00 2001
From: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date: Wed, 12 Aug 2026 15:23:46 -0300
Subject: [PATCH 138/344] doc: create ai-guidelines and include to CONTRIBUTING
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Beth Griggs <bethanyngriggs@gmail.com>
Co-authored-by: Aditi <62544124+Aditi-1400@users.noreply.github.com>
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Co-authored-by: Tobias Nießen <tniessen@tnie.de>
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Co-authored-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Co-authored-by: Efe <dogukankrskl@gmail.com>
Co-authored-by: James M Snell <jasnell@gmail.com>
Co-authored-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/62105
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aditi Singh <aditisingh1400@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
---
 CONTRIBUTING.md                   | 10 ++++
 doc/contributing/ai-guidelines.md | 98 +++++++++++++++++++++++++++++++
 2 files changed, 108 insertions(+)
 create mode 100644 doc/contributing/ai-guidelines.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b47b9868461b..90a8a1d50f4f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,6 +25,7 @@ works.
 * [Issues](#issues)
 * [Pull Requests](#pull-requests)
 * [Automation and bots](#automation-and-bots)
+* [AI Use Policy and Guidelines](#ai-use-policy-and-guidelines)
 * [Developer's Certificate of Origin 1.1](#developers-certificate-of-origin-11)
 
 ## [Code of Conduct](./doc/contributing/code-of-conduct.md)
@@ -66,6 +67,15 @@ by an automation that was not authorized by Node.js collaborators are
 subject to immediate moderation enforcement on the automation and owner
 without notice.
 
+## [AI Use Policy and Guidelines](./doc/contributing/ai-guidelines.md)
+
+Node.js requires contributors to understand and take full responsibility for
+every change they propose. Pull requests containing AI-generated code the
+contributor has not personally understood, tested, and verified will likely be closed
+without review.
+
+See [details on our AI use policy and guidelines](./doc/contributing/ai-guidelines.md).
+
 ## Developer's Certificate of Origin 1.1
 
 ```text
diff --git a/doc/contributing/ai-guidelines.md b/doc/contributing/ai-guidelines.md
new file mode 100644
index 000000000000..baebe5dc6c80
--- /dev/null
+++ b/doc/contributing/ai-guidelines.md
@@ -0,0 +1,98 @@
+# AI use policy and guidelines
+
+* [Core principle](#core-principle)
+* [When AI is used in contributions](#when-ai-is-used-in-contributions)
+* [When AI is used in communications](#when-ai-is-used-in-communications)
+
+This document aligns with the [OpenJS Foundation AI Coding Assistants Policy][].
+
+## Core principle
+
+Tools should never replace human judgment, regardless of whether they are
+powered by AI.
+
+Node.js requires contributors to understand and take full responsibility for
+every change they propose. The answer to "Why is X an improvement?" can
+never be "I'm not sure. The AI did it."
+
+If AI tools assisted in generating a contribution, acknowledge that honestly.
+Regardless of how much code is generated by AI, disclosure does not serve
+as a disclaimer of responsibility.
+
+Be aware that the mention of for-profit trademarks or commercial brands in
+commit messages, which are part of the code base, can be abused for
+profit-driven marketing. If the disclosure involves for-profit trademarks or
+commercial brands, it's recommended to either anonymize the branding (e.g. say
+`a frontier reasoning model`, `a closed-source coding agent` instead of
+`<brand>`), or only mention the for-profit brand/trademark in the PR
+description, but not in the commit message, unless the message would not have
+made sense without mentioning the specific brand/trademark. These
+recommendations only apply to for-profit tools/models, not any non-profit ones.
+
+Pull requests that contain AI-generated code the contributor has not
+personally understood, tested, and verified waste collaborator time and
+will be subject to closure without additional review. Contributors who
+repeatedly submit such changes, show no understanding of the project or
+its processes, or are dishonest about the use of automated assistance
+may be blocked from further contributions.
+
+Pull requests must not be opened by automated tooling, unless specifically
+approved in advance by the project. To request approval, either open an issue in
+[nodejs/admin](https://github.com/nodejs/admin/issues), or if the automation can
+be done in the form of a GitHub workflow, submit a pull request to add the
+workflow and use the usual pull request review process to seek consensus.
+
+## When AI is used in contributions
+
+Contributors may use AI tools to assist with contributions, but such tools
+never replace human judgment.
+
+When using AI as a coding assistant:
+
+* **Understand the codebase first.** Do not skip familiarizing yourself with
+  the relevant subsystem. Always verify analysis generated by tools against
+  the actual source code with human judgement.
+
+* **Own every line you submit.** You are responsible for all code in your
+  pull request, regardless of how it was created. The submitted changes
+  must satisfy the project's [Developer's Certificate of Origin][] and licensing
+  requirements. Be prepared to explain any change in detail during review.
+
+* **Keep the commits logical.** The [commit message guidelines][]
+  and [commit squashing guidelines](./pull-requests.md#commit-squashing)
+  must be followed regardless of what tool is used in the pull request.
+
+* **Test thoroughly.** Existing tests should not be removed or modified
+  without human verification. It is crucial to verify, with human judgement,
+  the correctness of new tests against the intended behavior of the feature
+  being tested, independently of how the implementation happens to behave.
+
+* **Do not disappear.** If you open a PR, follow it through. Respond to
+  feedback and iterate until the work lands or is explicitly closed. If you
+  can no longer pursue it, close the PR. Stalled PRs block progress.
+
+* **Do not use AI to claim "good first issue" tasks.** These issues exist to
+  help new contributors learn the codebase and processes hands-on.
+
+* **Keep the comments useful.** Verify with human judgement that the
+  comments are necessary and accurate. Remove comments that simply
+  restate what the code does. Add comments only where the logic is non-obvious.
+
+## When AI is used in communications
+
+Node.js values concise, precise communication that respects collaborator and
+contributor time.
+
+* **Do not paste messages generated entirely by AI** in pull requests, issues,
+  or the project's communication channels. Such communication may be removed in
+  accordance to [the Node.js moderation policy][].
+* **Verify claims about the code with human judgement before using them in
+  communications**. Results from AI tools should only be treated as hypothesis.
+  Link to actual code, documentation and specifications as source of truth.
+* Grammar and spell-check tools are acceptable when they improve clarity and
+  conciseness.
+
+[Developer's Certificate of Origin]: ../../CONTRIBUTING.md#developers-certificate-of-origin-11
+[OpenJS Foundation AI Coding Assistants Policy]: https://ai-coding-assistants-policy.openjsf.org/
+[commit message guidelines]: ./pull-requests.md#commit-message-guidelines
+[the Node.js moderation policy]: https://github.com/nodejs/admin/blob/main/Moderation-Policy.md

From ebd8c6ba523bbfd29ed4da8970f0e7e7f0b3424b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9?= <contact.9a5d6388@renegade334.me.uk>
Date: Wed, 12 Aug 2026 22:13:05 +0100
Subject: [PATCH 139/344] deps: float ICU-23262 patch for icu78

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/64678
Fixes: https://github.com/nodejs/node/issues/63041
Refs: https://unicode-org.atlassian.net/browse/ICU-23262
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 tools/icu/patches/78/source/i18n/dtfmtsym.cpp | 2653 +++++++++++++++++
 1 file changed, 2653 insertions(+)
 create mode 100644 tools/icu/patches/78/source/i18n/dtfmtsym.cpp

diff --git a/tools/icu/patches/78/source/i18n/dtfmtsym.cpp b/tools/icu/patches/78/source/i18n/dtfmtsym.cpp
new file mode 100644
index 000000000000..6c2a417eccde
--- /dev/null
+++ b/tools/icu/patches/78/source/i18n/dtfmtsym.cpp
@@ -0,0 +1,2653 @@
+// © 2016 and later: Unicode, Inc. and others.
+// License & terms of use: http://www.unicode.org/copyright.html
+/*
+*******************************************************************************
+* Copyright (C) 1997-2016, International Business Machines Corporation and    *
+* others. All Rights Reserved.                                                *
+*******************************************************************************
+*
+* File DTFMTSYM.CPP
+*
+* Modification History:
+*
+*   Date        Name        Description
+*   02/19/97    aliu        Converted from java.
+*   07/21/98    stephen     Added getZoneIndex
+*                            Changed weekdays/short weekdays to be one-based
+*   06/14/99    stephen     Removed SimpleDateFormat::fgTimeZoneDataSuffix
+*   11/16/99    weiv        Added 'Y' and 'e' to fgPatternChars
+*   03/27/00    weiv        Keeping resource bundle around!
+*   06/30/05    emmons      Added eraNames, narrow month/day, standalone context
+*   10/12/05    emmons      Added setters for eraNames, month/day by width/context
+*******************************************************************************
+*/
+
+#include <utility>
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_FORMATTING
+#include "unicode/ustring.h"
+#include "unicode/localpointer.h"
+#include "unicode/dtfmtsym.h"
+#include "unicode/errorcode.h"
+#include "unicode/smpdtfmt.h"
+#include "unicode/msgfmt.h"
+#include "unicode/numsys.h"
+#include "unicode/tznames.h"
+#include "cpputils.h"
+#include "umutex.h"
+#include "cmemory.h"
+#include "cstring.h"
+#include "charstr.h"
+#include "erarules.h"
+#include "dt_impl.h"
+#include "locbased.h"
+#include "gregoimp.h"
+#include "hash.h"
+#include "uassert.h"
+#include "uresimp.h"
+#include "ureslocs.h"
+#include "uvector.h"
+#include "shareddateformatsymbols.h"
+#include "unicode/calendar.h"
+#include "unifiedcache.h"
+
+// *****************************************************************************
+// class DateFormatSymbols
+// *****************************************************************************
+
+/**
+ * These are static arrays we use only in the case where we have no
+ * resource data.
+ */
+
+#if UDAT_HAS_PATTERN_CHAR_FOR_TIME_SEPARATOR
+#define PATTERN_CHARS_LEN 38
+#else
+#define PATTERN_CHARS_LEN 37
+#endif
+
+/**
+ * Unlocalized date-time pattern characters. For example: 'y', 'd', etc. All
+ * locales use the same these unlocalized pattern characters.
+ */
+static const char16_t gPatternChars[] = {
+    // if UDAT_HAS_PATTERN_CHAR_FOR_TIME_SEPARATOR:
+    //   GyMdkHmsSEDFwWahKzYeugAZvcLQqVUOXxrbB:
+    // else:
+    //   GyMdkHmsSEDFwWahKzYeugAZvcLQqVUOXxrbB
+
+    0x47, 0x79, 0x4D, 0x64, 0x6B, 0x48, 0x6D, 0x73, 0x53, 0x45,
+    0x44, 0x46, 0x77, 0x57, 0x61, 0x68, 0x4B, 0x7A, 0x59, 0x65,
+    0x75, 0x67, 0x41, 0x5A, 0x76, 0x63, 0x4c, 0x51, 0x71, 0x56,
+    0x55, 0x4F, 0x58, 0x78, 0x72, 0x62, 0x42,
+#if UDAT_HAS_PATTERN_CHAR_FOR_TIME_SEPARATOR
+    0x3a,
+#endif
+    0
+};
+
+/**
+ * Map of each ASCII character to its corresponding index in the table above if
+ * it is a pattern character and -1 otherwise.
+ */
+static const int8_t gLookupPatternChars[] = {
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    //
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    //       !   "   #   $   %   &   '   (   )   *   +   ,   -   .   /
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+#if UDAT_HAS_PATTERN_CHAR_FOR_TIME_SEPARATOR
+    //   0   1   2   3   4   5   6   7   8   9   :   ;   <   =   >   ?
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 37, -1, -1, -1, -1, -1,
+#else
+    //   0   1   2   3   4   5   6   7   8   9   :   ;   <   =   >   ?
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+#endif
+    //   @   A   B   C   D   E   F   G   H   I   J   K   L   M   N   O
+        -1, 22, 36, -1, 10,  9, 11,  0,  5, -1, -1, 16, 26,  2, -1, 31,
+    //   P   Q   R   S   T   U   V   W   X   Y   Z   [   \   ]   ^   _
+        -1, 27, -1,  8, -1, 30, 29, 13, 32, 18, 23, -1, -1, -1, -1, -1,
+    //   `   a   b   c   d   e   f   g   h   i   j   k   l   m   n   o
+        -1, 14, 35, 25,  3, 19, -1, 21, 15, -1, -1,  4, -1,  6, -1, -1,
+    //   p   q   r   s   t   u   v   w   x   y   z   {   |   }   ~
+        -1, 28, 34,  7, -1, 20, 24, 12, 33,  1, 17, -1, -1, -1, -1, -1
+};
+
+//------------------------------------------------------
+// Strings of last resort.  These are only used if we have no resource
+// files.  They aren't designed for actual use, just for backup.
+
+// These are the month names and abbreviations of last resort.
+static const char16_t gLastResortMonthNames[13][3] =
+{
+    {0x0030, 0x0031, 0x0000}, /* "01" */
+    {0x0030, 0x0032, 0x0000}, /* "02" */
+    {0x0030, 0x0033, 0x0000}, /* "03" */
+    {0x0030, 0x0034, 0x0000}, /* "04" */
+    {0x0030, 0x0035, 0x0000}, /* "05" */
+    {0x0030, 0x0036, 0x0000}, /* "06" */
+    {0x0030, 0x0037, 0x0000}, /* "07" */
+    {0x0030, 0x0038, 0x0000}, /* "08" */
+    {0x0030, 0x0039, 0x0000}, /* "09" */
+    {0x0031, 0x0030, 0x0000}, /* "10" */
+    {0x0031, 0x0031, 0x0000}, /* "11" */
+    {0x0031, 0x0032, 0x0000}, /* "12" */
+    {0x0031, 0x0033, 0x0000}  /* "13" */
+};
+
+// These are the weekday names and abbreviations of last resort.
+static const char16_t gLastResortDayNames[8][2] =
+{
+    {0x0030, 0x0000}, /* "0" */
+    {0x0031, 0x0000}, /* "1" */
+    {0x0032, 0x0000}, /* "2" */
+    {0x0033, 0x0000}, /* "3" */
+    {0x0034, 0x0000}, /* "4" */
+    {0x0035, 0x0000}, /* "5" */
+    {0x0036, 0x0000}, /* "6" */
+    {0x0037, 0x0000}  /* "7" */
+};
+
+// These are the quarter names and abbreviations of last resort.
+static const char16_t gLastResortQuarters[4][2] =
+{
+    {0x0031, 0x0000}, /* "1" */
+    {0x0032, 0x0000}, /* "2" */
+    {0x0033, 0x0000}, /* "3" */
+    {0x0034, 0x0000}, /* "4" */
+};
+
+// These are the am/pm and BC/AD markers of last resort.
+static const char16_t gLastResortAmPmMarkers[2][3] =
+{
+    {0x0041, 0x004D, 0x0000}, /* "AM" */
+    {0x0050, 0x004D, 0x0000}  /* "PM" */
+};
+
+static const char16_t gLastResortEras[2][3] =
+{
+    {0x0042, 0x0043, 0x0000}, /* "BC" */
+    {0x0041, 0x0044, 0x0000}  /* "AD" */
+};
+
+/* Sizes for the last resort string arrays */
+typedef enum LastResortSize {
+    kMonthNum = 13,
+    kMonthLen = 3,
+
+    kDayNum = 8,
+    kDayLen = 2,
+
+    kAmPmNum = 2,
+    kAmPmLen = 3,
+
+    kQuarterNum = 4,
+    kQuarterLen = 2,
+
+    kEraNum = 2,
+    kEraLen = 3,
+
+    kZoneNum = 5,
+    kZoneLen = 4,
+
+    kGmtHourNum = 4,
+    kGmtHourLen = 10
+} LastResortSize;
+
+U_NAMESPACE_BEGIN
+
+SharedDateFormatSymbols::~SharedDateFormatSymbols() {
+}
+
+template<> U_I18N_API
+const SharedDateFormatSymbols *
+        LocaleCacheKey<SharedDateFormatSymbols>::createObject(
+                const void * /*unusedContext*/, UErrorCode &status) const {
+    char type[256];
+    Calendar::getCalendarTypeFromLocale(fLoc, type, UPRV_LENGTHOF(type), status);
+    if (U_FAILURE(status)) {
+        return nullptr;
+    }
+    SharedDateFormatSymbols *shared
+            = new SharedDateFormatSymbols(fLoc, type, status);
+    if (shared == nullptr) {
+        status = U_MEMORY_ALLOCATION_ERROR;
+        return nullptr;
+    }
+    if (U_FAILURE(status)) {
+        delete shared;
+        return nullptr;
+    }
+    shared->addRef();
+    return shared;
+}
+
+UOBJECT_DEFINE_RTTI_IMPLEMENTATION(DateFormatSymbols)
+
+#define kSUPPLEMENTAL "supplementalData"
+
+/**
+ * These are the tags we expect to see in normal resource bundle files associated
+ * with a locale and calendar
+ */
+static const char gCalendarTag[]="calendar";
+static const char gGregorianTag[]="gregorian";
+static const char gErasTag[]="eras";
+static const char gCyclicNameSetsTag[]="cyclicNameSets";
+static const char gNameSetYearsTag[]="years";
+static const char gNameSetZodiacsTag[]="zodiacs";
+static const char gMonthNamesTag[]="monthNames";
+static const char gMonthPatternsTag[]="monthPatterns";
+static const char gDayNamesTag[]="dayNames";
+static const char gNamesWideTag[]="wide";
+static const char gNamesAbbrTag[]="abbreviated";
+static const char gNamesShortTag[]="short";
+static const char gNamesNarrowTag[]="narrow";
+static const char gNamesAllTag[]="all";
+static const char gNamesFormatTag[]="format";
+static const char gNamesStandaloneTag[]="stand-alone";
+static const char gNamesNumericTag[]="numeric";
+static const char gAmPmMarkersTag[]="AmPmMarkers";
+static const char gAmPmMarkersAbbrTag[]="AmPmMarkersAbbr";
+static const char gAmPmMarkersNarrowTag[]="AmPmMarkersNarrow";
+static const char gQuartersTag[]="quarters";
+static const char gNumberElementsTag[]="NumberElements";
+static const char gSymbolsTag[]="symbols";
+static const char gTimeSeparatorTag[]="timeSeparator";
+static const char gDayPeriodTag[]="dayPeriod";
+
+// static const char gZoneStringsTag[]="zoneStrings";
+
+// static const char gLocalPatternCharsTag[]="localPatternChars";
+
+static const char gContextTransformsTag[]="contextTransforms";
+
+/**
+ * Jitterbug 2974: MSVC has a bug whereby new X[0] behaves badly.
+ * Work around this.
+ */
+static inline UnicodeString* newUnicodeStringArray(size_t count) {
+    return new UnicodeString[count ? count : 1];
+}
+
+//------------------------------------------------------
+
+DateFormatSymbols * U_EXPORT2
+DateFormatSymbols::createForLocale(
+        const Locale& locale, UErrorCode &status) {
+    const SharedDateFormatSymbols *shared = nullptr;
+    UnifiedCache::getByLocale(locale, shared, status);
+    if (U_FAILURE(status)) {
+        return nullptr;
+    }
+    DateFormatSymbols *result = new DateFormatSymbols(shared->get());
+    shared->removeRef();
+    if (result == nullptr) {
+        status = U_MEMORY_ALLOCATION_ERROR;
+        return nullptr;
+    }
+    return result;
+}
+
+DateFormatSymbols::DateFormatSymbols(const Locale& locale,
+                                     UErrorCode& status)
+    : UObject()
+{
+  initializeData(locale, nullptr,  status);
+}
+
+DateFormatSymbols::DateFormatSymbols(UErrorCode& status)
+    : UObject()
+{
+  initializeData(Locale::getDefault(), nullptr, status, true);
+}
+
+
+DateFormatSymbols::DateFormatSymbols(const Locale& locale,
+                                     const char *type,
+                                     UErrorCode& status)
+    : UObject()
+{
+  initializeData(locale, type,  status);
+}
+
+DateFormatSymbols::DateFormatSymbols(const char *type, UErrorCode& status)
+    : UObject()
+{
+  initializeData(Locale::getDefault(), type, status, true);
+}
+
+DateFormatSymbols::DateFormatSymbols(const DateFormatSymbols& other)
+    : UObject(other)
+{
+    copyData(other);
+}
+
+void
+DateFormatSymbols::assignArray(UnicodeString*& dstArray,
+                               int32_t& dstCount,
+                               const UnicodeString* srcArray,
+                               int32_t srcCount)
+{
+    // assignArray() is only called by copyData() and initializeData(), which in turn
+    // implements the copy constructor and the assignment operator.
+    // All strings in a DateFormatSymbols object are created in one of the following
+    // three ways that all allow to safely use UnicodeString::fastCopyFrom():
+    // - readonly-aliases from resource bundles
+    // - readonly-aliases or allocated strings from constants
+    // - safely cloned strings (with owned buffers) from setXYZ() functions
+    //
+    // Note that this is true for as long as DateFormatSymbols can be constructed
+    // only from a locale bundle or set via the cloning API,
+    // *and* for as long as all the strings are in *private* fields, preventing
+    // a subclass from creating these strings in an "unsafe" way (with respect to fastCopyFrom()).
+    if(srcArray == nullptr) {
+        // Do not attempt to copy bogus input (which will crash).
+        // Note that this assignArray method already had the potential to return a null dstArray;
+        // see handling below for "if(dstArray != nullptr)".
+        dstCount = 0;
+        dstArray = nullptr;
+        return;
+    }
+    dstCount = srcCount;
+    dstArray = newUnicodeStringArray(srcCount);
+    if(dstArray != nullptr) {
+        int32_t i;
+        for(i=0; i<srcCount; ++i) {
+            dstArray[i].fastCopyFrom(srcArray[i]);
+        }
+    }
+}
+
+/**
+ * Create a copy, in fZoneStrings, of the given zone strings array.  The
+ * member variables fZoneStringsRowCount and fZoneStringsColCount should
+ * be set already by the caller.
+ */
+void
+DateFormatSymbols::createZoneStrings(const UnicodeString *const * otherStrings)
+{
+    int32_t row, col;
+    UBool failed = false;
+
+    fZoneStrings = static_cast<UnicodeString**>(uprv_malloc(fZoneStringsRowCount * sizeof(UnicodeString*)));
+    if (fZoneStrings != nullptr) {
+        for (row=0; row<fZoneStringsRowCount; ++row)
+        {
+            fZoneStrings[row] = newUnicodeStringArray(fZoneStringsColCount);
+            if (fZoneStrings[row] == nullptr) {
+                failed = true;
+                break;
+            }
+            for (col=0; col<fZoneStringsColCount; ++col) {
+                // fastCopyFrom() - see assignArray comments
+                fZoneStrings[row][col].fastCopyFrom(otherStrings[row][col]);
+            }
+        }
+    }
+    // If memory allocation failed, roll back and delete fZoneStrings
+    if (failed) {
+        for (int i = row; i >= 0; i--) {
+            delete[] fZoneStrings[i];
+        }
+        uprv_free(fZoneStrings);
+        fZoneStrings = nullptr;
+    }
+}
+
+/**
+ * Copy all of the other's data to this.
+ */
+void
+DateFormatSymbols::copyData(const DateFormatSymbols& other) {
+    validLocale = other.validLocale;
+    actualLocale = other.actualLocale;
+    assignArray(fEras, fErasCount, other.fEras, other.fErasCount);
+    assignArray(fEraNames, fEraNamesCount, other.fEraNames, other.fEraNamesCount);
+    assignArray(fNarrowEras, fNarrowErasCount, other.fNarrowEras, other.fNarrowErasCount);
+    assignArray(fMonths, fMonthsCount, other.fMonths, other.fMonthsCount);
+    assignArray(fShortMonths, fShortMonthsCount, other.fShortMonths, other.fShortMonthsCount);
+    assignArray(fNarrowMonths, fNarrowMonthsCount, other.fNarrowMonths, other.fNarrowMonthsCount);
+    assignArray(fStandaloneMonths, fStandaloneMonthsCount, other.fStandaloneMonths, other.fStandaloneMonthsCount);
+    assignArray(fStandaloneShortMonths, fStandaloneShortMonthsCount, other.fStandaloneShortMonths, other.fStandaloneShortMonthsCount);
+    assignArray(fStandaloneNarrowMonths, fStandaloneNarrowMonthsCount, other.fStandaloneNarrowMonths, other.fStandaloneNarrowMonthsCount);
+    assignArray(fWeekdays, fWeekdaysCount, other.fWeekdays, other.fWeekdaysCount);
+    assignArray(fShortWeekdays, fShortWeekdaysCount, other.fShortWeekdays, other.fShortWeekdaysCount);
+    assignArray(fShorterWeekdays, fShorterWeekdaysCount, other.fShorterWeekdays, other.fShorterWeekdaysCount);
+    assignArray(fNarrowWeekdays, fNarrowWeekdaysCount, other.fNarrowWeekdays, other.fNarrowWeekdaysCount);
+    assignArray(fStandaloneWeekdays, fStandaloneWeekdaysCount, other.fStandaloneWeekdays, other.fStandaloneWeekdaysCount);
+    assignArray(fStandaloneShortWeekdays, fStandaloneShortWeekdaysCount, other.fStandaloneShortWeekdays, other.fStandaloneShortWeekdaysCount);
+    assignArray(fStandaloneShorterWeekdays, fStandaloneShorterWeekdaysCount, other.fStandaloneShorterWeekdays, other.fStandaloneShorterWeekdaysCount);
+    assignArray(fStandaloneNarrowWeekdays, fStandaloneNarrowWeekdaysCount, other.fStandaloneNarrowWeekdays, other.fStandaloneNarrowWeekdaysCount);
+    assignArray(fAmPms, fAmPmsCount, other.fAmPms, other.fAmPmsCount);
+    assignArray(fWideAmPms, fWideAmPmsCount, other.fWideAmPms, other.fWideAmPmsCount );
+    assignArray(fNarrowAmPms, fNarrowAmPmsCount, other.fNarrowAmPms, other.fNarrowAmPmsCount );
+    fTimeSeparator.fastCopyFrom(other.fTimeSeparator);  // fastCopyFrom() - see assignArray comments
+    assignArray(fQuarters, fQuartersCount, other.fQuarters, other.fQuartersCount);
+    assignArray(fShortQuarters, fShortQuartersCount, other.fShortQuarters, other.fShortQuartersCount);
+    assignArray(fNarrowQuarters, fNarrowQuartersCount, other.fNarrowQuarters, other.fNarrowQuartersCount);
+    assignArray(fStandaloneQuarters, fStandaloneQuartersCount, other.fStandaloneQuarters, other.fStandaloneQuartersCount);
+    assignArray(fStandaloneShortQuarters, fStandaloneShortQuartersCount, other.fStandaloneShortQuarters, other.fStandaloneShortQuartersCount);
+    assignArray(fStandaloneNarrowQuarters, fStandaloneNarrowQuartersCount, other.fStandaloneNarrowQuarters, other.fStandaloneNarrowQuartersCount);
+    assignArray(fWideDayPeriods, fWideDayPeriodsCount,
+                other.fWideDayPeriods, other.fWideDayPeriodsCount);
+    assignArray(fNarrowDayPeriods, fNarrowDayPeriodsCount,
+                other.fNarrowDayPeriods, other.fNarrowDayPeriodsCount);
+    assignArray(fAbbreviatedDayPeriods, fAbbreviatedDayPeriodsCount,
+                other.fAbbreviatedDayPeriods, other.fAbbreviatedDayPeriodsCount);
+    assignArray(fStandaloneWideDayPeriods, fStandaloneWideDayPeriodsCount,
+                other.fStandaloneWideDayPeriods, other.fStandaloneWideDayPeriodsCount);
+    assignArray(fStandaloneNarrowDayPeriods, fStandaloneNarrowDayPeriodsCount,
+                other.fStandaloneNarrowDayPeriods, other.fStandaloneNarrowDayPeriodsCount);
+    assignArray(fStandaloneAbbreviatedDayPeriods, fStandaloneAbbreviatedDayPeriodsCount,
+                other.fStandaloneAbbreviatedDayPeriods, other.fStandaloneAbbreviatedDayPeriodsCount);
+    if (other.fLeapMonthPatterns != nullptr) {
+        assignArray(fLeapMonthPatterns, fLeapMonthPatternsCount, other.fLeapMonthPatterns, other.fLeapMonthPatternsCount);
+    } else {
+        fLeapMonthPatterns = nullptr;
+        fLeapMonthPatternsCount = 0;
+    }
+    if (other.fShortYearNames != nullptr) {
+        assignArray(fShortYearNames, fShortYearNamesCount, other.fShortYearNames, other.fShortYearNamesCount);
+    } else {
+        fShortYearNames = nullptr;
+        fShortYearNamesCount = 0;
+    }
+    if (other.fShortZodiacNames != nullptr) {
+        assignArray(fShortZodiacNames, fShortZodiacNamesCount, other.fShortZodiacNames, other.fShortZodiacNamesCount);
+    } else {
+        fShortZodiacNames = nullptr;
+        fShortZodiacNamesCount = 0;
+    }
+
+    if (other.fZoneStrings != nullptr) {
+        fZoneStringsColCount = other.fZoneStringsColCount;
+        fZoneStringsRowCount = other.fZoneStringsRowCount;
+        createZoneStrings((const UnicodeString**)other.fZoneStrings);
+
+    } else {
+        fZoneStrings = nullptr;
+        fZoneStringsColCount = 0;
+        fZoneStringsRowCount = 0;
+    }
+    fZSFLocale = other.fZSFLocale;
+    // Other zone strings data is created on demand
+    fLocaleZoneStrings = nullptr;
+
+    // fastCopyFrom() - see assignArray comments
+    fLocalPatternChars.fastCopyFrom(other.fLocalPatternChars);
+
+    uprv_memcpy(fCapitalization, other.fCapitalization, sizeof(fCapitalization));
+}
+
+/**
+ * Assignment operator.
+ */
+DateFormatSymbols& DateFormatSymbols::operator=(const DateFormatSymbols& other)
+{
+    if (this == &other) { return *this; }  // self-assignment: no-op
+    dispose();
+    copyData(other);
+
+    return *this;
+}
+
+DateFormatSymbols::~DateFormatSymbols()
+{
+    dispose();
+}
+
+void DateFormatSymbols::dispose()
+{
+    delete[] fEras;
+    delete[] fEraNames;
+    delete[] fNarrowEras;
+    delete[] fMonths;
+    delete[] fShortMonths;
+    delete[] fNarrowMonths;
+    delete[] fStandaloneMonths;
+    delete[] fStandaloneShortMonths;
+    delete[] fStandaloneNarrowMonths;
+    delete[] fWeekdays;
+    delete[] fShortWeekdays;
+    delete[] fShorterWeekdays;
+    delete[] fNarrowWeekdays;
+    delete[] fStandaloneWeekdays;
+    delete[] fStandaloneShortWeekdays;
+    delete[] fStandaloneShorterWeekdays;
+    delete[] fStandaloneNarrowWeekdays;
+    delete[] fAmPms;
+    delete[] fWideAmPms;
+    delete[] fNarrowAmPms;
+    delete[] fQuarters;
+    delete[] fShortQuarters;
+    delete[] fNarrowQuarters;
+    delete[] fStandaloneQuarters;
+    delete[] fStandaloneShortQuarters;
+    delete[] fStandaloneNarrowQuarters;
+    delete[] fLeapMonthPatterns;
+    delete[] fShortYearNames;
+    delete[] fShortZodiacNames;
+    delete[] fAbbreviatedDayPeriods;
+    delete[] fWideDayPeriods;
+    delete[] fNarrowDayPeriods;
+    delete[] fStandaloneAbbreviatedDayPeriods;
+    delete[] fStandaloneWideDayPeriods;
+    delete[] fStandaloneNarrowDayPeriods;
+
+    actualLocale = Locale::getRoot();
+    validLocale = Locale::getRoot();
+    disposeZoneStrings();
+}
+
+void DateFormatSymbols::disposeZoneStrings()
+{
+    if (fZoneStrings) {
+        for (int32_t row = 0; row < fZoneStringsRowCount; ++row) {
+            delete[] fZoneStrings[row];
+        }
+        uprv_free(fZoneStrings);
+    }
+    if (fLocaleZoneStrings) {
+        for (int32_t row = 0; row < fZoneStringsRowCount; ++row) {
+            delete[] fLocaleZoneStrings[row];
+        }
+        uprv_free(fLocaleZoneStrings);
+    }
+
+    fZoneStrings = nullptr;
+    fLocaleZoneStrings = nullptr;
+    fZoneStringsRowCount = 0;
+    fZoneStringsColCount = 0;
+}
+
+UBool
+DateFormatSymbols::arrayCompare(const UnicodeString* array1,
+                                const UnicodeString* array2,
+                                int32_t count)
+{
+    if (array1 == array2) return true;
+    while (count>0)
+    {
+        --count;
+        if (array1[count] != array2[count]) return false;
+    }
+    return true;
+}
+
+bool
+DateFormatSymbols::operator==(const DateFormatSymbols& other) const
+{
+    // First do cheap comparisons
+    if (this == &other) {
+        return true;
+    }
+    if (fErasCount == other.fErasCount &&
+        fEraNamesCount == other.fEraNamesCount &&
+        fNarrowErasCount == other.fNarrowErasCount &&
+        fMonthsCount == other.fMonthsCount &&
+        fShortMonthsCount == other.fShortMonthsCount &&
+        fNarrowMonthsCount == other.fNarrowMonthsCount &&
+        fStandaloneMonthsCount == other.fStandaloneMonthsCount &&
+        fStandaloneShortMonthsCount == other.fStandaloneShortMonthsCount &&
+        fStandaloneNarrowMonthsCount == other.fStandaloneNarrowMonthsCount &&
+        fWeekdaysCount == other.fWeekdaysCount &&
+        fShortWeekdaysCount == other.fShortWeekdaysCount &&
+        fShorterWeekdaysCount == other.fShorterWeekdaysCount &&
+        fNarrowWeekdaysCount == other.fNarrowWeekdaysCount &&
+        fStandaloneWeekdaysCount == other.fStandaloneWeekdaysCount &&
+        fStandaloneShortWeekdaysCount == other.fStandaloneShortWeekdaysCount &&
+        fStandaloneShorterWeekdaysCount == other.fStandaloneShorterWeekdaysCount &&
+        fStandaloneNarrowWeekdaysCount == other.fStandaloneNarrowWeekdaysCount &&
+        fAmPmsCount == other.fAmPmsCount &&
+        fWideAmPmsCount == other.fWideAmPmsCount &&
+        fNarrowAmPmsCount == other.fNarrowAmPmsCount &&
+        fQuartersCount == other.fQuartersCount &&
+        fShortQuartersCount == other.fShortQuartersCount &&
+        fNarrowQuartersCount == other.fNarrowQuartersCount &&
+        fStandaloneQuartersCount == other.fStandaloneQuartersCount &&
+        fStandaloneShortQuartersCount == other.fStandaloneShortQuartersCount &&
+        fStandaloneNarrowQuartersCount == other.fStandaloneNarrowQuartersCount &&
+        fLeapMonthPatternsCount == other.fLeapMonthPatternsCount &&
+        fShortYearNamesCount == other.fShortYearNamesCount &&
+        fShortZodiacNamesCount == other.fShortZodiacNamesCount &&
+        fAbbreviatedDayPeriodsCount == other.fAbbreviatedDayPeriodsCount &&
+        fWideDayPeriodsCount == other.fWideDayPeriodsCount &&
+        fNarrowDayPeriodsCount == other.fNarrowDayPeriodsCount &&
+        fStandaloneAbbreviatedDayPeriodsCount == other.fStandaloneAbbreviatedDayPeriodsCount &&
+        fStandaloneWideDayPeriodsCount == other.fStandaloneWideDayPeriodsCount &&
+        fStandaloneNarrowDayPeriodsCount == other.fStandaloneNarrowDayPeriodsCount &&
+        (uprv_memcmp(fCapitalization, other.fCapitalization, sizeof(fCapitalization))==0))
+    {
+        // Now compare the arrays themselves
+        if (arrayCompare(fEras, other.fEras, fErasCount) &&
+            arrayCompare(fEraNames, other.fEraNames, fEraNamesCount) &&
+            arrayCompare(fNarrowEras, other.fNarrowEras, fNarrowErasCount) &&
+            arrayCompare(fMonths, other.fMonths, fMonthsCount) &&
+            arrayCompare(fShortMonths, other.fShortMonths, fShortMonthsCount) &&
+            arrayCompare(fNarrowMonths, other.fNarrowMonths, fNarrowMonthsCount) &&
+            arrayCompare(fStandaloneMonths, other.fStandaloneMonths, fStandaloneMonthsCount) &&
+            arrayCompare(fStandaloneShortMonths, other.fStandaloneShortMonths, fStandaloneShortMonthsCount) &&
+            arrayCompare(fStandaloneNarrowMonths, other.fStandaloneNarrowMonths, fStandaloneNarrowMonthsCount) &&
+            arrayCompare(fWeekdays, other.fWeekdays, fWeekdaysCount) &&
+            arrayCompare(fShortWeekdays, other.fShortWeekdays, fShortWeekdaysCount) &&
+            arrayCompare(fShorterWeekdays, other.fShorterWeekdays, fShorterWeekdaysCount) &&
+            arrayCompare(fNarrowWeekdays, other.fNarrowWeekdays, fNarrowWeekdaysCount) &&
+            arrayCompare(fStandaloneWeekdays, other.fStandaloneWeekdays, fStandaloneWeekdaysCount) &&
+            arrayCompare(fStandaloneShortWeekdays, other.fStandaloneShortWeekdays, fStandaloneShortWeekdaysCount) &&
+            arrayCompare(fStandaloneShorterWeekdays, other.fStandaloneShorterWeekdays, fStandaloneShorterWeekdaysCount) &&
+            arrayCompare(fStandaloneNarrowWeekdays, other.fStandaloneNarrowWeekdays, fStandaloneNarrowWeekdaysCount) &&
+            arrayCompare(fAmPms, other.fAmPms, fAmPmsCount) &&
+            arrayCompare(fWideAmPms, other.fWideAmPms, fWideAmPmsCount) &&
+            arrayCompare(fNarrowAmPms, other.fNarrowAmPms, fNarrowAmPmsCount) &&
+            fTimeSeparator == other.fTimeSeparator &&
+            arrayCompare(fQuarters, other.fQuarters, fQuartersCount) &&
+            arrayCompare(fShortQuarters, other.fShortQuarters, fShortQuartersCount) &&
+            arrayCompare(fNarrowQuarters, other.fNarrowQuarters, fNarrowQuartersCount) &&
+            arrayCompare(fStandaloneQuarters, other.fStandaloneQuarters, fStandaloneQuartersCount) &&
+            arrayCompare(fStandaloneShortQuarters, other.fStandaloneShortQuarters, fStandaloneShortQuartersCount) &&
+            arrayCompare(fStandaloneNarrowQuarters, other.fStandaloneNarrowQuarters, fStandaloneNarrowQuartersCount) &&
+            arrayCompare(fLeapMonthPatterns, other.fLeapMonthPatterns, fLeapMonthPatternsCount) &&
+            arrayCompare(fShortYearNames, other.fShortYearNames, fShortYearNamesCount) &&
+            arrayCompare(fShortZodiacNames, other.fShortZodiacNames, fShortZodiacNamesCount) &&
+            arrayCompare(fAbbreviatedDayPeriods, other.fAbbreviatedDayPeriods, fAbbreviatedDayPeriodsCount) &&
+            arrayCompare(fWideDayPeriods, other.fWideDayPeriods, fWideDayPeriodsCount) &&
+            arrayCompare(fNarrowDayPeriods, other.fNarrowDayPeriods, fNarrowDayPeriodsCount) &&
+            arrayCompare(fStandaloneAbbreviatedDayPeriods, other.fStandaloneAbbreviatedDayPeriods,
+                         fStandaloneAbbreviatedDayPeriodsCount) &&
+            arrayCompare(fStandaloneWideDayPeriods, other.fStandaloneWideDayPeriods,
+                         fStandaloneWideDayPeriodsCount) &&
+            arrayCompare(fStandaloneNarrowDayPeriods, other.fStandaloneNarrowDayPeriods,
+                         fStandaloneWideDayPeriodsCount))
+        {
+            // Compare the contents of fZoneStrings
+            if (fZoneStrings == nullptr && other.fZoneStrings == nullptr) {
+                if (fZSFLocale == other.fZSFLocale) {
+                    return true;
+                }
+            } else if (fZoneStrings != nullptr && other.fZoneStrings != nullptr) {
+                if (fZoneStringsRowCount == other.fZoneStringsRowCount
+                    && fZoneStringsColCount == other.fZoneStringsColCount) {
+                    bool cmpres = true;
+                    for (int32_t i = 0; (i < fZoneStringsRowCount) && cmpres; i++) {
+                        cmpres = arrayCompare(fZoneStrings[i], other.fZoneStrings[i], fZoneStringsColCount);
+                    }
+                    return cmpres;
+                }
+            }
+            return false;
+        }
+    }
+    return false;
+}
+
+//------------------------------------------------------
+
+const UnicodeString*
+DateFormatSymbols::getEras(int32_t &count) const
+{
+    count = fErasCount;
+    return fEras;
+}
+
+const UnicodeString*
+DateFormatSymbols::getEraNames(int32_t &count) const
+{
+    count = fEraNamesCount;
+    return fEraNames;
+}
+
+const UnicodeString*
+DateFormatSymbols::getNarrowEras(int32_t &count) const
+{
+    count = fNarrowErasCount;
+    return fNarrowEras;
+}
+
+const UnicodeString*
+DateFormatSymbols::getMonths(int32_t &count) const
+{
+    count = fMonthsCount;
+    return fMonths;
+}
+
+const UnicodeString*
+DateFormatSymbols::getShortMonths(int32_t &count) const
+{
+    count = fShortMonthsCount;
+    return fShortMonths;
+}
+
+const UnicodeString*
+DateFormatSymbols::getMonths(int32_t &count, DtContextType context, DtWidthType width ) const
+{
+    UnicodeString *returnValue = nullptr;
+
+    switch (context) {
+    case FORMAT :
+        switch(width) {
+        case WIDE :
+            count = fMonthsCount;
+            returnValue = fMonths;
+            break;
+        case ABBREVIATED :
+        case SHORT : // no month data for this, defaults to ABBREVIATED
+            count = fShortMonthsCount;
+            returnValue = fShortMonths;
+            break;
+        case NARROW :
+            count = fNarrowMonthsCount;
+            returnValue = fNarrowMonths;
+            break;
+        case DT_WIDTH_COUNT :
+            break;
+        }
+        break;
+    case STANDALONE :
+        switch(width) {
+        case WIDE :
+            count = fStandaloneMonthsCount;
+            returnValue = fStandaloneMonths;
+            break;
+        case ABBREVIATED :
+        case SHORT : // no month data for this, defaults to ABBREVIATED
+            count = fStandaloneShortMonthsCount;
+            returnValue = fStandaloneShortMonths;
+            break;
+        case NARROW :
+            count = fStandaloneNarrowMonthsCount;
+            returnValue = fStandaloneNarrowMonths;
+            break;
+        case DT_WIDTH_COUNT :
+            break;
+        }
+        break;
+    case DT_CONTEXT_COUNT :
+        break;
+    }
+    return returnValue;
+}
+
+const UnicodeString*
+DateFormatSymbols::getWeekdays(int32_t &count) const
+{
+    count = fWeekdaysCount;
+    return fWeekdays;
+}
+
+const UnicodeString*
+DateFormatSymbols::getShortWeekdays(int32_t &count) const
+{
+    count = fShortWeekdaysCount;
+    return fShortWeekdays;
+}
+
+const UnicodeString*
+DateFormatSymbols::getWeekdays(int32_t &count, DtContextType context, DtWidthType width) const
+{
+    UnicodeString *returnValue = nullptr;
+    switch (context) {
+    case FORMAT :
+        switch(width) {
+            case WIDE :
+                count = fWeekdaysCount;
+                returnValue = fWeekdays;
+                break;
+            case ABBREVIATED :
+                count = fShortWeekdaysCount;
+                returnValue = fShortWeekdays;
+                break;
+            case SHORT :
+                count = fShorterWeekdaysCount;
+                returnValue = fShorterWeekdays;
+                break;
+            case NARROW :
+                count = fNarrowWeekdaysCount;
+                returnValue = fNarrowWeekdays;
+                break;
+            case DT_WIDTH_COUNT :
+                break;
+        }
+        break;
+    case STANDALONE :
+        switch(width) {
+            case WIDE :
+                count = fStandaloneWeekdaysCount;
+                returnValue = fStandaloneWeekdays;
+                break;
+            case ABBREVIATED :
+                count = fStandaloneShortWeekdaysCount;
+                returnValue = fStandaloneShortWeekdays;
+                break;
+            case SHORT :
+                count = fStandaloneShorterWeekdaysCount;
+                returnValue = fStandaloneShorterWeekdays;
+                break;
+            case NARROW :
+                count = fStandaloneNarrowWeekdaysCount;
+                returnValue = fStandaloneNarrowWeekdays;
+                break;
+            case DT_WIDTH_COUNT :
+                break;
+        }
+        break;
+    case DT_CONTEXT_COUNT :
+        break;
+    }
+    return returnValue;
+}
+
+const UnicodeString*
+DateFormatSymbols::getQuarters(int32_t &count, DtContextType context, DtWidthType width ) const
+{
+    UnicodeString *returnValue = nullptr;
+
+    switch (context) {
+    case FORMAT :
+        switch(width) {
+        case WIDE :
+            count = fQuartersCount;
+            returnValue = fQuarters;
+            break;
+        case ABBREVIATED :
+        case SHORT : // no quarter data for this, defaults to ABBREVIATED
+            count = fShortQuartersCount;
+            returnValue = fShortQuarters;
+            break;
+        case NARROW :
+            count = fNarrowQuartersCount;
+            returnValue = fNarrowQuarters;
+            break;
+        case DT_WIDTH_COUNT :
+            break;
+        }
+        break;
+    case STANDALONE :
+        switch(width) {
+        case WIDE :
+            count = fStandaloneQuartersCount;
+            returnValue = fStandaloneQuarters;
+            break;
+        case ABBREVIATED :
+        case SHORT : // no quarter data for this, defaults to ABBREVIATED
+            count = fStandaloneShortQuartersCount;
+            returnValue = fStandaloneShortQuarters;
+            break;
+        case NARROW :
+            count = fStandaloneNarrowQuartersCount;
+            returnValue = fStandaloneNarrowQuarters;
+            break;
+        case DT_WIDTH_COUNT :
+            break;
+        }
+        break;
+    case DT_CONTEXT_COUNT :
+        break;
+    }
+    return returnValue;
+}
+
+UnicodeString&
+DateFormatSymbols::getTimeSeparatorString(UnicodeString& result) const
+{
+    // fastCopyFrom() - see assignArray comments
+    return result.fastCopyFrom(fTimeSeparator);
+}
+
+const UnicodeString*
+DateFormatSymbols::getAmPmStrings(int32_t &count) const
+{
+    return getAmPmStrings(count, FORMAT, ABBREVIATED);
+}
+
+const UnicodeString*
+DateFormatSymbols::getAmPmStrings(int32_t &count, DtContextType /*ignored*/, DtWidthType width) const
+{
+    UnicodeString* const* srcArray;
+    int32_t const* srcCount;
+    switch (width) {
+    case WIDE:
+        srcArray = &fWideAmPms;
+        srcCount = &fWideAmPmsCount;
+        break;
+    case NARROW:
+        srcArray = &fNarrowAmPms;
+        srcCount = &fNarrowAmPmsCount;
+        break;
+    case ABBREVIATED:
+    default:
+        srcArray = &fAmPms;
+        srcCount = &fAmPmsCount;
+        break;
+    }
+
+    count = *srcCount;
+    return *srcArray;
+}
+
+const UnicodeString*
+DateFormatSymbols::getLeapMonthPatterns(int32_t &count) const
+{
+    count = fLeapMonthPatternsCount;
+    return fLeapMonthPatterns;
+}
+
+const UnicodeString*
+DateFormatSymbols::getYearNames(int32_t& count,
+                                DtContextType /*ignored*/, DtWidthType /*ignored*/) const
+{
+    count = fShortYearNamesCount;
+    return fShortYearNames;
+}
+
+void
+DateFormatSymbols::setYearNames(const UnicodeString* yearNames, int32_t count,
+                                DtContextType context, DtWidthType width)
+{
+    if (context == FORMAT && width == ABBREVIATED) {
+        delete[] fShortYearNames;
+        fShortYearNames = newUnicodeStringArray(count);
+        uprv_arrayCopy(yearNames, fShortYearNames, count);
+        fShortYearNamesCount = count;
+    }
+}
+
+const UnicodeString*
+DateFormatSymbols::getZodiacNames(int32_t& count,
+                                DtContextType /*ignored*/, DtWidthType /*ignored*/) const
+{
+    count = fShortZodiacNamesCount;
+    return fShortZodiacNames;
+}
+
+void
+DateFormatSymbols::setZodiacNames(const UnicodeString* zodiacNames, int32_t count,
+                                DtContextType context, DtWidthType width)
+{
+    if (context == FORMAT && width == ABBREVIATED) {
+        delete[] fShortZodiacNames;
+        fShortZodiacNames = newUnicodeStringArray(count);
+        uprv_arrayCopy(zodiacNames, fShortZodiacNames, count);
+        fShortZodiacNamesCount = count;
+    }
+}
+
+//------------------------------------------------------
+
+void
+DateFormatSymbols::setEras(const UnicodeString* erasArray, int32_t count)
+{
+    // delete the old list if we own it
+    delete[] fEras;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fEras = newUnicodeStringArray(count);
+    uprv_arrayCopy(erasArray,fEras,  count);
+    fErasCount = count;
+}
+
+void
+DateFormatSymbols::setEraNames(const UnicodeString* eraNamesArray, int32_t count)
+{
+    // delete the old list if we own it
+    delete[] fEraNames;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fEraNames = newUnicodeStringArray(count);
+    uprv_arrayCopy(eraNamesArray,fEraNames,  count);
+    fEraNamesCount = count;
+}
+
+void
+DateFormatSymbols::setNarrowEras(const UnicodeString* narrowErasArray, int32_t count)
+{
+    // delete the old list if we own it
+    delete[] fNarrowEras;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fNarrowEras = newUnicodeStringArray(count);
+    uprv_arrayCopy(narrowErasArray,fNarrowEras,  count);
+    fNarrowErasCount = count;
+}
+
+void
+DateFormatSymbols::setMonths(const UnicodeString* monthsArray, int32_t count)
+{
+    // delete the old list if we own it
+    delete[] fMonths;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fMonths = newUnicodeStringArray(count);
+    uprv_arrayCopy( monthsArray,fMonths,count);
+    fMonthsCount = count;
+}
+
+void
+DateFormatSymbols::setShortMonths(const UnicodeString* shortMonthsArray, int32_t count)
+{
+    // delete the old list if we own it
+    delete[] fShortMonths;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fShortMonths = newUnicodeStringArray(count);
+    uprv_arrayCopy(shortMonthsArray,fShortMonths,  count);
+    fShortMonthsCount = count;
+}
+
+void
+DateFormatSymbols::setMonths(const UnicodeString* monthsArray, int32_t count, DtContextType context, DtWidthType width)
+{
+    // delete the old list if we own it
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+
+    switch (context) {
+    case FORMAT :
+        switch (width) {
+        case WIDE :
+            delete[] fMonths;
+            fMonths = newUnicodeStringArray(count);
+            uprv_arrayCopy( monthsArray,fMonths,count);
+            fMonthsCount = count;
+            break;
+        case ABBREVIATED :
+            delete[] fShortMonths;
+            fShortMonths = newUnicodeStringArray(count);
+            uprv_arrayCopy( monthsArray,fShortMonths,count);
+            fShortMonthsCount = count;
+            break;
+        case NARROW :
+            delete[] fNarrowMonths;
+            fNarrowMonths = newUnicodeStringArray(count);
+            uprv_arrayCopy( monthsArray,fNarrowMonths,count);
+            fNarrowMonthsCount = count;
+            break;
+        default :
+            break;
+        }
+        break;
+    case STANDALONE :
+        switch (width) {
+        case WIDE :
+            delete[] fStandaloneMonths;
+            fStandaloneMonths = newUnicodeStringArray(count);
+            uprv_arrayCopy( monthsArray,fStandaloneMonths,count);
+            fStandaloneMonthsCount = count;
+            break;
+        case ABBREVIATED :
+            delete[] fStandaloneShortMonths;
+            fStandaloneShortMonths = newUnicodeStringArray(count);
+            uprv_arrayCopy( monthsArray,fStandaloneShortMonths,count);
+            fStandaloneShortMonthsCount = count;
+            break;
+        case NARROW :
+            delete[] fStandaloneNarrowMonths;
+            fStandaloneNarrowMonths = newUnicodeStringArray(count);
+            uprv_arrayCopy( monthsArray,fStandaloneNarrowMonths,count);
+            fStandaloneNarrowMonthsCount = count;
+            break;
+        default :
+            break;
+        }
+        break;
+    case DT_CONTEXT_COUNT :
+        break;
+    }
+}
+
+void DateFormatSymbols::setWeekdays(const UnicodeString* weekdaysArray, int32_t count)
+{
+    // delete the old list if we own it
+    delete[] fWeekdays;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fWeekdays = newUnicodeStringArray(count);
+    uprv_arrayCopy(weekdaysArray,fWeekdays,count);
+    fWeekdaysCount = count;
+}
+
+void
+DateFormatSymbols::setShortWeekdays(const UnicodeString* shortWeekdaysArray, int32_t count)
+{
+    // delete the old list if we own it
+    delete[] fShortWeekdays;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fShortWeekdays = newUnicodeStringArray(count);
+    uprv_arrayCopy(shortWeekdaysArray, fShortWeekdays, count);
+    fShortWeekdaysCount = count;
+}
+
+void
+DateFormatSymbols::setWeekdays(const UnicodeString* weekdaysArray, int32_t count, DtContextType context, DtWidthType width)
+{
+    // delete the old list if we own it
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+
+    switch (context) {
+    case FORMAT :
+        switch (width) {
+        case WIDE :
+            delete[] fWeekdays;
+            fWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fWeekdays, count);
+            fWeekdaysCount = count;
+            break;
+        case ABBREVIATED :
+            delete[] fShortWeekdays;
+            fShortWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fShortWeekdays, count);
+            fShortWeekdaysCount = count;
+            break;
+        case SHORT :
+            delete[] fShorterWeekdays;
+            fShorterWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fShorterWeekdays, count);
+            fShorterWeekdaysCount = count;
+            break;
+        case NARROW :
+            delete[] fNarrowWeekdays;
+            fNarrowWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fNarrowWeekdays, count);
+            fNarrowWeekdaysCount = count;
+            break;
+        case DT_WIDTH_COUNT :
+            break;
+        }
+        break;
+    case STANDALONE :
+        switch (width) {
+        case WIDE :
+            delete[] fStandaloneWeekdays;
+            fStandaloneWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fStandaloneWeekdays, count);
+            fStandaloneWeekdaysCount = count;
+            break;
+        case ABBREVIATED :
+            delete[] fStandaloneShortWeekdays;
+            fStandaloneShortWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fStandaloneShortWeekdays, count);
+            fStandaloneShortWeekdaysCount = count;
+            break;
+        case SHORT :
+            delete[] fStandaloneShorterWeekdays;
+            fStandaloneShorterWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fStandaloneShorterWeekdays, count);
+            fStandaloneShorterWeekdaysCount = count;
+            break;
+        case NARROW :
+            delete[] fStandaloneNarrowWeekdays;
+            fStandaloneNarrowWeekdays = newUnicodeStringArray(count);
+            uprv_arrayCopy(weekdaysArray, fStandaloneNarrowWeekdays, count);
+            fStandaloneNarrowWeekdaysCount = count;
+            break;
+        case DT_WIDTH_COUNT :
+            break;
+        }
+        break;
+    case DT_CONTEXT_COUNT :
+        break;
+    }
+}
+
+void
+DateFormatSymbols::setQuarters(const UnicodeString* quartersArray, int32_t count, DtContextType context, DtWidthType width)
+{
+    // delete the old list if we own it
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+
+    switch (context) {
+    case FORMAT :
+        switch (width) {
+        case WIDE :
+            delete[] fQuarters;
+            fQuarters = newUnicodeStringArray(count);
+            uprv_arrayCopy( quartersArray,fQuarters,count);
+            fQuartersCount = count;
+            break;
+        case ABBREVIATED :
+            delete[] fShortQuarters;
+            fShortQuarters = newUnicodeStringArray(count);
+            uprv_arrayCopy( quartersArray,fShortQuarters,count);
+            fShortQuartersCount = count;
+            break;
+        case NARROW :
+            delete[] fNarrowQuarters;
+            fNarrowQuarters = newUnicodeStringArray(count);
+            uprv_arrayCopy( quartersArray,fNarrowQuarters,count);
+            fNarrowQuartersCount = count;
+            break;
+        default :
+            break;
+        }
+        break;
+    case STANDALONE :
+        switch (width) {
+        case WIDE :
+            delete[] fStandaloneQuarters;
+            fStandaloneQuarters = newUnicodeStringArray(count);
+            uprv_arrayCopy( quartersArray,fStandaloneQuarters,count);
+            fStandaloneQuartersCount = count;
+            break;
+        case ABBREVIATED :
+            delete[] fStandaloneShortQuarters;
+            fStandaloneShortQuarters = newUnicodeStringArray(count);
+            uprv_arrayCopy( quartersArray,fStandaloneShortQuarters,count);
+            fStandaloneShortQuartersCount = count;
+            break;
+        case NARROW :
+            delete[] fStandaloneNarrowQuarters;
+            fStandaloneNarrowQuarters = newUnicodeStringArray(count);
+            uprv_arrayCopy( quartersArray,fStandaloneNarrowQuarters,count);
+            fStandaloneNarrowQuartersCount = count;
+            break;
+        default :
+            break;
+        }
+        break;
+    case DT_CONTEXT_COUNT :
+        break;
+    }
+}
+
+void
+DateFormatSymbols::setAmPmStrings(const UnicodeString* amPmsArray, int32_t count)
+{
+    setAmPmStrings(amPmsArray, count, FORMAT, ABBREVIATED);
+}
+
+void
+DateFormatSymbols::setAmPmStrings(const UnicodeString* amPmsArray, int32_t count, DtContextType /*ignored*/, DtWidthType width)
+{
+    UnicodeString** targetArray;
+    int32_t* targetCount;
+    switch (width) {
+    case WIDE:
+        targetArray = &fWideAmPms;
+        targetCount = &fWideAmPmsCount;
+        break;
+    case NARROW:
+        targetArray = &fNarrowAmPms;
+        targetCount = &fNarrowAmPmsCount;
+        break;
+    case ABBREVIATED:
+    default:
+        targetArray = &fAmPms;
+        targetCount = &fAmPmsCount;
+        break;
+    }
+
+    // delete the old list if we own it
+    delete[] *targetArray;
+
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    *targetArray = newUnicodeStringArray(count);
+    uprv_arrayCopy(amPmsArray,*targetArray,count);
+    *targetCount = count;
+}
+
+void
+DateFormatSymbols::setTimeSeparatorString(const UnicodeString& newTimeSeparator)
+{
+    fTimeSeparator = newTimeSeparator;
+}
+
+const UnicodeString**
+DateFormatSymbols::getZoneStrings(int32_t& rowCount, int32_t& columnCount) const
+{
+    const UnicodeString **result = nullptr;
+    static UMutex LOCK;
+
+    umtx_lock(&LOCK);
+    if (fZoneStrings == nullptr) {
+        if (fLocaleZoneStrings == nullptr) {
+            const_cast<DateFormatSymbols*>(this)->initZoneStringsArray();
+        }
+        result = (const UnicodeString**)fLocaleZoneStrings;
+    } else {
+        result = (const UnicodeString**)fZoneStrings;
+    }
+    rowCount = fZoneStringsRowCount;
+    columnCount = fZoneStringsColCount;
+    umtx_unlock(&LOCK);
+
+    return result;
+}
+
+// For now, we include all zones
+#define ZONE_SET UCAL_ZONE_TYPE_ANY
+
+// This code must be called within a synchronized block
+void
+DateFormatSymbols::initZoneStringsArray() {
+    if (fZoneStrings != nullptr || fLocaleZoneStrings != nullptr) {
+        return;
+    }
+
+    UErrorCode status = U_ZERO_ERROR;
+
+    StringEnumeration *tzids = nullptr;
+    UnicodeString ** zarray = nullptr;
+    TimeZoneNames *tzNames = nullptr;
+    int32_t rows = 0;
+
+    static const UTimeZoneNameType TYPES[] = {
+        UTZNM_LONG_STANDARD, UTZNM_SHORT_STANDARD,
+        UTZNM_LONG_DAYLIGHT, UTZNM_SHORT_DAYLIGHT
+    };
+    static const int32_t NUM_TYPES = 4;
+
+    do { // dummy do-while
+
+        tzids = TimeZone::createTimeZoneIDEnumeration(ZONE_SET, nullptr, nullptr, status);
+        rows = tzids->count(status);
+        if (U_FAILURE(status)) {
+            break;
+        }
+
+        // Allocate array
+        int32_t size = rows * sizeof(UnicodeString*);
+        zarray = static_cast<UnicodeString**>(uprv_malloc(size));
+        if (zarray == nullptr) {
+            status = U_MEMORY_ALLOCATION_ERROR;
+            break;
+        }
+        uprv_memset(zarray, 0, size);
+
+        tzNames = TimeZoneNames::createInstance(fZSFLocale, status);
+        tzNames->loadAllDisplayNames(status);
+        if (U_FAILURE(status)) { break; }
+
+        const UnicodeString *tzid;
+        int32_t i = 0;
+        UDate now = Calendar::getNow();
+        UnicodeString tzDispName;
+
+        while ((tzid = tzids->snext(status)) != nullptr) {
+            if (U_FAILURE(status)) {
+                break;
+            }
+
+            zarray[i] = new UnicodeString[5];
+            if (zarray[i] == nullptr) {
+                status = U_MEMORY_ALLOCATION_ERROR;
+                break;
+            }
+
+            zarray[i][0].setTo(*tzid);
+            tzNames->getDisplayNames(*tzid, TYPES, NUM_TYPES, now, zarray[i]+1, status);
+            i++;
+        }
+
+    } while (false);
+
+    if (U_FAILURE(status)) {
+        if (zarray) {
+            for (int32_t i = 0; i < rows; i++) {
+                if (zarray[i]) {
+                    delete[] zarray[i];
+                }
+            }
+            uprv_free(zarray);
+            zarray = nullptr;
+        }
+    }
+
+    delete tzNames;
+    delete tzids;
+
+    fLocaleZoneStrings = zarray;
+    fZoneStringsRowCount = rows;
+    fZoneStringsColCount = 1 + NUM_TYPES;
+}
+
+void
+DateFormatSymbols::setZoneStrings(const UnicodeString* const *strings, int32_t rowCount, int32_t columnCount)
+{
+    // since deleting a 2-d array is a pain in the butt, we offload that task to
+    // a separate function
+    disposeZoneStrings();
+    // we always own the new list, which we create here (we duplicate rather
+    // than adopting the list passed in)
+    fZoneStringsRowCount = rowCount;
+    fZoneStringsColCount = columnCount;
+    createZoneStrings(const_cast<const UnicodeString**>(strings));
+}
+
+//------------------------------------------------------
+
+const char16_t * U_EXPORT2
+DateFormatSymbols::getPatternUChars()
+{
+    return gPatternChars;
+}
+
+UDateFormatField U_EXPORT2
+DateFormatSymbols::getPatternCharIndex(char16_t c) {
+    if (c >= UPRV_LENGTHOF(gLookupPatternChars)) {
+        return UDAT_FIELD_COUNT;
+    }
+    const auto idx = gLookupPatternChars[c];
+    return idx == -1 ? UDAT_FIELD_COUNT : static_cast<UDateFormatField>(idx);
+}
+
+static const uint64_t kNumericFieldsAlways =
+    (static_cast<uint64_t>(1) << UDAT_YEAR_FIELD) |                 // y
+    (static_cast<uint64_t>(1) << UDAT_DATE_FIELD) |                 // d
+    (static_cast<uint64_t>(1) << UDAT_HOUR_OF_DAY1_FIELD) |         // k
+    (static_cast<uint64_t>(1) << UDAT_HOUR_OF_DAY0_FIELD) |         // H
+    (static_cast<uint64_t>(1) << UDAT_MINUTE_FIELD) |               // m
+    (static_cast<uint64_t>(1) << UDAT_SECOND_FIELD) |               // s
+    (static_cast<uint64_t>(1) << UDAT_FRACTIONAL_SECOND_FIELD) |    // S
+    (static_cast<uint64_t>(1) << UDAT_DAY_OF_YEAR_FIELD) |          // D
+    (static_cast<uint64_t>(1) << UDAT_DAY_OF_WEEK_IN_MONTH_FIELD) | // F
+    (static_cast<uint64_t>(1) << UDAT_WEEK_OF_YEAR_FIELD) |         // w
+    (static_cast<uint64_t>(1) << UDAT_WEEK_OF_MONTH_FIELD) |        // W
+    (static_cast<uint64_t>(1) << UDAT_HOUR1_FIELD) |                // h
+    (static_cast<uint64_t>(1) << UDAT_HOUR0_FIELD) |                // K
+    (static_cast<uint64_t>(1) << UDAT_YEAR_WOY_FIELD) |             // Y
+    (static_cast<uint64_t>(1) << UDAT_EXTENDED_YEAR_FIELD) |        // u
+    (static_cast<uint64_t>(1) << UDAT_JULIAN_DAY_FIELD) |           // g
+    (static_cast<uint64_t>(1) << UDAT_MILLISECONDS_IN_DAY_FIELD) |  // A
+    (static_cast<uint64_t>(1) << UDAT_RELATED_YEAR_FIELD);          // r
+
+static const uint64_t kNumericFieldsForCount12 =
+    (static_cast<uint64_t>(1) << UDAT_MONTH_FIELD) |             // M or MM
+    (static_cast<uint64_t>(1) << UDAT_DOW_LOCAL_FIELD) |         // e or ee
+    (static_cast<uint64_t>(1) << UDAT_STANDALONE_DAY_FIELD) |    // c or cc
+    (static_cast<uint64_t>(1) << UDAT_STANDALONE_MONTH_FIELD) |  // L or LL
+    (static_cast<uint64_t>(1) << UDAT_QUARTER_FIELD) |           // Q or QQ
+    (static_cast<uint64_t>(1) << UDAT_STANDALONE_QUARTER_FIELD); // q or qq
+
+UBool U_EXPORT2
+DateFormatSymbols::isNumericField(UDateFormatField f, int32_t count) {
+    if (f == UDAT_FIELD_COUNT) {
+        return false;
+    }
+    uint64_t flag = static_cast<uint64_t>(1) << f;
+    return ((kNumericFieldsAlways & flag) != 0 || ((kNumericFieldsForCount12 & flag) != 0 && count < 3));
+}
+
+UBool U_EXPORT2
+DateFormatSymbols::isNumericPatternChar(char16_t c, int32_t count) {
+    return isNumericField(getPatternCharIndex(c), count);
+}
+
+//------------------------------------------------------
+
+UnicodeString&
+DateFormatSymbols::getLocalPatternChars(UnicodeString& result) const
+{
+    // fastCopyFrom() - see assignArray comments
+    return result.fastCopyFrom(fLocalPatternChars);
+}
+
+//------------------------------------------------------
+
+void
+DateFormatSymbols::setLocalPatternChars(const UnicodeString& newLocalPatternChars)
+{
+    fLocalPatternChars = newLocalPatternChars;
+}
+
+//------------------------------------------------------
+
+namespace {
+
+// Constants declarations
+const char16_t kCalendarAliasPrefixUChar[] = {
+    SOLIDUS, CAP_L, CAP_O, CAP_C, CAP_A, CAP_L, CAP_E, SOLIDUS,
+    LOW_C, LOW_A, LOW_L, LOW_E, LOW_N, LOW_D, LOW_A, LOW_R, SOLIDUS
+};
+const char16_t kGregorianTagUChar[] = {
+    LOW_G, LOW_R, LOW_E, LOW_G, LOW_O, LOW_R, LOW_I, LOW_A, LOW_N
+};
+const char16_t kVariantTagUChar[] = {
+    PERCENT, LOW_V, LOW_A, LOW_R, LOW_I, LOW_A, LOW_N, LOW_T
+};
+const char16_t kLeapTagUChar[] = {
+    LOW_L, LOW_E, LOW_A, LOW_P
+};
+const char16_t kCyclicNameSetsTagUChar[] = {
+    LOW_C, LOW_Y, LOW_C, LOW_L, LOW_I, LOW_C, CAP_N, LOW_A, LOW_M, LOW_E, CAP_S, LOW_E, LOW_T, LOW_S
+};
+const char16_t kYearsTagUChar[] = {
+    SOLIDUS, LOW_Y, LOW_E, LOW_A, LOW_R, LOW_S
+};
+const char16_t kZodiacsUChar[] = {
+    SOLIDUS, LOW_Z, LOW_O, LOW_D, LOW_I, LOW_A, LOW_C, LOW_S
+};
+const char16_t kDayPartsTagUChar[] = {
+    SOLIDUS, LOW_D, LOW_A, LOW_Y, CAP_P, LOW_A, LOW_R, LOW_T, LOW_S
+};
+const char16_t kFormatTagUChar[] = {
+    SOLIDUS, LOW_F, LOW_O, LOW_R, LOW_M, LOW_A, LOW_T
+};
+const char16_t kAbbrTagUChar[] = {
+    SOLIDUS, LOW_A, LOW_B, LOW_B, LOW_R, LOW_E, LOW_V, LOW_I, LOW_A, LOW_T, LOW_E, LOW_D
+};
+
+// ResourceSink to enumerate all calendar resources
+struct CalendarDataSink : public ResourceSink {
+
+    // Enum which specifies the type of alias received, or no alias
+    enum AliasType {
+        SAME_CALENDAR,
+        DIFFERENT_CALENDAR,
+        GREGORIAN,
+        NONE
+    };
+
+    // Data structures to store resources from the current resource bundle
+    Hashtable arrays;
+    Hashtable arraySizes;
+    Hashtable maps;
+    /** 
+     * Whenever there are aliases, the same object will be added twice to 'map'.
+     * To avoid double deletion, 'maps' won't take ownership of the objects. Instead,
+     * 'mapRefs' will own them and will delete them when CalendarDataSink is deleted.
+     */
+    MemoryPool<Hashtable> mapRefs;
+
+    // Paths and the aliases they point to
+    UVector aliasPathPairs;
+
+    // Current and next calendar resource table which should be loaded
+    UnicodeString currentCalendarType;
+    UnicodeString nextCalendarType;
+
+    // Resources to visit when enumerating fallback calendars
+    LocalPointer<UVector> resourcesToVisit;
+
+    // Alias' relative path populated whenever an alias is read
+    UnicodeString aliasRelativePath;
+
+    // Initializes CalendarDataSink with default values
+    CalendarDataSink(UErrorCode& status)
+    :   arrays(false, status), arraySizes(false, status), maps(false, status),
+        mapRefs(),
+        aliasPathPairs(uprv_deleteUObject, uhash_compareUnicodeString, status),
+        currentCalendarType(), nextCalendarType(),
+        resourcesToVisit(nullptr), aliasRelativePath() {
+        if (U_FAILURE(status)) { return; }
+    }
+    virtual ~CalendarDataSink();
+
+    // Configure the CalendarSink to visit all the resources
+    void visitAllResources() {
+        resourcesToVisit.adoptInstead(nullptr);
+    }
+
+    // Actions to be done before enumerating
+    void preEnumerate(const UnicodeString &calendarType) {
+        currentCalendarType = calendarType;
+        nextCalendarType.setToBogus();
+        aliasPathPairs.removeAllElements();
+    }
+
+    virtual void put(const char *key, ResourceValue &value, UBool, UErrorCode &errorCode) override {
+        if (U_FAILURE(errorCode)) { return; }
+        U_ASSERT(!currentCalendarType.isEmpty());
+
+        // Stores the resources to visit on the next calendar.
+        LocalPointer<UVector> resourcesToVisitNext(nullptr);
+        ResourceTable calendarData = value.getTable(errorCode);
+        if (U_FAILURE(errorCode)) { return; }
+
+        // Enumerate all resources for this calendar
+        for (int i = 0; calendarData.getKeyAndValue(i, key, value); i++) {
+            UnicodeString keyUString(key, -1, US_INV);
+
+            // == Handle aliases ==
+            AliasType aliasType = processAliasFromValue(keyUString, value, errorCode);
+            if (U_FAILURE(errorCode)) { return; }
+            if (aliasType == GREGORIAN) {
+                // Ignore aliases to the gregorian calendar, all of its resources will be loaded anyway.
+                continue;
+
+            } else if (aliasType == DIFFERENT_CALENDAR) {
+                // Whenever an alias to the next calendar (except gregorian) is encountered, register the
+                // calendar type it's pointing to
+                if (resourcesToVisitNext.isNull()) {
+                    resourcesToVisitNext
+                        .adoptInsteadAndCheckErrorCode(new UVector(uprv_deleteUObject, uhash_compareUnicodeString, errorCode),
+                                                       errorCode);
+                    if (U_FAILURE(errorCode)) { return; }
+                }
+                LocalPointer<UnicodeString> aliasRelativePathCopy(aliasRelativePath.clone(), errorCode);
+                resourcesToVisitNext->adoptElement(aliasRelativePathCopy.orphan(), errorCode);
+                if (U_FAILURE(errorCode)) { return; }
+                continue;
+
+            } else if (aliasType == SAME_CALENDAR) {
+                // Register same-calendar alias
+                if (arrays.get(aliasRelativePath) == nullptr && maps.get(aliasRelativePath) == nullptr) {
+                    LocalPointer<UnicodeString> aliasRelativePathCopy(aliasRelativePath.clone(), errorCode);
+                    aliasPathPairs.adoptElement(aliasRelativePathCopy.orphan(), errorCode);
+                    if (U_FAILURE(errorCode)) { return; }
+                    LocalPointer<UnicodeString> keyUStringCopy(keyUString.clone(), errorCode);
+                    aliasPathPairs.adoptElement(keyUStringCopy.orphan(), errorCode);
+                    if (U_FAILURE(errorCode)) { return; }
+                }
+                continue;
+            }
+
+            // Only visit the resources that were referenced by an alias on the previous calendar
+            // (AmPmMarkersAbbr is an exception).
+            if (!resourcesToVisit.isNull() && !resourcesToVisit->isEmpty() && !resourcesToVisit->contains(&keyUString)
+                && uprv_strcmp(key, gAmPmMarkersAbbrTag) != 0) { continue; }
+
+            // == Handle data ==
+            if (uprv_strcmp(key, gAmPmMarkersTag) == 0
+                || uprv_strcmp(key, gAmPmMarkersAbbrTag) == 0
+                || uprv_strcmp(key, gAmPmMarkersNarrowTag) == 0) {
+                if (arrays.get(keyUString) == nullptr) {
+                    ResourceArray resourceArray = value.getArray(errorCode);
+                    int32_t arraySize = resourceArray.getSize();
+                    LocalArray<UnicodeString> stringArray(new UnicodeString[arraySize], errorCode);
+                    value.getStringArray(stringArray.getAlias(), arraySize, errorCode);
+                    arrays.put(keyUString, stringArray.orphan(), errorCode);
+                    arraySizes.puti(keyUString, arraySize, errorCode);
+                    if (U_FAILURE(errorCode)) { return; }
+                }
+            } else if (uprv_strcmp(key, gErasTag) == 0
+                       || uprv_strcmp(key, gDayNamesTag) == 0
+                       || uprv_strcmp(key, gMonthNamesTag) == 0
+                       || uprv_strcmp(key, gQuartersTag) == 0
+                       || uprv_strcmp(key, gDayPeriodTag) == 0
+                       || uprv_strcmp(key, gMonthPatternsTag) == 0
+                       || uprv_strcmp(key, gCyclicNameSetsTag) == 0) {
+                processResource(keyUString, key, value, errorCode);
+            }
+        }
+
+        // Apply same-calendar aliases
+        UBool modified;
+        do {
+            modified = false;
+            for (int32_t i = 0; i < aliasPathPairs.size();) {
+                UBool mod = false;
+                UnicodeString* alias = static_cast<UnicodeString*>(aliasPathPairs[i]);
+                UnicodeString *aliasArray;
+                Hashtable *aliasMap;
+                if ((aliasArray = static_cast<UnicodeString*>(arrays.get(*alias))) != nullptr) {
+                    UnicodeString* path = static_cast<UnicodeString*>(aliasPathPairs[i + 1]);
+                    if (arrays.get(*path) == nullptr) {
+                        // Clone the array
+                        int32_t aliasArraySize = arraySizes.geti(*alias);
+                        LocalArray<UnicodeString> aliasArrayCopy(new UnicodeString[aliasArraySize], errorCode);
+                        if (U_FAILURE(errorCode)) { return; }
+                        uprv_arrayCopy(aliasArray, aliasArrayCopy.getAlias(), aliasArraySize);
+                        // Put the array on the 'arrays' map
+                        arrays.put(*path, aliasArrayCopy.orphan(), errorCode);
+                        arraySizes.puti(*path, aliasArraySize, errorCode);
+                    }
+                    if (U_FAILURE(errorCode)) { return; }
+                    mod = true;
+                } else if ((aliasMap = static_cast<Hashtable*>(maps.get(*alias))) != nullptr) {
+                    UnicodeString* path = static_cast<UnicodeString*>(aliasPathPairs[i + 1]);
+                    if (maps.get(*path) == nullptr) {
+                        maps.put(*path, aliasMap, errorCode);
+                    }
+                    if (U_FAILURE(errorCode)) { return; }
+                    mod = true;
+                }
+                if (mod) {
+                    aliasPathPairs.removeElementAt(i + 1);
+                    aliasPathPairs.removeElementAt(i);
+                    modified = true;
+                } else {
+                    i += 2;
+                }
+            }
+        } while (modified && !aliasPathPairs.isEmpty());
+
+        // Set the resources to visit on the next calendar
+        if (!resourcesToVisitNext.isNull()) {
+            resourcesToVisit = std::move(resourcesToVisitNext);
+        }
+    }
+
+    // Process the nested resource bundle tables
+    void processResource(UnicodeString &path, const char *key, ResourceValue &value, UErrorCode &errorCode) {
+        if (U_FAILURE(errorCode)) return;
+
+        ResourceTable table = value.getTable(errorCode);
+        if (U_FAILURE(errorCode)) return;
+        Hashtable* stringMap = nullptr;
+
+        // Iterate over all the elements of the table and add them to the map
+        for (int i = 0; table.getKeyAndValue(i, key, value); i++) {
+            UnicodeString keyUString(key, -1, US_INV);
+
+            // Ignore '%variant' keys
+            if (keyUString.endsWith(kVariantTagUChar, UPRV_LENGTHOF(kVariantTagUChar))) {
+                continue;
+            }
+
+            // == Handle String elements ==
+            if (value.getType() == URES_STRING) {
+                // We are on a leaf, store the map elements into the stringMap
+                if (i == 0) {
+                    // mapRefs will keep ownership of 'stringMap':
+                    stringMap = mapRefs.create(false, errorCode);
+                    if (stringMap == nullptr) {
+                        errorCode = U_MEMORY_ALLOCATION_ERROR;
+                        return;
+                    }
+                    maps.put(path, stringMap, errorCode);
+                    if (U_FAILURE(errorCode)) { return; }
+                    stringMap->setValueDeleter(uprv_deleteUObject);
+                }
+                U_ASSERT(stringMap != nullptr);
+                int32_t valueStringSize;
+                const char16_t *valueString = value.getString(valueStringSize, errorCode);
+                if (U_FAILURE(errorCode)) { return; }
+                LocalPointer<UnicodeString> valueUString(new UnicodeString(true, valueString, valueStringSize), errorCode);
+                stringMap->put(keyUString, valueUString.orphan(), errorCode);
+                if (U_FAILURE(errorCode)) { return; }
+                continue;
+            }
+            U_ASSERT(stringMap == nullptr);
+
+            // Store the current path's length and append the current key to the path.
+            int32_t pathLength = path.length();
+            path.append(SOLIDUS).append(keyUString);
+
+            // In cyclicNameSets ignore everything but years/format/abbreviated
+            // and zodiacs/format/abbreviated
+            if (path.startsWith(kCyclicNameSetsTagUChar, UPRV_LENGTHOF(kCyclicNameSetsTagUChar))) {
+                UBool skip = true;
+                int32_t startIndex = UPRV_LENGTHOF(kCyclicNameSetsTagUChar);
+                int32_t length = 0;
+                if (startIndex == path.length()
+                    || path.compare(startIndex, (length = UPRV_LENGTHOF(kZodiacsUChar)), kZodiacsUChar, 0, UPRV_LENGTHOF(kZodiacsUChar)) == 0
+                    || path.compare(startIndex, (length = UPRV_LENGTHOF(kYearsTagUChar)), kYearsTagUChar, 0, UPRV_LENGTHOF(kYearsTagUChar)) == 0
+                    || path.compare(startIndex, (length = UPRV_LENGTHOF(kDayPartsTagUChar)), kDayPartsTagUChar, 0, UPRV_LENGTHOF(kDayPartsTagUChar)) == 0) {
+                    startIndex += length;
+                    length = 0;
+                    if (startIndex == path.length()
+                        || path.compare(startIndex, (length = UPRV_LENGTHOF(kFormatTagUChar)), kFormatTagUChar, 0, UPRV_LENGTHOF(kFormatTagUChar)) == 0) {
+                        startIndex += length;
+                        length = 0;
+                        if (startIndex == path.length()
+                            || path.compare(startIndex, (length = UPRV_LENGTHOF(kAbbrTagUChar)), kAbbrTagUChar, 0, UPRV_LENGTHOF(kAbbrTagUChar)) == 0) {
+                            skip = false;
+                        }
+                    }
+                }
+                if (skip) {
+                    // Drop the latest key on the path and continue
+                    path.retainBetween(0, pathLength);
+                    continue;
+                }
+            }
+
+            // == Handle aliases ==
+            if (arrays.get(path) != nullptr || maps.get(path) != nullptr) {
+                // Drop the latest key on the path and continue
+                path.retainBetween(0, pathLength);
+                continue;
+            }
+
+            AliasType aliasType = processAliasFromValue(path, value, errorCode);
+            if (U_FAILURE(errorCode)) { return; }
+            if (aliasType == SAME_CALENDAR) {
+                // Store the alias path and the current path on aliasPathPairs
+                LocalPointer<UnicodeString> aliasRelativePathCopy(aliasRelativePath.clone(), errorCode);
+                aliasPathPairs.adoptElement(aliasRelativePathCopy.orphan(), errorCode);
+                if (U_FAILURE(errorCode)) { return; }
+                LocalPointer<UnicodeString> pathCopy(path.clone(), errorCode);
+                aliasPathPairs.adoptElement(pathCopy.orphan(), errorCode);
+                if (U_FAILURE(errorCode)) { return; }
+
+                // Drop the latest key on the path and continue
+                path.retainBetween(0, pathLength);
+                continue;
+            }
+            U_ASSERT(aliasType == NONE);
+
+            // == Handle data ==
+            if (value.getType() == URES_ARRAY) {
+                // We are on a leaf, store the array
+                ResourceArray rDataArray = value.getArray(errorCode);
+                int32_t dataArraySize = rDataArray.getSize();
+                LocalArray<UnicodeString> dataArray(new UnicodeString[dataArraySize], errorCode);
+                value.getStringArray(dataArray.getAlias(), dataArraySize, errorCode);
+                arrays.put(path, dataArray.orphan(), errorCode);
+                arraySizes.puti(path, dataArraySize, errorCode);
+                if (U_FAILURE(errorCode)) { return; }
+            } else if (value.getType() == URES_TABLE) {
+                // We are not on a leaf, recursively process the subtable.
+                processResource(path, key, value, errorCode);
+                if (U_FAILURE(errorCode)) { return; }
+            }
+
+            // Drop the latest key on the path
+            path.retainBetween(0, pathLength);
+        }
+    }
+
+    // Populates an AliasIdentifier with the alias information contained on the UResource.Value.
+    AliasType processAliasFromValue(UnicodeString &currentRelativePath, ResourceValue &value,
+                                    UErrorCode &errorCode) {
+        if (U_FAILURE(errorCode)) { return NONE; }
+
+        if (value.getType() == URES_ALIAS) {
+            int32_t aliasPathSize;
+            const char16_t* aliasPathUChar = value.getAliasString(aliasPathSize, errorCode);
+            if (U_FAILURE(errorCode)) { return NONE; }
+            UnicodeString aliasPath(aliasPathUChar, aliasPathSize);
+            const int32_t aliasPrefixLength = UPRV_LENGTHOF(kCalendarAliasPrefixUChar);
+            if (aliasPath.startsWith(kCalendarAliasPrefixUChar, aliasPrefixLength)
+                && aliasPath.length() > aliasPrefixLength) {
+                int32_t typeLimit = aliasPath.indexOf(SOLIDUS, aliasPrefixLength);
+                if (typeLimit > aliasPrefixLength) {
+                    const UnicodeString aliasCalendarType =
+                        aliasPath.tempSubStringBetween(aliasPrefixLength, typeLimit);
+                    aliasRelativePath.setTo(aliasPath, typeLimit + 1, aliasPath.length());
+
+                    if (currentCalendarType == aliasCalendarType
+                        && currentRelativePath != aliasRelativePath) {
+                        // If we have an alias to the same calendar, the path to the resource must be different
+                        return SAME_CALENDAR;
+
+                    } else if (currentCalendarType != aliasCalendarType
+                               && currentRelativePath == aliasRelativePath) {
+                        // If we have an alias to a different calendar, the path to the resource must be the same
+                        if (aliasCalendarType.compare(kGregorianTagUChar, UPRV_LENGTHOF(kGregorianTagUChar)) == 0) {
+                            return GREGORIAN;
+                        } else if (nextCalendarType.isBogus()) {
+                            nextCalendarType = aliasCalendarType;
+                            return DIFFERENT_CALENDAR;
+                        } else if (nextCalendarType == aliasCalendarType) {
+                            return DIFFERENT_CALENDAR;
+                        }
+                    }
+                }
+            }
+            errorCode = U_INTERNAL_PROGRAM_ERROR;
+            return NONE;
+        }
+        return NONE;
+    }
+
+    // Deleter function to be used by 'arrays'
+    static void U_CALLCONV deleteUnicodeStringArray(void *uArray) {
+        delete[] static_cast<UnicodeString *>(uArray);
+    }
+};
+// Virtual destructors have to be defined out of line
+CalendarDataSink::~CalendarDataSink() {
+    arrays.setValueDeleter(deleteUnicodeStringArray);
+}
+}
+
+//------------------------------------------------------
+
+static void
+initField(UnicodeString **field, int32_t& length, const char16_t *data, LastResortSize numStr, LastResortSize strLen, UErrorCode &status) {
+    if (U_SUCCESS(status)) {
+        length = numStr;
+        *field = newUnicodeStringArray(static_cast<size_t>(numStr));
+        if (*field) {
+            for(int32_t i = 0; i<length; i++) {
+                // readonly aliases - all "data" strings are constant
+                // -1 as length for variable-length strings (gLastResortDayNames[0] is empty)
+                (*(field) + i)->setTo(true, data + (i * (static_cast<int32_t>(strLen))), -1);
+            }
+        }
+        else {
+            length = 0;
+            status = U_MEMORY_ALLOCATION_ERROR;
+        }
+    }
+}
+
+static void
+initField(UnicodeString **field, int32_t& length, CalendarDataSink &sink, CharString &key, UErrorCode &status) {
+    if (U_SUCCESS(status)) {
+        UnicodeString keyUString(key.data(), -1, US_INV);
+        UnicodeString* array = static_cast<UnicodeString*>(sink.arrays.get(keyUString));
+
+        if (array != nullptr) {
+            length = sink.arraySizes.geti(keyUString);
+            *field = array;
+            // DateFormatSymbols takes ownership of the array:
+            sink.arrays.remove(keyUString);
+        } else {
+            length = 0;
+            status = U_MISSING_RESOURCE_ERROR;
+        }
+    }
+}
+
+static void
+initField(UnicodeString **field, int32_t& length, CalendarDataSink &sink, CharString &key, int32_t arrayOffset, UErrorCode &status) {
+    if (U_SUCCESS(status)) {
+        UnicodeString keyUString(key.data(), -1, US_INV);
+        UnicodeString* array = static_cast<UnicodeString*>(sink.arrays.get(keyUString));
+
+        if (array != nullptr) {
+            int32_t arrayLength = sink.arraySizes.geti(keyUString);
+            length = arrayLength + arrayOffset;
+            *field = new UnicodeString[length];
+            if (*field == nullptr) {
+                status = U_MEMORY_ALLOCATION_ERROR;
+                return;
+            }
+            uprv_arrayCopy(array, 0, *field, arrayOffset, arrayLength);
+        } else {
+            length = 0;
+            status = U_MISSING_RESOURCE_ERROR;
+        }
+    }
+}
+
+static void
+initEras(UnicodeString **field, int32_t& length, CalendarDataSink &sink, CharString &key, const UResourceBundle *ctebPtr, const char* eraWidth, int32_t maxEra, UErrorCode &status) {
+    if (U_SUCCESS(status)) {
+        length = 0;
+        UnicodeString keyUString(key.data(), -1, US_INV);
+        Hashtable *eraNamesTable = static_cast<Hashtable*>(sink.maps.get(keyUString));
+
+        if (eraNamesTable != nullptr) {
+            UErrorCode resStatus = U_ZERO_ERROR;
+            LocalUResourceBundlePointer ctewb(ures_getByKeyWithFallback(ctebPtr, eraWidth, nullptr, &resStatus));
+            const UResourceBundle *ctewbPtr = (U_SUCCESS(resStatus))? ctewb.getAlias() : nullptr;
+            *field = new UnicodeString[maxEra + 1];
+            if (*field == nullptr) {
+                status = U_MEMORY_ALLOCATION_ERROR;
+                return;
+            }
+            length = maxEra + 1;
+            for (int32_t eraCode = 0; eraCode <= maxEra; eraCode++) {
+                char eraCodeStr[12]; // T_CString_integerToString is documented to generate at most 12 bytes including nul terminator
+                int32_t eraCodeStrLen = T_CString_integerToString(eraCodeStr, eraCode, 10);
+                UnicodeString eraCodeKey = UnicodeString(eraCodeStr, eraCodeStrLen, US_INV);
+                UnicodeString *eraName = static_cast<UnicodeString*>(eraNamesTable->get(eraCodeKey));
+                (*field)[eraCode].remove();
+                if (eraName != nullptr) {
+                    // Get eraName from map (created by CalendarSink)
+                    (*field)[eraCode].fastCopyFrom(*eraName);
+                } else if (ctewbPtr != nullptr) {
+                    // Try filling in missing items from parent locale(s)
+                    resStatus = U_ZERO_ERROR;
+                    LocalUResourceBundlePointer ctewkb(ures_getByKeyWithFallback(ctewbPtr, eraCodeStr, nullptr, &resStatus));
+                    if (U_SUCCESS(resStatus)) {
+                        int32_t eraNameLen;
+                        const UChar* eraNamePtr = ures_getString(ctewkb.getAlias(), &eraNameLen, &resStatus);
+                        if (U_SUCCESS(resStatus)) {
+                            (*field)[eraCode].setTo(false, eraNamePtr, eraNameLen);
+                        }
+                    }
+                }
+            }
+            return;
+        }
+        status = U_MISSING_RESOURCE_ERROR;
+    }
+}
+
+static void
+initLeapMonthPattern(UnicodeString *field, int32_t index, CalendarDataSink &sink, CharString &path, UErrorCode &status) {
+    field[index].remove();
+    if (U_SUCCESS(status)) {
+        UnicodeString pathUString(path.data(), -1, US_INV);
+        Hashtable *leapMonthTable = static_cast<Hashtable*>(sink.maps.get(pathUString));
+        if (leapMonthTable != nullptr) {
+            UnicodeString leapLabel(false, kLeapTagUChar, UPRV_LENGTHOF(kLeapTagUChar));
+            UnicodeString *leapMonthPattern = static_cast<UnicodeString*>(leapMonthTable->get(leapLabel));
+            if (leapMonthPattern != nullptr) {
+                field[index].fastCopyFrom(*leapMonthPattern);
+            } else {
+                field[index].setToBogus();
+            }
+            return;
+        }
+        status = U_MISSING_RESOURCE_ERROR;
+    }
+}
+
+static CharString
+&buildResourcePath(CharString &path, const char* segment1, UErrorCode &errorCode) {
+    return path.clear().append(segment1, -1, errorCode);
+}
+
+static CharString
+&buildResourcePath(CharString &path, const char* segment1, const char* segment2,
+                   UErrorCode &errorCode) {
+    return buildResourcePath(path, segment1, errorCode).append('/', errorCode)
+                                                       .append(segment2, -1, errorCode);
+}
+
+static CharString
+&buildResourcePath(CharString &path, const char* segment1, const char* segment2,
+                   const char* segment3, UErrorCode &errorCode) {
+    return buildResourcePath(path, segment1, segment2, errorCode).append('/', errorCode)
+                                                                 .append(segment3, -1, errorCode);
+}
+
+static CharString
+&buildResourcePath(CharString &path, const char* segment1, const char* segment2,
+                   const char* segment3, const char* segment4, UErrorCode &errorCode) {
+    return buildResourcePath(path, segment1, segment2, segment3, errorCode).append('/', errorCode)
+                                                                           .append(segment4, -1, errorCode);
+}
+
+typedef struct {
+    const char * usageTypeName;
+    DateFormatSymbols::ECapitalizationContextUsageType usageTypeEnumValue;
+} ContextUsageTypeNameToEnumValue;
+
+static const ContextUsageTypeNameToEnumValue contextUsageTypeMap[] = {
+   // Entries must be sorted by usageTypeName; entry with nullptr name terminates list.
+    { "day-format-except-narrow", DateFormatSymbols::kCapContextUsageDayFormat },
+    { "day-narrow",     DateFormatSymbols::kCapContextUsageDayNarrow },
+    { "day-standalone-except-narrow", DateFormatSymbols::kCapContextUsageDayStandalone },
+    { "era-abbr",       DateFormatSymbols::kCapContextUsageEraAbbrev },
+    { "era-name",       DateFormatSymbols::kCapContextUsageEraWide },
+    { "era-narrow",     DateFormatSymbols::kCapContextUsageEraNarrow },
+    { "metazone-long",  DateFormatSymbols::kCapContextUsageMetazoneLong },
+    { "metazone-short", DateFormatSymbols::kCapContextUsageMetazoneShort },
+    { "month-format-except-narrow", DateFormatSymbols::kCapContextUsageMonthFormat },
+    { "month-narrow",   DateFormatSymbols::kCapContextUsageMonthNarrow },
+    { "month-standalone-except-narrow", DateFormatSymbols::kCapContextUsageMonthStandalone },
+    { "zone-long",      DateFormatSymbols::kCapContextUsageZoneLong },
+    { "zone-short",     DateFormatSymbols::kCapContextUsageZoneShort },
+    { nullptr, static_cast<DateFormatSymbols::ECapitalizationContextUsageType>(0) },
+};
+
+// Resource keys to look up localized strings for day periods.
+// The first one must be midnight and the second must be noon, so that their indices coincide
+// with the am/pm field. Formatting and parsing code for day periods relies on this coincidence.
+static const char *dayPeriodKeys[] = {"midnight", "noon",
+                         "morning1", "afternoon1", "evening1", "night1",
+                         "morning2", "afternoon2", "evening2", "night2"};
+
+UnicodeString* loadDayPeriodStrings(CalendarDataSink &sink, CharString &path,
+                                    int32_t &stringCount,  UErrorCode &status) {
+    if (U_FAILURE(status)) { return nullptr; }
+
+    UnicodeString pathUString(path.data(), -1, US_INV);
+    Hashtable* map = static_cast<Hashtable*>(sink.maps.get(pathUString));
+
+    stringCount = UPRV_LENGTHOF(dayPeriodKeys);
+    UnicodeString *strings = new UnicodeString[stringCount];
+    if (strings == nullptr) {
+        status = U_MEMORY_ALLOCATION_ERROR;
+        return nullptr;
+    }
+
+    if (map != nullptr) {
+        for (int32_t i = 0; i < stringCount; ++i) {
+            UnicodeString dayPeriodKey(dayPeriodKeys[i], -1, US_INV);
+            UnicodeString *dayPeriod = static_cast<UnicodeString*>(map->get(dayPeriodKey));
+            if (dayPeriod != nullptr) {
+                strings[i].fastCopyFrom(*dayPeriod);
+            } else {
+                strings[i].setToBogus();
+            }
+        }
+    } else {
+        for (int32_t i = 0; i < stringCount; i++) {
+            strings[i].setToBogus();
+        }
+    }
+    return strings;
+}
+
+
+void
+DateFormatSymbols::initializeData(const Locale& locale, const char *type, UErrorCode& status, UBool useLastResortData)
+{
+    int32_t len = 0;
+    /* In case something goes wrong, initialize all of the data to nullptr. */
+    fEras = nullptr;
+    fErasCount = 0;
+    fEraNames = nullptr;
+    fEraNamesCount = 0;
+    fNarrowEras = nullptr;
+    fNarrowErasCount = 0;
+    fMonths = nullptr;
+    fMonthsCount=0;
+    fShortMonths = nullptr;
+    fShortMonthsCount=0;
+    fNarrowMonths = nullptr;
+    fNarrowMonthsCount=0;
+    fStandaloneMonths = nullptr;
+    fStandaloneMonthsCount=0;
+    fStandaloneShortMonths = nullptr;
+    fStandaloneShortMonthsCount=0;
+    fStandaloneNarrowMonths = nullptr;
+    fStandaloneNarrowMonthsCount=0;
+    fWeekdays = nullptr;
+    fWeekdaysCount=0;
+    fShortWeekdays = nullptr;
+    fShortWeekdaysCount=0;
+    fShorterWeekdays = nullptr;
+    fShorterWeekdaysCount=0;
+    fNarrowWeekdays = nullptr;
+    fNarrowWeekdaysCount=0;
+    fStandaloneWeekdays = nullptr;
+    fStandaloneWeekdaysCount=0;
+    fStandaloneShortWeekdays = nullptr;
+    fStandaloneShortWeekdaysCount=0;
+    fStandaloneShorterWeekdays = nullptr;
+    fStandaloneShorterWeekdaysCount=0;
+    fStandaloneNarrowWeekdays = nullptr;
+    fStandaloneNarrowWeekdaysCount=0;
+    fAmPms = nullptr;
+    fAmPmsCount=0;
+    fWideAmPms = nullptr;
+    fWideAmPmsCount=0;
+    fNarrowAmPms = nullptr;
+    fNarrowAmPmsCount=0;
+    fTimeSeparator.setToBogus();
+    fQuarters = nullptr;
+    fQuartersCount = 0;
+    fShortQuarters = nullptr;
+    fShortQuartersCount = 0;
+    fNarrowQuarters = nullptr;
+    fNarrowQuartersCount = 0;
+    fStandaloneQuarters = nullptr;
+    fStandaloneQuartersCount = 0;
+    fStandaloneShortQuarters = nullptr;
+    fStandaloneShortQuartersCount = 0;
+    fStandaloneNarrowQuarters = nullptr;
+    fStandaloneNarrowQuartersCount = 0;
+    fLeapMonthPatterns = nullptr;
+    fLeapMonthPatternsCount = 0;
+    fShortYearNames = nullptr;
+    fShortYearNamesCount = 0;
+    fShortZodiacNames = nullptr;
+    fShortZodiacNamesCount = 0;
+    fZoneStringsRowCount = 0;
+    fZoneStringsColCount = 0;
+    fZoneStrings = nullptr;
+    fLocaleZoneStrings = nullptr;
+    fAbbreviatedDayPeriods = nullptr;
+    fAbbreviatedDayPeriodsCount = 0;
+    fWideDayPeriods = nullptr;
+    fWideDayPeriodsCount = 0;
+    fNarrowDayPeriods = nullptr;
+    fNarrowDayPeriodsCount = 0;
+    fStandaloneAbbreviatedDayPeriods = nullptr;
+    fStandaloneAbbreviatedDayPeriodsCount = 0;
+    fStandaloneWideDayPeriods = nullptr;
+    fStandaloneWideDayPeriodsCount = 0;
+    fStandaloneNarrowDayPeriods = nullptr;
+    fStandaloneNarrowDayPeriodsCount = 0;
+    uprv_memset(fCapitalization, 0, sizeof(fCapitalization));
+
+    // We need to preserve the requested locale for
+    // lazy ZoneStringFormat instantiation.  ZoneStringFormat
+    // is region sensitive, thus, bundle locale bundle's locale
+    // is not sufficient.
+    fZSFLocale = locale;
+
+    if (U_FAILURE(status)) return;
+
+    // Create a CalendarDataSink to process this data and the resource bundles
+    CalendarDataSink calendarSink(status);
+    LocalUResourceBundlePointer rb(ures_open(nullptr, locale.getBaseName(), &status));
+    LocalUResourceBundlePointer cb(ures_getByKey(rb.getAlias(), gCalendarTag, nullptr, &status));
+
+    if (U_FAILURE(status)) return;
+
+    // Iterate over the resource bundle data following the fallbacks through different calendar types
+    UnicodeString calendarType((type != nullptr && *type != '\0')? type : gGregorianTag, -1, US_INV);
+    while (!calendarType.isBogus()) {
+        CharString calendarTypeBuffer;
+        calendarTypeBuffer.appendInvariantChars(calendarType, status);
+        if (U_FAILURE(status)) { return; }
+        const char *calendarTypeCArray = calendarTypeBuffer.data();
+
+        // Enumerate this calendar type. If the calendar is not found fallback to gregorian
+        UErrorCode oldStatus = status;
+        LocalUResourceBundlePointer ctb(ures_getByKeyWithFallback(cb.getAlias(), calendarTypeCArray, nullptr, &status));
+        if (status == U_MISSING_RESOURCE_ERROR) {
+            if (uprv_strcmp(calendarTypeCArray, gGregorianTag) != 0) {
+                calendarType.setTo(false, kGregorianTagUChar, UPRV_LENGTHOF(kGregorianTagUChar));
+                calendarSink.visitAllResources();
+                status = oldStatus;
+                continue;
+            }
+            return;
+        }
+
+        calendarSink.preEnumerate(calendarType);
+        ures_getAllItemsWithFallback(ctb.getAlias(), "", calendarSink, status);
+        if (U_FAILURE(status)) break;
+
+        // Stop loading when gregorian was loaded
+        if (uprv_strcmp(calendarTypeCArray, gGregorianTag) == 0) {
+            break;
+        }
+
+        // Get the next calendar type to process from the sink
+        calendarType = calendarSink.nextCalendarType;
+
+        // Gregorian is always the last fallback
+        if (calendarType.isBogus()) {
+            calendarType.setTo(false, kGregorianTagUChar, UPRV_LENGTHOF(kGregorianTagUChar));
+            calendarSink.visitAllResources();
+        }
+    }
+
+    // CharString object to build paths
+    CharString path;
+
+    // Load Leap Month Patterns
+    UErrorCode tempStatus = status;
+    fLeapMonthPatterns = newUnicodeStringArray(kMonthPatternsCount);
+    if (fLeapMonthPatterns) {
+        initLeapMonthPattern(fLeapMonthPatterns, kLeapMonthPatternFormatWide, calendarSink,
+                             buildResourcePath(path, gMonthPatternsTag, gNamesFormatTag, gNamesWideTag, tempStatus), tempStatus);
+        initLeapMonthPattern(fLeapMonthPatterns, kLeapMonthPatternFormatAbbrev, calendarSink,
+                             buildResourcePath(path, gMonthPatternsTag, gNamesFormatTag, gNamesAbbrTag, tempStatus), tempStatus);
+        initLeapMonthPattern(fLeapMonthPatterns, kLeapMonthPatternFormatNarrow, calendarSink,
+                             buildResourcePath(path, gMonthPatternsTag, gNamesFormatTag, gNamesNarrowTag, tempStatus), tempStatus);
+        initLeapMonthPattern(fLeapMonthPatterns, kLeapMonthPatternStandaloneWide, calendarSink,
+                             buildResourcePath(path, gMonthPatternsTag, gNamesStandaloneTag, gNamesWideTag, tempStatus), tempStatus);
+        initLeapMonthPattern(fLeapMonthPatterns, kLeapMonthPatternStandaloneAbbrev, calendarSink,
+                             buildResourcePath(path, gMonthPatternsTag, gNamesStandaloneTag, gNamesAbbrTag, tempStatus), tempStatus);
+        initLeapMonthPattern(fLeapMonthPatterns, kLeapMonthPatternStandaloneNarrow, calendarSink,
+                             buildResourcePath(path, gMonthPatternsTag, gNamesStandaloneTag, gNamesNarrowTag, tempStatus), tempStatus);
+        initLeapMonthPattern(fLeapMonthPatterns, kLeapMonthPatternNumeric, calendarSink,
+                             buildResourcePath(path, gMonthPatternsTag, gNamesNumericTag, gNamesAllTag, tempStatus), tempStatus);
+        if (U_SUCCESS(tempStatus)) {
+            // Hack to fix bad C inheritance for dangi monthPatterns (OK in J); this should be handled by aliases in root, but isn't.
+            // The ordering of the following statements is important.
+            if (fLeapMonthPatterns[kLeapMonthPatternFormatAbbrev].isEmpty()) {
+                fLeapMonthPatterns[kLeapMonthPatternFormatAbbrev].setTo(fLeapMonthPatterns[kLeapMonthPatternFormatWide]);
+            }
+            if (fLeapMonthPatterns[kLeapMonthPatternFormatNarrow].isEmpty()) {
+                fLeapMonthPatterns[kLeapMonthPatternFormatNarrow].setTo(fLeapMonthPatterns[kLeapMonthPatternStandaloneNarrow]);
+            }
+            if (fLeapMonthPatterns[kLeapMonthPatternStandaloneWide].isEmpty()) {
+                fLeapMonthPatterns[kLeapMonthPatternStandaloneWide].setTo(fLeapMonthPatterns[kLeapMonthPatternFormatWide]);
+            }
+            if (fLeapMonthPatterns[kLeapMonthPatternStandaloneAbbrev].isEmpty()) {
+                fLeapMonthPatterns[kLeapMonthPatternStandaloneAbbrev].setTo(fLeapMonthPatterns[kLeapMonthPatternFormatAbbrev]);
+            }
+            // end of hack
+            fLeapMonthPatternsCount = kMonthPatternsCount;
+        } else {
+            delete[] fLeapMonthPatterns;
+            fLeapMonthPatterns = nullptr;
+        }
+    }
+
+    // Load cyclic names sets
+    tempStatus = status;
+    initField(&fShortYearNames, fShortYearNamesCount, calendarSink,
+              buildResourcePath(path, gCyclicNameSetsTag, gNameSetYearsTag, gNamesFormatTag, gNamesAbbrTag, tempStatus), tempStatus);
+    initField(&fShortZodiacNames, fShortZodiacNamesCount, calendarSink,
+              buildResourcePath(path, gCyclicNameSetsTag, gNameSetZodiacsTag, gNamesFormatTag, gNamesAbbrTag, tempStatus), tempStatus);
+
+    // Load context transforms and capitalization
+    tempStatus = U_ZERO_ERROR;
+    LocalUResourceBundlePointer localeBundle(ures_open(nullptr, locale.getName(), &tempStatus));
+    if (U_SUCCESS(tempStatus)) {
+        LocalUResourceBundlePointer contextTransforms(ures_getByKeyWithFallback(localeBundle.getAlias(), gContextTransformsTag, nullptr, &tempStatus));
+        if (U_SUCCESS(tempStatus)) {
+            for (LocalUResourceBundlePointer contextTransformUsage;
+                 contextTransformUsage.adoptInstead(ures_getNextResource(contextTransforms.getAlias(), nullptr, &tempStatus)),
+                 contextTransformUsage.isValid();) {
+                const int32_t * intVector = ures_getIntVector(contextTransformUsage.getAlias(), &len, &status);
+                if (U_SUCCESS(tempStatus) && intVector != nullptr && len >= 2) {
+                    const char* usageType = ures_getKey(contextTransformUsage.getAlias());
+                    if (usageType != nullptr) {
+                        const ContextUsageTypeNameToEnumValue * typeMapPtr = contextUsageTypeMap;
+                        int32_t compResult = 0;
+                        // linear search; list is short and we cannot be sure that bsearch is available
+                        while ( typeMapPtr->usageTypeName != nullptr && (compResult = uprv_strcmp(usageType, typeMapPtr->usageTypeName)) > 0 ) {
+                            ++typeMapPtr;
+                        }
+                        if (typeMapPtr->usageTypeName != nullptr && compResult == 0) {
+                            fCapitalization[typeMapPtr->usageTypeEnumValue][0] = static_cast<UBool>(intVector[0]);
+                            fCapitalization[typeMapPtr->usageTypeEnumValue][1] = static_cast<UBool>(intVector[1]);
+                        }
+                    }
+                }
+                tempStatus = U_ZERO_ERROR;
+            }
+        }
+
+        tempStatus = U_ZERO_ERROR;
+        const LocalPointer<NumberingSystem> numberingSystem(
+                NumberingSystem::createInstance(locale, tempStatus), tempStatus);
+        if (U_SUCCESS(tempStatus)) {
+            // These functions all fail gracefully if passed nullptr pointers and
+            // do nothing unless U_SUCCESS(tempStatus), so it's only necessary
+            // to check for errors once after all calls are made.
+            const LocalUResourceBundlePointer numberElementsData(ures_getByKeyWithFallback(
+                    localeBundle.getAlias(), gNumberElementsTag, nullptr, &tempStatus));
+            const LocalUResourceBundlePointer nsNameData(ures_getByKeyWithFallback(
+                    numberElementsData.getAlias(), numberingSystem->getName(), nullptr, &tempStatus));
+            const LocalUResourceBundlePointer symbolsData(ures_getByKeyWithFallback(
+                    nsNameData.getAlias(), gSymbolsTag, nullptr, &tempStatus));
+            fTimeSeparator = ures_getUnicodeStringByKey(
+                    symbolsData.getAlias(), gTimeSeparatorTag, &tempStatus);
+            if (U_FAILURE(tempStatus)) {
+                fTimeSeparator.setToBogus();
+            }
+        }
+
+    }
+
+    if (fTimeSeparator.isBogus()) {
+        fTimeSeparator.setTo(DateFormatSymbols::DEFAULT_TIME_SEPARATOR);
+    }
+
+    // Load day periods
+    fAbbreviatedDayPeriods = loadDayPeriodStrings(calendarSink,
+                            buildResourcePath(path, gDayPeriodTag, gNamesFormatTag, gNamesAbbrTag, status),
+                            fAbbreviatedDayPeriodsCount, status);
+
+    fWideDayPeriods = loadDayPeriodStrings(calendarSink,
+                            buildResourcePath(path, gDayPeriodTag, gNamesFormatTag, gNamesWideTag, status),
+                            fWideDayPeriodsCount, status);
+    fNarrowDayPeriods = loadDayPeriodStrings(calendarSink,
+                            buildResourcePath(path, gDayPeriodTag, gNamesFormatTag, gNamesNarrowTag, status),
+                            fNarrowDayPeriodsCount, status);
+
+    fStandaloneAbbreviatedDayPeriods = loadDayPeriodStrings(calendarSink,
+                            buildResourcePath(path, gDayPeriodTag, gNamesStandaloneTag, gNamesAbbrTag, status),
+                            fStandaloneAbbreviatedDayPeriodsCount, status);
+
+    fStandaloneWideDayPeriods = loadDayPeriodStrings(calendarSink,
+                            buildResourcePath(path, gDayPeriodTag, gNamesStandaloneTag, gNamesWideTag, status),
+                            fStandaloneWideDayPeriodsCount, status);
+    fStandaloneNarrowDayPeriods = loadDayPeriodStrings(calendarSink,
+                            buildResourcePath(path, gDayPeriodTag, gNamesStandaloneTag, gNamesNarrowTag, status),
+                            fStandaloneNarrowDayPeriodsCount, status);
+
+    // Fill in for missing/bogus items (dayPeriods are a map so single items might be missing)
+    if (U_SUCCESS(status)) {
+        for (int32_t dpidx = 0; dpidx < fAbbreviatedDayPeriodsCount; ++dpidx) {
+            if (dpidx < fWideDayPeriodsCount && fWideDayPeriods != nullptr && fWideDayPeriods[dpidx].isBogus()) {
+                fWideDayPeriods[dpidx].fastCopyFrom(fAbbreviatedDayPeriods[dpidx]);
+            }
+            if (dpidx < fNarrowDayPeriodsCount && fNarrowDayPeriods != nullptr && fNarrowDayPeriods[dpidx].isBogus()) {
+                fNarrowDayPeriods[dpidx].fastCopyFrom(fAbbreviatedDayPeriods[dpidx]);
+            }
+            if (dpidx < fStandaloneAbbreviatedDayPeriodsCount && fStandaloneAbbreviatedDayPeriods != nullptr && fStandaloneAbbreviatedDayPeriods[dpidx].isBogus()) {
+                fStandaloneAbbreviatedDayPeriods[dpidx].fastCopyFrom(fAbbreviatedDayPeriods[dpidx]);
+            }
+            if (dpidx < fStandaloneWideDayPeriodsCount && fStandaloneWideDayPeriods != nullptr && fStandaloneWideDayPeriods[dpidx].isBogus()) {
+                fStandaloneWideDayPeriods[dpidx].fastCopyFrom(fStandaloneAbbreviatedDayPeriods[dpidx]);
+            }
+            if (dpidx < fStandaloneNarrowDayPeriodsCount && fStandaloneNarrowDayPeriods != nullptr && fStandaloneNarrowDayPeriods[dpidx].isBogus()) {
+                fStandaloneNarrowDayPeriods[dpidx].fastCopyFrom(fStandaloneAbbreviatedDayPeriods[dpidx]);
+            }
+        }
+    }
+
+    // if we make it to here, the resource data is cool, and we can get everything out
+    // of it that we need except for the time-zone and localized-pattern data, which
+    // are stored in a separate file
+    validLocale = Locale(ures_getLocaleByType(cb.getAlias(), ULOC_VALID_LOCALE, &status));
+    actualLocale = Locale(ures_getLocaleByType(cb.getAlias(), ULOC_ACTUAL_LOCALE, &status));
+
+    // Era setup
+    if (type == nullptr) {
+        type = "gregorian";
+    }
+    LocalPointer<EraRules> eraRules(EraRules::createInstance(type, false, status));
+    int32_t maxEra = (U_SUCCESS(status))? eraRules->getMaxEraCode(): 0;
+    UErrorCode resStatus = U_ZERO_ERROR;
+    LocalUResourceBundlePointer ctpb(ures_getByKeyWithFallback(cb.getAlias(), type, nullptr, &resStatus));
+    LocalUResourceBundlePointer cteb(ures_getByKeyWithFallback(ctpb.getAlias(), gErasTag, nullptr, &resStatus));
+    const UResourceBundle *ctebPtr = (U_SUCCESS(resStatus))? cteb.getAlias() : nullptr;
+    // Load eras
+    initEras(&fEras, fErasCount, calendarSink, buildResourcePath(path, gErasTag, gNamesAbbrTag, status),
+            ctebPtr, gNamesAbbrTag, maxEra, status);
+    UErrorCode oldStatus = status;
+    initEras(&fEraNames, fEraNamesCount, calendarSink, buildResourcePath(path, gErasTag, gNamesWideTag, status),
+            ctebPtr, gNamesWideTag, maxEra, status);
+    if (status == U_MISSING_RESOURCE_ERROR) { // Workaround because eras/wide was omitted from CLDR 1.3
+        status = U_ZERO_ERROR;
+        assignArray(fEraNames, fEraNamesCount, fEras, fErasCount);
+    }
+    // current ICU4J falls back to abbreviated if narrow eras are missing, so we will too
+    oldStatus = status;
+    initEras(&fNarrowEras, fNarrowErasCount, calendarSink, buildResourcePath(path, gErasTag, gNamesNarrowTag, status),
+            ctebPtr, gNamesNarrowTag, maxEra, status);
+    if (status == U_MISSING_RESOURCE_ERROR) { // Workaround because eras/wide was omitted from CLDR 1.3
+        status = U_ZERO_ERROR;
+        assignArray(fNarrowEras, fNarrowErasCount, fEras, fErasCount);
+    }
+
+    // Load month names
+    initField(&fMonths, fMonthsCount, calendarSink,
+              buildResourcePath(path, gMonthNamesTag, gNamesFormatTag, gNamesWideTag, status), status);
+    initField(&fShortMonths, fShortMonthsCount, calendarSink,
+              buildResourcePath(path, gMonthNamesTag, gNamesFormatTag, gNamesAbbrTag, status), status);
+    initField(&fStandaloneMonths, fStandaloneMonthsCount, calendarSink,
+              buildResourcePath(path, gMonthNamesTag, gNamesStandaloneTag, gNamesWideTag, status), status);
+    if (status == U_MISSING_RESOURCE_ERROR) { /* If standalone/wide not available, use format/wide */
+        status = U_ZERO_ERROR;
+        assignArray(fStandaloneMonths, fStandaloneMonthsCount, fMonths, fMonthsCount);
+    }
+    initField(&fStandaloneShortMonths, fStandaloneShortMonthsCount, calendarSink,
+              buildResourcePath(path, gMonthNamesTag, gNamesStandaloneTag, gNamesAbbrTag, status), status);
+    if (status == U_MISSING_RESOURCE_ERROR) { /* If standalone/abbreviated not available, use format/abbreviated */
+        status = U_ZERO_ERROR;
+        assignArray(fStandaloneShortMonths, fStandaloneShortMonthsCount, fShortMonths, fShortMonthsCount);
+    }
+
+    UErrorCode narrowMonthsEC = status;
+    UErrorCode standaloneNarrowMonthsEC = status;
+    initField(&fNarrowMonths, fNarrowMonthsCount, calendarSink,
+              buildResourcePath(path, gMonthNamesTag, gNamesFormatTag, gNamesNarrowTag, narrowMonthsEC), narrowMonthsEC);
+    initField(&fStandaloneNarrowMonths, fStandaloneNarrowMonthsCount, calendarSink,
+              buildResourcePath(path, gMonthNamesTag, gNamesStandaloneTag, gNamesNarrowTag, narrowMonthsEC), standaloneNarrowMonthsEC);
+    if (narrowMonthsEC == U_MISSING_RESOURCE_ERROR && standaloneNarrowMonthsEC != U_MISSING_RESOURCE_ERROR) {
+        // If format/narrow not available, use standalone/narrow
+        assignArray(fNarrowMonths, fNarrowMonthsCount, fStandaloneNarrowMonths, fStandaloneNarrowMonthsCount);
+    } else if (narrowMonthsEC != U_MISSING_RESOURCE_ERROR && standaloneNarrowMonthsEC == U_MISSING_RESOURCE_ERROR) {
+        // If standalone/narrow not available, use format/narrow
+        assignArray(fStandaloneNarrowMonths, fStandaloneNarrowMonthsCount, fNarrowMonths, fNarrowMonthsCount);
+    } else if (narrowMonthsEC == U_MISSING_RESOURCE_ERROR && standaloneNarrowMonthsEC == U_MISSING_RESOURCE_ERROR) {
+        // If neither is available, use format/abbreviated
+        assignArray(fNarrowMonths, fNarrowMonthsCount, fShortMonths, fShortMonthsCount);
+        assignArray(fStandaloneNarrowMonths, fStandaloneNarrowMonthsCount, fShortMonths, fShortMonthsCount);
+    }
+
+    // Load AM/PM markers.
+    ErrorCode ampmStatus;
+    initField(&fAmPms, fAmPmsCount, calendarSink,
+              buildResourcePath(path, gAmPmMarkersAbbrTag, ampmStatus), ampmStatus);
+    if (ampmStatus.isFailure()) {
+        // No-op: fall back to last-resort names, which are pre-populated
+    }
+    ampmStatus.reset();
+    initField(&fNarrowAmPms, fNarrowAmPmsCount, calendarSink,
+              buildResourcePath(path, gAmPmMarkersNarrowTag, ampmStatus), ampmStatus);
+    if (ampmStatus.isFailure()) {
+        // Narrow falls back to Abbreviated
+        assignArray(fNarrowAmPms, fNarrowAmPmsCount, fAmPms, fAmPmsCount);
+    }
+    ampmStatus.reset();
+    initField(&fWideAmPms, fWideAmPmsCount, calendarSink,
+              buildResourcePath(path, gAmPmMarkersTag, ampmStatus), ampmStatus);
+    if (ampmStatus.isFailure()) {
+        // Wide falls back to Abbreviated
+        assignArray(fWideAmPms, fWideAmPmsCount, fAmPms, fAmPmsCount);
+    }
+    ampmStatus.reset();
+
+    // Load quarters
+    initField(&fQuarters, fQuartersCount, calendarSink,
+              buildResourcePath(path, gQuartersTag, gNamesFormatTag, gNamesWideTag, status), status);
+    initField(&fShortQuarters, fShortQuartersCount, calendarSink,
+              buildResourcePath(path, gQuartersTag, gNamesFormatTag, gNamesAbbrTag, status), status);
+    if(status == U_MISSING_RESOURCE_ERROR) {
+        status = U_ZERO_ERROR;
+        assignArray(fShortQuarters, fShortQuartersCount, fQuarters, fQuartersCount);
+    }
+
+    initField(&fStandaloneQuarters, fStandaloneQuartersCount, calendarSink,
+              buildResourcePath(path, gQuartersTag, gNamesStandaloneTag, gNamesWideTag, status), status);
+    if(status == U_MISSING_RESOURCE_ERROR) {
+        status = U_ZERO_ERROR;
+        assignArray(fStandaloneQuarters, fStandaloneQuartersCount, fQuarters, fQuartersCount);
+    }
+    initField(&fStandaloneShortQuarters, fStandaloneShortQuartersCount, calendarSink,
+              buildResourcePath(path, gQuartersTag, gNamesStandaloneTag, gNamesAbbrTag, status), status);
+    if(status == U_MISSING_RESOURCE_ERROR) {
+        status = U_ZERO_ERROR;
+        assignArray(fStandaloneShortQuarters, fStandaloneShortQuartersCount, fShortQuarters, fShortQuartersCount);
+    }
+
+    // unlike the fields above, narrow format quarters fall back on narrow standalone quarters
+    initField(&fStandaloneNarrowQuarters, fStandaloneNarrowQuartersCount, calendarSink,
+              buildResourcePath(path, gQuartersTag, gNamesStandaloneTag, gNamesNarrowTag, status), status);
+    initField(&fNarrowQuarters, fNarrowQuartersCount, calendarSink,
+              buildResourcePath(path, gQuartersTag, gNamesFormatTag, gNamesNarrowTag, status), status);
+    if(status == U_MISSING_RESOURCE_ERROR) {
+        status = U_ZERO_ERROR;
+        assignArray(fNarrowQuarters, fNarrowQuartersCount, fStandaloneNarrowQuarters, fStandaloneNarrowQuartersCount);
+    }
+    
+    // ICU 3.8 or later version no longer uses localized date-time pattern characters by default (ticket#5597)
+    /*
+    // fastCopyFrom()/setTo() - see assignArray comments
+    resStr = ures_getStringByKey(fResourceBundle, gLocalPatternCharsTag, &len, &status);
+    fLocalPatternChars.setTo(true, resStr, len);
+    // If the locale data does not include new pattern chars, use the defaults
+    // TODO: Consider making this an error, since this may add conflicting characters.
+    if (len < PATTERN_CHARS_LEN) {
+        fLocalPatternChars.append(UnicodeString(true, &gPatternChars[len], PATTERN_CHARS_LEN-len));
+    }
+    */
+    fLocalPatternChars.setTo(true, gPatternChars, PATTERN_CHARS_LEN);
+
+    // Format wide weekdays -> fWeekdays
+    // {sfb} fixed to handle 1-based weekdays
+    initField(&fWeekdays, fWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesFormatTag, gNamesWideTag, status), 1, status);
+
+    // Format abbreviated weekdays -> fShortWeekdays
+    initField(&fShortWeekdays, fShortWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesFormatTag, gNamesAbbrTag, status), 1, status);
+
+    // Format short weekdays -> fShorterWeekdays (fall back to abbreviated)
+    initField(&fShorterWeekdays, fShorterWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesFormatTag, gNamesShortTag, status), 1, status);
+    if (status == U_MISSING_RESOURCE_ERROR) {
+        status = U_ZERO_ERROR;
+        assignArray(fShorterWeekdays, fShorterWeekdaysCount, fShortWeekdays, fShortWeekdaysCount);
+    }
+
+    // Stand-alone wide weekdays -> fStandaloneWeekdays
+    initField(&fStandaloneWeekdays, fStandaloneWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesStandaloneTag, gNamesWideTag, status), 1, status);
+    if (status == U_MISSING_RESOURCE_ERROR) { /* If standalone/wide is not available, use format/wide */
+        status = U_ZERO_ERROR;
+        assignArray(fStandaloneWeekdays, fStandaloneWeekdaysCount, fWeekdays, fWeekdaysCount);
+    }
+
+    // Stand-alone abbreviated weekdays -> fStandaloneShortWeekdays
+    initField(&fStandaloneShortWeekdays, fStandaloneShortWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesStandaloneTag, gNamesAbbrTag, status), 1, status);
+    if (status == U_MISSING_RESOURCE_ERROR) { /* If standalone/abbreviated is not available, use format/abbreviated */
+        status = U_ZERO_ERROR;
+        assignArray(fStandaloneShortWeekdays, fStandaloneShortWeekdaysCount, fShortWeekdays, fShortWeekdaysCount);
+    }
+
+    // Stand-alone short weekdays -> fStandaloneShorterWeekdays (fall back to format abbreviated)
+    initField(&fStandaloneShorterWeekdays, fStandaloneShorterWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesStandaloneTag, gNamesShortTag, status), 1, status);
+    if (status == U_MISSING_RESOURCE_ERROR) { /* If standalone/short is not available, use format/short */
+        status = U_ZERO_ERROR;
+        assignArray(fStandaloneShorterWeekdays, fStandaloneShorterWeekdaysCount, fShorterWeekdays, fShorterWeekdaysCount);
+    }
+
+    // Format narrow weekdays -> fNarrowWeekdays
+    UErrorCode narrowWeeksEC = status;
+    initField(&fNarrowWeekdays, fNarrowWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesFormatTag, gNamesNarrowTag, status), 1, narrowWeeksEC);
+    // Stand-alone narrow weekdays -> fStandaloneNarrowWeekdays
+    UErrorCode standaloneNarrowWeeksEC = status;
+    initField(&fStandaloneNarrowWeekdays, fStandaloneNarrowWeekdaysCount, calendarSink,
+              buildResourcePath(path, gDayNamesTag, gNamesStandaloneTag, gNamesNarrowTag, status), 1, standaloneNarrowWeeksEC);
+
+    if (narrowWeeksEC == U_MISSING_RESOURCE_ERROR && standaloneNarrowWeeksEC != U_MISSING_RESOURCE_ERROR) {
+        // If format/narrow not available, use standalone/narrow
+        assignArray(fNarrowWeekdays, fNarrowWeekdaysCount, fStandaloneNarrowWeekdays, fStandaloneNarrowWeekdaysCount);
+    } else if (narrowWeeksEC != U_MISSING_RESOURCE_ERROR && standaloneNarrowWeeksEC == U_MISSING_RESOURCE_ERROR) {
+        // If standalone/narrow not available, use format/narrow
+        assignArray(fStandaloneNarrowWeekdays, fStandaloneNarrowWeekdaysCount, fNarrowWeekdays, fNarrowWeekdaysCount);
+    } else if (narrowWeeksEC == U_MISSING_RESOURCE_ERROR && standaloneNarrowWeeksEC == U_MISSING_RESOURCE_ERROR ) {
+        // If neither is available, use format/abbreviated
+        assignArray(fNarrowWeekdays, fNarrowWeekdaysCount, fShortWeekdays, fShortWeekdaysCount);
+        assignArray(fStandaloneNarrowWeekdays, fStandaloneNarrowWeekdaysCount, fShortWeekdays, fShortWeekdaysCount);
+    }
+
+    // Last resort fallback in case previous data wasn't loaded
+    if (U_FAILURE(status))
+    {
+        if (useLastResortData)
+        {
+            // Handle the case in which there is no resource data present.
+            // We don't have to generate usable patterns in this situation;
+            // we just need to produce something that will be semi-intelligible
+            // in most locales.
+
+            status = U_USING_FALLBACK_WARNING;
+            //TODO(fabalbon): make sure we are storing las resort data for all fields in here.
+            initField(&fEras, fErasCount, reinterpret_cast<const char16_t*>(gLastResortEras), kEraNum, kEraLen, status);
+            initField(&fEraNames, fEraNamesCount, reinterpret_cast<const char16_t*>(gLastResortEras), kEraNum, kEraLen, status);
+            initField(&fNarrowEras, fNarrowErasCount, reinterpret_cast<const char16_t*>(gLastResortEras), kEraNum, kEraLen, status);
+            initField(&fMonths, fMonthsCount, reinterpret_cast<const char16_t*>(gLastResortMonthNames), kMonthNum, kMonthLen, status);
+            initField(&fShortMonths, fShortMonthsCount, reinterpret_cast<const char16_t*>(gLastResortMonthNames), kMonthNum, kMonthLen, status);
+            initField(&fNarrowMonths, fNarrowMonthsCount, reinterpret_cast<const char16_t*>(gLastResortMonthNames), kMonthNum, kMonthLen, status);
+            initField(&fStandaloneMonths, fStandaloneMonthsCount, reinterpret_cast<const char16_t*>(gLastResortMonthNames), kMonthNum, kMonthLen, status);
+            initField(&fStandaloneShortMonths, fStandaloneShortMonthsCount, reinterpret_cast<const char16_t*>(gLastResortMonthNames), kMonthNum, kMonthLen, status);
+            initField(&fStandaloneNarrowMonths, fStandaloneNarrowMonthsCount, reinterpret_cast<const char16_t*>(gLastResortMonthNames), kMonthNum, kMonthLen, status);
+            initField(&fWeekdays, fWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fShortWeekdays, fShortWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fShorterWeekdays, fShorterWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fNarrowWeekdays, fNarrowWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fStandaloneWeekdays, fStandaloneWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fStandaloneShortWeekdays, fStandaloneShortWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fStandaloneShorterWeekdays, fStandaloneShorterWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fStandaloneNarrowWeekdays, fStandaloneNarrowWeekdaysCount, reinterpret_cast<const char16_t*>(gLastResortDayNames), kDayNum, kDayLen, status);
+            initField(&fAmPms, fAmPmsCount, reinterpret_cast<const char16_t*>(gLastResortAmPmMarkers), kAmPmNum, kAmPmLen, status);
+            initField(&fNarrowAmPms, fNarrowAmPmsCount, reinterpret_cast<const char16_t*>(gLastResortAmPmMarkers), kAmPmNum, kAmPmLen, status);
+            initField(&fQuarters, fQuartersCount, reinterpret_cast<const char16_t*>(gLastResortQuarters), kQuarterNum, kQuarterLen, status);
+            initField(&fShortQuarters, fShortQuartersCount, reinterpret_cast<const char16_t*>(gLastResortQuarters), kQuarterNum, kQuarterLen, status);
+            initField(&fNarrowQuarters, fNarrowQuartersCount, reinterpret_cast<const char16_t*>(gLastResortQuarters), kQuarterNum, kQuarterLen, status);
+            initField(&fStandaloneQuarters, fStandaloneQuartersCount, reinterpret_cast<const char16_t*>(gLastResortQuarters), kQuarterNum, kQuarterLen, status);
+            initField(&fStandaloneShortQuarters, fStandaloneShortQuartersCount, reinterpret_cast<const char16_t*>(gLastResortQuarters), kQuarterNum, kQuarterLen, status);
+            initField(&fStandaloneNarrowQuarters, fStandaloneNarrowQuartersCount, reinterpret_cast<const char16_t*>(gLastResortQuarters), kQuarterNum, kQuarterLen, status);
+            fLocalPatternChars.setTo(true, gPatternChars, PATTERN_CHARS_LEN);
+        }
+    }
+}
+
+Locale
+DateFormatSymbols::getLocale(ULocDataLocaleType type, UErrorCode& status) const {
+    return LocaleBased::getLocale(validLocale, actualLocale, type, status);
+}
+
+U_NAMESPACE_END
+
+#endif /* #if !UCONFIG_NO_FORMATTING */
+
+//eof

From d7805e00dc7043f439e943ca5132244751fa3ba9 Mon Sep 17 00:00:00 2001
From: Paul Bouchon <mail@bitpshr.net>
Date: Wed, 12 Aug 2026 17:47:11 -0400
Subject: [PATCH 140/344] module: fix --check on ambiguous ESM files

A `.js` file with no `"type"` in the nearest package.json has no format
of its own, and `defaultGetFormat()` reports it as null. `--check`
passed that null straight to `wrapSafe()`, which parses as CommonJS.
Module syntax makes that parse bail out early, so the file was reported
as valid and `--check` exited 0 even though it is not valid JavaScript
under either goal.

At load time the goal for such a file is decided by looking for module
syntax in the source. Decide it the same way here, so the file is
parsed as a module and its real syntax error is reported. Files whose
format is known are unaffected, as are ambiguous files without module
syntax, which are still parsed as CommonJS.

Fixes: https://github.com/nodejs/node/issues/65202
Signed-off-by: Paul Bouchon <mail@bitpshr.net>
PR-URL: https://github.com/nodejs/node/pull/65203
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/main/check_syntax.js                | 12 ++++++++++++
 test/fixtures/syntax/bad_syntax_esm_ambiguous.js |  2 ++
 test/sequential/test-cli-syntax-bad.js           |  3 +++
 3 files changed, 17 insertions(+)
 create mode 100644 test/fixtures/syntax/bad_syntax_esm_ambiguous.js

diff --git a/lib/internal/main/check_syntax.js b/lib/internal/main/check_syntax.js
index 16e367c4e089..7bc7bbc1ede4 100644
--- a/lib/internal/main/check_syntax.js
+++ b/lib/internal/main/check_syntax.js
@@ -67,6 +67,18 @@ async function checkSyntax(source, filename) {
     format = await defaultGetFormat(new URL(url));
   }
 
+  // A `.js` file with no `"type"` in the nearest package.json has no format of
+  // its own. At load time the goal is decided by looking for module syntax in
+  // the source, so decide it the same way here. Otherwise such a file is only
+  // ever parsed as CommonJS, where module syntax makes the parse bail out
+  // before any syntax error in the rest of the file is reported.
+  if (format === null || format === undefined) {
+    const { containsModuleSyntax } = internalBinding('contextify');
+    if (containsModuleSyntax(source, filename)) {
+      format = 'module';
+    }
+  }
+
   if (format === 'module') {
     const { ModuleWrap } = internalBinding('module_wrap');
     new ModuleWrap(filename, undefined, source, 0, 0);
diff --git a/test/fixtures/syntax/bad_syntax_esm_ambiguous.js b/test/fixtures/syntax/bad_syntax_esm_ambiguous.js
new file mode 100644
index 000000000000..511f42994f90
--- /dev/null
+++ b/test/fixtures/syntax/bad_syntax_esm_ambiguous.js
@@ -0,0 +1,2 @@
+import fs from 'node:fs';
+var = ;
diff --git a/test/sequential/test-cli-syntax-bad.js b/test/sequential/test-cli-syntax-bad.js
index e967ff36ac28..0cf9d020b30f 100644
--- a/test/sequential/test-cli-syntax-bad.js
+++ b/test/sequential/test-cli-syntax-bad.js
@@ -21,6 +21,9 @@ const syntaxErrorRE = /^SyntaxError: \b/m;
   'syntax/bad_syntax',
   'syntax/bad_syntax_shebang.js',
   'syntax/bad_syntax_shebang',
+  // A `.js` file with no `"type"` in the nearest package.json, whose module
+  // syntax makes it load as ESM. Refs: https://github.com/nodejs/node/issues/65202
+  'syntax/bad_syntax_esm_ambiguous.js',
 ].forEach((file) => {
   const path = fixtures.path(file);
 

From 374f7e214d523c2bea3693b8e04657ad3fa7c603 Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Thu, 13 Aug 2026 16:29:17 +0900
Subject: [PATCH 141/344] stream: use validateBuffer for BYOB reader view

The same check is already spelled validateBuffer(view, 'view') in
ReadableStreamBYOBRequest.respondWithNewView(), and the thrown error is
unchanged.

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65046
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/webstreams/readablestream.js | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index e1e80eb953c0..b05cb7c257eb 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -1060,17 +1060,7 @@ class ReadableStreamBYOBReader {
   async read(view, options = kEmptyObject) {
     if (!isReadableStreamBYOBReader(this))
       throw new ERR_INVALID_THIS('ReadableStreamBYOBReader');
-    if (!isArrayBufferView(view)) {
-      throw new ERR_INVALID_ARG_TYPE(
-        'view',
-        [
-          'Buffer',
-          'TypedArray',
-          'DataView',
-        ],
-        view,
-      );
-    }
+    validateBuffer(view, 'view');
     validateObject(options, 'options', kValidateObjectAllowObjectsAndNull);
 
     const viewByteLength = ArrayBufferViewGetByteLength(view);

From 6a142c03e90e051a85c93d40556449af84537e08 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Fri, 7 Aug 2026 20:14:51 +0200
Subject: [PATCH 142/344] crypto: read WebCrypto inputs through primordials

BufferSource conversion hands over the caller's own object uncopied, so
byteLength, byteOffset, buffer and length reads on it run
user-replaceable prototype accessors. Internal lookup tables are indexed
with computed keys, so a polluted %Object.prototype% key answers a miss.
The %Set% constructor iterates its argument through the user-mutable
%Array.prototype% iterator.

The algorithm registry and the hash name tables are detached from
%Object.prototype% after construction rather than declared
`__proto__: null`, which V8 places in dictionary mode.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65115
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/crypto/aes.js                    |   3 +-
 lib/internal/crypto/cfrg.js                   |   4 +-
 lib/internal/crypto/diffiehellman.js          |   3 +-
 lib/internal/crypto/ec.js                     |   7 +-
 lib/internal/crypto/hash.js                   |   5 +-
 lib/internal/crypto/hashnames.js              |  14 +-
 lib/internal/crypto/keys.js                   |   4 +-
 lib/internal/crypto/ml_dsa.js                 |   7 +-
 lib/internal/crypto/ml_kem.js                 |   7 +-
 lib/internal/crypto/rsa.js                    |   6 +-
 lib/internal/crypto/util.js                   |  90 +++-
 lib/internal/crypto/webcrypto.js              |  13 +-
 lib/internal/crypto/webcrypto_util.js         |  13 +-
 lib/internal/crypto/webidl.js                 |  42 +-
 .../test-webcrypto-prototype-pollution.mjs    | 469 ++++++++++++++++++
 15 files changed, 618 insertions(+), 69 deletions(-)
 create mode 100644 test/parallel/test-webcrypto-prototype-pollution.mjs

diff --git a/lib/internal/crypto/aes.js b/lib/internal/crypto/aes.js
index 7ce1dabbf7c5..3280ddff8459 100644
--- a/lib/internal/crypto/aes.js
+++ b/lib/internal/crypto/aes.js
@@ -24,6 +24,7 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  getBufferSourceByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -218,7 +219,7 @@ function aesImportKey(
       if (format === 'raw' && name === 'AES-OCB') {
         return undefined;
       }
-      length = keyData.byteLength * 8;
+      length = getBufferSourceByteLength(keyData) * 8;
       validateKeyLength(length);
       handle = importSecretKey(keyData);
       break;
diff --git a/lib/internal/crypto/cfrg.js b/lib/internal/crypto/cfrg.js
index 994b8f510c49..9eea26aa36a0 100644
--- a/lib/internal/crypto/cfrg.js
+++ b/lib/internal/crypto/cfrg.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   StringPrototypeToLowerCase,
   TypedArrayPrototypeGetBuffer,
 } = primordials;
@@ -27,6 +26,7 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -124,7 +124,7 @@ function cfrgImportKey(
   const { name } = algorithm;
   let handle;
   const allowedUsages = kUsages[name];
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(
diff --git a/lib/internal/crypto/diffiehellman.js b/lib/internal/crypto/diffiehellman.js
index 367ca9df1f13..c41b192ca8c8 100644
--- a/lib/internal/crypto/diffiehellman.js
+++ b/lib/internal/crypto/diffiehellman.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  ArrayBufferPrototypeGetByteLength,
   ArrayBufferPrototypeSlice,
   FunctionPrototypeCall,
   ObjectDefineProperty,
@@ -414,7 +415,7 @@ function ecdhDeriveBits(algorithm, baseKey, length) {
   return jobPromiseThen(bits, (bits) => {
     const sliceLength = numBitsToBytes(length);
 
-    const { byteLength } = bits;
+    const byteLength = ArrayBufferPrototypeGetByteLength(bits);
     // If the length is larger than the derived secret, throw.
     if (byteLength < sliceLength)
       throw lazyDOMException('derived bit length is too small', 'OperationError');
diff --git a/lib/internal/crypto/ec.js b/lib/internal/crypto/ec.js
index fc19e7cce6a5..cbd89dd11c7e 100644
--- a/lib/internal/crypto/ec.js
+++ b/lib/internal/crypto/ec.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
 } = primordials;
@@ -33,6 +32,7 @@ const {
   jobPromise,
   normalizeHashName,
   kNamedCurveAliases,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -142,7 +142,7 @@ function ecImportKey(
 
   let handle;
   const allowedUsages = kUsages[name];
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(
@@ -215,7 +215,8 @@ function ecImportKey(
     throw lazyDOMException('Invalid keyData', 'DataError');
   }
 
-  if (kNamedCurveAliases[namedCurve] !== handle.keyDetail({}).namedCurve)
+  if (kNamedCurveAliases[namedCurve] !==
+      handle.keyDetail({ __proto__: null }).namedCurve)
     throw lazyDOMException('Named curve mismatch', 'DataError');
 
   return new InternalCryptoKey(
diff --git a/lib/internal/crypto/hash.js b/lib/internal/crypto/hash.js
index 60d34aae902c..a32d74f65cb4 100644
--- a/lib/internal/crypto/hash.js
+++ b/lib/internal/crypto/hash.js
@@ -31,6 +31,7 @@ const {
   kHandle,
   getCachedHashId,
   getHashCache,
+  getOptionalByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -234,8 +235,8 @@ function asyncDigest(algorithm, data) {
       // Fall through
     case 'cSHAKE256': {
       const outputLength = algorithm.outputLength;
-      if (algorithm.functionName?.byteLength ||
-          algorithm.customization?.byteLength) {
+      if (getOptionalByteLength(algorithm.functionName) ||
+          getOptionalByteLength(algorithm.customization)) {
         if (CShakeJob === undefined) {
           throw lazyDOMException(
             'Non-empty CShakeParams functionName or customization is not supported',
diff --git a/lib/internal/crypto/hashnames.js b/lib/internal/crypto/hashnames.js
index 7a625c47e2f4..c39d696a8011 100644
--- a/lib/internal/crypto/hashnames.js
+++ b/lib/internal/crypto/hashnames.js
@@ -2,6 +2,7 @@
 
 const {
   ObjectKeys,
+  ObjectSetPrototypeOf,
 } = primordials;
 
 const kHashContextNode = 1;
@@ -71,15 +72,22 @@ const kHashNames = {
   },
 };
 
+// Both tables are indexed with computed keys, so a polluted %Object.prototype%
+// key must not answer a miss. Detached here rather than declared
+// `__proto__: null`: V8 puts that literal form in dictionary mode.
+ObjectSetPrototypeOf(kHashNames, null);
+
 {
   // Index the aliases
   const keys = ObjectKeys(kHashNames);
   for (let n = 0; n < keys.length; n++) {
-    const contexts = ObjectKeys(kHashNames[keys[n]]);
+    const entry = kHashNames[keys[n]];
+    ObjectSetPrototypeOf(entry, null);
+    const contexts = ObjectKeys(entry);
     for (let i = 0; i < contexts.length; i++) {
-      const alias = kHashNames[keys[n]][contexts[i]];
+      const alias = entry[contexts[i]];
       if (kHashNames[alias] === undefined)
-        kHashNames[alias] = kHashNames[keys[n]];
+        kHashNames[alias] = entry;
     }
   }
 }
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 600a01b7b514..a7f3b4f47cfb 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -5,7 +5,6 @@ const {
   ObjectDefineProperties,
   ObjectPrototypeHasOwnProperty,
   ObjectSetPrototypeOf,
-  SafeSet,
   StringPrototypeIncludes,
   StringPrototypeStartsWith,
   SymbolToStringTag,
@@ -68,6 +67,7 @@ const {
   getUsagesMask,
   getUsagesFromMask,
   hasUsage,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -1332,7 +1332,7 @@ function importGenericSecretKey(
   extractable,
   keyUsages,
 ) {
-  const usagesSet = new SafeSet(keyUsages);
+  const usagesSet = toUsagesSet(keyUsages);
   const { name } = algorithm;
   if (extractable)
     throw lazyDOMException(`${name} keys are not extractable`, 'SyntaxError');
diff --git a/lib/internal/crypto/ml_dsa.js b/lib/internal/crypto/ml_dsa.js
index 857961ff6ef3..0756198312c0 100644
--- a/lib/internal/crypto/ml_dsa.js
+++ b/lib/internal/crypto/ml_dsa.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   StringPrototypeToLowerCase,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -28,6 +27,8 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  toUsagesSet,
+  getBufferSourceByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -122,7 +123,7 @@ function mlDsaImportKey(
 
   const { name } = algorithm;
   let handle;
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(
@@ -147,7 +148,7 @@ function mlDsaImportKey(
         'ML-DSA-65': 4060,
         'ML-DSA-87': 4924,
       };
-      if (keyData.byteLength === privOnlyLengths[name]) {
+      if (getBufferSourceByteLength(keyData) === privOnlyLengths[name]) {
         throw lazyDOMException(
           'Importing an ML-DSA PKCS#8 key without a seed is not supported',
           'NotSupportedError');
diff --git a/lib/internal/crypto/ml_kem.js b/lib/internal/crypto/ml_kem.js
index f18dcd13db77..c917c88c0f29 100644
--- a/lib/internal/crypto/ml_kem.js
+++ b/lib/internal/crypto/ml_kem.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   StringPrototypeToLowerCase,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -27,6 +26,8 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  toUsagesSet,
+  getBufferSourceByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -123,7 +124,7 @@ function mlKemImportKey(
 
   const { name } = algorithm;
   let handle;
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(
@@ -148,7 +149,7 @@ function mlKemImportKey(
         'ML-KEM-768': 2428,
         'ML-KEM-1024': 3196,
       };
-      if (keyData.byteLength === privOnlyLengths[name]) {
+      if (getBufferSourceByteLength(keyData) === privOnlyLengths[name]) {
         throw lazyDOMException(
           'Importing an ML-KEM PKCS#8 key without a seed is not supported',
           'NotSupportedError');
diff --git a/lib/internal/crypto/rsa.js b/lib/internal/crypto/rsa.js
index a2757384f4f4..d153ab664bd8 100644
--- a/lib/internal/crypto/rsa.js
+++ b/lib/internal/crypto/rsa.js
@@ -2,7 +2,6 @@
 
 const {
   MathCeil,
-  SafeSet,
   TypedArrayPrototypeGetBuffer,
   Uint8Array,
 } = primordials;
@@ -35,6 +34,7 @@ const {
   jobPromise,
   normalizeHashName,
   validateMaxBufferLength,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -174,7 +174,7 @@ function rsaImportKey(
   extractable,
   usages) {
   const allowedUsages = kUsages[algorithm.name];
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   let handle;
   switch (format) {
     case 'KeyObjectHandle':
@@ -234,7 +234,7 @@ function rsaImportKey(
   const {
     modulusLength,
     publicExponent,
-  } = handle.keyDetail({});
+  } = handle.keyDetail({ __proto__: null });
 
   return new InternalCryptoKey(handle, {
     name: algorithm.name,
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index ca02c6907dad..282ce9b35591 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -15,15 +15,18 @@ const {
   ObjectEntries,
   ObjectKeys,
   ObjectPrototypeHasOwnProperty,
+  ObjectSetPrototypeOf,
   PromisePrototypeThen,
   PromiseReject,
   PromiseWithResolvers,
   SafeMap,
+  SafeSet,
   StringPrototypeToUpperCase,
   Symbol,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
   TypedArrayPrototypeGetByteOffset,
+  TypedArrayPrototypeGetLength,
   TypedArrayPrototypeSlice,
   Uint8Array,
 } = primordials;
@@ -459,17 +462,23 @@ const experimentalAlgorithms = [
 // Also builds a parallel Map<UPPERCASED_NAME, canonicalName> per operation
 // for O(1) case-insensitive algorithm name lookup in normalizeAlgorithm.
 function createSupportedAlgorithms(algorithmDefs) {
+  // Detached below rather than declared `__proto__: null`: V8 puts that
+  // literal form in dictionary mode, slowing every registry lookup.
   const result = {};
   const nameMap = {};
 
-  for (const { 0: algorithmName, 1: operations } of ObjectEntries(algorithmDefs)) {
+  const algorithmEntries = ObjectEntries(algorithmDefs);
+  for (let i = 0; i < algorithmEntries.length; i++) {
+    const { 0: algorithmName, 1: operations } = algorithmEntries[i];
     // Skip algorithms that are conditionally not supported
     if (ObjectPrototypeHasOwnProperty(conditionalAlgorithms, algorithmName) &&
         !conditionalAlgorithms[algorithmName]) {
       continue;
     }
 
-    for (const { 0: operation, 1: dict } of ObjectEntries(operations)) {
+    const operationEntries = ObjectEntries(operations);
+    for (let j = 0; j < operationEntries.length; j++) {
+      const { 0: operation, 1: dict } = operationEntries[j];
       result[operation] ||= {};
       nameMap[operation] ||= new SafeMap();
       nameMap[operation].set(StringPrototypeToUpperCase(algorithmName), algorithmName);
@@ -490,6 +499,13 @@ function createSupportedAlgorithms(algorithmDefs) {
     }
   }
 
+  const operations = ObjectKeys(result);
+  for (let i = 0; i < operations.length; i++) {
+    ObjectSetPrototypeOf(result[operations[i]], null);
+  }
+  ObjectSetPrototypeOf(result, null);
+  ObjectSetPrototypeOf(nameMap, null);
+
   return { algorithms: result, nameMap };
 }
 
@@ -538,12 +554,17 @@ const simpleAlgorithmDictionaries = {
 
 // Pre-compute ObjectKeys() for each dictionary entry at module init
 // to avoid allocating a new keys array on every normalizeAlgorithm call.
-for (const { 0: name, 1: types } of ObjectEntries(simpleAlgorithmDictionaries)) {
+const simpleAlgorithmDictionaryEntries =
+  ObjectEntries(simpleAlgorithmDictionaries);
+for (let i = 0; i < simpleAlgorithmDictionaryEntries.length; i++) {
+  const { 0: name, 1: types } = simpleAlgorithmDictionaryEntries[i];
   simpleAlgorithmDictionaries[name] = { keys: ObjectKeys(types), types };
 }
+// See createSupportedAlgorithms() for why this is detached here.
+ObjectSetPrototypeOf(simpleAlgorithmDictionaries, null);
 
 function validateMaxBufferLength(data, name, max = kMaxBufferLength) {
-  if (data.byteLength > max) {
+  if (getBufferSourceByteLength(data) > max) {
     throw lazyDOMException(
       `${name} must be at most ${max} bytes`,
       'OperationError');
@@ -648,20 +669,8 @@ function normalizeAlgorithm(algorithm, op) {
       const idlValue = normalizedAlgorithm[member];
       // 3.
       if (idlType === 'BufferSource' && idlValue) {
-        const isView = ArrayBufferIsView(idlValue);
-        const idlValueBytes = isView ?
-          new Uint8Array(
-            getDataViewOrTypedArrayBuffer(idlValue),
-            getDataViewOrTypedArrayByteOffset(idlValue),
-            getDataViewOrTypedArrayByteLength(idlValue),
-          ) :
-          new Uint8Array(
-            idlValue,
-            0,
-            ArrayBufferPrototypeGetByteLength(idlValue),
-          );
         normalizedAlgorithm[member] = TypedArrayPrototypeSlice(
-          idlValueBytes,
+          getBufferSourceBytes(idlValue),
         );
       } else if (idlType === 'HashAlgorithmIdentifier') {
         normalizedAlgorithm[member] = normalizeAlgorithm(idlValue, 'digest');
@@ -690,6 +699,26 @@ function getDataViewOrTypedArrayByteLength(V) {
     DataViewPrototypeGetByteLength(V) : TypedArrayPrototypeGetByteLength(V);
 }
 
+function getBufferSourceByteLength(V) {
+  return ArrayBufferIsView(V) ?
+    getDataViewOrTypedArrayByteLength(V) :
+    ArrayBufferPrototypeGetByteLength(V);
+}
+
+function getBufferSourceBytes(V) {
+  return ArrayBufferIsView(V) ?
+    new Uint8Array(
+      getDataViewOrTypedArrayBuffer(V),
+      getDataViewOrTypedArrayByteOffset(V),
+      getDataViewOrTypedArrayByteLength(V),
+    ) :
+    new Uint8Array(V, 0, ArrayBufferPrototypeGetByteLength(V));
+}
+
+function getOptionalByteLength(V) {
+  return V === undefined ? 0 : TypedArrayPrototypeGetByteLength(V);
+}
+
 function hasAnyNotIn(set, checks) {
   for (const s of set)
     if (!ArrayPrototypeIncludes(checks, s))
@@ -848,9 +877,10 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // Returns undefined if the conversion was unsuccessful.
 function bigIntArrayToUnsignedInt(input) {
   let result = 0;
+  const length = TypedArrayPrototypeGetLength(input);
 
-  for (let n = 0; n < input.length; ++n) {
-    const n_reversed = input.length - n - 1;
+  for (let n = 0; n < length; ++n) {
+    const n_reversed = length - n - 1;
     if (n_reversed >= 4 && input[n])
       return;  // Too large
     result |= input[n] << 8 * n_reversed;
@@ -861,9 +891,10 @@ function bigIntArrayToUnsignedInt(input) {
 
 function bigIntArrayToUnsignedBigInt(input) {
   let result = 0n;
+  const length = TypedArrayPrototypeGetLength(input);
 
-  for (let n = 0; n < input.length; ++n) {
-    const n_reversed = input.length - n - 1;
+  for (let n = 0; n < length; ++n) {
+    const n_reversed = length - n - 1;
     result |= BigInt(input[n]) << 8n * BigInt(n_reversed);
   }
 
@@ -903,6 +934,19 @@ for (let n = 0; n < kCanonicalUsageOrder.length; n++) {
   kUsageByMask[mask] = usage;
 }
 
+/**
+ * Collects a key usage list into a set.
+ * @param {string[]} usages
+ * @returns {SafeSet<string>}
+ */
+function toUsagesSet(usages) {
+  const usagesSet = new SafeSet();
+  for (let n = 0; n < usages.length; n++) {
+    usagesSet.add(usages[n]);
+  }
+  return usagesSet;
+}
+
 /**
  * Returns a bit mask representing the usages from `usageSet`.
  * @param {SafeSet<string>} usageSet
@@ -1031,10 +1075,13 @@ function secureHeapUsed() {
 
 module.exports = {
   getArrayBufferOrView,
+  getBufferSourceByteLength,
+  getBufferSourceBytes,
   getCiphers,
   getCurves,
   getDataViewOrTypedArrayBuffer,
   getHashes,
+  getOptionalByteLength,
   kHandle,
   setEngine,
   toBuf,
@@ -1060,6 +1107,7 @@ module.exports = {
   getStringOption,
   getUsagesMask,
   getUsagesFromMask,
+  toUsagesSet,
   hasUsage,
   secureHeapUsed,
   getCachedHashId,
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index ff8cb8062891..8943da946fce 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -69,6 +69,7 @@ const {
   numBitsToBytes,
   prepareWebCryptoResult,
   validateMaxBufferLength,
+  getOptionalByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -130,9 +131,17 @@ function prepareSubtleMethod(receiver, method, argLength, required) {
 }
 
 function convertSubtleArgument(prefix, converter, value, index) {
+  // Mirrors makeOptions() in internal/webidl, including why it stays an
+  // ordinary literal: the converters read every member below, and an absent
+  // one would resolve through %Object.prototype%.
   return webidl.converters[converter](value, {
     prefix,
     context: kArgumentContexts[index],
+    code: undefined,
+    enforceRange: undefined,
+    clamp: undefined,
+    allowShared: undefined,
+    allowResizable: undefined,
   });
 }
 
@@ -1802,8 +1811,8 @@ function check(op, alg, length) {
     case 'digest': {
       if ((normalizedAlgorithm.name === 'cSHAKE128' ||
            normalizedAlgorithm.name === 'cSHAKE256') &&
-          (normalizedAlgorithm.functionName?.byteLength ||
-           normalizedAlgorithm.customization?.byteLength)) {
+          (getOptionalByteLength(normalizedAlgorithm.functionName) ||
+           getOptionalByteLength(normalizedAlgorithm.customization))) {
         return CShakeJob !== undefined;
       }
       return true;
diff --git a/lib/internal/crypto/webcrypto_util.js b/lib/internal/crypto/webcrypto_util.js
index 1b802a6dc466..065520c59cb3 100644
--- a/lib/internal/crypto/webcrypto_util.js
+++ b/lib/internal/crypto/webcrypto_util.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const {
-  ArrayPrototypePush,
+  ArrayPrototypePushApply,
   SafeSet,
 } = primordials;
 
@@ -19,6 +19,7 @@ const {
 const {
   hasAnyNotIn,
   validateKeyOps,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -60,7 +61,7 @@ function verifyAcceptableKeyUse(subject, usagesSet, allowed) {
  * @returns {SafeSet<string>}
  */
 function validateKeyUsages(usages, allowed, subject) {
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   verifyAcceptableKeyUse(subject, usagesSet, allowed);
   return usagesSet;
 }
@@ -115,12 +116,8 @@ function getKeyPairUsages(usagesSet, allowed) {
  */
 function createKeyUsages(publicUsages, privateUsages) {
   const keygen = [];
-  for (let n = 0; n < publicUsages.length; n++) {
-    ArrayPrototypePush(keygen, publicUsages[n]);
-  }
-  for (let n = 0; n < privateUsages.length; n++) {
-    ArrayPrototypePush(keygen, privateUsages[n]);
-  }
+  ArrayPrototypePushApply(keygen, publicUsages);
+  ArrayPrototypePushApply(keygen, privateUsages);
   return {
     __proto__: null,
     public: publicUsages,
diff --git a/lib/internal/crypto/webidl.js b/lib/internal/crypto/webidl.js
index cd90c36e96ca..5dc263120eae 100644
--- a/lib/internal/crypto/webidl.js
+++ b/lib/internal/crypto/webidl.js
@@ -1,15 +1,15 @@
 'use strict';
 
 const {
-  ArrayBufferIsView,
   ArrayPrototypeIncludes,
   MathPow,
   NumberParseInt,
   ObjectPrototypeHasOwnProperty,
   StringPrototypeCharCodeAt,
+  StringPrototypeSplit,
   StringPrototypeStartsWith,
   StringPrototypeToLowerCase,
-  Uint8Array,
+  TypedArrayPrototypeGetLength,
 } = primordials;
 
 const {
@@ -26,6 +26,8 @@ const {
 } = require('internal/crypto/keys');
 const {
   validateMaxBufferLength,
+  getBufferSourceByteLength,
+  getBufferSourceBytes,
   kNamedCurveAliases,
   numBitsToBytes,
 } = require('internal/crypto/util');
@@ -40,7 +42,7 @@ const {
 } = require('internal/webidl');
 
 function validateByteLength(buf, name, target) {
-  if (buf.byteLength !== target) {
+  if (getBufferSourceByteLength(buf) !== target) {
     throw lazyDOMException(
       `${name} must contain exactly ${target} bytes`,
       'OperationError');
@@ -126,6 +128,9 @@ function enforceRangeOptions(opts) {
     context: opts.context,
     code: opts.code,
     enforceRange: true,
+    clamp: undefined,
+    allowShared: undefined,
+    allowResizable: undefined,
   };
 }
 
@@ -256,7 +261,7 @@ converters.AesKeyGenParams = createDictionaryConverter(
 
 function validateZeroLength(parameterName) {
   return (V, dict) => {
-    if (V.byteLength) {
+    if (getBufferSourceByteLength(V)) {
       throw lazyDOMException(
         `Non zero-length ${parameterName} is not supported.`, 'NotSupportedError');
     }
@@ -272,19 +277,18 @@ function validateCShakeOutputLength(V) {
 }
 
 function bufferSourceEqualsAscii(V, string) {
-  if (V.byteLength !== string.length) return false;
+  if (getBufferSourceByteLength(V) !== string.length) return false;
 
-  const bytes = ArrayBufferIsView(V) ?
-    new Uint8Array(V.buffer, V.byteOffset, V.byteLength) :
-    new Uint8Array(V);
-  for (let i = 0; i < bytes.length; i++) {
+  const bytes = getBufferSourceBytes(V);
+  const length = TypedArrayPrototypeGetLength(bytes);
+  for (let i = 0; i < length; i++) {
     if (bytes[i] !== StringPrototypeCharCodeAt(string, i)) return false;
   }
   return true;
 }
 
 function validateCShakeFunctionName(V) {
-  if (V.byteLength === 0 ||
+  if (getBufferSourceByteLength(V) === 0 ||
       bufferSourceEqualsAscii(V, 'KMAC') ||
       bufferSourceEqualsAscii(V, 'TupleHash') ||
       bufferSourceEqualsAscii(V, 'ParallelHash')) {
@@ -340,7 +344,12 @@ function validateHmacKeyLength(parameterName, zeroError) {
   };
 }
 
-for (const { 0: name, 1: zeroError } of [['HmacKeyGenParams', 'OperationError'], ['HmacImportParams', 'DataError']]) {
+const kHmacDictionaries = [
+  ['HmacKeyGenParams', 'OperationError'],
+  ['HmacImportParams', 'DataError'],
+];
+for (let i = 0; i < kHmacDictionaries.length; i++) {
+  const { 0: name, 1: zeroError } = kHmacDictionaries[i];
   converters[name] = createDictionaryConverter(
     name, [
       dictAlgorithm,
@@ -524,7 +533,7 @@ converters.AeadParams = createDictionaryConverter(
               validateMaxBufferLength(V, 'algorithm.iv');
               break;
             case 'aes-ocb':
-              if (V.byteLength > 15) {
+              if (getBufferSourceByteLength(V) > 15) {
                 throw lazyDOMException(
                   'AES-OCB algorithm.iv must be no more than 15 bytes',
                   'OperationError');
@@ -633,7 +642,8 @@ converters.ContextParams = createDictionaryConverter(
           if (process.features.openssl_is_boringssl) {
             this.validator = undefined;
           } else {
-            let { 0: major, 1: minor } = process.versions.openssl.split('.');
+            let { 0: major, 1: minor } =
+              StringPrototypeSplit(process.versions.openssl, '.');
             major = NumberParseInt(major, 10);
             minor = NumberParseInt(minor, 10);
             if (major > 3 || (major === 3 && minor >= 2)) {
@@ -656,7 +666,7 @@ converters.Argon2Params = createDictionaryConverter(
         key: 'nonce',
         converter: converters.BufferSource,
         validator: (V) => {
-          if (V.byteLength < 8) {
+          if (getBufferSourceByteLength(V) < 8) {
             throw lazyDOMException('nonce must be at least 8 bytes', 'OperationError');
           }
         },
@@ -722,7 +732,9 @@ converters.Argon2Params = createDictionaryConverter(
     ],
   ]);
 
-for (const name of ['KmacKeyGenParams', 'KmacImportParams']) {
+const kKmacDictionaries = ['KmacKeyGenParams', 'KmacImportParams'];
+for (let i = 0; i < kKmacDictionaries.length; i++) {
+  const name = kKmacDictionaries[i];
   converters[name] = createDictionaryConverter(
     name, [
       dictAlgorithm,
diff --git a/test/parallel/test-webcrypto-prototype-pollution.mjs b/test/parallel/test-webcrypto-prototype-pollution.mjs
new file mode 100644
index 000000000000..9a35444ee968
--- /dev/null
+++ b/test/parallel/test-webcrypto-prototype-pollution.mjs
@@ -0,0 +1,469 @@
+// Flags: --expose-internals
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { createRequire } from 'node:module';
+
+if (!common.hasCrypto) common.skip('missing crypto');
+
+// Regression tests for prototype pollution reaching WebCrypto input validation
+// and normalization, via BufferSource prototype accessors, inherited
+// %Object.prototype% keys, or %Array.prototype%[%Symbol.iterator%]. See
+// test-webcrypto-promise-prototype-pollution.mjs for the promise side.
+
+const require = createRequire(import.meta.url);
+const { kSupportedAlgorithms } = require('internal/crypto/util');
+const { getFips } = require('node:crypto');
+const { hasOpenSSL } = require('../common/crypto');
+const { subtle } = globalThis.crypto;
+
+const TypedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+const data = new TextEncoder().encode('prototype pollution');
+const modulusLength = getFips() === 1 ? 2048 : 1024;
+
+// Avoids SubtleCrypto.supports(), which warns and invokes the registry's
+// experimental-algorithm getters.
+function supports(operation, name) {
+  return Object.hasOwn(kSupportedAlgorithms[operation] ?? {}, name);
+}
+
+// Each poison is { target, key, ...descriptor }.
+async function withPoisoned(poisons, fn) {
+  const saved = [];
+  for (const { target, key, ...descriptor } of poisons) {
+    saved.push([target, key, Object.getOwnPropertyDescriptor(target, key)]);
+    Object.defineProperty(target, key, {
+      __proto__: null,
+      configurable: true,
+      ...descriptor,
+    });
+  }
+  try {
+    return await fn();
+  } finally {
+    for (let i = saved.length - 1; i >= 0; i--) {
+      const { 0: target, 1: key, 2: descriptor } = saved[i];
+      if (descriptor === undefined) {
+        delete target[key];
+      } else {
+        Object.defineProperty(target, key, descriptor);
+      }
+    }
+  }
+}
+
+function poisonTypedArrayByteLength(value) {
+  return [{ target: TypedArrayPrototype, key: 'byteLength', get: () => value }];
+}
+
+function inherited(key, value) {
+  return [{ target: Object.prototype, key, value, writable: true }];
+}
+
+const poisonArrayIterator = [{
+  target: Array.prototype,
+  key: Symbol.iterator,
+  value: () => ({ next: () => ({ done: true, value: undefined }) }),
+  writable: true,
+}];
+
+// A poisoned array iterator breaks assert too, so settle under the poison and
+// assert once it has been restored.
+async function settleUnderPoison(poisons, fn) {
+  const outcome = { __proto__: null, value: undefined, error: undefined };
+  await withPoisoned(poisons, async () => {
+    try {
+      outcome.value = await fn();
+    } catch (err) {
+      outcome.error = err;
+    }
+  });
+  return outcome;
+}
+
+// validateByteLength(). Unguarded, the empty iv reaches OpenSSL, which also
+// fails with OperationError, hence the message assertion.
+{
+  const key = await subtle.importKey(
+    'raw-secret', new Uint8Array(16), 'AES-CBC', false, ['encrypt']);
+  await withPoisoned(poisonTypedArrayByteLength(16), common.mustCall(() =>
+    assert.rejects(
+      subtle.encrypt({ name: 'AES-CBC', iv: new Uint8Array(0) }, key, data),
+      {
+        name: 'OperationError',
+        message: /algorithm\.iv must contain exactly 16 bytes/,
+      })));
+}
+
+// validateMaxBufferLength().
+{
+  const key = await subtle.importKey(
+    'raw-secret', new Uint8Array(32), 'HKDF', false, ['deriveBits']);
+  await withPoisoned(poisonTypedArrayByteLength(0), common.mustCall(() =>
+    assert.rejects(
+      subtle.deriveBits({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: new Uint8Array(0),
+        info: new Uint8Array(4096),
+      }, key, 8),
+      {
+        name: 'OperationError',
+        message: /algorithm\.info must be at most 1024 bytes/,
+      })));
+}
+
+// aesImportKey().
+await withPoisoned(poisonTypedArrayByteLength(16), common.mustCall(async () => {
+  const key = await subtle.importKey(
+    'raw-secret', new Uint8Array(32), 'AES-GCM', true, ['encrypt']);
+  assert.strictEqual(key.algorithm.length, 256);
+}));
+
+// validateCShakeFunctionName().
+if (supports('digest', 'cSHAKE128')) {
+  await withPoisoned(poisonTypedArrayByteLength(0), common.mustCall(() =>
+    assert.rejects(
+      subtle.digest({
+        name: 'cSHAKE128',
+        outputLength: 256,
+        functionName: new Uint8Array([0x41, 0x42, 0x43, 0x44]),
+      }, data),
+      {
+        name: 'NotSupportedError',
+        message: /Unsupported CShakeParams functionName/,
+      })));
+
+  // asyncDigest() picks the cSHAKE job over plain SHAKE on a non-empty
+  // customization.
+  if (hasOpenSSL(3)) {
+    const algorithm = {
+      name: 'cSHAKE128',
+      outputLength: 256,
+      customization: new Uint8Array([1, 2, 3]),
+    };
+    const expected = new Uint8Array(await subtle.digest(algorithm, data));
+    const plain = new Uint8Array(
+      await subtle.digest({ name: 'cSHAKE128', outputLength: 256 }, data));
+    assert.notDeepStrictEqual(expected, plain);
+    await withPoisoned(poisonTypedArrayByteLength(0),
+                       common.mustCall(async () => {
+                         assert.deepStrictEqual(
+                           new Uint8Array(await subtle.digest(algorithm, data)),
+                           expected);
+                       }));
+  }
+}
+
+// AeadParams: AES-OCB caps the iv at 15 bytes.
+if (supports('encrypt', 'AES-OCB')) {
+  const key = await subtle.importKey(
+    'raw-secret', new Uint8Array(16), 'AES-OCB', false, ['encrypt']);
+  await withPoisoned(poisonTypedArrayByteLength(12), common.mustCall(() =>
+    assert.rejects(
+      subtle.encrypt({ name: 'AES-OCB', iv: new Uint8Array(20) }, key, data),
+      {
+        name: 'OperationError',
+        message: /algorithm\.iv must be no more than 15 bytes/,
+      })));
+}
+
+// Argon2Params: the nonce has an 8 byte minimum.
+if (supports('deriveBits', 'Argon2id')) {
+  const key = await subtle.importKey(
+    'raw-secret', new Uint8Array(32), 'Argon2id', false, ['deriveBits']);
+  await withPoisoned(poisonTypedArrayByteLength(16), common.mustCall(() =>
+    assert.rejects(
+      subtle.deriveBits({
+        name: 'Argon2id',
+        nonce: new Uint8Array(4),
+        memory: 32,
+        passes: 1,
+        parallelism: 1,
+      }, key, 256),
+      {
+        name: 'OperationError',
+        message: /nonce must be at least 8 bytes/,
+      })));
+}
+
+// bigIntArrayToUnsignedInt(): TypedArray `length` is a prototype accessor.
+await withPoisoned(
+  [{ target: TypedArrayPrototype, key: 'length', get: () => 0 }],
+  common.mustCall(async () => {
+    const { publicKey } = await subtle.generateKey({
+      name: 'RSA-OAEP',
+      modulusLength,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash: 'SHA-256',
+    }, true, ['encrypt', 'decrypt']);
+    assert.strictEqual(publicKey.algorithm.modulusLength, modulusLength);
+    assert.deepStrictEqual(
+      publicKey.algorithm.publicExponent, new Uint8Array([1, 0, 1]));
+  }));
+
+// ecdhDeriveBits() bounds the request by the native job's ArrayBuffer.
+{
+  const { privateKey, publicKey } = await subtle.generateKey(
+    { name: 'ECDH', namedCurve: 'P-256' }, false, ['deriveBits']);
+  await withPoisoned(
+    [{ target: ArrayBuffer.prototype, key: 'byteLength', get: () => 1e9 }],
+    common.mustCall(() => assert.rejects(
+      subtle.deriveBits({ name: 'ECDH', public: publicKey }, privateKey, 8192),
+      { name: 'OperationError' })));
+}
+
+// simpleAlgorithmDictionaries relies on a miss returning undefined.
+{
+  const { privateKey, publicKey } = await subtle.generateKey(
+    { name: 'ECDH', namedCurve: 'P-256' }, false, ['deriveBits']);
+  await withPoisoned(
+    inherited('EcdhKeyDeriveParams',
+              { keys: ['public'], types: { public: 'BufferSource' } }),
+    common.mustCall(async () => {
+      const bits = await subtle.deriveBits(
+        { name: 'ECDH', public: publicKey }, privateKey, 128);
+      assert.strictEqual(bits.byteLength, 16);
+    }));
+
+  await withPoisoned(
+    inherited('AesKeyGenParams',
+              { keys: ['name'], types: { name: 'AlgorithmIdentifier' } }),
+    common.mustCall(async () => {
+      const key = await subtle.generateKey(
+        { name: 'AES-GCM', length: 128 }, false, ['encrypt']);
+      assert.strictEqual(key.algorithm.length, 128);
+    }));
+}
+
+// createDictionaryConverter() reads optional member descriptor keys.
+{
+  const key = await subtle.generateKey(
+    { name: 'AES-GCM', length: 128 }, false, ['encrypt']);
+  const encrypt = () => subtle.encrypt(
+    { name: 'AES-GCM', iv: new Uint8Array(12) }, key, data);
+
+  for (const poison of [
+    inherited('required', true),
+    inherited('defaultValue', () => 9999),
+    inherited('validator', common.mustNotCall('Object.prototype.validator')),
+  ]) {
+    await withPoisoned(poison, common.mustCall(async () => {
+      assert.strictEqual((await encrypt()).byteLength, data.byteLength + 16);
+    }));
+  }
+}
+
+// Conversion options are read by key by the Web IDL converters.
+{
+  const key = await subtle.importKey(
+    'raw-secret', new Uint8Array(32), 'HKDF', false, ['deriveBits']);
+  const hkdf = (length) => subtle.deriveBits({
+    name: 'HKDF',
+    hash: 'SHA-256',
+    salt: new Uint8Array(0),
+    info: new Uint8Array(0),
+  }, key, length);
+
+  // [EnforceRange] and [Clamp] are not set for a plain `unsigned long`, so
+  // 2 ** 32 wraps to 0 rather than throwing or clamping.
+  for (const attribute of ['enforceRange', 'clamp']) {
+    await withPoisoned(
+      inherited(attribute, true),
+      common.mustCall(async () => {
+        await assert.rejects(hkdf(2 ** 32), { code: 'ERR_OUT_OF_RANGE' });
+      }));
+  }
+
+  // [AllowResizable] is not set for BufferSource.
+  await withPoisoned(inherited('allowResizable', true), common.mustCall(() =>
+    subtle.digest('SHA-256', new ArrayBuffer(8, { maxByteLength: 1024 }))
+  ));
+
+  // makeException() falls back to ERR_INVALID_ARG_TYPE.
+  await withPoisoned(inherited('code', 'ERR_POLLUTED'), common.mustCall(() =>
+    assert.rejects(subtle.digest('SHA-256', 'not a BufferSource'),
+                   { code: 'ERR_INVALID_ARG_TYPE' })));
+}
+
+// enforceRangeOptions(): [EnforceRange] uses IntegerPart, not round-half-even.
+{
+  const key = await subtle.importKey(
+    'raw-secret', new Uint8Array(4), 'PBKDF2', false, ['deriveBits']);
+  const pbkdf2 = (iterations) => subtle.deriveBits({
+    name: 'PBKDF2',
+    hash: 'SHA-256',
+    salt: new Uint8Array(16),
+    iterations,
+  }, key, 8);
+
+  const expected = new Uint8Array(await pbkdf2(1));
+  await withPoisoned(inherited('clamp', true), common.mustCall(async () => {
+    assert.deepStrictEqual(new Uint8Array(await pbkdf2(1.5)), expected);
+  }));
+}
+
+// keyDetail() is filled in by C++ with an ordinary [[Set]].
+{
+  const { publicKey } = await subtle.generateKey({
+    name: 'RSA-PSS',
+    modulusLength,
+    publicExponent: new Uint8Array([1, 0, 1]),
+    hash: 'SHA-256',
+  }, true, ['sign', 'verify']);
+  const spki = await subtle.exportKey('spki', publicKey);
+
+  await withPoisoned([
+    {
+      target: Object.prototype, key: 'modulusLength',
+      get: () => 8192, set() {},
+    },
+    {
+      target: Object.prototype, key: 'publicExponent',
+      get: () => new Uint8Array([9, 9, 9]), set() {},
+    },
+  ], common.mustCall(async () => {
+    const imported = await subtle.importKey(
+      'spki', spki, { name: 'RSA-PSS', hash: 'SHA-256' }, true, ['verify']);
+    assert.strictEqual(imported.algorithm.modulusLength, modulusLength);
+    assert.deepStrictEqual(
+      imported.algorithm.publicExponent, new Uint8Array([1, 0, 1]));
+  }));
+}
+
+{
+  const { publicKey } = await subtle.generateKey(
+    { name: 'ECDSA', namedCurve: 'P-384' }, true, ['sign', 'verify']);
+  const spki = await subtle.exportKey('spki', publicKey);
+
+  await withPoisoned(
+    [{
+      target: Object.prototype, key: 'namedCurve',
+      get: () => 'prime256v1', set() {},
+    }],
+    common.mustCall(() => assert.rejects(
+      subtle.importKey(
+        'spki', spki, { name: 'ECDSA', namedCurve: 'P-256' }, true, ['verify']),
+      { name: 'DataError', message: /Named curve mismatch/ })));
+}
+
+// Key usages under a poisoned array iterator. Callers pass a Set so the
+// spec-mandated sequence conversion still yields the requested usage; only
+// WebCrypto's own re-iteration of that array sees the poison.
+{
+  // Every Set has to be built before the poison is installed, otherwise the
+  // Set constructor itself iterates its array argument and comes out empty.
+  const signOnly = new Set(['sign']);
+  const encryptOnly = new Set(['encrypt']);
+  const decryptOnly = new Set(['decrypt']);
+  const decapsulateKeyOnly = new Set(['decapsulateKey']);
+
+  // Secret keys reject empty usages anyway, so match the message: the usage
+  // has to be rejected as unsupported, not as missing.
+  const cases = [
+    {
+      name: 'AES-GCM',
+      message: /Unsupported key usage for AES-GCM key/,
+      importKey: () => subtle.importKey(
+        'raw-secret', new Uint8Array(32), 'AES-GCM', false, signOnly),
+    },
+    {
+      name: 'HKDF',
+      message: /Unsupported key usage for a HKDF key/,
+      importKey: () => subtle.importKey(
+        'raw-secret', new Uint8Array(32), 'HKDF', false, encryptOnly),
+    },
+  ];
+
+  const addPublicKeyCase = async (name, algorithm, usages, disallowed) => {
+    if (!supports('importKey', name)) return;
+    const { publicKey } = await subtle.generateKey(algorithm, true, usages);
+    const spki = await subtle.exportKey('spki', publicKey);
+    cases.push({
+      name,
+      importKey: () => subtle.importKey(
+        'spki', spki, algorithm, true, disallowed),
+    });
+  };
+
+  await addPublicKeyCase('ECDSA', { name: 'ECDSA', namedCurve: 'P-256' },
+                         ['sign', 'verify'], signOnly);
+  await addPublicKeyCase('Ed25519', { name: 'Ed25519' },
+                         ['sign', 'verify'], signOnly);
+  await addPublicKeyCase('RSA-OAEP', {
+    name: 'RSA-OAEP',
+    modulusLength,
+    publicExponent: new Uint8Array([1, 0, 1]),
+    hash: 'SHA-256',
+  }, ['encrypt', 'decrypt'], decryptOnly);
+  await addPublicKeyCase('ML-DSA-44', { name: 'ML-DSA-44' },
+                         ['sign', 'verify'], signOnly);
+  await addPublicKeyCase('ML-KEM-512', { name: 'ML-KEM-512' },
+                         ['encapsulateKey', 'decapsulateKey'],
+                         decapsulateKeyOnly);
+
+  for (const { name, message, importKey } of cases) {
+    const outcome = await settleUnderPoison(poisonArrayIterator, importKey);
+    assert.strictEqual(outcome.value, undefined, name);
+    assert.strictEqual(outcome.error?.name, 'SyntaxError', name);
+    if (message !== undefined) assert.match(outcome.error.message, message);
+  }
+}
+
+// The registry, the Web IDL converters and the hash name aliases are built at
+// module load, so poisoning those needs a fresh process. The child bodies are
+// written as real functions and stringified into -e so that they stay linted.
+async function runInFreshProcess(fn, args, expected) {
+  const { code, stdout, stderr } = await common.spawnPromisified(
+    process.execPath, ['-e', `(${fn})(${args})`]);
+  assert.strictEqual(code, 0, stderr);
+  assert.strictEqual(stdout.trim(), expected, stderr);
+}
+
+// Only the load happens under the poison: a sequence<KeyUsage> argument would
+// legitimately come out empty while the caller's iterator is broken.
+async function pollutedArrayIteratorChild(kmac) {
+  const real = Array.prototype[Symbol.iterator];
+  Array.prototype[Symbol.iterator] = () => ({ next: () => ({ done: true }) });
+  const { subtle } = globalThis.crypto;
+  const out = [];
+  try {
+    out.push((await subtle.digest('SHA-256', new Uint8Array(4))).byteLength);
+  } finally {
+    Array.prototype[Symbol.iterator] = real;
+  }
+  const hmac = await subtle.generateKey(
+    { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  out.push((await subtle.sign('HMAC', hmac, new Uint8Array(4))).byteLength);
+  const aes = await subtle.generateKey(
+    { name: 'AES-GCM', length: 128 }, false, ['encrypt']);
+  out.push((await subtle.encrypt(
+    { name: 'AES-GCM', iv: new Uint8Array(12) }, aes, new Uint8Array(4),
+  )).byteLength);
+  if (kmac) {
+    const key = await subtle.generateKey(
+      { name: 'KMAC128', length: 128 }, false, ['sign']);
+    out.push((await subtle.sign(
+      { name: 'KMAC128', outputLength: 256 }, key, new Uint8Array(4),
+    )).byteLength);
+  }
+  console.log(out.join(','));
+}
+
+// kHashNames indexes its aliases at load time.
+async function pollutedHashNameChild() {
+  Object.prototype['SHA-256'] = { 1: 'md5', 2: 'POLLUTED' };
+  const { subtle } = globalThis.crypto;
+  const key = await subtle.generateKey(
+    { name: 'HMAC', hash: 'SHA-256' }, true, ['sign']);
+  const signature = await subtle.sign('HMAC', key, new Uint8Array(4));
+  const { alg } = await subtle.exportKey('jwk', key);
+  console.log(`${signature.byteLength},${alg}`);
+}
+
+{
+  const kmac = supports('generateKey', 'KMAC128');
+  await runInFreshProcess(pollutedArrayIteratorChild, kmac,
+                          kmac ? '32,32,20,32' : '32,32,20');
+  await runInFreshProcess(pollutedHashNameChild, '', '32,HS256');
+}

From 219495fe2ce8a57a1afd71dfbc5327c828a31c93 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sun, 9 Aug 2026 22:11:21 +0200
Subject: [PATCH 143/344] test: account for [EnforceRange] in
 test-webcrypto-prototype-pollution

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65173
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
---
 test/parallel/test-webcrypto-prototype-pollution.mjs | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/test/parallel/test-webcrypto-prototype-pollution.mjs b/test/parallel/test-webcrypto-prototype-pollution.mjs
index 9a35444ee968..a7104c2b7ae4 100644
--- a/test/parallel/test-webcrypto-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-prototype-pollution.mjs
@@ -265,14 +265,15 @@ await withPoisoned(
     info: new Uint8Array(0),
   }, key, length);
 
-  // [EnforceRange] and [Clamp] are not set for a plain `unsigned long`, so
-  // 2 ** 32 wraps to 0 rather than throwing or clamping.
+  // deriveBits length is [EnforceRange], so 2 ** 32 must throw even when
+  // conversion option properties are inherited from Object.prototype.
   for (const attribute of ['enforceRange', 'clamp']) {
     await withPoisoned(
       inherited(attribute, true),
-      common.mustCall(async () => {
-        await assert.rejects(hkdf(2 ** 32), { code: 'ERR_OUT_OF_RANGE' });
-      }));
+      common.mustCall(() => assert.rejects(hkdf(2 ** 32), {
+        code: 'ERR_OUT_OF_RANGE',
+        name: 'TypeError',
+      })));
   }
 
   // [AllowResizable] is not set for BufferSource.

From fd7e9044335c5406032481865f05af8a25dce13e Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sun, 2 Aug 2026 16:09:14 +0200
Subject: [PATCH 144/344] test: update tests to run with OpenSSL >= 3.0 FIPS
 mode

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64960
Fixes: https://github.com/nodejs/node/issues/48379
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/crypto/webcrypto.js              |   1 +
 test/common/crypto.js                         |  14 +-
 test/fixtures/keys/Makefile                   |  28 ++
 test/fixtures/keys/agent1-fips.pfx            | Bin 0 -> 3808 bytes
 test/fixtures/keys/ec-fips.pfx                | Bin 0 -> 1261 bytes
 test/parallel/test-crypto-argon2-job.js       |   4 +-
 test/parallel/test-crypto-argon2.js           |  13 +-
 .../parallel/test-crypto-async-sign-verify.js |  61 ++--
 .../test-crypto-authenticated-stream.js       |  11 +
 test/parallel/test-crypto-authenticated.js    |  51 ++-
 test/parallel/test-crypto-certificate.js      |  10 +-
 .../test-crypto-cipheriv-decipheriv.js        |  31 +-
 test/parallel/test-crypto-classes.js          |  15 +-
 test/parallel/test-crypto-dh-constructor.js   |   7 +-
 test/parallel/test-crypto-dh-curves.js        | 182 ++++++-----
 test/parallel/test-crypto-dh-generate-keys.js |   5 +-
 test/parallel/test-crypto-dh-leak.js          |   5 +-
 test/parallel/test-crypto-dh-modp2-views.js   |  34 +-
 test/parallel/test-crypto-dh-modp2.js         |  53 +--
 test/parallel/test-crypto-dh-odd-key.js       |  15 +-
 test/parallel/test-crypto-dh-shared.js        |   6 +-
 test/parallel/test-crypto-dh.js               |   8 +-
 test/parallel/test-crypto-ecdh-convert-key.js |  17 +-
 test/parallel/test-crypto-eddsa-variants.js   |  14 +-
 test/parallel/test-crypto-encap-decap.js      |  13 +-
 test/parallel/test-crypto-getcipherinfo.js    |   8 +-
 test/parallel/test-crypto-hkdf.js             |   8 +-
 test/parallel/test-crypto-hmac.js             |  30 +-
 test/parallel/test-crypto-job-error-parity.js |  32 +-
 .../test-crypto-key-objects-messageport.js    |   3 +-
 .../test-crypto-key-objects-to-crypto-key.js  |  21 +-
 test/parallel/test-crypto-key-objects.js      | 304 ++++++++++++------
 test/parallel/test-crypto-key-store.js        |  44 +--
 test/parallel/test-crypto-keygen-async-dsa.js |  12 +-
 ...ypto-keygen-async-elliptic-curve-jwk-ec.js |   8 +-
 ...pto-keygen-async-elliptic-curve-jwk-rsa.js |   3 +-
 ...-crypto-keygen-async-elliptic-curve-jwk.js |   9 +-
 ...-keygen-async-encrypted-private-key-der.js |   6 +-
 ...ypto-keygen-async-encrypted-private-key.js |  11 +-
 ...nc-explicit-elliptic-curve-encrypted.js.js |  12 +-
 ...en-async-named-elliptic-curve-encrypted.js |  12 +-
 test/parallel/test-crypto-keygen-async-rsa.js |  15 +-
 .../parallel/test-crypto-keygen-bit-length.js |  27 +-
 .../parallel/test-crypto-keygen-dh-classic.js |   3 +-
 test/parallel/test-crypto-keygen-eddsa.js     |   9 +-
 ...crypto-keygen-empty-passphrase-no-error.js |  12 +-
 ...rypto-keygen-empty-passphrase-no-prompt.js |  23 +-
 ...o-keygen-invalid-parameter-encoding-dsa.js |   8 +-
 ...ypto-keygen-key-object-without-encoding.js |   5 +-
 .../test-crypto-keygen-key-objects.js         |   8 +-
 .../test-crypto-keygen-missing-oid.js         |   5 +-
 ...test-crypto-keygen-no-rsassa-pss-params.js |   9 +-
 ...pto-keygen-non-standard-public-exponent.js |  46 +--
 test/parallel/test-crypto-keygen-promisify.js |   8 +-
 test/parallel/test-crypto-keygen-raw.js       |  32 +-
 .../test-crypto-keygen-rfc8017-9-1.js         |   7 +-
 .../test-crypto-keygen-rfc8017-a-2-3.js       |  10 +-
 test/parallel/test-crypto-keygen-rsa-pss.js   |   8 +-
 test/parallel/test-crypto-keygen-sync.js      |  10 +-
 .../test-crypto-keyobject-brand-check.js      |   5 +-
 .../test-crypto-keyobject-clone-transfer.js   |   3 +-
 .../test-crypto-keyobject-hidden-slots.js     |  16 +-
 .../test-crypto-keyobject-no-own-symbols.js   |   3 +-
 test/parallel/test-crypto-pbkdf2.js           | 185 ++++++++---
 .../test-crypto-pqc-encrypted-pkcs8.js        |  25 +-
 .../test-crypto-private-decrypt-gh32240.js    |  42 ++-
 ...t-crypto-publicDecrypt-fails-first-time.js |  10 +-
 test/parallel/test-crypto-rsa-dsa.js          | 146 ++++++---
 test/parallel/test-crypto-scrypt.js           |  47 ++-
 test/parallel/test-crypto-secure-heap.js      |   5 +-
 test/parallel/test-crypto-sign-verify.js      | 214 ++++++++----
 test/parallel/test-crypto-worker-thread.js    |   3 +-
 test/parallel/test-crypto.js                  |  65 ++--
 .../test-https-agent-additional-options.js    |  15 +-
 ...test-https-agent-pfx-object-array-reuse.js |  55 +++-
 .../test-https-agent-session-eviction.js      |  31 +-
 test/parallel/test-https-pfx.js               |  21 +-
 ...ttps-selfsigned-no-keycertsign-no-crash.js |   3 +-
 test/parallel/test-tls-alert.js               |  21 +-
 .../test-tls-client-getephemeralkeyinfo.js    |  82 +++--
 test/parallel/test-tls-client-mindhsize.js    |  15 +-
 test/parallel/test-tls-dhe.js                 |  55 +++-
 test/parallel/test-tls-ecdh-multiple.js       |  27 +-
 .../test-tls-env-extra-ca-with-options.js     |  25 +-
 test/parallel/test-tls-getprotocol.js         |  42 ++-
 test/parallel/test-tls-honorcipherorder.js    |   3 +-
 test/parallel/test-tls-invalid-pfx.js         |   7 +-
 test/parallel/test-tls-min-max-version.js     |  45 ++-
 test/parallel/test-tls-multi-key.js           |  12 +
 test/parallel/test-tls-multi-pfx.js           |  39 ++-
 test/parallel/test-tls-passphrase.js          |  28 ++
 .../test-tls-pfx-authorizationerror.js        |  30 +-
 test/parallel/test-tls-session-cache.js       |   9 +-
 test/parallel/test-tls-set-ciphers.js         | 136 ++++----
 test/parallel/test-tls-write-error.js         |  19 +-
 ...-webcrypto-aead-decrypt-detached-buffer.js |  38 ++-
 test/parallel/test-webcrypto-constructors.js  |  44 ++-
 .../test-webcrypto-cryptokey-hidden-slots.js  |   3 +-
 .../test-webcrypto-deduplicate-usages.js      |  21 +-
 .../test-webcrypto-derivebits-argon2.js       |   4 +-
 .../test-webcrypto-derivebits-cfrg.js         |  11 +
 test/parallel/test-webcrypto-derivebits.js    |  61 +++-
 .../parallel/test-webcrypto-derivekey-cfrg.js |  11 +
 test/parallel/test-webcrypto-derivekey.js     | 124 ++++---
 test/parallel/test-webcrypto-digest.js        |  40 ++-
 .../test-webcrypto-encrypt-decrypt-aes.js     |   9 +
 ...rypto-encrypt-decrypt-chacha20-poly1305.js |  11 +
 .../test-webcrypto-encrypt-decrypt.js         |  11 +-
 .../test-webcrypto-export-import-cfrg.js      |  16 +-
 test/parallel/test-webcrypto-export-import.js |   9 +-
 .../test-webcrypto-get-public-key.mjs         |  11 +
 test/parallel/test-webcrypto-keygen.js        |  79 ++++-
 ...-webcrypto-promise-prototype-pollution.mjs |  61 +++-
 .../test-webcrypto-raw-format-aliases.js      |  20 +-
 .../test-webcrypto-sign-verify-ecdsa.js       |  33 +-
 .../test-webcrypto-sign-verify-eddsa.js       |   4 +-
 .../test-webcrypto-sign-verify-hmac.js        |   5 +-
 .../test-webcrypto-sign-verify-kmac.js        |  92 ++++--
 .../test-webcrypto-sign-verify-ml-dsa.js      |   4 +-
 .../test-webcrypto-sign-verify-rsa.js         |  48 ++-
 test/parallel/test-webcrypto-sign-verify.js   |   3 +-
 test/parallel/test-webcrypto-supports.mjs     |   5 +
 test/parallel/test-webcrypto-wrap-unwrap.js   |  63 +++-
 ...t-crypto-argon2-nonblocking-constructor.js |   4 +-
 test/pummel/test-crypto-dh-keys.js            |  12 +-
 test/pummel/test-dh-regr.js                   |  27 +-
 .../test-webcrypto-derivebits-pbkdf2.js       |  26 +-
 test/sequential/test-async-wrap-getasyncid.js |   4 +-
 test/wpt/status/WebCryptoAPI.cjs              |  86 ++++-
 test/wpt/test-webcrypto.js                    |  28 ++
 130 files changed, 2869 insertions(+), 1014 deletions(-)
 create mode 100644 test/fixtures/keys/agent1-fips.pfx
 create mode 100644 test/fixtures/keys/ec-fips.pfx

diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index 8943da946fce..c2803cca1372 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -1617,6 +1617,7 @@ class SubtleCrypto {
   }
 
   // Implements https://wicg.github.io/webcrypto-modern-algos/#SubtleCrypto-method-supports
+  // TODO(panva): Make supports() account for the active FIPS state.
   static supports(operation, algorithm, lengthOrAdditionalAlgorithm = null) {
     emitExperimentalWarning('The supports Web Crypto API method');
     if (this !== SubtleCrypto) throw new ERR_INVALID_THIS('SubtleCrypto constructor');
diff --git a/test/common/crypto.js b/test/common/crypto.js
index f50d3895a178..63f7487f15d3 100644
--- a/test/common/crypto.js
+++ b/test/common/crypto.js
@@ -50,9 +50,14 @@ function assertApproximateSize(key, expectedSize) {
 function testEncryptDecrypt(publicKey, privateKey) {
   const message = 'Hello Node.js world!';
   const plaintext = Buffer.from(message, 'utf8');
+  const withOaepHash = (key) => {
+    if (!hasFIPS(3)) return key;
+    if (key?.key !== undefined) return { ...key, oaepHash: 'sha256' };
+    return { key, oaepHash: 'sha256' };
+  };
   for (const key of [publicKey, privateKey]) {
-    const ciphertext = publicEncrypt(key, plaintext);
-    const received = privateDecrypt(privateKey, ciphertext);
+    const ciphertext = publicEncrypt(withOaepHash(key), plaintext);
+    const received = privateDecrypt(withOaepHash(privateKey), ciphertext);
     assert.strictEqual(received.toString('utf8'), message);
   }
 }
@@ -118,6 +123,10 @@ const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
   return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
 };
 
+const hasFIPS = (major = 0, minor = 0, patch = 0) => {
+  return crypto.getFips() === 1 && hasOpenSSL(major, minor, patch);
+};
+
 let opensslCli = null;
 
 module.exports = {
@@ -134,6 +143,7 @@ module.exports = {
   sec1Exp,
   sec1EncExp,
   hasOpenSSL,
+  hasFIPS,
   get hasOpenSSL3() {
     return hasOpenSSL(3);
   },
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 128e928a5916..3ef61d00afff 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -8,6 +8,7 @@ all: \
   ca5-cert.pem \
   ca6-cert.pem \
   agent1-cert.pem \
+  agent1-fips.pfx \
   agent1.pfx \
   agent2-cert.pem \
   agent3-cert.pem \
@@ -39,6 +40,7 @@ all: \
   dsa_private_encrypted_1025.pem \
   dsa_public_1025.pem \
   ec-cert.pem \
+  ec-fips.pfx \
   ec.pfx \
   fake-cnnic-root-cert.pem \
   intermediate-ca-cert.pem \
@@ -444,6 +446,20 @@ agent1.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
 		-out agent1.pfx \
 		-password pass:sample
 
+# PKCS12KDF is unavailable under FIPS properties. Use PBMAC1 with PBKDF2
+# instead, alongside AES-256/PBKDF2 key protection.
+agent1-fips.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in agent1-cert.pem \
+		-inkey agent1-key.pem \
+		-certfile ca1-cert.pem \
+		-out agent1-fips.pfx \
+		-password pass:password
+
 agent1-verify: agent1-cert.pem ca1-cert.pem
 	openssl verify -CAfile ca1-cert.pem agent1-cert.pem
 
@@ -787,6 +803,18 @@ ec.pfx: ec-cert.pem ec-key.pem
 		-out ec.pfx \
 		-password pass:
 
+# See agent1-fips.pfx for why the FIPS fixture uses PBMAC1.
+ec-fips.pfx: ec-cert.pem ec-key.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in ec-cert.pem \
+		-inkey ec-key.pem \
+		-out ec-fips.pfx \
+		-password pass:password
+
 dh512.pem:
 	openssl dhparam -out dh512.pem 512
 
diff --git a/test/fixtures/keys/agent1-fips.pfx b/test/fixtures/keys/agent1-fips.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..5613cfae430b4c83b74d8c7c0aac3fa4d1449d7f
GIT binary patch
literal 3808
zcmai%XHXOBwuTc(=tKx*(*@~06qT-YY0^6wy3(6Sl@fXak>0C-2#BGGAPUl}Kq%6Y
zD!m7!8MvOgclMrp=FFTQ->iAxcg?r{t$7v<0huQN62cG=RU%S>m`5>Zlt5x&5dv}#
zgn)?uu|;4AlAM1cq9Ozd>W>vm00jIg;r}E+82oPmri2;5#Qu>KFfI@kyfDIJK%_oS
zsnm6}r+WiSKtKY3Q4o>*?^FU(FaX9%L~0ZB2<S)%0t$erI`lUJvWdlzv)`ukyWZ^U
zha*U+rZ;tF&bJ%nY_!?Ry-BJHuXEm|PQmQ@<mW&fs}rlfDvkodIJz^H$u9eXM&T&C
zsF7ni{S_Iw1Zfh7E8`unLo_Cm{7!rdz)LdQW;V0QYC8wNYsSAc*<+g5H?yDgYS#{s
znX_UkzJJo(#fWelP?8LjvUvY2m;W>~zZENUjcT(wNg2ggO-*mp0S-n15$N-dFw2Po
zrjmI+mdXR_eZ{cwQ!xflkQurX{myXG3EB(q=bL%BO#j(SpW9#gzGwHavV_pQLMZIg
zrL(Dv)YUazv|7%06^@{bof6D&d(}W@HR0MwvuVD){h+BAwG{53^}QuD#WrJ5TZ0T`
z%VIvxj#06w-6%9kAnN{HKLO}qtX#SkCd#HL_!m&rcq$Pq#9Y?X5RmLveQMGV0>2V%
zU!h<{dy+)cb6#}raJjf=cx~D)oNsGLY?$Z9S``J}nv=vX<|h*~%r`ZMg&L(j4GXy%
zk#X;dQtZkhNMjSDJ14w@v_5C6>2vK553F6RY^b7dFW~-+cwsU_pNsplV6f|>T`a$h
zUPH2o_V?VZg+7R>wjJhFh#h{?yhJRQF}MDr{zPN^lqVM(Xt+mLuuLYwYxYRe4zs@$
zq;Hv8ZkO+y+p1~vl9Zss%kL_B^+ND{n<aC5rgRoEb$2K_W?|n4GGSSSnkX4uEI$@{
z^P|Ss`+m&t78_B9S~_q7N+VUuPN(l?&z_fl)E>;C&A+L1E3Hb*e!FJU3@tRGO#k9h
z{5f0?4#gZ`$W!x%JFH?=#96dT=|pw|WFW%)X1Y(sVgODLq3$ig)@_y5=l1k!b8rQM
zaiiLZBzDgu;U9{Mofa#S;<n%*1h;&EYzMM;YWQGua@cJ_x%4VTf;KG728BBKhCX|@
z`Uz1ah<7GKhz>;NR&iJwKiOcEID4fN{(bP8z1lv)i16vwLk%C)Y<S$~ysWX=mP0~V
zEcxJ0fM&Q~WYS=p^;Jg264I(1$rL0l0)D~WW;L?&6YG9~9uG~sslJpZhtyX@x2&eM
z^?ITN(p4VLsvN18fhHDyou4Sh8K%o=wsgcaRZpxEw&#$yVI~ZXTHZF&EzvDV>nXXF
z-;BI`jx54`oxfH=isk*Lr@d5Ahq!$#fQ?YXtxMx0QX5O*vm9-{UL@lexWMW)ogKZ~
z-~EJhF!$y0voO|nc?mCrLD5+?J?>`tT4Uo+FU%k$0^_Q~I_wDY*fL_y;KQiT@~@0#
zAenLoif{J<jjcGUgs1QCAp1WN0NXnkix>=?LXUuamhr2<C~OvfFqcR#|EM}HV2pm+
zt?-OT|AQEV>1mmAoz?GL+>nUfOMQn8D=g=2k)i6fuVWdekd=KZ&SRwnPUnwxMb2!E
zw9x%?o?^GWtK4nci^zt6#P1DTq*9qJ&F8IMs_4%(tYscin(STTi!cV+))e*^=jLU`
zqGTw%uIbxc)h_4}PwZL)>zjvnEI@VPl7fT>LPGcCsnOHrS!C3I4ay96k?~Dvb_Mod
z-7!$6E=rI1X<9>Vy=ZqK75wwl`oLuQyO`D>{=&k+qZv%W2wG6KShOdxte?nbC{uK$
z`m9O^jm>g<u{_<DsM?eyEJeooBQrN0%yd-o?3sYP-R&2AX_Oo%(_H3pzIoYl+RVDd
zBI<{ck6^Mq74>Gz2Q*OX!CI<SeJ)d`;`C3J1G4qIoQboqGgB#pD0!mU{`z)>D;&)O
zvNGh@Y_a)}wgt4*!hA3A(Ig1lYcnejVvGcF^C73?pt0d#W&GaPN`gSawpR6C<K(Hr
zBSxDrQ?)t6*MwK)r`-^wX@`9E8t~A?JGz2CMu~*?5D&$D&CFI}anFJctut_6!3tS-
zje_V47jM@um7n6vN^zv(UiFSrO|N@?Nz2uwdX;HTwW{dzZ+Lpl)_8tFYc-E%q}jQe
zM$K|I_wht<+uAncIxyM;n;OXm>=m|IOHlrTHg9Hs20D?U2MF{KGKJlnqyE|G(A{zG
zz2igCB*M8tsI%7Hog}OGw4l7;gtT;0dMzSByda~%bMD%MjOve(B~9ANbdM=vSxh36
z7oVs3c@lE2eORINAgk@gdfRI{gOBWJo3B0E&2s!hL+|C7lPd)rCbD;dcv~l@Q}Gm=
zDB~?-eY=x-)+1WeBQl;{@T#Z3iVu^-6~le?gZxuP{b9#lXiIbN)UuLlnVES|CBkf`
zpK~CkDqzO(6Sf39P}dX8%W3)!vt`@bERHvwp*(@Xc<d{PE|}UWZkdx4u{b*9yV*cb
zpd@gC&^zVYEuRJOPPv_hv^^*2M8$diF$mz>BV~Bu0|TXiFV4#R$Z3!`-Ecgm!$Aa{
zk8K4glJOT7@9{WjJRCOG>%p08AkkfqVKZPj`oe6?CDlYO@ubXV&ikBgBDA+WLU+`x
zm5XWNv1f5uu>P%>GQCdqC{Xe;GN22p9oesNxlqT7SCVzw(+K6XI|F!zyC`44Cu_t*
zvXTym!OYSxF}2k``v9cf`Vfm_!Hy5^y!j3I!75vG=lJ@%zfKcw9kPg3>Bs<?4j@{~
z56)lepXr@XhSP5q;S|z*30gef%F&3;d^jiG?urds(_3I!(Dg{0{Wy8hy*Xt0W7IX^
zR>ym8qn4>-_(QW5H#IF2+RZ?1x?sncNP-G!l3P!Fva=MwLxlo``m*$ox1%@g(o6`x
zvZ`2@7}QGs?i3nR8XH=8sH;&wvptymOCu6*@}Qi1IGc$E3qybt{^pE-feZL02mucK
zWBdJi-bCd8$21gVK!QJ^^dIx?e*=}JH?@^EUPD|ae&Q{C!w9|q3M!ZjVWKG4lKb=I
z$a1z&oE``P!iG3OXkJUnrV9WSysvkjIhQ*}E>kyhS1M~thN@0i!wU&}yj_x641tvk
z4~ehjN#SyG?pZVxCjRHDtmD8YRHIb4TXyWv?R3v|Di{0PS~pp$v^&@jmkwI9r>WEF
zYZv<+Nqxor1?j@xcHSXVJ#CIz0TR?N1MvklYw^}j8OgN?=a7>2^rA1494>p#yR*2w
zqW#5XKIwzeoRz3OwVsN`6l|01rDcAC<`)SI!io$Jr*c31SMp<ai=6eX1fK`La!165
zc)9rK98aFi^k(Y&)xDrF&n_`rtWDXe^J<tAW>6#;Tlh_Te7v{slX=$Md52NtF6D99
zIt4qI{$W*(Uk8b%AP+Cz7-Lm=W}$q250_UjVSITnu{Dn4(HyQ4CHrZKoh{5tE&6Rc
zqo<4i=B&oAxM%dQ`#v07xM0jswQriOI20EalVp|~X+D6CvfqLA1-XT~Y-V+{`a{t4
zZ!NG(XC3o`Q{ZR`2QJ5oR~DBQTFtyuD<?r?vaI)qo(iM7;^_OT8iH$d!iRivnXSS{
zKPVIUGqd*|c8r8r)GqQEWY3QdhX7fW>zDmBi`_FdNXL19!$Y+)H}+^9Xcj@ppCjI?
zR{*BQ=WJO~Ax*<%vt|IC1b4Qt9_O>S4^;M7r;y@5A89E7gc?bK8*#zo@Dx<o;u7Sf
z`o?<f67;&LtO8k-;xLVT5DzN>9GZ&mJ6zBTZ%|#5Y4XUoCsI1*)uSeQZI-of?g`LS
ziR-?|Yi?R(>5@BfcYbac_K~C|Ekz>d>CYz2d)F$%VzXCIXLYgt-<a$e;$Q+A-yUaf
z8ewEeh^XG7kurA!jQpn2_qPFrwOP(n(yi|BAsDL{=TUef!d9HgRCl?lr%EN$%(nUT
zX3+E=bqEt1)h6Y^vgP4G_d-x(7{ow?dQr(kDo`#bO5CFzPHe^XL+Ao@Y_y5H^zpVr
zhUo}re{|ET`9R0crY04yBo6*Lp&M43VSf_zST{Xnlwzr_sE;Q{2gPOibWJNp>Iu(A
zF%v)Sj$A0iI;%QE<4gE$-B{o2o54ITQ{yPj&ho_fyOa}&eLIu|qbH?l5VEQ`rF_#s
zQ(Y0zJeEHu&nUgrk~Q=Bd>#}Zj)Jvj+~RRI{HSf1Z{{3O*)(nhh*#c*Z=||Cu6!L_
zkfHl>tMGh!-kxk_#}Gb#VSGYp)|R+2tNg6$1O6MsaVaz{fw!vH3`TgoFIRB<E9na|
zAsQ#sr=Te1FYg`cY4P0>Ns5ZzhWi(&0XjH_ii2I<pe7+-pq65!&@gk%<~{ApjjMie
z1Px)4f>jqsTFB$ouDQK()rPIo(Od-ye0rG>QiY}>V}DDkS9eZYgUUWqI|VvlZN4*@
z&z?rAvQ-EDu8QM6S=aWtU2msmvOBk?hxufkSox*r+fQkRb%r8q0Q=>P-x~?vADre8
zBd-trPyD(rOZljMbw_(wuTH<7+~qBjX~56#p55{~PB~a|XV9E{g<PH9UJhbczxU2!
z*|^hDi=6s;DP#xzH8gAEw)0BBcV<iQTwDk<>(fthN0to%E+r}-y%-rv3DT31r9<5#
zcf4-=J;jbO>qctS%vj?jzB*673az8b4C}eND87<ZXHs>yOtJFDu#?TEcZOozFwVah
zEh(KCJ%|<+Pv4atJ4VCgkakb1OdNQaE^7#jNQC*p^#ASzLtrW}$$umTj2A>@6ilTH
z=<Z!pH%(}oCO^3UuLVm0WdFBg@c*5LAa>^AzUk}`rymbncgDE3cs81K&y!TNg)www
Oi}QF-1I&N^_J082g(BYo

literal 0
HcmV?d00001

diff --git a/test/fixtures/keys/ec-fips.pfx b/test/fixtures/keys/ec-fips.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..1c26d641b9fc78bc68993098dee50019150d6390
GIT binary patch
literal 1261
zcmXqLVtL8L$ZXKW62!)-)#lOmotKfFaX}M{GfNYTJy6)%po!@fLW*rc6Vq*=&~+w8
z1|W3-A;V}859hG*8Uz^_BDg#TDl7s|lDkUY3*M~$d)_kP?ddrOn3y;i40zZ$Aht4b
zvN9ORvT-J~c`&9jvoLD02zXmWU1#}p;NYjTtLzUuiWN3AF(qi<cIdTt?fl7q$F|D(
z$~mb>@7lRJU)=;!=C!07r5l)TNC*s1^t-Y%Ea=Oj$r^n2NA7L>HcPa@p{a|1$;ZgE
zA7zdwuC09kMB`dT{(}i$gaae^KjyiAZkulREjY77e@P?j``ZUL+-7cCrMGL}Tc6D6
zpKs?*W^TIhEX#Kp&&5ur-omhhJvOWhw^;1*Wq-A=DEd~X{zSF+Woo<EUJLqj)>yp7
z>FGLK=WKrS*FV*L9)`TDKcwdR$g)nd<KDH1tE$$)`z|+F>`DD3r}lNfh56-F4xh`e
zf{_PL)EXtbe_&~}dBYMLye(u&g6bJ><7IId7HgXO9?d-@`TN(JlRxEWtu?sZE~-_o
zS+#`a2xnRD!X497xh9J|Jb8CRjYiX@V=af~M92Fc{=M(W#lH3vq4PSrBUu03-_a@_
zS|8f5PI7D7$;f~DQ!LLrDX#m!<&5sz+eh~58V7b(m#Kd}em0`*TiDtkzjJuH9+;{e
zyBui6;$<om+aof+h&j>RO@D(d=NE;k0vEsTS<tb%Ze6>>BA=g6>q;cobRC=^oX1!B
zL}6m>eLLfi>aO;Qq83j#CeGaAWdGw|u$5gS7yq|{36e&4R6;IKvE864z+#cf!C=gr
zSs1tC*VDa*TXk!7XQ@?rUkG#jc45N7)!K_Q<L537iCnpJP5i{2y|;CK`99~2UU9TE
z{wmksKW|zD%u8>6?|<}oqj6nesD?_<j<ru#FXoQ)xXI695v6>|=GK8@fzb`gw*oeQ
zJU2<oLPmx2#IwlASvH|+4Z5dwUoY8Qu`kW{^^Mw=w(03lu1#nAo_JpQrN+XjmrrEf
z?k_ZGV)TTkTTn(|v|?#uGy@770kIw%H#Cp%a4|A1X#8%__=QliS1-Gz@L~3fjW<_$
zmS4)B(?KxVKU~EXb^kC=zLv`bvn|Q{g;^RWtoL-d<xu)(zo^88nM)#nc~tLS7Fg~Y
zz<0DPC+4K#ey3BP#JKqni~9W1c3Chz`0kfHsXyypUrF2jae8pVmrlL%*(_#BTnqK}
zZWO%Z4-ij0zRKyZV`N(E6kk8Nb)4ph=eHMa^lDhe^;*12dhs@nUdy?Yjk0Py1^7H4
zE}Gt5`EJ^Udi$Bm(-&kE3C*`EWHq{KsA`}L4<$}fLopT+!`C|1t1Mr<`0AX*dNyTq
zn%paw#RiSN2BijpaFwil1}+9B2riF-I*Y)`{TJioPx;qgP48NJI=lEaD14Y070^ls
tlyZVaAxS6dq1*O!rO67DdAnujd`}3r4Zmn!`t;3`EB5!>7p}){EC33o5$^y1

literal 0
HcmV?d00001

diff --git a/test/parallel/test-crypto-argon2-job.js b/test/parallel/test-crypto-argon2-job.js
index 37a0127958cf..b5bf48e197eb 100644
--- a/test/parallel/test-crypto-argon2-job.js
+++ b/test/parallel/test-crypto-argon2-job.js
@@ -4,10 +4,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
+if (hasFIPS(3))
+  common.skip('Argon2 is not available in FIPS mode');
 
 // Exercises the native Argon2 job directly via internalBinding, bypassing
 // the JS validators, to ensure that if invalid parameters ever reach the
diff --git a/test/parallel/test-crypto-argon2.js b/test/parallel/test-crypto-argon2.js
index 1f238e61a61d..447812877e9c 100644
--- a/test/parallel/test-crypto-argon2.js
+++ b/test/parallel/test-crypto-argon2.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
@@ -28,6 +28,17 @@ const secret = Buffer.alloc(8, 0x03);
 const associatedData = Buffer.alloc(12, 0x04);
 const defaults = { message, nonce, parallelism: 1, tagLength: 64, memory: 8, passes: 3 };
 
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.argon2Sync('argon2id', defaults), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+  crypto.argon2('argon2id', defaults, common.mustCall((err, result) => {
+    assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+    assert.strictEqual(result, undefined);
+  }));
+  return;
+}
+
 const good = [
   // Test vectors from RFC 9106 https://www.rfc-editor.org/rfc/rfc9106.html#name-test-vectors
   // and OpenSSL 3.2 https://github.com/openssl/openssl/blob/6dfa998f7ea150f9c6d4e4727cf6d5c82a68a8da/test/recipes/30-test_evp_data/evpkdf_argon2.txt
diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
index bee83eaf8de0..96b4b5d90679 100644
--- a/test/parallel/test-crypto-async-sign-verify.js
+++ b/test/parallel/test-crypto-async-sign-verify.js
@@ -3,12 +3,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
+const fips3 = hasFIPS(3);
+
 function test(
   publicFixture,
   privateFixture,
@@ -65,6 +67,15 @@ function test(
   }
 }
 
+function testSignFailure(privateFixture, algorithm, options, code) {
+  const key = { key: fixtures.readKey(privateFixture), ...options };
+  const data = Buffer.from('Hello world');
+  assert.throws(() => crypto.sign(algorithm, data, key), { code });
+  crypto.sign(algorithm, data, key, common.mustCall((err) => {
+    assert.strictEqual(err?.code, code);
+  }));
+}
+
 // RSA w/ default padding
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true);
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true,
@@ -94,14 +105,19 @@ if (!process.features.openssl_is_boringssl) {
   test('ed448_public.pem', 'ed448_private.pem', undefined, true);
 
   // ECDSA w/ der signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false);
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false, { dsaEncoding: 'der' });
-
-  // ECDSA w/ ieee-p1363 signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
-       { dsaEncoding: 'ieee-p1363' });
+  if (fips3) {
+    testSignFailure('ec_secp256k1_private.pem', 'sha384', {},
+                    'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE');
+  } else {
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false);
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false, { dsaEncoding: 'der' });
+
+    // ECDSA w/ ieee-p1363 signature encoding
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
+         { dsaEncoding: 'ieee-p1363' });
+  }
 
   // DSA w/ der signature encoding
   test('dsa_public.pem', 'dsa_private.pem', 'sha256',
@@ -157,7 +173,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 
   let expected = /no default digest/;
   let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
-  if (hasOpenSSL3 || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3) || process.features.openssl_is_boringssl) {
     expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
     expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
   }
@@ -170,12 +186,21 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 }
 
 {
-  const { privateKey } = crypto.generateKeyPairSync('rsa', {
-    modulusLength: 512
-  });
-  crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
-    assert.ok(err);
-    assert.match(err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
-    assert.match(err.code, /^ERR_OSSL_.*DIGEST_TOO_BIG_FOR_RSA_KEY$/);
-  }));
+  if (fips3) {
+    crypto.generateKeyPair('rsa', { modulusLength: 512 },
+                           common.mustCall((err) => {
+                             assert.strictEqual(
+                               err?.code, 'ERR_OSSL_RSA_INVALID_MODULUS');
+                           }));
+  } else {
+    const { privateKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 512
+    });
+    crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
+      assert.ok(err);
+      assert.match(
+        err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
+      assert.match(err.code, /^ERR_OSSL_.*DIGEST_TOO_BIG_FOR_RSA_KEY$/);
+    }));
+  }
 }
diff --git a/test/parallel/test-crypto-authenticated-stream.js b/test/parallel/test-crypto-authenticated-stream.js
index 51b928ec36be..45736d3303dc 100644
--- a/test/parallel/test-crypto-authenticated-stream.js
+++ b/test/parallel/test-crypto-authenticated-stream.js
@@ -6,6 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const fs = require('fs');
 const stream = require('stream');
 const tmpdir = require('../common/tmpdir');
@@ -120,6 +121,16 @@ function test(config) {
     return;
   }
 
+  if (hasFIPS(3)) {
+    assert.throws(() => crypto.createDecipheriv(
+      config.cipher, config.key, config.iv, {
+        authTagLength: config.authTagLength,
+      }), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+    return;
+  }
+
   direct(config);
   mstream(config);
   fstream(config);
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index 2a4e2a1520a3..4062a5b5495f 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -29,9 +29,10 @@ const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
-const isFipsEnabled = crypto.getFips();
+const isFipsEnabled = crypto.getFips() === 1;
+const fips3 = hasFIPS(3);
 
 //
 // Test authenticated encryption modes.
@@ -559,6 +560,14 @@ for (const test of TEST_CASES) {
     const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
     const tag = cipher.getAuthTag();
 
+    if (fips3 && mode === 'ccm') {
+      assert.throws(() => crypto.createDecipheriv(
+        `aes-128-${mode}`, key, iv, opts), {
+        code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+      });
+      continue;
+    }
+
     const decipher = crypto.createDecipheriv(`aes-128-${mode}`, key, iv, opts);
     decipher.setAuthTag(tag);
     assert.throws(() => {
@@ -636,7 +645,7 @@ for (const test of TEST_CASES) {
     const cipher = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
     assert.throws(() => {
       cipher.final();
-    }, hasOpenSSL3 ? {
+    }, hasOpenSSL(3) ? {
       code: 'ERR_OSSL_TAG_NOT_SET'
     } : {
       message: /Unsupported state/
@@ -644,7 +653,14 @@ for (const test of TEST_CASES) {
   }
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (fips3) {
+  assert.throws(() => crypto.createCipheriv(
+    'chacha20-poly1305', Buffer.alloc(32), Buffer.alloc(12), {
+      authTagLength: 16,
+    }), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+} else if (!process.features.openssl_is_boringssl) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -662,7 +678,7 @@ if (!process.features.openssl_is_boringssl) {
 
 // ChaCha20-Poly1305 should respect the authTagLength option and should not
 // require the authentication tag before calls to update() during decryption.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -713,7 +729,7 @@ if (!process.features.openssl_is_boringssl) {
 // shorter tags as long as their length was valid according to NIST SP 800-38D.
 // For ChaCha20-Poly1305, we intentionally deviate from that because there are
 // no recommended or approved authentication tag lengths below 16 bytes.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -752,7 +768,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // https://github.com/nodejs/node/issues/45874
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -798,13 +814,20 @@ if (ciphers.includes('aes-128-ccm')) {
   const tag = cipher.getAuthTag();
   assert.strictEqual(tag.length, 16);
 
-  const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
-    authTagLength: 16,
-  });
-  decipher.setAuthTag(tag);
-  decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
-  decipher.update(new DataView(new ArrayBuffer(0)));
-  decipher.final();
+  if (fips3) {
+    assert.throws(() => crypto.createDecipheriv(
+      'aes-128-ccm', key, nonce, { authTagLength: 16 }), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+  } else {
+    const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+      authTagLength: 16,
+    });
+    decipher.setAuthTag(tag);
+    decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+    decipher.update(new DataView(new ArrayBuffer(0)));
+    decipher.final();
+  }
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-ccm test');
 }
diff --git a/test/parallel/test-crypto-certificate.js b/test/parallel/test-crypto-certificate.js
index 28d20ba61c75..6462654680ea 100644
--- a/test/parallel/test-crypto-certificate.js
+++ b/test/parallel/test-crypto-certificate.js
@@ -26,6 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { Certificate } = crypto;
 const fixtures = require('../common/fixtures');
 
@@ -42,7 +43,7 @@ function copyArrayBuffer(buf) {
 function checkMethods(certificate) {
 
   if (!process.features.openssl_is_boringssl)
-    assert.strictEqual(certificate.verifySpkac(spkacValid), true);
+    assert.strictEqual(certificate.verifySpkac(spkacValid), !hasFIPS(3));
   assert.strictEqual(certificate.verifySpkac(spkacFail), false);
 
   assert.strictEqual(
@@ -59,9 +60,10 @@ function checkMethods(certificate) {
 
   if (!process.features.openssl_is_boringssl) {
     const ab = copyArrayBuffer(spkacValid);
-    assert.strictEqual(certificate.verifySpkac(ab), true);
-    assert.strictEqual(certificate.verifySpkac(new Uint8Array(ab)), true);
-    assert.strictEqual(certificate.verifySpkac(new DataView(ab)), true);
+    const expected = !hasFIPS(3);
+    assert.strictEqual(certificate.verifySpkac(ab), expected);
+    assert.strictEqual(certificate.verifySpkac(new Uint8Array(ab)), expected);
+    assert.strictEqual(certificate.verifySpkac(new DataView(ab)), expected);
   }
 }
 
diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
index 095458e7d0b4..b1965c5a80c1 100644
--- a/test/parallel/test-crypto-cipheriv-decipheriv.js
+++ b/test/parallel/test-crypto-cipheriv-decipheriv.js
@@ -5,8 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
-const isFipsEnabled = crypto.getFips();
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const isFipsEnabled = crypto.getFips() === 1;
+const fips3 = hasFIPS(3);
 
 function testCipher1(key, iv) {
   // Test encryption and decryption with explicit key and iv
@@ -86,10 +87,12 @@ function testCipher3(key, iv) {
 
 {
   const Cipheriv = crypto.Cipheriv;
-  const key = '123456789012345678901234';
-  const iv = '12345678';
+  const algorithm = fips3 ? 'aes-128-cbc' : 'des-ede3-cbc';
+  const key = fips3 ?
+    '1234567890123456' : '123456789012345678901234';
+  const iv = fips3 ? '1234567890123456' : '12345678';
 
-  const instance = Cipheriv('des-ede3-cbc', key, iv);
+  const instance = Cipheriv(algorithm, key, iv);
   assert(instance instanceof Cipheriv, 'Cipheriv is expected to return a new ' +
                                        'instance when called without `new`');
 
@@ -119,10 +122,12 @@ function testCipher3(key, iv) {
 
 {
   const Decipheriv = crypto.Decipheriv;
-  const key = '123456789012345678901234';
-  const iv = '12345678';
+  const algorithm = fips3 ? 'aes-128-cbc' : 'des-ede3-cbc';
+  const key = fips3 ?
+    '1234567890123456' : '123456789012345678901234';
+  const iv = fips3 ? '1234567890123456' : '12345678';
 
-  const instance = Decipheriv('des-ede3-cbc', key, iv);
+  const instance = Decipheriv(algorithm, key, iv);
   assert(instance instanceof Decipheriv, 'Decipheriv expected to return a new' +
                                          ' instance when called without `new`');
 
@@ -153,8 +158,10 @@ function testCipher3(key, iv) {
 testCipher1('0123456789abcd0123456789', '12345678');
 testCipher1('0123456789abcd0123456789', Buffer.from('12345678'));
 testCipher1(Buffer.from('0123456789abcd0123456789'), '12345678');
-testCipher1(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
-testCipher2(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
+testCipher1(
+  Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
+testCipher2(
+  Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
 
 if (!isFipsEnabled) {
   testCipher3(Buffer.from('000102030405060708090A0B0C0D0E0F', 'hex'),
@@ -207,8 +214,8 @@ assert.throws(
   errMessage);
 
 // But all other IV lengths should be accepted.
-const minIvLength = hasOpenSSL3 ? 8 : 1;
-const maxIvLength = hasOpenSSL3 ? 64 : 256;
+const minIvLength = hasOpenSSL(3) ? 8 : 1;
+const maxIvLength = hasOpenSSL(3) ? 64 : 256;
 for (let n = minIvLength; n < maxIvLength; n += 1) {
   if (isFipsEnabled && n < 12) continue;
   crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n));
diff --git a/test/parallel/test-crypto-classes.js b/test/parallel/test-crypto-classes.js
index 429bc91d4412..48d68c93fb62 100644
--- a/test/parallel/test-crypto-classes.js
+++ b/test/parallel/test-crypto-classes.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 // 'ClassName' : ['args', 'for', 'constructor']
 const TEST_CASES = {
@@ -21,8 +21,17 @@ const TEST_CASES = {
   'ECDH': ['prime256v1'],
 };
 
-if (!crypto.getFips()) {
-  TEST_CASES.DiffieHellman = [hasOpenSSL3 ? 1024 : 256];
+if (hasFIPS(3)) {
+  TEST_CASES.Hmac = ['sha1', '0123456789abcdef'];
+  TEST_CASES.Cipheriv = [
+    'aes-128-cbc', '0123456789abcdef', '1234567890abcdef'];
+  TEST_CASES.Decipheriv = TEST_CASES.Cipheriv;
+  TEST_CASES.Sign = ['RSA-SHA256'];
+  TEST_CASES.Verify = ['RSA-SHA256'];
+  TEST_CASES.DiffieHellman = [2048];
+  TEST_CASES.DiffieHellmanGroup = ['modp14'];
+} else if (crypto.getFips() !== 1) {
+  TEST_CASES.DiffieHellman = [hasOpenSSL(3) ? 1024 : 256];
 }
 
 for (const [clazz, args] of Object.entries(TEST_CASES)) {
diff --git a/test/parallel/test-crypto-dh-constructor.js b/test/parallel/test-crypto-dh-constructor.js
index eb8674932484..28747ac3a726 100644
--- a/test/parallel/test-crypto-dh-constructor.js
+++ b/test/parallel/test-crypto-dh-constructor.js
@@ -5,9 +5,10 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
-const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
+const size = hasFIPS(3) ?
+  2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
 const dh1 = crypto.createDiffieHellman(size);
 const p1 = dh1.getPrime('buffer');
 
@@ -21,7 +22,7 @@ const p1 = dh1.getPrime('buffer');
 
 {
   const DiffieHellmanGroup = crypto.DiffieHellmanGroup;
-  const dhg = DiffieHellmanGroup('modp5');
+  const dhg = DiffieHellmanGroup(hasFIPS(3) ? 'modp14' : 'modp5');
   assert(dhg instanceof DiffieHellmanGroup, 'DiffieHellmanGroup is expected ' +
                                             'to return a new instance when ' +
                                             'called without `new`');
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index f14c58e7c200..c2449a292894 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const {
   DH_CHECK_P_NOT_PRIME,
   DH_CHECK_P_NOT_SAFE_PRIME,
@@ -123,112 +123,118 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
 
   // ECDH should check that point is on curve
   const ecdh3 = crypto.createECDH('secp256k1');
-  const key3 = ecdh3.generateKeys();
-
-  assert.throws(
-    () => ecdh2.computeSecret(key3, 'latin1', 'buffer'),
-    {
-      code: 'ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY',
-      name: 'Error',
-      message: 'Public key is not valid for specified curve'
+  if (hasFIPS(3)) {
+    assert.throws(() => ecdh3.generateKeys(), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
     });
+  } else {
+    const key3 = ecdh3.generateKeys();
 
-  // ECDH should allow .setPrivateKey()/.setPublicKey()
-  const ecdh4 = crypto.createECDH('prime256v1');
+    assert.throws(
+      () => ecdh2.computeSecret(key3, 'latin1', 'buffer'),
+      {
+        code: 'ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY',
+        name: 'Error',
+        message: 'Public key is not valid for specified curve'
+      });
 
-  ecdh4.setPrivateKey(ecdh1.getPrivateKey());
-  ecdh4.setPublicKey(ecdh1.getPublicKey());
+    // ECDH should allow .setPrivateKey()/.setPublicKey()
+    const ecdh4 = crypto.createECDH('prime256v1');
 
-  assert.throws(() => {
-    ecdh4.setPublicKey(ecdh3.getPublicKey());
-  }, { message: 'Failed to convert Buffer to EC_POINT' });
+    ecdh4.setPrivateKey(ecdh1.getPrivateKey());
+    ecdh4.setPublicKey(ecdh1.getPublicKey());
 
-  // Verify that we can use ECDH without having to use newly generated keys.
-  const ecdh5 = crypto.createECDH('secp256k1');
+    assert.throws(() => {
+      ecdh4.setPublicKey(ecdh3.getPublicKey());
+    }, { message: 'Failed to convert Buffer to EC_POINT' });
 
-  // Verify errors are thrown when retrieving keys from an uninitialized object.
-  assert.throws(() => {
-    ecdh5.getPublicKey();
-  }, /^Error: Failed to get ECDH public key$/);
+    // Verify that we can use ECDH without having to use newly generated keys.
+    const ecdh5 = crypto.createECDH('secp256k1');
 
-  assert.throws(() => {
-    ecdh5.getPrivateKey();
-  }, /^Error: Failed to get ECDH private key$/);
+    // Verify errors are thrown when retrieving keys from an uninitialized object.
+    assert.throws(() => {
+      ecdh5.getPublicKey();
+    }, /^Error: Failed to get ECDH public key$/);
+
+    assert.throws(() => {
+      ecdh5.getPrivateKey();
+    }, /^Error: Failed to get ECDH private key$/);
 
-  // A valid private key for the secp256k1 curve.
-  const cafebabeKey = 'cafebabe'.repeat(8);
-  // Associated compressed and uncompressed public keys (points).
-  const cafebabePubPtComp =
+    // A valid private key for the secp256k1 curve.
+    const cafebabeKey = 'cafebabe'.repeat(8);
+    // Associated compressed and uncompressed public keys (points).
+    const cafebabePubPtComp =
   '03672a31bfc59d3f04548ec9b7daeeba2f61814e8ccc40448045007f5479f693a3';
-  const cafebabePubPtUnComp =
+    const cafebabePubPtUnComp =
   '04672a31bfc59d3f04548ec9b7daeeba2f61814e8ccc40448045007f5479f693a3' +
   '2e02c7f93d13dc2732b760ca377a5897b9dd41a1c1b29dc0442fdce6d0a04d1d';
-  ecdh5.setPrivateKey(cafebabeKey, 'hex');
-  assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
-  // Show that the public point (key) is generated while setting the
-  // private key.
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
-
-  // Compressed and uncompressed public points/keys for other party's
-  // private key.
-  // 0xDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
-  const peerPubPtComp =
+    ecdh5.setPrivateKey(cafebabeKey, 'hex');
+    assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
+    // Show that the public point (key) is generated while setting the
+    // private key.
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+
+    // Compressed and uncompressed public points/keys for other party's
+    // private key.
+    // 0xDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
+    const peerPubPtComp =
   '02c6b754b20826eb925e052ee2c25285b162b51fdca732bcf67e39d647fb6830ae';
-  const peerPubPtUnComp =
+    const peerPubPtUnComp =
   '04c6b754b20826eb925e052ee2c25285b162b51fdca732bcf67e39d647fb6830ae' +
   'b651944a574a362082a77e3f2b5d9223eb54d7f2f76846522bf75f3bedb8178e';
 
-  const sharedSecret =
+    const sharedSecret =
   '1da220b5329bbe8bfd19ceef5a5898593f411a6f12ea40f2a8eead9a5cf59970';
 
-  assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
-                     sharedSecret);
-  assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
-                     sharedSecret);
-
-  // Verify that we still have the same key pair as before the computation.
-  assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
+                       sharedSecret);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
+                       sharedSecret);
 
-  // Verify setting and getting compressed and non-compressed serializations.
-  ecdh5.setPublicKey(cafebabePubPtComp, 'hex');
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
-  assert.strictEqual(
-    ecdh5.getPublicKey('hex', 'compressed'),
-    cafebabePubPtComp
-  );
-  ecdh5.setPublicKey(cafebabePubPtUnComp, 'hex');
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
-  assert.strictEqual(
-    ecdh5.getPublicKey('hex', 'compressed'),
-    cafebabePubPtComp
-  );
-
-  // Show why allowing the public key to be set on this type
-  // does not make sense.
-  ecdh5.setPublicKey(peerPubPtComp, 'hex');
-  assert.strictEqual(ecdh5.getPublicKey('hex'), peerPubPtUnComp);
-  assert.throws(() => {
-    // Error because the public key does not match the private key anymore.
-    ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex');
-  }, /Invalid key pair/);
-
-  // Set to a valid key to show that later attempts to set an invalid key are
-  // rejected.
-  ecdh5.setPrivateKey(cafebabeKey, 'hex');
-
-  // Some invalid private keys for the secp256k1 curve.
-  const errMessage = /Private key is not valid for specified curve/;
-  ['0000000000000000000000000000000000000000000000000000000000000000',
-   'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141',
-   'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF',
-  ].forEach((element) => {
-    assert.throws(() => {
-      ecdh5.setPrivateKey(element, 'hex');
-    }, errMessage);
-    // Verify object state did not change.
+    // Verify that we still have the same key pair as before the computation.
     assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
-  });
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+
+    // Verify setting and getting compressed and non-compressed serializations.
+    ecdh5.setPublicKey(cafebabePubPtComp, 'hex');
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+    assert.strictEqual(
+      ecdh5.getPublicKey('hex', 'compressed'),
+      cafebabePubPtComp
+    );
+    ecdh5.setPublicKey(cafebabePubPtUnComp, 'hex');
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+    assert.strictEqual(
+      ecdh5.getPublicKey('hex', 'compressed'),
+      cafebabePubPtComp
+    );
+
+    // Show why allowing the public key to be set on this type
+    // does not make sense.
+    ecdh5.setPublicKey(peerPubPtComp, 'hex');
+    assert.strictEqual(ecdh5.getPublicKey('hex'), peerPubPtUnComp);
+    assert.throws(() => {
+    // Error because the public key does not match the private key anymore.
+      ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex');
+    }, /Invalid key pair/);
+
+    // Set to a valid key to show that later attempts to set an invalid key are
+    // rejected.
+    ecdh5.setPrivateKey(cafebabeKey, 'hex');
+
+    // Some invalid private keys for the secp256k1 curve.
+    const errMessage = /Private key is not valid for specified curve/;
+    ['0000000000000000000000000000000000000000000000000000000000000000',
+     'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141',
+     'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF',
+    ].forEach((element) => {
+      assert.throws(() => {
+        ecdh5.setPrivateKey(element, 'hex');
+      }, errMessage);
+      // Verify object state did not change.
+      assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
+    });
+  }
 }
 
 // Use of invalid keys was not cleaning up ERR stack, and was causing
diff --git a/test/parallel/test-crypto-dh-generate-keys.js b/test/parallel/test-crypto-dh-generate-keys.js
index acf7e2d09b2b..d074ba957516 100644
--- a/test/parallel/test-crypto-dh-generate-keys.js
+++ b/test/parallel/test-crypto-dh-generate-keys.js
@@ -6,10 +6,11 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 {
-  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
+  const size = hasFIPS(3) ?
+    2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
 
   function unlessInvalidState(f) {
     try {
diff --git a/test/parallel/test-crypto-dh-leak.js b/test/parallel/test-crypto-dh-leak.js
index df1ba89737c6..8d5141eef4b1 100644
--- a/test/parallel/test-crypto-dh-leak.js
+++ b/test/parallel/test-crypto-dh-leak.js
@@ -9,11 +9,12 @@ if (common.isASan)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const before = process.memoryUsage.rss();
 {
-  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
+  const size = hasFIPS(3) ?
+    2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
   const dh = crypto.createDiffieHellman(size);
   const publicKey = dh.generateKeys();
   const privateKey = dh.getPrivateKey();
diff --git a/test/parallel/test-crypto-dh-modp2-views.js b/test/parallel/test-crypto-dh-modp2-views.js
index a28e615b7f35..e32c515e1536 100644
--- a/test/parallel/test-crypto-dh-modp2-views.js
+++ b/test/parallel/test-crypto-dh-modp2-views.js
@@ -5,24 +5,30 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf } = require('../common/crypto');
 
 if (process.features.openssl_is_boringssl) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
-const modp2 = crypto.createDiffieHellmanGroup('modp2');
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+} else {
+  const modp2 = crypto.createDiffieHellmanGroup('modp2');
 
-const views = common.getArrayBufferViews(modp2buf);
-for (const buf of [modp2buf, ...views]) {
-  // Ensure specific generator (string with encoding) works as expected with
-  // any ArrayBufferViews as the first argument to createDiffieHellman().
-  const exmodp2 = crypto.createDiffieHellman(buf, '02', 'hex');
-  modp2.generateKeys();
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
-      .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
-      .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
+  const views = common.getArrayBufferViews(modp2buf);
+  for (const buf of [modp2buf, ...views]) {
+    // Ensure specific generator (string with encoding) works as expected with
+    // any ArrayBufferViews as the first argument to createDiffieHellman().
+    const exmodp2 = crypto.createDiffieHellman(buf, '02', 'hex');
+    modp2.generateKeys();
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+        .toString('hex');
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+        .toString('hex');
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
 }
diff --git a/test/parallel/test-crypto-dh-modp2.js b/test/parallel/test-crypto-dh-modp2.js
index eb262f235ff3..0bf36f93a39a 100644
--- a/test/parallel/test-crypto-dh-modp2.js
+++ b/test/parallel/test-crypto-dh-modp2.js
@@ -5,44 +5,51 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf } = require('../common/crypto');
 
 if (process.features.openssl_is_boringssl) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
-const modp2 = crypto.createDiffieHellmanGroup('modp2');
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+} else {
+  const modp2 = crypto.createDiffieHellmanGroup('modp2');
 
-{
+  {
   // Ensure specific generator (buffer) works as expected.
-  const exmodp2 = crypto.createDiffieHellman(modp2buf, Buffer.from([2]));
-  modp2.generateKeys();
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+    const exmodp2 = crypto.createDiffieHellman(modp2buf, Buffer.from([2]));
+    modp2.generateKeys();
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
       .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
-}
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
 
-{
+  {
   // Ensure specific generator (string without encoding) works as expected.
-  const exmodp2 = crypto.createDiffieHellman(modp2buf, '\x02');
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+    const exmodp2 = crypto.createDiffieHellman(modp2buf, '\x02');
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
       .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
-}
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
 
-{
+  {
   // Ensure specific generator (numeric) works as expected.
-  const exmodp2 = crypto.createDiffieHellman(modp2buf, 2);
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+    const exmodp2 = crypto.createDiffieHellman(modp2buf, 2);
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
       .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
+
 }
diff --git a/test/parallel/test-crypto-dh-odd-key.js b/test/parallel/test-crypto-dh-odd-key.js
index fbe42be425ed..c96227770e3d 100644
--- a/test/parallel/test-crypto-dh-odd-key.js
+++ b/test/parallel/test-crypto-dh-odd-key.js
@@ -27,19 +27,24 @@ if (!common.hasCrypto) {
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 function test() {
   const odd = Buffer.alloc(39, 'A');
 
-  const c = crypto.createDiffieHellman(hasOpenSSL3 ? 1024 : 32);
+  const size = hasFIPS(3) ? 2048 : (hasOpenSSL(3) ? 1024 : 32);
+  const c = crypto.createDiffieHellman(size);
   c.setPrivateKey(odd);
   c.generateKeys();
 }
 
-// FIPS requires a length of at least 1024
-if (!crypto.getFips()) {
+if (hasFIPS(3)) {
+  test();
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+} else if (crypto.getFips() !== 1) {
   test();
 } else {
-  assert.throws(function() { test(); }, /key size too small/);
+  assert.throws(test, /key size too small/);
 }
diff --git a/test/parallel/test-crypto-dh-shared.js b/test/parallel/test-crypto-dh-shared.js
index 515405034d76..5e6db278324d 100644
--- a/test/parallel/test-crypto-dh-shared.js
+++ b/test/parallel/test-crypto-dh-shared.js
@@ -5,9 +5,11 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
-const alice = crypto.createDiffieHellmanGroup('modp5');
-const bob = crypto.createDiffieHellmanGroup('modp5');
+const group = hasFIPS(3) ? 'modp14' : 'modp5';
+const alice = crypto.createDiffieHellmanGroup(group);
+const bob = crypto.createDiffieHellmanGroup(group);
 alice.generateKeys();
 bob.generateKeys();
 const aSecret = alice.computeSecret(bob.getPublicKey()).toString('hex');
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index 8a3dee5b0756..dc55c5226efb 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -7,11 +7,13 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const crypto = require('crypto');
 const {
-  hasOpenSSL3,
+  hasOpenSSL,
+  hasFIPS,
 } = require('../common/crypto');
 
 {
-  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
+  const size = hasFIPS(3) ?
+    2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
   const dh1 = crypto.createDiffieHellman(size);
   const p1 = dh1.getPrime('buffer');
   const dh2 = crypto.createDiffieHellman(p1, 'buffer');
@@ -57,7 +59,7 @@ const {
   assert.strictEqual(secret1, secret4);
 
   let wrongBlockLength;
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     wrongBlockLength = {
       message: /wrong[\s_]final[\s_]block[\s_]length/i,
       code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
diff --git a/test/parallel/test-crypto-ecdh-convert-key.js b/test/parallel/test-crypto-ecdh-convert-key.js
index c0046099df9e..8c910b1b6052 100644
--- a/test/parallel/test-crypto-ecdh-convert-key.js
+++ b/test/parallel/test-crypto-ecdh-convert-key.js
@@ -6,6 +6,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 
 const { ECDH, createSign, getCurves } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // A valid private key for the secp256k1 curve.
 const cafebabeKey = 'cafebabe'.repeat(8);
@@ -93,11 +94,17 @@ if (getCurves().includes('secp256k1')) {
 
   // Compare to getPublicKey.
   const ecdh1 = ECDH('secp256k1');
-  ecdh1.generateKeys();
-  ecdh1.setPrivateKey(cafebabeKey, 'hex');
-  assert.strictEqual(ecdh1.getPublicKey('hex', 'uncompressed'), uncompressed);
-  assert.strictEqual(ecdh1.getPublicKey('hex', 'compressed'), compressed);
-  assert.strictEqual(ecdh1.getPublicKey('hex', 'hybrid'), hybrid);
+  if (hasFIPS(3)) {
+    assert.throws(() => ecdh1.generateKeys(), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+  } else {
+    ecdh1.generateKeys();
+    ecdh1.setPrivateKey(cafebabeKey, 'hex');
+    assert.strictEqual(ecdh1.getPublicKey('hex', 'uncompressed'), uncompressed);
+    assert.strictEqual(ecdh1.getPublicKey('hex', 'compressed'), compressed);
+    assert.strictEqual(ecdh1.getPublicKey('hex', 'hybrid'), hybrid);
+  }
 }
 
 // See https://github.com/nodejs/node/issues/26133, failed ConvertKey
diff --git a/test/parallel/test-crypto-eddsa-variants.js b/test/parallel/test-crypto-eddsa-variants.js
index 691534f13f5b..3a75a7bf4f6f 100644
--- a/test/parallel/test-crypto-eddsa-variants.js
+++ b/test/parallel/test-crypto-eddsa-variants.js
@@ -7,6 +7,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const {
   hasOpenSSL,
+  hasFIPS,
 } = require('../common/crypto');
 
 // RFC 8032 Section 7 test vectors for Ed25519, Ed25519ctx, and Ed448.
@@ -191,7 +192,18 @@ for (const v of vectors) {
   const signKey = context ? { key: privateKey, context } : privateKey;
   const verifyKey = context ? { key: publicKey, context } : publicKey;
 
-  const sig = crypto.sign(null, message, signKey);
+  let sig;
+  try {
+    sig = crypto.sign(null, message, signKey);
+  } catch (err) {
+    if (!hasFIPS(3) ||
+        (!v.algorithm.endsWith('ctx') && !v.context)) {
+      throw err;
+    }
+    assert.strictEqual(
+      err.code, 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION');
+    continue;
+  }
   assert.deepStrictEqual(sig, expectedSig);
   assert.strictEqual(
     crypto.verify(null, message, verifyKey, expectedSig), true);
diff --git a/test/parallel/test-crypto-encap-decap.js b/test/parallel/test-crypto-encap-decap.js
index f2259194a9e1..7cafa0f2aa93 100644
--- a/test/parallel/test-crypto-encap-decap.js
+++ b/test/parallel/test-crypto-encap-decap.js
@@ -6,10 +6,11 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const { promisify } = require('util');
 
 const isBoringSSL = process.features.openssl_is_boringssl;
+const isFips = hasFIPS(3);
 
 if (!hasOpenSSL(3) && !isBoringSSL) {
   assert.throws(() => crypto.encapsulate(), { code: 'ERR_CRYPTO_KEM_NOT_SUPPORTED' });
@@ -36,7 +37,7 @@ const keys = {
     privateKey: fixtures.readKey('rsa_pss_private_2048.pem', 'ascii'),
   },
   'p-256': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('ec_p256_public.pem', 'ascii'),
     privateKey: fixtures.readKey('ec_p256_private.pem', 'ascii'),
     sharedSecretLength: 32,
@@ -44,7 +45,7 @@ const keys = {
     raw: true,
   },
   'p-384': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('ec_p384_public.pem', 'ascii'),
     privateKey: fixtures.readKey('ec_p384_private.pem', 'ascii'),
     sharedSecretLength: 48,
@@ -52,7 +53,7 @@ const keys = {
     raw: true,
   },
   'p-521': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('ec_p521_public.pem', 'ascii'),
     privateKey: fixtures.readKey('ec_p521_private.pem', 'ascii'),
     sharedSecretLength: 64,
@@ -65,7 +66,7 @@ const keys = {
     privateKey: fixtures.readKey('ec_secp256k1_private.pem', 'ascii'),
   },
   'x25519': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('x25519_public.pem', 'ascii'),
     privateKey: fixtures.readKey('x25519_private.pem', 'ascii'),
     sharedSecretLength: 32,
@@ -73,7 +74,7 @@ const keys = {
     raw: true,
   },
   'x448': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('x448_public.pem', 'ascii'),
     privateKey: fixtures.readKey('x448_private.pem', 'ascii'),
     sharedSecretLength: 64,
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index d55985aa3c7f..4f9f2975ad6d 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -6,8 +6,9 @@ if (!common.hasCrypto)
 
 const {
   getCiphers,
-  getCipherInfo
+  getCipherInfo,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 const assert = require('assert');
 
@@ -76,7 +77,10 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 assert(!getCipherInfo('aes-128-ocb', { ivLength: 16 }));
-if (!process.features.openssl_is_boringssl) {
+if (hasFIPS(3)) {
+  assert.strictEqual(
+    getCipherInfo('aes-128-ocb', { ivLength: 12 }), undefined);
+} else if (!process.features.openssl_is_boringssl) {
   for (let n = 1; n < 16; n++)
     assert(getCipherInfo('aes-128-ocb', { ivLength: n }));
 } else {
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index 242e278707d7..bfde3b324331 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -13,7 +13,7 @@ const {
   hkdfSync,
   getHashes
 } = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 {
   assert.throws(() => hkdf(), {
@@ -120,12 +120,12 @@ const { hasOpenSSL3 } = require('../common/crypto');
 }
 
 const algorithms = [
-  ['sha256', 'secret', 'salt', 'info', 10],
+  ['sha256', '0123456789abcdef', '0123456789abcdef', 'info', 10],
   ['sha256', '', '', '', 10],
   ['sha256', '', 'salt', '', 10],
   ['sha512', 'secret', 'salt', '', 15],
 ];
-if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3) && !process.features.openssl_is_boringssl)
   algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
 
 algorithms.forEach(([ hash, secret, salt, info, length ]) => {
@@ -216,7 +216,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => {
 });
 
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   const kKnownUnsupported = ['shake128', 'shake256'];
   for (const hash of getHashes()) {
     if (kKnownUnsupported.includes(hash)) continue;
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index 48857c7cf027..29740a2fc247 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -6,6 +6,9 @@ if (!common.hasCrypto) {
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
 
 {
   const Hmac = crypto.Hmac;
@@ -24,7 +27,7 @@ assert.throws(
 
 // This used to segfault. See: https://github.com/nodejs/node/issues/9819
 assert.throws(
-  () => crypto.createHmac('sha256', 'key').digest({
+  () => crypto.createHmac('sha256', '0123456789abcdef').digest({
     toString: () => { throw new Error('boom'); },
   }),
   {
@@ -40,9 +43,14 @@ assert.throws(
   });
 
 function testHmac(algo, key, data, expected) {
-  // FIPS does not support MD5.
-  if (crypto.getFips() && algo === 'md5')
+  if (crypto.getFips() === 1 && algo === 'md5') {
+    if (fips3) {
+      assert.throws(() => crypto.createHmac(algo, Buffer.alloc(32)), {
+        code: 'ERR_OSSL_EVP_UNSUPPORTED',
+      });
+    }
     return;
+  }
 
   if (!Array.isArray(data))
     data = [data];
@@ -70,12 +78,13 @@ function testHmac(algo, key, data, expected) {
 
 {
   // Historically, dss1 and DSS1 are SHA-1 aliases.
+  const key = '0123456789abcdef';
   const expected =
-    crypto.createHmac('sha1', 'key').update('data').digest('hex');
+    crypto.createHmac('sha1', key).update('data').digest('hex');
 
   for (const algo of ['dss1', 'DSS1']) {
     assert.strictEqual(
-      crypto.createHmac(algo, 'key').update('data').digest('hex'),
+      crypto.createHmac(algo, key).update('data').digest('hex'),
       expected);
   }
 }
@@ -419,9 +428,12 @@ const rfc2202_sha1 = [
 for (const { key, data, hmac } of rfc2202_sha1)
   testHmac('sha1', key, data, hmac);
 
-assert.strictEqual(
-  crypto.createHmac('sha256', 'w00t').digest('ucs2'),
-  crypto.createHmac('sha256', 'w00t').digest().toString('ucs2'));
+{
+  const key = '0123456789abcdef';
+  assert.strictEqual(
+    crypto.createHmac('sha256', key).digest('ucs2'),
+    crypto.createHmac('sha256', key).digest().toString('ucs2'));
+}
 
 // Check initialized -> uninitialized state transition after calling digest().
 {
@@ -460,7 +472,7 @@ assert.strictEqual(
 
 {
   assert.throws(
-    () => crypto.createHmac('sha7', 'key'),
+    () => crypto.createHmac('sha7', '0123456789abcdef'),
     /Invalid digest/);
 }
 
diff --git a/test/parallel/test-crypto-job-error-parity.js b/test/parallel/test-crypto-job-error-parity.js
index f10c910ff67b..ee9bd27bba6b 100644
--- a/test/parallel/test-crypto-job-error-parity.js
+++ b/test/parallel/test-crypto-job-error-parity.js
@@ -8,11 +8,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
+const fips3 = hasFIPS(3);
+
 function getError(fn) {
   let err;
   assert.throws(fn, (e) => { err = e; return true; });
@@ -69,14 +71,26 @@ const data = Buffer.from('test data');
 // Sign: RSA key too small for digest (OpenSSL error)
 {
   const { privateKey } = crypto.generateKeyPairSync('rsa', {
-    modulusLength: 512,
+    modulusLength: fips3 ? 2048 : 512,
   });
+  const key = fips3 ? {
+    key: privateKey,
+    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: 256,
+  } : privateKey;
+  const digest = fips3 ? 'sha256' : 'sha512';
+
+  const syncErr = getError(() => crypto.sign(digest, data, key));
+  if (fips3) {
+    assert.strictEqual(syncErr.code,
+                       'ERR_OSSL_RSA_DATA_TOO_LARGE_FOR_KEY_SIZE');
+  } else {
+    assert.match(
+      syncErr.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
+  }
 
-  const syncErr = getError(() => crypto.sign('sha512', data, privateKey));
-  assert.match(syncErr.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
-
-  crypto.sign('sha512', data, privateKey, common.mustCall((asyncErr) => {
-    assertErrorMatch(syncErr, asyncErr, 'sign: RSA 512 + sha512');
+  crypto.sign(digest, data, key, common.mustCall((asyncErr) => {
+    assertErrorMatch(syncErr, asyncErr, 'sign: RSA policy error');
   }));
 }
 
@@ -160,7 +174,9 @@ const data = Buffer.from('test data');
 
 // DH: Mismatched DH group params (OpenSSL error)
 {
-  const alice = crypto.generateKeyPairSync('dh', { group: 'modp5' });
+  const alice = crypto.generateKeyPairSync('dh', {
+    group: fips3 ? 'modp14' : 'modp5',
+  });
   const bob = crypto.generateKeyPairSync('dh', { group: 'modp18' });
 
   const syncErr = getError(() =>
diff --git a/test/parallel/test-crypto-key-objects-messageport.js b/test/parallel/test-crypto-key-objects-messageport.js
index d23fde0d00d7..a379b84185ce 100644
--- a/test/parallel/test-crypto-key-objects-messageport.js
+++ b/test/parallel/test-crypto-key-objects-messageport.js
@@ -9,6 +9,7 @@ const {
   generateKeyPairSync,
   KeyObject,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const { createContext } = require('vm');
 const {
@@ -45,7 +46,7 @@ process.env.HAS_STARTED_WORKER = 1;
   // The main thread generates keys and passes them to worker threads.
   const secretKey = generateKeySync('aes', { length: 128 });
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024
+    modulusLength: hasFIPS(3) ? 2048 : 1024
   });
   const cryptoKey = await subtle.generateKey(
     { name: 'AES-CBC', length: 128 }, false, ['encrypt']);
diff --git a/test/parallel/test-crypto-key-objects-to-crypto-key.js b/test/parallel/test-crypto-key-objects-to-crypto-key.js
index a498df144f33..32228e7c8a06 100644
--- a/test/parallel/test-crypto-key-objects-to-crypto-key.js
+++ b/test/parallel/test-crypto-key-objects-to-crypto-key.js
@@ -12,7 +12,9 @@ const {
   randomBytes,
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { kSupportedAlgorithms } = require('internal/crypto/util');
+const rejectsXCurves = hasFIPS(3, 5);
 
 const hashes = Object.keys(kSupportedAlgorithms.digest).filter((name) => {
   return name.startsWith('SHA-') || name.startsWith('SHA3-');
@@ -232,6 +234,13 @@ function ecVectors(name, usagesByType) {
 }
 
 function cfrgVectors(name, usagesByType) {
+  if (rejectsXCurves && name.startsWith('X')) {
+    assert.throws(() => generateKeyPairSync(name.toLowerCase()), {
+      code: 'ERR_OSSL_EVP_UNSUPPORTED',
+    });
+    return [];
+  }
+
   const keyPair = generateKeyPairSync(name.toLowerCase());
   return asymmetricVectors(keyPair, name, usagesByType);
 }
@@ -317,9 +326,11 @@ const invalid = {
   'HMAC': () => macInvalid(
     { name: 'HMAC', hash: 'SHA-256' },
     'HmacImportParams.length cannot be 0'),
-  'X25519': () => invalidAsymmetricKeyType('X25519', 'Ed25519'),
 };
 
+if (!rejectsXCurves)
+  invalid.X25519 = () => invalidAsymmetricKeyType('X25519', 'Ed25519');
+
 for (const name of ['AES-CBC', 'AES-CTR', 'AES-GCM', 'AES-OCB']) {
   if (name in kSupportedAlgorithms.importKey)
     tests[name] = symmetricVectors(name, ['encrypt', 'decrypt']);
@@ -350,9 +361,11 @@ for (const [name, usages, invalidAlgorithm] of [
 ]) {
   if (name in kSupportedAlgorithms.importKey) {
     tests[name] = cfrgVectors(name, usages);
-    invalid[name] = () => {
-      invalidAsymmetricKeyType(name, invalidAlgorithm);
-    };
+    if (!rejectsXCurves) {
+      invalid[name] = () => {
+        invalidAsymmetricKeyType(name, invalidAlgorithm);
+      };
+    }
   }
 }
 
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index dadeb780cf6c..ba9a05387f21 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -24,7 +24,17 @@ const {
   generateKeyPairSync,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips30 = fips3 && !fips35;
+const fips4 = hasFIPS(4);
+const rejectsXCurves = fips35;
+const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
 
 const fixtures = require('../common/fixtures');
 
@@ -201,15 +211,26 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
 
   // It should also be possible to import an encrypted private key as a public
   // key.
+  const passphrase = 'password';
+  if (fips4) {
+    assert.throws(() => privateKey.export({
+      type: 'pkcs8',
+      format: 'pem',
+      passphrase: '123',
+      cipher: 'aes-128-cbc'
+    }), {
+      code: 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+    });
+  }
   const decryptedKey = createPublicKey({
     key: privateKey.export({
       type: 'pkcs8',
       format: 'pem',
-      passphrase: '123',
+      passphrase,
       cipher: 'aes-128-cbc'
     }),
     format: 'pem',
-    passphrase: '123'
+    passphrase
   });
   assert.strictEqual(decryptedKey.type, 'public');
   assert.strictEqual(decryptedKey.asymmetricKeyType, 'rsa');
@@ -328,7 +349,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   // This should not cause a crash: https://github.com/nodejs/node/issues/25247
   assert.throws(() => {
     createPrivateKey({ key: '' });
-  }, hasOpenSSL3 ? {
+  }, hasOpenSSL(3) ? {
     message: 'error:1E08010C:DECODER routines::unsupported',
   } : process.features.openssl_is_boringssl ? {
     message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE',
@@ -360,7 +381,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
       type: 'pkcs1'
     });
     createPrivateKey({ key, format: 'der', type: 'pkcs1' });
-  }, hasOpenSSL3 ? {
+  }, hasOpenSSL(3) ? {
     message: /error:1E08010C:DECODER routines::unsupported/,
     library: 'DECODER routines'
   } : process.features.openssl_is_boringssl ? {
@@ -415,6 +436,8 @@ for (const info of [
     } },
 ]) {
   const keyType = info.keyType;
+  const fipsUnsupported =
+    rejectsXCurves && keyType.startsWith('x');
 
   if (process.features.openssl_is_boringssl && keyType.endsWith('448')) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
@@ -433,19 +456,32 @@ for (const info of [
   }
 
   {
-    const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
-    assert.strictEqual(key.type, 'private');
-    assert.strictEqual(key.asymmetricKeyType, keyType);
-    assert.strictEqual(key.symmetricKeySize, undefined);
-    assert.strictEqual(
-      key.export({ type: 'pkcs8', format: 'pem' }), info.private);
-    assert.deepStrictEqual(
-      key.export({ format: 'jwk' }), info.jwk);
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
+      assert.strictEqual(key.type, 'private');
+      assert.strictEqual(key.asymmetricKeyType, keyType);
+      assert.strictEqual(key.symmetricKeySize, undefined);
+      assert.strictEqual(
+        key.export({ type: 'pkcs8', format: 'pem' }), info.private);
+      assert.deepStrictEqual(
+        key.export({ format: 'jwk' }), info.jwk);
+    }
   }
 
   {
-    for (const input of [
-      info.private, info.public, { key: info.jwk, format: 'jwk' }]) {
+    const inputs = [info.private, info.public];
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPublicKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      inputs.push({ key: info.jwk, format: 'jwk' });
+    }
+    for (const input of inputs) {
       const key = createPublicKey(input);
       assert.strictEqual(key.type, 'public');
       assert.strictEqual(key.asymmetricKeyType, keyType);
@@ -469,21 +505,32 @@ for (const info of [
     assert(Buffer.isBuffer(rawPriv));
     assert(Buffer.isBuffer(rawPub));
 
-    const importedPriv = createPrivateKey({
+    const privateOptions = {
       key: rawPriv, format: 'raw-private', asymmetricKeyType: keyType,
-    });
-    assert.strictEqual(importedPriv.type, 'private');
-    assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPriv.export({ format: 'raw-private' }), rawPriv);
-
-    const importedPub = createPublicKey({
+    };
+    const publicOptions = {
       key: rawPub, format: 'raw-public', asymmetricKeyType: keyType,
-    });
-    assert.strictEqual(importedPub.type, 'public');
-    assert.strictEqual(importedPub.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPub.export({ format: 'raw-public' }), rawPub);
+    };
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey(privateOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(
+        () => createPublicKey(publicOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+    } else {
+      const importedPriv = createPrivateKey(privateOptions);
+      assert.strictEqual(importedPriv.type, 'private');
+      assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPriv.export({ format: 'raw-private' }), rawPriv);
+
+      const importedPub = createPublicKey(publicOptions);
+      assert.strictEqual(importedPub.type, 'public');
+      assert.strictEqual(importedPub.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPub.export({ format: 'raw-public' }), rawPub);
+    }
   }
 }
 
@@ -582,6 +629,7 @@ for (const info of [
     } },
 ]) {
   const { keyType, namedCurve } = info;
+  const fipsUnsupported = fips3 && namedCurve === 'secp256k1';
 
   if (process.features.openssl_is_boringssl && !getCurves().includes(namedCurve)) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
@@ -601,20 +649,33 @@ for (const info of [
   }
 
   {
-    const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
-    assert.strictEqual(key.type, 'private');
-    assert.strictEqual(key.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(key.asymmetricKeyDetails, { namedCurve });
-    assert.strictEqual(key.symmetricKeySize, undefined);
-    assert.strictEqual(
-      key.export({ type: 'pkcs8', format: 'pem' }), info.private);
-    assert.deepStrictEqual(
-      key.export({ format: 'jwk' }), info.jwk);
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
+      assert.strictEqual(key.type, 'private');
+      assert.strictEqual(key.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(key.asymmetricKeyDetails, { namedCurve });
+      assert.strictEqual(key.symmetricKeySize, undefined);
+      assert.strictEqual(
+        key.export({ type: 'pkcs8', format: 'pem' }), info.private);
+      assert.deepStrictEqual(
+        key.export({ format: 'jwk' }), info.jwk);
+    }
   }
 
   {
-    for (const input of [
-      info.private, info.public, { key: info.jwk, format: 'jwk' }]) {
+    const inputs = [info.private, info.public];
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPublicKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      inputs.push({ key: info.jwk, format: 'jwk' });
+    }
+    for (const input of inputs) {
       const key = createPublicKey(input);
       assert.strictEqual(key.type, 'public');
       assert.strictEqual(key.asymmetricKeyType, keyType);
@@ -649,23 +710,35 @@ for (const info of [
     assert(Buffer.isBuffer(rawPriv));
     assert(Buffer.isBuffer(rawPub));
 
-    const importedPriv = createPrivateKey({
+    const privateOptions = {
       key: rawPriv, format: 'raw-private',
       asymmetricKeyType: keyType, namedCurve,
-    });
-    assert.strictEqual(importedPriv.type, 'private');
-    assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPriv.export({ format: 'raw-private' }), rawPriv);
+    };
 
-    const importedPub = createPublicKey({
+    const publicOptions = {
       key: rawPub, format: 'raw-public',
       asymmetricKeyType: keyType, namedCurve,
-    });
-    assert.strictEqual(importedPub.type, 'public');
-    assert.strictEqual(importedPub.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPub.export({ format: 'raw-public' }), rawPub);
+    };
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey(privateOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(
+        () => createPublicKey(publicOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+    } else {
+      const importedPriv = createPrivateKey(privateOptions);
+      assert.strictEqual(importedPriv.type, 'private');
+      assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPriv.export({ format: 'raw-private' }), rawPriv);
+
+      const importedPub = createPublicKey(publicOptions);
+      assert.strictEqual(importedPub.type, 'public');
+      assert.strictEqual(importedPub.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPub.export({ format: 'raw-public' }), rawPub);
+    }
   }
 }
 
@@ -717,7 +790,7 @@ for (const info of [
 
 {
   // Reading an encrypted key without a passphrase should fail.
-  assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL3 ? {
+  assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL(3) ? {
     name: 'Error',
     message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled',
@@ -733,7 +806,7 @@ for (const info of [
     key: privateDsa,
     format: 'pem',
     passphrase: Buffer.alloc(1025, 'a')
-  }), hasOpenSSL3 ? { name: 'Error' } : {
+  }), hasOpenSSL(3) ? { name: 'Error' } : {
     code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
     name: 'Error'
   });
@@ -744,8 +817,10 @@ for (const info of [
     key: privateDsa,
     format: 'pem',
     passphrase: Buffer.alloc(1024, 'a')
-  }), {
-    message: /bad decrypt|BAD_DECRYPT/
+  }), fips4 ? {
+    code: 'ERR_OSSL_INVALID_SALT_LENGTH',
+  } : {
+    message: /bad decrypt|BAD_DECRYPT/,
   });
 
   const publicKey = createPublicKey(publicDsa);
@@ -756,11 +831,28 @@ for (const info of [
     () => publicKey.export({ format: 'jwk' }),
     { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' });
 
-  const privateKey = createPrivateKey({
-    key: privateDsa,
+  const privateKeyData =
+    createPrivateKey(fixtures.readKey('dsa_private.pem')).export({
+      type: 'pkcs8',
+      format: 'pem',
+      cipher: 'aes-256-cbc',
+      passphrase: 'password',
+    });
+  const privateKeyOptions = {
+    key: privateKeyData,
     format: 'pem',
-    passphrase: 'secret'
-  });
+    passphrase: 'password',
+  };
+  if (fips4) {
+    assert.throws(() => createPrivateKey({
+      key: privateDsa,
+      format: 'pem',
+      passphrase: 'secret',
+    }), {
+      code: 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+    });
+  }
+  const privateKey = createPrivateKey(privateKeyOptions);
   assert.strictEqual(privateKey.type, 'private');
   assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
   assert.strictEqual(privateKey.symmetricKeySize, undefined);
@@ -804,20 +896,27 @@ if (!process.features.openssl_is_boringssl) {
       { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' });
 
     for (const key of [privatePem, privateKey]) {
-      // Any algorithm should work.
-      for (const algo of ['sha1', 'sha256']) {
-        // Any salt length should work.
-        for (const saltLength of [undefined, 8, 10, 12, 16, 18, 20]) {
-          const signature = createSign(algo)
-                            .update('foo')
-                            .sign({ key, saltLength });
-
-          for (const pkey of [key, publicKey, publicPem]) {
-            const okay = createVerify(algo)
-                         .update('foo')
-                         .verify({ key: pkey, saltLength }, signature);
-
-            assert.ok(okay);
+      if (fips30) {
+        // With no explicit parameters, this key defaults to SHA-1 for PSS.
+        assert.throws(() => createSign('sha256').update('foo').sign(key), {
+          code: fipsDigestErrorCode,
+        });
+      } else {
+        // Any algorithm should work.
+        for (const algo of ['sha1', 'sha256']) {
+          // Any salt length should work.
+          for (const saltLength of [undefined, 8, 10, 12, 16, 18, 20]) {
+            const signature = createSign(algo)
+                              .update('foo')
+                              .sign({ key, saltLength });
+
+            for (const pkey of [key, publicKey, publicPem]) {
+              const okay = createVerify(algo)
+                           .update('foo')
+                           .verify({ key: pkey, saltLength }, signature);
+
+              assert.ok(okay);
+            }
           }
         }
       }
@@ -885,12 +984,15 @@ if (!process.features.openssl_is_boringssl) {
       // Signing with anything other than sha256 should fail.
       assert.throws(() => {
         createSign('sha1').sign(key);
-      }, /digest not allowed/);
+      }, fips30 ? {
+        code: fipsDigestErrorCode,
+      } : /digest not allowed/);
 
       // Signing with salt lengths less than 16 bytes should fail.
       for (const saltLength of [8, 10, 12]) {
         assert.throws(() => {
-          createSign('sha1').sign({ key, saltLength });
+          createSign(fips3 ? 'sha256' : 'sha1')
+            .sign({ key, saltLength });
         }, /pss saltlen too small/);
       }
 
@@ -983,7 +1085,9 @@ if (!process.features.openssl_is_boringssl) {
       for (const algo of ['sha1', 'sha256']) {
         assert.throws(() => {
           createSign(algo).sign(key);
-        }, /digest not allowed/);
+        }, fips30 && algo === 'sha1' ? {
+          code: fipsDigestErrorCode,
+        } : /digest not allowed/);
       }
 
       // sha512 should produce a valid signature.
@@ -1046,20 +1150,26 @@ if (!process.features.openssl_is_boringssl) {
   // provider is currently in use.
   const namedCurve = getCurves().find((curve) => !supported.includes(curve));
   assert(namedCurve);
-  const keyPair = generateKeyPairSync('ec', { namedCurve });
-  const { publicKey, privateKey } = keyPair;
-  assert.throws(
-    () => publicKey.export({ format: 'jwk' }),
-    {
-      code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
-      message: `Unsupported JWK EC curve: ${namedCurve}.`
-    });
-  assert.throws(
-    () => privateKey.export({ format: 'jwk' }),
-    {
-      code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
-      message: `Unsupported JWK EC curve: ${namedCurve}.`
+  if (fips3) {
+    assert.throws(() => generateKeyPairSync('ec', { namedCurve }), {
+      code: 'ERR_OSSL_EC_UNKNOWN_GROUP',
     });
+  } else {
+    const keyPair = generateKeyPairSync('ec', { namedCurve });
+    const { publicKey, privateKey } = keyPair;
+    assert.throws(
+      () => publicKey.export({ format: 'jwk' }),
+      {
+        code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
+        message: `Unsupported JWK EC curve: ${namedCurve}.`
+      });
+    assert.throws(
+      () => privateKey.export({ format: 'jwk' }),
+      {
+        code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
+        message: `Unsupported JWK EC curve: ${namedCurve}.`
+      });
+  }
 }
 
 {
@@ -1102,12 +1212,18 @@ if (!process.features.openssl_is_boringssl) {
 
 {
   const first = generateKeyPairSync('ed25519');
-  const second = generateKeyPairSync('x25519');
+  if (rejectsXCurves) {
+    assert.throws(() => generateKeyPairSync('x25519'), {
+      code: 'ERR_OSSL_EVP_UNSUPPORTED',
+    });
+  } else {
+    const second = generateKeyPairSync('x25519');
 
-  assert(!first.publicKey.equals(second.publicKey));
-  assert(!first.publicKey.equals(second.privateKey));
-  assert(!first.privateKey.equals(second.privateKey));
-  assert(!first.privateKey.equals(second.publicKey));
+    assert(!first.publicKey.equals(second.publicKey));
+    assert(!first.publicKey.equals(second.privateKey));
+    assert(!first.privateKey.equals(second.privateKey));
+    assert(!first.privateKey.equals(second.publicKey));
+  }
 }
 
 {
diff --git a/test/parallel/test-crypto-key-store.js b/test/parallel/test-crypto-key-store.js
index b6f012416673..58a23192b28f 100644
--- a/test/parallel/test-crypto-key-store.js
+++ b/test/parallel/test-crypto-key-store.js
@@ -2,7 +2,7 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 if (!hasOpenSSL(3))
   common.skip('requires OpenSSL 3.x');
 
@@ -84,26 +84,32 @@ const data = Buffer.from('hello store');
 }
 
 {
-  const alice = generateKeyPairSync('x25519');
-  const bob = generateKeyPairSync('x25519');
-  const file = path.join(tmpdir.path, 'x25519.pem');
-  fs.writeFileSync(file, alice.privateKey.export({
-    format: 'pem',
-    type: 'pkcs8',
-  }));
-  const url = pathToFileURL(file);
+  if (hasFIPS(3, 5)) {
+    assert.throws(() => generateKeyPairSync('x25519'), {
+      code: 'ERR_OSSL_EVP_UNSUPPORTED',
+    });
+  } else {
+    const alice = generateKeyPairSync('x25519');
+    const bob = generateKeyPairSync('x25519');
+    const file = path.join(tmpdir.path, 'x25519.pem');
+    fs.writeFileSync(file, alice.privateKey.export({
+      format: 'pem',
+      type: 'pkcs8',
+    }));
+    const url = pathToFileURL(file);
 
-  const expected = diffieHellman({
-    privateKey: alice.privateKey,
-    publicKey: bob.publicKey,
-  });
-  assert.deepStrictEqual(
-    diffieHellman({ privateKey: url, publicKey: bob.publicKey }),
-    expected);
+    const expected = diffieHellman({
+      privateKey: alice.privateKey,
+      publicKey: bob.publicKey,
+    });
+    assert.deepStrictEqual(
+      diffieHellman({ privateKey: url, publicKey: bob.publicKey }),
+      expected);
 
-  if (hasOpenSSL(3, 2)) {
-    const { sharedKey, ciphertext } = encapsulate(alice.publicKey);
-    assert.deepStrictEqual(decapsulate(url, ciphertext), sharedKey);
+    if (hasOpenSSL(3, 2)) {
+      const { sharedKey, ciphertext } = encapsulate(alice.publicKey);
+      assert.deepStrictEqual(decapsulate(url, ciphertext), sharedKey);
+    }
   }
 }
 
diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js
index d7c857d35e21..6c7129c7efba 100644
--- a/test/parallel/test-crypto-keygen-async-dsa.js
+++ b/test/parallel/test-crypto-keygen-async-dsa.js
@@ -17,7 +17,7 @@ const {
   spkiExp,
 } = require('../common/crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // Test async DSA key generation.
 {
@@ -27,7 +27,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
   };
 
   generateKeyPair('dsa', {
-    modulusLength: hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL(3) ? 2048 : 512,
     divisorLength: 256,
     publicKeyEncoding: {
       type: 'spki',
@@ -35,7 +35,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
     },
     privateKeyEncoding: {
       cipher: 'aes-128-cbc',
-      passphrase: 'secret',
+      passphrase: 'password',
       ...privateKeyEncoding
     }
   }, common.mustSucceed((publicKey, privateKeyDER) => {
@@ -44,8 +44,8 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // The private key is DER-encoded.
     assert(Buffer.isBuffer(privateKeyDER));
 
-    assertApproximateSize(publicKey, hasOpenSSL3 ? 1194 : 440);
-    assertApproximateSize(privateKeyDER, hasOpenSSL3 ? 721 : 336);
+    assertApproximateSize(publicKey, hasOpenSSL(3) ? 1194 : 440);
+    assertApproximateSize(privateKeyDER, hasOpenSSL(3) ? 721 : 336);
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => {
@@ -63,7 +63,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
     testSignVerify(publicKey, {
       key: privateKeyDER,
       ...privateKeyEncoding,
-      passphrase: 'secret'
+      passphrase: 'password'
     });
   }));
 }
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
index b0945dcc83a2..bde6dc1d694b 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
@@ -8,6 +8,7 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test async elliptic curve key generation with 'jwk' encoding and named
 // curve.
@@ -24,7 +25,12 @@ for (const curve of ['P-384', 'P-256', 'P-521', 'secp256k1']) {
     privateKeyEncoding: {
       format: 'jwk'
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3) && curve === 'secp256k1') {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EC_UNKNOWN_GROUP');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(typeof publicKey, 'object');
     assert.strictEqual(typeof privateKey, 'object');
     assert.strictEqual(publicKey.x, privateKey.x);
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js
index 449d1a97f9f6..f1a1bdf8322f 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js
@@ -8,11 +8,12 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test async elliptic curve key generation with 'jwk' encoding and RSA.
 {
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     publicKeyEncoding: {
       format: 'jwk'
     },
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
index 731960b0d56a..cfef18c889b6 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
@@ -8,6 +8,8 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+const rejectsXCurves = hasFIPS(3, 5);
 
 // Test async elliptic curve key generation with 'jwk' encoding.
 {
@@ -23,7 +25,12 @@ const {
       privateKeyEncoding: {
         format: 'jwk'
       }
-    }, common.mustSucceed((publicKey, privateKey) => {
+    }, common.mustCall((err, publicKey, privateKey) => {
+      if (rejectsXCurves && type.startsWith('x')) {
+        assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+        return;
+      }
+      assert.ifError(err);
       assert.strictEqual(typeof publicKey, 'object');
       assert.strictEqual(typeof privateKey, 'object');
       assert.strictEqual(publicKey.x, privateKey.x);
diff --git a/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js b/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js
index 3203dfe16eb6..c1bc6fc95ea0 100644
--- a/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js
+++ b/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js
@@ -10,15 +10,17 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key, but encoded as DER.
 {
+  const isFips = hasFIPS(3);
   generateKeyPair('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'der'
@@ -29,7 +31,7 @@ const {
     }
   }, common.mustSucceed((publicKeyDER, privateKeyDER) => {
     assert(Buffer.isBuffer(publicKeyDER));
-    assertApproximateSize(publicKeyDER, 74);
+    assertApproximateSize(publicKeyDER, isFips ? 270 : 74);
 
     assert(Buffer.isBuffer(privateKeyDER));
 
diff --git a/test/parallel/test-crypto-keygen-async-encrypted-private-key.js b/test/parallel/test-crypto-keygen-async-encrypted-private-key.js
index 727cccc6f3ef..37a0121742df 100644
--- a/test/parallel/test-crypto-keygen-async-encrypted-private-key.js
+++ b/test/parallel/test-crypto-keygen-async-encrypted-private-key.js
@@ -10,15 +10,18 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key, but encoded as DER.
 {
+  const isFips = hasFIPS(3);
+  const passphrase = 'password';
   generateKeyPair('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'der'
@@ -27,11 +30,11 @@ const {
       type: 'pkcs8',
       format: 'der',
       cipher: 'aes-256-cbc',
-      passphrase: 'secret'
+      passphrase
     }
   }, common.mustSucceed((publicKeyDER, privateKeyDER) => {
     assert(Buffer.isBuffer(publicKeyDER));
-    assertApproximateSize(publicKeyDER, 74);
+    assertApproximateSize(publicKeyDER, isFips ? 270 : 74);
 
     assert(Buffer.isBuffer(privateKeyDER));
 
@@ -59,7 +62,7 @@ const {
       key: privateKeyDER,
       format: 'der',
       type: 'pkcs8',
-      passphrase: 'secret'
+      passphrase
     };
     testEncryptDecrypt(publicKey, privateKey);
     testSignVerify(publicKey, privateKey);
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
index c3b8ab6e8f50..081e709f46ec 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
@@ -12,10 +12,11 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testSignVerify,
   spkiExp,
   sec1EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 {
@@ -34,7 +35,12 @@ const {
       cipher: 'aes-128-cbc',
       passphrase: 'secret'
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3)) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(typeof publicKey, 'string');
     assert.match(publicKey, spkiExp);
     assert.strictEqual(typeof privateKey, 'string');
@@ -42,7 +48,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
index 0503ff74787f..84ea9d2f7a9a 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
@@ -9,10 +9,11 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testSignVerify,
   spkiExp,
   sec1EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 {
@@ -31,7 +32,12 @@ const {
       cipher: 'aes-128-cbc',
       passphrase: 'secret'
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3)) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(typeof publicKey, 'string');
     assert.match(publicKey, spkiExp);
     assert.strictEqual(typeof privateKey, 'string');
@@ -39,7 +45,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-rsa.js b/test/parallel/test-crypto-keygen-async-rsa.js
index c80d7d334929..7a372ded9fc5 100644
--- a/test/parallel/test-crypto-keygen-async-rsa.js
+++ b/test/parallel/test-crypto-keygen-async-rsa.js
@@ -10,17 +10,19 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
   pkcs1EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key.
 {
+  const isFips = hasFIPS(3);
   generateKeyPair('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'der'
@@ -31,7 +33,12 @@ const {
       cipher: 'aes-256-cbc',
       passphrase: 'secret'
     }
-  }, common.mustSucceed((publicKeyDER, privateKey) => {
+  }, common.mustCall((err, publicKeyDER, privateKey) => {
+    if (isFips) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    assert.ifError(err);
     assert(Buffer.isBuffer(publicKeyDER));
     assertApproximateSize(publicKeyDER, 74);
 
@@ -44,7 +51,7 @@ const {
       type: 'pkcs1',
       format: 'der',
     };
-    const expectedError = hasOpenSSL3 ? {
+    const expectedError = hasOpenSSL(3) ? {
       name: 'Error',
       message: 'error:07880109:common libcrypto routines::interrupted or ' +
                'cancelled'
diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js
index 13234589a5d6..52765f3d7fe7 100644
--- a/test/parallel/test-crypto-keygen-bit-length.js
+++ b/test/parallel/test-crypto-keygen-bit-length.js
@@ -12,7 +12,9 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
 
 // This tests check that generateKeyPair returns correct bit length in
 // KeyObject's asymmetricKeyDetails.
@@ -20,23 +22,38 @@ const { hasOpenSSL3 } = require('../common/crypto');
 {
   generateKeyPair('rsa', {
     modulusLength: 513,
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (fips3) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_RSA_INVALID_MODULUS');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 513);
     assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
   }));
 
   generateKeyPair('rsa-pss', {
     modulusLength: 513,
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (fips3) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_RSA_INVALID_MODULUS');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 513);
     assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
   }));
 
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     generateKeyPair('dsa', {
       modulusLength: 2049,
       divisorLength: 256,
-    }, common.mustSucceed((publicKey, privateKey) => {
+    }, common.mustCall((err, publicKey, privateKey) => {
+      if (fips3) {
+        assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS');
+        return;
+      }
+      assert.ifError(err);
       assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
       assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
     }));
diff --git a/test/parallel/test-crypto-keygen-dh-classic.js b/test/parallel/test-crypto-keygen-dh-classic.js
index 44af7730126a..13c5db2d0603 100644
--- a/test/parallel/test-crypto-keygen-dh-classic.js
+++ b/test/parallel/test-crypto-keygen-dh-classic.js
@@ -11,11 +11,12 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test classic Diffie-Hellman key generation.
 {
   generateKeyPair('dh', {
-    primeLength: 512
+    primeLength: hasFIPS(3) ? 2048 : 512
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dh');
diff --git a/test/parallel/test-crypto-keygen-eddsa.js b/test/parallel/test-crypto-keygen-eddsa.js
index 0a132235ea28..5dbdf9a7aeea 100644
--- a/test/parallel/test-crypto-keygen-eddsa.js
+++ b/test/parallel/test-crypto-keygen-eddsa.js
@@ -8,6 +8,8 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+const rejectsXCurves = hasFIPS(3, 5);
 
 // Test EdDSA key generation.
 {
@@ -16,7 +18,12 @@ const {
       common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
       continue;
     }
-    generateKeyPair(keyType, common.mustSucceed((publicKey, privateKey) => {
+    generateKeyPair(keyType, common.mustCall((err, publicKey, privateKey) => {
+      if (rejectsXCurves && keyType.startsWith('x')) {
+        assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+        return;
+      }
+      assert.ifError(err);
       assert.strictEqual(publicKey.type, 'public');
       assert.strictEqual(publicKey.asymmetricKeyType, keyType);
       assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {});
diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js
index 6c7938f99e1b..ae1ca23c29e8 100644
--- a/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js
+++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js
@@ -8,11 +8,14 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+
+const fips4 = hasFIPS(4);
 
 // Passing an empty passphrase string should not throw ERR_OSSL_CRYPTO_MALLOC_FAILURE even on OpenSSL 3.
 // Regression test for https://github.com/nodejs/node/issues/41428.
 generateKeyPair('rsa', {
-  modulusLength: 1024,
+  modulusLength: hasFIPS(3) ? 2048 : 1024,
   publicKeyEncoding: {
     type: 'spki',
     format: 'pem'
@@ -23,7 +26,12 @@ generateKeyPair('rsa', {
     cipher: 'aes-256-cbc',
     passphrase: ''
   }
-}, common.mustSucceed((publicKey, privateKey) => {
+}, common.mustCall((err, publicKey, privateKey) => {
+  if (fips4) {
+    assert.strictEqual(err?.code, 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK');
+    return;
+  }
+  assert.ifError(err);
   assert.strictEqual(typeof publicKey, 'string');
   assert.strictEqual(typeof privateKey, 'string');
 }));
diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
index cb873ff04748..ccf98bcd3766 100644
--- a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
+++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
@@ -10,23 +10,38 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testSignVerify,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
+const fips4 = hasFIPS(4);
+
 // Passing an empty passphrase string should not cause OpenSSL's default
 // passphrase prompt in the terminal.
 // See https://github.com/nodejs/node/issues/35898.
 for (const type of ['pkcs1', 'pkcs8']) {
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     privateKeyEncoding: {
       type,
       format: 'pem',
       cipher: 'aes-256-cbc',
       passphrase: ''
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3) && type === 'pkcs1') {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    if (fips4) {
+      assert.strictEqual(
+        err?.code,
+        'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+      );
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(publicKey.type, 'public');
 
     for (const passphrase of ['', Buffer.alloc(0)]) {
@@ -41,7 +56,7 @@ for (const type of ['pkcs1', 'pkcs8']) {
     // the key, and not specifying a passphrase should fail when decoding it.
     assert.throws(() => {
       return testSignVerify(publicKey, privateKey);
-    }, hasOpenSSL3 ? {
+    }, hasOpenSSL(3) ? {
       name: 'Error',
       code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
       message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
diff --git a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
index 9086e2e8a5f1..9d1fdf23bc0b 100644
--- a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
+++ b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
@@ -12,6 +12,9 @@ const assert = require('assert');
 const {
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
 
 // Test invalid parameter encoding.
 {
@@ -25,7 +28,8 @@ const {
     }
   }), {
     name: 'Error',
-    code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE',
-    message: 'Unsupported JWK Key Type.'
+    code: fips3 ? 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS' :
+      'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE',
+    ...!fips3 && { message: 'Unsupported JWK Key Type.' },
   });
 }
diff --git a/test/parallel/test-crypto-keygen-key-object-without-encoding.js b/test/parallel/test-crypto-keygen-key-object-without-encoding.js
index abcd282871b6..3c44d174df6f 100644
--- a/test/parallel/test-crypto-keygen-key-object-without-encoding.js
+++ b/test/parallel/test-crypto-keygen-key-object-without-encoding.js
@@ -9,6 +9,7 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
 } = require('../common/crypto');
@@ -17,7 +18,7 @@ const {
 {
   // If no publicKeyEncoding is specified, a key object should be returned.
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     privateKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
@@ -36,7 +37,7 @@ const {
 
   // If no privateKeyEncoding is specified, a key object should be returned.
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
diff --git a/test/parallel/test-crypto-keygen-key-objects.js b/test/parallel/test-crypto-keygen-key-objects.js
index a0f1bdf2bcb5..2d22e99360e3 100644
--- a/test/parallel/test-crypto-keygen-key-objects.js
+++ b/test/parallel/test-crypto-keygen-key-objects.js
@@ -8,18 +8,20 @@ const assert = require('assert');
 const {
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test sync key generation with key objects.
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 512
+    modulusLength
   });
 
   assert.strictEqual(typeof publicKey, 'object');
   assert.strictEqual(publicKey.type, 'public');
   assert.strictEqual(publicKey.asymmetricKeyType, 'rsa');
   assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-    modulusLength: 512,
+    modulusLength,
     publicExponent: 65537n
   });
 
@@ -27,7 +29,7 @@ const {
   assert.strictEqual(privateKey.type, 'private');
   assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
   assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-    modulusLength: 512,
+    modulusLength,
     publicExponent: 65537n
   });
 }
diff --git a/test/parallel/test-crypto-keygen-missing-oid.js b/test/parallel/test-crypto-keygen-missing-oid.js
index 1e4f309292eb..afe95dbee40f 100644
--- a/test/parallel/test-crypto-keygen-missing-oid.js
+++ b/test/parallel/test-crypto-keygen-missing-oid.js
@@ -11,7 +11,7 @@ const {
   getCurves,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 // This test creates EC key pairs on curves without associated OIDs.
 // Specifying a key encoding should not crash.
@@ -22,7 +22,8 @@ const { hasOpenSSL3 } = require('../common/crypto');
         continue;
 
       const expectedErrorCode =
-        hasOpenSSL3 ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
+        hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' :
+          hasOpenSSL(3) ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
       const params = {
         namedCurve,
         publicKeyEncoding: {
diff --git a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
index 559c6f0af051..778899972863 100644
--- a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
+++ b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
@@ -11,15 +11,17 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // 'rsa-pss' should not add a RSASSA-PSS-params sequence by default.
 // Regression test for: https://github.com/nodejs/node/issues/39936
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512
+    modulusLength
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n
     };
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, expectedKeyDetails);
@@ -30,6 +32,7 @@ const {
     // AlgorithmIdentifier member of the SubjectPublicKeyInfo has the expected
     // length of 11 bytes (as opposed to > 11 bytes if node added params).
     const spki = publicKey.export({ format: 'der', type: 'spki' });
-    assert.strictEqual(spki[3], 11, spki.toString('hex'));
+    assert.strictEqual(
+      spki[3], hasFIPS(3) ? 32 : 11, spki.toString('hex'));
   }));
 }
diff --git a/test/parallel/test-crypto-keygen-non-standard-public-exponent.js b/test/parallel/test-crypto-keygen-non-standard-public-exponent.js
index f54a9e8a6d9b..d6677683880e 100644
--- a/test/parallel/test-crypto-keygen-non-standard-public-exponent.js
+++ b/test/parallel/test-crypto-keygen-non-standard-public-exponent.js
@@ -8,28 +8,38 @@ const assert = require('assert');
 const {
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test sync key generation with key objects with a non-standard
 // publicExponent
 {
-  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    publicExponent: 3,
-    modulusLength: 512
-  });
+  if (hasFIPS(3)) {
+    assert.throws(() => generateKeyPairSync('rsa', {
+      publicExponent: 3,
+      modulusLength: 2048,
+    }), {
+      code: 'ERR_OSSL_RSA_PUB_EXPONENT_OUT_OF_RANGE',
+    });
+  } else {
+    const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+      publicExponent: 3,
+      modulusLength: 512
+    });
 
-  assert.strictEqual(typeof publicKey, 'object');
-  assert.strictEqual(publicKey.type, 'public');
-  assert.strictEqual(publicKey.asymmetricKeyType, 'rsa');
-  assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-    modulusLength: 512,
-    publicExponent: 3n
-  });
+    assert.strictEqual(typeof publicKey, 'object');
+    assert.strictEqual(publicKey.type, 'public');
+    assert.strictEqual(publicKey.asymmetricKeyType, 'rsa');
+    assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
+      modulusLength: 512,
+      publicExponent: 3n
+    });
 
-  assert.strictEqual(typeof privateKey, 'object');
-  assert.strictEqual(privateKey.type, 'private');
-  assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
-  assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-    modulusLength: 512,
-    publicExponent: 3n
-  });
+    assert.strictEqual(typeof privateKey, 'object');
+    assert.strictEqual(privateKey.type, 'private');
+    assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
+    assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
+      modulusLength: 512,
+      publicExponent: 3n
+    });
+  }
 }
diff --git a/test/parallel/test-crypto-keygen-promisify.js b/test/parallel/test-crypto-keygen-promisify.js
index cd6ca7d6e3e6..158367cef46b 100644
--- a/test/parallel/test-crypto-keygen-promisify.js
+++ b/test/parallel/test-crypto-keygen-promisify.js
@@ -10,6 +10,7 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
   pkcs1PubExp,
@@ -19,9 +20,10 @@ const { promisify } = require('util');
 
 // Test the util.promisified API with async RSA key generation.
 {
+  const isFips = hasFIPS(3);
   promisify(generateKeyPair)('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
@@ -34,11 +36,11 @@ const { promisify } = require('util');
     const { publicKey, privateKey } = keys;
     assert.strictEqual(typeof publicKey, 'string');
     assert.match(publicKey, pkcs1PubExp);
-    assertApproximateSize(publicKey, 180);
+    assertApproximateSize(publicKey, isFips ? 426 : 180);
 
     assert.strictEqual(typeof privateKey, 'string');
     assert.match(privateKey, pkcs1PrivExp);
-    assertApproximateSize(privateKey, 512);
+    assertApproximateSize(privateKey, isFips ? 1675 : 512);
 
     testEncryptDecrypt(publicKey, privateKey);
     testSignVerify(publicKey, privateKey);
diff --git a/test/parallel/test-crypto-keygen-raw.js b/test/parallel/test-crypto-keygen-raw.js
index e55c3f10eed8..41ef9362dcac 100644
--- a/test/parallel/test-crypto-keygen-raw.js
+++ b/test/parallel/test-crypto-keygen-raw.js
@@ -11,7 +11,9 @@ const {
   createPublicKey,
   createPrivateKey,
 } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+
+const rejectsXCurves = hasFIPS(3, 5);
 
 // Test generateKeyPairSync with raw encoding for EdDSA/ECDH key types.
 {
@@ -20,10 +22,17 @@ const { hasOpenSSL } = require('../common/crypto');
     types.push('ed448', 'x448');
   }
   for (const type of types) {
-    const { publicKey, privateKey } = generateKeyPairSync(type, {
+    const options = {
       publicKeyEncoding: { format: 'raw-public' },
       privateKeyEncoding: { format: 'raw-private' },
-    });
+    };
+    if (rejectsXCurves && type.startsWith('x')) {
+      assert.throws(() => generateKeyPairSync(type, options), {
+        code: 'ERR_OSSL_EVP_UNSUPPORTED',
+      });
+      continue;
+    }
+    const { publicKey, privateKey } = generateKeyPairSync(type, options);
 
     assert(Buffer.isBuffer(publicKey));
     assert(Buffer.isBuffer(privateKey));
@@ -54,13 +63,20 @@ const { hasOpenSSL } = require('../common/crypto');
     types.push('ed448', 'x448');
   }
   for (const type of types) {
-    generateKeyPair(type, {
+    const options = {
       publicKeyEncoding: { format: 'raw-public' },
       privateKeyEncoding: { format: 'raw-private' },
-    }, common.mustSucceed((publicKey, privateKey) => {
-      assert(Buffer.isBuffer(publicKey));
-      assert(Buffer.isBuffer(privateKey));
-    }));
+    };
+    generateKeyPair(type, options,
+                    common.mustCall((err, publicKey, privateKey) => {
+                      if (rejectsXCurves && type.startsWith('x')) {
+                        assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+                        return;
+                      }
+                      assert.ifError(err);
+                      assert(Buffer.isBuffer(publicKey));
+                      assert(Buffer.isBuffer(privateKey));
+                    }));
   }
 }
 
diff --git a/test/parallel/test-crypto-keygen-rfc8017-9-1.js b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
index fbefb1b4f642..3234084afe10 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-9-1.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
@@ -11,19 +11,20 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // RFC 8017, 9.1.: "Assuming that the mask generation function is based on a
 // hash function, it is RECOMMENDED that the hash function be the same as the
 // one that is applied to the message."
 {
-
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     hashAlgorithm: 'sha256',
     saltLength: 16
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
diff --git a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
index bc96d57ed0cd..f7cb70560e7e 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
@@ -11,16 +11,18 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // RFC 8017, A.2.3.: "For a given hashAlgorithm, the default value of
 // saltLength is the octet length of the hash value."
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     hashAlgorithm: 'sha512'
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha512',
       mgf1HashAlgorithm: 'sha512',
@@ -32,12 +34,12 @@ const {
 
   // It is still possible to explicitly set saltLength to 0.
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     hashAlgorithm: 'sha512',
     saltLength: 0
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha512',
       mgf1HashAlgorithm: 'sha512',
diff --git a/test/parallel/test-crypto-keygen-rsa-pss.js b/test/parallel/test-crypto-keygen-rsa-pss.js
index 3ce0d40e8d1b..88d522a223b9 100644
--- a/test/parallel/test-crypto-keygen-rsa-pss.js
+++ b/test/parallel/test-crypto-keygen-rsa-pss.js
@@ -13,14 +13,16 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
 } = require('../common/crypto');
 
 // Test RSA-PSS.
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     saltLength: 16,
     hashAlgorithm: 'sha256',
     mgf1HashAlgorithm: 'sha256'
@@ -28,7 +30,7 @@ const {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
@@ -38,7 +40,7 @@ const {
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
diff --git a/test/parallel/test-crypto-keygen-sync.js b/test/parallel/test-crypto-keygen-sync.js
index a100379e21f1..54a91fcfbcae 100644
--- a/test/parallel/test-crypto-keygen-sync.js
+++ b/test/parallel/test-crypto-keygen-sync.js
@@ -10,6 +10,7 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
   pkcs1PubExp,
@@ -19,9 +20,10 @@ const {
 // To make the test faster, we will only test sync key generation once and
 // with a relatively small key.
 {
+  const isFips = hasFIPS(3);
   const ret = generateKeyPairSync('rsa', {
-    publicExponent: 3,
-    modulusLength: 512,
+    publicExponent: isFips ? 0x10001 : 3,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
@@ -37,10 +39,10 @@ const {
 
   assert.strictEqual(typeof publicKey, 'string');
   assert.match(publicKey, pkcs1PubExp);
-  assertApproximateSize(publicKey, 162);
+  assertApproximateSize(publicKey, isFips ? 426 : 162);
   assert.strictEqual(typeof privateKey, 'string');
   assert.match(privateKey, pkcs8Exp);
-  assertApproximateSize(privateKey, 512);
+  assertApproximateSize(privateKey, isFips ? 1704 : 512);
 
   testEncryptDecrypt(publicKey, privateKey);
   testSignVerify(publicKey, privateKey);
diff --git a/test/parallel/test-crypto-keyobject-brand-check.js b/test/parallel/test-crypto-keyobject-brand-check.js
index ac0cf1b65f70..ed8e5bdae76e 100644
--- a/test/parallel/test-crypto-keyobject-brand-check.js
+++ b/test/parallel/test-crypto-keyobject-brand-check.js
@@ -15,6 +15,7 @@ const {
   generateKeyPairSync,
   KeyObject,
 } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 const { types: { isKeyObject } } = require('node:util');
 
 const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
@@ -25,7 +26,9 @@ function getter(proto, name) {
 
 {
   const secret = createSecretKey(Buffer.alloc(16));
-  const { publicKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
+  const { publicKey } = generateKeyPairSync('rsa', {
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
+  });
 
   const type = getter(KeyObject.prototype, 'type');
   const symmetricKeySize =
diff --git a/test/parallel/test-crypto-keyobject-clone-transfer.js b/test/parallel/test-crypto-keyobject-clone-transfer.js
index 1d68e4b9911a..6786df288589 100644
--- a/test/parallel/test-crypto-keyobject-clone-transfer.js
+++ b/test/parallel/test-crypto-keyobject-clone-transfer.js
@@ -16,6 +16,7 @@ const {
   sign,
   verify,
 } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 const { MessageChannel, Worker } = require('node:worker_threads');
 const { types: { isKeyObject } } = require('node:util');
 
@@ -85,7 +86,7 @@ function hmacDigest(key) {
 (async () => {
   const secret = createSecretKey(Buffer.alloc(16));
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
   });
 
   for (const key of [secret, publicKey, privateKey]) {
diff --git a/test/parallel/test-crypto-keyobject-hidden-slots.js b/test/parallel/test-crypto-keyobject-hidden-slots.js
index 1ea243ba0ab8..b3db2068541f 100644
--- a/test/parallel/test-crypto-keyobject-hidden-slots.js
+++ b/test/parallel/test-crypto-keyobject-hidden-slots.js
@@ -29,6 +29,7 @@ const {
   X509Certificate,
 } = require('node:crypto');
 const { readFileSync } = require('node:fs');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 function updateFinal(cipher, data = Buffer.alloc(16)) {
@@ -110,12 +111,13 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
 }
 
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 1024;
   const { publicKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength,
   });
 
   const details = publicKey.asymmetricKeyDetails;
-  assert.strictEqual(details.modulusLength, 1024);
+  assert.strictEqual(details.modulusLength, modulusLength);
   assert.strictEqual(details.publicExponent, 65537n);
 
   details.modulusLength = 1;
@@ -124,7 +126,7 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
 
   const freshDetails = publicKey.asymmetricKeyDetails;
   assert.notStrictEqual(freshDetails, details);
-  assert.strictEqual(freshDetails.modulusLength, 1024);
+  assert.strictEqual(freshDetails.modulusLength, modulusLength);
   assert.strictEqual(freshDetails.publicExponent, 65537n);
   assert.strictEqual(freshDetails.extra, undefined);
 }
@@ -150,7 +152,7 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
 
 {
   const { privateKey, publicKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
   });
   const originalType =
     Object.getOwnPropertyDescriptor(KeyObject.prototype, 'type');
@@ -175,8 +177,10 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
     verifier.update(data);
     assert.strictEqual(verifier.verify(publicKey, streamSignature), true);
 
-    const ciphertext = publicEncrypt(publicKey, data);
-    assert.deepStrictEqual(privateDecrypt(privateKey, ciphertext), data);
+    const options = hasFIPS(3) ? { oaepHash: 'sha256' } : {};
+    const ciphertext = publicEncrypt({ key: publicKey, ...options }, data);
+    assert.deepStrictEqual(
+      privateDecrypt({ key: privateKey, ...options }, ciphertext), data);
 
     assert.strictEqual(publicKey.equals(createPublicKey(privateKey)), true);
 
diff --git a/test/parallel/test-crypto-keyobject-no-own-symbols.js b/test/parallel/test-crypto-keyobject-no-own-symbols.js
index f1539c6a0f7a..945032446784 100644
--- a/test/parallel/test-crypto-keyobject-no-own-symbols.js
+++ b/test/parallel/test-crypto-keyobject-no-own-symbols.js
@@ -12,6 +12,7 @@ const {
   createSecretKey,
   generateKeyPairSync,
 } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 
 function assertNoOwnKeys(key) {
   assert.deepStrictEqual(Object.getOwnPropertySymbols(key), []);
@@ -22,7 +23,7 @@ function assertNoOwnKeys(key) {
 {
   const secret = createSecretKey(Buffer.alloc(16));
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
   });
 
   for (const key of [secret, publicKey, privateKey]) {
diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
index 78b73ed6c4e0..7cd1206f4f02 100644
--- a/test/parallel/test-crypto-pbkdf2.js
+++ b/test/parallel/test-crypto-pbkdf2.js
@@ -5,7 +5,16 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+const fips4 = hasFIPS(4);
+const validPassword = fips4 ? 'password' : 'pass';
+const validSalt = fips4 ? '0123456789abcdef' : 'salt';
+const validIterations = fips4 ? 1000 : 8;
+const validKeyLength = fips4 ? 16 : 8;
 
 function runPBKDF2(password, salt, iterations, keylen, hash) {
   const syncResult =
@@ -19,6 +28,25 @@ function runPBKDF2(password, salt, iterations, keylen, hash) {
   return syncResult;
 }
 
+function assertPBKDF2Fails(password, salt, iterations, keylen, hash) {
+  const expected = { message: 'PBKDF2 derivation failed' };
+  assert.throws(
+    () => crypto.pbkdf2Sync(password, salt, iterations, keylen, hash),
+    expected,
+  );
+  crypto.pbkdf2(
+    password,
+    salt,
+    iterations,
+    keylen,
+    hash,
+    common.mustCall((err, result) => {
+      assert.strictEqual(err?.message, expected.message);
+      assert.strictEqual(result, undefined);
+    }),
+  );
+}
+
 function testPBKDF2(password, salt, iterations, keylen, expected, encoding) {
   const actual = runPBKDF2(password, salt, iterations, keylen, 'sha256');
   assert.strictEqual(actual.toString(encoding || 'latin1'), expected);
@@ -28,36 +56,55 @@ function testPBKDF2(password, salt, iterations, keylen, expected, encoding) {
 // Test PBKDF2 with RFC 6070 test vectors (except #4)
 //
 
-testPBKDF2('password', 'salt', 1, 20,
-           '\x12\x0f\xb6\xcf\xfc\xf8\xb3\x2c\x43\xe7\x22\x52' +
-           '\x56\xc4\xf8\x37\xa8\x65\x48\xc9');
-
-testPBKDF2('password', 'salt', 2, 20,
-           '\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9' +
-           '\x28\xf0\x6d\xd0\x2a\x30\x3f\x8e');
-
-testPBKDF2('password', 'salt', 4096, 20,
-           '\xc5\xe4\x78\xd5\x92\x88\xc8\x41\xaa\x53\x0d\xb6' +
-           '\x84\x5c\x4c\x8d\x96\x28\x93\xa0');
-
-testPBKDF2('passwordPASSWORDpassword',
-           'saltSALTsaltSALTsaltSALTsaltSALTsalt',
-           4096,
-           25,
-           '\x34\x8c\x89\xdb\xcb\xd3\x2b\x2f\x32\xd8\x14\xb8\x11' +
-           '\x6e\x84\xcf\x2b\x17\x34\x7e\xbc\x18\x00\x18\x1c');
-
-testPBKDF2('pass\0word', 'sa\0lt', 4096, 16,
-           '\x89\xb6\x9d\x05\x16\xf8\x29\x89\x3c\x69\x62\x26\x65' +
-           '\x0a\x86\x87');
-
-testPBKDF2('password', 'salt', 32, 32,
-           '64c486c55d30d4c5a079b8823b7d7cb37ff0556f537da8410233bcec330ed956',
-           'hex');
+if (fips4) {
+  testPBKDF2(validPassword, validSalt, validIterations, 32,
+             '8514638175a45bc45eb1f22f04ff7d27' +
+             'f4f8be480498c455ff4b494ce8d1e7d2',
+             'hex');
+
+  for (const args of [
+    ['short', validSalt, validIterations],
+    [validPassword, 'short', validIterations],
+    [validPassword, validSalt, 999],
+  ]) {
+    assertPBKDF2Fails(...args, 32, 'sha256');
+  }
+  assertPBKDF2Fails(
+    validPassword, validSalt, validIterations, 8, 'sha256');
+} else {
+  testPBKDF2('password', 'salt', 1, 20,
+             '\x12\x0f\xb6\xcf\xfc\xf8\xb3\x2c\x43\xe7\x22\x52' +
+             '\x56\xc4\xf8\x37\xa8\x65\x48\xc9');
+
+  testPBKDF2('password', 'salt', 2, 20,
+             '\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9' +
+             '\x28\xf0\x6d\xd0\x2a\x30\x3f\x8e');
+
+  testPBKDF2('password', 'salt', 4096, 20,
+             '\xc5\xe4\x78\xd5\x92\x88\xc8\x41\xaa\x53\x0d\xb6' +
+             '\x84\x5c\x4c\x8d\x96\x28\x93\xa0');
+
+  testPBKDF2('passwordPASSWORDpassword',
+             'saltSALTsaltSALTsaltSALTsaltSALTsalt',
+             4096,
+             25,
+             '\x34\x8c\x89\xdb\xcb\xd3\x2b\x2f\x32\xd8\x14\xb8\x11' +
+             '\x6e\x84\xcf\x2b\x17\x34\x7e\xbc\x18\x00\x18\x1c');
+
+  testPBKDF2('pass\0word', 'sa\0lt', 4096, 16,
+             '\x89\xb6\x9d\x05\x16\xf8\x29\x89\x3c\x69\x62\x26\x65' +
+             '\x0a\x86\x87');
+
+  testPBKDF2('password', 'salt', 32, 32,
+             '64c486c55d30d4c5a079b8823b7d7cb3' +
+             '7ff0556f537da8410233bcec330ed956',
+             'hex');
+}
 
 // Error path should not leak memory (check with valgrind).
 assert.throws(
-  () => crypto.pbkdf2('password', 'salt', 1, 20, 'sha1'),
+  () => crypto.pbkdf2(
+    validPassword, validSalt, validIterations, 20, 'sha1'),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError'
@@ -66,7 +113,8 @@ assert.throws(
 
 for (const iterations of [-1, 0, 2147483648]) {
   assert.throws(
-    () => crypto.pbkdf2Sync('password', 'salt', iterations, 20, 'sha1'),
+    () => crypto.pbkdf2Sync(
+      validPassword, validSalt, iterations, 20, 'sha1'),
     {
       code: 'ERR_OUT_OF_RANGE',
       name: 'RangeError',
@@ -77,7 +125,8 @@ for (const iterations of [-1, 0, 2147483648]) {
 ['str', null, undefined, [], {}].forEach((notNumber) => {
   assert.throws(
     () => {
-      crypto.pbkdf2Sync('password', 'salt', 1, notNumber, 'sha256');
+      crypto.pbkdf2Sync(
+        validPassword, validSalt, validIterations, notNumber, 'sha256');
     }, {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -89,7 +138,7 @@ for (const iterations of [-1, 0, 2147483648]) {
 [Infinity, -Infinity, NaN].forEach((input) => {
   assert.throws(
     () => {
-      crypto.pbkdf2('password', 'salt', 1, input, 'sha256',
+      crypto.pbkdf2(validPassword, validSalt, validIterations, input, 'sha256',
                     common.mustNotCall());
     }, {
       code: 'ERR_OUT_OF_RANGE',
@@ -102,7 +151,7 @@ for (const iterations of [-1, 0, 2147483648]) {
 [-1, 2147483648, 4294967296].forEach((input) => {
   assert.throws(
     () => {
-      crypto.pbkdf2('password', 'salt', 1, input, 'sha256',
+      crypto.pbkdf2(validPassword, validSalt, validIterations, input, 'sha256',
                     common.mustNotCall());
     }, {
       code: 'ERR_OUT_OF_RANGE',
@@ -119,14 +168,16 @@ for (const iterations of [-1, 0, 2147483648]) {
   let posError;
   let posResult;
   try {
-    posResult = crypto.pbkdf2Sync('password', 'salt', 1, 0, 'sha256');
+    posResult = crypto.pbkdf2Sync(
+      validPassword, validSalt, validIterations, 0, 'sha256');
   } catch (err) {
     posError = err;
   }
   let negError;
   let negResult;
   try {
-    negResult = crypto.pbkdf2Sync('password', 'salt', 1, -0, 'sha256');
+    negResult = crypto.pbkdf2Sync(
+      validPassword, validSalt, validIterations, -0, 'sha256');
   } catch (err) {
     negError = err;
   }
@@ -136,15 +187,22 @@ for (const iterations of [-1, 0, 2147483648]) {
     assert.deepStrictEqual(negResult, posResult);
   }
 
-  crypto.pbkdf2('password', 'salt', 1, -0, 'sha256', common.mustCall());
+  crypto.pbkdf2(
+    validPassword, validSalt, validIterations, -0, 'sha256',
+    common.mustCall());
 }
 
 // Should not get FATAL ERROR with empty password and salt
 // https://github.com/nodejs/node/issues/8571
-crypto.pbkdf2('', '', 1, 32, 'sha256', common.mustSucceed());
+if (fips4) {
+  assertPBKDF2Fails('', '', 1, 32, 'sha256');
+} else {
+  crypto.pbkdf2('', '', 1, 32, 'sha256', common.mustSucceed());
+}
 
 assert.throws(
-  () => crypto.pbkdf2('password', 'salt', 8, 8, common.mustNotCall()),
+  () => crypto.pbkdf2(
+    validPassword, validSalt, validIterations, 8, common.mustNotCall()),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError',
@@ -153,7 +211,7 @@ assert.throws(
   });
 
 assert.throws(
-  () => crypto.pbkdf2Sync('password', 'salt', 8, 8),
+  () => crypto.pbkdf2Sync(validPassword, validSalt, validIterations, 8),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError',
@@ -162,7 +220,7 @@ assert.throws(
   });
 
 assert.throws(
-  () => crypto.pbkdf2Sync('password', 'salt', 8, 8, null),
+  () => crypto.pbkdf2Sync(validPassword, validSalt, validIterations, 8, null),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError',
@@ -171,7 +229,8 @@ assert.throws(
   });
 [1, {}, [], true, undefined, null].forEach((input) => {
   assert.throws(
-    () => crypto.pbkdf2(input, 'salt', 8, 8, 'sha256', common.mustNotCall()),
+    () => crypto.pbkdf2(
+      input, validSalt, validIterations, 8, 'sha256', common.mustNotCall()),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -179,7 +238,9 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2('pass', input, 8, 8, 'sha256', common.mustNotCall()),
+    () => crypto.pbkdf2(
+      validPassword, input, validIterations, 8, 'sha256',
+      common.mustNotCall()),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -187,7 +248,8 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2Sync(input, 'salt', 8, 8, 'sha256'),
+    () => crypto.pbkdf2Sync(
+      input, validSalt, validIterations, 8, 'sha256'),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -195,7 +257,8 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2Sync('pass', input, 8, 8, 'sha256'),
+    () => crypto.pbkdf2Sync(
+      validPassword, input, validIterations, 8, 'sha256'),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -206,7 +269,8 @@ assert.throws(
 ['test', {}, [], true, undefined, null].forEach((i) => {
   const received = common.invalidArgTypeHelper(i);
   assert.throws(
-    () => crypto.pbkdf2('pass', 'salt', i, 8, 'sha256', common.mustNotCall()),
+    () => crypto.pbkdf2(
+      validPassword, validSalt, i, 8, 'sha256', common.mustNotCall()),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -215,7 +279,7 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2Sync('pass', 'salt', i, 8, 'sha256'),
+    () => crypto.pbkdf2Sync(validPassword, validSalt, i, 8, 'sha256'),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -224,15 +288,32 @@ assert.throws(
   );
 });
 
+if (fips4) {
+  assertPBKDF2Fails(
+    new Uint8Array(1), validSalt, validIterations, validKeyLength, 'sha256');
+  assertPBKDF2Fails(
+    validPassword, new Uint8Array(1), validIterations, validKeyLength,
+    'sha256');
+}
+
 // Any TypedArray should work for password and salt.
 for (const SomeArray of [Uint8Array, Uint16Array, Uint32Array, Float32Array,
                          Float64Array, ArrayBuffer, SharedArrayBuffer]) {
-  runPBKDF2(new SomeArray(10), 'salt', 8, 8, 'sha256');
-  runPBKDF2('pass', new SomeArray(10), 8, 8, 'sha256');
+  const length = fips4 ? 16 : 10;
+  const input = new SomeArray(length);
+  const bytes = ArrayBuffer.isView(input) ?
+    new Uint8Array(input.buffer, input.byteOffset, input.byteLength) :
+    new Uint8Array(input);
+  for (let index = 0; index < bytes.length; index++)
+    bytes[index] = index + 1;
+  runPBKDF2(input, validSalt, validIterations, validKeyLength, 'sha256');
+  runPBKDF2(validPassword, input, validIterations, validKeyLength, 'sha256');
 }
 
 assert.throws(
-  () => crypto.pbkdf2('pass', 'salt', 8, 8, 'md55', common.mustNotCall()),
+  () => crypto.pbkdf2(
+    validPassword, validSalt, validIterations, 8, 'md55',
+    common.mustNotCall()),
   {
     code: 'ERR_CRYPTO_INVALID_DIGEST',
     name: 'TypeError',
@@ -241,7 +322,8 @@ assert.throws(
 );
 
 assert.throws(
-  () => crypto.pbkdf2Sync('pass', 'salt', 8, 8, 'md55'),
+  () => crypto.pbkdf2Sync(
+    validPassword, validSalt, validIterations, 8, 'md55'),
   {
     code: 'ERR_CRYPTO_INVALID_DIGEST',
     name: 'TypeError',
@@ -249,7 +331,7 @@ assert.throws(
   }
 );
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   const kNotPBKDF2Supported = ['shake128', 'shake256'];
   crypto.getHashes()
     .filter((hash) => !kNotPBKDF2Supported.includes(hash))
@@ -261,7 +343,8 @@ if (!hasOpenSSL3) {
 {
   // This should not crash.
   assert.throws(
-    () => crypto.pbkdf2Sync('1', '2', 1, 1, '%'),
+    () => crypto.pbkdf2Sync(
+      validPassword, validSalt, validIterations, 1, '%'),
     {
       code: 'ERR_CRYPTO_INVALID_DIGEST',
       name: 'TypeError',
diff --git a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
index b4a1b586d21d..8f2a10725c94 100644
--- a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
+++ b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
@@ -30,19 +30,32 @@ if (process.features.openssl_is_boringssl) {
 // ciphers like RC2, the optional PBKDF2 keyLength INTEGER branch in
 // the EncryptedPrivateKeyInfo parser.
 const availableCiphers = new Set(getCiphers());
+const passphrase = 'top secret';
 const ciphers = [
   'aes-128-cbc', 'aes-192-cbc', 'aes-256-cbc',
   'des-ede3-cbc', 'rc2-cbc',
-].filter((c) => availableCiphers.has(c));
+].filter((cipher) => availableCiphers.has(cipher) &&
+                       (!hasFIPS(3) || cipher !== 'rc2-cbc'));
+
+if (hasFIPS(3)) {
+  const { privateKey } = generateKeyPairSync('ml-dsa-44');
+  assert.throws(() => privateKey.export({
+    type: 'pkcs8',
+    format: 'der',
+    cipher: 'rc2-cbc',
+    passphrase,
+  }), { code: 'ERR_OSSL_EVP_UNSUPPORTED' });
+}
 
-const passphrase = 'top secret';
+const wrongPassphrase = 'wrong password';
 const wrongPassphraseError =
   /bad decrypt|DECRYPTION_FAILED|BAD_DECRYPT|bad password|DECODE[ _]ERROR/i;
 // A wrong passphrase usually fails during cipher finalization, but CBC output
 // can have valid padding by chance. OpenSSL then parses the bad plaintext as
 // PKCS#8 and may report ASN.1 or decoder errors from the same failed import.
 function assertWrongPassphrase(fn) {
-  assert.throws(fn, (err) => wrongPassphraseError.test(err.message) ||
+  assert.throws(fn, (err) => err.code === 'ERR_OSSL_BAD_DECRYPT' ||
+                            wrongPassphraseError.test(err.message) ||
                             err.code?.startsWith('ERR_OSSL_ASN1_') ||
                             err.code === 'ERR_OSSL_UNSUPPORTED');
 }
@@ -79,7 +92,7 @@ for (const asymmetricKeyType of algorithms) {
         key: encrypted,
         format,
         type: 'pkcs8',
-        passphrase: 'wrong',
+        passphrase: wrongPassphrase,
       }));
     }
   }
@@ -128,7 +141,7 @@ for (const { alg, jwkFile, encBase } of fixtureCases) {
       key: encryptedFixture,
       format,
       type: 'pkcs8',
-      passphrase: 'wrong',
+      passphrase: wrongPassphrase,
     }));
   }
 }
diff --git a/test/parallel/test-crypto-private-decrypt-gh32240.js b/test/parallel/test-crypto-private-decrypt-gh32240.js
index 1ff5b565d6d5..a38fcba6775e 100644
--- a/test/parallel/test-crypto-private-decrypt-gh32240.js
+++ b/test/parallel/test-crypto-private-decrypt-gh32240.js
@@ -14,29 +14,57 @@ const {
   privateDecrypt,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
 
-const pair = generateKeyPairSync('rsa', { modulusLength: 512 });
+const fips3 = hasFIPS(3);
+const fips4 = hasFIPS(4);
+const pair = generateKeyPairSync('rsa', {
+  modulusLength: fips3 ? 2048 : 512,
+});
 
 const expected = Buffer.from('shibboleth');
-const encrypted = publicEncrypt(pair.publicKey, expected);
+const options = fips3 ? { oaepHash: 'sha256' } : {};
+const encrypted = publicEncrypt({ key: pair.publicKey, ...options }, expected);
 
 const pkey = pair.privateKey.export({ type: 'pkcs1', format: 'pem' });
-const pkeyEncrypted =
-  pair.privateKey.export({
+if (fips3) {
+  assert.throws(() => pair.privateKey.export({
     type: 'pkcs1',
     format: 'pem',
     cipher: 'aes-128-cbc',
     passphrase: 'secret',
+  }), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+}
+if (fips4) {
+  assert.throws(() => pair.privateKey.export({
+    type: 'pkcs8',
+    format: 'pem',
+    cipher: 'aes-256-cbc',
+    passphrase: 'secret',
+  }), {
+    code: 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+  });
+}
+const pkeyEncrypted =
+  pair.privateKey.export({
+    type: fips3 ? 'pkcs8' : 'pkcs1',
+    format: 'pem',
+    cipher: fips3 ? 'aes-256-cbc' : 'aes-128-cbc',
+    passphrase: 'password',
   });
 
 function decrypt(key) {
-  const decrypted = privateDecrypt(key, encrypted);
+  const decrypted = privateDecrypt({ key, ...options }, encrypted);
   assert.deepStrictEqual(decrypted, expected);
 }
 
 decrypt(pkey);
-assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL3 ?
+assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL(3) ?
   { message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled' } :
   { code: 'ERR_MISSING_PASSPHRASE' });
diff --git a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
index 1d64e08920c6..21cc5f3ebce2 100644
--- a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
+++ b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
@@ -7,15 +7,17 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
 }
 
 const assert = require('assert');
 const crypto = require('crypto');
 
+const passphrase = 'password';
+
 const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
   modulusLength: 2048,
   publicKeyEncoding: {
@@ -26,7 +28,7 @@ const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
     type: 'pkcs8',
     format: 'pem',
     cipher: 'aes-128-ecb',
-    passphrase: 'abcdef'
+    passphrase
   }
 });
 assert.notStrictEqual(privateKey.toString(), '');
@@ -35,7 +37,7 @@ const msg = 'The quick brown fox jumps over the lazy dog';
 
 const encryptedString = crypto.privateEncrypt({
   key: privateKey,
-  passphrase: 'abcdef'
+  passphrase
 }, Buffer.from(msg)).toString('base64');
 const decryptedString = crypto.publicDecrypt(publicKey, Buffer.from(encryptedString, 'base64')).toString();
 console.log(`Encrypted: ${encryptedString}`);
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
index 35ad67302077..bda98652cf59 100644
--- a/test/parallel/test-crypto-rsa-dsa.js
+++ b/test/parallel/test-crypto-rsa-dsa.js
@@ -9,7 +9,16 @@ const crypto = require('crypto');
 const constants = crypto.constants;
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips30 = fips3 && !fips35;
+const fips4 = hasFIPS(4);
+const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
+const wrongPassphrase = 'wrong-password';
 
 // Test certificates
 const certPem = fixtures.readKey('rsa_cert.crt');
@@ -17,17 +26,42 @@ const keyPem = fixtures.readKey('rsa_private.pem');
 const rsaKeySize = 2048;
 const rsaPubPem = fixtures.readKey('rsa_public.pem', 'ascii');
 const rsaKeyPem = fixtures.readKey('rsa_private.pem', 'ascii');
-const rsaKeyPemEncrypted = fixtures.readKey('rsa_private_encrypted.pem',
-                                            'ascii');
+const rsaKeyPemEncryptedLegacy = fixtures.readKey(
+  'rsa_private_encrypted.pem', 'ascii');
+const rsaKeyPemEncrypted = fips3 ?
+  crypto.createPrivateKey(rsaKeyPem).export({
+    type: 'pkcs8',
+    format: 'pem',
+    cipher: 'aes-256-cbc',
+    passphrase: 'password',
+  }) : rsaKeyPemEncryptedLegacy;
 const dsaPubPem = fixtures.readKey('dsa_public.pem', 'ascii');
 const dsaKeyPem = fixtures.readKey('dsa_private.pem', 'ascii');
-const dsaKeyPemEncrypted = fixtures.readKey('dsa_private_encrypted.pem',
-                                            'ascii');
+const dsaKeyPemEncryptedLegacy = fixtures.readKey(
+  'dsa_private_encrypted.pem', 'ascii');
+const dsaKeyPemEncrypted = fips3 ?
+  crypto.createPrivateKey(dsaKeyPem).export({
+    type: 'pkcs8',
+    format: 'pem',
+    cipher: 'aes-256-cbc',
+    passphrase: 'password',
+  }) : dsaKeyPemEncryptedLegacy;
 const rsaPkcs8KeyPem = fixtures.readKey('rsa_private_pkcs8.pem');
 const dsaPkcs8KeyPem = fixtures.readKey('dsa_private_pkcs8.pem');
 
 const ec = new TextEncoder();
 
+if (fips3) {
+  for (const key of [rsaKeyPemEncryptedLegacy, dsaKeyPemEncryptedLegacy]) {
+    assert.throws(() => crypto.createPrivateKey({
+      key,
+      passphrase: 'password',
+    }), {
+      code: 'ERR_OSSL_EVP_UNSUPPORTED',
+    });
+  }
+}
+
 const openssl1DecryptError = {
   message: 'error:06065064:digital envelope routines:EVP_DecryptFinal_ex:' +
     'bad decrypt',
@@ -37,18 +71,21 @@ const openssl1DecryptError = {
   library: 'digital envelope routines',
 };
 
-const decryptError = hasOpenSSL3 ?
-  { message: 'error:1C800064:Provider routines::bad decrypt' } :
-  process.features.openssl_is_boringssl ? {
-    message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
-    code: 'ERR_OSSL_BAD_DECRYPT',
-    reason: 'BAD_DECRYPT',
-    function: 'OPENSSL_internal',
-    library: 'Cipher functions',
-  } :
-    openssl1DecryptError;
-
-const decryptPrivateKeyError = hasOpenSSL3 ? {
+const decryptError = fips4 ?
+  { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
+    { message: 'error:1C800064:Provider routines::bad decrypt' } :
+    process.features.openssl_is_boringssl ? {
+      message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
+      code: 'ERR_OSSL_BAD_DECRYPT',
+      reason: 'BAD_DECRYPT',
+      function: 'OPENSSL_internal',
+      library: 'Cipher functions',
+    } :
+      openssl1DecryptError;
+
+const decryptPrivateKeyError = fips4 ? {
+  code: 'ERR_OSSL_BAD_DECRYPT',
+} : hasOpenSSL(3) ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
 } : process.features.openssl_is_boringssl ? {
   message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
@@ -156,7 +193,7 @@ function getBufferCopy(buf) {
   // Now with RSA_NO_PADDING. Plaintext needs to match key size.
   // OpenSSL 3.x has a rsa_check_padding that will cause an error if
   // RSA_NO_PADDING is used.
-  if (!hasOpenSSL3) {
+  if (!hasOpenSSL(3)) {
     {
       const plaintext = 'x'.repeat(rsaKeySize / 8);
       encryptedBuffer = crypto.privateEncrypt({
@@ -192,14 +229,14 @@ function getBufferCopy(buf) {
   assert.throws(() => {
     crypto.privateDecrypt({
       key: rsaKeyPemEncrypted,
-      passphrase: 'wrong'
+      passphrase: wrongPassphrase
     }, bufferToEncrypt);
   }, decryptError);
 
   assert.throws(() => {
     crypto.publicEncrypt({
       key: rsaKeyPemEncrypted,
-      passphrase: 'wrong'
+      passphrase: wrongPassphrase
     }, encryptedBuffer);
   }, decryptError);
 
@@ -211,7 +248,7 @@ function getBufferCopy(buf) {
   assert.throws(() => {
     crypto.publicDecrypt({
       key: rsaKeyPemEncrypted,
-      passphrase: Buffer.from('wrong')
+      passphrase: Buffer.from(wrongPassphrase)
     }, encryptedBuffer);
   }, decryptError);
 }
@@ -349,8 +386,12 @@ test_rsa('RSA_PKCS1_OAEP_PADDING', 'sha256', 'sha256');
 test_rsa('RSA_PKCS1_OAEP_PADDING', 'sha512', 'sha512');
 assert.throws(() => {
   test_rsa('RSA_PKCS1_OAEP_PADDING', 'sha256', 'sha512');
-}, {
-  code: 'ERR_OSSL_RSA_OAEP_DECODING_ERROR'
+}, fips35 ? {
+  code: 'ERR_OSSL_EVP_PROVIDER_ASYM_CIPHER_FAILURE',
+} : fips3 ? {
+  message: 'error:00000000:lib(0)::reason(0)',
+} : {
+  code: 'ERR_OSSL_RSA_OAEP_DECODING_ERROR',
 });
 
 // The following RSA-OAEP test cases were created using the WebCrypto API to
@@ -416,8 +457,9 @@ for (const fn of [crypto.publicEncrypt, crypto.privateDecrypt]) {
 }
 
 // Test RSA key signing/verification
-let rsaSign = crypto.createSign('SHA1');
-let rsaVerify = crypto.createVerify('SHA1');
+const rsaDigest = fips3 ? 'SHA256' : 'SHA1';
+let rsaSign = crypto.createSign(rsaDigest);
+let rsaVerify = crypto.createVerify(rsaDigest);
 assert.ok(rsaSign);
 assert.ok(rsaVerify);
 
@@ -428,36 +470,39 @@ const expectedSignature = fixtures.readKey(
 
 rsaSign.update(rsaPubPem);
 let rsaSignature = rsaSign.sign(rsaKeyPem, 'hex');
-assert.strictEqual(rsaSignature, expectedSignature);
+if (!fips3)
+  assert.strictEqual(rsaSignature, expectedSignature);
 
 rsaVerify.update(rsaPubPem);
 assert.strictEqual(rsaVerify.verify(rsaPubPem, rsaSignature, 'hex'), true);
 
 // Test RSA PKCS#8 key signing/verification
-rsaSign = crypto.createSign('SHA1');
+rsaSign = crypto.createSign(rsaDigest);
 rsaSign.update(rsaPubPem);
 rsaSignature = rsaSign.sign(rsaPkcs8KeyPem, 'hex');
-assert.strictEqual(rsaSignature, expectedSignature);
+if (!fips3)
+  assert.strictEqual(rsaSignature, expectedSignature);
 
-rsaVerify = crypto.createVerify('SHA1');
+rsaVerify = crypto.createVerify(rsaDigest);
 rsaVerify.update(rsaPubPem);
 assert.strictEqual(rsaVerify.verify(rsaPubPem, rsaSignature, 'hex'), true);
 
 // Test RSA key signing/verification with encrypted key
-rsaSign = crypto.createSign('SHA1');
+rsaSign = crypto.createSign(rsaDigest);
 rsaSign.update(rsaPubPem);
 const signOptions = { key: rsaKeyPemEncrypted, passphrase: 'password' };
 rsaSignature = rsaSign.sign(signOptions, 'hex');
-assert.strictEqual(rsaSignature, expectedSignature);
+if (!fips3)
+  assert.strictEqual(rsaSignature, expectedSignature);
 
-rsaVerify = crypto.createVerify('SHA1');
+rsaVerify = crypto.createVerify(rsaDigest);
 rsaVerify.update(rsaPubPem);
 assert.strictEqual(rsaVerify.verify(rsaPubPem, rsaSignature, 'hex'), true);
 
-rsaSign = crypto.createSign('SHA1');
+rsaSign = crypto.createSign(rsaDigest);
 rsaSign.update(rsaPubPem);
 assert.throws(() => {
-  const signOptions = { key: rsaKeyPemEncrypted, passphrase: 'wrong' };
+  const signOptions = { key: rsaKeyPemEncrypted, passphrase: wrongPassphrase };
   rsaSign.sign(signOptions, 'hex');
 }, decryptPrivateKeyError);
 
@@ -508,11 +553,12 @@ if (!process.features.openssl_is_boringssl) {
 
   // DSA signatures vary across runs so there is no static string to verify
   // against.
-  const sign = crypto.createSign('SHA1');
+  const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
+  const sign = crypto.createSign(dsaDigest);
   sign.update(input);
   const signature = sign.sign(dsaKeyPem, 'hex');
 
-  const verify = crypto.createVerify('SHA1');
+  const verify = crypto.createVerify(dsaDigest);
   verify.update(input);
 
   assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
@@ -520,12 +566,18 @@ if (!process.features.openssl_is_boringssl) {
   // Test the legacy 'DSS1' name.
   const sign2 = crypto.createSign('DSS1');
   sign2.update(input);
-  const signature2 = sign2.sign(dsaKeyPem, 'hex');
+  if (fips30) {
+    assert.throws(() => sign2.sign(dsaKeyPem, 'hex'), {
+      code: fipsDigestErrorCode,
+    });
+  } else {
+    const signature2 = sign2.sign(dsaKeyPem, 'hex');
 
-  const verify2 = crypto.createVerify('DSS1');
-  verify2.update(input);
+    const verify2 = crypto.createVerify('DSS1');
+    verify2.update(input);
 
-  assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true);
+    assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true);
+  }
 } else {
   common.printSkipMessage('Skipping unsupported DSA test case');
 }
@@ -539,11 +591,12 @@ if (!process.features.openssl_is_boringssl) {
 
   // DSA signatures vary across runs so there is no static string to verify
   // against.
-  const sign = crypto.createSign('SHA1');
+  const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
+  const sign = crypto.createSign(dsaDigest);
   sign.update(input);
   const signature = sign.sign(dsaPkcs8KeyPem, 'hex');
 
-  const verify = crypto.createVerify('SHA1');
+  const verify = crypto.createVerify(dsaDigest);
   verify.update(input);
 
   assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
@@ -558,22 +611,23 @@ if (!process.features.openssl_is_boringssl) {
 const input = 'I AM THE WALRUS';
 
 {
-  const sign = crypto.createSign('SHA1');
+  const sign = crypto.createSign(fips3 ? 'SHA256' : 'SHA1');
   sign.update(input);
   assert.throws(() => {
-    sign.sign({ key: dsaKeyPemEncrypted, passphrase: 'wrong' }, 'hex');
+    sign.sign({ key: dsaKeyPemEncrypted, passphrase: wrongPassphrase }, 'hex');
   }, decryptPrivateKeyError);
 }
 
 if (!process.features.openssl_is_boringssl) {
   // DSA signatures vary across runs so there is no static string to verify
   // against.
-  const sign = crypto.createSign('SHA1');
+  const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
+  const sign = crypto.createSign(dsaDigest);
   sign.update(input);
   const signOptions = { key: dsaKeyPemEncrypted, passphrase: 'password' };
   const signature = sign.sign(signOptions, 'hex');
 
-  const verify = crypto.createVerify('SHA1');
+  const verify = crypto.createVerify(dsaDigest);
   verify.update(input);
 
   assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
diff --git a/test/parallel/test-crypto-scrypt.js b/test/parallel/test-crypto-scrypt.js
index 421ee4ce8f34..3012a8fa55d5 100644
--- a/test/parallel/test-crypto-scrypt.js
+++ b/test/parallel/test-crypto-scrypt.js
@@ -5,6 +5,8 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+const isFips = hasFIPS(3);
 
 if (typeof crypto.scrypt !== 'function' || typeof crypto.scryptSync !== 'function')
   common.skip('no scrypt support');
@@ -159,13 +161,20 @@ const badargs = [
   },
 ];
 
-for (const options of good) {
-  const { pass, salt, keylen, expected } = options;
-  const actual = crypto.scryptSync(pass, salt, keylen, options);
-  assert.strictEqual(actual.toString('hex'), expected);
-  crypto.scrypt(pass, salt, keylen, options, common.mustSucceed((actual) => {
+if (isFips) {
+  const expected = { code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS' };
+  assert.throws(() => crypto.scryptSync('pass', 'salt', 1), expected);
+  assert.throws(
+    () => crypto.scrypt('pass', 'salt', 1, () => {}), expected);
+} else {
+  for (const options of good) {
+    const { pass, salt, keylen, expected } = options;
+    const actual = crypto.scryptSync(pass, salt, keylen, options);
     assert.strictEqual(actual.toString('hex'), expected);
-  }));
+    crypto.scrypt(pass, salt, keylen, options, common.mustSucceed((actual) => {
+      assert.strictEqual(actual.toString('hex'), expected);
+    }));
+  }
 }
 
 for (const options of bad) {
@@ -191,7 +200,9 @@ for (const options of incompatibleOptions) {
 }
 
 for (const options of toobig) {
-  const expected = {
+  const expected = isFips ? {
+    code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS',
+  } : {
     message: process.features.openssl_is_boringssl ?
       /Invalid scrypt params:.*(INVALID_PARAMETERS|MEMORY_LIMIT_EXCEEDED)/ :
       /Invalid scrypt params:.*memory limit exceeded/,
@@ -203,7 +214,7 @@ for (const options of toobig) {
                 expected);
 }
 
-{
+if (!isFips) {
   const defaults = { N: 16384, p: 1, r: 8 };
   const expected = crypto.scryptSync('pass', 'salt', 1, defaults);
   const actual = crypto.scryptSync('pass', 'salt', 1);
@@ -229,10 +240,12 @@ for (const { args, expected } of badargs) {
 {
   // Values for maxmem that do not fit in 32 bits but that are still safe
   // integers should be allowed.
-  crypto.scrypt('', '', 4, { maxmem: 2 ** 52 },
-                common.mustSucceed((actual) => {
-                  assert.strictEqual(actual.toString('hex'), 'd72c87d0');
-                }));
+  if (!isFips) {
+    crypto.scrypt('', '', 4, { maxmem: 2 ** 52 },
+                  common.mustSucceed((actual) => {
+                    assert.strictEqual(actual.toString('hex'), 'd72c87d0');
+                  }));
+  }
 
   // Values that exceed Number.isSafeInteger should not be allowed.
   assert.throws(() => crypto.scryptSync('', '', 0, { maxmem: 2 ** 53 }), {
@@ -240,7 +253,7 @@ for (const { args, expected } of badargs) {
   });
 }
 
-{
+if (!isFips) {
   // Regression test for https://github.com/nodejs/node/issues/28836.
 
   function testParameter(name, value) {
@@ -299,5 +312,11 @@ for (const { args, expected } of badargs) {
     assert.deepStrictEqual(negResult, posResult);
   }
 
-  crypto.scrypt('', '', -0, common.mustCall());
+  if (isFips) {
+    assert.throws(
+      () => crypto.scrypt('', '', -0, () => {}),
+      { code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS' });
+  } else {
+    crypto.scrypt('', '', -0, common.mustCall());
+  }
 }
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index 3845f49a4748..8bd93c5281da 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -20,7 +20,7 @@ if (process.features.openssl_is_boringssl) {
 const assert = require('assert');
 const { fork } = require('child_process');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const {
   secureHeapUsed,
   createDiffieHellman,
@@ -38,7 +38,8 @@ if (process.argv[2] === 'child') {
   assert.strictEqual(a.used, 0);
 
   {
-    const size = getFips() || hasOpenSSL3 ? 1024 : 256;
+    const size = hasFIPS(3) ?
+      2048 : (getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
     const dh1 = createDiffieHellman(size);
     const p1 = dh1.getPrime('buffer');
     const dh2 = createDiffieHellman(p1, 'buffer');
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
index 527c39b30786..e8398c21bafd 100644
--- a/test/parallel/test-crypto-sign-verify.js
+++ b/test/parallel/test-crypto-sign-verify.js
@@ -10,6 +10,7 @@ const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 const {
   hasOpenSSL,
+  hasFIPS,
   opensslCli,
 } = require('../common/crypto');
 
@@ -17,6 +18,17 @@ const {
 const certPem = fixtures.readKey('rsa_cert.crt');
 const keyPem = fixtures.readKey('rsa_private.pem');
 const keySize = 2048;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips30 = fips3 && !fips35;
+const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
+const signingHash = fips3 ? 'SHA256' : 'SHA1';
+
+if (fips30) {
+  assert.throws(
+    () => crypto.createSign('SHA1').update('Test123').sign(keyPem),
+    { code: fipsDigestErrorCode });
+}
 
 {
   const Sign = crypto.Sign;
@@ -60,7 +72,7 @@ const keySize = 2048;
   Object.defineProperty(Object.prototype, 'opensslErrorStack', errorStack);
 
   assert.throws(() => {
-    crypto.createSign('SHA1')
+    crypto.createSign('SHA256')
       .update('Test123')
       .sign({
         key: keyPem,
@@ -99,15 +111,15 @@ assert.throws(
 
 // Test signing and verifying
 {
-  const s1 = crypto.createSign('SHA1')
+  const s1 = crypto.createSign(signingHash)
                    .update('Test123')
                    .sign(keyPem, 'base64');
-  let s1stream = crypto.createSign('SHA1');
+  let s1stream = crypto.createSign(signingHash);
   s1stream.end('Test123');
   s1stream = s1stream.sign(keyPem, 'base64');
   assert.strictEqual(s1, s1stream, `${s1} should equal ${s1stream}`);
 
-  const verified = crypto.createVerify('SHA1')
+  const verified = crypto.createVerify(signingHash)
                          .update('Test')
                          .update('123')
                          .verify(certPem, s1, 'base64');
@@ -138,16 +150,16 @@ assert.throws(
 }
 
 {
-  const s3 = crypto.createSign('SHA1')
+  const s3 = crypto.createSign(signingHash)
                    .update('Test123')
                    .sign(keyPem, 'buffer');
-  let verified = crypto.createVerify('SHA1')
+  let verified = crypto.createVerify(signingHash)
                        .update('Test')
                        .update('123')
                        .verify(certPem, s3);
   assert.strictEqual(verified, true);
 
-  const verStream = crypto.createVerify('SHA1');
+  const verStream = crypto.createVerify(signingHash);
   verStream.write('Tes');
   verStream.write('t12');
   verStream.end('3');
@@ -190,6 +202,17 @@ assert.throws(
 
     const data = Buffer.from('Test123');
 
+    if (fips30) {
+      const streamOptions = {
+        key: keyPem,
+        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST,
+      };
+      assert.throws(
+        () => crypto.createSign(algo).update(data).sign(streamOptions),
+        { code: fipsDigestErrorCode });
+    }
+
     signSaltLengths.forEach((signSaltLength) => {
       if (signSaltLength > max) {
         // If the salt length is too big, an Error should be thrown
@@ -211,20 +234,23 @@ assert.throws(
         }, errMessage);
       } else {
         // Otherwise, a valid signature should be generated
-        const s4 = crypto.createSign(algo)
-                         .update(data)
-                         .sign({
-                           key: keyPem,
-                           padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
-                           saltLength: signSaltLength
-                         });
         const s4_2 = crypto.sign(algo, data, {
           key: keyPem,
           padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
           saltLength: signSaltLength
         });
+        const signatures = [s4_2];
+        if (!fips30) {
+          signatures.unshift(crypto.createSign(algo)
+            .update(data)
+            .sign({
+              key: keyPem,
+              padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+              saltLength: signSaltLength
+            }));
+        }
 
-        [s4, s4_2].forEach((sig) => {
+        signatures.forEach((sig) => {
           let verified;
           verifySaltLengths.forEach((verifySaltLength) => {
             // Verification should succeed if and only if the salt length is
@@ -281,7 +307,8 @@ assert.throws(
     });
   }
 
-  testPSS('SHA1', 20);
+  if (!fips30)
+    testPSS('SHA1', 20);
   testPSS('SHA256', 32);
 }
 
@@ -340,7 +367,7 @@ assert.throws(
     });
 
   assert.throws(() => {
-    crypto.createSign('SHA1')
+    crypto.createSign('SHA256')
       .update('Test123')
       .sign({
         key: keyPem,
@@ -365,7 +392,7 @@ assert.throws(
 // Test throws exception when key options is null
 {
   assert.throws(() => {
-    crypto.createSign('SHA1').update('Test123').sign(null, 'base64');
+    crypto.createSign('SHA256').update('Test123').sign(null, 'base64');
   }, {
     code: 'ERR_CRYPTO_SIGN_KEY_REQUIRED',
     name: 'Error'
@@ -373,8 +400,8 @@ assert.throws(
 }
 
 {
-  const sign = crypto.createSign('SHA1');
-  const verify = crypto.createVerify('SHA1');
+  const sign = crypto.createSign('SHA256');
+  const verify = crypto.createVerify('SHA256');
 
   [1, [], {}, undefined, null, true, Infinity].forEach((input) => {
     const errObj = {
@@ -441,7 +468,7 @@ for (const pair of [
   { private: fixtures.readKey('rsa_private_2048.pem', 'ascii'),
     public: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
     skip: false,
-    algo: 'sha1',
+    algo: signingHash,
     sigLen: 256,
     raw: false },
 ]) {
@@ -450,6 +477,7 @@ for (const pair of [
     continue;
   }
   const algo = pair.algo;
+  const keyType = crypto.createPrivateKey(pair.private).asymmetricKeyType;
 
   {
     const data = Buffer.from('Hello world');
@@ -521,15 +549,34 @@ for (const pair of [
       const sig = crypto.sign(algo, data, { key: pair.private, context });
       assert.strictEqual(crypto.verify(algo, data, { key: pair.public }, sig), true);
       assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context }, sig), true);
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context: crypto.randomBytes(30) }, sig), false);
+      const mismatchedContext = { key: pair.public, context: crypto.randomBytes(30) };
+      if (fips35 && keyType === 'ed25519') {
+        assert.throws(() => crypto.verify(algo, data, mismatchedContext, sig), {
+          code: 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION',
+        });
+      } else {
+        assert.strictEqual(
+          crypto.verify(algo, data, mismatchedContext, sig), false);
+      }
     }
 
     {
       const context = new Uint8Array(32);
-      const sig = crypto.sign(algo, data, { key: pair.private, context });
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public }, sig), false);
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context }, sig), true);
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context: crypto.randomBytes(30) }, sig), false);
+      if (fips35 && keyType === 'ed25519') {
+        assert.throws(
+          () => crypto.sign(algo, data, { key: pair.private, context }),
+          { code: 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION' });
+      } else {
+        const sig = crypto.sign(algo, data, { key: pair.private, context });
+        assert.strictEqual(
+          crypto.verify(algo, data, { key: pair.public }, sig), false);
+        assert.strictEqual(
+          crypto.verify(algo, data, { key: pair.public, context }, sig), true);
+        assert.strictEqual(crypto.verify(algo, data, {
+          key: pair.public,
+          context: crypto.randomBytes(30),
+        }, sig), false);
+      }
     }
 
     assert.throws(() => crypto.sign(algo, data, { key: pair.private, context: new Uint8Array(256) }), {
@@ -572,20 +619,27 @@ if (hasOpenSSL(3, 2)) {
 
   {
     const context = Buffer.from('my context');
-    const sig = crypto.sign(null, data, { key: privKey, context });
-    assert.strictEqual(sig.length, 64);
+    if (fips35) {
+      assert.throws(() => crypto.sign(null, data, { key: privKey, context }), {
+        code: 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION',
+      });
+    } else {
+      const sig = crypto.sign(null, data, { key: privKey, context });
+      assert.strictEqual(sig.length, 64);
 
-    // Verify with matching context succeeds
-    assert.strictEqual(crypto.verify(null, data, { key: pubKey, context }, sig), true);
+      // Verify with matching context succeeds
+      assert.strictEqual(
+        crypto.verify(null, data, { key: pubKey, context }, sig), true);
 
-    // Verify without context fails (Ed25519ctx !== Ed25519 pure)
-    assert.strictEqual(crypto.verify(null, data, { key: pubKey }, sig), false);
+      // Verify without context fails (Ed25519ctx !== Ed25519 pure)
+      assert.strictEqual(crypto.verify(null, data, { key: pubKey }, sig), false);
 
-    // Verify with wrong context fails
-    assert.strictEqual(crypto.verify(null, data, {
-      key: pubKey,
-      context: Buffer.from('wrong'),
-    }, sig), false);
+      // Verify with wrong context fails
+      assert.strictEqual(crypto.verify(null, data, {
+        key: pubKey,
+        context: Buffer.from('wrong'),
+      }, sig), false);
+    }
   }
 
   {
@@ -662,7 +716,9 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
 
 {
   const data = Buffer.from('Hello world');
-  const keys = [['ec-key.pem', 64], ['dsa_private_1025.pem', 40]];
+  const dsaKey = fips3 ?
+    ['dsa_private.pem', 64] : ['dsa_private_1025.pem', 40];
+  const keys = [['ec-key.pem', 64], dsaKey];
 
   for (const [file, length] of keys) {
     if (process.features.openssl_is_boringssl && file.startsWith('dsa_')) {
@@ -670,28 +726,29 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
       continue;
     }
     const privKey = fixtures.readKey(file);
+    const digest = fips3 ? 'sha256' : 'sha1';
     [
-      crypto.createSign('sha1').update(data).sign(privKey),
-      crypto.sign('sha1', data, privKey),
-      crypto.sign('sha1', data, { key: privKey, dsaEncoding: 'der' }),
+      crypto.createSign(digest).update(data).sign(privKey),
+      crypto.sign(digest, data, privKey),
+      crypto.sign(digest, data, { key: privKey, dsaEncoding: 'der' }),
     ].forEach((sig) => {
       // Signature length variability due to DER encoding
       assert(sig.length >= length + 4 && sig.length <= length + 8);
 
       assert.strictEqual(
-        crypto.createVerify('sha1').update(data).verify(privKey, sig),
+        crypto.createVerify(digest).update(data).verify(privKey, sig),
         true
       );
-      assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
+      assert.strictEqual(crypto.verify(digest, data, privKey, sig), true);
     });
 
     // Test (EC)DSA signature conversion.
     const opts = { key: privKey, dsaEncoding: 'ieee-p1363' };
-    let sig = crypto.sign('sha1', data, opts);
+    let sig = crypto.sign(digest, data, opts);
     // Unlike DER signatures, IEEE P1363 signatures have a predictable length.
     assert.strictEqual(sig.length, length);
-    assert.strictEqual(crypto.verify('sha1', data, opts, sig), true);
-    assert.strictEqual(crypto.createVerify('sha1')
+    assert.strictEqual(crypto.verify(digest, data, opts, sig), true);
+    assert.strictEqual(crypto.createVerify(digest)
                              .update(data)
                              .verify(opts, sig), true);
 
@@ -700,7 +757,7 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
       sig = crypto.randomBytes(length + i);
       let result;
       try {
-        result = crypto.verify('sha1', data, opts, sig);
+        result = crypto.verify(digest, data, opts, sig);
       } catch (err) {
         assert.match(err.message, /asn1 encoding/);
         assert.strictEqual(err.library, 'asn1 encoding routines');
@@ -735,20 +792,20 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
   }
 
   // Non-(EC)DSA keys should ignore the option.
-  const sig = crypto.sign('sha1', data, {
+  const sig = crypto.sign(signingHash, data, {
     key: keyPem,
     dsaEncoding: 'ieee-p1363'
   });
-  assert.strictEqual(crypto.verify('sha1', data, certPem, sig), true);
+  assert.strictEqual(crypto.verify(signingHash, data, certPem, sig), true);
   assert.strictEqual(
-    crypto.verify('sha1', data, {
+    crypto.verify(signingHash, data, {
       key: certPem,
       dsaEncoding: 'ieee-p1363'
     }, sig),
     true
   );
   assert.strictEqual(
-    crypto.verify('sha1', data, {
+    crypto.verify(signingHash, data, {
       key: certPem,
       dsaEncoding: 'der'
     }, sig),
@@ -757,7 +814,7 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
 
   for (const dsaEncoding of ['foo', null, {}, 5, true, NaN]) {
     assert.throws(() => {
-      crypto.sign('sha1', data, {
+      crypto.sign(signingHash, data, {
         key: certPem,
         dsaEncoding
       });
@@ -776,12 +833,13 @@ if (!opensslCli) {
   const privkey = fixtures.readKey('rsa_private_2048.pem');
 
   const msg = 'Test123';
-  const s5 = crypto.createSign('SHA256')
-    .update(msg)
-    .sign({
-      key: privkey,
-      padding: crypto.constants.RSA_PKCS1_PSS_PADDING
-    });
+  const options = {
+    key: privkey,
+    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+  };
+  const s5 = fips30 ?
+    crypto.sign('SHA256', Buffer.from(msg), options) :
+    crypto.createSign('SHA256').update(msg).sign(options);
 
   const tmpdir = require('../common/tmpdir');
   tmpdir.refresh();
@@ -811,8 +869,14 @@ if (!process.features.openssl_is_boringssl) {
     const privateKey = crypto.createPrivateKey(privatePem);
 
     for (const key of [privatePem, privateKey]) {
-      // Any algorithm should work.
-      for (const algo of ['sha1', 'sha256']) {
+      if (fips30) {
+        assert.throws(() => crypto.sign('sha1', 'foo', key), {
+          code: fipsDigestErrorCode,
+        });
+      }
+      // Any algorithm should work unless SHA-1 signing is unavailable.
+      const algorithms = fips30 ? ['sha256'] : ['sha1', 'sha256'];
+      for (const algo of algorithms) {
         // Any salt length should work.
         for (const saltLength of [undefined, 8, 10, 12, 16, 18, 20]) {
           const signature = crypto.sign(algo, 'foo', { key, saltLength });
@@ -847,7 +911,9 @@ if (!process.features.openssl_is_boringssl) {
       // Signing with anything other than sha256 should fail.
       assert.throws(() => {
         crypto.sign('sha1', 'foo', key);
-      }, /digest not allowed/);
+      }, fips30 ? {
+        code: fipsDigestErrorCode,
+      } : /digest not allowed/);
 
       // Signing with salt lengths less than 16 bytes should fail.
       for (const saltLength of [8, 10, 12]) {
@@ -895,7 +961,9 @@ if (!process.features.openssl_is_boringssl) {
       for (const algo of ['sha1', 'sha256']) {
         assert.throws(() => {
           crypto.sign(algo, 'foo', key);
-        }, /digest not allowed/);
+        }, fips30 && algo === 'sha1' ? {
+          code: fipsDigestErrorCode,
+        } : /digest not allowed/);
       }
 
       // sha512 should produce a valid signature.
@@ -915,15 +983,21 @@ if (!process.features.openssl_is_boringssl) {
 // The sign function should not swallow OpenSSL errors.
 // Regression test for https://github.com/nodejs/node/issues/40794.
 {
-  assert.throws(() => {
-    const { privateKey } = crypto.generateKeyPairSync('rsa', {
-      modulusLength: 512
+  if (fips3) {
+    assert.throws(() => crypto.generateKeyPairSync('rsa', {
+      modulusLength: 512,
+    }), { code: 'ERR_OSSL_RSA_INVALID_MODULUS' });
+  } else {
+    assert.throws(() => {
+      const { privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 512
+      });
+      crypto.sign('sha512', 'message', privateKey);
+    }, {
+      code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY',
+      message: /digest too big for rsa key|DIGEST_TOO_BIG_FOR_RSA_KEY/
     });
-    crypto.sign('sha512', 'message', privateKey);
-  }, {
-    code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY',
-    message: /digest too big for rsa key|DIGEST_TOO_BIG_FOR_RSA_KEY/
-  });
+  }
 }
 
 {
diff --git a/test/parallel/test-crypto-worker-thread.js b/test/parallel/test-crypto-worker-thread.js
index d9030d5cfc11..42027f3f2b44 100644
--- a/test/parallel/test-crypto-worker-thread.js
+++ b/test/parallel/test-crypto-worker-thread.js
@@ -9,6 +9,7 @@ const {
   generateKeySync,
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 const assert = require('assert');
@@ -19,7 +20,7 @@ if (isMainThread) {
   (async () => {
     const secretKey = generateKeySync('aes', { length: 128 });
     const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-      modulusLength: 1024
+      modulusLength: hasFIPS(3) ? 2048 : 1024
     });
     const cryptoKey = await subtle.generateKey(
       { name: 'AES-CBC', length: 128 }, false, ['encrypt']);
diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
index 46f4571b33df..2379ea692cac 100644
--- a/test/parallel/test-crypto.js
+++ b/test/parallel/test-crypto.js
@@ -29,7 +29,8 @@ const assert = require('assert');
 const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const isFips = hasFIPS(3);
 
 // Test Certificates
 const certPfx = fixtures.readKey('rsa_cert.pfx');
@@ -54,27 +55,35 @@ assert.throws(() => {
 });
 
 // PFX tests
-tls.createSecureContext({ pfx: certPfx, passphrase: 'sample' });
-
-assert.throws(() => {
-  tls.createSecureContext({ pfx: certPfx });
-}, (err) => {
-  // Throws general Error, so there is no opensslErrorStack property.
-  return err instanceof Error &&
-         err.name === 'Error' &&
-         /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
-         !('opensslErrorStack' in err);
-});
+if (isFips) {
+  for (const passphrase of ['sample', undefined, 'test']) {
+    assert.throws(
+      () => tls.createSecureContext({ pfx: certPfx, passphrase }),
+      { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  }
+} else {
+  tls.createSecureContext({ pfx: certPfx, passphrase: 'sample' });
+
+  assert.throws(() => {
+    tls.createSecureContext({ pfx: certPfx });
+  }, (err) => {
+    // Throws general Error, so there is no opensslErrorStack property.
+    return err instanceof Error &&
+           err.name === 'Error' &&
+           /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
+           !('opensslErrorStack' in err);
+  });
 
-assert.throws(() => {
-  tls.createSecureContext({ pfx: certPfx, passphrase: 'test' });
-}, (err) => {
-  // Throws general Error, so there is no opensslErrorStack property.
-  return err instanceof Error &&
-         err.name === 'Error' &&
-         /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
-         !('opensslErrorStack' in err);
-});
+  assert.throws(() => {
+    tls.createSecureContext({ pfx: certPfx, passphrase: 'test' });
+  }, (err) => {
+    // Throws general Error, so there is no opensslErrorStack property.
+    return err instanceof Error &&
+           err.name === 'Error' &&
+           /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
+           !('opensslErrorStack' in err);
+  });
+}
 
 assert.throws(() => {
   tls.createSecureContext({ pfx: 'sample', passphrase: 'test' });
@@ -191,7 +200,7 @@ assert.throws(
 );
 
 assert.throws(
-  () => crypto.createHmac('sha256', 'a secret').update('0', 'hex'),
+  () => crypto.createHmac('sha256', '0123456789abcdef').update('0', 'hex'),
   (error) => {
     assert.ok(!('opensslErrorStack' in error));
     assert.throws(() => { throw error; }, encodingError);
@@ -211,7 +220,11 @@ assert.throws(() => {
   ].join('\n');
   crypto.createSign('SHA256').update('test').sign(priv);
 }, (err) => {
-  if (process.features.openssl_is_boringssl) {
+  if (isFips) {
+    assert.throws(() => { throw err; }, {
+      code: 'ERR_OSSL_INVALID_KEY_LENGTH',
+    });
+  } else if (process.features.openssl_is_boringssl) {
     // BoringSSL rejects the tiny RSA key while decoding it, before signing.
     assert.throws(() => { throw err; }, {
       name: 'Error',
@@ -225,9 +238,9 @@ assert.throws(() => {
     assert(Array.isArray(err.opensslErrorStack));
     assert(err.opensslErrorStack.length > 0);
   } else {
-    if (!hasOpenSSL3)
+    if (!hasOpenSSL(3))
       assert.ok(!('opensslErrorStack' in err));
-    assert.throws(() => { throw err; }, hasOpenSSL3 ? {
+    assert.throws(() => { throw err; }, hasOpenSSL(3) ? {
       name: 'Error',
       message: 'error:02000070:rsa routines::digest too big for rsa key',
       library: 'rsa routines',
@@ -243,7 +256,7 @@ assert.throws(() => {
   return true;
 });
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   // The correct header inside `rsa_private_pkcs8_bad.pem` should have been
   // -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
   // instead of
diff --git a/test/parallel/test-https-agent-additional-options.js b/test/parallel/test-https-agent-additional-options.js
index 000cb9d3d0c2..3707855ed5c8 100644
--- a/test/parallel/test-https-agent-additional-options.js
+++ b/test/parallel/test-https-agent-additional-options.js
@@ -6,17 +6,20 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const https = require('https');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 const options = {
   key: fixtures.readKey('agent1-key.pem'),
   cert: fixtures.readKey('agent1-cert.pem'),
   ca: fixtures.readKey('ca1-cert.pem'),
-  minVersion: 'TLSv1.1',
+  minVersion: fips3 ? 'TLSv1.2' : 'TLSv1.1',
 };
 
 if (!process.features.openssl_is_boringssl) {
-  options.ciphers = 'ALL@SECLEVEL=0';
+  options.ciphers = fips3 ?
+    'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
 }
 
 const server = https.Server(options, (req, res) => {
@@ -34,7 +37,8 @@ function getBaseOptions(port) {
   };
 
   if (!process.features.openssl_is_boringssl) {
-    baseOptions.ciphers = 'ALL@SECLEVEL=0';
+    baseOptions.ciphers = fips3 ?
+      'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
   }
 
   return baseOptions;
@@ -44,10 +48,11 @@ const updatedValues = new Map([
   ['dhparam', fixtures.readKey('dh2048.pem')],
   ['ecdhCurve', 'secp384r1'],
   ['honorCipherOrder', true],
-  ['minVersion', 'TLSv1.1'],
+  ['minVersion', fips3 ? 'TLSv1.2' : 'TLSv1.1'],
   ['maxVersion', 'TLSv1.3'],
   ['secureOptions', crypto.constants.SSL_OP_CIPHER_SERVER_PREFERENCE],
-  ['secureProtocol', 'TLSv1_1_method'],
+  ['secureProtocol', fips3 ?
+    'TLSv1_2_method' : 'TLSv1_1_method'],
   ['sessionIdContext', 'sessionIdContext'],
 ]);
 
diff --git a/test/parallel/test-https-agent-pfx-object-array-reuse.js b/test/parallel/test-https-agent-pfx-object-array-reuse.js
index 95134855e971..758c32e54008 100644
--- a/test/parallel/test-https-agent-pfx-object-array-reuse.js
+++ b/test/parallel/test-https-agent-pfx-object-array-reuse.js
@@ -6,21 +6,57 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const https = require('https');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+
+const onRequest = (req, res) => {
+  res.end(req.socket.getPeerCertificate().subject.CN);
+};
+const requestHandler = fips3 && !fips35 ?
+  common.mustNotCall() :
+  common.mustCall(onRequest, fips3 ? 1 : 2);
 
 const server = https.createServer({
   key: fixtures.readKey('agent2-key.pem'),
   cert: fixtures.readKey('agent2-cert.pem'),
   requestCert: true,
   rejectUnauthorized: false,
-}, common.mustCall((req, res) => {
-  res.end(req.socket.getPeerCertificate().subject.CN);
-}, 2));
+}, requestHandler);
 
 server.listen(0, common.mustCall(async () => {
   const agent = new https.Agent({ keepAlive: true, maxSockets: 1 });
   const port = server.address().port;
 
+  if (fips3) {
+    await assert.rejects(request({
+      agent,
+      port,
+      pfx: [{ buf: fixtures.readKey('agent1.pfx'), passphrase: 'sample' }],
+    }, false), { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+
+    if (!fips35) {
+      agent.destroy();
+      server.close();
+      return;
+    }
+
+    const result = await request({
+      agent,
+      port,
+      pfx: [{
+        buf: fixtures.readKey('agent1-fips.pfx'),
+        passphrase: 'password',
+      }],
+    });
+    assert.strictEqual(result.body, 'agent1');
+    assert.strictEqual(result.reusedSocket, false);
+    agent.destroy();
+    server.close();
+    return;
+  }
+
   const first = await request({
     agent,
     port,
@@ -41,19 +77,20 @@ server.listen(0, common.mustCall(async () => {
   server.close();
 }));
 
-function request(options) {
+function request(options, expectResponse = true) {
   return new Promise((resolve, reject) => {
-    const req = https.get({
-      ...options,
-      rejectUnauthorized: false,
-    }, common.mustCall((res) => {
+    const onResponse = expectResponse ? common.mustCall((res) => {
       let body = '';
       res.setEncoding('utf8');
       res.on('data', (chunk) => body += chunk);
       res.on('end', common.mustCall(() => {
         resolve({ body, reusedSocket: req.reusedSocket });
       }));
-    }));
+    }) : common.mustNotCall();
+    const req = https.get({
+      ...options,
+      rejectUnauthorized: false,
+    }, onResponse);
     req.on('error', reject);
   });
 }
diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
index de2790e0d0a3..971a8f359a6f 100644
--- a/test/parallel/test-https-agent-session-eviction.js
+++ b/test/parallel/test-https-agent-session-eviction.js
@@ -8,10 +8,11 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const https = require('https');
-const { SSL_OP_NO_TICKET } = require('crypto').constants;
+const { constants: { SSL_OP_NO_TICKET } } = require('crypto');
+const fips3 = hasFIPS(3);
 
 const options = {
   key: fixtures.readKey('agent1-key.pem'),
@@ -19,11 +20,17 @@ const options = {
   secureOptions: SSL_OP_NO_TICKET,
 };
 
+if (fips3) {
+  options.minVersion = 'TLSv1.3';
+  options.maxVersion = 'TLSv1.3';
+}
+
 if (!process.features.openssl_is_boringssl) {
-  options.ciphers = 'RSA@SECLEVEL=0';
+  options.ciphers = fips3 ?
+    'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
 }
 
-// Create TLS1.2 server
+// Create the initial server and cache a session from it.
 https.createServer(options, function(req, res) {
   res.writeHead(200, { 'Connection': 'close' });
   res.end('ohai');
@@ -47,9 +54,14 @@ function first(server) {
   req.end();
 }
 
-// Create TLS1 server
+// Create a server constrained to a different TLS version.
 function faultyServer(port) {
-  options.secureProtocol = 'TLSv1_method';
+  if (fips3) {
+    options.minVersion = 'TLSv1.2';
+    options.maxVersion = 'TLSv1.2';
+  } else {
+    options.secureProtocol = 'TLSv1_method';
+  }
   https.createServer(options, function(req, res) {
     res.writeHead(200, { 'Connection': 'close' });
     res.end('hello faulty');
@@ -62,14 +74,15 @@ function faultyServer(port) {
 function second(server, session) {
   const req = https.request({
     port: server.address().port,
-    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+    ciphers: fips3 ? 'ECDHE-RSA-AES256-GCM-SHA384' :
+      (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
     rejectUnauthorized: false
   }, function(res) {
     res.resume();
   });
 
-  // Although we have a TLS 1.2 session to offer to the TLS 1.0 server,
-  // connection to the TLS 1.0 server should work.
+  // Offering the cached session to a server using another TLS version should
+  // not prevent a fresh connection.
   req.on('response', common.mustCall(function(res) {
     // The test is now complete for OpenSSL 1.1.0.
     server.close();
diff --git a/test/parallel/test-https-pfx.js b/test/parallel/test-https-pfx.js
index 3c0aa82b3dbe..2be91887207d 100644
--- a/test/parallel/test-https-pfx.js
+++ b/test/parallel/test-https-pfx.js
@@ -29,6 +29,8 @@ const fixtures = require('../common/fixtures');
 
 const assert = require('assert');
 const https = require('https');
+const { hasFIPS } = require('../common/crypto');
+const fips3 = hasFIPS(3);
 
 const pfx = fixtures.readKey('rsa_cert.pfx');
 
@@ -42,10 +44,23 @@ const options = {
   rejectUnauthorized: false
 };
 
+if (fips3) {
+  assert.throws(() => https.createServer(options), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+
+  if (!hasFIPS(3, 5)) {
+    return;
+  }
+
+  options.pfx = fixtures.readKey('agent1-fips.pfx');
+  options.passphrase = 'password';
+}
+
 const server = https.createServer(options, common.mustCallAtLeast((req, res) => {
-  assert.strictEqual(req.socket.authorized, false); // not a client cert
-  assert.strictEqual(req.socket.authorizationError,
-                     'DEPTH_ZERO_SELF_SIGNED_CERT');
+  assert.strictEqual(req.socket.authorized, fips3);
+  assert.strictEqual(req.socket.authorizationError, fips3 ?
+    null : 'DEPTH_ZERO_SELF_SIGNED_CERT');
   res.writeHead(200);
   res.end('OK');
 }));
diff --git a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
index 667be03d58ce..ec1b8dda8ca1 100644
--- a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
+++ b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
@@ -13,9 +13,10 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const crypto = require('crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // See #37990 for details on why this is problematic with FIPS.
-if (process.config.variables.openssl_is_fips)
+if (crypto.getFips() === 1 && !hasOpenSSL(3))
   common.skip('Skipping as test uses non-fips compliant EC curve');
 
 // This test will fail for OpenSSL < 1.1.1h
diff --git a/test/parallel/test-tls-alert.js b/test/parallel/test-tls-alert.js
index 64b7080e39ba..f20bf42a2dcd 100644
--- a/test/parallel/test-tls-alert.js
+++ b/test/parallel/test-tls-alert.js
@@ -27,6 +27,7 @@ if (!common.hasCrypto) {
 
 const {
   hasOpenSSL,
+  hasFIPS,
   opensslCli,
 } = require('../common/crypto');
 
@@ -43,11 +44,18 @@ function loadPEM(n) {
   return fixtures.readKey(`${n}.pem`);
 }
 
-const server = tls.Server({
-  secureProtocol: 'TLSv1_2_server_method',
+const serverOptions = {
   key: loadPEM('agent2-key'),
-  cert: loadPEM('agent2-cert')
-}, null).listen(0, common.mustCall(() => {
+  cert: loadPEM('agent2-cert'),
+};
+if (hasFIPS(3)) {
+  serverOptions.minVersion = 'TLSv1.3';
+  serverOptions.maxVersion = 'TLSv1.3';
+} else {
+  serverOptions.secureProtocol = 'TLSv1_2_server_method';
+}
+
+const server = tls.Server(serverOptions, null).listen(0, common.mustCall(() => {
   if (process.features.openssl_is_boringssl) {
     let gotClientError = false;
     let gotServerError = false;
@@ -75,8 +83,9 @@ const server = tls.Server({
     return;
   }
 
-  const args = ['s_client', '-quiet', '-tls1_1',
-                '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+  const args = ['s_client', '-quiet', hasFIPS(3) ? '-tls1_2' : '-tls1_1',
+                '-cipher', hasFIPS(3) ? 'DEFAULT' :
+                  (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
                 '-connect', `127.0.0.1:${server.address().port}`];
 
   execFile(opensslCli, args, common.mustCall((err, _, stderr) => {
diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
index ea6dec7bdc46..db41fdf6a098 100644
--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
+++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -9,7 +9,7 @@ if (process.features.openssl_is_boringssl) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
@@ -17,12 +17,14 @@ const tls = require('tls');
 
 const key = fixtures.readKey('agent2-key.pem');
 const cert = fixtures.readKey('agent2-cert.pem');
+const fips3 = hasFIPS(3);
+const rejectsXCurves = hasFIPS(3, 5);
 
 function loadDHParam(n) {
   return fixtures.readKey(`dh${n}.pem`);
 }
 
-function test(size, type, name, cipher) {
+function test(size, type, name, cipher, expectError = false) {
   assert(cipher);
 
   const options = {
@@ -49,39 +51,62 @@ function test(size, type, name, cipher) {
     }
   }
 
-  const server = tls.createServer(options, common.mustCall((conn) => {
-    assert.strictEqual(conn.getEphemeralKeyInfo(), null);
-    conn.end();
-  }));
+  if (rejectsXCurves && (name === 'X25519' || name === 'X448')) {
+    assert.throws(() => tls.createServer(options), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+    return;
+  }
+
+  const onConnection = expectError ? common.mustNotCall() :
+    common.mustCall((conn) => {
+      assert.strictEqual(conn.getEphemeralKeyInfo(), null);
+      conn.end();
+    });
+  const server = tls.createServer(options, onConnection);
 
   server.on('close', common.mustSucceed());
 
   server.listen(0, common.mustCall(() => {
+    const onSecureConnect = expectError ? common.mustNotCall() :
+      common.mustCall(function() {
+        const ekeyinfo = client.getEphemeralKeyInfo();
+        assert.strictEqual(ekeyinfo.type, type);
+        assert.strictEqual(ekeyinfo.size, size);
+        assert.strictEqual(ekeyinfo.name, name);
+        server.close();
+      });
     const client = tls.connect({
       port: server.address().port,
       rejectUnauthorized: false
-    }, common.mustCall(function() {
-      const ekeyinfo = client.getEphemeralKeyInfo();
-      assert.strictEqual(ekeyinfo.type, type);
-      assert.strictEqual(ekeyinfo.size, size);
-      assert.strictEqual(ekeyinfo.name, name);
-      server.close();
-    }));
-    client.on('secureConnect', common.mustCall());
+    }, onSecureConnect);
+    if (expectError) {
+      client.on('error', common.mustCall((err) => {
+        assert.strictEqual(err.code, 'ERR_SSL_BAD_DH_VALUE');
+        server.close();
+      }));
+    } else {
+      client.on('secureConnect', common.mustCall());
+    }
   }));
 }
 
-test(undefined, undefined, undefined, 'AES256-SHA256');
+if (!fips3)
+  test(undefined, undefined, undefined, 'AES256-SHA256');
 test('auto', 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
-if (hasOpenSSL(4, 0)) {
-  // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
-  // always selects FFDHE-2048 regardless of the server-supplied dhparam.
-} else if (!hasOpenSSL(3, 2)) {
-  test(1024, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+if (fips3 && !hasOpenSSL(4)) {
+  test(2048, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384', true);
 } else {
-  test(3072, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+  if (hasOpenSSL(4, 0)) {
+    // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
+    // always selects FFDHE-2048 regardless of the server-supplied dhparam.
+  } else if (!hasOpenSSL(3, 2)) {
+    test(1024, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+  } else {
+    test(3072, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+  }
+  test(2048, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
 }
-test(2048, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
 test(256, 'ECDH', 'prime256v1', 'ECDHE-RSA-AES256-GCM-SHA384');
 test(521, 'ECDH', 'secp521r1', 'ECDHE-RSA-AES256-GCM-SHA384');
 test(253, 'ECDH', 'X25519', 'ECDHE-RSA-AES256-GCM-SHA384');
@@ -96,6 +121,17 @@ function testTLS13Group(size, type, name) {
     maxVersion: 'TLSv1.3',
   };
 
+  const unsupportedFipsGroup =
+    (rejectsXCurves && name === 'X25519') ||
+    (hasFIPS(4) &&
+     (name === 'curveSM2' || name === 'curveSM2MLKEM768'));
+  if (unsupportedFipsGroup) {
+    assert.throws(() => tls.createServer(options), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+    return;
+  }
+
   const server = tls.createServer(options, common.mustCall((conn) => {
     assert.strictEqual(conn.getEphemeralKeyInfo(), null);
     conn.end();
@@ -121,6 +157,8 @@ function testTLS13Group(size, type, name) {
   }));
 }
 
+if (fips3)
+  testTLS13Group(256, 'ECDH', 'prime256v1');
 testTLS13Group(253, 'ECDH', 'X25519');
 
 if (hasOpenSSL(3, 5)) {
diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js
index d777a9bfa97f..8f3b2eafbb8a 100644
--- a/test/parallel/test-tls-client-mindhsize.js
+++ b/test/parallel/test-tls-client-mindhsize.js
@@ -13,7 +13,9 @@ const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const fips3 = hasFIPS(3);
+const fips4 = hasFIPS(4);
 
 const key = fixtures.readKey('agent2-key.pem');
 const cert = fixtures.readKey('agent2-cert.pem');
@@ -29,7 +31,7 @@ function test(size, err, next, minDHSizeOverride) {
   const options = {
     key: key,
     cert: cert,
-    dhparam: loadDHParam(size),
+    dhparam: size === 'auto' ? 'auto' : loadDHParam(size),
     ciphers: 'DHE-RSA-AES128-GCM-SHA256'
   };
 
@@ -60,7 +62,8 @@ function test(size, err, next, minDHSizeOverride) {
     if (err) {
       client.on('error', common.mustCall((e) => {
         nerror++;
-        assert.strictEqual(e.code, 'ERR_TLS_DH_PARAM_SIZE');
+        assert.strictEqual(e.code, fips3 && !fips4 ?
+          'ERR_SSL_BAD_DH_VALUE' : 'ERR_TLS_DH_PARAM_SIZE');
         server.close();
       }));
     }
@@ -86,7 +89,11 @@ function testDHE3072() {
 }
 
 if (!process.features.openssl_is_boringssl) {
-  if (hasOpenSSL(4, 0)) {
+  if (fips3 && !fips4) {
+    // The FIPS provider rejects explicit DH parameters without a validated
+    // subgroup, while OpenSSL's built-in FFDHE group remains available.
+    testDHE2048(true, () => test('auto', false, null, 2048));
+  } else if (hasOpenSSL(4, 0)) {
     // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
     // ignores the server-supplied dhparam in favor of FFDHE-2048. The 3072
     // success case is therefore replaced by a 2048 success case.
diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js
index 83af6daccbd0..65f3dc6867c4 100644
--- a/test/parallel/test-tls-dhe.js
+++ b/test/parallel/test-tls-dhe.js
@@ -34,6 +34,7 @@ if (process.features.openssl_is_boringssl) {
 const {
   opensslCli,
   hasOpenSSL,
+  hasFIPS,
 } = require('../common/crypto');
 
 // OpenSSL has a set of security levels which affect what algorithms
@@ -62,7 +63,7 @@ const dheCipher = 'DHE-RSA-AES128-SHA256';
 const ecdheCipher = 'ECDHE-RSA-AES128-SHA256';
 const ciphers = `${dheCipher}:${ecdheCipher}`;
 
-if (secLevel < 2) {
+if (secLevel < 2 && !hasFIPS(3)) {
   // Test will emit a warning because the DH parameter size is < 2048 bits
   // when the test is run on versions lower than OpenSSL32
   common.expectWarning('SecurityWarning',
@@ -74,7 +75,7 @@ function loadDHParam(n) {
   return fixtures.readKey(keyname);
 }
 
-function test(dhparam, keylen, expectedCipher) {
+function test(dhparam, keylen, expectedCipher, expectedError) {
   const options = {
     key,
     cert,
@@ -84,12 +85,29 @@ function test(dhparam, keylen, expectedCipher) {
   };
 
   const server = tls.createServer(options, (conn) => conn.end());
+  if (typeof expectedError === 'string' || Array.isArray(expectedError)) {
+    server.once('tlsClientError', common.mustCall((err) => {
+      if (Array.isArray(expectedError)) {
+        assert.ok(expectedError.includes(err.code), err);
+      } else {
+        assert.strictEqual(err.code, expectedError);
+      }
+    }));
+  }
 
   server.listen(0, '127.0.0.1', common.mustCall(() => {
     const args = ['s_client', '-connect', `127.0.0.1:${server.address().port}`,
                   '-cipher', `${ciphers}:@SECLEVEL=1`];
 
-    execFile(opensslCli, args, common.mustSucceed((stdout) => {
+    execFile(opensslCli, args, common.mustCall((err, stdout, stderr) => {
+      if (expectedError) {
+        assert.strictEqual(err?.code, 1);
+        if (expectedError instanceof RegExp) assert.match(stderr, expectedError);
+        server.close();
+        return;
+      }
+
+      assert.ifError(err);
       assert(keylen === null ||
              // s_client < OpenSSL 3.5
              stdout.includes(`Server Temp Key: DH, ${keylen} bits`) ||
@@ -103,10 +121,10 @@ function test(dhparam, keylen, expectedCipher) {
   return once(server, 'close');
 }
 
-function testCustomParam(keylen, expectedCipher) {
+function testCustomParam(keylen, expectedCipher, expectedError) {
   const dhparam = loadDHParam(keylen);
   if (keylen === 'error') keylen = null;
-  return test(dhparam, keylen, expectedCipher);
+  return test(dhparam, keylen, expectedCipher, expectedError);
 }
 
 (async () => {
@@ -140,14 +158,29 @@ function testCustomParam(keylen, expectedCipher) {
   // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
   // ignores the server-supplied dhparam in favor of FFDHE-2048, so the
   // negotiated key length is always 2048.
-  if (secLevel < 2) {
-    await testCustomParam(1024, dheCipher);
-  } else if (hasOpenSSL(4, 0)) {
-    await test(loadDHParam(3072), 2048, dheCipher);
+  if (hasFIPS(3)) {
+    if (hasFIPS(4)) {
+      await test(loadDHParam(3072), 2048, dheCipher);
+      await testCustomParam(2048, dheCipher);
+    } else {
+      const errorCode = hasFIPS(3, 5) ?
+        [
+          'ERR_SSL_INVALID_KEY_LENGTH',
+          'ERR_SSL_SSL/TLS_ALERT_ILLEGAL_PARAMETER',
+        ] : 'ERR_SSL_INTERNAL_ERROR';
+      await testCustomParam(3072, null, errorCode);
+      await testCustomParam(2048, null, errorCode);
+    }
   } else {
-    await testCustomParam(3072, dheCipher);
+    if (secLevel < 2) {
+      await testCustomParam(1024, dheCipher);
+    } else if (hasOpenSSL(4, 0)) {
+      await test(loadDHParam(3072), 2048, dheCipher);
+    } else {
+      await testCustomParam(3072, dheCipher);
+    }
+    await testCustomParam(2048, dheCipher);
   }
-  await testCustomParam(2048, dheCipher);
 
   // Invalid DHE parameters are discarded. Prior to OpenSSL 4.0 this
   // disabled DHE and ECDHE was negotiated; since 4.0, FFDHE-2048 is used.
diff --git a/test/parallel/test-tls-ecdh-multiple.js b/test/parallel/test-tls-ecdh-multiple.js
index ed60044197d7..b01051d5b457 100644
--- a/test/parallel/test-tls-ecdh-multiple.js
+++ b/test/parallel/test-tls-ecdh-multiple.js
@@ -8,7 +8,11 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli, hasOpenSSL } = require('../common/crypto');
+const {
+  opensslCli,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
 const crypto = require('crypto');
 
 if (!opensslCli) {
@@ -19,14 +23,16 @@ const assert = require('assert');
 const tls = require('tls');
 const { execFile } = require('child_process');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 function loadPEM(n) {
   return fixtures.readKey(`${n}.pem`);
 }
 
-// OpenSSL 4.0 disables support for deprecated elliptic curves from RFC 8422
-// (including secp256k1) by default.
-const ecdhCurve = process.features.openssl_is_boringssl || hasOpenSSL(4, 0) ?
+// The FIPS provider and OpenSSL 4.0 disable support for deprecated elliptic
+// curves from RFC 8422 (including secp256k1) by default.
+const ecdhCurve = process.features.openssl_is_boringssl ||
+  hasOpenSSL(4, 0) || hasFIPS(3) ?
   'prime256v1:secp521r1' :
   'secp256k1:prime256v1:secp521r1';
 
@@ -61,8 +67,17 @@ const server = tls.createServer(options, (conn) => {
     'prime192v3',
   ];
 
-  // Brainpool is not supported in FIPS mode.
-  if (crypto.getFips()) {
+  // Setting a Brainpool group on a TLS context is deferred by OpenSSL, so
+  // exercise the prohibited key operation directly under FIPS properties.
+  if (fips3) {
+    if (hasFIPS(3, 5)) {
+      assert.throws(
+        () => crypto.createECDH('brainpoolP256r1').generateKeys(),
+        { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+    } else {
+      unsupportedCurves.push('brainpoolP256r1');
+    }
+  } else if (crypto.getFips() === 1) {
     unsupportedCurves.push('brainpoolP256r1');
   }
 
diff --git a/test/parallel/test-tls-env-extra-ca-with-options.js b/test/parallel/test-tls-env-extra-ca-with-options.js
index 8f04decf670c..5775284eea44 100644
--- a/test/parallel/test-tls-env-extra-ca-with-options.js
+++ b/test/parallel/test-tls-env-extra-ca-with-options.js
@@ -8,7 +8,9 @@ if (!common.hasCrypto)
 const assert = require('node:assert');
 const tls = require('node:tls');
 const { fork } = require('node:child_process');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 const tests = [
   {
@@ -28,13 +30,26 @@ const tests = [
       crl: fixtures.readKey('ca2-crl.pem')
     }
   },
-  {
+];
+
+if (fips3) {
+  assert.throws(() => tls.createSecureContext({
+    pfx: fixtures.readKey('agent1.pfx'),
+    passphrase: 'sample',
+  }), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+}
+
+if (!fips3 || hasFIPS(3, 5)) {
+  tests.push({
     clientOptions: {
-      pfx: fixtures.readKey('agent1.pfx'),
-      passphrase: 'sample'
+      pfx: fixtures.readKey(fips3 ?
+        'agent1-fips.pfx' : 'agent1.pfx'),
+      passphrase: fips3 ? 'password' : 'sample'
     }
-  },
-];
+  });
+}
 
 if (process.argv[2]) {
   const testNumber = parseInt(process.argv[2], 10);
diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js
index 2945ff99b5a2..2fe971444271 100644
--- a/test/parallel/test-tls-getprotocol.js
+++ b/test/parallel/test-tls-getprotocol.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 // This test ensures that `getProtocol` returns the right protocol
 // from a TLS connection
@@ -11,6 +11,7 @@ const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 let clientConfigs = [
   {
@@ -42,27 +43,50 @@ const serverConfig = {
 };
 
 if (!process.features.openssl_is_boringssl) {
-  serverConfig.ciphers = 'RSA@SECLEVEL=0';
+  serverConfig.ciphers = fips3 ?
+    'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
 }
 
-const server = tls.createServer(serverConfig, common.mustCall(clientConfigs.length))
+const expectedConnections = fips3 ? 1 : clientConfigs.length;
+const server = tls.createServer(serverConfig, common.mustCall(expectedConnections));
+
+if (fips3) {
+  server.on('tlsClientError', common.mustCall((err) => {
+    assert.ok([
+      'ERR_SSL_NO_SUITABLE_DIGEST_ALGORITHM',
+      'ERR_SSL_UNEXPECTED_MESSAGE',
+    ].includes(err.code), err);
+  }, 2));
+}
+
+server
 .listen(0, common.localhostIPv4, common.mustCall(function() {
-  let connected = 0;
+  let completed = 0;
+  function done() {
+    if (++completed === clientConfigs.length)
+      server.close();
+  }
+
   for (const v of clientConfigs) {
-    tls.connect({
+    const shouldConnect = !fips3 || v.version === 'TLSv1.2';
+    const client = tls.connect({
       host: common.localhostIPv4,
       port: server.address().port,
       ciphers: v.ciphers,
       rejectUnauthorized: false,
       secureProtocol: v.secureProtocol
-    }, common.mustCall(function() {
+    }, shouldConnect ? common.mustCall(function() {
       assert.strictEqual(this.getProtocol(), v.version);
       this.on('end', common.mustCall());
       this.on('close', common.mustCall(function() {
         assert.strictEqual(this.getProtocol(), null);
+        done();
       })).end();
-      if (++connected === clientConfigs.length)
-        server.close();
-    }));
+    }) : common.mustNotCall());
+
+    if (!shouldConnect) {
+      client.on('error', common.mustCall((err) => assert(err.code)));
+      client.on('close', common.mustCall(done));
+    }
   }
 }));
diff --git a/test/parallel/test-tls-honorcipherorder.js b/test/parallel/test-tls-honorcipherorder.js
index d86a59aa4cdc..fbee483d83b9 100644
--- a/test/parallel/test-tls-honorcipherorder.js
+++ b/test/parallel/test-tls-honorcipherorder.js
@@ -8,6 +8,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const mustCall = common.mustCall;
 const tls = require('tls');
 const util = require('util');
@@ -16,7 +17,7 @@ const util = require('util');
 // default method is updated in the future
 const SSL_Method = 'TLSv1_2_method';
 const localhost = '127.0.0.1';
-const config = process.features.openssl_is_boringssl ? {
+const config = process.features.openssl_is_boringssl || hasFIPS(3) ? {
   serverCiphers:
     'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256',
   clientPreferenceCiphers:
diff --git a/test/parallel/test-tls-invalid-pfx.js b/test/parallel/test-tls-invalid-pfx.js
index c16858f0f788..749d9e8b9f76 100644
--- a/test/parallel/test-tls-invalid-pfx.js
+++ b/test/parallel/test-tls-invalid-pfx.js
@@ -7,6 +7,7 @@ const fixtures = require('../common/fixtures');
 const {
   assert, connect, keys
 } = require(fixtures.path('tls-connect'));
+const { hasFIPS } = require('../common/crypto');
 
 const invalidPfx = fixtures.readKey('cert-without-key.pfx');
 
@@ -18,6 +19,10 @@ connect({
   },
   server: keys.agent1
 }, common.mustCall((e, pair, cleanup) => {
-  assert.strictEqual(e.message, 'Unable to load private key from PFX data');
+  if (hasFIPS(3)) {
+    assert.strictEqual(e.code, 'ERR_CRYPTO_UNSUPPORTED_OPERATION');
+  } else {
+    assert.strictEqual(e.message, 'Unable to load private key from PFX data');
+  }
   cleanup();
 }));
diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
index 88dce9f4b8e6..83797238cf4b 100644
--- a/test/parallel/test-tls-min-max-version.js
+++ b/test/parallel/test-tls-min-max-version.js
@@ -12,7 +12,7 @@ if (process.features.openssl_is_boringssl) {
 
 const {
   hasOpenSSL,
-  hasOpenSSL3,
+  hasFIPS,
 } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
@@ -29,8 +29,24 @@ const DEFAULT_MAX_VERSION = tls.DEFAULT_MAX_VERSION;
 function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
   assert(proto || cerr || serr, 'test missing any expectations');
 
+  const legacyProtocols = new Set([
+    'TLSv1',
+    'TLSv1.1',
+    'TLSv1_method',
+    'TLSv1_1_method',
+  ]);
+  const expectedLegacyProtocol = proto === 'TLSv1' || proto === 'TLSv1.1';
+  const legacyOnlyConfiguration = [cprot, sprot, cmax, smax]
+    .some((value) => legacyProtocols.has(value));
+  const fipsLegacyFailure = hasFIPS(3) &&
+    (expectedLegacyProtocol || (!proto && legacyOnlyConfiguration));
+
+  if (hasFIPS(3) && expectedLegacyProtocol) {
+    proto = undefined;
+  }
+
   let ciphers;
-  if (hasOpenSSL3 && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
+  if (hasOpenSSL(3) && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
       proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
       sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
     if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL')
@@ -65,6 +81,27 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
     console.log('test:', u(cmin), u(cmax), u(cprot), u(smin), u(smax), u(sprot),
                 u(ciphers), 'expect', u(proto), u(cerr), u(serr));
     console.log('  ', where);
+    if (fipsLegacyFailure) {
+      const errors = [pair.client.err, pair.server.err].filter(Boolean);
+      assert(errors.length > 0);
+      const expectedCodes = new Set([
+        'ERR_SSL_NO_PROTOCOLS_AVAILABLE',
+        'ERR_SSL_NO_SUITABLE_DIGEST_ALGORITHM',
+        'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE',
+        'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE',
+        'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION',
+        'ERR_SSL_UNEXPECTED_MESSAGE',
+        'ERR_SSL_UNSUPPORTED_PROTOCOL',
+        'ERR_SSL_VERSION_TOO_LOW',
+        'ERR_SSL_WRONG_VERSION_NUMBER',
+      ]);
+      if (hasFIPS(4))
+        expectedCodes.add('ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE');
+      for (const error of errors)
+        assert(expectedCodes.has(error.code), error);
+      return cleanup();
+    }
+
     if (!proto) {
       console.log('client', pair.client.err ? pair.client.err.code : undefined);
       console.log('server', pair.server.err ? pair.server.err.code : undefined);
@@ -139,9 +176,9 @@ test(U, U, 'TLS_method', U, U, 'TLSv1_method', 'TLSv1');
 
 // OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the
 // client) when no protocols are enabled on the server.
-const NO_PROTOCOLS_AVAILABLE_SERVER = hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER = hasOpenSSL(3) ?
   'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR';
-const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = hasOpenSSL(3) ?
   'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR';
 
 // SSLv23 also means "any supported protocol" greater than the default
diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js
index 0a9c6f108bf6..239cb8aec725 100644
--- a/test/parallel/test-tls-multi-key.js
+++ b/test/parallel/test-tls-multi-key.js
@@ -35,6 +35,7 @@ if (process.features.openssl_is_boringssl) {
 const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
+const { hasFIPS } = require('../common/crypto');
 
 // Key is ordered as ec, rsa, cert is ordered as rsa, ec.
 test({
@@ -143,6 +144,17 @@ test({
 });
 
 function test(options) {
+  if (hasFIPS(3) && options.pfx) {
+    const serverOptions = { ...options };
+    delete serverOptions.rsaCN;
+    delete serverOptions.eccCN;
+    delete serverOptions.client;
+    assert.throws(() => tls.createServer(serverOptions), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+    return;
+  }
+
   const rsaCN = options.rsaCN || 'agent1';
   const eccCN = options.eccCN || 'agent2';
   const clientTrustRoots = options.client.ca;
diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
index fec697cd3b70..b5bbb6decc12 100644
--- a/test/parallel/test-tls-multi-pfx.js
+++ b/test/parallel/test-tls-multi-pfx.js
@@ -10,9 +10,12 @@ if (process.features.openssl_is_boringssl) {
 
 const assert = require('assert');
 const tls = require('tls');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
+const fips4 = hasFIPS(4);
 
-const options = {
+const legacyOptions = {
   pfx: [
     {
       buf: fixtures.readKey('agent1.pfx'),
@@ -22,6 +25,40 @@ const options = {
   ]
 };
 
+if (fips3) {
+  assert.throws(() => tls.createServer(legacyOptions), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+
+  if (!hasFIPS(3, 5)) {
+    return;
+  }
+}
+
+const fipsPfx = [
+  {
+    buf: fixtures.readKey('agent1-fips.pfx'),
+    passphrase: 'password',
+  },
+  {
+    buf: fixtures.readKey('ec-fips.pfx'),
+    passphrase: 'password',
+  },
+];
+
+if (fips4) {
+  for (const { buf } of fipsPfx) {
+    assert.throws(() => tls.createServer({
+      pfx: buf,
+      passphrase: 'sample',
+    }), {
+      message: 'password strength too weak',
+    });
+  }
+}
+
+const options = fips3 ? { pfx: fipsPfx } : legacyOptions;
+
 const ciphers = [];
 
 const server = tls.createServer(options, function(conn) {
diff --git a/test/parallel/test-tls-passphrase.js b/test/parallel/test-tls-passphrase.js
index 4372da249bb5..1fe2c1ec11cf 100644
--- a/test/parallel/test-tls-passphrase.js
+++ b/test/parallel/test-tls-passphrase.js
@@ -26,6 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const tls = require('tls');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 const passKey = fixtures.readKey('rsa_private_encrypted.pem');
@@ -37,6 +38,33 @@ assert(Buffer.isBuffer(cert));
 assert.strictEqual(typeof passKey.toString(), 'string');
 assert.strictEqual(typeof cert.toString(), 'string');
 
+if (hasFIPS(3)) {
+  const encryptedKeyOptions = {
+    key: passKey,
+    passphrase: 'password',
+    cert,
+  };
+  assert.throws(() => tls.Server(encryptedKeyOptions), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+  assert.throws(() => tls.connect(encryptedKeyOptions), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+
+  const server = tls.Server({ key: rawKey, passphrase: 'ignored', cert });
+  server.listen(0, common.mustCall(function() {
+    const client = tls.connect({
+      port: this.address().port,
+      key: rawKey,
+      passphrase: 'ignored',
+      cert,
+      rejectUnauthorized: false,
+    }, common.mustCall(() => client.end()));
+    client.on('close', common.mustCall(() => server.close()));
+  }));
+  return;
+}
+
 function onSecureConnect() {
   return common.mustCall(function() { this.end(); });
 }
diff --git a/test/parallel/test-tls-pfx-authorizationerror.js b/test/parallel/test-tls-pfx-authorizationerror.js
index 53fcc0b16b5b..e115eea80fea 100644
--- a/test/parallel/test-tls-pfx-authorizationerror.js
+++ b/test/parallel/test-tls-pfx-authorizationerror.js
@@ -10,14 +10,38 @@ const fixtures = require('../common/fixtures');
 
 const assert = require('assert');
 const tls = require('tls');
+const { hasFIPS } = require('../common/crypto');
 
-const pfx = fixtures.readKey('agent1.pfx');
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips4 = hasFIPS(4);
+const pfx = fixtures.readKey(fips35 ? 'agent1-fips.pfx' : 'agent1.pfx');
+const passphrase = fips35 ? 'password' : 'sample';
+
+if (fips3) {
+  assert.throws(() => tls.createServer({
+    pfx: fixtures.readKey('agent1.pfx'),
+    passphrase: 'sample',
+  }), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+
+  if (!fips35) {
+    return;
+  }
+
+  if (fips4) {
+    assert.throws(() => tls.createServer({ pfx, passphrase: 'sample' }), {
+      message: 'password strength too weak',
+    });
+  }
+}
 
 const server = tls
   .createServer(
     {
       pfx: pfx,
-      passphrase: 'sample',
+      passphrase,
       requestCert: true,
       rejectUnauthorized: false
     },
@@ -33,7 +57,7 @@ const server = tls
       {
         port: this.address().port,
         pfx: pfx,
-        passphrase: 'sample',
+        passphrase,
         rejectUnauthorized: false
       },
       common.mustCall(() => {
diff --git a/test/parallel/test-tls-session-cache.js b/test/parallel/test-tls-session-cache.js
index ae560e567980..0789879e1dce 100644
--- a/test/parallel/test-tls-session-cache.js
+++ b/test/parallel/test-tls-session-cache.js
@@ -26,6 +26,7 @@ if (!common.hasCrypto) {
 }
 const {
   hasOpenSSL,
+  hasFIPS,
   opensslCli,
 } = require('../common/crypto');
 
@@ -59,7 +60,8 @@ function doTest(testOptions, callback) {
     secureProtocol: 'TLS_method',
     // BoringSSL supports the RSA cipher selector, but not OpenSSL's
     // cipher-string policy command syntax.
-    ciphers: isBoringSSL ? 'RSA' : 'RSA@SECLEVEL=0'
+    ciphers: hasFIPS(3) ? 'ECDHE-RSA-AES256-GCM-SHA384' :
+      (isBoringSSL ? 'RSA' : 'RSA@SECLEVEL=0')
   };
   let requestCount = 0;
   let resumeCount = 0;
@@ -108,8 +110,9 @@ function doTest(testOptions, callback) {
   server.listen(0, common.mustCall(function() {
     const args = [
       's_client',
-      isBoringSSL ? '-tls1_2' : '-tls1',
-      '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+      isBoringSSL || hasFIPS(3) ? '-tls1_2' : '-tls1',
+      '-cipher', hasFIPS(3) ? 'ECDHE-RSA-AES256-GCM-SHA384' :
+        (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
       '-connect', `localhost:${this.address().port}`,
       '-servername', 'ohgod',
       '-key', fixtures.path('keys/rsa_private.pem'),
diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
index 82a19bb9e90f..57fb35991121 100644
--- a/test/parallel/test-tls-set-ciphers.js
+++ b/test/parallel/test-tls-set-ciphers.js
@@ -6,10 +6,10 @@ if (!common.hasCrypto) {
 
 const {
   hasOpenSSL,
-  hasOpenSSL3,
+  hasFIPS,
 } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('missing crypto, or OpenSSL version lower than 3');
 }
 
@@ -96,57 +96,83 @@ if (hasOpenSSL(4, 0)) {
   expectedTLSAlertError = 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE';
 }
 
-// Have shared ciphers.
-test(U, 'AES256-SHA', 'AES256-SHA');
-test('AES256-SHA', U, 'AES256-SHA');
-
-test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
-test('TLS_AES_256_GCM_SHA384:!TLS_CHACHA20_POLY1305_SHA256', U, 'TLS_AES_256_GCM_SHA384');
-
-// Do not have shared ciphers.
-test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
-     U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
-
-test('AES256-SHA', 'AES256-SHA256', U, expectedTLSAlertError,
-     'ERR_SSL_NO_SHARED_CIPHER');
-test('AES256-SHA:TLS_AES_256_GCM_SHA384',
-     'TLS_CHACHA20_POLY1305_SHA256:AES256-SHA256',
-     U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
-
-// Cipher order ignored, TLS1.3 chosen before TLS1.2.
-test('AES256-SHA:TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
-test(U, 'AES256-SHA:TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-
-// Cipher order ignored, TLS1.3 before TLS1.2 and
-// cipher suites are not disabled if TLS ciphers are set only
-// TODO: maybe these tests should be reworked so maxVersion clamping
-// is done explicitly and not implicitly in the test() function
-test('AES256-SHA', U, 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
-test(U, 'AES256-SHA', 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
-
-// TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
-// default, but work.
-// However, for OpenSSL32 AES_128 is not enabled due to the
-// default security level
-if (!hasOpenSSL(3, 2)) {
-  test('TLS_AES_128_CCM_8_SHA256', U,
-       U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
-
-  test('TLS_AES_128_CCM_8_SHA256', 'TLS_AES_128_CCM_8_SHA256',
-       'TLS_AES_128_CCM_8_SHA256');
+if (hasFIPS(3)) {
+  const tls12Cipher = 'ECDHE-RSA-AES256-GCM-SHA384';
+
+  // FIPS-approved TLS 1.2 and TLS 1.3 cipher suites work.
+  test(U, tls12Cipher, tls12Cipher);
+  test(tls12Cipher, U, tls12Cipher);
+  test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+
+  // The FIPS provider rejects ChaCha20-Poly1305.
+  test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
+       U, expectedTLSAlertError, 'ERR_SSL_NO_CIPHERS_AVAILABLE');
+
+  // Invalid cipher values are still validated before provider selection.
+  test(9, tls12Cipher, U, 'ERR_INVALID_ARG_TYPE', U);
+  test(tls12Cipher, 9, U, U, 'ERR_INVALID_ARG_TYPE');
+  test(':', tls12Cipher, U, 'ERR_INVALID_ARG_VALUE', U);
+  test(tls12Cipher, ':', U, U, 'ERR_INVALID_ARG_VALUE');
+
+  // Empty and null values continue to select the defaults.
+  test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
+  test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test(null, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384', null, 'TLS_AES_256_GCM_SHA384');
+} else {
+  // Have shared ciphers.
+  test(U, 'AES256-SHA', 'AES256-SHA');
+  test('AES256-SHA', U, 'AES256-SHA');
+
+  test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384:!TLS_CHACHA20_POLY1305_SHA256', U, 'TLS_AES_256_GCM_SHA384');
+
+  // Do not have shared ciphers.
+  test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
+       U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
+
+  test('AES256-SHA', 'AES256-SHA256', U, expectedTLSAlertError,
+       'ERR_SSL_NO_SHARED_CIPHER');
+  test('AES256-SHA:TLS_AES_256_GCM_SHA384',
+       'TLS_CHACHA20_POLY1305_SHA256:AES256-SHA256',
+       U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
+
+  // Cipher order ignored, TLS1.3 chosen before TLS1.2.
+  test('AES256-SHA:TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+  test(U, 'AES256-SHA:TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+
+  // Cipher order ignored, TLS1.3 before TLS1.2 and
+  // cipher suites are not disabled if TLS ciphers are set only
+  // TODO: maybe these tests should be reworked so maxVersion clamping
+  // is done explicitly and not implicitly in the test() function
+  test('AES256-SHA', U, 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
+  test(U, 'AES256-SHA', 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
+
+  // TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
+  // default, but work.
+  // However, for OpenSSL32 AES_128 is not enabled due to the
+  // default security level
+  if (!hasOpenSSL(3, 2)) {
+    test('TLS_AES_128_CCM_8_SHA256', U,
+         U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
+
+    test('TLS_AES_128_CCM_8_SHA256', 'TLS_AES_128_CCM_8_SHA256',
+         'TLS_AES_128_CCM_8_SHA256');
+  }
+
+  // Invalid cipher values
+  test(9, 'AES256-SHA', U, 'ERR_INVALID_ARG_TYPE', U);
+  test('AES256-SHA', 9, U, U, 'ERR_INVALID_ARG_TYPE');
+  test(':', 'AES256-SHA', U, 'ERR_INVALID_ARG_VALUE', U);
+  test('AES256-SHA', ':', U, U, 'ERR_INVALID_ARG_VALUE');
+
+  // Using '' is synonymous for "use default ciphers"
+  test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
+  test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+
+  // Using null should be treated the same as undefined.
+  test(null, 'AES256-SHA', 'AES256-SHA');
+  test('AES256-SHA', null, 'AES256-SHA');
 }
-
-// Invalid cipher values
-test(9, 'AES256-SHA', U, 'ERR_INVALID_ARG_TYPE', U);
-test('AES256-SHA', 9, U, U, 'ERR_INVALID_ARG_TYPE');
-test(':', 'AES256-SHA', U, 'ERR_INVALID_ARG_VALUE', U);
-test('AES256-SHA', ':', U, U, 'ERR_INVALID_ARG_VALUE');
-
-// Using '' is synonymous for "use default ciphers"
-test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
-test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-
-// Using null should be treated the same as undefined.
-test(null, 'AES256-SHA', 'AES256-SHA');
-test('AES256-SHA', null, 'AES256-SHA');
diff --git a/test/parallel/test-tls-write-error.js b/test/parallel/test-tls-write-error.js
index 8a8d820a09cc..f6ec7b9bd245 100644
--- a/test/parallel/test-tls-write-error.js
+++ b/test/parallel/test-tls-write-error.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto)
 
 const { TestTLSSocket, ccs } = require('../common/tls');
 const fixtures = require('../common/fixtures');
+const assert = require('assert');
 const https = require('https');
+const { hasFIPS } = require('../common/crypto');
 
 // Regression test for an use-after-free bug in the TLS implementation that
 // would occur when `SSL_write()` failed.
@@ -18,6 +20,7 @@ const opts = {
   key: server_key,
   cert: server_cert,
 };
+const rejectsClientHello = hasFIPS(3) && !hasFIPS(3, 5);
 
 if (!process.features.openssl_is_boringssl) {
   opts.ciphers = 'ALL@SECLEVEL=0';
@@ -25,7 +28,15 @@ if (!process.features.openssl_is_boringssl) {
 
 const server = https.createServer(opts, (req, res) => {
   res.write('hello');
-}).listen(0, common.mustCall(() => {
+});
+
+if (rejectsClientHello) {
+  server.once('tlsClientError', common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ERR_SSL_WRONG_SIGNATURE_TYPE');
+  }));
+}
+
+server.listen(0, common.mustCall(() => {
   const client = new TestTLSSocket(server_cert);
 
   client.connect({
@@ -37,6 +48,12 @@ const server = https.createServer(opts, (req, res) => {
   }));
 
   client.once('data', common.mustCall((buf) => {
+    if (rejectsClientHello) {
+      client.end();
+      server.close();
+      return;
+    }
+
     let remaining = buf;
     do {
       remaining = client.parseTLSFrame(remaining);
diff --git a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
index 316d706e7b79..5960c46f8aa8 100644
--- a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
+++ b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
@@ -6,10 +6,17 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
 
-async function test(algorithmName, keyLength, ivLength, format = 'raw') {
+async function test(
+  algorithmName,
+  keyLength,
+  ivLength,
+  format = 'raw',
+  causeCode,
+) {
   const key = await subtle.importKey(
     format,
     new Uint8Array(keyLength),
@@ -21,19 +28,40 @@ async function test(algorithmName, keyLength, ivLength, format = 'raw') {
   const data = new Uint8Array(32);
   data.buffer.transfer();
 
+  const expected = causeCode === undefined ?
+    { name: 'OperationError' } :
+    (err) => err.name === 'OperationError' &&
+             err.cause?.code === causeCode;
   await assert.rejects(
     subtle.decrypt({ name: algorithmName, iv: new Uint8Array(ivLength) }, key, data),
-    { name: 'OperationError' },
+    expected,
   );
 }
 
 const tests = [
   test('AES-GCM', 32, 12),
-  test('ChaCha20-Poly1305', 32, 12, 'raw-secret'),
 ];
 
+if (fips3) {
+  tests.push(assert.rejects(
+    subtle.importKey(
+      'raw-secret',
+      new Uint8Array(32),
+      'ChaCha20-Poly1305',
+      false,
+      ['encrypt', 'decrypt']),
+    { name: 'NotSupportedError' }));
+} else {
+  tests.push(test('ChaCha20-Poly1305', 32, 12, 'raw-secret'));
+}
+
 if (hasOpenSSL(3)) {
-  tests.push(test('AES-OCB', 32, 12, 'raw-secret'));
+  tests.push(test(
+    'AES-OCB',
+    32,
+    12,
+    'raw-secret',
+    fips3 ? 'ERR_OSSL_EVP_UNSUPPORTED' : undefined));
 }
 
 Promise.all(tests).then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-constructors.js b/test/parallel/test-webcrypto-constructors.js
index 782265edc294..3d13b6c92bba 100644
--- a/test/parallel/test-webcrypto-constructors.js
+++ b/test/parallel/test-webcrypto-constructors.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips4 = hasFIPS(4);
 
 // Test CryptoKey constructor
 {
@@ -152,19 +154,41 @@ const notSubtle = Reflect.construct(function() {}, [], SubtleCrypto);
 }
 
 {
-  subtle.importKey(
-    'raw',
-    globalThis.crypto.getRandomValues(new Uint8Array(4)),
-    'PBKDF2',
-    false,
-    ['deriveKey'],
-  ).then((key) => {
+  const keyData = globalThis.crypto.getRandomValues(
+    new Uint8Array(fips4 ? 8 : 4));
+  const importedKeys = [
+    subtle.importKey('raw', keyData, 'PBKDF2', false, ['deriveKey']),
+  ];
+  if (fips4) {
+    importedKeys.push(
+      subtle.importKey(
+        'raw',
+        globalThis.crypto.getRandomValues(new Uint8Array(4)),
+        'PBKDF2',
+        false,
+        ['deriveKey']));
+  }
+
+  Promise.all(importedKeys).then(async ([key, weakKey]) => {
     subtle.importKey = common.mustNotCall();
-    return subtle.deriveKey({
+    if (fips4) {
+      await assert.rejects(subtle.deriveKey({
+        name: 'PBKDF2',
+        hash: 'SHA-512',
+        salt: new Uint8Array(),
+        iterations: 5,
+      }, weakKey, {
+        name: 'AES-GCM',
+        length: 256,
+      }, true, ['encrypt', 'decrypt']), { name: 'OperationError' });
+    }
+
+    await subtle.deriveKey({
       name: 'PBKDF2',
       hash: 'SHA-512',
-      salt: globalThis.crypto.getRandomValues(new Uint8Array()),
-      iterations: 5,
+      salt: globalThis.crypto.getRandomValues(
+        new Uint8Array(fips4 ? 16 : 0)),
+      iterations: fips4 ? 1000 : 5,
     }, key, {
       name: 'AES-GCM',
       length: 256
diff --git a/test/parallel/test-webcrypto-cryptokey-hidden-slots.js b/test/parallel/test-webcrypto-cryptokey-hidden-slots.js
index 792a1a59c4c5..75b977073dab 100644
--- a/test/parallel/test-webcrypto-cryptokey-hidden-slots.js
+++ b/test/parallel/test-webcrypto-cryptokey-hidden-slots.js
@@ -22,6 +22,7 @@ if (!common.hasCrypto)
 const assert = require('node:assert');
 const {
   createHmac,
+  getFips,
   KeyObject,
   sign: cryptoSign,
   verify: cryptoVerify,
@@ -50,7 +51,7 @@ common.expectWarning({
   const { publicKey: rsaPublicKey } = await subtle.generateKey(
     {
       name: 'RSA-PSS',
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256',
     },
diff --git a/test/parallel/test-webcrypto-deduplicate-usages.js b/test/parallel/test-webcrypto-deduplicate-usages.js
index 70b35f6cfa38..d27675d873ce 100644
--- a/test/parallel/test-webcrypto-deduplicate-usages.js
+++ b/test/parallel/test-webcrypto-deduplicate-usages.js
@@ -13,7 +13,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const { createSecretKey } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function assertSameSet(actual, expected, msg) {
@@ -50,6 +50,10 @@ function assertSameSet(actual, expected, msg) {
       expected: ['encrypt', 'decrypt', 'wrapKey', 'unwrapKey'] },
   ];
 
+  if (hasFIPS(3))
+    symmetric.splice(symmetric.findIndex(({ algorithm }) =>
+      algorithm.name === 'ChaCha20-Poly1305'), 1);
+
   if (hasOpenSSL(3)) {
     symmetric.push({
       algorithm: { name: 'AES-OCB', length: 128 },
@@ -107,6 +111,10 @@ function assertSameSet(actual, expected, msg) {
       privateExpected: ['deriveKey', 'deriveBits'] },
   ];
 
+  if (hasFIPS(3))
+    asymmetric.splice(asymmetric.findIndex(({ algorithm }) =>
+      algorithm.name === 'X25519'), 1);
+
   if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
     asymmetric.push({
       algorithm: { name: 'ML-DSA-65' },
@@ -336,12 +344,17 @@ function assertSameSet(actual, expected, msg) {
 
   // ChaCha20-Poly1305 raw-secret import.
   tests.push((async () => {
-    const key = await subtle.importKey(
+    const imported = subtle.importKey(
       'raw-secret',
       new Uint8Array(32),
       { name: 'ChaCha20-Poly1305' },
       true,
       ['decrypt', 'encrypt', 'decrypt', 'encrypt']);
+    if (hasFIPS(3)) {
+      await assert.rejects(imported, { name: 'NotSupportedError' });
+      return;
+    }
+    const key = await imported;
     assertSameSet(key.usages, ['encrypt', 'decrypt']);
     assert.strictEqual(key.usages.length, 2);
   })());
@@ -491,6 +504,10 @@ function assertSameSet(actual, expected, msg) {
       privateExpected: ['deriveKey', 'deriveBits'] },
   ];
 
+  if (hasFIPS(3))
+    jwkPairVectors.splice(jwkPairVectors.findIndex(({ algorithm }) =>
+      algorithm.name === 'X25519'), 1);
+
   if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
     jwkPairVectors.push({
       algorithm: { name: 'ML-DSA-65' },
diff --git a/test/parallel/test-webcrypto-derivebits-argon2.js b/test/parallel/test-webcrypto-derivebits-argon2.js
index e2b465ab206b..129b716c5919 100644
--- a/test/parallel/test-webcrypto-derivebits-argon2.js
+++ b/test/parallel/test-webcrypto-derivebits-argon2.js
@@ -5,10 +5,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
+if (hasFIPS(3))
+  common.skip('Argon2 is not available in FIPS mode');
 
 const assert = require('assert');
 const { createSecretKey } = require('crypto');
diff --git a/test/parallel/test-webcrypto-derivebits-cfrg.js b/test/parallel/test-webcrypto-derivebits-cfrg.js
index 757c81272536..fae39ac89c5e 100644
--- a/test/parallel/test-webcrypto-derivebits-cfrg.js
+++ b/test/parallel/test-webcrypto-derivebits-cfrg.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const kTests = [
   {
@@ -77,6 +79,15 @@ async function prepareKeys() {
     Object.keys(keys).map(async (name) => {
       const { size, result, privateKey, publicKey } = keys[name];
 
+      if (rejectsXCurves) {
+        await assert.rejects(
+          subtle.deriveBits({ name, public: publicKey }, privateKey, 8 * size),
+          (err) => err.name === 'OperationError' &&
+                   err.cause?.code ===
+                     'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE');
+        return;
+      }
+
       {
         // Good parameters
         const bits = await subtle.deriveBits({
diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js
index 50892be7400e..6ef2227ab2d2 100644
--- a/test/parallel/test-webcrypto-derivebits.js
+++ b/test/parallel/test-webcrypto-derivebits.js
@@ -7,7 +7,11 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const requiresLongHkdfInputs = hasFIPS(3) && !hasFIPS(3, 5);
+const rejectsWeakPbkdf2Inputs = hasFIPS(4);
+const rejectsXCurves = hasFIPS(3, 5);
 
 // This is only a partial test. The WebCrypto Web Platform Tests
 // will provide much greater coverage.
@@ -56,12 +60,20 @@ const { subtle } = globalThis.crypto;
   }
 
   const kTests = [
-    ['hello', 'there', 'my friend', 'SHA-256', 512,
-     '14d93b0ccd99d4f2cbd9fbfe9c830b5b8a43e3e45e329' +
-     '41ef21bdeb0fa87b6b6bfa5c54466aa5bf76cdc2685fb' +
-     'a4408ea5b94c049fe035649b46f92fdc519374'],
-    ['hello', 'there', 'my friend', 'SHA-384', 128,
-     'e36cf2cf943d8f3a88adb80f478745c3'],
+    [requiresLongHkdfInputs ? 'hello hello hello' : 'hello',
+     'there', requiresLongHkdfInputs ? 'my friend indeed' : 'my friend',
+     'SHA-256', 512,
+     requiresLongHkdfInputs ?
+       'bc2b7841512a6f4563f723c317909ac305ddbfbdec1daf0055d0587b5db8d635' +
+       'a22f97b0dfbcc12dcd2d096123385227b16e95e5bccc0d6751491f38c5e48428' :
+       '14d93b0ccd99d4f2cbd9fbfe9c830b5b8a43e3e45e329' +
+       '41ef21bdeb0fa87b6b6bfa5c54466aa5bf76cdc2685fb' +
+       'a4408ea5b94c049fe035649b46f92fdc519374'],
+    [requiresLongHkdfInputs ? 'hello hello hello' : 'hello',
+     'there', requiresLongHkdfInputs ? 'my friend indeed' : 'my friend',
+     'SHA-384', 128,
+     requiresLongHkdfInputs ? 'ee2d1d7dc759c26f2ab8ee6d7cfa0c23' :
+       'e36cf2cf943d8f3a88adb80f478745c3'],
   ];
 
   const tests = Promise.all(kTests.map((args) => test(...args)));
@@ -88,17 +100,24 @@ const { subtle } = globalThis.crypto;
   }
 
   const kTests = [
-    ['hello', 'there', 10, 'SHA-256', 512,
-     'f72d1cf4853fffbd16a42751765d11f8dc7939498ee7b7' +
-     'ce7678b4cb16fad88098110a83e71f4483ce73203f7a64' +
-     '719d293280f780f9fafdcf46925c5c0588b3'],
-    ['hello', 'there', 5, 'SHA-384', 128,
-     '201509b012c9cd2fbe7ea938f0c509b3'],
+    ['password', 'there there here', 1000, 'SHA-256', 512,
+     '8802c34ee684a523f9304a6335394c0a5f02350d51383d' +
+     '17d3cf89fa0808591ddede3c832fe4691c7f361ade53b9' +
+     '36bf94347055bcf86fd662abe038fb945d17'],
+    ['password', 'there there here', 2000, 'SHA-384', 128,
+     '7c650b88798cea1a390802a6f97e05b0'],
   ];
 
   const tests = Promise.all(kTests.map((args) => test(...args)));
 
   tests.then(common.mustCall());
+
+  if (rejectsWeakPbkdf2Inputs) {
+    assert.rejects(
+      test('hello', 'there', 10, 'SHA-256', 512),
+      { name: 'OperationError' })
+      .then(common.mustCall());
+  }
 }
 
 // Test X25519 and X448 bit derivation
@@ -123,10 +142,20 @@ const { subtle } = globalThis.crypto;
     assert.deepStrictEqual(secret1, secret2);
   }
 
-  test('X25519').then(common.mustCall());
-  if (!process.features.openssl_is_boringssl) {
-    test('X448').then(common.mustCall());
+  if (rejectsXCurves) {
+    for (const name of ['X25519', 'X448']) {
+      assert.rejects(
+        test(name),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED')
+        .then(common.mustCall());
+    }
   } else {
-    common.printSkipMessage('Skipping unsupported X448 test case');
+    test('X25519').then(common.mustCall());
+    if (!process.features.openssl_is_boringssl) {
+      test('X448').then(common.mustCall());
+    } else {
+      common.printSkipMessage('Skipping unsupported X448 test case');
+    }
   }
 }
diff --git a/test/parallel/test-webcrypto-derivekey-cfrg.js b/test/parallel/test-webcrypto-derivekey-cfrg.js
index c5a5b1f3518f..13c4e56ce5b0 100644
--- a/test/parallel/test-webcrypto-derivekey-cfrg.js
+++ b/test/parallel/test-webcrypto-derivekey-cfrg.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const kTests = [
   {
@@ -80,6 +82,15 @@ async function prepareKeys() {
     Object.keys(keys).map(async (name) => {
       const { result, privateKey, publicKey } = keys[name];
 
+      if (rejectsXCurves) {
+        await assert.rejects(
+          subtle.deriveKey({ name, public: publicKey }, privateKey, ...otherArgs),
+          (err) => err.name === 'OperationError' &&
+                   err.cause?.code ===
+                     'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE');
+        return;
+      }
+
       {
         // Good parameters
         const key = await subtle.deriveKey({
diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
index f9323bca2caf..75f43bf8a9ae 100644
--- a/test/parallel/test-webcrypto-derivekey.js
+++ b/test/parallel/test-webcrypto-derivekey.js
@@ -5,11 +5,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
 const { KeyObject } = require('crypto');
+const rejectsXCurves = hasFIPS(3, 5);
+const fips4 = hasFIPS(4);
 
 // This is only a partial test. The WebCrypto Web Platform Tests
 // will provide much greater coverage.
@@ -74,24 +76,24 @@ const { KeyObject } = require('crypto');
   }
 
   const kTests = [
-    ['hello', 'there', 'my friend', 'SHA-1',
-     '365ca5d3f42d050c74302e420c83975327950f1913a151eecd00526bf52614a0'],
-    ['hello', 'there', 'my friend', 'SHA-256',
-     '14d93b0ccd99d4f2cbd9fbfe9c830b5b8a43e3e45e32941ef21bdeb0fa87b6b6'],
-    ['hello', 'there', 'my friend', 'SHA-384',
-     'e36cf2cf943d8f3a88adb80f478745c336ac811b1a86d03a7d10eb0b6b52295c'],
-    ['hello', 'there', 'my friend', 'SHA-512',
-     '1e42d43fcacba361716f65853bd5f3c479f679612f0180eab3c51ed6c9d2b47d'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-1',
+     'aac1ecdc73147af6a418393da6875bff5f566c0a473e25d54b4dfc3cb7cb2ace'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-256',
+     'bc2b7841512a6f4563f723c317909ac305ddbfbdec1daf0055d0587b5db8d635'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-384',
+     'ee2d1d7dc759c26f2ab8ee6d7cfa0c2313e82650a4514673c867063dc1849040'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-512',
+     'a7abd704d0be364c6d4a530b6f93fcaff95474a2eee5a127ff86c5d095a2a812'],
   ];
 
   if (!process.features.openssl_is_boringssl) {
     kTests.push(
-      ['hello', 'there', 'my friend', 'SHA3-256',
-       '2a49a3b6fb219117af9e251c6c65f16600cbca13bd0be6e70d96b0b9fa4cf3fd'],
-      ['hello', 'there', 'my friend', 'SHA3-384',
-       '0437bb59b95f2db2c7684c0b439028cb0fdd6f0f5d03b9f489066a87ae147221'],
-      ['hello', 'there', 'my friend', 'SHA3-512',
-       '3bbc469d38214371921e52c6f147e96cb7eb370421a81f53dea8b4851dfb8bce'],
+      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-256',
+       '89b3751df2ada85322a57ec82f7d0a5c233c6def91c92e681bc5118bd5768dca'],
+      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-384',
+       'b4fa7b9929a595bbaa370eb959b194c1232d5a329abd02a5fa166a1424962fcf'],
+      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-512',
+       'ac5d90a6bc848961e78a491887539b29c532a9c0d0b39cec464df071a63e0061'],
     );
   } else {
     common.printSkipMessage('Skipping unsupported SHA-3 test cases');
@@ -127,30 +129,36 @@ const { KeyObject } = require('crypto');
   }
 
   const kTests = [
-    ['hello', 'there', 5, 'SHA-1',
-     'f8f65a5fd92c9b74916083a7e9b0001c46bc89e2a14c48014cf1e0e1dbabf635'],
-    ['hello', 'there', 5, 'SHA-256',
-     '2e575eae24267db32106c7dba01615e5417557e8c5cf33ba15a311cb0c2907ee'],
-    ['hello', 'there', 5, 'SHA-384',
-     '201509b012c9cd2fbe7ea938f0c509b36ecb140f38bf9130e96923f55f46756d'],
-    ['hello', 'there', 5, 'SHA-512',
-     '2e8d981741f98193e0af9c79870af0e985089341221edad9a130d297eae1984b'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-1',
+     'b747604ca226287ccae90d8d8c119645a80d1154625a56b2debb3f9b172eb134'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-256',
+     '3cc64f6cfcbdb9c42b63b471016f17d1966b70934b4719a12ce95382940252f2'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-384',
+     '5ce64241beef3a3931dbfac6eef7303b5bdbea13449d4eeb4f89c3e9f9357c65'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-512',
+     '12790ce09027db067d680670f4dc704715b5120d139e8fde810afc34fb66f9f1'],
   ];
 
   if (!process.features.openssl_is_boringssl) {
     kTests.push(
-      ['hello', 'there', 5, 'SHA3-256',
-       '0aed29b61b3ca3978aea34a9793276574ea997b69e8d03727438199f90571649'],
-      ['hello', 'there', 5, 'SHA3-384',
-       '7aa4a274aa19b4623c5d3091c4b06355de85ff6f25e53a83e3126cbb86ae68df'],
-      ['hello', 'there', 5, 'SHA3-512',
-       '4d909c47a81c625f866d1f9406248e6bc3c7ea89225fbccf1f08820254c9ef56']
+      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-256',
+       '0f69b46660cba27b95215d5676492c64ed6abf6d426669a4a02b0ca3a1c36c11'],
+      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-384',
+       'a2e86a2d4cdf9844d70ae37f71302356ce2b9a899f5d778fc9af64d32e351d70'],
+      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-512',
+       '03431052c37d626ae3fc1df582ff2a4d610642fc27e1b8130ca5980c0b0756ac']
     );
   } else {
     common.printSkipMessage('Skipping unsupported SHA-3 test cases');
   }
 
-  const tests = Promise.all(kTests.map((args) => test(...args)));
+  const promises = kTests.map((args) => test(...args));
+  if (fips4) {
+    promises.push(assert.rejects(
+      test('hello', 'there', 5, 'SHA-256', ''),
+      { name: 'OperationError' }));
+  }
+  const tests = Promise.all(promises);
 
   tests.then(common.mustCall());
 }
@@ -254,8 +262,18 @@ const { KeyObject } = require('crypto');
   (async () => {
     for (const [derivedKeyAlgorithm, usage, expected] of vectors) {
       const derived = await subtle.deriveKey(
-        { name: 'PBKDF2', salt: new Uint8Array([]), hash: 'SHA-256', iterations: 20 },
-        await subtle.importKey('raw', new Uint8Array([]), { name: 'PBKDF2' }, false, ['deriveKey']),
+        {
+          name: 'PBKDF2',
+          salt: new Uint8Array(16),
+          hash: 'SHA-256',
+          iterations: 1000,
+        },
+        await subtle.importKey(
+          'raw',
+          new Uint8Array(8),
+          { name: 'PBKDF2' },
+          false,
+          ['deriveKey']),
         derivedKeyAlgorithm,
         false,
         [usage]);
@@ -271,17 +289,27 @@ if (hasOpenSSL(3)) {
     const usages = ['sign'];
     for (const [algorithm, baseKeyAlgorithm] of [
       [
-        { name: 'HKDF', salt: new Uint8Array(), info: new Uint8Array(), hash: 'SHA-256' },
+        {
+          name: 'HKDF',
+          salt: new Uint8Array(16),
+          info: new Uint8Array(),
+          hash: 'SHA-256',
+        },
         { name: 'HKDF' },
       ],
       [
-        { name: 'PBKDF2', salt: new Uint8Array(), hash: 'SHA-256', iterations: 20 },
+        {
+          name: 'PBKDF2',
+          salt: new Uint8Array(16),
+          hash: 'SHA-256',
+          iterations: 1000,
+        },
         { name: 'PBKDF2' },
       ],
     ]) {
       const baseKey = await subtle.importKey(
         'raw',
-        new Uint8Array(),
+        new Uint8Array(baseKeyAlgorithm.name === 'HKDF' ? 16 : 8),
         baseKeyAlgorithm,
         false,
         ['deriveKey']);
@@ -293,11 +321,15 @@ if (hasOpenSSL(3)) {
         usages);
       assert.strictEqual(derived.algorithm.length, 0);
 
-      const signature = await subtle.sign({
+      const signature = subtle.sign({
         name: 'KMAC128',
         outputLength: 256,
       }, derived, new Uint8Array());
-      assert.strictEqual(signature.byteLength, 32);
+      if (fips4) {
+        await assert.rejects(signature, { name: 'OperationError' });
+      } else {
+        assert.strictEqual((await signature).byteLength, 32);
+      }
     }
   })().then(common.mustCall());
 }
@@ -333,10 +365,20 @@ if (hasOpenSSL(3)) {
     assert.deepStrictEqual(raw1, raw2);
   }
 
-  test('X25519').then(common.mustCall());
-  if (!process.features.openssl_is_boringssl) {
-    test('X448').then(common.mustCall());
+  if (rejectsXCurves) {
+    for (const name of ['X25519', 'X448']) {
+      assert.rejects(
+        test(name),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED')
+        .then(common.mustCall());
+    }
   } else {
-    common.printSkipMessage('Skipping unsupported X448 test case');
+    test('X25519').then(common.mustCall());
+    if (!process.features.openssl_is_boringssl) {
+      test('X448').then(common.mustCall());
+    } else {
+      common.printSkipMessage('Skipping unsupported X448 test case');
+    }
   }
 }
diff --git a/test/parallel/test-webcrypto-digest.js b/test/parallel/test-webcrypto-digest.js
index 8e1b6797ee86..447948212bc1 100644
--- a/test/parallel/test-webcrypto-digest.js
+++ b/test/parallel/test-webcrypto-digest.js
@@ -9,7 +9,8 @@ const assert = require('assert');
 const { Buffer } = require('buffer');
 const { subtle } = globalThis.crypto;
 const { createHash, getHashes } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const fips4 = hasFIPS(4);
 
 const kTests = [
   ['SHA-1', ['sha1'], 160],
@@ -397,18 +398,35 @@ if (getHashes().includes('shake128')) {
                   'ca6f88db415829',
       },
     ]) {
-      assert.strictEqual(
-        Buffer.from(await subtle.digest(algorithm, data)).toString('hex'),
-        expected);
+      const digest = subtle.digest(algorithm, data);
+      if (fips4) {
+        await assert.rejects(
+          digest,
+          (err) => err.name === 'OperationError' &&
+                   err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+      } else {
+        assert.strictEqual(
+          Buffer.from(await digest).toString('hex'),
+          expected);
+      }
     }
 
-    const truncated = Buffer.from(await subtle.digest(
+    const truncatedDigest = subtle.digest(
       { ...nistCShakeSample1.algorithm, outputLength: 255 },
-      nistCShakeSample1.data));
-    const expected = Buffer.from(nistCShakeSample1.expected, 'hex');
-    assert.strictEqual(truncated.byteLength, expected.byteLength);
-    assert.deepStrictEqual(truncated.subarray(0, 31), expected.subarray(0, 31));
-    assert.strictEqual(truncated[31] & 0b00000001, 0);
-    assert.strictEqual(truncated[31] | 0b00000001, expected[31]);
+      nistCShakeSample1.data);
+    if (fips4) {
+      await assert.rejects(
+        truncatedDigest,
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+    } else {
+      const truncated = Buffer.from(await truncatedDigest);
+      const expected = Buffer.from(nistCShakeSample1.expected, 'hex');
+      assert.strictEqual(truncated.byteLength, expected.byteLength);
+      assert.deepStrictEqual(
+        truncated.subarray(0, 31), expected.subarray(0, 31));
+      assert.strictEqual(truncated[31] & 0b00000001, 0);
+      assert.strictEqual(truncated[31] | 0b00000001, expected[31]);
+    }
   })().then(common.mustCall());
 }
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
index d7a7dca6584c..00c294839bfe 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
@@ -8,6 +8,7 @@ if (!common.hasCrypto)
 const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 async function testEncrypt({ keyBuffer, algorithm, plaintext, result }) {
@@ -237,6 +238,14 @@ if (hasOpenSSL(3)) {
   } = require('../fixtures/crypto/aes_ocb')();
 
   (async function() {
+    if (getFips() === 1) {
+      await assert.rejects(
+        testEncrypt(passing[0]),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+
     const variations = [];
 
     passing.forEach((vector) => {
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js b/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js
index 723fd26ea570..45225115fd52 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js
@@ -6,8 +6,19 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
+if (hasFIPS(3)) {
+  assert.rejects(
+    subtle.generateKey(
+      { name: 'ChaCha20-Poly1305' },
+      false,
+      ['encrypt', 'decrypt']),
+    { name: 'NotSupportedError' }).then(common.mustCall());
+  return;
+}
+
 async function testEncrypt({ keyBuffer, algorithm, plaintext, result }) {
   // Using a copy of plaintext to prevent tampering of the original
   plaintext = Buffer.from(plaintext);
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt.js b/test/parallel/test-webcrypto-encrypt-decrypt.js
index c4ca52862fe0..1015752a8b0a 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt.js
@@ -7,6 +7,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const { hasOpenSSL } = require('../common/crypto');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 // This is only a partial test. The WebCrypto Web Platform Tests
@@ -207,7 +208,15 @@ if (hasOpenSSL(3)) {
       Buffer.from(buf).toString('hex'));
   }
 
-  test().then(common.mustCall());
+  if (getFips() === 1) {
+    assert.rejects(
+      test(),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED')
+      .then(common.mustCall());
+  } else {
+    test().then(common.mustCall());
+  }
 } else {
   common.printSkipMessage('Skipping unsupported AES-OCB test cases');
 }
diff --git a/test/parallel/test-webcrypto-export-import-cfrg.js b/test/parallel/test-webcrypto-export-import-cfrg.js
index 14f475fc1779..0ff7c61bdc68 100644
--- a/test/parallel/test-webcrypto-export-import-cfrg.js
+++ b/test/parallel/test-webcrypto-export-import-cfrg.js
@@ -8,7 +8,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const keyData = {
   'Ed25519': {
@@ -413,9 +415,19 @@ async function testImportRaw({ name, publicUsages }) {
     for (const extractable of [true, false]) {
       tests.push(testImportSpki(vector, extractable));
       tests.push(testImportPkcs8(vector, extractable));
-      tests.push(testImportJwk(vector, extractable));
+      if (rejectsXCurves && vector.name.startsWith('X')) {
+        tests.push(assert.rejects(
+          testImportJwk(vector, extractable),
+          { name: 'DataError' }));
+      } else {
+        tests.push(testImportJwk(vector, extractable));
+      }
+    }
+    if (rejectsXCurves && vector.name.startsWith('X')) {
+      tests.push(assert.rejects(testImportRaw(vector), { name: 'DataError' }));
+    } else {
+      tests.push(testImportRaw(vector));
     }
-    tests.push(testImportRaw(vector));
   }
   await Promise.all(tests);
 })().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js
index c7399c69d9c9..9f6b2125d8ed 100644
--- a/test/parallel/test-webcrypto-export-import.js
+++ b/test/parallel/test-webcrypto-export-import.js
@@ -10,7 +10,12 @@ const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
-const { createPrivateKey, createPublicKey, createSecretKey } = require('crypto');
+const {
+  createPrivateKey,
+  createPublicKey,
+  createSecretKey,
+  getFips,
+} = require('crypto');
 
 {
   async function test() {
@@ -397,7 +402,7 @@ if (hasOpenSSL(3)) {
   async function test() {
     const { publicKey, privateKey } = await subtle.generateKey({
       name: 'RSA-PSS',
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-384'
     }, true, ['sign', 'verify']);
diff --git a/test/parallel/test-webcrypto-get-public-key.mjs b/test/parallel/test-webcrypto-get-public-key.mjs
index 622ec4adca68..65e3cb5334d9 100644
--- a/test/parallel/test-webcrypto-get-public-key.mjs
+++ b/test/parallel/test-webcrypto-get-public-key.mjs
@@ -9,8 +9,10 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { kSupportedAlgorithms } = require('internal/crypto/util');
+const { hasFIPS } = require('../common/crypto');
 const { SubtleCrypto } = globalThis;
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,
@@ -80,6 +82,15 @@ for (const name of Object.keys(kSupportedAlgorithms.exportKey)) {
 
   assert.strictEqual(SubtleCrypto.supports('getPublicKey', name), true);
 
+  if (rejectsXCurves &&
+      (name === 'X25519' || name === 'X448')) {
+    await assert.rejects(
+      subtle.generateKey(test.algorithm, false, test.privateUsages),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+    continue;
+  }
+
   const { privateKey } = await subtle.generateKey(
     test.algorithm, false, test.privateUsages);
   const usages = test.publicUsages;
diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js
index 989fdbb47616..6ea2579ae041 100644
--- a/test/parallel/test-webcrypto-keygen.js
+++ b/test/parallel/test-webcrypto-keygen.js
@@ -6,15 +6,18 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const assert = require('assert');
 const { types: { isCryptoKey } } = require('util');
 const {
   createSecretKey,
+  getFips,
   KeyObject,
 } = require('crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
 
 const { bigIntArrayToUnsignedBigInt } = require('internal/crypto/util');
 
@@ -69,7 +72,7 @@ const vectors = {
   },
   'RSASSA-PKCS1-v1_5': {
     algorithm: {
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     },
@@ -81,7 +84,7 @@ const vectors = {
   },
   'RSA-PSS': {
     algorithm: {
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     },
@@ -93,7 +96,7 @@ const vectors = {
   },
   'RSA-OAEP': {
     algorithm: {
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     },
@@ -247,6 +250,21 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 // Test bad usages
 {
   async function test(name) {
+    if (fips3 && name === 'ChaCha20-Poly1305') {
+      await assert.rejects(
+        subtle.generateKey({ name }, true, []),
+        { name: 'NotSupportedError' });
+      return;
+    }
+
+    if (fips35 && (name === 'X25519' || name === 'X448')) {
+      await assert.rejects(
+        subtle.generateKey({ name }, true, ['deriveBits']),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+
     await assert.rejects(
       subtle.generateKey(
         {
@@ -453,7 +471,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   const kTests = [
     [
       'RSASSA-PKCS1-v1_5',
-      1024,
+      getFips() === 1 ? 2048 : 1024,
       Buffer.from([1, 0, 1]),
       'SHA-1',
       ['sign'],
@@ -461,7 +479,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
     ],
     [
       'RSA-PSS',
-      1024,
+      getFips() === 1 ? 2048 : 1024,
       Buffer.from([1, 0, 1]),
       'SHA-256',
       ['sign'],
@@ -470,22 +488,37 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   ];
 
 
+  let fipsExponentTest;
   if (!process.features.openssl_is_boringssl) {
-    kTests.push(
-      [
-        'RSA-OAEP',
-        1024,
-        Buffer.from([3]),
-        'SHA3-256',
-        ['decrypt', 'unwrapKey'],
-        ['encrypt', 'wrapKey'],
-      ],
-    );
+    if (fips3) {
+      fipsExponentTest = assert.rejects(
+        subtle.generateKey({
+          name: 'RSA-OAEP',
+          modulusLength: 2048,
+          publicExponent: Buffer.from([3]),
+          hash: 'SHA3-256',
+        }, true, ['decrypt', 'unwrapKey', 'encrypt', 'wrapKey']),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.code === 'ERR_OSSL_RSA_PUB_EXPONENT_OUT_OF_RANGE');
+    } else {
+      kTests.push(
+        [
+          'RSA-OAEP',
+          1024,
+          Buffer.from([3]),
+          'SHA3-256',
+          ['decrypt', 'unwrapKey'],
+          ['encrypt', 'wrapKey'],
+        ],
+      );
+    }
   } else {
     common.printSkipMessage('Skipping unsupported SHA-3 test case');
   }
 
   const tests = kTests.map((args) => test(...args));
+  if (fipsExponentTest !== undefined)
+    tests.push(fipsExponentTest);
 
   Promise.all(tests).then(common.mustCall());
 }
@@ -706,6 +739,13 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
 
 // Test OKP Key Generation
 {
+  async function testFipsUnsupported(name) {
+    await assert.rejects(
+      subtle.generateKey({ name }, true, ['deriveKey', 'deriveBits']),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+  }
+
   async function test(
     name,
     privateUsages,
@@ -770,7 +810,12 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
     common.printSkipMessage('Skipping unsupported Curve448 test cases');
   }
 
-  const tests = kTests.map((args) => test(...args));
+  const tests = kTests.map((args) => {
+    const [name] = args;
+    if (fips35 && (name === 'X25519' || name === 'X448'))
+      return testFipsUnsupported(name);
+    return test(...args);
+  });
 
   Promise.all(tests).then(common.mustCall());
 }
diff --git a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
index 5c13561dc260..6d8a3fa3df9f 100644
--- a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
@@ -24,7 +24,21 @@ if (!common.hasCrypto) common.skip('missing crypto');
 
 const require = createRequire(import.meta.url);
 const { kSupportedAlgorithms } = require('internal/crypto/util');
+const { getFips } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips4 = hasFIPS(4);
+const fips35UnavailableKeyGeneration = new Set([
+  'X25519',
+  'X448',
+]);
+const fips3UnavailableDerivation = new Set([
+  'Argon2d',
+  'Argon2i',
+  'Argon2id',
+]);
 
 Promise.prototype.then = common.mustNotCall('Promise.prototype.then');
 
@@ -333,7 +347,7 @@ function algorithm(name, params = {}) {
 
 function rsaAlgorithm(name) {
   return algorithm(name, {
-    modulusLength: 1024,
+    modulusLength: getFips() === 1 ? 2048 : 1024,
     publicExponent: new Uint8Array([1, 0, 1]),
     hash: 'SHA-256',
   });
@@ -877,8 +891,8 @@ for (const name of ['HKDF', 'PBKDF2']) {
       }) :
       algorithm(name, {
         hash: 'SHA-256',
-        salt: new Uint8Array(8),
-        iterations: 1,
+        salt: new Uint8Array(fips4 ? 16 : 8),
+        iterations: fips4 ? 1000 : 1,
       }),
   }));
 }
@@ -1029,6 +1043,24 @@ for (const [name, operations] of supportedAlgorithms) {
   assert(fixture, `missing prototype pollution fixture for ${name}`);
 
   const ctx = { __proto__: null };
+  if (fips3 && fips3UnavailableDerivation.has(name)) {
+    await fixture.importKey(ctx);
+    await assert.rejects(
+      fixture.deriveBits(ctx),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+    continue;
+  }
+  if ((fips3 && name === 'ChaCha20-Poly1305') ||
+      (fips35 && fips35UnavailableKeyGeneration.has(name))) {
+    const expected = name === 'ChaCha20-Poly1305' ?
+      { name: 'NotSupportedError' } :
+      (err) => err.name === 'OperationError' &&
+               err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED';
+    await assert.rejects(fixture.generateKey(ctx), expected);
+    continue;
+  }
+
   for (const operation of operationOrder) {
     if (!operations.has(operation))
       continue;
@@ -1036,7 +1068,17 @@ for (const [name, operations] of supportedAlgorithms) {
       typeof fixture[operation],
       'function',
       `missing prototype pollution coverage for ${name} ${operation}`);
-    await fixture[operation](ctx);
+    if (fips3 && name === 'AES-OCB' &&
+        (operation === 'encrypt' || operation === 'decrypt')) {
+      if (operation === 'decrypt')
+        ctx.ciphertext = new Uint8Array();
+      await assert.rejects(
+        fixture[operation](ctx),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+    } else {
+      await fixture[operation](ctx);
+    }
   }
 
   if (typeof fixture.getPublicKey === 'function' &&
@@ -1074,17 +1116,22 @@ for (const name of getKeyLengthAlgorithms) {
     continue;
   }
 
-  await assertCryptoKeyResult(`get key length ${name}`, () =>
+  const deriveKey = () => assertCryptoKeyResult(`get key length ${name}`, () =>
     subtle.deriveKey(
       algorithm('PBKDF2', {
         hash: 'SHA-256',
-        salt: new Uint8Array(8),
-        iterations: 1,
+        salt: new Uint8Array(fips4 ? 16 : 8),
+        iterations: fips4 ? 1000 : 1,
       }),
       pbkdf2Key,
       target.algorithm,
       true,
       target.usages));
+  if (fips3 && name === 'ChaCha20-Poly1305') {
+    await assert.rejects(deriveKey(), { name: 'NotSupportedError' });
+  } else {
+    await deriveKey();
+  }
 }
 
 // Keep one explicit unwrapKey('jwk') negative case: the parsed object must not
diff --git a/test/parallel/test-webcrypto-raw-format-aliases.js b/test/parallel/test-webcrypto-raw-format-aliases.js
index 94e9474fde13..c9a0e8a4cf48 100644
--- a/test/parallel/test-webcrypto-raw-format-aliases.js
+++ b/test/parallel/test-webcrypto-raw-format-aliases.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 function getAlgorithmName(algorithm) {
   return typeof algorithm === 'string' ? algorithm : algorithm.name;
@@ -50,7 +52,7 @@ async function assertPublicKeyDoesNotAcceptRawSecret(
     importUsages);
 }
 
-Promise.all([
+const tests = [
   assertSecretKeyDoesNotAcceptRawPublic('HKDF'),
   assertSecretKeyDoesNotAcceptRawPublic('PBKDF2'),
   assertPublicKeyDoesNotAcceptRawSecret(
@@ -65,8 +67,18 @@ Promise.all([
     'Ed25519',
     ['sign', 'verify'],
     ['verify']),
-  assertPublicKeyDoesNotAcceptRawSecret(
+];
+
+if (rejectsXCurves) {
+  tests.push(assert.rejects(
+    subtle.generateKey('X25519', true, ['deriveBits']),
+    (err) => err.name === 'OperationError' &&
+             err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED'));
+} else {
+  tests.push(assertPublicKeyDoesNotAcceptRawSecret(
     'X25519',
     ['deriveBits'],
-    []),
-]).then(common.mustCall());
+    []));
+}
+
+Promise.all(tests).then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-sign-verify-ecdsa.js b/test/parallel/test-webcrypto-sign-verify-ecdsa.js
index eb7814efa556..94e3eff02eb9 100644
--- a/test/parallel/test-webcrypto-sign-verify-ecdsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-ecdsa.js
@@ -6,7 +6,10 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsSha1Signing = hasFIPS(3) && !hasFIPS(3, 5);
 
 const vectors = require('../fixtures/crypto/ecdsa')();
 
@@ -50,7 +53,7 @@ async function testVerify({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -173,7 +176,7 @@ async function testSign({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -229,6 +232,32 @@ async function testSign({ name,
 
   for (let i = 0; i < vectors.length; ++i) {
     const vector = vectors[i];
+    if (rejectsSha1Signing && vector.hash === 'SHA-1') {
+      const publicKey = await subtle.importKey(
+        'spki',
+        vector.publicKeyBuffer,
+        { name: vector.name, namedCurve: vector.namedCurve },
+        false,
+        ['verify']);
+      const privateKey = await subtle.importKey(
+        'pkcs8',
+        vector.privateKeyBuffer,
+        { name: vector.name, namedCurve: vector.namedCurve },
+        false,
+        ['sign']);
+      assert(await subtle.verify(
+        { name: vector.name, hash: vector.hash },
+        publicKey,
+        vector.signature,
+        vector.plaintext));
+      await assert.rejects(
+        subtle.sign(
+          { name: vector.name, hash: vector.hash },
+          privateKey,
+          vector.plaintext),
+        { name: 'OperationError' });
+      continue;
+    }
     variations.push(testVerify(vector));
     variations.push(testSign(vector));
   }
diff --git a/test/parallel/test-webcrypto-sign-verify-eddsa.js b/test/parallel/test-webcrypto-sign-verify-eddsa.js
index 3c40139754be..ad587a1220e0 100644
--- a/test/parallel/test-webcrypto-sign-verify-eddsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-eddsa.js
@@ -92,7 +92,7 @@ async function testVerify({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -219,7 +219,7 @@ async function testSign({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
diff --git a/test/parallel/test-webcrypto-sign-verify-hmac.js b/test/parallel/test-webcrypto-sign-verify-hmac.js
index ac3841fad79a..bbe5dd498109 100644
--- a/test/parallel/test-webcrypto-sign-verify-hmac.js
+++ b/test/parallel/test-webcrypto-sign-verify-hmac.js
@@ -6,6 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 const vectors = require('../fixtures/crypto/hmac')();
@@ -35,7 +36,7 @@ async function testVerify({ hash,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -126,7 +127,7 @@ async function testSign({ hash,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
diff --git a/test/parallel/test-webcrypto-sign-verify-kmac.js b/test/parallel/test-webcrypto-sign-verify-kmac.js
index f93fc293b2a4..160067b9b760 100644
--- a/test/parallel/test-webcrypto-sign-verify-kmac.js
+++ b/test/parallel/test-webcrypto-sign-verify-kmac.js
@@ -5,16 +5,29 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3))
   common.skip('requires OpenSSL >= 3');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
+const fips4 = hasFIPS(4);
 
 const vectors = require('../fixtures/crypto/kmac')();
 
+function isFipsUnsupported(err) {
+  return err.name === 'OperationError' &&
+    err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED';
+}
+
+function isFips4Incompatible({ key, keyLength, outputLength }) {
+  const keyLengthInBits = keyLength ?? key.byteLength * 8;
+  return keyLengthInBits < 128 ||
+    keyLengthInBits % 8 !== 0 ||
+    outputLength % 8 !== 0;
+}
+
 async function testVerify({ algorithm,
                             key,
                             keyLength,
@@ -193,8 +206,13 @@ async function testSign({ algorithm,
   const variations = [];
 
   for (const vector of vectors) {
-    variations.push(testVerify(vector));
-    variations.push(testSign(vector));
+    if (fips4 && isFips4Incompatible(vector)) {
+      variations.push(assert.rejects(testVerify(vector), isFipsUnsupported));
+      variations.push(assert.rejects(testSign(vector), isFipsUnsupported));
+    } else {
+      variations.push(testVerify(vector));
+      variations.push(testSign(vector));
+    }
   }
 
   await Promise.all(variations);
@@ -209,25 +227,47 @@ async function testSign({ algorithm,
     ['sign', 'verify']);
   const algorithm = {
     name: 'KMAC128',
-    outputLength: 9,
+    outputLength: fips4 ? 16 : 9,
     customization: new Uint8Array(),
   };
   const data = new Uint8Array([1, 2, 3]);
 
+  if (fips4) {
+    await assert.rejects(
+      subtle.sign({ ...algorithm, outputLength: 9 }, key, data),
+      isFipsUnsupported);
+  }
+
   const signature = await subtle.sign(algorithm, key, data);
   assert.strictEqual(signature.byteLength, 2);
-  assert.strictEqual(new Uint8Array(signature)[1] & 0b01111111, 0);
+  if (!fips4)
+    assert.strictEqual(new Uint8Array(signature)[1] & 0b01111111, 0);
   assert(await subtle.verify(algorithm, key, signature, data));
 
-  const signature16 = new Uint8Array(await subtle.sign({
-    ...algorithm,
-    outputLength: 16,
-  }, key, data));
-  signature16[1] &= 0b10000000;
-  assert.notDeepStrictEqual(new Uint8Array(signature), signature16);
+  if (fips4) {
+    const signature128 = await subtle.sign({
+      ...algorithm,
+      outputLength: 128,
+    }, key, data);
+    assert.strictEqual(signature128.byteLength, 16);
+    assert(await subtle.verify({
+      ...algorithm,
+      outputLength: 128,
+    }, key, signature128, data));
+  } else {
+    const signature16 = new Uint8Array(await subtle.sign({
+      ...algorithm,
+      outputLength: 16,
+    }, key, data));
+    signature16[1] &= 0b10000000;
+    assert.notDeepStrictEqual(new Uint8Array(signature), signature16);
+  }
 
   const invalidSignature = new Uint8Array(signature);
-  invalidSignature[1] |= 0b00000001;
+  if (fips4)
+    invalidSignature[0] ^= 0b00000001;
+  else
+    invalidSignature[1] |= 0b00000001;
   assert(!(await subtle.verify(algorithm, key, invalidSignature, data)));
 
   const nonByteKey = await subtle.importKey(
@@ -236,15 +276,20 @@ async function testSign({ algorithm,
     { name: 'KMAC128', length: 25 },
     false,
     ['sign', 'verify']);
-  const nonByteKeySignature = await subtle.sign({
+  const nonByteKeySignature = subtle.sign({
     ...algorithm,
     outputLength: 16,
   }, nonByteKey, data);
-  assert.strictEqual(nonByteKeySignature.byteLength, 2);
-  assert(await subtle.verify({
-    ...algorithm,
-    outputLength: 16,
-  }, nonByteKey, nonByteKeySignature, data));
+  if (fips4) {
+    await assert.rejects(nonByteKeySignature, isFipsUnsupported);
+  } else {
+    const result = await nonByteKeySignature;
+    assert.strictEqual(result.byteLength, 2);
+    assert(await subtle.verify({
+      ...algorithm,
+      outputLength: 16,
+    }, nonByteKey, result, data));
+  }
 })().then(common.mustCall());
 
 (async function() {
@@ -265,9 +310,14 @@ async function testSign({ algorithm,
       assert.strictEqual(key.algorithm.length, keyData.byteLength * 8);
 
       const algorithm = { name, outputLength: 256 };
-      const signature = await subtle.sign(algorithm, key, data);
-      assert.strictEqual(signature.byteLength, 32);
-      assert(await subtle.verify(algorithm, key, signature, data));
+      const signature = subtle.sign(algorithm, key, data);
+      if (fips4) {
+        await assert.rejects(signature, isFipsUnsupported);
+      } else {
+        const result = await signature;
+        assert.strictEqual(result.byteLength, 32);
+        assert(await subtle.verify(algorithm, key, result, data));
+      }
     }
   }
 })().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
index b11e65ade791..67c85f92e4e2 100644
--- a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
@@ -43,7 +43,7 @@ async function testVerify({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -156,7 +156,7 @@ async function testSign({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
index 0ccbf431f147..3e706941595d 100644
--- a/test/parallel/test-webcrypto-sign-verify-rsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
@@ -6,7 +6,10 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
+const rejectsSha1Signing = hasFIPS(3) && !hasFIPS(3, 5);
 
 const rsa_pkcs = require('../fixtures/crypto/rsa_pkcs');
 const rsa_pss = require('../fixtures/crypto/rsa_pss');
@@ -194,6 +197,23 @@ async function testSign({
     });
 }
 
+async function testFipsSignRejected({
+  algorithm,
+  hash,
+  privateKeyBuffer,
+  plaintext,
+}) {
+  const privateKey = await subtle.importKey(
+    'pkcs8',
+    privateKeyBuffer,
+    { name: algorithm.name, hash },
+    false,
+    ['sign']);
+  await assert.rejects(
+    subtle.sign(algorithm, privateKey, plaintext),
+    { name: 'OperationError' });
+}
+
 async function testSaltLength(keyLength, hash, hLen) {
   const { publicKey, privateKey } = await subtle.generateKey({
     name: 'RSA-PSS',
@@ -205,7 +225,8 @@ async function testSaltLength(keyLength, hash, hLen) {
   const data = Buffer.from('Hello, world!');
   const max = keyLength / 8 - hLen - 2;
 
-  const signature = await subtle.sign({ name: 'RSA-PSS', saltLength: max }, privateKey, data);
+  const signature = await subtle.sign(
+    { name: 'RSA-PSS', saltLength: max }, privateKey, data);
   await assert.rejects(
     subtle.sign({ name: 'RSA-PSS', saltLength: max + 1 }, privateKey, data), (err) => {
       assert.strictEqual(err.name, 'OperationError');
@@ -213,7 +234,8 @@ async function testSaltLength(keyLength, hash, hLen) {
       assert.strictEqual(err.cause?.message, `The value of "algorithm.saltLength" is out of range. It must be >= 0 && <= ${max}. Received ${max + 1}`);
       return true;
     });
-  await subtle.verify({ name: 'RSA-PSS', saltLength: max }, publicKey, signature, data);
+  await subtle.verify(
+    { name: 'RSA-PSS', saltLength: max }, publicKey, signature, data);
   await assert.rejects(
     subtle.verify({ name: 'RSA-PSS', saltLength: max + 1 }, publicKey, signature, data), (err) => {
       assert.strictEqual(err.name, 'OperationError');
@@ -228,14 +250,28 @@ async function testSaltLength(keyLength, hash, hLen) {
 
   rsa_pkcs().forEach((vector) => {
     variations.push(testVerify(vector));
-    variations.push(testSign(vector));
+    variations.push(rejectsSha1Signing && vector.hash === 'SHA-1' ?
+      testFipsSignRejected(vector) : testSign(vector));
   });
   rsa_pss().forEach((vector) => {
     variations.push(testVerify(vector));
-    variations.push(testSign(vector));
+    variations.push(rejectsSha1Signing && vector.hash === 'SHA-1' ?
+      testFipsSignRejected(vector) : testSign(vector));
   });
 
-  for (const keyLength of [1024, 2048]) {
+  if (fips3) {
+    variations.push(assert.rejects(
+      subtle.generateKey({
+        name: 'RSA-PSS',
+        modulusLength: 1024,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash: 'SHA-256',
+      }, false, ['sign', 'verify']),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.code === 'ERR_OSSL_RSA_INVALID_MODULUS'));
+  }
+
+  for (const keyLength of fips3 ? [2048] : [1024, 2048]) {
     for (const [hash, hLen] of [
       ['SHA-1', 20],
       ['SHA-256', 32],
@@ -247,6 +283,8 @@ async function testSaltLength(keyLength, hash, hLen) {
         ['SHA3-512', 64],
       ] : []),
     ]) {
+      if (rejectsSha1Signing && hash === 'SHA-1')
+        continue;
       variations.push(testSaltLength(keyLength, hash, hLen));
     }
   }
diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js
index 0a6f5cffe7b9..db6c9e093872 100644
--- a/test/parallel/test-webcrypto-sign-verify.js
+++ b/test/parallel/test-webcrypto-sign-verify.js
@@ -8,6 +8,7 @@ if (!common.hasCrypto)
 const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 // This is only a partial test. The WebCrypto Web Platform Tests
@@ -19,7 +20,7 @@ const { subtle } = globalThis.crypto;
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
       name: 'RSASSA-PKCS1-v1_5',
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     }, true, ['sign', 'verify']);
diff --git a/test/parallel/test-webcrypto-supports.mjs b/test/parallel/test-webcrypto-supports.mjs
index 43d3ee03c8bc..2bc9d589b478 100644
--- a/test/parallel/test-webcrypto-supports.mjs
+++ b/test/parallel/test-webcrypto-supports.mjs
@@ -4,6 +4,11 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 import * as assert from 'node:assert';
+import { hasFIPS } from '../common/crypto.js';
+
+if (hasFIPS(3))
+  common.skip('SubtleCrypto.supports() does not reflect FIPS provider availability');
+
 const { SubtleCrypto } = globalThis;
 
 const sources = [
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index 18ba6dc37963..342eae0859e4 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -5,10 +5,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
 
 const kWrappingData = {
   'RSA-OAEP': {
@@ -35,7 +38,7 @@ const kWrappingData = {
     wrap: {
       iv: new Uint8Array(16),
       additionalData: new Uint8Array(16),
-      tagLength: 64
+      tagLength: fips3 ? 128 : 64
     },
     pair: false
   },
@@ -54,7 +57,10 @@ const kWrappingData = {
   }
 };
 
-if (hasOpenSSL(3)) {
+if (fips3)
+  delete kWrappingData['ChaCha20-Poly1305'];
+
+if (hasOpenSSL(3) && !fips3) {
   kWrappingData['AES-OCB'] = {
     generate: { length: 128 },
     wrap: {
@@ -87,7 +93,7 @@ async function generateKeysToWrap() {
     {
       algorithm: {
         name: 'RSASSA-PKCS1-v1_5',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256'
       },
@@ -98,7 +104,7 @@ async function generateKeysToWrap() {
     {
       algorithm: {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256'
       },
@@ -109,7 +115,7 @@ async function generateKeysToWrap() {
     {
       algorithm: {
         name: 'RSA-OAEP',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256'
       },
@@ -234,6 +240,20 @@ async function generateKeysToWrap() {
     common.printSkipMessage('Skipping unsupported Curve test cases');
   }
 
+  if (fips3) {
+    const unsupported = new Set([
+      'ChaCha20-Poly1305',
+    ]);
+    if (fips35) {
+      unsupported.add('X25519');
+      unsupported.add('X448');
+    }
+    for (let i = parameters.length - 1; i >= 0; --i) {
+      if (unsupported.has(parameters[i].algorithm.name))
+        parameters.splice(i, 1);
+    }
+  }
+
   const allkeys = await Promise.all(parameters.map(async (params) => {
     const usages = 'usages' in params ?
       params.usages :
@@ -360,6 +380,37 @@ function testWrapping(name, keys) {
 }
 
 (async function() {
+  if (fips3) {
+    await assert.rejects(
+      subtle.generateKey(
+        { name: 'ChaCha20-Poly1305' }, true, ['wrapKey']),
+      { name: 'NotSupportedError' });
+
+    if (fips35) {
+      for (const name of ['X25519', 'X448']) {
+        await assert.rejects(
+          subtle.generateKey({ name }, true, ['deriveBits']),
+          (err) => err.name === 'OperationError' &&
+                   err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+      }
+    }
+
+    const wrappingKey = await subtle.generateKey(
+      { name: 'AES-OCB', length: 128 }, true, ['wrapKey']);
+    const key = await subtle.generateKey(
+      { name: 'HMAC', hash: 'SHA-256', length: 256 },
+      true,
+      ['sign']);
+    await assert.rejects(
+      subtle.wrapKey(
+        'raw',
+        key,
+        wrappingKey,
+        { name: 'AES-OCB', iv: new Uint8Array(15), tagLength: 128 }),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
+  }
+
   await generateWrappingKeys();
   const keys = await generateKeysToWrap();
   const variations = [];
diff --git a/test/pummel/test-crypto-argon2-nonblocking-constructor.js b/test/pummel/test-crypto-argon2-nonblocking-constructor.js
index 37cb5363d43c..4e0ff50c3fa3 100644
--- a/test/pummel/test-crypto-argon2-nonblocking-constructor.js
+++ b/test/pummel/test-crypto-argon2-nonblocking-constructor.js
@@ -4,10 +4,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
+if (hasFIPS(3))
+  common.skip('Argon2 is not available in FIPS mode');
 
 // Regression test for https://github.com/nodejs/node/issues/62861.
 // `AdditionalConfig` used to invoke the full Argon2 KDF synchronously inside
diff --git a/test/pummel/test-crypto-dh-keys.js b/test/pummel/test-crypto-dh-keys.js
index 8aa1e30e354f..824628732a55 100644
--- a/test/pummel/test-crypto-dh-keys.js
+++ b/test/pummel/test-crypto-dh-keys.js
@@ -32,11 +32,21 @@ if (common.isPi()) {
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17']) {
   // modp1 is 768 bits, FIPS requires >= 1024.
   // BoringSSL does not support modp1 or modp2.
-  if ((name === 'modp1' && crypto.getFips()) ||
+  if (hasFIPS(3) && ['modp1', 'modp2', 'modp5'].includes(name)) {
+    const parameters = crypto.getDiffieHellman(name);
+    const group = crypto.createDiffieHellman(
+      parameters.getPrime(), parameters.getGenerator());
+    assert.throws(() => group.generateKeys(), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+    continue;
+  }
+  if ((name === 'modp1' && crypto.getFips() === 1) ||
       (process.features.openssl_is_boringssl &&
        (name === 'modp1' || name === 'modp2'))) {
     common.printSkipMessage(`Skipping unsupported ${name} test case`);
diff --git a/test/pummel/test-dh-regr.js b/test/pummel/test-dh-regr.js
index 961bea3246fb..c442fbc3a809 100644
--- a/test/pummel/test-dh-regr.js
+++ b/test/pummel/test-dh-regr.js
@@ -32,15 +32,30 @@ if (common.isPi()) {
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
-// FIPS requires length >= 1024 but we use 512/256 in this test to keep it from
-// taking too long and timing out in CI.
-const length = crypto.getFips() ? 1024 : hasOpenSSL3 ? 512 : 256;
+let p;
+let iterations = 2000;
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+    name: 'TypeError',
+  });
 
-const p = crypto.createDiffieHellman(length).getPrime();
+  // Use a precomputed approved group instead of generating a 2048-bit prime
+  // for every test run. Its larger keys also make each pummel iteration more
+  // expensive, so use enough iterations to exercise the regression without
+  // making the FIPS job excessively slow.
+  p = crypto.getDiffieHellman('modp14').getPrime();
+  iterations = 100;
+} else {
+  // FIPS requires length >= 1024, but small parameters keep this pummel test
+  // from timing out in ordinary CI.
+  const length = crypto.getFips() === 1 ? 1024 : (hasOpenSSL(3) ? 512 : 256);
+  p = crypto.createDiffieHellman(length).getPrime();
+}
 
-for (let i = 0; i < 2000; i++) {
+for (let i = 0; i < iterations; i++) {
   const a = crypto.createDiffieHellman(p);
   const b = crypto.createDiffieHellman(p);
 
diff --git a/test/pummel/test-webcrypto-derivebits-pbkdf2.js b/test/pummel/test-webcrypto-derivebits-pbkdf2.js
index bfb01ac0c94f..9e6cdcad8ab0 100644
--- a/test/pummel/test-webcrypto-derivebits-pbkdf2.js
+++ b/test/pummel/test-webcrypto-derivebits-pbkdf2.js
@@ -11,7 +11,9 @@ if (common.isPi()) {
 }
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips4 = hasFIPS(4);
 
 function getDeriveKeyInfo(name, length, hash, ...usages) {
   return [{ name, length, hash }, usages];
@@ -632,6 +634,19 @@ async function testWrongKeyType(
         Object.keys(kDerivations[size][saltSize][hash])
           .forEach((iterations) => {
             const args = [baseKeys, size, saltSize, hash, iterations | 0];
+            if (fips4 &&
+                (size === 'empty' || saltSize !== 'long' || iterations < 1000)) {
+              variations.push(assert.rejects(
+                testDeriveBits(...args), { name: 'OperationError' }));
+              kDerivedKeyTypes.forEach((keyType) => {
+                const keyArgs = getDeriveKeyInfo(...keyType);
+                variations.push(assert.rejects(
+                  testDeriveKey(...args, ...keyArgs),
+                  { name: 'OperationError' }));
+              });
+              return;
+            }
+
             variations.push(testDeriveBits(...args));
             variations.push(testDeriveBitsBadLengths(...args));
             variations.push(testDeriveBitsBadHash(...args));
@@ -674,12 +689,17 @@ async function testWrongKeyType(
 
 // https://github.com/w3c/webcrypto/pull/380
 {
-  crypto.subtle.importKey('raw', new Uint8Array(0), 'PBKDF2', false, ['deriveBits']).then((key) => {
+  crypto.subtle.importKey(
+    'raw',
+    new Uint8Array(fips4 ? 8 : 0),
+    'PBKDF2',
+    false,
+    ['deriveBits']).then((key) => {
     return crypto.subtle.deriveBits({
       name: 'PBKDF2',
       hash: { name: 'SHA-256' },
-      iterations: 10,
-      salt: new Uint8Array(0),
+      iterations: fips4 ? 1000 : 10,
+      salt: new Uint8Array(fips4 ? 16 : 0),
     }, key, 0);
   }).then((bits) => {
     assert.deepStrictEqual(bits, new ArrayBuffer(0));
diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
index 5db4a7763158..ef48f457a878 100644
--- a/test/sequential/test-async-wrap-getasyncid.js
+++ b/test/sequential/test-async-wrap-getasyncid.js
@@ -139,6 +139,7 @@ function testInitialized(req, ctor_name) {
 
 if (common.hasCrypto) { // eslint-disable-line node-core/crypto-check
   const crypto = require('crypto');
+  const { hasFIPS } = require('../common/crypto');
 
   // The handle for PBKDF2 and RandomBytes isn't returned by the function call,
   // so need to check it from the callback.
@@ -152,7 +153,8 @@ if (common.hasCrypto) { // eslint-disable-line node-core/crypto-check
     testInitialized(this, 'RandomBytesJob');
   }));
 
-  if (typeof internalBinding('crypto').ScryptJob === 'function') {
+  if (typeof internalBinding('crypto').ScryptJob === 'function' &&
+      !hasFIPS(3)) {
     crypto.scrypt('password', 'salt', 8, common.mustCall(function() {
       testInitialized(this, 'ScryptJob');
     }));
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index 8ec27109eeca..8dfd37b33b34 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -1,14 +1,20 @@
 'use strict';
 
-const { hasOpenSSL } = require('../../common/crypto.js');
+const {
+  hasOpenSSL,
+  hasFIPS,
+} = require('../../common/crypto.js');
 
 const conditionalFileSkips = {};
 const conditionalSubtestSkips = {};
 
 function skip(...files) {
   for (const file of files) {
+    const provider = process.features.openssl_is_boringssl ?
+      'BoringSSL' :
+      `OpenSSL ${process.versions.openssl}${hasFIPS(3) ? ' FIPS mode' : ''}`;
     conditionalFileSkips[file] = {
-      'skip': 'Unsupported in ' + (process.features.openssl_is_boringssl ? 'BoringSSL' : `OpenSSL ${process.versions.openssl}`),
+      'skip': `Unsupported in ${provider}`,
     };
   }
 }
@@ -37,7 +43,7 @@ if (!hasOpenSSL(3, 0)) {
     'sign_verify/kmac.tentative.https.any.js');
 }
 
-if (!hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2) || hasFIPS(3)) {
   skip(
     'derive_bits_keys/argon2.tentative.https.any.js',
     'import_export/Argon2_importKey.tentative.https.any.js');
@@ -91,6 +97,80 @@ if (process.features.openssl_is_boringssl) {
     ['supports-modern.tentative.https.any.js', /ml-kem-512/i]);
 }
 
+if (hasFIPS(3)) {
+  skip(
+    'encrypt_decrypt/aes_ocb.tentative.https.any.js',
+    'encrypt_decrypt/chacha20_poly1305.tentative.https.any.js',
+    'generateKey/failures_chacha20_poly1305.tentative.https.any.js',
+    'generateKey/successes_chacha20_poly1305.tentative.https.any.js',
+    'import_export/ChaCha20-Poly1305_importKey.tentative.https.any.js',
+    'serialization/chacha20-poly1305.tentative.https.any.js');
+
+  skipSubtests(
+    [
+      'supports-modern.tentative.https.any.js',
+      /(?:ChaCha20-Poly1305|^supports returns (?:true|false) for algorithm objects with (?:valid|invalid) parameters$)/,
+    ],
+    [
+      'wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js',
+      /(?=.*(?:RSASSA-PKCS1-v1_5|RSA-PSS|RSA-OAEP) private key)(?=.*non-extractable)/,
+    ]);
+}
+
+// OpenSSL 3.0 through 3.3 reject SHA-1 signature generation in FIPS mode.
+// OpenSSL 3.4 permits it for legacy use cases while marking the operation as
+// non-approved through a per-operation FIPS indicator. Node does not expose
+// that indicator, so the round-trip tests succeed.
+if (hasFIPS(3) && !hasOpenSSL(3, 4)) {
+  skipSubtests(
+    ['sign_verify/ecdsa.https.any.js', /with SHA-1.*round trip$/],
+    ['sign_verify/rsa_pkcs.https.any.js', /with SHA-1.*round trip$/],
+    ['sign_verify/rsa_pss.https.any.js', /with SHA-1.*round trip$/]);
+}
+
+if (hasFIPS(3, 5)) {
+  skip(
+    'derive_bits_keys/cfrg_curves_bits_curve25519.https.any.js',
+    'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js',
+    'derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js',
+    'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',
+    'generateKey/successes_X25519.https.any.js',
+    'generateKey/successes_X448.tentative.https.any.js',
+    'import_export/okp_importKey_X25519.https.any.js',
+    'import_export/okp_importKey_X448.tentative.https.any.js',
+    'import_export/okp_importKey_failures_X25519.https.any.js',
+    'import_export/okp_importKey_failures_X448.tentative.https.any.js',
+    'serialization/x25519.https.any.js',
+    'serialization/x448.tentative.https.any.js');
+
+  skipSubtests(
+    [
+      'derive_bits_keys/derived_bits_length.https.any.js',
+      /^X25519 derivation/,
+    ],
+    ['getPublicKey.tentative.https.any.js', /(?:X25519|X448)/],
+    [
+      'import_export/raw_format_aliases.tentative.https.any.js',
+      /(?:X25519|X448)/,
+    ],
+    [
+      'supports.tentative.https.any.js',
+      /(?:X25519|^deriveKey promise tests$)/,
+    ],
+    [
+      'wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js',
+      /(?=.*(?:X25519|X448))(?=.*(?:jwk|as non-extractable using pkcs8))/,
+    ]);
+}
+
+if (hasFIPS(4)) {
+  skipSubtests(
+    [
+      'derive_bits_keys/pbkdf2.https.any.js',
+      /(?:empty password|(?:short|empty) salt|with 1 iterations)/,
+    ]);
+}
+
 skipSubtests(
   ['digest/kangarootwelve.tentative.https.any.js', /C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2}) bytes/]);
 
diff --git a/test/wpt/test-webcrypto.js b/test/wpt/test-webcrypto.js
index 0d53a51901bb..0828047b3799 100644
--- a/test/wpt/test-webcrypto.js
+++ b/test/wpt/test-webcrypto.js
@@ -4,10 +4,38 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { join } = require('node:path');
+const { hasFIPS } = require('../common/crypto');
 const { WPTRunner } = require('../common/wpt');
 
 const runner = new WPTRunner('WebCryptoAPI');
 
 runner.pretendGlobalThisAs('Window');
 
+if (hasFIPS(3, 5)) {
+  const supportsFile = join(
+    'WebCryptoAPI',
+    'supports.tentative.https.any.js');
+  const eagerX25519Key = `    deriveBitsParams: {
+      name: 'X25519',
+      public: crypto.subtle.generateKey('X25519', false, ['deriveBits']),
+    },`;
+  const unavailableX25519Key = `    deriveBitsParams: {
+      name: 'X25519',
+      public: undefined,
+    },`;
+  runner.setScriptModifier((script) => {
+    if (!script.filename.endsWith(supportsFile))
+      return;
+
+    const fragments = script.code.split(eagerX25519Key);
+    if (fragments.length !== 2) {
+      throw new Error(
+        `Expected exactly one eager X25519 key in ${script.filename}; ` +
+        `found ${fragments.length - 1}`);
+    }
+    script.code = fragments.join(unavailableX25519Key);
+  });
+}
+
 runner.runJsTests();

From 66ee4792bfbfa71335f747ceae116c8d98aa74a2 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 11 Aug 2026 21:34:34 +0200
Subject: [PATCH 145/344] crypto: disable non-FIPS WebCrypto paths in FIPS mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hide TurboSHAKE and KangarooTwelve when FIPS is enabled. Reject cSHAKE
and KMAC parameters that require implementations outside the OpenSSL
provider, while keeping provider-backed paths available.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65172
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
---
 lib/internal/crypto/mac.js                    |   4 +
 lib/internal/crypto/util.js                   |  14 ++
 lib/internal/crypto/webidl.js                 |  51 +++--
 src/crypto/crypto_hash.cc                     |   5 +
 src/crypto/crypto_kmac.cc                     |   2 +
 src/crypto/crypto_turboshake.cc               |  10 +
 src/crypto/crypto_util.cc                     |   8 +-
 src/crypto/crypto_util.h                      |   1 +
 .../test-crypto-key-objects-to-crypto-key.js  |  28 ++-
 test/parallel/test-webcrypto-derivekey.js     |   8 +-
 .../test-webcrypto-digest-turboshake-rfc.js   |   5 +
 .../test-webcrypto-digest-turboshake.js       |   5 +
 test/parallel/test-webcrypto-digest.js        |  42 ++--
 test/parallel/test-webcrypto-export-import.js | 106 +++++-----
 .../test-webcrypto-fips-exceptions.mjs        | 198 ++++++++++++++++++
 test/parallel/test-webcrypto-keygen-kmac.js   |  49 +++--
 .../test-webcrypto-prototype-pollution.mjs    |  36 ++--
 .../test-webcrypto-sign-verify-kmac.js        |  69 +++---
 test/parallel/test-webcrypto-wrap-unwrap.js   |   2 +-
 test/wpt/status/WebCryptoAPI.cjs              |  12 +-
 20 files changed, 472 insertions(+), 183 deletions(-)
 create mode 100644 test/parallel/test-webcrypto-fips-exceptions.mjs

diff --git a/lib/internal/crypto/mac.js b/lib/internal/crypto/mac.js
index f6f82238b549..3297297abd59 100644
--- a/lib/internal/crypto/mac.js
+++ b/lib/internal/crypto/mac.js
@@ -20,6 +20,7 @@ const {
   normalizeHashName,
   numBitsToBytes,
   truncateToBitLength,
+  validateKmacKeyLength,
 } = require('internal/crypto/util');
 
 const {
@@ -60,6 +61,9 @@ function normalizeKeyLength(handle, algorithm) {
     length = algorithm.length;
   }
 
+  if (algorithm.name === 'KMAC128' || algorithm.name === 'KMAC256')
+    validateKmacKeyLength(length);
+
   return { handle, length };
 }
 
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index 282ce9b35591..3a70d32b8d21 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -47,9 +47,12 @@ const {
   EVP_PKEY_ML_KEM_1024,
   kKeyVariantAES_OCB_128: hasAesOcbMode,
   Argon2Job,
+  getFipsCrypto,
   KmacJob,
 } = internalBinding('crypto');
 
+const isFips = getFipsCrypto() === 1;
+
 const { getOptionValue } = require('internal/options');
 
 const {
@@ -415,6 +418,8 @@ const conditionalAlgorithms = {
   'Ed448': !process.features.openssl_is_boringssl,
   'KMAC128': !!KmacJob,
   'KMAC256': !!KmacJob,
+  'KT128': !isFips,
+  'KT256': !isFips,
   'ML-DSA-44': !!EVP_PKEY_ML_DSA_44,
   'ML-DSA-65': !!EVP_PKEY_ML_DSA_65,
   'ML-DSA-87': !!EVP_PKEY_ML_DSA_87,
@@ -427,6 +432,8 @@ const conditionalAlgorithms = {
     ArrayPrototypeIncludes(getHashes(), 'sha3-384'),
   'SHA3-512': !process.features.openssl_is_boringssl ||
     ArrayPrototypeIncludes(getHashes(), 'sha3-512'),
+  'TurboSHAKE128': !isFips,
+  'TurboSHAKE256': !isFips,
   'X448': !process.features.openssl_is_boringssl,
 };
 
@@ -571,6 +578,11 @@ function validateMaxBufferLength(data, name, max = kMaxBufferLength) {
   }
 }
 
+function validateKmacKeyLength(length) {
+  if ((length < 32 || length % 8) && isFips)
+    throw lazyDOMException('Invalid key length', 'NotSupportedError');
+}
+
 /**
  * Converts a bit length to the number of bytes needed to contain it.
  * Non-byte lengths are rounded up to the next byte.
@@ -1088,6 +1100,7 @@ module.exports = {
 
   kNamedCurveAliases,
   kSupportedAlgorithms,
+  isFips,
   normalizeAlgorithm,
   normalizeHashName,
   hasAnyNotIn,
@@ -1097,6 +1110,7 @@ module.exports = {
   jobPromiseThen,
   cleanupWebCryptoResult,
   prepareWebCryptoResult,
+  validateKmacKeyLength,
   validateMaxBufferLength,
   numBitsToBytes,
   truncateToBitLength,
diff --git a/lib/internal/crypto/webidl.js b/lib/internal/crypto/webidl.js
index 5dc263120eae..9be253daaf2e 100644
--- a/lib/internal/crypto/webidl.js
+++ b/lib/internal/crypto/webidl.js
@@ -9,7 +9,6 @@ const {
   StringPrototypeSplit,
   StringPrototypeStartsWith,
   StringPrototypeToLowerCase,
-  TypedArrayPrototypeGetLength,
 } = primordials;
 
 const {
@@ -28,8 +27,10 @@ const {
   validateMaxBufferLength,
   getBufferSourceByteLength,
   getBufferSourceBytes,
+  isFips,
   kNamedCurveAliases,
   numBitsToBytes,
+  validateKmacKeyLength,
 } = require('internal/crypto/util');
 const {
   converters: webidl,
@@ -276,23 +277,24 @@ function validateCShakeOutputLength(V) {
   }
 }
 
-function bufferSourceEqualsAscii(V, string) {
-  if (getBufferSourceByteLength(V) !== string.length) return false;
-
-  const bytes = getBufferSourceBytes(V);
-  const length = TypedArrayPrototypeGetLength(bytes);
-  for (let i = 0; i < length; i++) {
-    if (bytes[i] !== StringPrototypeCharCodeAt(string, i)) return false;
-  }
-  return true;
-}
+const kCShakeFunctionNames = ['KMAC', 'TupleHash', 'ParallelHash'];
 
 function validateCShakeFunctionName(V) {
-  if (getBufferSourceByteLength(V) === 0 ||
-      bufferSourceEqualsAscii(V, 'KMAC') ||
-      bufferSourceEqualsAscii(V, 'TupleHash') ||
-      bufferSourceEqualsAscii(V, 'ParallelHash')) {
-    return;
+  const length = getBufferSourceByteLength(V);
+  if (length === 0) return;
+
+  if (!isFips) {
+    const bytes = getBufferSourceBytes(V);
+    for (let i = 0; i < kCShakeFunctionNames.length; i++) {
+      const functionName = kCShakeFunctionNames[i];
+      if (length !== functionName.length) continue;
+
+      let j = 0;
+      for (; j < length; j++) {
+        if (bytes[j] !== StringPrototypeCharCodeAt(functionName, j)) break;
+      }
+      if (j === length) return;
+    }
   }
 
   throw lazyDOMException(
@@ -300,6 +302,14 @@ function validateCShakeFunctionName(V) {
     'NotSupportedError');
 }
 
+function validateCShakeCustomization(V) {
+  if (isFips && getBufferSourceByteLength(V) !== 0)
+    throw lazyDOMException(
+      'Unsupported CShakeParams customization',
+      'NotSupportedError');
+  validateMaxBufferLength(V, 'CShakeParams.customization', 512);
+}
+
 converters.RsaPssParams = createDictionaryConverter(
   'RsaPssParams', [
     dictAlgorithm,
@@ -457,7 +467,7 @@ converters.CShakeParams = createDictionaryConverter(
       {
         key: 'customization',
         converter: converters.BufferSource,
-        validator: (V, opts) => validateMaxBufferLength(V, 'CShakeParams.customization', 512),
+        validator: validateCShakeCustomization,
       },
     ],
   ]);
@@ -743,6 +753,7 @@ for (let i = 0; i < kKmacDictionaries.length; i++) {
           key: 'length',
           converter: (V, opts) =>
             converters['unsigned long'](V, enforceRangeOptions(opts)),
+          validator: validateKmacKeyLength,
         },
       ],
     ]);
@@ -756,6 +767,12 @@ converters.KmacParams = createDictionaryConverter(
         key: 'outputLength',
         converter: (V, opts) =>
           converters['unsigned long'](V, enforceRangeOptions(opts)),
+        validator: (V) => {
+          if ((V === 0 || V % 8) && isFips)
+            throw lazyDOMException(
+              'Invalid KmacParams outputLength',
+              'NotSupportedError');
+        },
         required: true,
       },
       {
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index 013d3cc0689b..a932b0755a0a 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -812,6 +812,11 @@ Maybe<void> CShakeTraits::AdditionalConfig(
     CShakeConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
+  if (IsFipsEnabled()) {
+    THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
+    return Nothing<void>();
+  }
+
   CHECK(args[offset]->IsString());  // Algorithm name
   Utf8Value algorithm_name(env->isolate(), args[offset]);
   std::string_view algorithm_str = algorithm_name.ToStringView();
diff --git a/src/crypto/crypto_kmac.cc b/src/crypto/crypto_kmac.cc
index e5b29370768d..7bdbece96277 100644
--- a/src/crypto/crypto_kmac.cc
+++ b/src/crypto/crypto_kmac.cc
@@ -151,6 +151,8 @@ bool DeriveBitsWithCShake(const KmacConfig& params,
                           const void* key_data,
                           size_t key_size,
                           ByteSource* out) {
+  if (IsFipsEnabled()) return false;
+
   const size_t key_length_bytes = NumBitsToBytes(params.key_length);
   if (key_size < key_length_bytes) return false;
 
diff --git a/src/crypto/crypto_turboshake.cc b/src/crypto/crypto_turboshake.cc
index e53e2910c6d3..371851e69a5f 100644
--- a/src/crypto/crypto_turboshake.cc
+++ b/src/crypto/crypto_turboshake.cc
@@ -428,6 +428,11 @@ Maybe<void> TurboShakeTraits::AdditionalConfig(
     TurboShakeConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
+  if (IsFipsEnabled()) {
+    THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
+    return Nothing<void>();
+  }
+
   // args[offset + 0] = algorithm name (string)
   CHECK(args[offset]->IsString());
   Utf8Value algorithm_name(env->isolate(), args[offset]);
@@ -535,6 +540,11 @@ Maybe<void> KangarooTwelveTraits::AdditionalConfig(
     KangarooTwelveConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
+  if (IsFipsEnabled()) {
+    THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
+    return Nothing<void>();
+  }
+
   // args[offset + 0] = algorithm name (string)
   CHECK(args[offset]->IsString());
   Utf8Value algorithm_name(env->isolate(), args[offset]);
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 166fea15da59..133a5c7f7f1d 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -146,6 +146,11 @@ bool InitCryptoOnce(Isolate* isolate) {
 // be part of a larger mutex for global OpenSSL state.
 static Mutex fips_mutex;
 
+bool IsFipsEnabled() {
+  Mutex::ScopedLock fips_lock(fips_mutex);
+  return ncrypto::isFipsEnabled();
+}
+
 void InitCryptoOnce() {
   Mutex::ScopedLock lock(per_process::cli_options_mutex);
   Mutex::ScopedLock fips_lock(fips_mutex);
@@ -223,8 +228,7 @@ void InitCryptoOnce() {
 
 void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
   Mutex::ScopedLock lock(per_process::cli_options_mutex);
-  Mutex::ScopedLock fips_lock(fips_mutex);
-  args.GetReturnValue().Set(ncrypto::isFipsEnabled() ? 1 : 0);
+  args.GetReturnValue().Set(IsFipsEnabled() ? 1 : 0);
 }
 
 void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index dd7e0842a29b..c74a6e7fd507 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -66,6 +66,7 @@ constexpr T NumBitsToBytes(T bits) {
 // what went wrong, or std::nullopt when there was nothing to do or the
 // options were applied successfully.
 std::optional<std::string> ProcessFipsOptions();
+bool IsFipsEnabled();
 
 bool InitCryptoOnce(v8::Isolate* isolate);
 void InitCryptoOnce();
diff --git a/test/parallel/test-crypto-key-objects-to-crypto-key.js b/test/parallel/test-crypto-key-objects-to-crypto-key.js
index 32228e7c8a06..1f92195dceca 100644
--- a/test/parallel/test-crypto-key-objects-to-crypto-key.js
+++ b/test/parallel/test-crypto-key-objects-to-crypto-key.js
@@ -14,6 +14,7 @@ const {
 } = require('crypto');
 const { hasFIPS } = require('../common/crypto');
 const { kSupportedAlgorithms } = require('internal/crypto/util');
+const fips = hasFIPS();
 const rejectsXCurves = hasFIPS(3, 5);
 
 const hashes = Object.keys(kSupportedAlgorithms.digest).filter((name) => {
@@ -135,7 +136,7 @@ function macInvalid(algorithm, invalidLengthMessage, allowZeroKey = false) {
   const key = createSecretKey(randomBytes(32));
   const usages = ['sign', 'verify'];
 
-  if (allowZeroKey) {
+  if (allowZeroKey && !fips) {
     const zeroKey = createSecretKey(Buffer.alloc(0))
       .toCryptoKey(algorithm, true, usages);
     assert.strictEqual(zeroKey.algorithm.length, 0);
@@ -143,6 +144,16 @@ function macInvalid(algorithm, invalidLengthMessage, allowZeroKey = false) {
     const explicitZeroKey = createSecretKey(Buffer.alloc(0))
       .toCryptoKey({ ...algorithm, length: 0 }, true, usages);
     assert.strictEqual(explicitZeroKey.algorithm.length, 0);
+  } else if (allowZeroKey) {
+    for (const zeroAlgorithm of [algorithm, { ...algorithm, length: 0 }]) {
+      assert.throws(() => {
+        createSecretKey(Buffer.alloc(0))
+          .toCryptoKey(zeroAlgorithm, true, usages);
+      }, {
+        name: 'NotSupportedError',
+        message: 'Invalid key length',
+      });
+    }
   } else {
     assert.throws(() => {
       createSecretKey(Buffer.alloc(0)).toCryptoKey(algorithm, true, usages);
@@ -157,12 +168,15 @@ function macInvalid(algorithm, invalidLengthMessage, allowZeroKey = false) {
     message: 'Usages cannot be empty when importing a secret key.'
   });
 
-  assert.throws(() => {
-    key.toCryptoKey({ ...algorithm, length: 0 }, true, usages);
-  }, {
-    name: 'DataError',
-    message: invalidLengthMessage,
-  });
+  assert.throws(
+    () => key.toCryptoKey({ ...algorithm, length: 0 }, true, usages),
+    allowZeroKey && fips ? {
+      name: 'NotSupportedError',
+      message: 'Invalid key length',
+    } : {
+      name: 'DataError',
+      message: invalidLengthMessage,
+    });
 }
 
 function hmacVectors() {
diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
index 75f43bf8a9ae..dbdc067368ae 100644
--- a/test/parallel/test-webcrypto-derivekey.js
+++ b/test/parallel/test-webcrypto-derivekey.js
@@ -283,7 +283,7 @@ const fips4 = hasFIPS(4);
   })().then(common.mustCall());
 }
 
-if (hasOpenSSL(3)) {
+if (hasOpenSSL(3) && !hasFIPS()) {
   (async () => {
     const derivedKeyAlgorithm = { name: 'KMAC128', length: 0 };
     const usages = ['sign'];
@@ -325,11 +325,7 @@ if (hasOpenSSL(3)) {
         name: 'KMAC128',
         outputLength: 256,
       }, derived, new Uint8Array());
-      if (fips4) {
-        await assert.rejects(signature, { name: 'OperationError' });
-      } else {
-        assert.strictEqual((await signature).byteLength, 32);
-      }
+      assert.strictEqual((await signature).byteLength, 32);
     }
   })().then(common.mustCall());
 }
diff --git a/test/parallel/test-webcrypto-digest-turboshake-rfc.js b/test/parallel/test-webcrypto-digest-turboshake-rfc.js
index 271fde76ab23..462204654121 100644
--- a/test/parallel/test-webcrypto-digest-turboshake-rfc.js
+++ b/test/parallel/test-webcrypto-digest-turboshake-rfc.js
@@ -5,6 +5,11 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasFIPS } = require('../common/crypto');
+
+if (hasFIPS())
+  common.skip('TurboSHAKE and KangarooTwelve are not available in FIPS mode');
+
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
 
diff --git a/test/parallel/test-webcrypto-digest-turboshake.js b/test/parallel/test-webcrypto-digest-turboshake.js
index a6f4b2d50f94..bd09362caa25 100644
--- a/test/parallel/test-webcrypto-digest-turboshake.js
+++ b/test/parallel/test-webcrypto-digest-turboshake.js
@@ -5,6 +5,11 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasFIPS } = require('../common/crypto');
+
+if (hasFIPS())
+  common.skip('TurboSHAKE and KangarooTwelve are not available in FIPS mode');
+
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
 
diff --git a/test/parallel/test-webcrypto-digest.js b/test/parallel/test-webcrypto-digest.js
index 447948212bc1..7c0ef7668c61 100644
--- a/test/parallel/test-webcrypto-digest.js
+++ b/test/parallel/test-webcrypto-digest.js
@@ -10,7 +10,7 @@ const { Buffer } = require('buffer');
 const { subtle } = globalThis.crypto;
 const { createHash, getHashes } = require('crypto');
 const { hasOpenSSL, hasFIPS } = require('../common/crypto');
-const fips4 = hasFIPS(4);
+const fips = hasFIPS();
 
 const kTests = [
   ['SHA-1', ['sha1'], 160],
@@ -291,6 +291,8 @@ if (getHashes().includes('shake128')) {
         message: 'Unsupported CShakeParams functionName',
       });
 
+    if (fips) return;
+
     await assert.rejects(
       subtle.digest(
         {
@@ -398,35 +400,19 @@ if (getHashes().includes('shake128')) {
                   'ca6f88db415829',
       },
     ]) {
-      const digest = subtle.digest(algorithm, data);
-      if (fips4) {
-        await assert.rejects(
-          digest,
-          (err) => err.name === 'OperationError' &&
-                   err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
-      } else {
-        assert.strictEqual(
-          Buffer.from(await digest).toString('hex'),
-          expected);
-      }
+      assert.strictEqual(
+        Buffer.from(await subtle.digest(algorithm, data)).toString('hex'),
+        expected);
     }
 
-    const truncatedDigest = subtle.digest(
+    const truncated = Buffer.from(await subtle.digest(
       { ...nistCShakeSample1.algorithm, outputLength: 255 },
-      nistCShakeSample1.data);
-    if (fips4) {
-      await assert.rejects(
-        truncatedDigest,
-        (err) => err.name === 'OperationError' &&
-                 err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
-    } else {
-      const truncated = Buffer.from(await truncatedDigest);
-      const expected = Buffer.from(nistCShakeSample1.expected, 'hex');
-      assert.strictEqual(truncated.byteLength, expected.byteLength);
-      assert.deepStrictEqual(
-        truncated.subarray(0, 31), expected.subarray(0, 31));
-      assert.strictEqual(truncated[31] & 0b00000001, 0);
-      assert.strictEqual(truncated[31] | 0b00000001, expected[31]);
-    }
+      nistCShakeSample1.data));
+    const expected = Buffer.from(nistCShakeSample1.expected, 'hex');
+    assert.strictEqual(truncated.byteLength, expected.byteLength);
+    assert.deepStrictEqual(
+      truncated.subarray(0, 31), expected.subarray(0, 31));
+    assert.strictEqual(truncated[31] & 0b00000001, 0);
+    assert.strictEqual(truncated[31] | 0b00000001, expected[31]);
   })().then(common.mustCall());
 }
diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js
index 9f6b2125d8ed..30d1ea622fae 100644
--- a/test/parallel/test-webcrypto-export-import.js
+++ b/test/parallel/test-webcrypto-export-import.js
@@ -286,66 +286,68 @@ if (hasOpenSSL(3)) {
       { name: 'SyntaxError', message: 'Usages cannot be empty when importing a secret key.' });
 
     {
-      const importedZeroImplicit = await subtle.importKey(
-        'raw-secret',
-        new Uint8Array(),
-        name,
-        true,
-        ['sign', 'verify']);
-      const importedZeroImplicitRaw =
-        await subtle.exportKey('raw-secret', importedZeroImplicit);
-      assert.strictEqual(importedZeroImplicit.algorithm.length, 0);
-      assert.strictEqual(importedZeroImplicitRaw.byteLength, 0);
+      if (getFips() !== 1) {
+        const importedZeroImplicit = await subtle.importKey(
+          'raw-secret',
+          new Uint8Array(),
+          name,
+          true,
+          ['sign', 'verify']);
+        const importedZeroImplicitRaw =
+          await subtle.exportKey('raw-secret', importedZeroImplicit);
+        assert.strictEqual(importedZeroImplicit.algorithm.length, 0);
+        assert.strictEqual(importedZeroImplicitRaw.byteLength, 0);
 
-      const importedZeroExplicit = await subtle.importKey(
-        'raw-secret',
-        new Uint8Array(),
-        { name, length: 0 },
-        true,
-        ['sign', 'verify']);
-      const importedZeroExplicitRaw =
-        await subtle.exportKey('raw-secret', importedZeroExplicit);
-      assert.strictEqual(importedZeroExplicit.algorithm.length, 0);
-      assert.strictEqual(importedZeroExplicitRaw.byteLength, 0);
-
-      await assert.rejects(
-        subtle.importKey(
+        const importedZeroExplicit = await subtle.importKey(
           'raw-secret',
-          new Uint8Array([0xff]),
+          new Uint8Array(),
           { name, length: 0 },
           true,
-          ['sign', 'verify']),
-        { name: 'DataError', message: 'Invalid key length' });
-
-      const generated = await subtle.generateKey(
-        { name, length: 9 },
-        true,
-        ['sign', 'verify']);
-      const generatedRaw = await subtle.exportKey('raw-secret', generated);
-      assert.strictEqual(generated.algorithm.length, 9);
-      assert.strictEqual(generatedRaw.byteLength, 2);
-      assert.strictEqual(new Uint8Array(generatedRaw)[1] & 0b01111111, 0);
+          ['sign', 'verify']);
+        const importedZeroExplicitRaw =
+          await subtle.exportKey('raw-secret', importedZeroExplicit);
+        assert.strictEqual(importedZeroExplicit.algorithm.length, 0);
+        assert.strictEqual(importedZeroExplicitRaw.byteLength, 0);
+
+        await assert.rejects(
+          subtle.importKey(
+            'raw-secret',
+            new Uint8Array([0xff]),
+            { name, length: 0 },
+            true,
+            ['sign', 'verify']),
+          { name: 'DataError', message: 'Invalid key length' });
+
+        const generated = await subtle.generateKey(
+          { name, length: 9 },
+          true,
+          ['sign', 'verify']);
+        const generatedRaw = await subtle.exportKey('raw-secret', generated);
+        assert.strictEqual(generated.algorithm.length, 9);
+        assert.strictEqual(generatedRaw.byteLength, 2);
+        assert.strictEqual(new Uint8Array(generatedRaw)[1] & 0b01111111, 0);
 
-      const importedExplicit = await subtle.importKey(
-        'raw-secret',
-        new Uint8Array([0xff, 0xff]),
-        { name, length: 9 },
-        true,
-        ['sign', 'verify']);
-      const importedExplicitRaw = await subtle.exportKey('raw-secret', importedExplicit);
-      assert.strictEqual(importedExplicit.algorithm.length, 9);
-      assert.deepStrictEqual(
-        new Uint8Array(importedExplicitRaw),
-        new Uint8Array([0xff, 0x80]));
-
-      await assert.rejects(
-        subtle.importKey(
+        const importedExplicit = await subtle.importKey(
           'raw-secret',
-          new Uint8Array([0xff]),
+          new Uint8Array([0xff, 0xff]),
           { name, length: 9 },
           true,
-          ['sign', 'verify']),
-        { name: 'DataError', message: 'Invalid key length' });
+          ['sign', 'verify']);
+        const importedExplicitRaw = await subtle.exportKey('raw-secret', importedExplicit);
+        assert.strictEqual(importedExplicit.algorithm.length, 9);
+        assert.deepStrictEqual(
+          new Uint8Array(importedExplicitRaw),
+          new Uint8Array([0xff, 0x80]));
+
+        await assert.rejects(
+          subtle.importKey(
+            'raw-secret',
+            new Uint8Array([0xff]),
+            { name, length: 9 },
+            true,
+            ['sign', 'verify']),
+          { name: 'DataError', message: 'Invalid key length' });
+      }
     }
   }
 
diff --git a/test/parallel/test-webcrypto-fips-exceptions.mjs b/test/parallel/test-webcrypto-fips-exceptions.mjs
new file mode 100644
index 000000000000..ecc0f3c6989d
--- /dev/null
+++ b/test/parallel/test-webcrypto-fips-exceptions.mjs
@@ -0,0 +1,198 @@
+// Flags: --expose-internals
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { createRequire } from 'node:module';
+import { hasFIPS } from '../common/crypto.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+if (!hasFIPS(3))
+  common.skip('requires OpenSSL >= 3 in FIPS mode');
+
+const require = createRequire(import.meta.url);
+const { internalBinding } = require('internal/test/binding');
+const { getCryptoKeyHandle } = require('internal/crypto/keys');
+const {
+  CShakeJob,
+  KangarooTwelveJob,
+  KmacJob,
+  TurboShakeJob,
+  kCryptoJobWebCrypto,
+  kSignJobModeSign,
+} = internalBinding('crypto');
+const { subtle } = globalThis.crypto;
+const { SubtleCrypto } = globalThis;
+const data = new Uint8Array();
+
+async function assertFipsException(operation, algorithm, fn, message) {
+  assert.strictEqual(SubtleCrypto.supports(operation, algorithm), false);
+  await assert.rejects(fn(), {
+    name: 'NotSupportedError',
+    message,
+  });
+}
+
+for (const algorithm of [
+  { name: 'turboshake128', outputLength: 128 },
+  { name: 'TurboSHAKE256', outputLength: 256 },
+  { name: 'KT128', outputLength: 128 },
+  { name: 'KT256', outputLength: 256, customization: data },
+]) {
+  await assertFipsException(
+    'digest',
+    algorithm,
+    () => subtle.digest(algorithm, data),
+    'Unrecognized algorithm name');
+}
+
+for (const createJob of [
+  () => new TurboShakeJob(
+    kCryptoJobWebCrypto, 'TurboSHAKE128', 0x1f, 16, data),
+  () => new KangarooTwelveJob(
+    kCryptoJobWebCrypto, 'KT128', undefined, 16, data),
+  () => new CShakeJob(
+    kCryptoJobWebCrypto,
+    'cSHAKE128',
+    data,
+    Buffer.from('KMAC'),
+    undefined,
+    128),
+]) {
+  assert.throws(createJob, {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    message: 'Unsupported crypto operation',
+  });
+}
+
+const emptyCShake = {
+  name: 'cSHAKE128',
+  outputLength: 256,
+  customization: data,
+  functionName: data,
+};
+assert.strictEqual(SubtleCrypto.supports('digest', emptyCShake), true);
+
+for (const length of [1, 513]) {
+  const algorithm = {
+    name: 'cSHAKE128',
+    outputLength: 256,
+    customization: new Uint8Array(length),
+  };
+  await assertFipsException(
+    'digest',
+    algorithm,
+    () => subtle.digest(algorithm, data),
+    'Unsupported CShakeParams customization');
+}
+
+const functionName = {
+  name: 'cSHAKE256',
+  outputLength: 256,
+  functionName: Buffer.from('KMAC'),
+};
+await assertFipsException(
+  'digest',
+  functionName,
+  () => subtle.digest(functionName, data),
+  'Unsupported CShakeParams functionName');
+
+const bothCShakeParams = {
+  ...functionName,
+  customization: new Uint8Array(1),
+};
+await assertFipsException(
+  'digest',
+  bothCShakeParams,
+  () => subtle.digest(bothCShakeParams, data),
+  'Unsupported CShakeParams customization');
+
+for (const length of [0, 24, 33]) {
+  const algorithm = { name: 'KMAC128', length };
+  await assertFipsException(
+    'generateKey',
+    algorithm,
+    () => subtle.generateKey(algorithm, false, ['sign', 'verify']),
+    'Invalid key length');
+  await assertFipsException(
+    'importKey',
+    algorithm,
+    () => subtle.importKey(
+      'raw-secret',
+      new Uint8Array(length === 24 ? 4 : Math.ceil(length / 8)),
+      algorithm,
+      false,
+      ['sign', 'verify']),
+    'Invalid key length');
+}
+
+const minimumKmac = { name: 'KMAC128', length: 32 };
+assert.strictEqual(
+  SubtleCrypto.supports('generateKey', minimumKmac), true);
+assert.strictEqual(
+  SubtleCrypto.supports('importKey', minimumKmac), true);
+await assert.rejects(
+  subtle.importKey(
+    'raw-secret',
+    new Uint8Array(5),
+    minimumKmac,
+    false,
+    ['sign', 'verify']), {
+    name: 'DataError',
+    message: 'Invalid key length',
+  });
+
+for (const length of [0, 3]) {
+  await assert.rejects(
+    subtle.importKey(
+      'raw-secret',
+      new Uint8Array(length),
+      'KMAC128',
+      false,
+      ['sign', 'verify']), {
+      name: 'NotSupportedError',
+      message: 'Invalid key length',
+    });
+}
+const key = await subtle.importKey(
+  'raw-secret',
+  new Uint8Array(4),
+  'KMAC128',
+  false,
+  ['sign', 'verify']);
+assert.strictEqual(key.algorithm.length, 32);
+
+await assert.rejects(
+  new KmacJob(
+    kCryptoJobWebCrypto,
+    kSignJobModeSign,
+    getCryptoKeyHandle(key),
+    'KMAC128',
+    undefined,
+    32,
+    9,
+    data,
+    undefined).run(),
+  (err) => {
+    assert.strictEqual(err.name, 'OperationError');
+    assert.strictEqual(err.cause?.code, 'ERR_CRYPTO_OPERATION_FAILED');
+    return true;
+  });
+
+const minimumOutput = { name: 'KMAC128', outputLength: 8 };
+assert.strictEqual(SubtleCrypto.supports('sign', minimumOutput), true);
+assert.strictEqual(SubtleCrypto.supports('verify', minimumOutput), true);
+for (const outputLength of [0, 9]) {
+  const algorithm = { name: 'KMAC128', outputLength };
+  await assertFipsException(
+    'sign',
+    algorithm,
+    () => subtle.sign(algorithm, key, data),
+    'Invalid KmacParams outputLength');
+  await assertFipsException(
+    'verify',
+    algorithm,
+    () => subtle.verify(algorithm, key, data, data),
+    'Invalid KmacParams outputLength');
+}
diff --git a/test/parallel/test-webcrypto-keygen-kmac.js b/test/parallel/test-webcrypto-keygen-kmac.js
index c1125412892e..33716095751f 100644
--- a/test/parallel/test-webcrypto-keygen-kmac.js
+++ b/test/parallel/test-webcrypto-keygen-kmac.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3))
   common.skip('requires OpenSSL >= 3');
@@ -13,38 +13,45 @@ if (!hasOpenSSL(3))
 const assert = require('assert');
 const { types: { isCryptoKey } } = require('util');
 const { subtle } = globalThis.crypto;
+const fips = hasFIPS();
 
 const usages = ['sign', 'verify'];
 
 async function test(name, length) {
-  length ??= name === 'KMAC128' ? 128 : 256;
-  const key = await subtle.generateKey({
-    name,
-    length,
-  }, true, usages);
-
-  assert(key);
-  assert(isCryptoKey(key));
-
-  assert.strictEqual(key.type, 'secret');
-  assert.strictEqual(key.toString(), '[object CryptoKey]');
-  assert.strictEqual(key.extractable, true);
-  assert.deepStrictEqual(key.usages, usages);
-  assert.strictEqual(key.algorithm.name, name);
-  assert.strictEqual(key.algorithm.length, length);
-  assert.strictEqual(key.algorithm, key.algorithm);
-  assert.strictEqual(key.usages, key.usages);
-
-  const raw = await subtle.exportKey('raw-secret', key);
-  assert.strictEqual(raw.byteLength, Math.ceil(length / 8));
+  const expectedLength = length ?? (name === 'KMAC128' ? 128 : 256);
+  const algorithm = { name };
+  if (length !== undefined)
+    algorithm.length = length;
+
+  if (fips && length !== undefined &&
+      (length < 32 || length % 8 !== 0)) return;
+
+  const generatedKey = await subtle.generateKey(algorithm, true, usages);
+
+  assert(generatedKey);
+  assert(isCryptoKey(generatedKey));
+
+  assert.strictEqual(generatedKey.type, 'secret');
+  assert.strictEqual(generatedKey.toString(), '[object CryptoKey]');
+  assert.strictEqual(generatedKey.extractable, true);
+  assert.deepStrictEqual(generatedKey.usages, usages);
+  assert.strictEqual(generatedKey.algorithm.name, name);
+  assert.strictEqual(generatedKey.algorithm.length, expectedLength);
+  assert.strictEqual(generatedKey.algorithm, generatedKey.algorithm);
+  assert.strictEqual(generatedKey.usages, generatedKey.usages);
+
+  const raw = await subtle.exportKey('raw-secret', generatedKey);
+  assert.strictEqual(raw.byteLength, Math.ceil(expectedLength / 8));
 }
 
 const kTests = [
   ['KMAC128', 0],
+  ['KMAC128', 32],
   ['KMAC128', 128],
   ['KMAC128', 256],
   ['KMAC128'],
   ['KMAC256', 0],
+  ['KMAC256', 32],
   ['KMAC256', 128],
   ['KMAC256', 256],
   ['KMAC256'],
diff --git a/test/parallel/test-webcrypto-prototype-pollution.mjs b/test/parallel/test-webcrypto-prototype-pollution.mjs
index a7104c2b7ae4..5ed77fc6021e 100644
--- a/test/parallel/test-webcrypto-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-prototype-pollution.mjs
@@ -142,16 +142,24 @@ if (supports('digest', 'cSHAKE128')) {
       outputLength: 256,
       customization: new Uint8Array([1, 2, 3]),
     };
-    const expected = new Uint8Array(await subtle.digest(algorithm, data));
-    const plain = new Uint8Array(
-      await subtle.digest({ name: 'cSHAKE128', outputLength: 256 }, data));
-    assert.notDeepStrictEqual(expected, plain);
-    await withPoisoned(poisonTypedArrayByteLength(0),
-                       common.mustCall(async () => {
-                         assert.deepStrictEqual(
-                           new Uint8Array(await subtle.digest(algorithm, data)),
-                           expected);
-                       }));
+    if (getFips() === 1) {
+      await withPoisoned(poisonTypedArrayByteLength(0), common.mustCall(() =>
+        assert.rejects(subtle.digest(algorithm, data), {
+          name: 'NotSupportedError',
+          message: 'Unsupported CShakeParams customization',
+        })));
+    } else {
+      const expected = new Uint8Array(await subtle.digest(algorithm, data));
+      const plain = new Uint8Array(
+        await subtle.digest({ name: 'cSHAKE128', outputLength: 256 }, data));
+      assert.notDeepStrictEqual(expected, plain);
+      await withPoisoned(poisonTypedArrayByteLength(0),
+                         common.mustCall(async () => {
+                           assert.deepStrictEqual(
+                             new Uint8Array(await subtle.digest(algorithm, data)),
+                             expected);
+                         }));
+    }
   }
 }
 
@@ -290,17 +298,17 @@ await withPoisoned(
 // enforceRangeOptions(): [EnforceRange] uses IntegerPart, not round-half-even.
 {
   const key = await subtle.importKey(
-    'raw-secret', new Uint8Array(4), 'PBKDF2', false, ['deriveBits']);
+    'raw-secret', new Uint8Array(32), 'PBKDF2', false, ['deriveBits']);
   const pbkdf2 = (iterations) => subtle.deriveBits({
     name: 'PBKDF2',
     hash: 'SHA-256',
     salt: new Uint8Array(16),
     iterations,
-  }, key, 8);
+  }, key, 112);
 
-  const expected = new Uint8Array(await pbkdf2(1));
+  const expected = new Uint8Array(await pbkdf2(1000));
   await withPoisoned(inherited('clamp', true), common.mustCall(async () => {
-    assert.deepStrictEqual(new Uint8Array(await pbkdf2(1.5)), expected);
+    assert.deepStrictEqual(new Uint8Array(await pbkdf2(1000.5)), expected);
   }));
 }
 
diff --git a/test/parallel/test-webcrypto-sign-verify-kmac.js b/test/parallel/test-webcrypto-sign-verify-kmac.js
index 160067b9b760..ac0b738bcd57 100644
--- a/test/parallel/test-webcrypto-sign-verify-kmac.js
+++ b/test/parallel/test-webcrypto-sign-verify-kmac.js
@@ -12,15 +12,24 @@ if (!hasOpenSSL(3))
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
+const fips = hasFIPS();
 const fips4 = hasFIPS(4);
 
 const vectors = require('../fixtures/crypto/kmac')();
 
-function isFipsUnsupported(err) {
+function isFipsProviderUnsupported(err) {
   return err.name === 'OperationError' &&
     err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED';
 }
 
+function usesNonFipsImplementation({ key, keyLength, outputLength }) {
+  const keyLengthInBits = keyLength ?? key.byteLength * 8;
+  return outputLength === 0 ||
+    outputLength % 8 !== 0 ||
+    keyLengthInBits < 32 ||
+    keyLengthInBits % 8 !== 0;
+}
+
 function isFips4Incompatible({ key, keyLength, outputLength }) {
   const keyLengthInBits = keyLength ?? key.byteLength * 8;
   return keyLengthInBits < 128 ||
@@ -206,9 +215,13 @@ async function testSign({ algorithm,
   const variations = [];
 
   for (const vector of vectors) {
+    if (fips && usesNonFipsImplementation(vector)) continue;
+
     if (fips4 && isFips4Incompatible(vector)) {
-      variations.push(assert.rejects(testVerify(vector), isFipsUnsupported));
-      variations.push(assert.rejects(testSign(vector), isFipsUnsupported));
+      variations.push(assert.rejects(
+        testVerify(vector), isFipsProviderUnsupported));
+      variations.push(assert.rejects(
+        testSign(vector), isFipsProviderUnsupported));
     } else {
       variations.push(testVerify(vector));
       variations.push(testSign(vector));
@@ -227,24 +240,18 @@ async function testSign({ algorithm,
     ['sign', 'verify']);
   const algorithm = {
     name: 'KMAC128',
-    outputLength: fips4 ? 16 : 9,
+    outputLength: fips ? 16 : 9,
     customization: new Uint8Array(),
   };
   const data = new Uint8Array([1, 2, 3]);
 
-  if (fips4) {
-    await assert.rejects(
-      subtle.sign({ ...algorithm, outputLength: 9 }, key, data),
-      isFipsUnsupported);
-  }
-
   const signature = await subtle.sign(algorithm, key, data);
   assert.strictEqual(signature.byteLength, 2);
-  if (!fips4)
+  if (!fips)
     assert.strictEqual(new Uint8Array(signature)[1] & 0b01111111, 0);
   assert(await subtle.verify(algorithm, key, signature, data));
 
-  if (fips4) {
+  if (fips) {
     const signature128 = await subtle.sign({
       ...algorithm,
       outputLength: 128,
@@ -264,25 +271,23 @@ async function testSign({ algorithm,
   }
 
   const invalidSignature = new Uint8Array(signature);
-  if (fips4)
+  if (fips)
     invalidSignature[0] ^= 0b00000001;
   else
     invalidSignature[1] |= 0b00000001;
   assert(!(await subtle.verify(algorithm, key, invalidSignature, data)));
 
-  const nonByteKey = await subtle.importKey(
-    'raw-secret',
-    new Uint8Array([0xff, 0xff, 0xff, 0xff]),
-    { name: 'KMAC128', length: 25 },
-    false,
-    ['sign', 'verify']);
-  const nonByteKeySignature = subtle.sign({
-    ...algorithm,
-    outputLength: 16,
-  }, nonByteKey, data);
-  if (fips4) {
-    await assert.rejects(nonByteKeySignature, isFipsUnsupported);
-  } else {
+  if (!fips) {
+    const nonByteKey = await subtle.importKey(
+      'raw-secret',
+      new Uint8Array([0xff, 0xff, 0xff, 0xff]),
+      { name: 'KMAC128', length: 25 },
+      false,
+      ['sign', 'verify']);
+    const nonByteKeySignature = subtle.sign({
+      ...algorithm,
+      outputLength: 16,
+    }, nonByteKey, data);
     const result = await nonByteKeySignature;
     assert.strictEqual(result.byteLength, 2);
     assert(await subtle.verify({
@@ -293,6 +298,8 @@ async function testSign({ algorithm,
 })().then(common.mustCall());
 
 (async function() {
+  if (fips) return;
+
   const data = new Uint8Array([1, 2, 3]);
 
   for (const name of ['KMAC128', 'KMAC256']) {
@@ -311,13 +318,9 @@ async function testSign({ algorithm,
 
       const algorithm = { name, outputLength: 256 };
       const signature = subtle.sign(algorithm, key, data);
-      if (fips4) {
-        await assert.rejects(signature, isFipsUnsupported);
-      } else {
-        const result = await signature;
-        assert.strictEqual(result.byteLength, 32);
-        assert(await subtle.verify(algorithm, key, result, data));
-      }
+      const result = await signature;
+      assert.strictEqual(result.byteLength, 32);
+      assert(await subtle.verify(algorithm, key, result, data));
     }
   }
 })().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index 342eae0859e4..c2c089ed0ffa 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -485,7 +485,7 @@ async function testNonByteLengthWrapUnwrap({
     implicitAlgorithm: hmacAlgorithm,
   });
 
-  if (hasOpenSSL(3)) {
+  if (hasOpenSSL(3) && getFips() !== 1) {
     const kmacAlgorithm = { name: 'KMAC128' };
     const kmacKey = await subtle.importKey(
       'raw-secret',
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index 8dfd37b33b34..ae73e17f5bb9 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -117,6 +117,12 @@ if (hasFIPS(3)) {
     ]);
 }
 
+if (hasFIPS()) {
+  skip(
+    'digest/kangarootwelve.tentative.https.any.js',
+    'digest/turboshake.tentative.https.any.js');
+}
+
 // OpenSSL 3.0 through 3.3 reject SHA-1 signature generation in FIPS mode.
 // OpenSSL 3.4 permits it for legacy use cases while marking the operation as
 // non-approved through a per-operation FIPS indicator. Node does not expose
@@ -171,8 +177,10 @@ if (hasFIPS(4)) {
     ]);
 }
 
-skipSubtests(
-  ['digest/kangarootwelve.tentative.https.any.js', /C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2}) bytes/]);
+if (!hasFIPS()) {
+  skipSubtests(
+    ['digest/kangarootwelve.tentative.https.any.js', /C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2}) bytes/]);
+}
 
 function assertNoOverlap(fileSkips, subtestSkips) {
   const subtestSkipFiles = new Set(Object.keys(subtestSkips));

From af867ce3e48e1a11b0c5aeb51d4c4a9c16659f36 Mon Sep 17 00:00:00 2001
From: Adam Mcgrath <adam.mcgrath@okta.com>
Date: Thu, 6 Aug 2026 09:20:28 +0100
Subject: [PATCH 146/344] crypto: add mgf1Hash for RSA-OAEP

Signed-off-by: Adam Mcgrath <adam.mcgrath@okta.com>
PR-URL: https://github.com/nodejs/node/pull/65073
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 deps/ncrypto/ncrypto.cc                    |  10 +-
 deps/ncrypto/ncrypto.h                     |   1 +
 doc/api/crypto.md                          |  20 ++-
 lib/internal/crypto/cipher.js              |   6 +-
 src/crypto/crypto_cipher.cc                |  13 +-
 src/crypto/crypto_cipher.h                 |   1 +
 src/crypto/crypto_rsa.cc                   |   1 +
 test/parallel/test-crypto-rsa-oaep-mgf1.js | 149 +++++++++++++++++++++
 typings/internalBinding/crypto.d.ts        |   1 +
 9 files changed, 192 insertions(+), 10 deletions(-)
 create mode 100644 test/parallel/test-crypto-rsa-oaep-mgf1.js

diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index b4fa65daa78c..d731e823b39d 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -5650,9 +5650,11 @@ DataPointer RSA_Cipher(const EVPKeyPointer& key,
   if (!key) return {};
   EVPKeyCtxPointer ctx = key.newCtx();
 
+  const Digest& mgf1_digest =
+      params.mgf1_digest != nullptr ? params.mgf1_digest : params.digest;
   if (!ctx || init(ctx.get()) <= 0 || !ctx.setRsaPadding(params.padding) ||
-      (params.digest != nullptr && (!ctx.setRsaOaepMd(params.digest) ||
-                                    !ctx.setRsaMgf1Md(params.digest)))) {
+      (params.digest != nullptr &&
+       (!ctx.setRsaOaepMd(params.digest) || !ctx.setRsaMgf1Md(mgf1_digest)))) {
     return {};
   }
 
@@ -5691,7 +5693,9 @@ DataPointer CipherImpl(const EVPKeyPointer& key,
   if (!key) return {};
   EVPKeyCtxPointer ctx = key.newCtx();
   if (!ctx || init(ctx.get()) <= 0 || !ctx.setRsaPadding(params.padding) ||
-      (params.digest != nullptr && !ctx.setRsaOaepMd(params.digest))) {
+      (params.digest != nullptr && !ctx.setRsaOaepMd(params.digest)) ||
+      (params.mgf1_digest != nullptr &&
+       !ctx.setRsaMgf1Md(params.mgf1_digest))) {
     return {};
   }
 
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 53302394f38b..a11d67ae460a 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -508,6 +508,7 @@ class Cipher final {
   struct CipherParams {
     int padding;
     Digest digest;
+    Digest mgf1_digest;
     const Buffer<const void> label;
   };
 
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 659905e17482..413533c63d01 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -5300,6 +5300,9 @@ An array of supported digest functions can be retrieved using
 <!-- YAML
 added: v0.11.14
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65073
+    description: The `mgf1Hash` option was added.
   - version:
       - v21.6.2
       - v20.11.1
@@ -5327,8 +5330,11 @@ changes:
 <!--lint disable maximum-line-length remark-lint-->
 
 * `privateKey` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey|URL}
-  * `oaepHash` {string} The hash function to use for OAEP padding and MGF1.
-    **Default:** `'sha1'`
+  * `oaepHash` {string} The hash function to use for OAEP padding and, unless
+    `mgf1Hash` is set, MGF1. **Default:** `'sha1'`
+  * `mgf1Hash` {string} The hash function to use for the MGF1 mask generation
+    function of OAEP padding. If not specified, the value of `oaepHash` is used.
+    This allows the OAEP digest and the MGF1 digest to differ.
   * `oaepLabel` {string|ArrayBuffer|Buffer|TypedArray|DataView} The label to
     use for OAEP padding. If not specified, no label is used.
   * `padding` {crypto.constants} An optional padding value defined in
@@ -5442,6 +5448,9 @@ be passed instead of a public key.
 <!-- YAML
 added: v0.11.14
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65073
+    description: The `mgf1Hash` option was added.
   - version: v15.0.0
     pr-url: https://github.com/nodejs/node/pull/35093
     description: Added string, ArrayBuffer, and CryptoKey as allowable key
@@ -5464,8 +5473,11 @@ changes:
 * `key` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
   * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
     A PEM encoded public or private key, {KeyObject}, or {CryptoKey}.
-  * `oaepHash` {string} The hash function to use for OAEP padding and MGF1.
-    **Default:** `'sha1'`
+  * `oaepHash` {string} The hash function to use for OAEP padding and, unless
+    `mgf1Hash` is set, MGF1. **Default:** `'sha1'`
+  * `mgf1Hash` {string} The hash function to use for the MGF1 mask generation
+    function of OAEP padding. If not specified, the value of `oaepHash` is used.
+    This allows the OAEP digest and the MGF1 digest to differ.
   * `oaepLabel` {string|ArrayBuffer|Buffer|TypedArray|DataView} The label to
     use for OAEP padding. If not specified, no label is used.
   * `passphrase` {string|ArrayBuffer|Buffer|TypedArray|DataView} An optional
diff --git a/lib/internal/crypto/cipher.js b/lib/internal/crypto/cipher.js
index 5dc2cf959624..dafcc59d5066 100644
--- a/lib/internal/crypto/cipher.js
+++ b/lib/internal/crypto/cipher.js
@@ -68,15 +68,17 @@ function rsaFunctionFor(method, defaultPadding, keyType) {
         preparePrivateKey(key, keyName) :
         preparePublicOrPrivateKey(key, keyName);
     const padding = key.padding || defaultPadding;
-    const { oaepHash, encoding } = key;
+    const { oaepHash, mgf1Hash, encoding } = key;
     let { oaepLabel } = key;
     if (oaepHash !== undefined)
       validateString(oaepHash, 'key.oaepHash');
+    if (mgf1Hash !== undefined)
+      validateString(mgf1Hash, 'key.mgf1Hash');
     if (oaepLabel !== undefined)
       oaepLabel = getArrayBufferOrView(oaepLabel, 'key.oaepLabel', encoding);
     buffer = getArrayBufferOrView(buffer, 'buffer', encoding);
     return method(data, format, type, passphrase, namedCurve, buffer,
-                  padding, oaepHash, oaepLabel);
+                  padding, oaepHash, oaepLabel, mgf1Hash);
   };
 }
 
diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
index 92682328d0ba..e4aaf0b953a7 100644
--- a/src/crypto/crypto_cipher.cc
+++ b/src/crypto/crypto_cipher.cc
@@ -801,6 +801,7 @@ bool PublicKeyCipher::Cipher(
     const EVPKeyPointer& pkey,
     int padding,
     const Digest& digest,
+    const Digest& mgf1_digest,
     const ArrayBufferOrViewContents<unsigned char>& oaep_label,
     const ArrayBufferOrViewContents<unsigned char>& data,
     std::unique_ptr<BackingStore>* out) {
@@ -810,6 +811,7 @@ bool PublicKeyCipher::Cipher(
   const ncrypto::Cipher::CipherParams params{
       .padding = padding,
       .digest = digest,
+      .mgf1_digest = mgf1_digest,
       .label = label,
   };
 
@@ -882,8 +884,17 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
   if (!oaep_label.CheckSizeInt32()) [[unlikely]] {
     return THROW_ERR_OUT_OF_RANGE(env, "oaepLabel is too big");
   }
+
+  Digest mgf1_digest;
+  if (args[offset + 4]->IsString()) {
+    Utf8Value mgf1_str(env->isolate(), args[offset + 4]);
+    mgf1_digest = Digest::FromName(*mgf1_str);
+    if (!mgf1_digest) return THROW_ERR_OSSL_EVP_INVALID_DIGEST(env);
+  }
+
   std::unique_ptr<BackingStore> out;
-  if (!Cipher<cipher>(env, pkey, padding, digest, oaep_label, buf, &out)) {
+  if (!Cipher<cipher>(
+          env, pkey, padding, digest, mgf1_digest, oaep_label, buf, &out)) {
     return ThrowCryptoError(env, ERR_get_error());
   }
 
diff --git a/src/crypto/crypto_cipher.h b/src/crypto/crypto_cipher.h
index f351c845497d..4837a63ca631 100644
--- a/src/crypto/crypto_cipher.h
+++ b/src/crypto/crypto_cipher.h
@@ -106,6 +106,7 @@ class PublicKeyCipher {
                      const ncrypto::EVPKeyPointer& pkey,
                      int padding,
                      const ncrypto::Digest& digest,
+                     const ncrypto::Digest& mgf1_digest,
                      const ArrayBufferOrViewContents<unsigned char>& oaep_label,
                      const ArrayBufferOrViewContents<unsigned char>& data,
                      std::unique_ptr<v8::BackingStore>* out);
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index f5dd79f5fce9..c89d6b698b2b 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -206,6 +206,7 @@ WebCryptoCipherStatus RSA_Cipher(Environment* env,
   const ncrypto::Rsa::CipherParams nparams{
       .padding = params.padding,
       .digest = params.digest,
+      .mgf1_digest = params.digest,
       .label = params.label,
   };
 
diff --git a/test/parallel/test-crypto-rsa-oaep-mgf1.js b/test/parallel/test-crypto-rsa-oaep-mgf1.js
new file mode 100644
index 000000000000..7ba7f19f6b5c
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-oaep-mgf1.js
@@ -0,0 +1,149 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// Tests the `mgf1Hash` option of crypto.publicEncrypt() and
+// crypto.privateDecrypt(), which allows the MGF1 digest of RSA-OAEP padding to
+// differ from the OAEP message digest (`oaepHash`). This is required for
+// interoperability with profiles such as XML Encryption's `rsa-oaep-mgf1p`,
+// where the OAEP digest may be changed but MGF1 is fixed to SHA-1.
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fixtures = require('../common/fixtures');
+const { hasFIPS } = require('../common/crypto');
+
+const constants = crypto.constants;
+
+const publicKey = fixtures.readKey('rsa_public.pem', 'ascii');
+const privateKey = fixtures.readKey('rsa_private.pem', 'ascii');
+
+const input = Buffer.from('the quick brown fox jumps over the lazy dog');
+
+// A round-trip with mismatched OAEP and MGF1 digests must succeed when both
+// sides agree on the digests.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha1',
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha1',
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// mgf1Hash actually affects the padding: a ciphertext produced with
+// oaepHash=sha256 and mgf1Hash=sha1 must NOT decrypt when MGF1 defaults to the
+// OAEP digest (sha256), which is the pre-existing behavior.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha1',
+  }, input);
+
+  assert.throws(() => {
+    crypto.privateDecrypt({
+      key: privateKey,
+      padding: constants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+      // No mgf1Hash: MGF1 follows oaepHash (sha256) and must fail to unpad.
+    }, encrypted);
+  }, {
+    code: hasFIPS(3, 5) ? 'ERR_OSSL_EVP_PROVIDER_ASYM_CIPHER_FAILURE' :
+      'ERR_OSSL_RSA_OAEP_DECODING_ERROR'
+  });
+}
+
+// Backward compatibility: omitting mgf1Hash on both sides keeps MGF1 == oaepHash
+// (the historical behavior), so this round-trips, and setting mgf1Hash equal to
+// oaepHash is equivalent to omitting it.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha256',
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// The default oaepHash is sha1, so mgf1Hash defaults to sha1 as well. A
+// ciphertext encrypted with all defaults must decrypt with an explicit
+// mgf1Hash: 'sha1'.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    mgf1Hash: 'sha1',
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// A few other digest combinations round-trip.
+for (const [oaepHash, mgf1Hash] of [
+  ['sha512', 'sha1'],
+  ['sha384', 'sha256'],
+  ['sha1', 'sha256'],
+]) {
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash,
+    mgf1Hash,
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash,
+    mgf1Hash,
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// mgf1Hash must be a string.
+for (const mgf1Hash of [1, true, {}, [], null]) {
+  assert.throws(() => {
+    crypto.publicEncrypt({
+      key: publicKey,
+      padding: constants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+      mgf1Hash,
+    }, input);
+  }, { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// An unknown mgf1Hash digest name is rejected.
+assert.throws(() => {
+  crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'not-a-real-digest',
+  }, input);
+}, { code: 'ERR_OSSL_EVP_INVALID_DIGEST' });
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index 03ea3e74c641..f532cf6a0c75 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -767,6 +767,7 @@ declare namespace InternalCryptoBinding {
       padding: number,
       oaepHash: string | undefined,
       oaepLabel: OptionalByteSource,
+      mgf1Hash: string | undefined,
     ]
   ) => Buffer;
 }

From 563cab119bedc50e114a885d57a43d759504b05a Mon Sep 17 00:00:00 2001
From: esgor <100363036+Eusgor@users.noreply.github.com>
Date: Fri, 17 Jul 2026 18:39:42 +0600
Subject: [PATCH 147/344] http2: avoid uaf while receiving and sending
 rst_stream

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: https://github.com/nodejs/node/issues/64113
Signed-off-by: Evgeniy Gorbanev <gorbanev.es@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64166
Backport-PR-URL: https://github.com/nodejs/node/pull/65264
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 src/node_http2.cc | 103 +++++++++++++++++++++++++++++++++++++++++++---
 src/node_http2.h  |  18 ++++++++
 2 files changed, 115 insertions(+), 6 deletions(-)

diff --git a/src/node_http2.cc b/src/node_http2.cc
index 5dfc425230e6..9af2f075d2ca 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -815,6 +815,21 @@ void Http2Session::Close(uint32_t code, bool socket_closed) {
     return;
   set_closing();
 
+  // Do not flush GOAWAY from inside nghttp2_session_mem_recv() callbacks.
+  // ConsumeHTTP2Data() finishes the close once mem_recv returns.
+  if (is_receiving()) {
+    set_close_pending();
+    pending_close_code_ = code;
+    pending_close_socket_closed_ = socket_closed;
+    return;
+  }
+
+  FinishClose(code, socket_closed);
+}
+
+void Http2Session::FinishClose(uint32_t code, bool socket_closed) {
+  CHECK(is_closing());
+
   // Stop reading on the i/o stream
   if (stream_ != nullptr) {
     set_reading_stopped();
@@ -864,6 +879,12 @@ void Http2Session::Close(uint32_t code, bool socket_closed) {
   EmitStatistics();
 }
 
+void Http2Session::MaybeFinishPendingClose() {
+  if (!is_close_pending() || is_destroyed()) return;
+  set_close_pending(false);
+  FinishClose(pending_close_code_, pending_close_socket_closed_);
+}
+
 // Locates an existing known stream by ID. nghttp2 has a similar method
 // but this is faster and does not fail if the stream is not found.
 BaseObjectPtr<Http2Stream> Http2Session::FindStream(int32_t id) {
@@ -958,11 +979,13 @@ void Http2Session::ConsumeHTTP2Data() {
         nghttp2_session_want_read(session_.get()));
   set_receive_paused(false);
   custom_recv_error_code_ = nullptr;
+  set_receiving();
   ssize_t ret =
     nghttp2_session_mem_recv(session_.get(),
                              reinterpret_cast<uint8_t*>(stream_buf_.base) +
                                  stream_buf_offset_,
                              read_len);
+  set_receiving(false);
   CHECK_NE(ret, NGHTTP2_ERR_NOMEM);
   CHECK_IMPLIES(custom_recv_error_code_ != nullptr, ret < 0);
 
@@ -976,6 +999,10 @@ void Http2Session::ConsumeHTTP2Data() {
     // Even if all bytes were received, a paused stream may delay the
     // nghttp2_on_frame_recv_callback which may have an END_STREAM flag.
     stream_buf_offset_ += ret;
+    // Still complete a Close() deferred during mem_recv; do not fall through
+    // to SendPendingData() here (paused receives historically skip that flush
+    // because a write may already be in progress).
+    MaybeFinishPendingClose();
     goto done;
   }
 
@@ -986,12 +1013,23 @@ void Http2Session::ConsumeHTTP2Data() {
   stream_buf_allocation_.reset();
   stream_buf_ = uv_buf_init(nullptr, 0);
 
+  // Finish a Close() deferred during mem_recv before flushing, so GOAWAY is
+  // not written after pending RST_STREAM frames.
+  MaybeFinishPendingClose();
+
+done:
+  // Finish a Close() deferred above before flushing, so GOAWAY is not written
+  // after pending RST_STREAM frames.
+  if (is_close_pending() && !is_destroyed()) {
+    set_close_pending(false);
+    FinishClose(pending_close_code_, pending_close_socket_closed_);
+  }
+
   // Send any data that was queued up while processing the received data.
   if (ret >= 0 && !is_destroyed()) {
     SendPendingData();
   }
 
-done:
   if (ret < 0) [[unlikely]] {
     Isolate* isolate = env()->isolate();
     Debug(this,
@@ -1405,6 +1443,9 @@ int Http2Session::OnDataChunkReceived(nghttp2_session* handle,
     len -= avail;
     stream->EmitRead(avail, buf);
 
+    // JS may have destroyed the stream from inside onread; stop delivering.
+    if (stream->is_destroyed()) break;
+
     // If the stream owner (e.g. the JS Http2Stream) wants more data, just
     // tell nghttp2 that all data has been consumed. Otherwise, defer until
     // more data is being requested.
@@ -1962,6 +2003,7 @@ uint8_t Http2Session::SendPendingData() {
   // SendPendingData should not be called recursively.
   if (is_sending())
     return 1;
+
   // This is cleared by ClearOutgoing().
   set_sending();
 
@@ -2372,10 +2414,48 @@ void Http2Stream::Destroy() {
   // Do nothing if this stream instance is already destroyed
   if (is_destroyed())
     return;
-  if (session_->has_pending_rststream(id_))
-    FlushRstStream();
+
+  // Session may already be gone if destroy was deferred across a session
+  // teardown.
+  if (!session_) {
+    set_destroyed();
+    Detach();
+    return;
+  }
+
+  // Mark destroyed immediately so OnDataChunkReceived stops EmitRead into an
+  // already-destroyed JS stream (which would treat the byte count as errno).
   set_destroyed();
 
+  // While mem_recv is active, do not FlushRstStream or RemoveStream yet:
+  // - FlushRstStream would close the nghttp2 stream before queued response
+  //   DATA can be mem_send'd after receive returns.
+  // - RemoveStream would make OnSendData/Provider::OnRead fail to FindStream.
+  // Pending RSTs stay in pending_rst_streams_ and are flushed from
+  // ClearOutgoing after the post-receive SendPendingData.
+  if (session_->is_receiving()) {
+    BaseObjectPtr<Http2Stream> strong_ref{this};
+    env()->SetImmediate(
+        [this, strong_ref](Environment*) { CompleteDestroyCleanup(); });
+    return;
+  }
+
+  if (session_->has_pending_rststream(id_)) FlushRstStream();
+
+  CompleteDestroyCleanup();
+}
+
+void Http2Stream::CompleteDestroyCleanup() {
+  if (!session_) {
+    Detach();
+    return;
+  }
+
+  // Destroy() always set_destroyed() before scheduling or calling this.
+  CHECK(is_destroyed());
+
+  if (session_->has_pending_rststream(id_)) FlushRstStream();
+
   Debug(this, "destroying stream");
 
   // Wait until the start of the next loop to delete because there
@@ -2412,7 +2492,6 @@ void Http2Stream::Destroy() {
   EmitStatistics();
 }
 
-
 // Initiates a response on the Http2Stream using data provided via the
 // StreamBase Streams API.
 int Http2Stream::SubmitResponse(const Http2Headers& headers, int options) {
@@ -2521,6 +2600,18 @@ void Http2Stream::SubmitRstStream(const uint32_t code) {
     return code == NGHTTP2_CANCEL;
   };
 
+  // Do not call `nghttp2_session_mem_send()` while nghttp2 is processing
+  // incoming data. Sending may close the stream and free nghttp2 state
+  // that is still in use by `nghttp2_session_mem_recv()`.
+  if (session_->is_receiving() && available_outbound_length_ == 0) {
+    if (is_stream_cancel(code)) {
+      session_->AddPendingRstStream(id_);
+      return;
+    }
+    FlushRstStream();
+    return;
+  }
+
   // If RST_STREAM frame is received with error code NGHTTP2_CANCEL,
   // add it to the pending list and don't force purge the data. It is
   // to avoids the double free error due to unwanted behavior of nghttp2.
@@ -2556,8 +2647,8 @@ void Http2Stream::SubmitRstStream(const uint32_t code) {
 }
 
 void Http2Stream::FlushRstStream() {
-  if (is_destroyed())
-    return;
+  if (!session_) return;
+  session_->RemovePendingRstStream(id_);
   Http2Scope h2scope(this);
   CHECK_EQ(nghttp2_submit_rst_stream(
       session_->session(),
diff --git a/src/node_http2.h b/src/node_http2.h
index 0bb2b0cb2891..f321bf0c1601 100644
--- a/src/node_http2.h
+++ b/src/node_http2.h
@@ -76,6 +76,8 @@ constexpr int kSessionStateSending = 0x10;
 constexpr int kSessionStateWriteInProgress = 0x20;
 constexpr int kSessionStateReadingStopped = 0x40;
 constexpr int kSessionStateReceivePaused = 0x80;
+constexpr int kSessionStateReceiving = 0x100;
+constexpr int kSessionStateClosePending = 0x200;
 
 // The Padding Strategy determines the method by which extra padding is
 // selected for HEADERS and DATA frames. These are configurable via the
@@ -331,6 +333,10 @@ class Http2Stream : public AsyncWrap,
   // Destroy this stream instance and free all held memory.
   void Destroy();
 
+  // Completes Destroy() after set_destroyed(); may run deferred until after
+  // nghttp2_session_mem_recv() returns.
+  void CompleteDestroyCleanup();
+
   bool is_destroyed() const {
     return flags_ & kStreamStateDestroyed;
   }
@@ -659,6 +665,8 @@ class Http2Session : public AsyncWrap,
   IS_FLAG(write_in_progress, kSessionStateWriteInProgress)
   IS_FLAG(reading_stopped, kSessionStateReadingStopped)
   IS_FLAG(receive_paused, kSessionStateReceivePaused)
+  IS_FLAG(receiving, kSessionStateReceiving)
+  IS_FLAG(close_pending, kSessionStateClosePending)
 
 #undef IS_FLAG
 
@@ -702,6 +710,10 @@ class Http2Session : public AsyncWrap,
            std::ranges::find(pending_rst_streams_, stream_id);
   }
 
+  void RemovePendingRstStream(int32_t stream_id) {
+    std::erase(pending_rst_streams_, stream_id);
+  }
+
   // Handle reads/writes from the underlying network transport.
   uv_buf_t OnStreamAlloc(size_t suggested_size) override;
   void OnStreamRead(ssize_t nread, const uv_buf_t& buf) override;
@@ -951,6 +963,10 @@ class Http2Session : public AsyncWrap,
   std::vector<uint8_t> outgoing_storage_;
   size_t outgoing_length_ = 0;
   std::vector<int32_t> pending_rst_streams_;
+  // Saved arguments for Close() deferred while nghttp2_session_mem_recv()
+  // callbacks are active.
+  uint32_t pending_close_code_ = NGHTTP2_NO_ERROR;
+  bool pending_close_socket_closed_ = false;
   // Count streams that have been rejected while being opened. Exceeding a fixed
   // limit will result in the session being destroyed, as an indication of a
   // misbehaving peer. This counter is reset once new streams are being
@@ -965,6 +981,8 @@ class Http2Session : public AsyncWrap,
 
   void CopyDataIntoOutgoing(const uint8_t* src, size_t src_length);
   void ClearOutgoing(int status);
+  void FinishClose(uint32_t code, bool socket_closed);
+  void MaybeFinishPendingClose();
 
   void MaybeNotifyGracefulCloseComplete();
 

From ffe1e7cbea97daa0aa91654fa29dc79f377e43ce Mon Sep 17 00:00:00 2001
From: Stewart X Addison <6487691+sxa@users.noreply.github.com>
Date: Sun, 16 Aug 2026 10:40:47 +0100
Subject: [PATCH 148/344] build: update binary-upload to use correct tarball
 name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

the binary-upload target uses $(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz as the
name to upload whereas it is created by the $(BINARYTAR) target as
$(BINARYNAME). Since BINARYNAME includes the optional VARIATION when
present this gets missed out int he binary-upload target, for example
during a release build for Alpine/musl. This commit changes the
binary-upload target to use the same variable for the tarball that is
used when the file is created.

Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/65282
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 Makefile | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Makefile b/Makefile
index bc9dd7a144db..10292db04e8c 100644
--- a/Makefile
+++ b/Makefile
@@ -1449,15 +1449,15 @@ binary: $(BINARYTAR) ## Build release binary tarballs.
 # Note: this is strictly for release builds on release machines only.
 binary-upload: binary
 	ssh $(STAGINGSERVER) "mkdir -p nodejs/$(DISTTYPEDIR)/$(FULLVERSION)"
-	chmod 664 $(TARNAME)-$(OSTYPE)-$(ARCH).tar.gz
-	scp -p $(TARNAME)-$(OSTYPE)-$(ARCH).tar.gz $(STAGINGSERVER):nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.gz
-	ssh $(STAGINGSERVER) "rclone copyto nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.gz $(CLOUDFLARE_BUCKET)/nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.gz"
-	ssh $(STAGINGSERVER) "touch nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.gz.done"
+	chmod 664 $(BINARYNAME).tar.gz
+	scp -p $(BINARYNAME).tar.gz $(STAGINGSERVER):nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.gz
+	ssh $(STAGINGSERVER) "rclone copyto nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.gz $(CLOUDFLARE_BUCKET)/nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.gz"
+	ssh $(STAGINGSERVER) "touch nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.gz.done"
 ifeq ($(XZ), 1)
-	chmod 664 $(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz
-	scp -p $(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz $(STAGINGSERVER):nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz
-	ssh $(STAGINGSERVER) "rclone copyto nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz $(CLOUDFLARE_BUCKET)/nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz"
-	ssh $(STAGINGSERVER) "touch nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz.done"
+	chmod 664 $(BINARYNAME).tar.xz
+	scp -p $(BINARYNAME).tar.xz $(STAGINGSERVER):nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.xz
+	ssh $(STAGINGSERVER) "rclone copyto nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.xz $(CLOUDFLARE_BUCKET)/nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.xz"
+	ssh $(STAGINGSERVER) "touch nodejs/$(DISTTYPEDIR)/$(FULLVERSION)/$(BINARYNAME).tar.xz.done"
 endif
 
 .PHONY: bench-all

From 17d2b067bf8ab6a8517f14135daf4ebdcb2ed52f Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 22 Aug 2026 13:31:02 +0200
Subject: [PATCH 149/344] tools: update BoringSSL pin on v26.x

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65483
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 tools/nix/openssl-matrix.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index 56cc7d506ad6..2a6a30183e22 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -8,9 +8,14 @@
   # "default" OpenSSL release line, should be kept in sync with the bundled version:
   openssl = pkgs.openssl_3_5;
 
+  # Using an updated version of BoringSSL as we do not support the old version anymore.
+  boringssl = pkgs.callPackage (builtins.fetchurl {
+    url = "https://github.com/NixOS/nixpkgs/raw/6062ba1a1b8b6281b12533c9075a2dbeb38f7e49/pkgs/by-name/bo/boringssl/package.nix";
+    sha256 = "01n2ga83ds5m9hz88z635g3q1c141ka2qs9k576c62v3fdpgcj6i";
+  }) { };
+
   # Other OpenSSL variants we want to test for:
   inherit (pkgs)
-    boringssl
     openssl_1_1
     openssl_3
     openssl_3_6

From 0e87576ed403015d588aaeb5ae4385a6989fe966 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Thu, 20 Aug 2026 12:27:18 +0200
Subject: [PATCH 150/344] crypto: remove obsolete BoringSSL shims

BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides
compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused by the early callback migration
and require the fixed ML-KEM private-key import error.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65423
Backport-PR-URL: https://github.com/nodejs/node/pull/65483
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 deps/ncrypto/ncrypto.cc                       | 77 -------------------
 deps/ncrypto/ncrypto.h                        |  3 -
 .../test-webcrypto-export-import-ml-kem.js    |  6 +-
 3 files changed, 2 insertions(+), 84 deletions(-)

diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index d731e823b39d..b248935b61bf 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -396,15 +396,7 @@ std::optional<std::string> CryptoErrorList::pop_front() {
 
 // ============================================================================
 DataPointer DataPointer::Alloc(size_t len) {
-#ifdef OPENSSL_IS_BORINGSSL
-  // Boringssl does not implement OPENSSL_zalloc
-  auto ptr = OPENSSL_malloc(len);
-  if (ptr == nullptr) return {};
-  memset(ptr, 0, len);
-  return DataPointer(ptr, len);
-#else
   return DataPointer(OPENSSL_zalloc(len), len);
-#endif
 }
 
 DataPointer DataPointer::SecureAlloc(size_t len) {
@@ -427,18 +419,11 @@ DataPointer DataPointer::SecureAlloc(size_t len) {
 }
 
 size_t DataPointer::GetSecureHeapUsed() {
-#ifndef OPENSSL_IS_BORINGSSL
   return CRYPTO_secure_malloc_initialized() ? CRYPTO_secure_used() : 0;
-#else
-  // BoringSSL does not have the secure heap and therefore
-  // will always return 0.
-  return 0;
-#endif
 }
 
 DataPointer::InitSecureHeapResult DataPointer::TryInitSecureHeap(size_t amount,
                                                                  size_t min) {
-#ifndef OPENSSL_IS_BORINGSSL
   switch (CRYPTO_secure_malloc_init(amount, min)) {
     case 0:
       return InitSecureHeapResult::FAILED;
@@ -449,10 +434,6 @@ DataPointer::InitSecureHeapResult DataPointer::TryInitSecureHeap(size_t amount,
     default:
       return InitSecureHeapResult::FAILED;
   }
-#else
-  // BoringSSL does not actually support the secure heap
-  return InitSecureHeapResult::FAILED;
-#endif
 }
 
 DataPointer DataPointer::Copy(const Buffer<const void>& buffer) {
@@ -580,12 +561,7 @@ BignumPointer BignumPointer::New() {
 }
 
 BignumPointer BignumPointer::NewSecure() {
-#ifdef OPENSSL_IS_BORINGSSL
-  // Boringssl does not implement BN_secure_new.
-  return New();
-#else
   return BignumPointer(BN_secure_new());
-#endif
 }
 
 BignumPointer& BignumPointer::operator=(BignumPointer&& other) noexcept {
@@ -4288,59 +4264,6 @@ std::optional<uint32_t> SSLPointer::verifyPeerCertificate() const {
   return std::nullopt;
 }
 
-const char* SSLPointer::getClientHelloAlpn() const {
-  if (ssl_ == nullptr) return {};
-#ifndef OPENSSL_IS_BORINGSSL
-  const unsigned char* buf;
-  size_t len;
-  size_t rem;
-
-  if (!SSL_client_hello_get0_ext(
-          get(),
-          TLSEXT_TYPE_application_layer_protocol_negotiation,
-          &buf,
-          &rem) ||
-      rem < 2) {
-    return {};
-  }
-
-  len = (buf[0] << 8) | buf[1];
-  if (len + 2 != rem) return {};
-  return reinterpret_cast<const char*>(buf + 3);
-#else
-  // Boringssl doesn't have a public API for this.
-  return {};
-#endif
-}
-
-const char* SSLPointer::getClientHelloServerName() const {
-  if (ssl_ == nullptr) return {};
-#ifndef OPENSSL_IS_BORINGSSL
-  const unsigned char* buf;
-  size_t len;
-  size_t rem;
-
-  if (!SSL_client_hello_get0_ext(get(), TLSEXT_TYPE_server_name, &buf, &rem) ||
-      rem <= 2) {
-    return {};
-  }
-
-  len = (*buf << 8) | *(buf + 1);
-  if (len + 2 != rem) return {};
-  rem = len;
-
-  if (rem == 0 || *(buf + 2) != TLSEXT_NAMETYPE_host_name) return {};
-  rem--;
-  if (rem <= 2) return {};
-  len = (*(buf + 3) << 8) | *(buf + 4);
-  if (len + 2 > rem) return {};
-  return reinterpret_cast<const char*>(buf + 5);
-#else
-  // Boringssl doesn't have a public API for this.
-  return {};
-#endif
-}
-
 std::optional<const std::string_view> SSLPointer::GetServerName(
     const SSL* ssl) {
   if (ssl == nullptr) return std::nullopt;
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index a11d67ae460a..343b3575bb82 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -1346,9 +1346,6 @@ class SSLPointer final {
   bool setSession(const SSLSessionPointer& session);
   bool setSniContext(const SSLCtxPointer& ctx) const;
 
-  const char* getClientHelloAlpn() const;
-  const char* getClientHelloServerName() const;
-
   std::optional<const std::string_view> getServerName() const;
   X509View getCertificate() const;
   EVPKeyPointer getPeerTempKey() const;
diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js
index a3b1b3fe7730..cd05224969c8 100644
--- a/test/parallel/test-webcrypto-export-import-ml-kem.js
+++ b/test/parallel/test-webcrypto-export-import-ml-kem.js
@@ -107,10 +107,8 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
   } catch (err) {
     if (process.features.openssl_is_boringssl) {
       assert.strictEqual(err.name, 'DataError');
-      // It should really only be ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED
-      // but BoringSSL is inconsistent between handling ML-KEM and ML-DSA
-      // Fixed in https://github.com/google/boringssl/commit/94c4c7f9e0eeeff72ea1ac6abf1aed5bd2a82c0c
-      assert.match(err.cause.code, /ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM|ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED/);
+      assert.strictEqual(err.cause.code,
+                         'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
       common.printSkipMessage('Skipping unsupported private key format test');
       return;
     }

From 137ff67fd34a994e00a978e8b06af7b0c550a6a0 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Thu, 20 Aug 2026 12:36:11 +0200
Subject: [PATCH 151/344] crypto: use available BoringSSL APIs

Use BoringSSL's current RSA and DH validation results instead of
maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level
through BoringSSL's compatibility APIs.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65423
Backport-PR-URL: https://github.com/nodejs/node/pull/65483
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 deps/ncrypto/ncrypto.cc                       | 20 ++++----
 deps/ncrypto/ncrypto.h                        | 15 ++----
 src/crypto/crypto_dh.cc                       |  2 -
 src/crypto/crypto_rsa.cc                      | 12 -----
 test/common/boringssl.js                      | 13 ++---
 test/parallel/test-crypto-dh-curves.js        | 50 +++++++++----------
 test/parallel/test-crypto-dh.js               |  4 +-
 test/parallel/test-crypto-keygen.js           | 31 +++++-------
 test/parallel/test-crypto-sec-level.js        |  6 ++-
 .../test-tls-client-getephemeralkeyinfo.js    |  2 +-
 10 files changed, 66 insertions(+), 89 deletions(-)

diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index b248935b61bf..089465ad5b95 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -2252,14 +2252,11 @@ DHPointer::CheckPublicKeyResult DHPointer::checkPublicKey(
   if (DH_check_pub_key(dh_.get(), pub_key.get(), &codes) != 1) {
     return DHPointer::CheckPublicKeyResult::CHECK_FAILED;
   }
-#ifndef OPENSSL_IS_BORINGSSL
-  // Boringssl does not define DH_CHECK_PUBKEY_TOO_SMALL or TOO_LARGE
   if (codes & DH_CHECK_PUBKEY_TOO_SMALL) {
     return DHPointer::CheckPublicKeyResult::TOO_SMALL;
   } else if (codes & DH_CHECK_PUBKEY_TOO_LARGE) {
     return DHPointer::CheckPublicKeyResult::TOO_LARGE;
   }
-#endif
   if (codes != 0) {
     return DHPointer::CheckPublicKeyResult::INVALID;
   }
@@ -4309,6 +4306,13 @@ std::optional<std::string_view> SSLPointer::getNegotiatedGroup() const {
   const char* group = SSL_get0_group_name(get());
   if (group == nullptr) return std::nullopt;
   return group;
+#elif defined(OPENSSL_IS_BORINGSSL)
+  if (!ssl_) return std::nullopt;
+  const int nid = SSL_get_negotiated_group(get());
+  if (nid == NID_undef) return std::nullopt;
+  const char* group = OBJ_nid2sn(nid);
+  if (group == nullptr) return std::nullopt;
+  return group;
 #else
   return std::nullopt;
 #endif
@@ -4333,19 +4337,17 @@ std::optional<std::string_view> SSLPointer::getCipherVersion() const {
 }
 
 std::optional<int> SSLPointer::getSecurityLevel() {
-#ifndef OPENSSL_IS_BORINGSSL
   auto ctx = SSLCtxPointer::New();
   if (!ctx) return std::nullopt;
 
+#ifdef OPENSSL_IS_BORINGSSL
+  return SSL_CTX_get_security_level(ctx.get());
+#else
   auto ssl = SSLPointer::New(ctx);
   if (!ssl) return std::nullopt;
 
   return SSL_get_security_level(ssl);
-#else
-  // OPENSSL_TLS_SECURITY_LEVEL is not defined in BoringSSL
-  // so assume it is the default OPENSSL_TLS_SECURITY_LEVEL value.
-  return 1;
-#endif  // OPENSSL_IS_BORINGSSL
+#endif
 }
 
 SSLCtxPointer::SSLCtxPointer(SSL_CTX* ctx) : ctx_(ctx) {}
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 343b3575bb82..26b359d1f231 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -1231,9 +1231,9 @@ class DHPointer final {
     UNABLE_TO_CHECK_GENERATOR = 0x04,
     NOT_SUITABLE_GENERATOR = 0x08,
     Q_NOT_PRIME = 0x10,
-#ifndef OPENSSL_IS_BORINGSSL
-    // Boringssl does not define the DH_CHECK_INVALID_[Q or J]_VALUE
     INVALID_Q = 0x20,
+#ifndef OPENSSL_IS_BORINGSSL
+    // BoringSSL does not define DH_CHECK_INVALID_J_VALUE.
     INVALID_J = 0x40,
     MODULUS_TOO_SMALL = 0x80,
     MODULUS_TOO_LARGE = 0x100,
@@ -1244,14 +1244,9 @@ class DHPointer final {
 
   enum class CheckPublicKeyResult {
     NONE,
-#ifndef OPENSSL_IS_BORINGSSL
-    // Boringssl does not define DH_R_CHECK_PUBKEY_TOO_SMALL or TOO_LARGE
-    TOO_SMALL = DH_R_CHECK_PUBKEY_TOO_SMALL,
-    TOO_LARGE = DH_R_CHECK_PUBKEY_TOO_LARGE,
-    INVALID = DH_R_CHECK_PUBKEY_INVALID,
-#else
-    INVALID = DH_R_INVALID_PUBKEY,
-#endif
+    TOO_SMALL,
+    TOO_LARGE,
+    INVALID,
     CHECK_FAILED = 512,
   };
   // Check to see if the given public key is suitable for this DH instance.
diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
index b41a6ec7e75c..5ad2d6be9e1b 100644
--- a/src/crypto/crypto_dh.cc
+++ b/src/crypto/crypto_dh.cc
@@ -319,12 +319,10 @@ void ComputeSecret(const FunctionCallbackInfo<Value>& args) {
     case DHPointer::CheckPublicKeyResult::CHECK_FAILED:
       return THROW_ERR_CRYPTO_INVALID_KEYTYPE(env,
                                               "Unspecified validation error");
-#ifndef OPENSSL_IS_BORINGSSL
     case DHPointer::CheckPublicKeyResult::TOO_SMALL:
       return THROW_ERR_CRYPTO_INVALID_KEYLEN(env, "Supplied key is too small");
     case DHPointer::CheckPublicKeyResult::TOO_LARGE:
       return THROW_ERR_CRYPTO_INVALID_KEYLEN(env, "Supplied key is too large");
-#endif
     case DHPointer::CheckPublicKeyResult::INVALID:
       return THROW_ERR_CRYPTO_INVALID_KEYTYPE(env, "Supplied key is invalid");
     case DHPointer::CheckPublicKeyResult::NONE:
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index c89d6b698b2b..15479284933d 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -137,18 +137,6 @@ Maybe<void> RsaKeyGenTraits::AdditionalConfig(
   params->params.modulus_bits = args[*offset + 1].As<Uint32>()->Value();
   params->params.exponent = args[*offset + 2].As<Uint32>()->Value();
 
-#ifdef OPENSSL_IS_BORINGSSL
-  // BoringSSL hangs indefinitely generating an RSA key with e=1, and for
-  // other invalid exponents (e=0, even values) reports the misleading error
-  // RSA_R_TOO_MANY_ITERATIONS only after running the full keygen loop. Reject
-  // those up-front with a clear error. The constraint here (odd integer >= 3)
-  // matches BoringSSL's own rsa_check_public_key validation.
-  if (params->params.exponent < 3 || (params->params.exponent & 1) == 0) {
-    THROW_ERR_OUT_OF_RANGE(env, "publicExponent is invalid");
-    return Nothing<void>();
-  }
-#endif
-
   *offset += 3;
 
   if (params->params.variant == kKeyVariantRSA_PSS) {
diff --git a/test/common/boringssl.js b/test/common/boringssl.js
index e6e91387c304..ab7f0505b0ce 100644
--- a/test/common/boringssl.js
+++ b/test/common/boringssl.js
@@ -137,12 +137,9 @@ function testRenegotiationUnsupported() {
 }
 
 /**
- * OpenSSL exposes the negotiated ephemeral key type, name, and size for TLS
- * clients. With BoringSSL the same ECDHE TLS 1.2 handshake succeeds, but
- * getEphemeralKeyInfo() returns null on the server side and an object whose
- * fields are undefined on the client side.
+ * BoringSSL exposes the negotiated TLS group but not the ephemeral key size.
  */
-function testEphemeralKeyInfoUnsupported() {
+function testEphemeralKeyInfo() {
   const server = tls.createServer({
     key: fixtures.readKey('agent2-key.pem'),
     cert: fixtures.readKey('agent2-cert.pem'),
@@ -161,8 +158,8 @@ function testEphemeralKeyInfoUnsupported() {
       maxVersion: 'TLSv1.2',
     }, common.mustCall(() => {
       assert.deepStrictEqual(client.getEphemeralKeyInfo(), {
-        type: undefined,
-        name: undefined,
+        type: 'TLSGroup',
+        name: 'prime256v1',
         size: undefined,
       });
       server.close();
@@ -337,7 +334,7 @@ module.exports = {
   assertMultiKeyUnsupported,
   assertNoCipherMatch,
   assertOpenSSLSecurityLevelsUnsupported,
-  testEphemeralKeyInfoUnsupported,
+  testEphemeralKeyInfo,
   testLegacyProtocolUnsupported,
   testMultiPfxSelectionDifference,
   testPskTls13Unsupported,
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index c2449a292894..ee8849163ae8 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -35,33 +35,33 @@ if (!process.features.openssl_is_boringssl) {
   assert.strictEqual(
     crypto.createDiffieHellman(notSafePrime, Buffer.from([2])).verifyError,
     DH_CHECK_P_NOT_SAFE_PRIME);
-
-  const group = crypto.getDiffieHellman('modp14');
-  const alice = crypto.createDiffieHellman(
-    group.getPrime(), group.getGenerator());
-  alice.generateKeys();
-  const groupPrime = BigInt(`0x${group.getPrime('hex')}`);
-  assert.throws(
-    () => alice.computeSecret(Buffer.from([1])),
-    {
-      code: 'ERR_CRYPTO_INVALID_KEYLEN',
-      message: 'Supplied key is too small'
-    });
-  assert.throws(
-    () => alice.computeSecret(group.getPrime()),
-    {
-      code: 'ERR_CRYPTO_INVALID_KEYLEN',
-      message: 'Supplied key is too large'
-    });
-  assert.throws(
-    () => alice.computeSecret(
-      Buffer.from((groupPrime - 1n).toString(16), 'hex')),
-    {
-      code: 'ERR_CRYPTO_INVALID_KEYLEN',
-      message: 'Supplied key is too large'
-    });
 }
 
+const group = crypto.getDiffieHellman('modp14');
+const alice = crypto.createDiffieHellman(
+  group.getPrime(), group.getGenerator());
+alice.generateKeys();
+const groupPrime = BigInt(`0x${group.getPrime('hex')}`);
+assert.throws(
+  () => alice.computeSecret(Buffer.from([1])),
+  {
+    code: 'ERR_CRYPTO_INVALID_KEYLEN',
+    message: 'Supplied key is too small'
+  });
+assert.throws(
+  () => alice.computeSecret(group.getPrime()),
+  {
+    code: 'ERR_CRYPTO_INVALID_KEYLEN',
+    message: 'Supplied key is too large'
+  });
+assert.throws(
+  () => alice.computeSecret(
+    Buffer.from((groupPrime - 1n).toString(16), 'hex')),
+  {
+    code: 'ERR_CRYPTO_INVALID_KEYLEN',
+    message: 'Supplied key is too large'
+  });
+
 // Confirm DH_check() results are exposed for optional examination.
 const bad_dh = process.features.openssl_is_boringssl ?
   crypto.createDiffieHellman('abcd', 'hex', 0) :
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index dc55c5226efb..f5d239f1d457 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -93,9 +93,7 @@ const {
   {
     assert.throws(() => {
       dh3.computeSecret('');
-    }, { message: process.features.openssl_is_boringssl ?
-      'Supplied key is invalid' :
-      'Supplied key is too small' });
+    }, { message: 'Supplied key is too small' });
   }
 }
 
diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
index 1a616ed5d11f..c525a54aa434 100644
--- a/test/parallel/test-crypto-keygen.js
+++ b/test/parallel/test-crypto-keygen.js
@@ -376,25 +376,20 @@ const isBoringSSL = process.features.openssl_is_boringssl;
   }
 
   // Test invalid exponents. (caught by OpenSSL)
+  let invalidExponentError = /bad e value/;
+  if (isBoringSSL) {
+    invalidExponentError = /BAD_E_VALUE/;
+  } else if (hasOpenSSL3) {
+    invalidExponentError = /exponent/;
+  }
   for (const publicExponent of [1, 1 + 0x10001]) {
-    if (isBoringSSL) {
-      assert.throws(() => generateKeyPair('rsa', {
-        modulusLength: 4096,
-        publicExponent
-      }, common.mustNotCall()), {
-        name: 'RangeError',
-        code: 'ERR_OUT_OF_RANGE',
-        message: 'publicExponent is invalid',
-      });
-    } else {
-      generateKeyPair('rsa', {
-        modulusLength: 4096,
-        publicExponent
-      }, common.mustCall((err) => {
-        assert.strictEqual(err.name, 'Error');
-        assert.match(err.message, hasOpenSSL3 ? /exponent/ : /bad e value/);
-      }));
-    }
+    generateKeyPair('rsa', {
+      modulusLength: 4096,
+      publicExponent
+    }, common.mustCall((err) => {
+      assert.strictEqual(err.name, 'Error');
+      assert.match(err.message, invalidExponentError);
+    }));
   }
 }
 
diff --git a/test/parallel/test-crypto-sec-level.js b/test/parallel/test-crypto-sec-level.js
index d7d2252be6c3..f2c0e3900624 100644
--- a/test/parallel/test-crypto-sec-level.js
+++ b/test/parallel/test-crypto-sec-level.js
@@ -15,4 +15,8 @@ const assert = require('assert');
 // This test simply validates that we can get some value for the secLevel
 // when needed by tests.
 const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
-assert.ok(secLevel >= 0 && secLevel <= 5);
+if (process.features.openssl_is_boringssl) {
+  assert.strictEqual(secLevel, 0);
+} else {
+  assert.ok(secLevel >= 0 && secLevel <= 5);
+}
diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
index db41fdf6a098..638df3ff0141 100644
--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
+++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -4,7 +4,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 if (process.features.openssl_is_boringssl) {
-  require('../common/boringssl').testEphemeralKeyInfoUnsupported();
+  require('../common/boringssl').testEphemeralKeyInfo();
   return;
 }
 

From c18b0aa54e6e7369689c70b3e83c3345d0c23e17 Mon Sep 17 00:00:00 2001
From: avivkeller <me@aviv.sh>
Date: Sat, 18 Jul 2026 19:28:42 -0700
Subject: [PATCH 152/344] repl: add basic syntax highlighting

Signed-off-by: avivkeller <me@aviv.sh>
PR-URL: https://github.com/nodejs/node/pull/64591
Backport-PR-URL: https://github.com/nodejs/node/pull/65267
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/internal/readline/interface.js            | 20 +++--
 lib/internal/repl/highlight.js                | 89 +++++++++++++++++++
 lib/internal/util/inspect.js                  |  1 +
 lib/repl.js                                   |  2 +
 test/parallel/test-repl-highlight.js          | 61 +++++++++++++
 test/parallel/test-repl-multiline.js          | 19 ++--
 test/parallel/test-repl-preview-newlines.js   |  9 +-
 .../test-repl-preview-without-inspector.js    |  6 +-
 test/parallel/test-repl-preview.js            |  6 +-
 test/parallel/test-repl-reverse-search.js     |  9 +-
 test/parallel/test-repl-top-level-await.js    |  6 +-
 11 files changed, 209 insertions(+), 19 deletions(-)
 create mode 100644 lib/internal/repl/highlight.js
 create mode 100644 test/parallel/test-repl-highlight.js

diff --git a/lib/internal/readline/interface.js b/lib/internal/readline/interface.js
index 729892ff670d..bc8f30427616 100644
--- a/lib/internal/readline/interface.js
+++ b/lib/internal/readline/interface.js
@@ -157,6 +157,7 @@ const kPreviousCursorCols = Symbol('_previousCursorCols');
 const kMultilineMove = Symbol('_multilineMove');
 const kPreviousPrevRows = Symbol('_previousPrevRows');
 const kAddNewLineOnTTY = Symbol('_addNewLineOnTTY');
+const kColorize = Symbol('_colorize');
 
 function InterfaceConstructor(input, output, completer, terminal) {
   this[kSawReturnAt] = 0;
@@ -164,6 +165,7 @@ function InterfaceConstructor(input, output, completer, terminal) {
   // might want to expose an alias and document that instead.
   this.isCompletionEnabled = true;
   this[kSawKeyPress] = false;
+  this[kColorize] = undefined;
   this[kPreviousKey] = null;
   this.escapeCodeTimeout = ESCAPE_CODE_TIMEOUT;
   this.tabSize = 8;
@@ -186,6 +188,7 @@ function InterfaceConstructor(input, output, completer, terminal) {
     const historySize = input.historySize;
     const history = input.history;
     const removeHistoryDuplicates = input.removeHistoryDuplicates;
+    this[kColorize] = input.colorize;
 
     if (input.tabSize !== undefined) {
       validateUint32(input.tabSize, 'tabSize', true);
@@ -523,15 +526,18 @@ class Interface extends InterfaceConstructor {
     if (this[kIsMultiline]) {
       const lines = StringPrototypeSplit(this.line, '\n');
       // Write first line with normal prompt
-      this[kWriteToOutput](this[kPrompt] + lines[0]);
+      this[kWriteToOutput](this[kPrompt] +
+                           (this[kColorize]?.(lines[0]) ?? lines[0]));
 
       // For continuation lines, add the "|" prefix
       for (let i = 1; i < lines.length; i++) {
-        this[kWriteToOutput](`\n${kMultilinePrompt.description}` + lines[i]);
+        this[kWriteToOutput](`\n${kMultilinePrompt.description}` +
+                             (this[kColorize]?.(lines[i]) ?? lines[i]));
       }
     } else {
       // Write the prompt and the current buffer content.
-      this[kWriteToOutput](line);
+      this[kWriteToOutput](this[kPrompt] +
+                           (this[kColorize]?.(this.line) ?? this.line));
     }
 
     // Force terminal to allocate a new line
@@ -687,7 +693,11 @@ class Interface extends InterfaceConstructor {
         this.line += c;
       }
       this.cursor += c.length;
-      this[kWriteToOutput](c);
+      if (this[kColorize] === undefined) {
+        this[kWriteToOutput](c);
+      } else {
+        this[kRefreshLine]();
+      }
       return;
     }
     if (this.cursor < this.line.length) {
@@ -706,7 +716,7 @@ class Interface extends InterfaceConstructor {
       this.cursor += c.length;
       const newPos = this.getCursorPos();
 
-      if (oldPos.rows < newPos.rows) {
+      if (oldPos.rows < newPos.rows || this[kColorize] !== undefined) {
         this[kRefreshLine]();
       } else {
         this[kWriteToOutput](c);
diff --git a/lib/internal/repl/highlight.js b/lib/internal/repl/highlight.js
new file mode 100644
index 000000000000..f49306d62891
--- /dev/null
+++ b/lib/internal/repl/highlight.js
@@ -0,0 +1,89 @@
+'use strict';
+
+const {
+  FunctionPrototypeBind,
+  StringPrototypeSlice,
+} = primordials;
+
+const { stylizeWithColor } = require('internal/util/inspect');
+const { Parser } = require('internal/deps/acorn/acorn/dist/acorn');
+
+const tokenizer = FunctionPrototypeBind(Parser.tokenizer, Parser);
+
+function tokenStyle(token) {
+  const { label, keyword } = token.type;
+
+  if (keyword !== undefined) {
+    if (label === 'true' || label === 'false') return 'boolean';
+    if (label === 'null') return 'null';
+    if (label === 'import' || label === 'export') return 'module';
+    return 'special';
+  }
+
+  switch (label) {
+    case 'name':
+      switch (token.value) {
+        case 'undefined':
+          return 'undefined';
+        case 'NaN':
+        case 'Infinity':
+          return 'number';
+        case 'Symbol':
+          return 'symbol';
+        case 'Date':
+          return 'date';
+        default:
+          return undefined;
+      }
+    case 'num':
+      return 'number';
+    case 'bigint':
+      return 'bigint';
+    case 'string':
+    case 'template':
+    case '`':
+      return 'string';
+    case 'regexp':
+      return 'regexp';
+    default:
+      return undefined;
+  }
+}
+
+function highlight(code) {
+  if (code.length === 0) return code;
+
+  let result = '';
+  let offset = 0;
+  function write(start, end, style) {
+    result +=
+      StringPrototypeSlice(code, offset, start) +
+      stylizeWithColor(StringPrototypeSlice(code, start, end), style);
+    offset = end;
+  }
+
+  try {
+    const iterator = tokenizer(code, {
+      __proto__: null,
+      allowHashBang: true,
+      ecmaVersion: 'latest',
+      onComment(_block, _text, start, end) {
+        write(start, end, 'undefined');
+      },
+    });
+
+    for (const token of iterator) {
+      const style = tokenStyle(token);
+      if (style !== undefined) {
+        write(token.start, token.end, style);
+      }
+    }
+  } catch {
+    // Acorn throws for unfinished strings, templates, and comments. Tokens and
+    // comments reported before that point are still useful while typing.
+  }
+
+  return result + StringPrototypeSlice(code, offset);
+}
+
+module.exports = { highlight };
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index c959c056fece..193ae8524632 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -3057,6 +3057,7 @@ module.exports = {
   identicalSequenceRange,
   inspect,
   inspectDefaultOptions,
+  stylizeWithColor,
   format,
   formatWithOptions,
   getStringWidth,
diff --git a/lib/repl.js b/lib/repl.js
index adb64db323be..1e6fdeb7110a 100644
--- a/lib/repl.js
+++ b/lib/repl.js
@@ -109,6 +109,7 @@ const {
 } = require('internal/readline/utils');
 const { Console } = require('console');
 const { shouldColorize } = require('internal/util/colors');
+const { highlight } = require('internal/repl/highlight');
 const CJSModule = require('internal/modules/cjs/loader').Module;
 const { AsyncLocalStorage } = require('async_hooks');
 let debug = require('internal/util/debuglog').debuglog('repl', (fn) => {
@@ -326,6 +327,7 @@ class REPLServer extends Interface {
       terminal: options.terminal,
       historySize: options.historySize,
       prompt,
+      colorize: options.useColors ? highlight : undefined,
     });
 
     ObjectDefineProperty(this, 'inputStream', {
diff --git a/test/parallel/test-repl-highlight.js b/test/parallel/test-repl-highlight.js
new file mode 100644
index 000000000000..77ed45294368
--- /dev/null
+++ b/test/parallel/test-repl-highlight.js
@@ -0,0 +1,61 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { inspect, stripVTControlCharacters } = require('util');
+const ArrayStream = require('../common/arraystream');
+const { highlight } = require('internal/repl/highlight');
+const { REPLServer } = require('repl');
+
+common.skipIfInspectorDisabled();
+
+assert.strictEqual(stripVTControlCharacters(highlight(
+  'const /* comment */ answer = 42; // comment',
+)), 'const /* comment */ answer = 42; // comment');
+
+assert.strictEqual(
+  highlight('const value = "text"'),
+  `\u001b[${inspect.colors.cyan[0]}mconst\u001b[${inspect.colors.cyan[1]}m value = ` +
+  `\u001b[${inspect.colors.green[0]}m"text"\u001b[${inspect.colors.green[1]}m`,
+);
+
+for (const source of [
+  'undefined',
+  'NaN',
+  'Infinity',
+  'Symbol.iterator',
+  'Date.now()',
+  'true',
+  'null',
+  '1n',
+  '/regexp/u',
+  'import("node:fs")',
+]) {
+  assert.notStrictEqual(highlight(source), source);
+}
+
+// Incomplete source is expected while the user is typing.
+highlight('const value = "');
+
+{
+  const input = new ArrayStream();
+  const output = new ArrayStream();
+  let rendered = '';
+  output.write = (chunk) => {
+    rendered += chunk;
+  };
+
+  const repl = new REPLServer({
+    input,
+    output,
+    prompt: '',
+    terminal: true,
+    useColors: false,
+  });
+  rendered = '';
+  repl.write('const');
+
+  assert.strictEqual(rendered, 'const');
+  repl.close();
+}
diff --git a/test/parallel/test-repl-multiline.js b/test/parallel/test-repl-multiline.js
index 6aecb6701144..3bcb657713d8 100644
--- a/test/parallel/test-repl-multiline.js
+++ b/test/parallel/test-repl-multiline.js
@@ -2,6 +2,7 @@
 const common = require('../common');
 const assert = require('assert');
 const { startNewREPLServer } = require('../common/repl');
+const { stripVTControlCharacters } = require('util');
 
 const input = ['const foo = {', '};', 'foo'];
 
@@ -9,16 +10,16 @@ function run({ useColors }) {
   const { replServer, output } = startNewREPLServer({ useColors });
 
   replServer.on('exit', common.mustCall(() => {
-    const actual = output.accumulator.split('\n');
+    // The output contains various escape codes, including
+    // screen clears and others, so we trim them all to
+    // simplify this test.
+    const actual = stripVTControlCharacters(output.accumulator);
 
-    // Validate the output, which contains terminal escape codes.
-    assert.strictEqual(actual.length, 6);
-    assert.ok(actual[0].endsWith(input[0]));
-    assert.ok(actual[1].includes('| '));
-    assert.ok(actual[1].endsWith(input[1]));
-    assert.ok(actual[2].includes('undefined'));
-    assert.ok(actual[3].endsWith(input[2]));
-    assert.strictEqual(actual[4], '{}');
+    const firstStatementIdx = actual.indexOf(input.slice(0, 1).join('\n| '));
+    assert(firstStatementIdx > -1);
+
+    assert(actual.slice(firstStatementIdx).includes('undefined'));
+    assert(actual.slice(firstStatementIdx).includes('foo'));
   }));
 
   input.forEach((line) => replServer.write(`${line}\n`));
diff --git a/test/parallel/test-repl-preview-newlines.js b/test/parallel/test-repl-preview-newlines.js
index 34a944beb538..8522b08f6c7c 100644
--- a/test/parallel/test-repl-preview-newlines.js
+++ b/test/parallel/test-repl-preview-newlines.js
@@ -6,7 +6,14 @@ const { startNewREPLServer } = require('../common/repl');
 
 common.skipIfInspectorDisabled();
 
-const { input, output } = startNewREPLServer({ useColors: true });
+// Ignore terminal settings so the preview remains active under TERM=dumb.
+process.env.TERM = '';
+
+// Keep syntax highlighting out of this test so it only covers preview layout.
+// Preview and result colors are enabled after readline is initialized.
+const { input, output, replServer } = startNewREPLServer({ useColors: false });
+replServer.useColors = true;
+replServer.writer.options.colors = true;
 
 output.accumulator = '';
 
diff --git a/test/parallel/test-repl-preview-without-inspector.js b/test/parallel/test-repl-preview-without-inspector.js
index 67090a928feb..58874c8f02a9 100644
--- a/test/parallel/test-repl-preview-without-inspector.js
+++ b/test/parallel/test-repl-preview-without-inspector.js
@@ -69,9 +69,13 @@ const repl = new REPLServer({
   prompt: PROMPT,
   stream: new REPLStream(),
   ignoreUndefined: true,
-  useColors: true,
+  // Keep syntax highlighting out of these preview transcript assertions.
+  // Preview and result colors are enabled after readline is initialized.
+  useColors: false,
   terminal: true,
 });
+repl.useColors = true;
+repl.writer.options.colors = true;
 
 repl.inputStream.run([
   'function foo(x) { return x; }',
diff --git a/test/parallel/test-repl-preview.js b/test/parallel/test-repl-preview.js
index 9ab84b5c9f3a..f8c510c74555 100644
--- a/test/parallel/test-repl-preview.js
+++ b/test/parallel/test-repl-preview.js
@@ -61,9 +61,13 @@ async function tests(options) {
     prompt: PROMPT,
     stream: new REPLStream(),
     ignoreUndefined: true,
-    useColors: true,
+    // Keep syntax highlighting out of these preview transcript assertions.
+    // Preview and result colors are enabled after readline is initialized.
+    useColors: false,
     ...options
   });
+  repl.useColors = true;
+  repl.writer.options.colors = true;
 
   repl.inputStream.run([
     'function foo(x) { return x; }',
diff --git a/test/parallel/test-repl-reverse-search.js b/test/parallel/test-repl-reverse-search.js
index cbe848afee08..7d008f98bf5b 100644
--- a/test/parallel/test-repl-reverse-search.js
+++ b/test/parallel/test-repl-reverse-search.js
@@ -329,7 +329,9 @@ function runTest() {
     }),
     completer: opts.completer,
     prompt,
-    useColors: opts.useColors || false,
+    // Keep syntax highlighting out of the reverse-search transcript. Result
+    // colors are enabled below after readline has been initialized.
+    useColors: false,
     terminal: true
   }, common.mustCall((err, repl) => {
     if (err) {
@@ -351,6 +353,11 @@ function runTest() {
       setImmediate(runTestWrap, true);
     }));
 
+    if (opts.useColors) {
+      repl.useColors = true;
+      repl.writer.options.colors = true;
+    }
+
     if (opts.columns) {
       Object.defineProperty(repl, 'columns', {
         value: opts.columns,
diff --git a/test/parallel/test-repl-top-level-await.js b/test/parallel/test-repl-top-level-await.js
index a94ff8e48984..bd3c3f6ec45b 100644
--- a/test/parallel/test-repl-top-level-await.js
+++ b/test/parallel/test-repl-top-level-await.js
@@ -51,9 +51,13 @@ const testMe = repl.start({
   prompt: PROMPT,
   stream: putIn,
   terminal: true,
-  useColors: true,
+  // Keep syntax highlighting out of these transcript assertions.
+  // Preview and result colors are enabled after readline is initialized.
+  useColors: false,
   breakEvalOnSigint: true
 });
+testMe.useColors = true;
+testMe.writer.options.colors = true;
 
 function runAndWait(cmds) {
   const promise = putIn.wait();

From df48191061330b0c8d2ffc4c95bb8794901f5fdd Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pipobscure@users.noreply.github.com>
Date: Sat, 1 Aug 2026 10:47:28 +0200
Subject: [PATCH 153/344] zlib: add ZipEntry, ZipFile, and ZipBuffer

Add ZIP archive support to the node:zlib module through three classes
and a set of helpers:

- ZipEntry: a single archive member, with buffered reads (content()),
  bounded-memory streaming reads (contentIterator()), and
  create()/createStream() for building members.
- ZipFile: random access to an archive backed by a file descriptor,
  reading members lazily without retaining their content and writing
  new members in place; opened with open()/openSync().
- ZipBuffer: a zero-copy, in-memory view over an archive already held
  in a Buffer.

createZipArchive() serializes a sequence of entries into an archive
byte stream, and setMaxZipContentSize() bounds the default in-memory
decompression size. Every operation has both an asynchronous and a
synchronous form.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/64339
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 doc/api/errors.md                             |   54 +
 doc/api/zlib.md                               | 1360 +++++++++++++++++
 doc/type-map.json                             |    3 +
 lib/internal/errors.js                        |    7 +
 lib/internal/zip.js                           |   44 +
 lib/internal/zip/archive.js                   |  321 ++++
 lib/internal/zip/binary.js                    |   87 ++
 lib/internal/zip/buffer.js                    |  186 +++
 lib/internal/zip/compression.js               |  303 ++++
 lib/internal/zip/constants.js                 |  109 ++
 lib/internal/zip/content-size.js              |   41 +
 lib/internal/zip/dos.js                       |  138 ++
 lib/internal/zip/entry.js                     |  962 ++++++++++++
 lib/internal/zip/extra-fields.js              |  199 +++
 lib/internal/zip/file.js                      |  780 ++++++++++
 lib/internal/zip/fs-util.js                   |  150 ++
 lib/internal/zip/header-builders.js           |  251 +++
 lib/internal/zip/headers.js                   |  511 +++++++
 lib/zlib.js                                   |   79 +
 test/parallel/test-zlib-zip-coverage.js       | 1318 ++++++++++++++++
 test/parallel/test-zlib-zip-edgecases.js      |  188 +++
 test/parallel/test-zlib-zip-encoding.js       |  244 +++
 .../test-zlib-zip-experimental-warning.js     |   59 +
 test/parallel/test-zlib-zip-files.js          |  240 +++
 test/parallel/test-zlib-zip-fuzz.js           |   85 ++
 test/parallel/test-zlib-zip-hardening.js      |  376 +++++
 test/parallel/test-zlib-zip-internals.js      |   53 +
 test/parallel/test-zlib-zip-interop.js        |  132 ++
 test/parallel/test-zlib-zip-metadata.js       |   96 ++
 test/parallel/test-zlib-zip-property.js       |  130 ++
 test/parallel/test-zlib-zip-security.js       |  265 ++++
 test/parallel/test-zlib-zip-sync.js           |  247 +++
 test/parallel/test-zlib-zip-writable.js       |  347 +++++
 test/parallel/test-zlib-zip-zip64.js          |   38 +
 test/parallel/test-zlib-zip.js                |  147 ++
 test/pummel/test-zlib-zip-slow.js             |  129 ++
 36 files changed, 9679 insertions(+)
 create mode 100644 lib/internal/zip.js
 create mode 100644 lib/internal/zip/archive.js
 create mode 100644 lib/internal/zip/binary.js
 create mode 100644 lib/internal/zip/buffer.js
 create mode 100644 lib/internal/zip/compression.js
 create mode 100644 lib/internal/zip/constants.js
 create mode 100644 lib/internal/zip/content-size.js
 create mode 100644 lib/internal/zip/dos.js
 create mode 100644 lib/internal/zip/entry.js
 create mode 100644 lib/internal/zip/extra-fields.js
 create mode 100644 lib/internal/zip/file.js
 create mode 100644 lib/internal/zip/fs-util.js
 create mode 100644 lib/internal/zip/header-builders.js
 create mode 100644 lib/internal/zip/headers.js
 create mode 100644 test/parallel/test-zlib-zip-coverage.js
 create mode 100644 test/parallel/test-zlib-zip-edgecases.js
 create mode 100644 test/parallel/test-zlib-zip-encoding.js
 create mode 100644 test/parallel/test-zlib-zip-experimental-warning.js
 create mode 100644 test/parallel/test-zlib-zip-files.js
 create mode 100644 test/parallel/test-zlib-zip-fuzz.js
 create mode 100644 test/parallel/test-zlib-zip-hardening.js
 create mode 100644 test/parallel/test-zlib-zip-internals.js
 create mode 100644 test/parallel/test-zlib-zip-interop.js
 create mode 100644 test/parallel/test-zlib-zip-metadata.js
 create mode 100644 test/parallel/test-zlib-zip-property.js
 create mode 100644 test/parallel/test-zlib-zip-security.js
 create mode 100644 test/parallel/test-zlib-zip-sync.js
 create mode 100644 test/parallel/test-zlib-zip-writable.js
 create mode 100644 test/parallel/test-zlib-zip-zip64.js
 create mode 100644 test/parallel/test-zlib-zip.js
 create mode 100644 test/pummel/test-zlib-zip-slow.js

diff --git a/doc/api/errors.md b/doc/api/errors.md
index 29f417892d7d..9084e2998f06 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -3660,6 +3660,58 @@ All attempts at serializing an uncaught exception from a worker thread failed.
 
 The requested functionality is not supported in worker threads.
 
+<a id="ERR_ZIP_ARCHIVE_TOO_LARGE"></a>
+
+### `ERR_ZIP_ARCHIVE_TOO_LARGE`
+
+An archive-level structure exceeds a limit: the archive comment exceeds the
+65,535-byte encoded length that the ZIP format allows, or the archive's
+central directory is too large to buffer in memory.
+
+<a id="ERR_ZIP_ENTRY_CORRUPT"></a>
+
+### `ERR_ZIP_ENTRY_CORRUPT`
+
+A ZIP archive entry failed CRC-32 verification, or produced more or fewer
+bytes than its declared uncompressed size, while being read.
+
+<a id="ERR_ZIP_ENTRY_NOT_FOUND"></a>
+
+### `ERR_ZIP_ENTRY_NOT_FOUND`
+
+A named entry was requested from a [`ZipFile`][] or [`ZipBuffer`][] that does
+not contain an entry with that name.
+
+<a id="ERR_ZIP_ENTRY_TOO_LARGE"></a>
+
+### `ERR_ZIP_ENTRY_TOO_LARGE`
+
+A ZIP archive entry's declared size exceeds the configured limit, or a
+provided entry name or comment exceeds the 65,535-byte encoded length that
+the ZIP format allows.
+
+<a id="ERR_ZIP_INVALID_ARCHIVE"></a>
+
+### `ERR_ZIP_INVALID_ARCHIVE`
+
+Data that was expected to be a ZIP archive, or a structure within one, is
+missing, out of bounds, or otherwise inconsistent with the ZIP format.
+
+<a id="ERR_ZIP_NOT_WRITABLE"></a>
+
+### `ERR_ZIP_NOT_WRITABLE`
+
+A mutating method (such as `zipFile.addEntry()` or `zipFile.delete()`) was
+called on a [`ZipFile`][] that was not opened with `{ writable: true }`.
+
+<a id="ERR_ZIP_UNSUPPORTED_FEATURE"></a>
+
+### `ERR_ZIP_UNSUPPORTED_FEATURE`
+
+A ZIP archive uses a feature outside of what this implementation supports,
+such as entry encryption, an unsupported compression method, or a multi-disk
+archive.
+
 <a id="ERR_ZLIB_INITIALIZATION_FAILED"></a>
 
 ### `ERR_ZLIB_INITIALIZATION_FAILED`
@@ -4603,6 +4655,8 @@ An error occurred trying to allocate memory. This should never happen.
 [`ServerResponse`]: http.md#class-httpserverresponse
 [`Temporal`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal
 [`Writable`]: stream.md#class-streamwritable
+[`ZipBuffer`]: zlib.md#class-zlibzipbuffer
+[`ZipFile`]: zlib.md#class-zlibzipfile
 [`child_process`]: child_process.md
 [`cipher.getAuthTag()`]: crypto.md#ciphergetauthtag
 [`crypto.getDiffieHellman()`]: crypto.md#cryptogetdiffiehellmangroupname
diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index 9cbef405232b..909992e07a4f 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -1007,6 +1007,1104 @@ added: v0.5.8
 Decompress either a Gzip- or Deflate-compressed stream by auto-detecting
 the header.
 
+## Class: `zlib.ZipBuffer`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this class among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+An in-memory, **zero-copy** view over the entries of a ZIP archive already
+held in a `Buffer`, `TypedArray`, `DataView`, or `ArrayBuffer`. Its set of
+entries can be edited - entries added or removed - but, unlike [`ZipFile`][],
+those edits are **not** written into the source buffer: a newly added entry is
+held as a separate in-memory [`ZipEntry`][] (the passed buffer is a fixed-size
+view with no room to append to), and removal just drops the entry from
+`ZipBuffer`'s index. The original bytes are never modified.
+[`zipBuffer.toBuffer()`][] serializes the current set of entries into a fresh
+archive.
+
+`ZipBuffer` does not copy the archive you hand it. It keeps a view onto that
+memory and reads each entry's content lazily and directly from it, which is
+what makes construction cheap regardless of archive size. The trade-off is
+that you **must not modify or reuse** that memory - including the
+`ArrayBuffer` backing a `TypedArray`/`DataView` - while the `ZipBuffer`, or
+any [`ZipEntry`][] obtained from it, is still in use: a later read would
+observe the change and may fail or return corrupt data. Pass a copy (for
+example `Buffer.from(source)`) if the source might be mutated or reused.
+
+`add()` and `toBuffer()` each have a `*Sync` counterpart
+([`addSync()`][`zipBuffer.addSync()`], [`toBufferSync()`][`zipBuffer.toBufferSync()`])
+that performs the same compression work synchronously. As with the
+synchronous `node:fs` APIs, these block the Node.js event loop and further
+JavaScript execution until the operation completes; use them only where
+synchronous execution is appropriate (for example, short-lived scripts or
+startup code), not in code that must stay responsive.
+
+```mjs
+import { ZipBuffer } from 'node:zlib';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { Buffer } from 'node:buffer';
+
+const zip = new ZipBuffer(readFileSync('archive.zip'));
+for (const [name, entry] of zip) {
+  console.log(name, entry.size);
+}
+await zip.add('hello.txt', Buffer.from('Hello, world!'));
+zip.delete('unwanted.txt');
+writeFileSync('archive.zip', await zip.toBuffer());
+```
+
+```cjs
+const { ZipBuffer } = require('node:zlib');
+const { readFileSync, writeFileSync } = require('node:fs');
+
+async function main() {
+  const zip = new ZipBuffer(readFileSync('archive.zip'));
+  for (const [name, entry] of zip) {
+    console.log(name, entry.size);
+  }
+  await zip.add('hello.txt', Buffer.from('Hello, world!'));
+  zip.delete('unwanted.txt');
+  writeFileSync('archive.zip', await zip.toBuffer());
+}
+main();
+```
+
+### `new zlib.ZipBuffer(buffer)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `buffer` {Buffer|TypedArray|DataView|ArrayBuffer} A complete ZIP archive.
+
+Parses the archive's central directory. Throws an [`ERR_ZIP_INVALID_ARCHIVE`][]
+or [`ERR_ZIP_UNSUPPORTED_FEATURE`][] error if `buffer` is not a well-formed,
+supported archive.
+
+`buffer` is **not copied**: the `ZipBuffer` retains a zero-copy view of it (for
+a `TypedArray`, `DataView`, or `ArrayBuffer`, of the underlying `ArrayBuffer`)
+and reads entry content directly from it on demand. Do not mutate or reuse that
+memory while the `ZipBuffer` or any entry read from it is still live; pass a
+copy if it might change.
+
+### `zipBuffer.add(filename, data[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive. A trailing `/`
+  marks a directory entry.
+* `data` {Buffer|TypedArray|DataView|ArrayBuffer} The entry's complete,
+  uncompressed content.
+* `options` {Object} See [`zlib.ZipEntry.create()`][].
+* Returns: {Promise} Fulfilled with the created {ZipEntry}.
+
+Equivalent to `zipBuffer.addEntry(await zlib.ZipEntry.create(filename, data,
+options))`.
+
+### `zipBuffer.addSync(filename, data[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive. A trailing `/`
+  marks a directory entry.
+* `data` {Buffer|TypedArray|DataView|ArrayBuffer} The entry's complete,
+  uncompressed content.
+* `options` {Object} See [`zlib.ZipEntry.createSync()`][].
+* Returns: {ZipEntry} The created entry.
+
+The synchronous version of [`zipBuffer.add()`][]. Equivalent to
+`zipBuffer.addEntry(zlib.ZipEntry.createSync(filename, data, options))`.
+
+### `zipBuffer.addEntry(entry)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `entry` {ZipEntry}
+* Returns: {ZipEntry} `entry`.
+
+Adds an already-built entry, keyed by its own [`zipEntry.name`][]. Replaces
+any existing entry of that name.
+
+### `zipBuffer.clear()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Removes every entry.
+
+### `zipBuffer.comment`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The archive-level comment, preserved byte-for-byte across
+[`zipBuffer.toBuffer()`][] calls unless overridden. The bytes are decoded as
+UTF-8 when they are valid UTF-8 and as CP437 otherwise (the field carries no
+encoding flag of its own).
+
+### `zipBuffer.delete(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {boolean} `true` if an entry named `name` existed and was removed.
+
+### `zipBuffer.entries()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of `[name, entry]` pairs, where `entry` is a
+  [`ZipEntry`][].
+
+### `zipBuffer.forEach(callback[, thisArg])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `callback` {Function}
+* `thisArg` {any}
+
+Calls `callback` once for each entry, in the order the archive lists them.
+
+### `zipBuffer.get(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {ZipEntry}
+
+Throws [`ERR_ZIP_ENTRY_NOT_FOUND`][] if the archive has no entry named `name`.
+
+### `zipBuffer.has(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {boolean}
+
+### `zipBuffer.keys()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of entry names.
+
+### `zipBuffer.size`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The number of entries in the archive.
+
+### `zipBuffer.toBuffer([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {string|Object} An archive comment, as a shorthand for
+  `{ comment: options }`.
+  * `comment` {string} An archive comment. **Default:** [`zipBuffer.comment`][].
+  * `baseOffset` {number} Shifts every offset the archive records by this
+    many bytes, so the serialized archive is self-describing even when it is
+    written somewhere other than the start of its eventual file - for example,
+    after `baseOffset` bytes of other content already written to the same
+    output. **Default:** `0`.
+* Returns: {Promise} Fulfilled with a {Buffer} containing the serialized
+  archive.
+
+Serializes the current set of entries - in the order they were added or
+read - into a fresh archive, switching to Zip64 structures automatically as
+needed (see [`zlib.createZipArchive()`][]).
+
+### `zipBuffer.toBufferSync([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {string|Object} See [`zipBuffer.toBuffer()`][].
+* Returns: {Buffer} The serialized archive.
+
+The synchronous version of [`zipBuffer.toBuffer()`][] (see
+[`zlib.createZipArchiveSync()`][]).
+
+### `zipBuffer.values()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of [`ZipEntry`][].
+
+### `zipBuffer.writable`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {boolean}
+
+Always `true`.
+
+## Class: `zlib.ZipEntry`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this class among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+A single file or directory inside a ZIP archive. Instances are produced by
+[`ZipBuffer`][] and [`ZipFile`][], or created directly for writing with
+`ZipEntry.create()`/`ZipEntry.createStream()`.
+
+`create()` and `content()` each have a `*Sync` counterpart (the streaming
+`contentIterator()` does not). As with the synchronous `node:fs` APIs, these
+block the
+Node.js event loop and further JavaScript execution until the operation
+(including any deflate/inflate pass) completes; use them only where
+synchronous execution is appropriate (for example, short-lived scripts or
+startup code), not in code that must stay responsive.
+
+### Static method: `zlib.ZipEntry.create(filename, data[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive. A trailing `/`
+  marks a directory entry.
+* `data` {Buffer|TypedArray|DataView|ArrayBuffer} The entry's complete,
+  uncompressed content. Must be empty when `filename` names a directory.
+* `options` {Object}
+  * `comment` {string} An entry comment.
+  * `mode` {integer} Unix permission bits. **Default:** `0o644` (`0o755` for
+    directories).
+  * `modified` {Date} The entry's modification time. **Default:** the
+    current time.
+  * `method` {string} One of `'deflate'`, `'store'`, or `'zstd'`. **Default:**
+    `'deflate'`, except for directories and empty content, which are always
+    stored.
+* Returns: {Promise} Fulfilled with a {ZipEntry}.
+
+Compresses `data` (unless `method` is `'store'`, or compression would not
+reduce its size) and computes its CRC-32.
+
+When the entry ends up stored uncompressed (because `method` is `'store'`,
+or because compression would not reduce the size), the entry retains a
+zero-copy view of `data` rather than a copy, and its CRC-32 has already been
+recorded. Do not mutate `data` after creating the entry; pass a copy if it
+might change.
+
+The MS-DOS date/time fields ZIP uses for `modified` have 2-second resolution
+and no time zone. When `modified` does not fall on a whole 2-second
+boundary, an Info-ZIP extended-timestamp extra field is written as well,
+recording the whole (UTC) second so the time round-trips more precisely (see
+[`zipEntry.modified`][]). This applies to every entry-creation path.
+
+### Static method: `zlib.ZipEntry.createStream(filename, source[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive. Must not end
+  in `/`.
+* `source` {AsyncIterable} Yields the entry's uncompressed content as
+  `Uint8Array` chunks.
+* `options` {Object}
+  * `comment` {string} An entry comment.
+  * `mode` {integer} Unix permission bits. **Default:** `0o644`.
+  * `modified` {Date} The entry's modification time. **Default:** the
+    current time.
+  * `method` {string} One of `'deflate'`, `'store'`, or `'zstd'`. **Default:**
+    `'deflate'`.
+* Returns: {ZipEntry}
+
+Creates an entry whose content is compressed on the fly as it is serialized
+by [`zlib.createZipArchive()`][], without buffering `source` in memory. Its
+`size`, `compressedSize`, and `crc32` only become available once
+serialization has finished. There is no synchronous counterpart: streaming
+entries only make sense with an asynchronous, incrementally-produced
+`source`.
+
+`source` is drained exactly once, during serialization. Until that happens
+the entry has no readable content, so [`zipEntry.content()`][],
+[`zipEntry.contentSync()`][], and [`zipEntry.contentIterator()`][] throw
+[`ERR_INVALID_STATE`][]. If the entry is serialized by adding it to a writable
+[`ZipFile`][] with [`zipFile.addEntry()`][] (or `addEntrySync()`), it is then
+**promoted in place** to a file-backed entry pointing at the copy just written,
+so it becomes readable (and can be serialized again) for as long as that
+`ZipFile` stays open. Serializing it any other way (for example directly
+through [`zlib.createZipArchive()`][]) leaves it spent and unreadable.
+
+Because `source` may hold an operating-system resource (a file read stream,
+say), a streaming entry is disposable: its `Symbol.dispose` and
+`Symbol.asyncDispose` methods destroy `source` if it has not been consumed.
+An entry passed to an archive is disposed by that archive (see
+[`zlib.createZipArchive()`][]); dispose an entry directly only when it was
+built but never handed to one. Disposal is a no-op for non-streaming entries -
+in particular a file-backed entry never closes the [`ZipFile`][] descriptor it
+borrows.
+
+### Static method: `zlib.ZipEntry.createSymlink(filename, target[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive.
+* `target` {string} The symbolic link's target path.
+* `options` {Object}
+  * `comment` {string} An entry comment.
+  * `mode` {integer} Unix permission bits. **Default:** `0o777`.
+  * `modified` {Date} The entry's modification time. **Default:** the current
+    time.
+* Returns: {ZipEntry}
+
+Creates a symbolic-link entry: a stored entry whose content is `target` and
+whose Unix mode type bits mark it as a symlink, so [`zipEntry.isSymlink`][] is
+`true` when it is read back. Extraction tools that honor symlink entries
+recreate the link; treat `target` as untrusted (see [`zipEntry.name`][] on
+path safety).
+
+### Static method: `zlib.ZipEntry.createSync(filename, data[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive. A trailing `/`
+  marks a directory entry.
+* `data` {Buffer|TypedArray|DataView|ArrayBuffer} The entry's complete,
+  uncompressed content. Must be empty when `filename` names a directory.
+* `options` {Object} See [`zlib.ZipEntry.create()`][].
+* Returns: {ZipEntry}
+
+The synchronous version of [`zlib.ZipEntry.create()`][].
+
+### Static method: `zlib.ZipEntry.read(buffer)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `buffer` {Buffer|TypedArray|DataView|ArrayBuffer} A complete ZIP archive.
+* Returns: {Iterator} of {ZipEntry}.
+
+Parses every entry out of `buffer` directly, without indexing it into a
+[`ZipBuffer`][]. Like [`ZipBuffer`][], the yielded entries hold zero-copy views
+of `buffer` rather than copies of their content, so the same rule applies: do
+not mutate or reuse `buffer` while any of them is still in use.
+
+### `zipEntry.comment`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+### `zipEntry.compressed`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {boolean}
+
+`true` if the entry's content is stored in compressed form (any compression
+method, currently deflate or Zstandard); `false` if it is stored
+uncompressed.
+
+### `zipEntry.compressedSize`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+### `zipEntry.content([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `verify` {boolean} Verify the entry's CRC-32 checksum. **Default:** `true`.
+  * `maxSize` {number} Reject content declaring more than this many
+    uncompressed bytes, before allocating anything. **Default:**
+    [`zlib.getMaxZipContentSize()`][].
+* Returns: {Promise} Fulfilled with a {Buffer} containing the entry's
+  decompressed content. The buffer is a fresh copy that shares no memory
+  with the archive or with data the entry was created from.
+
+Throws an [`ERR_ZIP_ENTRY_TOO_LARGE`][] error if the entry's declared size
+exceeds `maxSize`, an [`ERR_ZIP_ENTRY_CORRUPT`][] error if the content fails
+CRC-32 verification or does not match its declared size, and an
+[`ERR_INVALID_STATE`][] error for a streaming entry
+([`zlib.ZipEntry.createStream()`][]) whose content is not yet available (see
+that method for when a streaming entry becomes readable).
+
+### `zipEntry.contentSync([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object} See [`zipEntry.content()`][].
+* Returns: {Buffer} The entry's decompressed content.
+
+The synchronous version of [`zipEntry.content()`][].
+
+### `zipEntry.contentIterator([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `verify` {boolean} Verify the entry's CRC-32 checksum. **Default:** `true`.
+  * `maxSize` {number} Reject content declaring more than this many
+    uncompressed bytes, before decompressing anything. **Default:** no limit.
+* Returns: {AsyncIterator} of {Buffer} chunks of the entry's decompressed
+  content.
+
+Unlike [`zipEntry.content()`][], this does not buffer the whole member in
+memory. For a file-backed entry (one returned by [`zipFile.get()`][]) the
+compressed bytes are read from disk as the iterator is consumed and nothing is
+retained; the entry is valid only while its `ZipFile` is open.
+
+Because streaming is the bounded-memory path for arbitrarily large members, it
+is **not** capped by [`zlib.getMaxZipContentSize()`][] the way
+[`zipEntry.content()`][] is - that default guards a single large allocation,
+which streaming never makes. Output is still bounded per chunk to the declared
+uncompressed size; pass `maxSize` to impose an explicit ceiling.
+
+For an in-memory entry stored without compression, the yielded chunks are
+zero-copy views of the entry's retained content (see
+[`zipEntry.rawContent`][]); do not mutate them.
+
+The yielded chunks are **provisional until the iterator completes**. CRC-32
+verification (and the final declared-size check) can only run once every byte
+has been read, so a corrupt or truncated entry is reported by the iterator
+throwing _after_ the last chunk, not before the first. Each chunk is still
+bounded so the total never exceeds the declared size or `maxSize`, but a
+consumer that must not act on unverified bytes should buffer them (or use
+[`zipEntry.content()`][], which verifies before returning anything) rather than
+processing chunks as they arrive.
+
+### `zipEntry.crc32`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+### `zipEntry.flags`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The entry's raw general-purpose bit flag.
+
+### `zipEntry.isDirectory`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {boolean}
+
+`true` if the entry is a directory (its name ends with `/`).
+
+### `zipEntry.isFile`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {boolean}
+
+`true` if the entry is a regular file — that is, neither a directory nor a
+symbolic link.
+
+### `zipEntry.isSymlink`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {boolean}
+
+`true` if the entry is a symbolic link (its Unix mode type bits are
+`S_IFLNK`); its content is the link target. Always `false` for archives not
+written on a Unix-like system. When extracting, treat a symlink's target as
+untrusted — see [`zipEntry.name`][] on path safety.
+
+### `zipEntry.mode`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The entry's Unix mode permission bits, including the setuid, setgid, and
+sticky bits (the low 12 bits, `0o7777`), or `0` if the archive was not written
+on a Unix-like system. The file-type bits are not included here; use
+[`zipEntry.isDirectory`][] / [`zipEntry.isSymlink`][] for the type.
+
+### `zipEntry.modified`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {Date}
+
+The entry's last-modification time. When the archive carries a higher-fidelity
+timestamp in an extra field — an NTFS (`0x000a`), Info-ZIP extended (`0x5455`),
+or Info-ZIP Unix (`0x5855`) field, as most modern tools write — that absolute
+(UTC) time is used; otherwise the coarse, local-time MS-DOS date/time field
+(2-second resolution) is used.
+
+Some tools store their high-fidelity timestamp only in the local file header,
+so on a file-backed entry (one returned by [`zipFile.get()`][]) the first read
+of this property may perform a small synchronous positioned disk read to
+resolve that header. If that read fails, the value silently falls back to the
+central-directory data.
+
+### `zipEntry.method`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The entry's raw compression method: `0` for stored, `8` for deflate, `93`
+for Zstandard.
+
+### `zipEntry.name`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The entry's name, decoded from the central directory, which is treated as
+authoritative — a local file header that disagrees is ignored, so a
+mismatched-header ("ZIP-confusion") archive cannot make `name` disagree with
+what is read. The bytes are decoded from a valid Info-ZIP Unicode Path extra
+field (`0x7075`) when one is present; otherwise as UTF-8 when the
+language-encoding flag (general-purpose bit 11) is set **or the bytes are
+valid UTF-8** (plenty of tools wrote UTF-8 names without ever setting the
+flag); and as CP437 — the historical default — only when they are not.
+See [`zipEntry.nameBuffer`][] for the raw bytes.
+
+The name is returned **verbatim**: it is never normalized, and a name
+containing `..`, a leading `/`, a drive letter, or backslashes is neither
+rewritten nor rejected. A `ZipFile`/`ZipBuffer` never writes to disk, so
+guarding against path traversal ("Zip Slip") when extracting is the caller's
+responsibility.
+
+### `zipEntry.nameBuffer`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {Buffer}
+
+The entry's raw name bytes, before any character decoding. Useful when the
+archive's names are in an encoding other than UTF-8 or CP437 and the caller
+wants to decode them itself.
+
+### `zipEntry.rawContent`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {Buffer|null}
+
+The entry's raw (still compressed, if applicable) content when it is held in
+memory, or `null` when there is no in-memory buffer to expose - for an entry
+created with [`zlib.ZipEntry.createStream()`][], or a file-backed entry
+returned by [`zipFile.get()`][], whose bytes are read from disk on demand
+rather than retained. Use [`zipEntry.content()`][] or
+[`zipEntry.contentIterator()`][] to read a file-backed entry.
+
+### `zipEntry.size`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The entry's uncompressed size, in bytes.
+
+## Class: `zlib.ZipFile`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this class among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+A random-access view over the entries of a ZIP archive on disk. Only the
+archive's tail and central directory are read up front; member content is
+read from disk lazily, on demand. Writable when opened with
+`{ writable: true }`: [`zipFile.addEntry()`][]/[`zipFile.add()`][] append the
+new member's data where the central directory used to be, then rewrite the
+central directory immediately after it; [`zipFile.delete()`][] just rewrites
+the central directory. Both mean the file is altered as soon as the method's
+returned `Promise` fulfills. Deleted or replaced members are left behind as
+dead space; [`zipFile.compact()`][] produces a stream with none.
+
+These in-place edits are **not crash-atomic**. Rewriting the central directory
+happens in place, so a write that fails partway - the disk fills, the device
+disconnects, the process is killed - can leave the archive on disk with a
+partial or missing central directory, i.e. unreadable, even though the member
+data before it is intact. The rejected call surfaces the underlying error and
+the `ZipFile` object is left usable (its in-memory view is not discarded, so a
+caller can attempt recovery - for example re-writing the entries elsewhere with
+[`zipFile.compact()`][]), but that in-memory view may no longer match the bytes
+on disk. Write to a copy, or `compact()` into a fresh file, when durability
+across a failure matters.
+
+Every method has a `*Sync` counterpart. As with the synchronous `node:fs`
+APIs, these block the Node.js event loop and further JavaScript execution
+until the operation completes; use them only where synchronous execution is
+appropriate (for example, short-lived scripts or startup code), not in code
+that must stay responsive. A synchronous method throws `ERR_INVALID_STATE`
+if called while an asynchronous `add()`, `addEntry()`, `delete()`, or
+`close()` on the same `ZipFile` has not settled yet, since letting the two
+interleave could corrupt the archive.
+
+```mjs
+import { ZipFile } from 'node:zlib';
+import { Buffer } from 'node:buffer';
+
+const zip = await ZipFile.open('archive.zip', { writable: true });
+try {
+  const entry = await zip.get('member.txt');
+  console.log((await entry.content()).toString());
+  for await (const chunk of await zip.stream('huge.bin')) {
+    // Process each chunk without buffering the whole member.
+  }
+  await zip.add('new.txt', Buffer.from('hello'));
+  await zip.delete('unwanted.txt');
+} finally {
+  await zip.close();
+}
+```
+
+```cjs
+const { ZipFile } = require('node:zlib');
+
+async function main() {
+  const zip = await ZipFile.open('archive.zip', { writable: true });
+  try {
+    const entry = await zip.get('member.txt');
+    console.log((await entry.content()).toString());
+    for await (const chunk of await zip.stream('huge.bin')) {
+      // Process each chunk without buffering the whole member.
+    }
+    await zip.add('new.txt', Buffer.from('hello'));
+    await zip.delete('unwanted.txt');
+  } finally {
+    await zip.close();
+  }
+}
+main();
+```
+
+### Static method: `zlib.ZipFile.open(filename[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string}
+* `options` {Object}
+  * `writable` {boolean} Open the underlying file for both reading and
+    writing (`'r+'`), enabling [`zipFile.addEntry()`][]/[`zipFile.add()`][]/
+    [`zipFile.delete()`][]. **Default:** `false`.
+* Returns: {Promise} Fulfilled with a {ZipFile}.
+
+Throws an [`ERR_ZIP_ARCHIVE_TOO_LARGE`][] error if the archive's central
+directory is too large to buffer in memory.
+
+### Static method: `zlib.ZipFile.openSync(filename[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string}
+* `options` {Object} See [`zlib.ZipFile.open()`][].
+* Returns: {ZipFile}
+
+The synchronous version of [`zlib.ZipFile.open()`][].
+
+### `zipFile.add(filename, data[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive. A trailing `/`
+  marks a directory entry.
+* `data` {Buffer|TypedArray|DataView|ArrayBuffer} The entry's complete,
+  uncompressed content.
+* `options` {Object} See [`zlib.ZipEntry.create()`][].
+* Returns: {Promise} Fulfilled with the created {ZipEntry}.
+
+Equivalent to `zipFile.addEntry(await zlib.ZipEntry.create(filename, data,
+options))`.
+
+### `zipFile.addEntry(entry)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `entry` {ZipEntry}
+* Returns: {Promise} Fulfilled with `entry`.
+
+Writes `entry` where the central directory currently starts, then rewrites
+the central directory to include it, replacing any existing entry of the
+same name. Throws [`ERR_ZIP_NOT_WRITABLE`][] if the `ZipFile` was not opened
+with `{ writable: true }`.
+
+The returned (same) `entry` is left readable: a streaming entry created with
+[`zlib.ZipEntry.createStream()`][], which would otherwise be spent once
+serialized, is promoted in place to a file-backed entry pointing at the copy
+just written (valid while this `ZipFile` is open). In-memory entries keep their
+own buffer unchanged.
+
+### `zipFile.addEntrySync(entry)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `entry` {ZipEntry}
+* Returns: {ZipEntry} `entry`.
+
+The synchronous version of [`zipFile.addEntry()`][]. `entry` must not be a
+pending streaming entry (one created with
+[`zlib.ZipEntry.createStream()`][]) - there is no synchronous way to drain
+its asynchronous source.
+
+### `zipFile.addSync(filename, data[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `filename` {string} The entry's name within the archive. A trailing `/`
+  marks a directory entry.
+* `data` {Buffer|TypedArray|DataView|ArrayBuffer} The entry's complete,
+  uncompressed content.
+* `options` {Object} See [`zlib.ZipEntry.createSync()`][].
+* Returns: {ZipEntry} The created entry.
+
+The synchronous version of [`zipFile.add()`][]. Equivalent to
+`zipFile.addEntrySync(zlib.ZipEntry.createSync(filename, data, options))`.
+
+### `zipFile.close()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Promise}
+
+Closes the underlying file handle.
+
+Closing does not invalidate outstanding objects: `ZipEntry` objects previously
+returned by [`zipFile.get()`][] and the `ZipFile`'s own methods will fail with
+system-level errors (for example `EBADF`) if used after close, rather than a
+dedicated Node.js error code. The same applies to [`zipFile.closeSync()`][].
+
+### `zipFile.closeSync()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+The synchronous version of [`zipFile.close()`][].
+
+### `zipFile.comment`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The archive-level comment, preserved byte-for-byte across
+[`zipFile.addEntry()`][]/[`zipFile.delete()`][] calls. The bytes are decoded
+as UTF-8 when they are valid UTF-8 and as CP437 otherwise (the field carries
+no encoding flag of its own).
+
+### `zipFile.compact([comment])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `comment` {string} An archive comment. **Default:** [`zipFile.comment`][].
+* Returns: {stream.Readable} A stream of the currently live entries,
+  serialized as a fresh archive with no dead space left by prior
+  [`zipFile.addEntry()`][]/[`zipFile.delete()`][] calls.
+
+Does not modify the open file; pipe the result into a new one:
+
+```mjs
+import { createWriteStream } from 'node:fs';
+zip.compact().pipe(createWriteStream('compacted.zip'));
+```
+
+### `zipFile.compactSync([comment])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `comment` {string} An archive comment. **Default:** [`zipFile.comment`][].
+* Returns: {Buffer} The currently live entries, serialized as a fresh
+  archive with no dead space left by prior
+  [`zipFile.addEntry()`][]/[`zipFile.delete()`][] calls.
+
+The synchronous version of [`zipFile.compact()`][]. Does not modify the
+open file.
+
+### `zipFile.delete(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {Promise} Fulfilled with `true` if an entry named `name` existed
+  and was removed, `false` otherwise.
+
+Rewrites the central directory without writing any new content - the
+archive does not grow. Throws [`ERR_ZIP_NOT_WRITABLE`][] if the `ZipFile` was
+not opened with `{ writable: true }`.
+
+### `zipFile.deleteSync(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {boolean} `true` if an entry named `name` existed and was
+  removed, `false` otherwise.
+
+The synchronous version of [`zipFile.delete()`][].
+
+### `zipFile.entries()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of `[name, entry]` pairs, where `entry` is a
+  {Promise} fulfilled with a [`ZipEntry`][].
+
+### `zipFile.entriesSync()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of `[name, entry]` pairs, where `entry` is a resolved
+  [`ZipEntry`][] (not a `Promise`).
+
+The synchronous version of [`zipFile.entries()`][].
+
+### `zipFile.forEach(callback[, thisArg])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `callback` {Function}
+* `thisArg` {any}
+
+### `zipFile.forEachSync(callback[, thisArg])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `callback` {Function}
+* `thisArg` {any}
+
+The synchronous version of [`zipFile.forEach()`][]: `callback` is invoked
+with a resolved [`ZipEntry`][] instead of a `Promise`.
+
+### `zipFile.get(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {Promise} Fulfilled with a {ZipEntry}.
+
+Returns a lazy, file-backed [`ZipEntry`][] for `name`. Nothing is read from
+disk here and no content is buffered: the returned entry reads (and, for
+[`zipEntry.content()`][], decompresses) its member straight from the file on
+each access, and the `ZipFile` retains no member content. The entry is valid
+only while this `ZipFile` is open. Reading its content later may throw
+[`ERR_ZIP_ENTRY_TOO_LARGE`][] if the member is too large to hold in a single
+buffer; use [`zipEntry.contentIterator()`][] (or [`zipFile.stream()`][])
+instead. Throws [`ERR_ZIP_ENTRY_NOT_FOUND`][] if the archive has no entry
+named `name`.
+
+### `zipFile.getSync(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {ZipEntry}
+
+The synchronous version of [`zipFile.get()`][]. Like `get()`, it reads
+nothing up front and only builds the lazy handle, so it does not itself block
+on I/O - but reads performed later through the returned entry (such as
+[`zipEntry.contentSync()`][]) do; see the note above on synchronous methods.
+
+### `zipFile.has(name)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* Returns: {boolean}
+
+### `zipFile.keys()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of entry names.
+
+### `zipFile.size`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The number of entries in the archive.
+
+### `zipFile.stream(name[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string}
+* `options` {Object}
+  * `verify` {boolean} Verify the entry's CRC-32 checksum. **Default:** `true`.
+  * `maxSize` {number} Reject content declaring more than this many
+    uncompressed bytes. **Default:** no limit.
+* Returns: {Promise} Fulfilled with a {stream.Readable} of the member's
+  decompressed content, without buffering the whole member in memory.
+
+Convenience wrapper that resolves to a `Readable` over
+[`zipEntry.contentIterator()`][] of [`zipFile.get()`][]`(name)`; the
+compressed bytes are read from disk as the stream is consumed. The returned
+promise rejects with [`ERR_ZIP_ENTRY_NOT_FOUND`][] if the archive has no entry
+named `name`.
+
+### `zipFile.values()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of {Promise} objects, each fulfilled with a
+  [`ZipEntry`][].
+
+### `zipFile.valuesSync()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Iterator} of resolved [`ZipEntry`][] values (not `Promise`s).
+
+The synchronous version of [`zipFile.values()`][].
+
+### `zipFile.writable`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {boolean}
+
+Whether this `ZipFile` was opened with `{ writable: true }`.
+
 ## Class: `zlib.ZlibBase`
 
 <!-- YAML
@@ -1335,6 +2433,184 @@ added: v0.5.8
 
 Creates and returns a new [`Unzip`][] object.
 
+## `zlib.createZipArchive(entries[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this function among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+* `entries` {Iterable|AsyncIterable} of [`ZipEntry`][].
+* `options` {string|Object} An archive comment, as a shorthand for
+  `{ comment: options }`.
+  * `comment` {string} An archive comment.
+  * `baseOffset` {number} Shifts every local/central header offset the
+    archive records by this many bytes, so the emitted stream is
+    self-describing even when something else is written before it - for
+    example, appending the archive after `baseOffset` bytes already written to
+    the same file, rather than at its start. **Default:** `0`.
+* Returns: {stream.Readable} A byte stream of the serialized archive.
+
+Serializes `entries` into a ZIP archive, switching to Zip64 structures
+automatically once the entry count, or any offset or size, exceeds what the
+classic 32-/16-bit ZIP fields can hold. The returned `Readable` is also an
+`AsyncIterable` of the same {Buffer} chunks it streams.
+
+Entries are written in iteration order and nothing deduplicates names: an
+iterable that yields two entries with the same name produces an archive
+containing both, and most extraction tools keep the one that appears later.
+[`ZipBuffer`][] and [`ZipFile`][] `add()` methods replace entries by name
+instead.
+
+The entries are owned by the returned stream: each is consumed as the archive
+is produced and must not be reused afterwards. This matters for streaming
+entries (from [`zlib.ZipEntry.createStream()`][]), which hold an underlying
+source such as a file read stream. If the returned stream is destroyed before
+it is fully consumed - for example, the destination of a [`pipeline()`][]
+fails - it disposes the entry it was serializing and every entry still queued
+behind it, destroying their sources so no descriptor leaks. Consume the stream
+to the end, or destroy it (directly, through a failed `pipeline()`, or with
+`await using`), to guarantee this cleanup; a stream that is neither consumed
+nor destroyed cannot release anything. A [`ZipEntry`][] that is never handed to
+an archive can be released directly with `Symbol.dispose` / `Symbol.asyncDispose`.
+
+Throws an [`ERR_ZIP_ARCHIVE_TOO_LARGE`][] error if the archive comment
+exceeds 65,535 bytes when encoded as UTF-8.
+
+```mjs
+import { createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+import { Buffer } from 'node:buffer';
+import { ZipEntry, createZipArchive } from 'node:zlib';
+
+const entries = [
+  await ZipEntry.create('hello.txt', Buffer.from('Hello, world!')),
+  await ZipEntry.create('data/', Buffer.alloc(0)),
+];
+await pipeline(
+  createZipArchive(entries, 'created by node:zlib'),
+  createWriteStream('archive.zip'),
+);
+```
+
+```cjs
+const { createWriteStream } = require('node:fs');
+const { pipeline } = require('node:stream/promises');
+const { ZipEntry, createZipArchive } = require('node:zlib');
+
+async function main() {
+  const entries = [
+    await ZipEntry.create('hello.txt', Buffer.from('Hello, world!')),
+    await ZipEntry.create('data/', Buffer.alloc(0)),
+  ];
+  await pipeline(
+    createZipArchive(entries, 'created by node:zlib'),
+    createWriteStream('archive.zip'),
+  );
+}
+main();
+```
+
+Passing `options.baseOffset` produces an archive that is valid immediately
+when placed after other content in the same file, without relying on a
+reader's self-extracting-archive detection to compensate for the shift:
+
+```mjs
+import { createWriteStream } from 'node:fs';
+import { Buffer } from 'node:buffer';
+import { ZipEntry, createZipArchive } from 'node:zlib';
+
+const prefix = Buffer.from('#!/bin/sh\nexit 0\n');
+const entries = [await ZipEntry.create('hello.txt', Buffer.from('Hello, world!'))];
+const out = createWriteStream('self-extracting.zip');
+out.write(prefix);
+createZipArchive(entries, { baseOffset: prefix.byteLength }).pipe(out);
+```
+
+## `zlib.createZipArchiveSync(entries[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this function among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+* `entries` {Iterable} of [`ZipEntry`][].
+* `options` {string|Object} See [`zlib.createZipArchive()`][].
+* Returns: {Iterator} of {Buffer} chunks making up the serialized archive.
+
+The synchronous version of [`zlib.createZipArchive()`][]. Blocks the
+Node.js event loop and further JavaScript execution until the whole
+archive (including any deflate passes) has been produced; use only where
+synchronous execution is appropriate (for example, short-lived scripts or
+startup code), not in code that must stay responsive. `entries` must be a
+plain (synchronous) `Iterable` - a streaming entry created with
+[`zlib.ZipEntry.createStream()`][] throws when its turn to serialize comes
+up, since draining its asynchronous source has no synchronous equivalent.
+
+As with [`zlib.createZipArchive()`][], the entries are owned by the returned
+iterator and must not be reused. If iteration stops early - including the
+throw on a streaming entry - the entry that stopped it and every entry still
+queued behind it are disposed, releasing any sources they hold.
+
+## `zlib.zipFiles(files[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this function among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+* `files` {Iterable} of `[sourcePath, entryName]` string pairs. Any iterable
+  works — an array, a `Map`, the result of `Object.entries()`, a generator.
+* `options` {string|Object}
+  * `followSymlinks` {boolean} Resolve a symbolic link and archive the file it
+    points to, rather than storing the link itself. **Default:** `true`.
+  * `comment` {string} An archive comment; a string `options` is shorthand for
+    `{ comment: options }`.
+  * `baseOffset` {number} See [`zlib.createZipArchive()`][].
+* Returns: {stream.Readable} of {Buffer} chunks making up the serialized
+  archive.
+
+Builds an archive from files on disk. For each `[sourcePath, entryName]` pair
+it reads `sourcePath` and adds an entry named `entryName`, capturing the file's
+Unix mode and modification time. A directory becomes a directory entry; a
+regular file's contents are streamed in (as a [`zlib.ZipEntry.createStream()`][]
+entry) without being buffered in memory. Directory contents are not walked
+recursively — list each path you want included.
+
+When `followSymlinks` is `true` (the default) a symbolic link is resolved and
+archived as its target file; when it is `false` the link itself is stored as a
+symbolic-link entry whose content is the target path (see
+[`zlib.ZipEntry.createSymlink()`][]).
+
+```mjs
+import { zipFiles } from 'node:zlib';
+import { createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+
+await pipeline(
+  zipFiles([
+    ['/data/report.pdf', 'report.pdf'],
+    ['/data/notes.txt', 'docs/notes.txt'],
+  ]),
+  createWriteStream('archive.zip'),
+);
+```
+
 ## `zlib.createZstdCompress([options])`
 
 > Stability: 1 - Experimental
@@ -1363,6 +2639,44 @@ added:
 
 Creates and returns a new [`ZstdDecompress`][] object.
 
+## `zlib.getMaxZipContentSize()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this function among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+* Returns: {number}
+
+The current default ceiling, in bytes, applied by [`zipEntry.content()`][]
+when no explicit `maxSize` is given. **Default:** `268435456` (256 MiB).
+
+## `zlib.setMaxZipContentSize(size)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+The ZIP archive API is experimental. Using any part of it (this function among
+them) emits an experimental warning the first time; merely importing
+`node:zlib` does not.
+
+* `size` {number}
+
+Sets the default ceiling used by [`zipEntry.content()`][] when no explicit
+`maxSize` option is given. This is a guard against zip bombs: an archive
+whose central directory declares a member larger than this is rejected
+before allocating memory for it. Streaming reads
+([`zipEntry.contentIterator()`][], [`zipFile.stream()`][]) are bounded-memory
+by design and are not affected by this setting.
+
 ## Convenience methods
 
 <!--type=misc-->
@@ -2029,11 +3343,22 @@ Create a Zstandard decompression transform.
 [`Content-Encoding`]: https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11
 [`DeflateRaw`]: #class-zlibdeflateraw
 [`Deflate`]: #class-zlibdeflate
+[`ERR_INVALID_STATE`]: errors.md#err_invalid_state
+[`ERR_ZIP_ARCHIVE_TOO_LARGE`]: errors.md#err_zip_archive_too_large
+[`ERR_ZIP_ENTRY_CORRUPT`]: errors.md#err_zip_entry_corrupt
+[`ERR_ZIP_ENTRY_NOT_FOUND`]: errors.md#err_zip_entry_not_found
+[`ERR_ZIP_ENTRY_TOO_LARGE`]: errors.md#err_zip_entry_too_large
+[`ERR_ZIP_INVALID_ARCHIVE`]: errors.md#err_zip_invalid_archive
+[`ERR_ZIP_NOT_WRITABLE`]: errors.md#err_zip_not_writable
+[`ERR_ZIP_UNSUPPORTED_FEATURE`]: errors.md#err_zip_unsupported_feature
 [`Gunzip`]: #class-zlibgunzip
 [`Gzip`]: #class-zlibgzip
 [`InflateRaw`]: #class-zlibinflateraw
 [`Inflate`]: #class-zlibinflate
 [`Unzip`]: #class-zlibunzip
+[`ZipBuffer`]: #class-zlibzipbuffer
+[`ZipEntry`]: #class-zlibzipentry
+[`ZipFile`]: #class-zlibzipfile
 [`ZlibBase`]: #class-zlibzlibbase
 [`ZstdCompress`]: #class-zlibzstdcompress
 [`ZstdDecompress`]: #class-zlibzstddecompress
@@ -2041,8 +3366,43 @@ Create a Zstandard decompression transform.
 [`deflateInit2` and `inflateInit2`]: https://zlib.net/manual.html#Advanced
 [`node:stream/iter`]: stream_iter.md
 [`pipeTo()`]: stream_iter.md#pipetosource-transforms-writer-options
+[`pipeline()`]: stream.md#streampipelinesource-transforms-destination-callback
 [`pull()`]: stream_iter.md#pullsource-transforms-options
 [`stream.Transform`]: stream.md#class-streamtransform
+[`zipBuffer.add()`]: #zipbufferaddfilename-data-options
+[`zipBuffer.addSync()`]: #zipbufferaddsyncfilename-data-options
+[`zipBuffer.comment`]: #zipbuffercomment
+[`zipBuffer.toBuffer()`]: #zipbuffertobufferoptions
+[`zipBuffer.toBufferSync()`]: #zipbuffertobuffersyncoptions
+[`zipEntry.content()`]: #zipentrycontentoptions
+[`zipEntry.contentIterator()`]: #zipentrycontentiteratoroptions
+[`zipEntry.contentSync()`]: #zipentrycontentsyncoptions
+[`zipEntry.isDirectory`]: #zipentryisdirectory
+[`zipEntry.isSymlink`]: #zipentryissymlink
+[`zipEntry.modified`]: #zipentrymodified
+[`zipEntry.nameBuffer`]: #zipentrynamebuffer
+[`zipEntry.name`]: #zipentryname
+[`zipEntry.rawContent`]: #zipentryrawcontent
+[`zipFile.add()`]: #zipfileaddfilename-data-options
+[`zipFile.addEntry()`]: #zipfileaddentryentry
+[`zipFile.close()`]: #zipfileclose
+[`zipFile.closeSync()`]: #zipfileclosesync
+[`zipFile.comment`]: #zipfilecomment
+[`zipFile.compact()`]: #zipfilecompactcomment
+[`zipFile.delete()`]: #zipfiledeletename
+[`zipFile.entries()`]: #zipfileentries
+[`zipFile.forEach()`]: #zipfileforeachcallback-thisarg
+[`zipFile.get()`]: #zipfilegetname
+[`zipFile.stream()`]: #zipfilestreamname-options
+[`zipFile.values()`]: #zipfilevalues
+[`zlib.ZipEntry.create()`]: #static-method-zlibzipentrycreatefilename-data-options
+[`zlib.ZipEntry.createStream()`]: #static-method-zlibzipentrycreatestreamfilename-source-options
+[`zlib.ZipEntry.createSymlink()`]: #static-method-zlibzipentrycreatesymlinkfilename-target-options
+[`zlib.ZipEntry.createSync()`]: #static-method-zlibzipentrycreatesyncfilename-data-options
+[`zlib.ZipFile.open()`]: #static-method-zlibzipfileopenfilename-options
+[`zlib.createZipArchive()`]: #zlibcreateziparchiveentries-options
+[`zlib.createZipArchiveSync()`]: #zlibcreateziparchivesyncentries-options
+[`zlib.getMaxZipContentSize()`]: #zlibgetmaxzipcontentsize
 [convenience methods]: #convenience-methods
 [zlib documentation]: https://zlib.net/manual.html#Constants
 [zlib.createGzip example]: #zlib
diff --git a/doc/type-map.json b/doc/type-map.json
index a35196d3a55e..0483bd15f5e5 100644
--- a/doc/type-map.json
+++ b/doc/type-map.json
@@ -155,6 +155,9 @@
   "WritableStreamDefaultController": "webstreams.html#class-writablestreamdefaultcontroller",
   "WritableStreamDefaultWriter": "webstreams.html#class-writablestreamdefaultwriter",
   "X509Certificate": "crypto.html#class-x509certificate",
+  "ZipBuffer": "zlib.html#class-zlibzipbuffer",
+  "ZipEntry": "zlib.html#class-zlibzipentry",
+  "ZipFile": "zlib.html#class-zlibzipfile",
   "zlib options": "zlib.html#class-options",
   "zstd options": "zlib.html#class-zstdoptions"
 }
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index 900f7fe740b3..d98495aa6566 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -2002,4 +2002,11 @@ E('ERR_WORKER_UNSERIALIZABLE_ERROR',
   'Serializing an uncaught exception failed', Error);
 E('ERR_WORKER_UNSUPPORTED_OPERATION',
   '%s is not supported in workers', TypeError);
+E('ERR_ZIP_ARCHIVE_TOO_LARGE', 'ZIP archive structure exceeds the allowed size: %s', RangeError);
+E('ERR_ZIP_ENTRY_CORRUPT', 'ZIP entry is corrupt: %s', Error);
+E('ERR_ZIP_ENTRY_NOT_FOUND', 'no such entry %j in the archive', Error);
+E('ERR_ZIP_ENTRY_TOO_LARGE', 'ZIP entry exceeds the allowed size: %s', RangeError);
+E('ERR_ZIP_INVALID_ARCHIVE', 'invalid ZIP archive: %s', Error);
+E('ERR_ZIP_NOT_WRITABLE', 'this archive was not opened for writing', TypeError);
+E('ERR_ZIP_UNSUPPORTED_FEATURE', 'unsupported ZIP feature: %s', Error);
 E('ERR_ZSTD_INVALID_PARAM', '%s is not a valid zstd parameter', RangeError);
diff --git a/lib/internal/zip.js b/lib/internal/zip.js
new file mode 100644
index 000000000000..1889a2eea9da
--- /dev/null
+++ b/lib/internal/zip.js
@@ -0,0 +1,44 @@
+'use strict';
+
+// Public entry point for ZIP archive support in `node:zlib`. The
+// implementation is split across `internal/zip/`:
+//
+//   constants        shared signatures, flags, symbols, and small values
+//   binary           bounds-checked reads and buffer coercion
+//   content-size     the module-global in-memory decompression ceiling
+//   dos              MS-DOS date/time and CP437 legacy name/text decoding
+//   extra-fields     TLV extra-field parsing and building
+//   headers          reader-side header structures and archive-end location
+//   header-builders  writer-side header/record builders
+//   compression      deflate/inflate/zstd plumbing and member decoding
+//   fs-util          fd read/write helpers
+//   entry            ZipEntry
+//   archive          createZipArchive()/zipFiles() serialization
+//   buffer           ZipBuffer
+//   file             ZipFile
+//
+// This barrel re-exports only the surface `lib/zlib.js` consumes.
+
+const { ZipEntry } = require('internal/zip/entry');
+const { ZipBuffer } = require('internal/zip/buffer');
+const { ZipFile } = require('internal/zip/file');
+const {
+  createZipArchive,
+  createZipArchiveSync,
+  zipFiles,
+} = require('internal/zip/archive');
+const {
+  getMaxZipContentSize,
+  setMaxZipContentSize,
+} = require('internal/zip/content-size');
+
+module.exports = {
+  ZipEntry,
+  ZipFile,
+  ZipBuffer,
+  createZipArchive,
+  createZipArchiveSync,
+  zipFiles,
+  getMaxZipContentSize,
+  setMaxZipContentSize,
+};
diff --git a/lib/internal/zip/archive.js b/lib/internal/zip/archive.js
new file mode 100644
index 000000000000..7693ce1297f2
--- /dev/null
+++ b/lib/internal/zip/archive.js
@@ -0,0 +1,321 @@
+'use strict';
+
+// Archive serialization: `createZipArchive()`/`createZipArchiveSync()` and
+// the `zipFiles()` on-disk variant, the `generateZipArchive()` generator they
+// build on (auto-switching to Zip64 as offsets/counts overflow), and the
+// shared archive-option normalizer.
+
+const {
+  ArrayPrototypePush,
+  JSONStringify,
+  NumberMAX_SAFE_INTEGER,
+  StringPrototypeEndsWith,
+  SymbolAsyncDispose,
+  SymbolAsyncIterator,
+  SymbolDispose,
+  SymbolIterator,
+} = primordials;
+
+const {
+  codes: {
+    ERR_ZIP_ARCHIVE_TOO_LARGE,
+    ERR_ZIP_UNSUPPORTED_FEATURE,
+  },
+} = require('internal/errors');
+const {
+  validateBoolean,
+  validateInteger,
+  validateObject,
+  validateString,
+} = require('internal/validators');
+const { isUint8Array } = require('internal/util/types');
+const { Buffer } = require('buffer');
+const { Readable } = require('stream');
+const fs = require('fs');
+const {
+  EMPTY_BUFFER,
+  SENTINEL16,
+  kFinalize,
+} = require('internal/zip/constants');
+const {
+  buildArchiveTrailer,
+} = require('internal/zip/header-builders');
+const {
+  fsStatAsync,
+  fsLstatAsync,
+  fsReadlinkAsync,
+} = require('internal/zip/fs-util');
+const { ZipEntry } = require('internal/zip/entry');
+
+/**
+ * `createZipArchive()`/`createZipArchiveSync()` (and the `ZipBuffer`
+ * `toBuffer()`/`toBufferSync()` methods that forward to them) take a single
+ * optional `options` argument that doubles as a plain archive comment: a
+ * string is shorthand for `{ comment: options }`.
+ * @param {string | { comment?: string, baseOffset?: number }} [options]
+ * @returns {{ comment: string | undefined, baseOffset: number }}
+ */
+function normalizeArchiveOptions(options) {
+  if (options === undefined) return { comment: undefined, baseOffset: 0 };
+  if (typeof options === 'string') return { comment: options, baseOffset: 0 };
+  validateObject(options, 'options');
+  const { comment, baseOffset = 0 } = options;
+  // A Buffer comment is an internal convenience (used when round-tripping an
+  // existing archive) that preserves the original bytes without forcing them
+  // through a decode/re-encode cycle that would corrupt non-UTF-8 comments.
+  if (comment !== undefined && !isUint8Array(comment)) {
+    validateString(comment, 'options.comment');
+  }
+  validateInteger(baseOffset, 'options.baseOffset', 0, NumberMAX_SAFE_INTEGER);
+  return { comment, baseOffset };
+}
+
+/**
+ * Serializes `entries` (a (async) iterable of `ZipEntry`) into a `Readable`
+ * stream of archive byte chunks, automatically switching to Zip64 structures
+ * once the entry count or any offset/size exceeds the classic 32-/16-bit
+ * limits.
+ *
+ * `options.baseOffset` shifts every local/central header offset the archive
+ * records by that many bytes, so the emitted bytes are self-describing even
+ * when something else is written before them - for example, appending the
+ * archive after `baseOffset` bytes already written to the same file, rather
+ * than at its start.
+ * @param {Iterable<ZipEntry> | AsyncIterable<ZipEntry>} entries
+ * @param {string | { comment?: string, baseOffset?: number }} [options]
+ * @returns {Readable}
+ */
+function createZipArchive(entries, options) {
+  return Readable.from(generateZipArchive(entries, options), { objectMode: false });
+}
+
+/**
+ * Creates an archive from files on disk. `files` is an iterable of
+ * `[sourcePath, entryName]` pairs - an array, a `Map`, the result of
+ * `Object.entries()`, a generator, and so on. Each entry captures the file's
+ * Unix mode and modification time; a directory becomes a directory entry and a
+ * regular file's contents are streamed in without being buffered in memory.
+ *
+ * With `options.followSymlinks` (default `true`) a symbolic link is resolved
+ * and archived as the file it points to; with it `false` the link itself is
+ * stored as a symlink entry whose content is the target path.
+ * @param {Iterable<[string, string]>} files
+ * @param {string | { followSymlinks?: boolean, comment?: string, baseOffset?: number }} [options]
+ * @returns {import('stream').Readable}
+ */
+function zipFiles(files, options) {
+  const followSymlinks = options?.followSymlinks ?? true;
+  validateBoolean(followSymlinks, 'options.followSymlinks');
+  return createZipArchive(fileEntries(files, followSymlinks), options);
+}
+
+// Turn each `[sourcePath, entryName]` pair into a `ZipEntry`, stat-ing the
+// source to capture its mode/mtime and picking the symlink/directory/file
+// entry shape; the file-backed variant streams contents rather than buffering.
+async function* fileEntries(files, followSymlinks) {
+  for await (const pair of files) {
+    const sourcePath = pair[0];
+    const name = pair[1];
+    validateString(sourcePath, 'sourcePath');
+    validateString(name, 'name');
+    // Following links resolves through to the target (stat); otherwise the
+    // link itself is inspected (lstat) and stored as a symlink entry.
+    const stats = followSymlinks ? await fsStatAsync(sourcePath) : await fsLstatAsync(sourcePath);
+    const options = { __proto__: null, mode: stats.mode & 0o7777, modified: stats.mtime };
+    if (stats.isSymbolicLink()) {
+      yield ZipEntry.createSymlink(name, await fsReadlinkAsync(sourcePath), options);
+    } else if (stats.isDirectory()) {
+      const dirName = StringPrototypeEndsWith(name, '/') ? name : `${name}/`;
+      yield await ZipEntry.create(dirName, EMPTY_BUFFER, options);
+    } else {
+      // Open the file ourselves and stream from that exact descriptor instead
+      // of re-resolving the path with createReadStream(). Re-opening by path
+      // would let a symlink swapped in after the classification above redirect
+      // the read - a TOCTOU that defeats followSymlinks:false. O_NOFOLLOW makes
+      // a final-component symlink fail the open outright when not following;
+      // the fstat then confirms a regular file, never a FIFO, device, or
+      // socket (which as a stream source could block or emit unbounded data).
+      // Metadata comes from that same fstat so it describes the inode we read.
+      const flags = followSymlinks ?
+        fs.constants.O_RDONLY :
+        fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
+      const handle = await fs.promises.open(sourcePath, flags);
+      let ownsHandle = true;
+      try {
+        const stat = await handle.stat();
+        if (!stat.isFile()) {
+          throw new ERR_ZIP_UNSUPPORTED_FEATURE(
+            `cannot archive ${JSONStringify(sourcePath)}: not a regular file`);
+        }
+        const fileOptions = {
+          __proto__: null,
+          mode: stat.mode & 0o7777,
+          modified: stat.mtime,
+        };
+        // The stream adopts the handle and closes it when it ends or is
+        // destroyed (autoClose); if the consumer stops before taking the
+        // entry, the finally destroys the stream, releasing the descriptor.
+        const stream = fs.createReadStream(undefined, { fd: handle });
+        ownsHandle = false;
+        let handedOff = false;
+        try {
+          yield ZipEntry.createStream(name, stream, fileOptions);
+          handedOff = true;
+        } finally {
+          if (!handedOff) stream.destroy();
+        }
+      } finally {
+        if (ownsHandle) await handle.close();
+      }
+    }
+  }
+}
+
+// Encode the archive comment (a string, or raw bytes when round-tripping a
+// non-UTF-8 comment) and enforce the 16-bit length field (sec. 4.3.16).
+function normalizeCommentBuffer(comment) {
+  if (comment === undefined) return EMPTY_BUFFER;
+  const buffer = isUint8Array(comment) ? comment : Buffer.from(comment, 'utf8');
+  if (buffer.length > SENTINEL16) {
+    throw new ERR_ZIP_ARCHIVE_TOO_LARGE(
+      'the archive comment must not exceed 65535 bytes when encoded as UTF-8');
+  }
+  return buffer;
+}
+
+// Dispose the entries still queued behind an interrupted serialization. A
+// ZipEntry handed to the archive is owned by it, so when the consumer destroys
+// the output stream early - which runs `generateZipArchive`'s `finally` - the
+// entries it never reached must be released too (a streaming entry may hold a
+// file read stream). The entry currently being serialized is torn down by the
+// `for await ... of entry` loop's own return propagation, so only the queue
+// behind it is handled here.
+//
+// A materialized source (an array, `Map`, `Object.entries()`) has already
+// created every entry, so each remaining one is pulled and disposed. A lazy
+// async source is instead `return()`ed: forcing it to produce every remaining
+// entry could open thousands of descriptors just to close them, so it is
+// signalled to stop and release its own in-flight resource (see
+// `fileEntries()`).
+async function disposeQueuedEntries(iterator, isAsync) {
+  if (isAsync) {
+    if (typeof iterator.return === 'function') await iterator.return();
+    return;
+  }
+  for (let next = iterator.next(); !next.done; next = iterator.next()) {
+    const entry = next.value;
+    if (typeof entry?.[SymbolAsyncDispose] === 'function') await entry[SymbolAsyncDispose]();
+  }
+}
+
+// Core serializer backing `createZipArchive()`: emits each entry's local header
+// + data, then the central directory, then the end-of-central-directory record
+// (APPNOTE sec. 4.3.6 archive layout), promoting to Zip64 end records
+// (sec. 4.3.14/4.3.15) once any count/offset/size overflows its classic field.
+//
+// The entries are owned by this generator: it drives the iterator by hand
+// (rather than `for await`) so that if the consumer destroys the returned
+// stream partway - `Readable.from()` then calls this generator's `return()` -
+// the `finally` can dispose every entry that was never fully serialized. A
+// synchronous source is stepped without `await` so a pulled-but-not-yet-used
+// entry cannot be stranded by a return injected at the `await`.
+async function* generateZipArchive(entries, options) {
+  const { comment, baseOffset } = normalizeArchiveOptions(options);
+  const commentBuffer = normalizeCommentBuffer(comment);
+  const centralHeaders = [];
+  let pos = baseOffset;
+  const isAsync = entries[SymbolAsyncIterator] !== undefined;
+  const iterator = isAsync ? entries[SymbolAsyncIterator]() : entries[SymbolIterator]();
+  let completed = false;
+  try {
+    while (true) {
+      const next = isAsync ? await iterator.next() : iterator.next();
+      if (next.done) break;
+      const entry = next.value;
+      const start = pos;
+      for await (const chunk of entry) {
+        yield chunk;
+        pos += chunk.length;
+      }
+      ArrayPrototypePush(centralHeaders, entry[kFinalize](start));
+    }
+    const centralDirectoryOffset = pos;
+    for (let i = 0; i < centralHeaders.length; i++) {
+      const chunk = centralHeaders[i];
+      yield chunk;
+      pos += chunk.length;
+    }
+    const centralDirectorySize = pos - centralDirectoryOffset;
+    const count = centralHeaders.length;
+    const trailer = buildArchiveTrailer(count, centralDirectorySize, centralDirectoryOffset, commentBuffer);
+    for (let i = 0; i < trailer.length; i++) yield trailer[i];
+    completed = true;
+  } finally {
+    if (!completed) await disposeQueuedEntries(iterator, isAsync);
+  }
+}
+
+/**
+ * The synchronous counterpart of `createZipArchive()`. `entries` must be a
+ * plain (synchronous) `Iterable` of entries that don't require an
+ * asynchronous serialization pass - a streaming entry created with
+ * `ZipEntry.createStream()` throws when its turn to serialize comes up, the
+ * same as calling `entry[Symbol.iterator]()` on one directly. Blocks the
+ * event loop and further JavaScript execution until the whole archive
+ * (including any deflate passes) has been produced; see
+ * `zipEntry.contentSync()`.
+ * @param {Iterable<ZipEntry>} entries
+ * @param {string | { comment?: string, baseOffset?: number }} [options]
+ * @yields {Buffer}
+ */
+function* createZipArchiveSync(entries, options) {
+  const { comment, baseOffset } = normalizeArchiveOptions(options);
+  const commentBuffer = normalizeCommentBuffer(comment);
+  const centralHeaders = [];
+  let pos = baseOffset;
+  const iterator = entries[SymbolIterator]();
+  let completed = false;
+  // As in generateZipArchive(), the entries are owned here: a streaming entry
+  // throws when serialized synchronously, so on that throw (or an early
+  // return of this generator) dispose the entry that failed and every entry
+  // still queued behind it, releasing any sources they hold.
+  let current = null;
+  try {
+    for (let next = iterator.next(); !next.done; next = iterator.next()) {
+      current = next.value;
+      const start = pos;
+      for (const chunk of current) {
+        yield chunk;
+        pos += chunk.length;
+      }
+      ArrayPrototypePush(centralHeaders, current[kFinalize](start));
+      current = null;
+    }
+    const centralDirectoryOffset = pos;
+    for (let i = 0; i < centralHeaders.length; i++) {
+      const chunk = centralHeaders[i];
+      yield chunk;
+      pos += chunk.length;
+    }
+    const centralDirectorySize = pos - centralDirectoryOffset;
+    const count = centralHeaders.length;
+    const trailer = buildArchiveTrailer(count, centralDirectorySize, centralDirectoryOffset, commentBuffer);
+    for (let i = 0; i < trailer.length; i++) yield trailer[i];
+    completed = true;
+  } finally {
+    if (!completed) {
+      if (typeof current?.[SymbolDispose] === 'function') current[SymbolDispose]();
+      for (let next = iterator.next(); !next.done; next = iterator.next()) {
+        const entry = next.value;
+        if (typeof entry?.[SymbolDispose] === 'function') entry[SymbolDispose]();
+      }
+    }
+  }
+}
+
+module.exports = {
+  normalizeArchiveOptions,
+  createZipArchive,
+  createZipArchiveSync,
+  zipFiles,
+};
diff --git a/lib/internal/zip/binary.js b/lib/internal/zip/binary.js
new file mode 100644
index 000000000000..3aa6b89a5cd3
--- /dev/null
+++ b/lib/internal/zip/binary.js
@@ -0,0 +1,87 @@
+'use strict';
+
+// Low-level binary helpers: bounds-checked archive ranges, safe 64-bit
+// integer read/write, and buffer coercion of user input.
+
+const {
+  BigInt,
+  Number,
+  NumberIsInteger,
+} = primordials;
+
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_ZIP_INVALID_ARCHIVE,
+  },
+} = require('internal/errors');
+const {
+  isAnyArrayBuffer,
+  isArrayBufferView,
+  isUint8Array,
+} = require('internal/util/types');
+const { Buffer } = require('buffer');
+const { BIGINT_MAX_SAFE_INTEGER } = require('internal/zip/constants');
+
+// Reject an [offset, offset + length) slice that escapes the archive buffer
+// before it is used to read a record: guards every offset taken from archive
+// bytes against corrupt or hostile values.
+function validateArchiveRange(buffer, offset, length, what) {
+  if (
+    !NumberIsInteger(offset) ||
+    offset < 0 ||
+    !NumberIsInteger(length) ||
+    length < 0 ||
+    offset + length > buffer.length
+  ) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(`${what} is out of bounds`);
+  }
+}
+
+// Read a little-endian u64 (sizes/offsets, Zip64) that must land in the JS
+// safe-integer range; a field past the buffer or beyond that range means a
+// corrupt or hostile archive.
+function readSafeUint64(buffer, offset) {
+  if (offset + 8 > buffer.length) {
+    throw new ERR_ZIP_INVALID_ARCHIVE('64-bit field is out of bounds');
+  }
+  const value = buffer.readBigUInt64LE(offset);
+  if (value > BIGINT_MAX_SAFE_INTEGER) {
+    throw new ERR_ZIP_INVALID_ARCHIVE('64-bit field exceeds the safe integer range');
+  }
+  return Number(value);
+}
+
+// Write a JS number as a little-endian u64; the write paths only feed values
+// already bounded by the safe-integer range, so no range check is needed here.
+function writeSafeUint64(buffer, offset, value) {
+  buffer.writeBigUInt64LE(BigInt(value), offset);
+}
+
+
+// Coerce user-supplied binary input to a Buffer, aliasing the same memory
+// (no copy) for a TypedArray/DataView/ArrayBuffer and rejecting anything else.
+// internal/crypto/util.js's getArrayBufferOrView() covers similar coercion but
+// returns the view unchanged (and accepts strings with an encoding); this
+// helper exists because the ZIP code needs an actual Buffer over that memory.
+function toBuffer(value, name) {
+  if (isUint8Array(value)) {
+    return Buffer.isBuffer(value) ?
+      value : Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+  }
+  if (isArrayBufferView(value)) {
+    return Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+  }
+  if (isAnyArrayBuffer(value)) {
+    return Buffer.from(value);
+  }
+  throw new ERR_INVALID_ARG_TYPE(
+    name, ['Buffer', 'TypedArray', 'DataView', 'ArrayBuffer'], value);
+}
+
+module.exports = {
+  validateArchiveRange,
+  readSafeUint64,
+  writeSafeUint64,
+  toBuffer,
+};
diff --git a/lib/internal/zip/buffer.js b/lib/internal/zip/buffer.js
new file mode 100644
index 000000000000..582d8ae799af
--- /dev/null
+++ b/lib/internal/zip/buffer.js
@@ -0,0 +1,186 @@
+'use strict';
+
+// `ZipBuffer`: an in-memory, writable view over the entries of an archive
+// held in a `Buffer`, serializing the current set back out with
+// `toBuffer()`/`toBufferSync()`.
+
+const {
+  ArrayPrototypePush,
+  FunctionPrototypeCall,
+  Map,
+  MapPrototypeClear,
+  MapPrototypeDelete,
+  MapPrototypeEntries,
+  MapPrototypeGet,
+  MapPrototypeGetSize,
+  MapPrototypeHas,
+  MapPrototypeKeys,
+  MapPrototypeSet,
+  SymbolDispose,
+  SymbolIterator,
+  SymbolToStringTag,
+} = primordials;
+
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_ZIP_ENTRY_NOT_FOUND,
+  },
+} = require('internal/errors');
+const {
+  validateFunction,
+  validateString,
+} = require('internal/validators');
+const { Buffer } = require('buffer');
+const { toBuffer } = require('internal/zip/binary');
+const { decodeZipText } = require('internal/zip/dos');
+const { findArchiveEnd } = require('internal/zip/headers');
+const {
+  readArchiveEntries,
+  ZipEntry,
+} = require('internal/zip/entry');
+const {
+  createZipArchive,
+  createZipArchiveSync,
+  normalizeArchiveOptions,
+} = require('internal/zip/archive');
+
+/**
+ * An in-memory view over the entries of a ZIP archive, writable in place:
+ * entries can be added or removed, and `toBuffer()` serializes the current
+ * set of entries into a fresh archive.
+ */
+class ZipBuffer {
+  #entries = new Map();
+  #comment;
+
+  /**
+   * Parses an existing archive's central directory into an in-memory,
+   * editable map of entries keyed by name.
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} buffer
+   */
+  constructor(buffer) {
+    const buf = toBuffer(buffer, 'buffer');
+    // Locate the archive end once; it supplies both the comment and the
+    // central-directory bounds for the entry walk.
+    const end = findArchiveEnd(buf);
+    this.#comment = end.comment;
+    for (const entry of readArchiveEntries(buf, end)) {
+      MapPrototypeSet(this.#entries, entry.name, entry);
+    }
+  }
+  get writable() { return true; }
+  // The EOCD comment has no encoding flag; apply the same UTF-8/CP437
+  // heuristic as unflagged member names and comments.
+  get comment() { return decodeZipText(this.#comment, 0); }
+  has(name) {
+    validateString(name, 'name');
+    return MapPrototypeHas(this.#entries, name);
+  }
+  get(name) {
+    validateString(name, 'name');
+    const entry = MapPrototypeGet(this.#entries, name);
+    if (entry === undefined) throw new ERR_ZIP_ENTRY_NOT_FOUND(name);
+    return entry;
+  }
+  /**
+   * Adds an already-built entry, keyed by its own name (replacing any
+   * existing entry of that name).
+   * @param {ZipEntry} entry
+   * @returns {ZipEntry}
+   */
+  addEntry(entry) {
+    if (!(entry instanceof ZipEntry)) {
+      throw new ERR_INVALID_ARG_TYPE('entry', 'ZipEntry', entry);
+    }
+    MapPrototypeSet(this.#entries, entry.name, entry);
+    return entry;
+  }
+  /**
+   * Builds an entry from in-memory `data` and adds it (replacing any entry of
+   * the same name).
+   * @param {string} filename
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} data
+   * @param {{ comment?: string, mode?: number, modified?: Date, method?: 'deflate' | 'store' | 'zstd' }} [options]
+   * @returns {Promise<ZipEntry>}
+   */
+  async add(filename, data, options) {
+    return this.addEntry(await ZipEntry.create(filename, data, options));
+  }
+  /**
+   * The synchronous counterpart of `add()`. Blocks the event loop and
+   * further JavaScript execution until done; see `zipEntry.contentSync()`.
+   * @param {string} filename
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} data
+   * @param {{ comment?: string, mode?: number, modified?: Date, method?: 'deflate' | 'store' | 'zstd' }} [options]
+   * @returns {ZipEntry}
+   */
+  addSync(filename, data, options) {
+    return this.addEntry(ZipEntry.createSync(filename, data, options));
+  }
+  /**
+   * @param {string} name
+   * @returns {boolean}
+   */
+  delete(name) {
+    validateString(name, 'name');
+    return MapPrototypeDelete(this.#entries, name);
+  }
+  clear() {
+    MapPrototypeClear(this.#entries);
+  }
+  keys() { return MapPrototypeKeys(this.#entries); }
+  *values() {
+    for (const name of this.keys()) yield this.get(name);
+  }
+  *entries() {
+    for (const name of this.keys()) yield [name, this.get(name)];
+  }
+  get size() { return MapPrototypeGetSize(this.#entries); }
+  [SymbolIterator]() { return this.entries(); }
+  get [SymbolToStringTag]() { return 'ZipBuffer'; }
+  forEach(callback, thisArg) {
+    validateFunction(callback, 'callback');
+    for (const { 0: key, 1: value } of MapPrototypeEntries(this.#entries)) {
+      FunctionPrototypeCall(callback, thisArg === undefined ? this : thisArg, value, key, this);
+    }
+  }
+  /**
+   * Serializes the current set of entries into a fresh archive.
+   * @param {string | { comment?: string, baseOffset?: number }} [options]
+   * @returns {Promise<Buffer>}
+   */
+  async toBuffer(options) {
+    const { comment, baseOffset } = normalizeArchiveOptions(options);
+    const chunks = [];
+    // Defaulting to the raw #comment bytes (not the decoded string)
+    // round-trips a non-UTF-8 archive comment unchanged.
+    for await (const chunk of createZipArchive(this.values(), { comment: comment ?? this.#comment, baseOffset })) {
+      ArrayPrototypePush(chunks, chunk);
+    }
+    return Buffer.concat(chunks);
+  }
+  /**
+   * The synchronous counterpart of `toBuffer()`. Blocks the event loop and
+   * further JavaScript execution until the whole archive has been
+   * serialized; see `zipEntry.contentSync()`.
+   * @param {string | { comment?: string, baseOffset?: number }} [options]
+   * @returns {Buffer}
+   */
+  toBufferSync(options) {
+    const { comment, baseOffset } = normalizeArchiveOptions(options);
+    const chunks = [];
+    for (const chunk of createZipArchiveSync(this.values(), { comment: comment ?? this.#comment, baseOffset })) {
+      ArrayPrototypePush(chunks, chunk);
+    }
+    return Buffer.concat(chunks);
+  }
+  // Dispose: drop all entries (this view holds no fd of its own).
+  [SymbolDispose]() {
+    MapPrototypeClear(this.#entries);
+  }
+}
+
+module.exports = {
+  ZipBuffer,
+};
diff --git a/lib/internal/zip/compression.js b/lib/internal/zip/compression.js
new file mode 100644
index 000000000000..fd9a7373c365
--- /dev/null
+++ b/lib/internal/zip/compression.js
@@ -0,0 +1,303 @@
+'use strict';
+
+// Compression/decompression plumbing over the lazily-required `zlib` facade:
+// one-shot (async and sync) and streaming deflate/inflate/zstd helpers, plus
+// the member decoders that add method dispatch, size bounding, and CRC-32
+// verification on top.
+
+const {
+  JSONStringify,
+  MathMin,
+  Promise,
+} = primordials;
+
+const {
+  codes: {
+    ERR_ZIP_ENTRY_CORRUPT,
+    ERR_ZIP_ENTRY_TOO_LARGE,
+    ERR_ZIP_UNSUPPORTED_FEATURE,
+  },
+} = require('internal/errors');
+const { kMaxLength } = require('buffer');
+const { compose } = require('stream');
+const { crc32: crc32Native } = internalBinding('zlib');
+const {
+  FLAG_ENCRYPTED,
+  METHOD_STORE,
+  METHOD_DEFLATE,
+  METHOD_ZSTD,
+} = require('internal/zip/constants');
+
+// `internal/zip` is required from `lib/zlib.js`, so it must not require the
+// public `zlib` facade at load time (its module.exports is not yet
+// populated). Compression is only needed once an entry is actually read or
+// written, well after `zlib.js` has finished loading, so a lazy reference is
+// enough to break the cycle.
+let zlib;
+function lazyZlib() {
+  zlib ??= require('zlib');
+  return zlib;
+}
+
+// -- compression plumbing ------------------------------------------------------
+
+// The one-shot (async/sync) and streaming helpers below are thin adapters that
+// promisify or stream-wrap the lazy `zlib` facade; individually trivial, they
+// exist only so the rest of the module never touches `zlib` directly.
+
+function deflateRawAsync(buffer) {
+  return new Promise((resolve, reject) => {
+    lazyZlib().deflateRaw(buffer, (err, result) => {
+      if (err) reject(err);
+      else resolve(result);
+    });
+  });
+}
+
+function inflateRawAsync(buffer, options) {
+  return new Promise((resolve, reject) => {
+    lazyZlib().inflateRaw(buffer, options, (err, result) => {
+      if (err) reject(err);
+      else resolve(result);
+    });
+  });
+}
+
+// Drive `source` through a zlib transform stream, returning an async-iterable
+// stream of its output. `compose()` (pipeline-backed) wires error propagation
+// both ways and tears the whole chain down when the consumer errors or stops
+// early, so an abandoned iteration cannot leak the pipeline.
+function pumpThroughTransform(source, transform) {
+  return compose(source, transform);
+}
+
+function deflateRawStream(source) {
+  return pumpThroughTransform(source, lazyZlib().createDeflateRaw());
+}
+
+function inflateRawStream(source) {
+  return pumpThroughTransform(source, lazyZlib().createInflateRaw());
+}
+
+function zstdCompressAsync(buffer) {
+  return new Promise((resolve, reject) => {
+    lazyZlib().zstdCompress(buffer, (err, result) => {
+      if (err) reject(err);
+      else resolve(result);
+    });
+  });
+}
+
+function zstdDecompressAsync(buffer, options) {
+  return new Promise((resolve, reject) => {
+    lazyZlib().zstdDecompress(buffer, options, (err, result) => {
+      if (err) reject(err);
+      else resolve(result);
+    });
+  });
+}
+
+function zstdCompressStream(source) {
+  return pumpThroughTransform(source, lazyZlib().createZstdCompress());
+}
+
+function zstdDecompressStream(source) {
+  return pumpThroughTransform(source, lazyZlib().createZstdDecompress());
+}
+
+
+function deflateRawSync(buffer) {
+  return lazyZlib().deflateRawSync(buffer);
+}
+
+function zstdCompressSync(buffer) {
+  return lazyZlib().zstdCompressSync(buffer);
+}
+
+/**
+ * @typedef {{
+ *   name: string,
+ *   flags: number,
+ *   method: number,
+ *   crc32: number,
+ *   uncompressedSize: number,
+ * }} ZipMemberInfo
+ */
+
+// Shared entry guards for the member decoders below: encryption and
+// unsupported compression methods are rejected up front, and when the caller
+// bounds the output, a declared size beyond that bound fails before anything
+// is decompressed or allocated.
+function assertDecodable(info, options) {
+  if (info.flags & FLAG_ENCRYPTED) {
+    throw new ERR_ZIP_UNSUPPORTED_FEATURE(
+      `entry ${JSONStringify(info.name)} is encrypted`);
+  }
+  if (info.method !== METHOD_STORE && info.method !== METHOD_DEFLATE && info.method !== METHOD_ZSTD) {
+    throw new ERR_ZIP_UNSUPPORTED_FEATURE(
+      `entry ${JSONStringify(info.name)} uses compression method ${info.method}`);
+  }
+  if (options?.maxSize !== undefined && info.uncompressedSize > options.maxSize) {
+    throw new ERR_ZIP_ENTRY_TOO_LARGE(
+      `entry ${JSONStringify(info.name)} declares ${info.uncompressedSize} bytes, ` +
+      `exceeding the ${options.maxSize} byte limit`);
+  }
+}
+
+// Bound one-shot decompression by the declared size, not just the caller's
+// limit: a member that decompresses to more than it declares is corrupt by
+// definition, so there is no reason to materialize more than `declared + 1`
+// bytes (the +1 makes an overrun detectable) no matter how generous `maxSize`
+// is. This keeps a tiny archive from forcing a `maxSize`-sized allocation.
+function outputCap(info, options) {
+  return MathMin(
+    info.uncompressedSize + 1, options?.maxSize ?? kMaxLength, kMaxLength);
+}
+
+// Map a one-shot decompression failure to a corrupt-entry error.
+// `assertDecodable()` has already ensured `declared <= maxSize`, so hitting
+// the output cap always means the stream produced more than the member
+// declared.
+function rethrowDecodeFailure(err, info, method) {
+  if (err?.code === 'ERR_BUFFER_TOO_LARGE') {
+    throw new ERR_ZIP_ENTRY_CORRUPT(
+      `entry ${JSONStringify(info.name)} ` +
+      `${method === METHOD_DEFLATE ? 'inflates' : 'decompresses'} beyond its ` +
+      `declared size of ${info.uncompressedSize} bytes`);
+  }
+  throw new ERR_ZIP_ENTRY_CORRUPT(
+    `entry ${JSONStringify(info.name)} failed to ` +
+    `${method === METHOD_DEFLATE ? 'inflate' : 'decompress'}: ${err.message}`);
+}
+
+// Enforce the declared size and (unless opted out) the CRC-32 on a fully
+// decoded member.
+function checkDecoded(data, info, verify) {
+  if (data.length !== info.uncompressedSize) {
+    throw new ERR_ZIP_ENTRY_CORRUPT(
+      `entry ${JSONStringify(info.name)} produced ${data.length} bytes, expected ` +
+      `${info.uncompressedSize}`);
+  }
+  if (verify && crc32Native(data, 0) !== info.crc32) {
+    throw new ERR_ZIP_ENTRY_CORRUPT(
+      `entry ${JSONStringify(info.name)} failed CRC-32 verification`);
+  }
+}
+
+/**
+ * Decodes one member's compressed byte stream: rejects encrypted entries and
+ * unsupported compression methods, inflates method 8 or decompresses method
+ * 93 (Zstandard), enforces the declared uncompressed size and verifies
+ * CRC-32 (on by default).
+ * @param {AsyncIterable<Buffer>} source
+ * @param {ZipMemberInfo} info
+ * @param {{ verify?: boolean, maxSize?: number }} [options]
+ * @yields {Buffer}
+ */
+async function* decodeMemberStream(source, info, options) {
+  assertDecodable(info, options);
+  const verify = options?.verify !== false;
+  let produced = 0;
+  let state = 0;
+  const decoded = info.method === METHOD_DEFLATE ? inflateRawStream(source) :
+    info.method === METHOD_ZSTD ? zstdDecompressStream(source) : source;
+  for await (const chunk of decoded) {
+    produced += chunk.length;
+    if (produced > info.uncompressedSize) {
+      throw new ERR_ZIP_ENTRY_CORRUPT(
+        `entry ${JSONStringify(info.name)} inflates beyond its declared size of ` +
+        `${info.uncompressedSize} bytes`);
+    }
+    if (verify) state = crc32Native(chunk, state);
+    yield chunk;
+  }
+  if (produced !== info.uncompressedSize) {
+    throw new ERR_ZIP_ENTRY_CORRUPT(
+      `entry ${JSONStringify(info.name)} is truncated: got ${produced} of ` +
+      `${info.uncompressedSize} bytes`);
+  }
+  if (verify && state !== info.crc32) {
+    throw new ERR_ZIP_ENTRY_CORRUPT(
+      `entry ${JSONStringify(info.name)} failed CRC-32 verification`);
+  }
+}
+
+/**
+ * Decodes one member held completely in `compressed`, in one shot: the same
+ * guards, declared-size bounding, and CRC-32 verification as
+ * `decodeMemberStream()`, returning the whole decoded member. For the store
+ * method the input buffer itself is returned - callers that must hand out
+ * caller-owned memory copy it (see `zipEntry.content()`).
+ * @param {Buffer} compressed
+ * @param {ZipMemberInfo} info
+ * @param {{ verify?: boolean, maxSize?: number }} [options]
+ * @returns {Promise<Buffer>}
+ */
+async function decodeMemberAsync(compressed, info, options) {
+  assertDecodable(info, options);
+  const cap = outputCap(info, options);
+  let data;
+  if (info.method === METHOD_DEFLATE) {
+    try {
+      data = await inflateRawAsync(compressed, { maxOutputLength: cap });
+    } catch (err) {
+      rethrowDecodeFailure(err, info, METHOD_DEFLATE);
+    }
+  } else if (info.method === METHOD_ZSTD) {
+    try {
+      data = await zstdDecompressAsync(compressed, { maxOutputLength: cap });
+    } catch (err) {
+      rethrowDecodeFailure(err, info, METHOD_ZSTD);
+    }
+  } else {
+    data = compressed;
+  }
+  checkDecoded(data, info, options?.verify !== false);
+  return data;
+}
+
+/**
+ * The synchronous counterpart of `decodeMemberAsync()`. There is no public
+ * synchronous incremental inflate API, so - unlike the streaming path -
+ * `compressed` must already be the member's complete compressed byte
+ * stream, and the whole result is produced (and verified) in one call
+ * rather than yielded incrementally.
+ * @param {Buffer} compressed
+ * @param {ZipMemberInfo} info
+ * @param {{ verify?: boolean, maxSize?: number }} [options]
+ * @returns {Buffer}
+ */
+function decodeMemberSync(compressed, info, options) {
+  assertDecodable(info, options);
+  const cap = outputCap(info, options);
+  let data;
+  if (info.method === METHOD_DEFLATE) {
+    try {
+      data = lazyZlib().inflateRawSync(compressed, { maxOutputLength: cap });
+    } catch (err) {
+      rethrowDecodeFailure(err, info, METHOD_DEFLATE);
+    }
+  } else if (info.method === METHOD_ZSTD) {
+    try {
+      data = lazyZlib().zstdDecompressSync(compressed, { maxOutputLength: cap });
+    } catch (err) {
+      rethrowDecodeFailure(err, info, METHOD_ZSTD);
+    }
+  } else {
+    data = compressed;
+  }
+  checkDecoded(data, info, options?.verify !== false);
+  return data;
+}
+
+module.exports = {
+  deflateRawAsync,
+  deflateRawSync,
+  zstdCompressAsync,
+  zstdCompressSync,
+  deflateRawStream,
+  zstdCompressStream,
+  decodeMemberStream,
+  decodeMemberAsync,
+  decodeMemberSync,
+};
diff --git a/lib/internal/zip/constants.js b/lib/internal/zip/constants.js
new file mode 100644
index 000000000000..2fe9d684b7f4
--- /dev/null
+++ b/lib/internal/zip/constants.js
@@ -0,0 +1,109 @@
+'use strict';
+
+// Shared constants, symbols, and tiny shared values for the ZIP
+// implementation. This module is a leaf: it requires nothing from the rest of
+// `internal/zip`, so every other zip module can require it without cycles.
+
+const {
+  BigInt,
+  NumberMAX_SAFE_INTEGER,
+  Symbol,
+} = primordials;
+
+const { FastBuffer } = require('internal/buffer');
+
+const EMPTY_BUFFER = new FastBuffer();
+const BIGINT_MAX_SAFE_INTEGER = BigInt(NumberMAX_SAFE_INTEGER);
+
+// ZIP record signatures (APPNOTE.TXT, PKWARE Inc.)
+const SIG_LOCAL_FILE_HEADER = 0x04034b50; // sec. 4.3.7
+const SIG_DATA_DESCRIPTOR = 0x08074b50; // sec. 4.3.9
+const SIG_CENTRAL_FILE_HEADER = 0x02014b50; // sec. 4.3.12
+const SIG_ZIP64_EOCD_RECORD = 0x06064b50; // sec. 4.3.14
+const SIG_ZIP64_EOCD_LOCATOR = 0x07064b50; // sec. 4.3.15
+const SIG_EOCD = 0x06054b50; // sec. 4.3.16
+
+const MADE_BY_UNIX = 3; // sec. 4.4.2
+const ZIP64_EXTRA_ID = 0x0001; // sec. 4.5.3
+
+const SENTINEL16 = 0xffff;
+const SENTINEL32 = 0xffffffff;
+
+const FLAG_ENCRYPTED = 0x0001; // sec. 4.4.4 bit 0
+const FLAG_DATA_DESCRIPTOR = 0x0008; // bit 3
+const FLAG_UTF8 = 0x0800; // bit 11: name/comment are UTF-8 (EFS)
+
+const METHOD_STORE = 0; // sec. 4.4.5
+const METHOD_DEFLATE = 8; // sec. 4.4.5
+const METHOD_ZSTD = 93; // sec. 4.4.5
+
+const VERSION_DEFAULT = 20; // 2.0: deflate + directories (sec. 4.4.3)
+const VERSION_ZIP64 = 45; // 4.5: Zip64 structures
+const VERSION_ZSTD = 63; // 6.3: Zstandard compression (method 93)
+
+// The Zip64 EOCD record may carry an extensible data sector of arbitrary
+// length between its fixed part and the locator, so it can start before any
+// fixed-size tail read. When the locator points further back than the bytes
+// at hand, callers re-read from the recorded offset - but only within this
+// bound, so a hostile locator cannot demand an unbounded allocation.
+const ZIP64_EOCD_MAX_LENGTH = 56 + 1024 * 1024;
+
+const S_IFREG = 0o100000; // Unix mode type bits: regular file
+const S_IFDIR = 0o040000; // Unix mode type bits: directory
+const S_IFLNK = 0o120000; // Unix mode type bits: symbolic link
+const S_IFMT = 0o170000; // Unix mode type mask
+
+// Extra-field header IDs we consult on read (sec. 4.5).
+const EXTRA_ID_NTFS = 0x000a; // NTFS times (100 ns since 1601)
+const EXTRA_ID_EXT_TIMESTAMP = 0x5455; // Info-ZIP extended timestamp ("UT")
+const EXTRA_ID_UNIX_OLD = 0x5855; // Info-ZIP Unix, original ("UX")
+const EXTRA_ID_UNICODE_PATH = 0x7075; // Info-ZIP Unicode Path ("up")
+
+// Passed between `ZipEntry` and the archive writers/`ZipFile`: `kFinalize`
+// asks an entry for its central-directory header at a known local offset;
+// `kPromote` rebinds a just-serialized streaming entry to its on-disk copy.
+const kFinalize = Symbol('kFinalize');
+const kPromote = Symbol('kPromote');
+
+// The chunk size for reading a file-backed member's compressed bytes.
+const READ_CHUNK_SIZE = 4 * 1024 * 1024;
+// EOCD + max comment + Zip64 locator + Zip64 record + slack for an
+// extensible data sector: the fixed-size tail `ZipFile.open()` reads first.
+const TAIL_LENGTH = 22 + SENTINEL16 + 20 + 56 + 4096;
+
+module.exports = {
+  EMPTY_BUFFER,
+  BIGINT_MAX_SAFE_INTEGER,
+  SIG_LOCAL_FILE_HEADER,
+  SIG_DATA_DESCRIPTOR,
+  SIG_CENTRAL_FILE_HEADER,
+  SIG_ZIP64_EOCD_RECORD,
+  SIG_ZIP64_EOCD_LOCATOR,
+  SIG_EOCD,
+  MADE_BY_UNIX,
+  ZIP64_EXTRA_ID,
+  SENTINEL16,
+  SENTINEL32,
+  FLAG_ENCRYPTED,
+  FLAG_DATA_DESCRIPTOR,
+  FLAG_UTF8,
+  METHOD_STORE,
+  METHOD_DEFLATE,
+  METHOD_ZSTD,
+  VERSION_DEFAULT,
+  VERSION_ZIP64,
+  VERSION_ZSTD,
+  ZIP64_EOCD_MAX_LENGTH,
+  S_IFREG,
+  S_IFDIR,
+  S_IFLNK,
+  S_IFMT,
+  EXTRA_ID_NTFS,
+  EXTRA_ID_EXT_TIMESTAMP,
+  EXTRA_ID_UNIX_OLD,
+  EXTRA_ID_UNICODE_PATH,
+  kFinalize,
+  kPromote,
+  READ_CHUNK_SIZE,
+  TAIL_LENGTH,
+};
diff --git a/lib/internal/zip/content-size.js b/lib/internal/zip/content-size.js
new file mode 100644
index 000000000000..0693e86f1568
--- /dev/null
+++ b/lib/internal/zip/content-size.js
@@ -0,0 +1,41 @@
+'use strict';
+
+// The module-global default ceiling on in-memory member decompression, and
+// its public getter/setter. Kept in its own module so every read path sees
+// the one mutable value.
+
+const { validateInteger } = require('internal/validators');
+
+// A default ceiling on the uncompressed size that the buffering read paths
+// (`ZipEntry.prototype.content()`, and therefore `ZipBuffer`/`ZipFile`
+// `get()`) will materialize in memory when the caller does not pass an
+// explicit `maxSize`. An archive whose central directory declares a member
+// larger than this is rejected before any large allocation happens. Callers
+// that need larger members can either pass a per-call `maxSize` or raise the
+// module default with `setMaxZipContentSize()`. The streaming read paths
+// (`contentIterator()`, `ZipFile.prototype.stream()`) are bounded-memory by
+// design and are not subject to this default.
+const DEFAULT_MAX_ZIP_CONTENT_SIZE = 256 * 1024 * 1024; // 256 MiB
+let maxZipContentSize = DEFAULT_MAX_ZIP_CONTENT_SIZE;
+
+/**
+ * @returns {number}
+ */
+function getMaxZipContentSize() {
+  return maxZipContentSize;
+}
+
+/**
+ * @param {number} size
+ * @returns {void}
+ */
+function setMaxZipContentSize(size) {
+  validateInteger(size, 'size', 0);
+  maxZipContentSize = size;
+}
+
+module.exports = {
+  DEFAULT_MAX_ZIP_CONTENT_SIZE,
+  getMaxZipContentSize,
+  setMaxZipContentSize,
+};
diff --git a/lib/internal/zip/dos.js b/lib/internal/zip/dos.js
new file mode 100644
index 000000000000..d3a41323b87e
--- /dev/null
+++ b/lib/internal/zip/dos.js
@@ -0,0 +1,138 @@
+'use strict';
+
+// DOS/IBM legacy decoding: MS-DOS date/time fields (sec. 4.4.6) and the
+// historical Code Page 437 name/comment encoding, plus the modern
+// UTF-8/Unicode-Path handling layered on top of them.
+
+const {
+  Date,
+  NumberIsNaN,
+  StringFromCharCode,
+} = primordials;
+
+const {
+  codes: {
+    ERR_INVALID_ARG_VALUE,
+  },
+} = require('internal/errors');
+const { crc32: crc32Native } = internalBinding('zlib');
+const { isUtf8 } = internalBinding('buffer');
+const {
+  FLAG_UTF8,
+  EXTRA_ID_UNICODE_PATH,
+} = require('internal/zip/constants');
+const { forEachExtraField } = require('internal/zip/extra-fields');
+
+// DOS date/time (sec. 4.4.6): local time by convention.
+// time: bits 0-4 seconds/2, 5-10 minutes, 11-15 hours
+// date: bits 0-4 day, 5-8 month, 9-15 years since 1980
+function decodeDosDateTime(time, date) {
+  // A zeroed/absent date field has month 0 and day 0, both invalid; the DOS
+  // epoch is 1980-01-01. Month/day 0 are treated as 1 so a zero field decodes
+  // to 1980-01-01 (and re-encodes to the same value).
+  return new Date(
+    ((date >>> 9) & 0x7f) + 1980,
+    ((date >>> 5) & 0x0f || 1) - 1,
+    (date & 0x1f) || 1,
+    (time >>> 11) & 0x1f,
+    (time >>> 5) & 0x3f,
+    (time & 0x1f) * 2,
+  );
+}
+
+// Encode a Date into packed MS-DOS time/date fields (sec. 4.4.6), clamping to
+// the representable range 1980-01-01 .. 2107-12-31.
+function encodeDosDateTime(value) {
+  const year = value.getFullYear();
+  if (NumberIsNaN(year)) {
+    throw new ERR_INVALID_ARG_VALUE('modified', value, 'must be a valid Date');
+  }
+  if (year < 1980) return { time: 0, date: (1 << 5) | 1 }; // Clamp to 1980-01-01 00:00:00
+  if (year > 2107) {
+    // Clamp to 2107-12-31 23:59:58
+    return {
+      time: (23 << 11) | (59 << 5) | 29,
+      date: (127 << 9) | (12 << 5) | 31,
+    };
+  }
+  const date =
+    ((year - 1980) << 9) | ((value.getMonth() + 1) << 5) | value.getDate();
+  const time =
+    (value.getHours() << 11) |
+    (value.getMinutes() << 5) |
+    (value.getSeconds() >>> 1);
+  return { time, date };
+}
+
+// Code Page 437 high half (0x80-0xFF) -> Unicode. Names without the UTF-8
+// language-encoding flag (bit 11) are historically CP437, which every real
+// tool (Info-ZIP, Windows Explorer) assumes; bytes 0x00-0x7F are ASCII.
+const CP437_HIGH = [
+  0x00c7, 0x00fc, 0x00e9, 0x00e2, 0x00e4, 0x00e0, 0x00e5, 0x00e7,
+  0x00ea, 0x00eb, 0x00e8, 0x00ef, 0x00ee, 0x00ec, 0x00c4, 0x00c5,
+  0x00c9, 0x00e6, 0x00c6, 0x00f4, 0x00f6, 0x00f2, 0x00fb, 0x00f9,
+  0x00ff, 0x00d6, 0x00dc, 0x00a2, 0x00a3, 0x00a5, 0x20a7, 0x0192,
+  0x00e1, 0x00ed, 0x00f3, 0x00fa, 0x00f1, 0x00d1, 0x00aa, 0x00ba,
+  0x00bf, 0x2310, 0x00ac, 0x00bd, 0x00bc, 0x00a1, 0x00ab, 0x00bb,
+  0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556,
+  0x2555, 0x2563, 0x2551, 0x2557, 0x255d, 0x255c, 0x255b, 0x2510,
+  0x2514, 0x2534, 0x252c, 0x251c, 0x2500, 0x253c, 0x255e, 0x255f,
+  0x255a, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256c, 0x2567,
+  0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256b,
+  0x256a, 0x2518, 0x250c, 0x2588, 0x2584, 0x258c, 0x2590, 0x2580,
+  0x03b1, 0x00df, 0x0393, 0x03c0, 0x03a3, 0x03c3, 0x00b5, 0x03c4,
+  0x03a6, 0x0398, 0x03a9, 0x03b4, 0x221e, 0x03c6, 0x03b5, 0x2229,
+  0x2261, 0x00b1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00f7, 0x2248,
+  0x00b0, 0x2219, 0x00b7, 0x221a, 0x207f, 0x00b2, 0x25a0, 0x00a0,
+];
+
+// Decode a CP437-encoded name/comment to a JS string via the table above.
+function decodeCp437(buffer) {
+  let out = '';
+  for (let i = 0; i < buffer.length; i++) {
+    const b = buffer[i];
+    out += StringFromCharCode(b < 0x80 ? b : CP437_HIGH[b - 0x80]);
+  }
+  return out;
+}
+
+// The UTF-8 name from an Info-ZIP Unicode Path extra field (sec. 4.6.9), but
+// only when its version is 1 and its CRC-32 matches the standard-field name
+// bytes (so a stale extra left over from a rename is ignored). Otherwise null.
+function unicodePathName(extra, standardNameBuffer) {
+  let result = null;
+  forEachExtraField(extra, (id, body) => {
+    if (result !== null || id !== EXTRA_ID_UNICODE_PATH || body.length < 5) return;
+    if (body[0] !== 1) return;
+    // The crc32 binding returns an unsigned uint32, directly comparable.
+    if (body.readUInt32LE(1) !== crc32Native(standardNameBuffer, 0)) return;
+    result = body.toString('utf8', 5);
+  });
+  return result;
+}
+
+// Decode an entry name: prefer a valid Unicode Path extra field, else the
+// UTF-8/CP437 heuristic below.
+function decodeZipName(nameBuffer, flags, extra) {
+  if (extra?.length) {
+    const unicode = unicodePathName(extra, nameBuffer);
+    if (unicode !== null) return unicode;
+  }
+  return decodeZipText(nameBuffer, flags);
+}
+
+// Decode a name/comment: UTF-8 when bit 11 says so, or when the bytes are
+// valid UTF-8 anyway - plenty of real tools (pre-JDK7 java.util.zip among
+// them) wrote UTF-8 names without ever setting the flag. Only genuinely
+// non-UTF-8 bytes take the historical CP437 default.
+function decodeZipText(buffer, flags) {
+  if ((flags & FLAG_UTF8) || isUtf8(buffer)) return buffer.toString('utf8');
+  return decodeCp437(buffer);
+}
+
+module.exports = {
+  decodeDosDateTime,
+  encodeDosDateTime,
+  decodeZipName,
+  decodeZipText,
+};
diff --git a/lib/internal/zip/entry.js b/lib/internal/zip/entry.js
new file mode 100644
index 000000000000..4eab161db9b2
--- /dev/null
+++ b/lib/internal/zip/entry.js
@@ -0,0 +1,962 @@
+'use strict';
+
+// `ZipEntry`: a single archive member. Reads (buffered and streaming),
+// (de)serialization, and the `create()`/`createSync()`/`createStream()`/
+// `createSymlink()` builders, plus the `createEntryMeta()` helper that
+// normalizes their options into the internal metadata record.
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSort,
+  Date,
+  DateNow,
+  JSONStringify,
+  MathFloor,
+  MathMin,
+  NumberMAX_SAFE_INTEGER,
+  StringPrototypeEndsWith,
+  SymbolAsyncDispose,
+  SymbolAsyncIterator,
+  SymbolDispose,
+  SymbolIterator,
+} = primordials;
+
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+    ERR_ZIP_ENTRY_TOO_LARGE,
+    ERR_ZIP_INVALID_ARCHIVE,
+    ERR_ZIP_UNSUPPORTED_FEATURE,
+  },
+} = require('internal/errors');
+const {
+  validateInteger,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+const {
+  isDate,
+  isUint8Array,
+} = require('internal/util/types');
+const { Buffer, kMaxLength } = require('buffer');
+const { crc32: crc32Native } = internalBinding('zlib');
+const {
+  EMPTY_BUFFER,
+  SIG_LOCAL_FILE_HEADER,
+  SENTINEL16,
+  FLAG_DATA_DESCRIPTOR,
+  FLAG_UTF8,
+  MADE_BY_UNIX,
+  METHOD_STORE,
+  METHOD_DEFLATE,
+  METHOD_ZSTD,
+  S_IFREG,
+  S_IFDIR,
+  S_IFLNK,
+  S_IFMT,
+  READ_CHUNK_SIZE,
+  kFinalize,
+  kPromote,
+} = require('internal/zip/constants');
+const {
+  toBuffer,
+  validateArchiveRange,
+} = require('internal/zip/binary');
+const {
+  extraFieldMtime,
+  stripZip64Extra,
+} = require('internal/zip/extra-fields');
+const {
+  decodeZipName,
+  decodeZipText,
+} = require('internal/zip/dos');
+const {
+  CentralFileHeader,
+  LocalFileHeader,
+  findArchiveEnd,
+} = require('internal/zip/headers');
+const {
+  buildLocalHeader,
+  buildCentralHeader,
+  buildDataDescriptor64,
+} = require('internal/zip/header-builders');
+const {
+  deflateRawAsync,
+  deflateRawSync,
+  zstdCompressAsync,
+  zstdCompressSync,
+  deflateRawStream,
+  zstdCompressStream,
+  decodeMemberStream,
+  decodeMemberAsync,
+  decodeMemberSync,
+} = require('internal/zip/compression');
+const {
+  readFdFully,
+  readFdFullySync,
+} = require('internal/zip/fs-util');
+const { getMaxZipContentSize } = require('internal/zip/content-size');
+
+// The whole (UTC) second to record in an extended-timestamp extra field when
+// `mtimeMs` cannot be represented exactly by the 2-second-resolution,
+// local-time DOS date/time fields (sub-second parts and odd seconds alike),
+// or null when the DOS fields suffice or the value does not fit the extra
+// field's signed 32-bit Unix-seconds range (through 2038). One rule, shared
+// by createEntryMeta() and #finalizeMeta() so the two cannot drift.
+function extendedMtimeSeconds(mtimeMs) {
+  const seconds = MathFloor(mtimeMs / 1000);
+  return (mtimeMs % 2000 !== 0 && seconds >= -2147483648 && seconds <= 2147483647) ?
+    seconds : null;
+}
+
+// Normalize the public builder options into the internal metadata record:
+// name/comment bytes, the UTF-8 flag, the Unix mode packed into the external
+// attributes (sec. 4.4.15), and the DOS/extended-timestamp fields.
+function createEntryMeta(filename, options) {
+  validateString(filename, 'filename');
+  const name = Buffer.from(filename, 'utf8');
+  if (name.length === 0) {
+    throw new ERR_INVALID_ARG_VALUE('filename', filename, 'must not be empty');
+  }
+  if (name.length > SENTINEL16) {
+    throw new ERR_ZIP_ENTRY_TOO_LARGE(
+      'the entry name must not exceed 65535 bytes when encoded as UTF-8');
+  }
+  let comment = EMPTY_BUFFER;
+  if (options?.comment !== undefined) {
+    validateString(options.comment, 'options.comment');
+    comment = Buffer.from(options.comment, 'utf8');
+    if (comment.length > SENTINEL16) {
+      throw new ERR_ZIP_ENTRY_TOO_LARGE(
+        'the entry comment must not exceed 65535 bytes when encoded as UTF-8');
+    }
+  }
+  const isSymlink = options?.symlink === true;
+  const isDirectory = !isSymlink && StringPrototypeEndsWith(filename, '/');
+  const mode = options?.mode ?? (isSymlink ? 0o777 : isDirectory ? 0o755 : 0o644);
+  validateUint32(mode, 'options.mode');
+  // Default to the current time at the DOS fields' 2-second resolution, so a
+  // default entry needs no extended-timestamp extra field (see below).
+  const modified = options?.modified ?? new Date(MathFloor(DateNow() / 2000) * 2000);
+  if (!isDate(modified)) {
+    throw new ERR_INVALID_ARG_TYPE('options.modified', 'Date', modified);
+  }
+  if (options?.method !== undefined &&
+      options.method !== 'deflate' && options.method !== 'store' && options.method !== 'zstd') {
+    throw new ERR_INVALID_ARG_VALUE(
+      'options.method', options.method, "must be 'deflate', 'store', or 'zstd'");
+  }
+  const typeBits = isSymlink ? S_IFLNK : isDirectory ? S_IFDIR : S_IFREG;
+  const unixAttrs = (typeBits | (mode & 0o7777)) & SENTINEL16;
+  const external = ((unixAttrs << 16) | (isDirectory ? 0x10 : 0)) >>> 0;
+  // Record the whole (UTC) second in an extended-timestamp extra field when
+  // the DOS fields cannot represent the time exactly; see
+  // extendedMtimeSeconds().
+  const extendedMtime = extendedMtimeSeconds(modified.getTime());
+  return {
+    name,
+    comment,
+    extra: EMPTY_BUFFER,
+    flags: FLAG_UTF8,
+    method: 0,
+    crc: 0,
+    compressedSize: 0,
+    uncompressedSize: 0,
+    modified,
+    extendedMtime,
+    external,
+    internal: 0,
+    madeBy: MADE_BY_UNIX,
+    pending: true,
+  };
+}
+
+/**
+ * A single file or directory inside a ZIP archive: reading, writing, and
+ * (de)serializing one archive member.
+ */
+class ZipEntry {
+  #central;
+  #local;
+  #content;
+  #source = null;
+  #meta = null;
+  #serialized = false;
+  // When #fd is non-null the entry is "file-backed": it holds no content
+  // buffer, only a descriptor *handle* ({ fd, closed }) shared with the
+  // owning ZipFile plus the local-header offset, and reads its compressed
+  // bytes from disk on demand (see #compressedBytes/#rawChunks). The shared
+  // handle lets close() invalidate every outstanding entry at once, so a
+  // read never falls through to a bare (possibly reused) fd number.
+  // #contentOffset caches the resolved start of the compressed data (a
+  // number, not a buffer) once the local header has been read.
+  #fd = null;
+  #localOffset = -1;
+  #contentOffset = -1;
+
+  /**
+   * @private
+   */
+  constructor(central, local, content, fd = null, localOffset = -1) {
+    this.#central = central;
+    this.#local = local;
+    this.#content = content;
+    this.#fd = fd;
+    this.#localOffset = localOffset;
+  }
+
+  // Whether the content is stored in compressed form, whatever the method.
+  get compressed() { return this.method !== METHOD_STORE; }
+  get rawContent() { return this.#content; }
+  get method() {
+    return this.#meta ? this.#meta.method : this.#central.compressionMethod;
+  }
+  get flags() {
+    return this.#meta ? this.#meta.flags : (this.#local ?? this.#central).flags;
+  }
+  get crc32() {
+    if (this.#meta) {
+      this.#assertNotPending();
+      return this.#meta.crc;
+    }
+    return this.#central.crc32;
+  }
+  get name() {
+    // The central directory is authoritative; a mismatched local-header name
+    // is deliberately ignored (defends against parser-confusion attacks).
+    // Both branches use the same decoding (Unicode Path extra, then
+    // UTF-8/CP437), so serialization - which snapshots the raw bytes into
+    // #meta - never changes what this getter reports.
+    return this.#meta ?
+      decodeZipName(this.#meta.name, this.#meta.flags, this.#meta.extra) :
+      this.#central.fileName;
+  }
+  get nameBuffer() {
+    return this.#meta ? this.#meta.name : this.#central.fileNameBuffer;
+  }
+  get comment() {
+    return this.#meta ?
+      decodeZipText(this.#meta.comment, this.#meta.flags) :
+      this.#central.fileComment;
+  }
+  get size() {
+    if (this.#meta) {
+      this.#assertNotPending();
+      return this.#meta.uncompressedSize;
+    }
+    return this.#central.uncompressedSize;
+  }
+  get compressedSize() {
+    if (this.#meta) {
+      this.#assertNotPending();
+      return this.#meta.compressedSize;
+    }
+    return this.#central.compressedSize;
+  }
+  get modified() {
+    if (this.#meta) return this.#meta.modified;
+    // Prefer an extra-field timestamp (absolute, higher-resolution) over the
+    // coarse local-time DOS date/time fields when a foreign archive carries
+    // one; consult both the central and local headers. A file-backed entry
+    // starts out with only its central header, but some tools (7-Zip, for
+    // one) write their high-fidelity timestamp only into the local header -
+    // resolve it lazily (a small, one-time positioned read) rather than
+    // silently reporting a coarser time than the archive carries, and fall
+    // back to the central data when the local header cannot be read.
+    if (this.#fd !== null && this.#local === null) {
+      try {
+        this.#resolveLocalHeaderSync();
+      } catch {
+        // A malformed local header fails loudly on the content read paths;
+        // for metadata, the central directory alone has to do.
+      }
+    }
+    return extraFieldMtime(this.#central.extraField, this.#local?.extraField) ??
+      this.#central.lastModified;
+  }
+  get mode() {
+    // The external attributes' high 16 bits hold Unix permissions only when
+    // the entry was made by a Unix host (sec. 4.4.2/4.4.15) - the same rule
+    // as `CentralFileHeader.prototype.mode`, which the non-meta branch
+    // defers to.
+    if (this.#meta) {
+      return this.#meta.madeBy === MADE_BY_UNIX ?
+        (this.#meta.external >>> 16) & 0o7777 : 0;
+    }
+    return this.#central.mode;
+  }
+  get isSymlink() {
+    // Derived from the made-by host and the external attributes' Unix type
+    // bits in both branches, so it survives serialization (which preserves
+    // both verbatim); this also makes a fresh `createSymlink()` entry report
+    // itself as one.
+    if (this.#meta) {
+      return this.#meta.madeBy === MADE_BY_UNIX &&
+        ((this.#meta.external >>> 16) & S_IFMT) === S_IFLNK;
+    }
+    return this.#central.isSymlink;
+  }
+  get isFile() { return !this.isDirectory && !this.isSymlink; }
+  get isDirectory() { return StringPrototypeEndsWith(this.name, '/'); }
+
+  // Guard: reject metadata/content reads on a write-streaming entry whose
+  // sizes and CRC are not yet known (still pending serialization).
+  #assertNotPending() {
+    if (this.#meta?.pending) {
+      throw new ERR_INVALID_STATE(
+        'this streaming entry has not finished serializing yet');
+    }
+  }
+
+  // Snapshot this (parsed) entry's central-directory data into a
+  // re-serializable #meta record, memoized. Needed so a round-tripped entry
+  // can be re-emitted from stable, extra-field-aware values rather than raw
+  // header bytes; clears the data-descriptor flag (see below).
+  #finalizeMeta() {
+    if (this.#meta) {
+      this.#assertNotPending();
+      return this.#meta;
+    }
+    const central = this.#central;
+    // Descriptor entries (bit 3) are re-emitted with known sizes/CRC and bit
+    // 3 cleared: full re-serialization emits a fresh local header from this
+    // same record, so it never reproduces a bit-3 local header without a
+    // data descriptor. (This invariant does NOT hold for `ZipFile`'s
+    // in-place central-directory rewrite, which leaves local headers on disk
+    // untouched - that path re-asserts bit 3 via `[kFinalize]`; see there.)
+    // Sizes come from the central directory
+    // (Zip64-aware); Zip64 extras are regenerated as needed, and all other
+    // extra-field records (Unicode Path, NTFS/UT timestamps, ...) are
+    // preserved so a re-serialized entry keeps its name encoding and
+    // timestamps.
+    const extra = stripZip64Extra(central.extraField);
+    // Snapshot the resolved (extra-field-aware) time, not the raw DOS field,
+    // so serialization does not degrade what `modified` reports. When that
+    // time cannot be represented exactly in the DOS fields and no preserved
+    // extra record carries it, record it in an extended-timestamp extra
+    // (see extendedMtimeSeconds(); same rule as createEntryMeta()).
+    const modified = this.modified;
+    const extendedMtime = extraFieldMtime(extra) === null ?
+      extendedMtimeSeconds(modified.getTime()) : null;
+    const meta = {
+      name: central.fileNameBuffer,
+      comment: central.fileCommentBuffer,
+      extra,
+      flags: central.flags & ~FLAG_DATA_DESCRIPTOR,
+      method: central.compressionMethod,
+      crc: central.crc32,
+      compressedSize: central.compressedSize,
+      uncompressedSize: central.uncompressedSize,
+      modified,
+      extendedMtime,
+      external: central.externalFileAttributes,
+      internal: central.internalFileAttributes,
+      // Preserve the creator's host byte (sec. 4.4.2): the external
+      // attributes are only interpretable relative to it.
+      madeBy: central.version >>> 8,
+      pending: false,
+    };
+    this.#meta = meta;
+    return meta;
+  }
+
+  // The live numeric descriptor for a file-backed entry, or a clean state
+  // error if the ZipFile that owns it has since been closed - never a raw
+  // (possibly OS-reused) fd number. Returns null for an in-memory entry.
+  // A file-backed entry holds a descriptor *handle* ({ fd, closed }) shared
+  // with its ZipFile, not a bare fd, so close() is observable here.
+  #liveDescriptor() {
+    const handle = this.#fd;
+    if (handle === null) return null;
+    if (handle.closed) {
+      throw new ERR_INVALID_STATE(
+        'cannot read a ZipEntry after its backing ZipFile has been closed');
+    }
+    return handle.fd;
+  }
+
+  // Read (and cache) this file-backed entry's local file header - whose
+  // length (fixed 30 bytes plus variable name/extra fields) is only known
+  // from the file itself, not from the central directory. Resolving it also
+  // yields the offset where the compressed data begins, and gives the
+  // `modified` getter access to a local-header-only timestamp extra.
+  async #resolveLocalHeader() {
+    if (this.#local !== null) return this.#local;
+    const fd = this.#liveDescriptor();
+    const fixed = Buffer.allocUnsafe(30);
+    await readFdFully(fd, fixed, this.#localOffset);
+    if (fixed.readUInt32LE(0) !== SIG_LOCAL_FILE_HEADER) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        `entry ${JSONStringify(this.name)} has an invalid local file header`);
+    }
+    const length = LocalFileHeader.length(fixed, 0);
+    const full = Buffer.allocUnsafe(length);
+    fixed.copy(full, 0);
+    if (length > 30) {
+      await readFdFully(fd, full.subarray(30), this.#localOffset + 30);
+    }
+    this.#local = new LocalFileHeader(full, 0);
+    this.#contentOffset = this.#localOffset + length;
+    return this.#local;
+  }
+  // Sync counterpart of #resolveLocalHeader().
+  #resolveLocalHeaderSync() {
+    if (this.#local !== null) return this.#local;
+    const fd = this.#liveDescriptor();
+    const fixed = Buffer.allocUnsafe(30);
+    readFdFullySync(fd, fixed, this.#localOffset);
+    if (fixed.readUInt32LE(0) !== SIG_LOCAL_FILE_HEADER) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        `entry ${JSONStringify(this.name)} has an invalid local file header`);
+    }
+    const length = LocalFileHeader.length(fixed, 0);
+    const full = Buffer.allocUnsafe(length);
+    fixed.copy(full, 0);
+    if (length > 30) {
+      readFdFullySync(fd, full.subarray(30), this.#localOffset + 30);
+    }
+    this.#local = new LocalFileHeader(full, 0);
+    this.#contentOffset = this.#localOffset + length;
+    return this.#local;
+  }
+  // The offset where this file-backed entry's compressed data begins, reading
+  // the local header first if that has not been resolved yet.
+  async #resolveContentOffset() {
+    if (this.#contentOffset < 0) await this.#resolveLocalHeader();
+    return this.#contentOffset;
+  }
+  // Sync counterpart of #resolveContentOffset().
+  #resolveContentOffsetSync() {
+    if (this.#contentOffset < 0) this.#resolveLocalHeaderSync();
+    return this.#contentOffset;
+  }
+  // The in-memory raw bytes, or a clean state error when there are none - a
+  // write-streaming entry (`createStream()`) has no readable content until it
+  // has been serialized into a backing archive (after which `addEntry()`
+  // promotes it to file-backed; see [kPromote]).
+  #inMemoryCompressed() {
+    if (this.#content === null) {
+      throw new ERR_INVALID_STATE(
+        'the content of a streaming entry is not available for reading');
+    }
+    return this.#content;
+  }
+  // The entry's raw (still-compressed) bytes. For an in-memory entry this is
+  // the entry's retained buffer - shared memory, NOT a copy: it may alias
+  // the source archive (`ZipEntry.read()`) or the caller's original `data`
+  // (`create()` when storing). For a file-backed entry it is freshly read
+  // from disk and caller-owned. Paths that hand these bytes out undecoded
+  // (the store method) must copy the in-memory case; see `content()`.
+  async #compressedBytes() {
+    if (this.#fd === null) return this.#inMemoryCompressed();
+    const size = this.compressedSize;
+    // A member at or beyond the maximum Buffer length cannot be materialized
+    // in one allocation; stream it instead. (kMaxLength equals the safe
+    // integer ceiling on 64-bit, so a larger size fails to parse anyway.)
+    if (size >= kMaxLength) {
+      throw new ERR_ZIP_ENTRY_TOO_LARGE(
+        `entry ${JSONStringify(this.name)} is too large to buffer ` +
+        `(${size} compressed bytes); use contentIterator() instead`);
+    }
+    const start = await this.#resolveContentOffset();
+    const compressed = Buffer.allocUnsafe(size);
+    await readFdFully(this.#liveDescriptor(), compressed, start);
+    return compressed;
+  }
+  // Sync counterpart of #compressedBytes().
+  #compressedBytesSync() {
+    if (this.#fd === null) return this.#inMemoryCompressed();
+    const size = this.compressedSize;
+    if (size >= kMaxLength) {
+      throw new ERR_ZIP_ENTRY_TOO_LARGE(
+        `entry ${JSONStringify(this.name)} is too large to buffer ` +
+        `(${size} compressed bytes); use contentIterator() instead`);
+    }
+    const start = this.#resolveContentOffsetSync();
+    const compressed = Buffer.allocUnsafe(size);
+    readFdFullySync(this.#liveDescriptor(), compressed, start);
+    return compressed;
+  }
+  // The entry's raw compressed bytes as a bounded-memory chunk stream, read
+  // straight from disk (file-backed entries only). Nothing is retained.
+  async *#rawChunks() {
+    this.#liveDescriptor();
+    let pos = await this.#resolveContentOffset();
+    let remaining = this.compressedSize;
+    while (remaining > 0) {
+      const take = MathMin(READ_CHUNK_SIZE, remaining);
+      const chunk = Buffer.allocUnsafe(take);
+      // Re-check per chunk: the ZipFile may be closed mid-stream.
+      await readFdFully(this.#liveDescriptor(), chunk, pos);
+      pos += take;
+      remaining -= take;
+      yield chunk;
+    }
+  }
+  // Sync counterpart of #rawChunks().
+  *#rawChunksSync() {
+    this.#liveDescriptor();
+    let pos = this.#resolveContentOffsetSync();
+    let remaining = this.compressedSize;
+    while (remaining > 0) {
+      const take = MathMin(READ_CHUNK_SIZE, remaining);
+      const chunk = Buffer.allocUnsafe(take);
+      // Re-check per chunk: the ZipFile may be closed mid-stream.
+      readFdFullySync(this.#liveDescriptor(), chunk, pos);
+      pos += take;
+      remaining -= take;
+      yield chunk;
+    }
+  }
+
+  /**
+   * Reads, decompresses, and (by default) CRC-32-verifies the whole entry
+   * into a single `Buffer`, enforcing the declared-size and `maxSize` limits.
+   * @param {{ verify?: boolean, maxSize?: number }} [options]
+   * @returns {Promise<Buffer>}
+   */
+  async content(options) {
+    const declared = this.size;
+    const maxSize = options?.maxSize ?? getMaxZipContentSize();
+    if (declared > maxSize) {
+      throw new ERR_ZIP_ENTRY_TOO_LARGE(
+        `entry ${JSONStringify(this.name)} declares ${declared} bytes, ` +
+        `exceeding the ${maxSize} byte limit`);
+    }
+    const compressed = await this.#compressedBytes();
+    const data = await decodeMemberAsync(compressed, {
+      name: this.name,
+      flags: this.flags,
+      method: this.method,
+      crc32: this.crc32,
+      uncompressedSize: declared,
+    }, { verify: options?.verify, maxSize });
+    // `data === compressed` only on the store path; copy the in-memory case
+    // (the entry's retained buffer, see #compressedBytes()) so the result is
+    // caller-owned on every path.
+    return data === compressed && this.#fd === null ? Buffer.from(data) : data;
+  }
+
+  /**
+   * The synchronous counterpart of `content()`. Blocks the event loop and
+   * further JavaScript execution until the whole entry has been read and, if
+   * applicable, inflated - use only where synchronous I/O is appropriate
+   * (for example, short-lived scripts or startup code), not in code that
+   * must stay responsive.
+   * @param {{ verify?: boolean, maxSize?: number }} [options]
+   * @returns {Buffer}
+   */
+  contentSync(options) {
+    const declared = this.size;
+    const maxSize = options?.maxSize ?? getMaxZipContentSize();
+    if (declared > maxSize) {
+      throw new ERR_ZIP_ENTRY_TOO_LARGE(
+        `entry ${JSONStringify(this.name)} declares ${declared} bytes, ` +
+        `exceeding the ${maxSize} byte limit`);
+    }
+    const compressed = this.#compressedBytesSync();
+    const data = decodeMemberSync(compressed, {
+      name: this.name,
+      flags: this.flags,
+      method: this.method,
+      crc32: this.crc32,
+      uncompressedSize: declared,
+    }, { verify: options?.verify, maxSize });
+    // `data === compressed` only on the store path; copy the in-memory case
+    // so the result is caller-owned on every path (see content()).
+    return data === compressed && this.#fd === null ? Buffer.from(data) : data;
+  }
+
+  // The raw (still-compressed) bytes as an async iterable, without buffering
+  // the whole member: straight from disk for a file-backed entry, or the
+  // single in-memory buffer otherwise. Throws synchronously for a pending
+  // write-streaming entry, whose content is not yet available for reading.
+  #rawSource() {
+    if (this.#fd !== null) return this.#rawChunks();
+    const content = this.#inMemoryCompressed();
+    return (async function* () {
+      if (content.length) yield content;
+    })();
+  }
+
+  /**
+   * Yields the entry's decompressed content as a bounded-memory async
+   * iterator of `Buffer` chunks, decompressing on the way and (by default)
+   * verifying CRC-32. For a file-backed entry (from `ZipFile.get()`) the
+   * compressed bytes are read from disk as they are consumed and nothing is
+   * retained.
+   * @param {{ verify?: boolean, maxSize?: number }} [options]
+   * @returns {AsyncGenerator<Buffer>}
+   */
+  contentIterator(options) {
+    // No default maxSize here, unlike content(): streaming is the
+    // bounded-memory path for arbitrarily large members, so imposing content()'s
+    // buffer-oriented ceiling would defeat its purpose (and cap legitimate
+    // multi-gigabyte reads). Output is still bounded per chunk to the declared
+    // uncompressed size; a caller that wants an explicit cap passes
+    // options.maxSize.
+    return decodeMemberStream(this.#rawSource(), {
+      name: this.name,
+      flags: this.flags,
+      method: this.method,
+      crc32: this.crc32,
+      uncompressedSize: this.size,
+    }, options);
+  }
+
+  // Synchronous serialization: emit the local file header (sec. 4.3.7)
+  // followed by the raw (already-compressed) content bytes. Streaming
+  // (source-backed) entries cannot be serialized this way.
+  *[SymbolIterator]() {
+    if (this.#source) {
+      throw new ERR_INVALID_STATE('a streaming entry cannot be serialized synchronously');
+    }
+    const meta = this.#finalizeMeta();
+    yield buildLocalHeader(meta);
+    if (this.#fd !== null) {
+      yield* this.#rawChunksSync();
+    } else if (this.#content?.length) {
+      yield this.#content;
+    }
+  }
+
+  // Asynchronous serialization. For a write-streaming entry, drain the
+  // source once, computing CRC-32 and sizes on the fly and emitting a Zip64
+  // data descriptor after the content (sec. 4.3.9); otherwise defer to the
+  // buffered/file-backed paths.
+  async *[SymbolAsyncIterator]() {
+    const source = this.#source;
+    if (!source) {
+      if (this.#fd !== null) {
+        yield buildLocalHeader(this.#finalizeMeta());
+        yield* this.#rawChunks();
+        return;
+      }
+      yield* this[SymbolIterator]();
+      return;
+    }
+    if (this.#serialized) {
+      throw new ERR_INVALID_STATE('a streaming entry can only be serialized once');
+    }
+    this.#serialized = true;
+    const meta = this.#meta;
+    yield buildLocalHeader(meta);
+    let state = 0;
+    let uncompressedSize = 0;
+    let compressedSize = 0;
+    const counted = (async function* () {
+      for await (const chunk of source) {
+        if (!isUint8Array(chunk)) {
+          throw new ERR_INVALID_ARG_TYPE('chunk', 'Uint8Array', chunk);
+        }
+        if (!chunk.length) continue;
+        state = crc32Native(chunk, state);
+        uncompressedSize += chunk.length;
+        yield chunk;
+      }
+    })();
+    const output = meta.method === METHOD_DEFLATE ? deflateRawStream(counted) :
+      meta.method === METHOD_ZSTD ? zstdCompressStream(counted) : counted;
+    for await (const chunk of output) {
+      compressedSize += chunk.length;
+      yield chunk;
+    }
+    meta.crc = state;
+    meta.uncompressedSize = uncompressedSize;
+    meta.compressedSize = compressedSize;
+    meta.pending = false;
+    yield buildDataDescriptor64(meta.crc, compressedSize, uncompressedSize);
+  }
+
+  // Release the entry's write-source, if it has one. Only a streaming entry
+  // (`createStream()`) owns a source - a caller-supplied `AsyncIterable`,
+  // often a file read stream holding a descriptor - and once that entry is
+  // handed to `createZipArchive()` the caller can no longer reach it, so the
+  // archive machinery disposes it when the archive finishes or its output
+  // stream is destroyed early (see `generateZipArchive()`); a caller holding
+  // an unused streaming entry can dispose it directly. In-memory and
+  // file-backed entries hold no source - a file-backed entry's descriptor
+  // belongs to the `ZipFile`, never to the entry - so disposing them is a
+  // no-op. Disposal is idempotent and marks the entry spent, so a disposed
+  // streaming entry can no longer be serialized.
+  #releaseSource() {
+    const source = this.#source;
+    this.#source = null;
+    this.#serialized = true;
+    return source;
+  }
+  [SymbolDispose]() {
+    const source = this.#releaseSource();
+    if (source === null) return;
+    if (typeof source.destroy === 'function') source.destroy();
+    else if (typeof source.return === 'function') source.return();
+  }
+  async [SymbolAsyncDispose]() {
+    const source = this.#releaseSource();
+    if (source === null) return;
+    if (typeof source[SymbolAsyncDispose] === 'function') await source[SymbolAsyncDispose]();
+    else if (typeof source.destroy === 'function') source.destroy();
+    else if (typeof source.return === 'function') await source.return();
+  }
+
+  /**
+   * Builds this entry's central-directory header (sec. 4.3.12) recording its
+   * local-header start; called by the archive writer once the offset is fixed.
+   *
+   * `preserveDescriptorFlag` is set by `ZipFile`'s in-place
+   * central-directory rewrite, which never regenerates local headers: when
+   * the on-disk local header advertises a data descriptor (bit 3, which
+   * `#finalizeMeta()` clears for full re-serialization), the rebuilt central
+   * header must keep advertising it too, or the two headers would contradict
+   * each other (sec. 4.3.12 expects them to agree). Full re-serialization
+   * emits a fresh, bit-3-free local header from the same meta, so there the
+   * cleared flag is the consistent one.
+   * @private
+   * @param {number} localOffset
+   * @param {boolean} [preserveDescriptorFlag]
+   * @returns {Buffer}
+   */
+  [kFinalize](localOffset, preserveDescriptorFlag = false) {
+    validateInteger(localOffset, 'localOffset', 0, NumberMAX_SAFE_INTEGER);
+    const meta = this.#finalizeMeta();
+    if (preserveDescriptorFlag && this.#central !== null &&
+        (this.#central.flags & FLAG_DATA_DESCRIPTOR) !== 0) {
+      return buildCentralHeader(
+        { ...meta, flags: meta.flags | FLAG_DATA_DESCRIPTOR }, localOffset);
+    }
+    return buildCentralHeader(meta, localOffset);
+  }
+
+  // Rebind a just-serialized write-streaming entry to its on-disk copy so it
+  // stops being dead weight: after `addEntry()`/`addEntrySync()` writes the
+  // entry into `fd` at `localOffset` (its local-header start), the spent
+  // source is dropped and the entry becomes a readable, re-serializable
+  // file-backed entry (valid while `fd` stays open). Only a spent stream
+  // entry - one with neither an in-memory buffer nor an existing backing fd -
+  // is promoted; in-memory and already-file-backed entries are left as they
+  // are. The kept `#meta` still supplies the (now-final) name/sizes/crc.
+  [kPromote](fd, localOffset) {
+    if (this.#content !== null || this.#fd !== null) return;
+    this.#fd = fd;
+    this.#localOffset = localOffset;
+    this.#contentOffset = -1;
+    this.#source = null;
+    this.#serialized = false;
+    // The descriptor flag has served its purpose: the sizes and CRC are
+    // known now, and the fd-backed serialization path emits plain headers
+    // and never writes a descriptor. Left set, a re-serialization would
+    // advertise (bit 3) a data descriptor that never follows - a corrupt
+    // archive for any reader that honors the flag.
+    this.#meta.flags &= ~FLAG_DATA_DESCRIPTOR;
+  }
+
+  /**
+   * Parses an in-memory archive, walking the central directory (sec. 4.3.12)
+   * and each referenced local header (sec. 4.3.7), and yields one read-only
+   * `ZipEntry` per member.
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} buffer
+   * @yields {ZipEntry}
+   */
+  static *read(buffer) {
+    const buf = toBuffer(buffer, 'buffer');
+    yield* readArchiveEntries(buf, findArchiveEnd(buf));
+  }
+
+  /**
+   * Builds a ready-to-serialize entry from in-memory `data`, compressing it
+   * with the chosen method (falling back to store when that does not shrink
+   * it) and recording the CRC-32 and sizes. When the entry ends up stored
+   * (explicitly or via the fallback) it retains `data`'s memory rather than
+   * copying it, and the CRC-32 is recorded now - mutating `data` afterwards
+   * would corrupt the entry on write.
+   * @param {string} filename
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} data
+   * @param {{
+   *   comment?: string,
+   *   mode?: number,
+   *   modified?: Date,
+   *   method?: 'deflate' | 'store' | 'zstd',
+   * }} [options]
+   * @returns {Promise<ZipEntry>}
+   */
+  // Shared head of create()/createSync(): validate, snapshot the CRC-32 and
+  // uncompressed size, and pick the compression method (store is forced for
+  // directories and empty content). The compression pass itself is the only
+  // thing the async/sync builders do differently.
+  static #prepareCreate(filename, data, options) {
+    const meta = createEntryMeta(filename, options);
+    const content = toBuffer(data, 'data');
+    const isDirectory = StringPrototypeEndsWith(filename, '/');
+    if (isDirectory && content.length) {
+      throw new ERR_INVALID_ARG_VALUE('data', data, 'must be empty for a directory entry');
+    }
+    meta.crc = crc32Native(content, 0);
+    meta.uncompressedSize = content.length;
+    const method =
+      isDirectory || content.length === 0 || options?.method === 'store' ? METHOD_STORE :
+        options?.method === 'zstd' ? METHOD_ZSTD : METHOD_DEFLATE;
+    return { meta, content, method };
+  }
+
+  // Shared tail of create()/createSync(): keep the compressed bytes only
+  // when the pass actually shrank the content (otherwise store the original,
+  // which also retains the caller's memory - see create()'s JSDoc), fill in
+  // the final sizes, and construct the entry. `compressed` is null when
+  // `method` is store.
+  static #finishCreate(meta, content, method, compressed) {
+    let finalContent = content;
+    if (compressed !== null && compressed.length < content.length) {
+      finalContent = compressed;
+    } else if (compressed !== null) {
+      method = METHOD_STORE; // Compression did not help; fall back to storing
+    }
+    meta.method = method;
+    meta.compressedSize = finalContent.length;
+    meta.pending = false;
+    const entry = new ZipEntry(null, null, finalContent);
+    entry.#meta = meta;
+    return entry;
+  }
+
+  static async create(filename, data, options) {
+    const { meta, content, method } = ZipEntry.#prepareCreate(filename, data, options);
+    const compressed =
+      method === METHOD_DEFLATE ? await deflateRawAsync(content) :
+        method === METHOD_ZSTD ? await zstdCompressAsync(content) : null;
+    return ZipEntry.#finishCreate(meta, content, method, compressed);
+  }
+
+  /**
+   * The synchronous counterpart of `create()`. Blocks the event loop and
+   * further JavaScript execution until done (including the deflate pass);
+   * see `contentSync()`. Retains `data`'s memory when storing, same as
+   * `create()`.
+   * @param {string} filename
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} data
+   * @param {{
+   *   comment?: string,
+   *   mode?: number,
+   *   modified?: Date,
+   *   method?: 'deflate' | 'store' | 'zstd',
+   * }} [options]
+   * @returns {ZipEntry}
+   */
+  static createSync(filename, data, options) {
+    const { meta, content, method } = ZipEntry.#prepareCreate(filename, data, options);
+    const compressed =
+      method === METHOD_DEFLATE ? deflateRawSync(content) :
+        method === METHOD_ZSTD ? zstdCompressSync(content) : null;
+    return ZipEntry.#finishCreate(meta, content, method, compressed);
+  }
+
+  /**
+   * Builds a write-streaming entry whose content is drained from `source`
+   * only at serialization time; its sizes/CRC are unknown until then, so it
+   * sets the data-descriptor flag (bit 3, sec. 4.3.9) and stays pending.
+   * @param {string} filename
+   * @param {AsyncIterable<Buffer>} source
+   * @param {{ comment?: string, mode?: number, modified?: Date, method?: 'deflate' | 'store' | 'zstd' }} [options]
+   * @returns {ZipEntry}
+   */
+  static createStream(filename, source, options) {
+    const meta = createEntryMeta(filename, options);
+    if (StringPrototypeEndsWith(filename, '/')) {
+      throw new ERR_INVALID_ARG_VALUE('filename', filename, 'a directory entry cannot be streamed');
+    }
+    meta.flags |= FLAG_DATA_DESCRIPTOR;
+    meta.method = options?.method === 'store' ? METHOD_STORE :
+      options?.method === 'zstd' ? METHOD_ZSTD : METHOD_DEFLATE;
+    meta.pending = true;
+    const entry = new ZipEntry(null, null, null);
+    entry.#meta = meta;
+    entry.#source = source;
+    return entry;
+  }
+
+  /**
+   * Creates a symbolic-link entry: a stored entry whose content is the link
+   * target and whose Unix mode type bits are `S_IFLNK`.
+   * @param {string} filename
+   * @param {string} target The link target path.
+   * @param {{ comment?: string, mode?: number, modified?: Date }} [options]
+   * @returns {ZipEntry}
+   */
+  static createSymlink(filename, target, options) {
+    validateString(target, 'target');
+    const meta = createEntryMeta(filename, {
+      __proto__: null,
+      comment: options?.comment,
+      mode: options?.mode,
+      modified: options?.modified,
+      symlink: true,
+    });
+    const content = Buffer.from(target, 'utf8');
+    meta.crc = crc32Native(content, 0);
+    meta.uncompressedSize = content.length;
+    meta.method = METHOD_STORE;
+    meta.compressedSize = content.length;
+    meta.pending = false;
+    const entry = new ZipEntry(null, null, content);
+    entry.#meta = meta;
+    return entry;
+  }
+}
+
+// Walk the central directory described by `end` (a findArchiveEnd() result
+// for `buf`), yielding one read-only ZipEntry per member. Split from
+// `ZipEntry.read()` so `ZipBuffer` - which also needs the archive-end record
+// for its comment - can locate the archive end once and share the result
+// instead of scanning for it twice. All records are parsed and their member
+// ranges cross-checked before the first entry is yielded: members must be
+// disjoint and precede the central directory, or one small file could quote
+// the same data region from N records - the "quoted overlap" zip-bomb shape
+// (CVE-2024-0450 in other implementations). Here the local headers have
+// been read, so the check uses each member's exact end (`ZipFile` applies
+// the same rule with a lower bound; see `validateMemberBounds()`).
+function* readArchiveEntries(buf, end) {
+  let pos = end.centralDirectoryOffset;
+  const cdEnd = end.centralDirectoryOffset + end.centralDirectorySize;
+  const parsed = [];
+  for (let index = 0; index < end.totalRecords; index++) {
+    const central = new CentralFileHeader(buf, pos);
+    if (pos + central.byteLength > cdEnd) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('central directory header is out of bounds');
+    }
+    if (central.diskNumber !== 0) {
+      throw new ERR_ZIP_UNSUPPORTED_FEATURE('multi-disk archives are not supported');
+    }
+    const localOffset = central.localFileHeaderOffset + end.prefix;
+    const local = new LocalFileHeader(buf, localOffset);
+    const dataStart = localOffset + local.byteLength;
+    const length = central.compressedSize;
+    validateArchiveRange(buf, dataStart, length, 'entry data');
+    const content = length ? buf.subarray(dataStart, dataStart + length) : EMPTY_BUFFER;
+    ArrayPrototypePush(parsed, {
+      entry: new ZipEntry(central, local, content),
+      start: localOffset,
+      dataEnd: dataStart + length,
+    });
+    pos = central.byteOffset + central.byteLength;
+  }
+  // Sort a separate range list; entries themselves are yielded in central
+  // directory order.
+  const ranges = ArrayPrototypeSort(ArrayPrototypeSlice(parsed), (a, b) => a.start - b.start);
+  for (let i = 0; i < ranges.length; i++) {
+    const bound = i + 1 < ranges.length ? ranges[i + 1].start : end.centralDirectoryOffset;
+    if (ranges[i].dataEnd > bound) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        `entry ${JSONStringify(ranges[i].entry.name)} overlaps the next ` +
+        'entry or the central directory (possible zip bomb)');
+    }
+  }
+  for (let i = 0; i < parsed.length; i++) yield parsed[i].entry;
+}
+
+module.exports = {
+  createEntryMeta,
+  readArchiveEntries,
+  ZipEntry,
+};
diff --git a/lib/internal/zip/extra-fields.js b/lib/internal/zip/extra-fields.js
new file mode 100644
index 000000000000..0816268411f1
--- /dev/null
+++ b/lib/internal/zip/extra-fields.js
@@ -0,0 +1,199 @@
+'use strict';
+
+// TLV extra-field parsing and building (sec. 4.5): the generic record walker,
+// the Zip64 extended-information field, modification-time extras
+// (NTFS/UT/UX), the round-trip-preserving strip of Zip64 records, and the
+// extended-timestamp builder used on the write path.
+
+const {
+  ArrayPrototypePush,
+  Date,
+  Number,
+} = primordials;
+
+const {
+  codes: {
+    ERR_ZIP_INVALID_ARCHIVE,
+  },
+} = require('internal/errors');
+const { Buffer } = require('buffer');
+const {
+  EMPTY_BUFFER,
+  ZIP64_EXTRA_ID,
+  EXTRA_ID_NTFS,
+  EXTRA_ID_EXT_TIMESTAMP,
+  EXTRA_ID_UNIX_OLD,
+} = require('internal/zip/constants');
+const { readSafeUint64 } = require('internal/zip/binary');
+
+// Zip64 extended information extra field (sec. 4.5.3). Walks the TLV records
+// itself, and unlike forEachExtraField() below it throws on a malformed
+// record: it only runs when a classic header field holds an overflow
+// sentinel, so the Zip64 record is required and a malformed extra field
+// hides required data.
+function parseZip64Extra(extra, want) {
+  const wanted =
+    want.uncompressedSize ||
+    want.compressedSize ||
+    want.localFileHeaderOffset ||
+    want.diskNumber;
+  if (!wanted) return {};
+  let pos = 0;
+  while (pos + 4 <= extra.length) {
+    const id = extra.readUInt16LE(pos);
+    const size = extra.readUInt16LE(pos + 2);
+    if (pos + 4 + size > extra.length) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('extra field is malformed');
+    }
+    if (id === ZIP64_EXTRA_ID) {
+      const result = {};
+      const body = pos + 4;
+      const end = body + size;
+      // APPNOTE 4.5.3: the field order is fixed - uncompressed size (8),
+      // compressed size (8), local header offset (8), disk number (4) - and
+      // each field MUST appear only when the corresponding classic field
+      // holds its overflow sentinel. When the record length matches exactly
+      // the fields the sentinels call for, parse them packed per spec.
+      // Real-world writers violate the "only" rule and emit fields for
+      // non-sentinel values too (commonly all four); such a record is longer
+      // than the wanted set, and is instead parsed positionally against the
+      // full layout - the fixed order makes both readings unambiguous.
+      const wantedSize =
+        (want.uncompressedSize ? 8 : 0) +
+        (want.compressedSize ? 8 : 0) +
+        (want.localFileHeaderOffset ? 8 : 0) +
+        (want.diskNumber ? 4 : 0);
+      const packed = size === wantedSize;
+      let cursor = body;
+      const take = (fullLayoutOffset, bytes) => {
+        const at = packed ? cursor : body + fullLayoutOffset;
+        if (at + bytes > end) {
+          throw new ERR_ZIP_INVALID_ARCHIVE(
+            'the Zip64 extended information extra field is truncated');
+        }
+        cursor += bytes;
+        return bytes === 8 ? readSafeUint64(extra, at) : extra.readUInt32LE(at);
+      };
+      if (want.uncompressedSize) result.uncompressedSize = take(0, 8);
+      if (want.compressedSize) result.compressedSize = take(8, 8);
+      if (want.localFileHeaderOffset) result.localFileHeaderOffset = take(16, 8);
+      if (want.diskNumber) result.diskNumber = take(24, 4);
+      return result;
+    }
+    pos += 4 + size;
+  }
+  throw new ERR_ZIP_INVALID_ARCHIVE(
+    'a field is 0xFFFFFFFF but the Zip64 extended information extra field is missing');
+}
+
+// Walk TLV extra-field records - id(2), size(2), body(size) - invoking `cb`
+// per record. Stops silently at the first malformed/overrunning record -
+// deliberately laxer than parseZip64Extra() above: this walker only feeds
+// advisory metadata (timestamps, Unicode names), and a malformed extra
+// should not make the archive unreadable.
+function forEachExtraField(extra, cb) {
+  let pos = 0;
+  while (pos + 4 <= extra.length) {
+    const id = extra.readUInt16LE(pos);
+    const size = extra.readUInt16LE(pos + 2);
+    if (pos + 4 + size > extra.length) break;
+    cb(id, extra.subarray(pos + 4, pos + 4 + size));
+    pos += 4 + size;
+  }
+}
+
+// The mtime from an NTFS extra field (id 0x000a, sec. 4.5.5): a reserved
+// dword then tagged sub-records; tag 1 carries the FILETIME mtime/atime/ctime.
+function parseNtfsMtime(body) {
+  let result = null;
+  let pos = 4; // Skip the reserved dword.
+  while (pos + 4 <= body.length) {
+    const tag = body.readUInt16LE(pos);
+    const size = body.readUInt16LE(pos + 2);
+    if (pos + 4 + size > body.length) break;
+    if (tag === 1 && size >= 8) {
+      // Windows FILETIME: 100 ns ticks since 1601-01-01 UTC.
+      const ticks = body.readBigUInt64LE(pos + 4);
+      result = new Date(Number(ticks / 10000n) - 11644473600000);
+    }
+    pos += 4 + size;
+  }
+  return result;
+}
+
+// The mtime from an Info-ZIP extended timestamp extra field ("UT", 0x5455;
+// listed in APPNOTE's third-party ID table sec. 4.6.1, format defined in
+// Info-ZIP's extrafld.txt).
+function parseExtTimestampMtime(body) {
+  // flags(1) then present times; bit 0 => mtime present (signed Unix seconds).
+  if (body.length < 5 || (body[0] & 1) === 0) return null;
+  return new Date(body.readInt32LE(1) * 1000);
+}
+
+// The mtime from an Info-ZIP original Unix extra field ("UX", id 0x5855).
+function parseUnixOldMtime(body) {
+  // atime(4), mtime(4) as signed Unix seconds (uid/gid follow only locally).
+  if (body.length < 8) return null;
+  return new Date(body.readInt32LE(4) * 1000);
+}
+
+// The highest-fidelity modification time carried in the given extra fields, or
+// null when none is present. NTFS (100 ns) beats the extended timestamp (1 s,
+// UTC) beats Info-ZIP Unix (1 s); all are absolute instants, unlike the coarse
+// local-time DOS date/time fields.
+function extraFieldMtime(...extras) {
+  let ntfs = null;
+  let ext = null;
+  let unix = null;
+  for (const extra of extras) {
+    if (!extra?.length) continue;
+    forEachExtraField(extra, (id, body) => {
+      if (id === EXTRA_ID_NTFS) ntfs ??= parseNtfsMtime(body);
+      else if (id === EXTRA_ID_EXT_TIMESTAMP) ext ??= parseExtTimestampMtime(body);
+      else if (id === EXTRA_ID_UNIX_OLD) unix ??= parseUnixOldMtime(body);
+    });
+  }
+  return ntfs ?? ext ?? unix;
+}
+
+// A copy of `extra` without any Zip64 record (id 0x0001): Zip64 data is
+// regenerated from the final sizes/offsets on serialization, but every other
+// record (Unicode Path, NTFS/UT timestamps, ...) must survive a round trip -
+// dropping them silently renames entries whose display name lives in the
+// Unicode Path extra and discards high-fidelity timestamps.
+function stripZip64Extra(extra) {
+  if (!extra.length) return EMPTY_BUFFER;
+  const parts = [];
+  let total = 0;
+  forEachExtraField(extra, (id, body) => {
+    if (id === ZIP64_EXTRA_ID) return;
+    const record = Buffer.allocUnsafe(4 + body.length);
+    record.writeUInt16LE(id, 0);
+    record.writeUInt16LE(body.length, 2);
+    body.copy(record, 4);
+    ArrayPrototypePush(parts, record);
+    total += record.length;
+  });
+  if (parts.length === 0) return EMPTY_BUFFER;
+  return Buffer.concat(parts, total);
+}
+
+// Info-ZIP extended timestamp extra field ("UT", 0x5455; see
+// parseExtTimestampMtime() above for the format's provenance): a flags byte
+// (bit 0 = modification time present) followed by the whole (UTC) second.
+function buildExtTimestampExtra(seconds) {
+  const buffer = Buffer.allocUnsafe(9);
+  buffer.writeUInt16LE(EXTRA_ID_EXT_TIMESTAMP, 0);
+  buffer.writeUInt16LE(5, 2);
+  buffer.writeUInt8(0x01, 4);
+  buffer.writeInt32LE(seconds, 5);
+  return buffer;
+}
+
+module.exports = {
+  parseZip64Extra,
+  forEachExtraField,
+  extraFieldMtime,
+  stripZip64Extra,
+  buildExtTimestampExtra,
+};
diff --git a/lib/internal/zip/file.js b/lib/internal/zip/file.js
new file mode 100644
index 000000000000..b43c091e8630
--- /dev/null
+++ b/lib/internal/zip/file.js
@@ -0,0 +1,780 @@
+'use strict';
+
+// `ZipFile`: random-access, in-place-writable view over an archive on disk
+// (a raw fd), plus `buildCentralDirectoryChunks()` which rebuilds the central
+// directory (and its Zip64/EOCD trailer) for the in-place rewrite path.
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeSort,
+  FunctionPrototypeCall,
+  JSONStringify,
+  Map,
+  MapPrototypeClear,
+  MapPrototypeDelete,
+  MapPrototypeEntries,
+  MapPrototypeGet,
+  MapPrototypeGetSize,
+  MapPrototypeHas,
+  MapPrototypeKeys,
+  MapPrototypeSet,
+  MathMin,
+  PromisePrototypeThen,
+  PromiseResolve,
+  SymbolAsyncDispose,
+  SymbolAsyncIterator,
+  SymbolDispose,
+  SymbolIterator,
+  SymbolToStringTag,
+} = primordials;
+
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
+    ERR_ZIP_ARCHIVE_TOO_LARGE,
+    ERR_ZIP_ENTRY_NOT_FOUND,
+    ERR_ZIP_INVALID_ARCHIVE,
+    ERR_ZIP_NOT_WRITABLE,
+  },
+} = require('internal/errors');
+const {
+  validateBoolean,
+  validateFunction,
+  validateString,
+} = require('internal/validators');
+const { Buffer, kMaxLength } = require('buffer');
+const { Readable } = require('stream');
+const fs = require('fs');
+const {
+  SIG_LOCAL_FILE_HEADER,
+  TAIL_LENGTH,
+  kFinalize,
+  kPromote,
+} = require('internal/zip/constants');
+const {
+  buildArchiveTrailer,
+} = require('internal/zip/header-builders');
+const {
+  CentralFileHeader,
+  LocalFileHeader,
+  findArchiveEnd,
+  readCentralDirectory,
+} = require('internal/zip/headers');
+const { decodeZipText } = require('internal/zip/dos');
+const {
+  fsOpenAsync,
+  fsCloseAsync,
+  fsFstatAsync,
+  fsFtruncateAsync,
+  readFdFully,
+  readFdFullySync,
+  writeFdFully,
+  writeFdFullySync,
+} = require('internal/zip/fs-util');
+const { ZipEntry } = require('internal/zip/entry');
+const {
+  createZipArchive,
+  createZipArchiveSync,
+} = require('internal/zip/archive');
+
+/**
+ * Builds a fresh central directory (sec. 4.3.12) plus its trailer (the Zip64
+ * end record/locator when needed and the end-of-central-directory record;
+ * see `buildArchiveTrailer()`) for `records`, an array of
+ * `{ entry, localOffset }` pairs already in their final order and at their
+ * final (possibly pre-existing, possibly freshly written) offsets.
+ * @param {Array<{ entry: ZipEntry, localOffset: number }>} records
+ * @param {number} centralDirectoryOffset
+ * @param {Buffer} comment
+ * @returns {{ centralHeaders: Buffer[], chunks: Buffer[] }}
+ */
+function buildCentralDirectoryChunks(records, centralDirectoryOffset, comment) {
+  const centralHeaders = [];
+  let centralDirectorySize = 0;
+  for (let i = 0; i < records.length; i++) {
+    // `true`: this rewrite leaves local headers on disk untouched, so an
+    // entry whose local header advertises a data descriptor (bit 3) must
+    // keep advertising it in the rebuilt central header; see [kFinalize].
+    const header = records[i].entry[kFinalize](records[i].localOffset, true);
+    ArrayPrototypePush(centralHeaders, header);
+    centralDirectorySize += header.length;
+  }
+  const count = records.length;
+  const chunks = [];
+  for (let i = 0; i < centralHeaders.length; i++) ArrayPrototypePush(chunks, centralHeaders[i]);
+  const trailer = buildArchiveTrailer(count, centralDirectorySize, centralDirectoryOffset, comment);
+  for (let i = 0; i < trailer.length; i++) ArrayPrototypePush(chunks, trailer[i]);
+  return { centralHeaders, chunks };
+}
+
+// Shared post-location validation for open()/openSync(): the archive tail
+// has been found; make sure the central directory it describes can actually
+// be buffered and lies inside the file.
+function checkArchiveEnd(end, size) {
+  if (end.centralDirectorySize > kMaxLength) {
+    throw new ERR_ZIP_ARCHIVE_TOO_LARGE('the central directory is too large to buffer');
+  }
+  if (end.centralDirectoryOffset + end.centralDirectorySize > size) {
+    throw new ERR_ZIP_INVALID_ARCHIVE('central directory is out of bounds');
+  }
+}
+
+// Given the fixed 30-byte local header read at `offset`, return where the
+// member's data ends. The data starts after the full local header (fixed +
+// file name + extra field), whose length lives only in the local header, not
+// the central directory - so the exact end can only be measured by reading it.
+// A malformed local header (bad signature) is not rejected here: fall back to
+// the 30-byte minimum so the archive stays openable (a read of that entry will
+// surface the error) while the member is still bounded by a safe lower bound.
+// Well-formed headers - the case an overlap attack must use to be readable -
+// are measured exactly, matching the read path and the in-memory reader.
+function localHeaderEnd(fixed, offset, compressedSize) {
+  if (fixed.readUInt32LE(0) !== SIG_LOCAL_FILE_HEADER) {
+    return offset + 30 + compressedSize;
+  }
+  return offset + LocalFileHeader.length(fixed, 0) + compressedSize;
+}
+
+// Reject any member whose actual compressed bytes cannot lie inside the file,
+// and any pair of members whose data ranges overlap each other or the central
+// directory. The buffered read paths (`ZipEntry.prototype.content()` and
+// friends) allocate `compressedSize` bytes before reading, so without the
+// bounds check a tiny file whose central directory lies about a member's size
+// could force an allocation of up to `kMaxLength` bytes. The overlap check
+// counters the "quoted overlap" zip-bomb shape (CVE-2024-0450 in other
+// implementations): N records quoting the same data region turn one small file
+// into N full-size extractions, while real archives lay members out
+// disjointly. The exact data range depends on the local header's length, which
+// is read here (one small read per member) so the check matches the read path
+// and the in-memory reader (`readArchiveEntries()`) rather than trusting a
+// looser lower bound.
+async function validateMemberBounds(fd, headers, prefix, size, centralDirectoryOffset) {
+  const members = [];
+  for (let i = 0; i < headers.length; i++) {
+    const header = headers[i];
+    const offset = header.localFileHeaderOffset + prefix;
+    const fixed = Buffer.allocUnsafe(30);
+    await readFdFully(fd, fixed, offset);
+    const dataEnd = localHeaderEnd(fixed, offset, header.compressedSize);
+    checkMemberRange(members, header.fileName, offset, dataEnd, size);
+  }
+  checkMemberOverlap(members, centralDirectoryOffset);
+}
+
+// Sync counterpart of validateMemberBounds().
+function validateMemberBoundsSync(fd, headers, prefix, size, centralDirectoryOffset) {
+  const members = [];
+  for (let i = 0; i < headers.length; i++) {
+    const header = headers[i];
+    const offset = header.localFileHeaderOffset + prefix;
+    const fixed = Buffer.allocUnsafe(30);
+    readFdFullySync(fd, fixed, offset);
+    const dataEnd = localHeaderEnd(fixed, offset, header.compressedSize);
+    checkMemberRange(members, header.fileName, offset, dataEnd, size);
+  }
+  checkMemberOverlap(members, centralDirectoryOffset);
+}
+
+// Record a member's [offset, dataEnd) range, rejecting one that runs past the
+// end of the file.
+function checkMemberRange(members, fileName, offset, dataEnd, size) {
+  if (dataEnd > size) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(
+      `entry ${JSONStringify(fileName)} data is out of bounds`);
+  }
+  ArrayPrototypePush(members, { fileName, offset, dataEnd });
+}
+
+// Sorted by local-header start, reject any member whose data runs into the
+// next member's local header or into the central directory.
+function checkMemberOverlap(members, centralDirectoryOffset) {
+  ArrayPrototypeSort(members, (a, b) => a.offset - b.offset);
+  for (let i = 0; i < members.length; i++) {
+    const bound = i + 1 < members.length ? members[i + 1].offset : centralDirectoryOffset;
+    if (members[i].dataEnd > bound) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        `entry ${JSONStringify(members[i].fileName)} overlaps the next ` +
+        'entry or the central directory (possible zip bomb)');
+    }
+  }
+}
+
+/**
+ * A random-access view over the entries of a ZIP archive on disk. Only the
+ * archive tail and central directory are read up front; individual member
+ * content is read lazily and on demand. Writable when opened with
+ * `{ writable: true }`: adding or deleting an entry rewrites the central
+ * directory in place, appending new entry content where the old central
+ * directory used to be.
+ *
+ * Every method has a `*Sync` counterpart. The synchronous methods block the
+ * Node.js event loop and further JavaScript execution until the operation
+ * completes - use them only where synchronous I/O is appropriate (for
+ * example, short-lived scripts or startup code), never in code that must
+ * stay responsive. A synchronous method throws `ERR_INVALID_STATE` if called
+ * while an asynchronous `addEntry()`/`add()`/`delete()`/`close()` on the same
+ * `ZipFile` has not settled yet, since letting the two interleave could
+ * corrupt the archive.
+ */
+class ZipFile {
+  // Shared descriptor handle ({ fd, closed }) handed to every ZipEntry this
+  // archive produces, so close() can invalidate them all at once. `#closing`
+  // is set synchronously the moment close()/closeSync() is called, gating any
+  // further public call; `handle.closed` is set once the fd is actually gone,
+  // gating reads through already-handed-out entries. Neither read ever falls
+  // through to a bare (possibly OS-reused) descriptor number.
+  #handle;
+  #closing = false;
+  #closePromise = null;
+  #writable;
+  #comment;
+  #centralDirectoryOffset;
+  #entries = new Map();
+  #queue = PromiseResolve();
+  #pendingAsyncOps = 0;
+
+  /**
+   * Builds the by-name entry map from the already-parsed central headers,
+   * recording each member's local-header offset (adjusted by any prefix).
+   * @private
+   */
+  constructor(fd, centralHeaders, prefix, centralDirectoryOffset, comment, writable) {
+    this.#handle = { fd, closed: false };
+    this.#writable = writable;
+    this.#comment = comment;
+    this.#centralDirectoryOffset = centralDirectoryOffset;
+    for (let i = 0; i < centralHeaders.length; i++) {
+      const central = centralHeaders[i];
+      MapPrototypeSet(this.#entries, central.fileName, {
+        central,
+        entry: undefined,
+        localOffset: central.localFileHeaderOffset + prefix,
+      });
+    }
+  }
+  get writable() { return this.#writable; }
+  // The EOCD comment has no encoding flag; apply the same UTF-8/CP437
+  // heuristic as unflagged member names and comments.
+  get comment() { return decodeZipText(this.#comment, 0); }
+  // Guard: throw unless this archive was opened writable.
+  #assertWritable() {
+    if (!this.#writable) throw new ERR_ZIP_NOT_WRITABLE();
+  }
+  // Guard: reject any operation once close() has been initiated, so a
+  // request never reaches a closed (or reused) descriptor. Set synchronously
+  // by close()/closeSync() so an add() issued after them cannot slip through.
+  #assertOpen() {
+    if (this.#closing) {
+      throw new ERR_INVALID_STATE('the ZipFile has been closed');
+    }
+  }
+  // Guard: reject a synchronous call while an async mutation is still in
+  // flight, since interleaving the two could corrupt the archive.
+  #assertNotBusy() {
+    if (this.#pendingAsyncOps > 0) {
+      throw new ERR_INVALID_STATE(
+        'cannot call a synchronous ZipFile method while an asynchronous ' +
+        'add(), addEntry(), delete(), or close() call has not settled yet');
+    }
+  }
+  // Serialize async mutations (add/delete/close) through a promise chain so
+  // they never overlap and corrupt the archive; the in-flight counter backs
+  // #assertNotBusy(). Failures do not break the chain (both arms continue it).
+  #enqueue(fn) {
+    this.#pendingAsyncOps++;
+    const run = async () => {
+      try {
+        return await fn();
+      } finally {
+        this.#pendingAsyncOps--;
+      }
+    };
+    const result = PromisePrototypeThen(this.#queue, run, run);
+    this.#queue = PromisePrototypeThen(result, () => undefined, () => undefined);
+    return result;
+  }
+  has(name) {
+    this.#assertOpen();
+    validateString(name, 'name');
+    return MapPrototypeHas(this.#entries, name);
+  }
+  // Return the lazy, file-backed ZipEntry handle for `info`, creating and
+  // caching it on first access. The handle stores only a descriptor and the
+  // local-header offset - never the member's content - so repeated `get()`s
+  // return the same lightweight object and no content buffer is retained by
+  // the ZipFile. Any read (`content()`, `contentIterator()`) goes to disk.
+  #handleFor(info) {
+    info.entry ??= new ZipEntry(info.central, null, null, this.#handle, info.localOffset);
+    return info.entry;
+  }
+  /**
+   * Returns a lazy, file-backed `ZipEntry` for `name`. Nothing is read from
+   * disk here and no content is buffered; the entry reads (and, for
+   * `content()`, decompresses) straight from the file on each access. The
+   * returned entry is valid only while this `ZipFile` is open.
+   * @param {string} name
+   * @returns {Promise<ZipEntry>}
+   */
+  async get(name) {
+    this.#assertOpen();
+    validateString(name, 'name');
+    const info = MapPrototypeGet(this.#entries, name);
+    if (info === undefined) throw new ERR_ZIP_ENTRY_NOT_FOUND(name);
+    return this.#handleFor(info);
+  }
+  /**
+   * The synchronous counterpart of `get()`. Like `get()`, it reads nothing
+   * up front and buffers no content - it only builds the lazy handle - so it
+   * does not itself block on I/O; see the class-level note on synchronous
+   * methods for reads performed later through the returned entry.
+   * @param {string} name
+   * @returns {ZipEntry}
+   */
+  getSync(name) {
+    this.#assertOpen();
+    this.#assertNotBusy();
+    validateString(name, 'name');
+    const info = MapPrototypeGet(this.#entries, name);
+    if (info === undefined) throw new ERR_ZIP_ENTRY_NOT_FOUND(name);
+    return this.#handleFor(info);
+  }
+  /**
+   * Streams a member's decoded content without buffering the whole member,
+   * as a `Readable` (verifying CRC-32 by default; `{ verify: false }` to opt
+   * out). Sugar for wrapping `get(name).contentIterator(options)`; the
+   * compressed bytes are read from disk as the stream is consumed.
+   * @param {string} name
+   * @param {{ verify?: boolean, maxSize?: number }} [options]
+   * @returns {Promise<import('stream').Readable>}
+   */
+  async stream(name, options) {
+    const entry = await this.get(name);
+    return Readable.from(entry.contentIterator(options), { objectMode: false });
+  }
+  /**
+   * Writes `entry`'s serialized bytes where the central directory currently
+   * starts, then rewrites the central directory to include it. Replaces any
+   * existing entry of the same name (its bytes become dead space, reclaimed
+   * by `compact()`).
+   * @param {ZipEntry} entry
+   * @returns {Promise<ZipEntry>}
+   */
+  async addEntry(entry) {
+    this.#assertWritable();
+    this.#assertOpen();
+    if (!(entry instanceof ZipEntry)) {
+      throw new ERR_INVALID_ARG_TYPE('entry', 'ZipEntry', entry);
+    }
+    return this.#enqueue(() => this.#doAdd(entry));
+  }
+  /**
+   * Builds an entry from in-memory `data` and appends it; see `addEntry()`.
+   * @param {string} filename
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} data
+   * @param {{ comment?: string, mode?: number, modified?: Date, method?: 'deflate' | 'store' | 'zstd' }} [options]
+   * @returns {Promise<ZipEntry>}
+   */
+  async add(filename, data, options) {
+    this.#assertWritable();
+    this.#assertOpen();
+    // Reserve the mutation synchronously (before the async ZipEntry.create()),
+    // so a close()/closeSync() issued right after cannot slip in front of it
+    // and tear down the descriptor this write depends on.
+    return this.#enqueue(async () =>
+      this.#doAdd(await ZipEntry.create(filename, data, options)));
+  }
+  // Append the entry's bytes where the central directory currently starts,
+  // then rewrite the directory to include it. On write failure, restore the
+  // original directory (the partial write may have clobbered it) and rethrow;
+  // on success, promote a spent stream entry to its on-disk copy.
+  async #doAdd(entry) {
+    const localOffset = this.#centralDirectoryOffset;
+    let written = 0;
+    try {
+      for await (const chunk of entry) {
+        await writeFdFully(this.#handle.fd, chunk, localOffset + written);
+        written += chunk.length;
+      }
+    } catch (err) {
+      // The failed entry's bytes start where the old central directory
+      // started, so part of it may already be overwritten - while the EOCD
+      // still points at it. Nothing has been adopted into memory yet, so
+      // rebuild and rewrite the directory (and EOCD) at its original offset
+      // to leave the archive exactly as it was before the call.
+      try {
+        await this.#rewriteCentralDirectory();
+      } catch {
+        // Restoring failed too (the device is likely full or gone); the
+        // original error is the actionable one.
+      }
+      throw err;
+    }
+    this.#centralDirectoryOffset = localOffset + written;
+    MapPrototypeSet(this.#entries, entry.name, { central: null, entry, localOffset });
+    await this.#rewriteCentralDirectory();
+    // The entry now has a stable home in this archive; if it was a spent
+    // streaming entry, rebind it to that on-disk copy so it stays readable.
+    entry[kPromote](this.#handle, localOffset);
+    return entry;
+  }
+  /**
+   * The synchronous counterpart of `addEntry()`. `entry` must not be a
+   * pending streaming entry (one created with `ZipEntry.createStream()`) -
+   * there is no synchronous way to drain its asynchronous source. Blocks the
+   * event loop until done; see the class-level note on synchronous methods.
+   * @param {ZipEntry} entry
+   * @returns {ZipEntry}
+   */
+  addEntrySync(entry) {
+    this.#assertWritable();
+    this.#assertOpen();
+    this.#assertNotBusy();
+    if (!(entry instanceof ZipEntry)) {
+      throw new ERR_INVALID_ARG_TYPE('entry', 'ZipEntry', entry);
+    }
+    const localOffset = this.#centralDirectoryOffset;
+    let written = 0;
+    try {
+      for (const chunk of entry) {
+        writeFdFullySync(this.#handle.fd, chunk, localOffset + written);
+        written += chunk.length;
+      }
+    } catch (err) {
+      // See #doAdd(): restore the (partially overwritten) central directory
+      // before surfacing the failure.
+      try {
+        this.#rewriteCentralDirectorySync();
+      } catch {
+        // Restoring failed too; the original error is the actionable one.
+      }
+      throw err;
+    }
+    this.#centralDirectoryOffset = localOffset + written;
+    MapPrototypeSet(this.#entries, entry.name, { central: null, entry, localOffset });
+    this.#rewriteCentralDirectorySync();
+    entry[kPromote](this.#handle, localOffset);
+    return entry;
+  }
+  /**
+   * The synchronous counterpart of `add()`. Blocks the event loop until
+   * done (including the deflate pass); see the class-level note on
+   * synchronous methods.
+   * @param {string} filename
+   * @param {Buffer | TypedArray | DataView | ArrayBuffer} data
+   * @param {{ comment?: string, mode?: number, modified?: Date, method?: 'deflate' | 'store' | 'zstd' }} [options]
+   * @returns {ZipEntry}
+   */
+  addSync(filename, data, options) {
+    this.#assertWritable();
+    return this.addEntrySync(ZipEntry.createSync(filename, data, options));
+  }
+  /**
+   * Removes an entry by name. The central directory is rewritten in place
+   * (no new content is written, so the archive does not grow); the removed
+   * entry's bytes become dead space, reclaimed by `compact()`.
+   * @param {string} name
+   * @returns {Promise<boolean>}
+   */
+  async delete(name) {
+    this.#assertWritable();
+    this.#assertOpen();
+    validateString(name, 'name');
+    return this.#enqueue(() => this.#doDelete(name));
+  }
+  // Drop the named entry and rewrite the central directory (no member bytes
+  // move, so the file does not grow); reports whether it existed.
+  async #doDelete(name) {
+    const existed = MapPrototypeDelete(this.#entries, name);
+    if (existed) await this.#rewriteCentralDirectory();
+    return existed;
+  }
+  /**
+   * The synchronous counterpart of `delete()`. Blocks the event loop until
+   * done; see the class-level note on synchronous methods.
+   * @param {string} name
+   * @returns {boolean}
+   */
+  deleteSync(name) {
+    this.#assertWritable();
+    this.#assertOpen();
+    this.#assertNotBusy();
+    validateString(name, 'name');
+    const existed = MapPrototypeDelete(this.#entries, name);
+    if (existed) this.#rewriteCentralDirectorySync();
+    return existed;
+  }
+  // Snapshot the live entries as ordered { entry, localOffset } records for a
+  // central-directory rebuild, materializing a plain ZipEntry for any member
+  // not yet handed out as a lazy handle.
+  #liveRecords() {
+    const records = [];
+    const names = [];
+    for (const { 0: name, 1: value } of MapPrototypeEntries(this.#entries)) {
+      ArrayPrototypePush(records, {
+        entry: value.entry ?? new ZipEntry(value.central, null, null),
+        localOffset: value.localOffset,
+      });
+      ArrayPrototypePush(names, name);
+    }
+    return { records, names };
+  }
+  // Rebuild the central directory and its trailer (sec. 4.3.12/4.3.16) for the
+  // current live set and overwrite it in place at its current offset,
+  // truncating any leftover tail, then adopt the freshly written headers.
+  async #rewriteCentralDirectory() {
+    const { records, names } = this.#liveRecords();
+    const { centralHeaders, chunks } = buildCentralDirectoryChunks(
+      records, this.#centralDirectoryOffset, this.#comment);
+    let pos = this.#centralDirectoryOffset;
+    for (let i = 0; i < chunks.length; i++) {
+      await writeFdFully(this.#handle.fd, chunks[i], pos);
+      pos += chunks[i].length;
+    }
+    await fsFtruncateAsync(this.#handle.fd, pos);
+    this.#adoptRewrittenCentralDirectory(names, centralHeaders, records);
+  }
+  // Sync counterpart of #rewriteCentralDirectory().
+  #rewriteCentralDirectorySync() {
+    const { records, names } = this.#liveRecords();
+    const { centralHeaders, chunks } = buildCentralDirectoryChunks(
+      records, this.#centralDirectoryOffset, this.#comment);
+    let pos = this.#centralDirectoryOffset;
+    for (let i = 0; i < chunks.length; i++) {
+      writeFdFullySync(this.#handle.fd, chunks[i], pos);
+      pos += chunks[i].length;
+    }
+    fs.ftruncateSync(this.#handle.fd, pos);
+    this.#adoptRewrittenCentralDirectory(names, centralHeaders, records);
+  }
+  // Re-derives fresh, disk-backed central headers from what was just
+  // written, so every entry - original or freshly added - is uniformly
+  // readable by offset from now on, regardless of whether its in-memory
+  // ZipEntry (e.g. a streaming entry, whose source can only be consumed
+  // once) is still around.
+  #adoptRewrittenCentralDirectory(names, centralHeaders, records) {
+    for (let i = 0; i < names.length; i++) {
+      MapPrototypeSet(this.#entries, names[i], {
+        central: new CentralFileHeader(centralHeaders[i], 0),
+        entry: undefined,
+        localOffset: records[i].localOffset,
+      });
+    }
+  }
+  /**
+   * Serializes the currently live entries into a fresh archive stream,
+   * leaving behind any dead space left by prior `addEntry()`/`delete()`
+   * calls. Does not modify the open file; pipe the result into a new one.
+   * @param {string} [comment]
+   * @returns {import('stream').Readable}
+   */
+  compact(comment) {
+    this.#assertOpen();
+    // Snapshot the live set now: a later addEntry()/delete() must not error
+    // out (or change) an archive stream that is already being produced.
+    // Reading the snapshot stays valid regardless of later mutations -
+    // neither addEntry() nor delete() moves existing member bytes.
+    const entries = [];
+    for (const { 1: info } of MapPrototypeEntries(this.#entries)) {
+      ArrayPrototypePush(entries, this.#handleFor(info));
+    }
+    return createZipArchive(entries, { comment: comment ?? this.#comment });
+  }
+  /**
+   * The synchronous counterpart of `compact()`. Blocks the event loop until
+   * the whole archive has been read and re-serialized; see the class-level
+   * note on synchronous methods.
+   * @param {string} [comment]
+   * @returns {Buffer}
+   */
+  compactSync(comment) {
+    this.#assertOpen();
+    this.#assertNotBusy();
+    const entries = [];
+    for (const { 1: info } of MapPrototypeEntries(this.#entries)) {
+      ArrayPrototypePush(entries, this.#handleFor(info));
+    }
+    const chunks = [];
+    for (const chunk of createZipArchiveSync(entries, { comment: comment ?? this.#comment })) {
+      ArrayPrototypePush(chunks, chunk);
+    }
+    return Buffer.concat(chunks);
+  }
+  keys() { this.#assertOpen(); return MapPrototypeKeys(this.#entries); }
+  *values() {
+    for (const name of this.keys()) yield this.get(name);
+  }
+  /**
+   * The synchronous counterpart of `values()`, yielding resolved `ZipEntry`
+   * values instead of `Promise`s.
+   * @yields {ZipEntry}
+   */
+  *valuesSync() {
+    for (const name of this.keys()) yield this.getSync(name);
+  }
+  *entries() {
+    for (const name of this.keys()) yield [name, this.get(name)];
+  }
+  /**
+   * The synchronous counterpart of `entries()`, yielding resolved `ZipEntry`
+   * values instead of `Promise`s.
+   * @yields {[string, ZipEntry]}
+   */
+  *entriesSync() {
+    for (const name of this.keys()) yield [name, this.getSync(name)];
+  }
+  // Async iteration yields each resolved ZipEntry (awaiting the lazy handles).
+  async *[SymbolAsyncIterator]() {
+    for (const promise of this.values()) yield await promise;
+  }
+  get size() { this.#assertOpen(); return MapPrototypeGetSize(this.#entries); }
+  [SymbolIterator]() { return this.entries(); }
+  get [SymbolToStringTag]() { return 'ZipFile'; }
+  forEach(callback, thisArg) {
+    validateFunction(callback, 'callback');
+    for (const { 0: key, 1: value } of this.entries()) {
+      FunctionPrototypeCall(callback, thisArg === undefined ? this : thisArg, value, key, this);
+    }
+  }
+  /**
+   * The synchronous counterpart of `forEach()`, invoking `callback` with a
+   * resolved `ZipEntry` instead of a `Promise`.
+   * @param {Function} callback
+   * @param {*} [thisArg]
+   */
+  forEachSync(callback, thisArg) {
+    validateFunction(callback, 'callback');
+    for (const { 0: key, 1: value } of this.entriesSync()) {
+      FunctionPrototypeCall(callback, thisArg === undefined ? this : thisArg, value, key, this);
+    }
+  }
+  // Drop all entries and close the fd, queued behind any pending async ops.
+  // Idempotent: a second close() is a safe no-op, never a double-close of a
+  // (possibly reused) descriptor. `#closing` is set synchronously so any
+  // operation issued after this point is rejected rather than racing the fd.
+  close() {
+    if (this.#closing) return this.#closePromise ?? PromiseResolve();
+    this.#closing = true;
+    this.#closePromise = this.#enqueue(async () => {
+      this.#handle.closed = true;
+      MapPrototypeClear(this.#entries);
+      await fsCloseAsync(this.#handle.fd);
+    });
+    return this.#closePromise;
+  }
+  /**
+   * The synchronous counterpart of `close()`; see the class-level note on
+   * synchronous methods. Idempotent.
+   */
+  closeSync() {
+    if (this.#closing) return;
+    this.#assertNotBusy();
+    this.#closing = true;
+    this.#handle.closed = true;
+    MapPrototypeClear(this.#entries);
+    fs.closeSync(this.#handle.fd);
+  }
+  async [SymbolAsyncDispose]() {
+    await this.close();
+  }
+  [SymbolDispose]() {
+    this.closeSync();
+  }
+  /**
+   * Opens an archive, reading only its tail and central directory up front
+   * (member content stays on disk). Pass `{ writable: true }` for in-place
+   * editing.
+   * @param {string} filename
+   * @param {{ writable?: boolean }} [options]
+   * @returns {Promise<ZipFile>}
+   */
+  static async open(filename, options) {
+    validateString(filename, 'filename');
+    const writable = options?.writable ?? false;
+    validateBoolean(writable, 'options.writable');
+    const fd = await fsOpenAsync(filename, writable ? 'r+' : 'r');
+    try {
+      const stat = await fsFstatAsync(fd);
+      const size = stat.size;
+      const tailLength = MathMin(size, TAIL_LENGTH);
+      const tail = Buffer.allocUnsafe(tailLength);
+      await readFdFully(fd, tail, size - tailLength);
+      let end = findArchiveEnd(tail, size - tailLength);
+      if (end.needTailFrom !== undefined) {
+        // The Zip64 EOCD record's extensible data sector pushes the record
+        // start beyond the fixed-size tail; re-read from the recorded
+        // offset (bounded by ZIP64_EOCD_MAX_LENGTH inside findArchiveEnd).
+        const retry = Buffer.allocUnsafe(size - end.needTailFrom);
+        await readFdFully(fd, retry, end.needTailFrom);
+        end = findArchiveEnd(retry, end.needTailFrom);
+        if (end.needTailFrom !== undefined) {
+          throw new ERR_ZIP_INVALID_ARCHIVE(
+            'Zip64 end of central directory record not found');
+        }
+      }
+      checkArchiveEnd(end, size);
+      const directory = Buffer.allocUnsafe(end.centralDirectorySize);
+      await readFdFully(fd, directory, end.centralDirectoryOffset);
+      const headers = readCentralDirectory(directory, end.totalRecords);
+      await validateMemberBounds(fd, headers, end.prefix, size, end.centralDirectoryOffset);
+      return new ZipFile(fd, headers, end.prefix, end.centralDirectoryOffset, end.comment, writable);
+    } catch (err) {
+      try {
+        await fsCloseAsync(fd);
+      } catch {
+        // The archive failed to parse; the close error is not actionable.
+      }
+      throw err;
+    }
+  }
+  /**
+   * The synchronous counterpart of `open()`. Blocks the event loop and
+   * further JavaScript execution until the archive's tail and central
+   * directory have been read; see the class-level note on synchronous
+   * methods.
+   * @param {string} filename
+   * @param {{ writable?: boolean }} [options]
+   * @returns {ZipFile}
+   */
+  static openSync(filename, options) {
+    validateString(filename, 'filename');
+    const writable = options?.writable ?? false;
+    validateBoolean(writable, 'options.writable');
+    const fd = fs.openSync(filename, writable ? 'r+' : 'r');
+    try {
+      const size = fs.fstatSync(fd).size;
+      const tailLength = MathMin(size, TAIL_LENGTH);
+      const tail = Buffer.allocUnsafe(tailLength);
+      readFdFullySync(fd, tail, size - tailLength);
+      let end = findArchiveEnd(tail, size - tailLength);
+      if (end.needTailFrom !== undefined) {
+        // See open(): the Zip64 EOCD record starts before the fixed-size
+        // tail; re-read from the recorded offset.
+        const retry = Buffer.allocUnsafe(size - end.needTailFrom);
+        readFdFullySync(fd, retry, end.needTailFrom);
+        end = findArchiveEnd(retry, end.needTailFrom);
+        if (end.needTailFrom !== undefined) {
+          throw new ERR_ZIP_INVALID_ARCHIVE(
+            'Zip64 end of central directory record not found');
+        }
+      }
+      checkArchiveEnd(end, size);
+      const directory = Buffer.allocUnsafe(end.centralDirectorySize);
+      readFdFullySync(fd, directory, end.centralDirectoryOffset);
+      const headers = readCentralDirectory(directory, end.totalRecords);
+      validateMemberBoundsSync(fd, headers, end.prefix, size, end.centralDirectoryOffset);
+      return new ZipFile(fd, headers, end.prefix, end.centralDirectoryOffset, end.comment, writable);
+    } catch (err) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        // The archive failed to parse; the close error is not actionable.
+      }
+      throw err;
+    }
+  }
+}
+
+module.exports = {
+  ZipFile,
+};
diff --git a/lib/internal/zip/fs-util.js b/lib/internal/zip/fs-util.js
new file mode 100644
index 000000000000..cfd20069d007
--- /dev/null
+++ b/lib/internal/zip/fs-util.js
@@ -0,0 +1,150 @@
+'use strict';
+
+// Promise wrappers over the callback `fs` primitives (`ZipFile` works on a
+// raw fd so one instance can serve both async and `Sync` methods), plus the
+// short-read/short-write loops that guarantee a full transfer.
+
+const {
+  Promise,
+} = primordials;
+
+const {
+  codes: {
+    ERR_INVALID_STATE,
+    ERR_ZIP_INVALID_ARCHIVE,
+  },
+} = require('internal/errors');
+const fs = require('fs');
+
+// Promisified adapters over the callback `fs` primitives; individually trivial,
+// they only exist so the async archive paths can `await` plain fd operations.
+//
+// `ZipFile` operates on a plain numeric file descriptor (rather than an
+// `fs.promises` `FileHandle`) so that a single instance can support both the
+// async and the `Sync` methods: `fs.read`/`fs.write`/`fs.fstat`/
+// `fs.ftruncate`/`fs.close` all accept a raw fd directly, same as their
+// `*Sync` counterparts, so both call sites share one open file underneath.
+function fsOpenAsync(path, flag) {
+  return new Promise((resolve, reject) => {
+    fs.open(path, flag, (err, fd) => (err ? reject(err) : resolve(fd)));
+  });
+}
+
+function fsStatAsync(path) {
+  return new Promise((resolve, reject) => {
+    fs.stat(path, (err, stats) => (err ? reject(err) : resolve(stats)));
+  });
+}
+
+function fsLstatAsync(path) {
+  return new Promise((resolve, reject) => {
+    fs.lstat(path, (err, stats) => (err ? reject(err) : resolve(stats)));
+  });
+}
+
+function fsReadlinkAsync(path) {
+  return new Promise((resolve, reject) => {
+    fs.readlink(path, 'utf8', (err, target) => (err ? reject(err) : resolve(target)));
+  });
+}
+
+function fsCloseAsync(fd) {
+  return new Promise((resolve, reject) => {
+    fs.close(fd, (err) => (err ? reject(err) : resolve()));
+  });
+}
+
+function fsFstatAsync(fd) {
+  return new Promise((resolve, reject) => {
+    fs.fstat(fd, (err, stats) => (err ? reject(err) : resolve(stats)));
+  });
+}
+
+function fsReadAsync(fd, buffer, offset, length, position) {
+  return new Promise((resolve, reject) => {
+    fs.read(fd, buffer, offset, length, position, (err, bytesRead) => (err ? reject(err) : resolve(bytesRead)));
+  });
+}
+
+function fsWriteAsync(fd, buffer, offset, length, position) {
+  return new Promise((resolve, reject) => {
+    fs.write(fd, buffer, offset, length, position, (err, bytesWritten) => (err ? reject(err) : resolve(bytesWritten)));
+  });
+}
+
+function fsFtruncateAsync(fd, len) {
+  return new Promise((resolve, reject) => {
+    fs.ftruncate(fd, len, (err) => (err ? reject(err) : resolve()));
+  });
+}
+
+// `read(2)` may return fewer bytes than requested without hitting EOF, so loop
+// until `buffer` is entirely filled; a genuine short read (0 bytes) means the
+// archive is truncated where a full header/record was expected.
+async function readFdFully(fd, buffer, position) {
+  let done = 0;
+  while (done < buffer.length) {
+    const bytesRead = await fsReadAsync(fd, buffer, done, buffer.length - done, position + done);
+    if (bytesRead <= 0) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('unexpected end of file');
+    }
+    done += bytesRead;
+  }
+}
+
+// Synchronous counterpart of `readFdFully()`; same short-read loop.
+function readFdFullySync(fd, buffer, position) {
+  let done = 0;
+  while (done < buffer.length) {
+    const bytesRead = fs.readSync(fd, buffer, done, buffer.length - done, position + done);
+    if (bytesRead <= 0) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('unexpected end of file');
+    }
+    done += bytesRead;
+  }
+}
+
+// `write(2)` may write fewer bytes than asked - most notably when an error
+// (ENOSPC, EIO, a full NFS commit) strikes after partial progress, which
+// surfaces as a short, error-free count. Advancing archive offsets by the
+// intended length would then silently corrupt the file, so every archive
+// write loops until the buffer is fully on disk; retrying the remainder
+// re-encounters and surfaces the underlying error.
+async function writeFdFully(fd, buffer, position) {
+  let done = 0;
+  while (done < buffer.length) {
+    const bytesWritten =
+      await fsWriteAsync(fd, buffer, done, buffer.length - done, position + done);
+    if (bytesWritten <= 0) {
+      throw new ERR_INVALID_STATE('a write to the archive made no progress');
+    }
+    done += bytesWritten;
+  }
+}
+
+// Synchronous counterpart of `writeFdFully()`; same short-write loop.
+function writeFdFullySync(fd, buffer, position) {
+  let done = 0;
+  while (done < buffer.length) {
+    const bytesWritten =
+      fs.writeSync(fd, buffer, done, buffer.length - done, position + done);
+    if (bytesWritten <= 0) {
+      throw new ERR_INVALID_STATE('a write to the archive made no progress');
+    }
+    done += bytesWritten;
+  }
+}
+
+module.exports = {
+  fsOpenAsync,
+  fsStatAsync,
+  fsLstatAsync,
+  fsReadlinkAsync,
+  fsCloseAsync,
+  fsFstatAsync,
+  fsFtruncateAsync,
+  readFdFully,
+  readFdFullySync,
+  writeFdFully,
+  writeFdFullySync,
+};
diff --git a/lib/internal/zip/header-builders.js b/lib/internal/zip/header-builders.js
new file mode 100644
index 000000000000..4b48fbc53180
--- /dev/null
+++ b/lib/internal/zip/header-builders.js
@@ -0,0 +1,251 @@
+'use strict';
+
+// Write-path header builders: local/central file headers, the Zip64 data
+// descriptor, and the (Zip64) end-of-central-directory records, plus the
+// version-needed and extra-length helpers they share.
+
+const {
+  ArrayPrototypePush,
+  MathMax,
+  MathMin,
+} = primordials;
+
+const {
+  codes: {
+    ERR_ZIP_ENTRY_TOO_LARGE,
+  },
+} = require('internal/errors');
+const { Buffer } = require('buffer');
+const {
+  EMPTY_BUFFER,
+  SIG_LOCAL_FILE_HEADER,
+  SIG_DATA_DESCRIPTOR,
+  SIG_CENTRAL_FILE_HEADER,
+  SIG_ZIP64_EOCD_RECORD,
+  SIG_ZIP64_EOCD_LOCATOR,
+  SIG_EOCD,
+  MADE_BY_UNIX,
+  ZIP64_EXTRA_ID,
+  SENTINEL16,
+  SENTINEL32,
+  FLAG_DATA_DESCRIPTOR,
+  METHOD_ZSTD,
+  VERSION_DEFAULT,
+  VERSION_ZIP64,
+  VERSION_ZSTD,
+} = require('internal/zip/constants');
+const { encodeDosDateTime } = require('internal/zip/dos');
+const { writeSafeUint64 } = require('internal/zip/binary');
+const { buildExtTimestampExtra } = require('internal/zip/extra-fields');
+
+// The "version needed to extract" (sec. 4.4.3): the highest version any
+// feature of the member demands - 6.3 for Zstandard, 4.5 for Zip64
+// structures, 2.0 otherwise.
+function versionNeeded(meta, zip64) {
+  return MathMax(
+    zip64 ? VERSION_ZIP64 : VERSION_DEFAULT,
+    meta.method === METHOD_ZSTD ? VERSION_ZSTD : 0);
+}
+
+// Guard the combined extra-field length against the 16-bit field it is stored
+// in (sec. 4.4.11).
+function checkExtraLength(extraLength) {
+  if (extraLength > SENTINEL16) {
+    throw new ERR_ZIP_ENTRY_TOO_LARGE(
+      'the entry extra fields must not exceed 65535 bytes');
+  }
+}
+
+// Build a local file header (sec. 4.3.7). Streamed entries (unknown sizes/CRC)
+// zero those fields and always carry a Zip64 extra so the trailing data
+// descriptor can hold 64-bit sizes; oversized non-streamed entries get one too.
+function buildLocalHeader(meta) {
+  const streaming = (meta.flags & FLAG_DATA_DESCRIPTOR) !== 0;
+  const zip64 =
+    streaming ||
+    meta.compressedSize >= SENTINEL32 ||
+    meta.uncompressedSize >= SENTINEL32;
+  const ts = meta.extendedMtime !== null ? buildExtTimestampExtra(meta.extendedMtime) : EMPTY_BUFFER;
+  const extraLength = (zip64 ? 20 : 0) + ts.length + meta.extra.length;
+  checkExtraLength(extraLength);
+  const buffer = Buffer.allocUnsafe(30 + meta.name.length + extraLength);
+  buffer.writeUInt32LE(SIG_LOCAL_FILE_HEADER, 0);
+  buffer.writeUInt16LE(versionNeeded(meta, zip64), 4);
+  buffer.writeUInt16LE(meta.flags, 6);
+  buffer.writeUInt16LE(meta.method, 8);
+  const { time, date } = encodeDosDateTime(meta.modified);
+  buffer.writeUInt16LE(time, 10);
+  buffer.writeUInt16LE(date, 12);
+  buffer.writeUInt32LE(streaming ? 0 : meta.crc, 14);
+  buffer.writeUInt32LE(zip64 ? SENTINEL32 : meta.compressedSize, 18);
+  buffer.writeUInt32LE(zip64 ? SENTINEL32 : meta.uncompressedSize, 22);
+  buffer.writeUInt16LE(meta.name.length, 26);
+  buffer.writeUInt16LE(extraLength, 28);
+  meta.name.copy(buffer, 30);
+  let pos = 30 + meta.name.length;
+  if (zip64) {
+    buffer.writeUInt16LE(ZIP64_EXTRA_ID, pos);
+    buffer.writeUInt16LE(16, pos + 2);
+    writeSafeUint64(buffer, pos + 4, streaming ? 0 : meta.uncompressedSize);
+    writeSafeUint64(buffer, pos + 12, streaming ? 0 : meta.compressedSize);
+    pos += 20;
+  }
+  ts.copy(buffer, pos);
+  pos += ts.length;
+  meta.extra.copy(buffer, pos);
+  return buffer;
+}
+
+// Build a central directory file header (sec. 4.3.12). Each of the
+// uncompressed size, compressed size, and local-header offset that overflows
+// 32 bits is moved into the Zip64 extra field (sec. 4.5.3) in that order.
+function buildCentralHeader(meta, localOffset) {
+  const zip64Streaming = (meta.flags & FLAG_DATA_DESCRIPTOR) !== 0;
+  const u64 = meta.uncompressedSize >= SENTINEL32;
+  const c64 = meta.compressedSize >= SENTINEL32;
+  const o64 = localOffset >= SENTINEL32;
+  const zip64Fields = (u64 ? 1 : 0) + (c64 ? 1 : 0) + (o64 ? 1 : 0);
+  const ts = meta.extendedMtime !== null ? buildExtTimestampExtra(meta.extendedMtime) : EMPTY_BUFFER;
+  const extraLength = (zip64Fields ? 4 + 8 * zip64Fields : 0) + ts.length + meta.extra.length;
+  checkExtraLength(extraLength);
+  const zip64 = zip64Streaming || zip64Fields > 0;
+  const version = versionNeeded(meta, zip64);
+  const buffer = Buffer.allocUnsafe(
+    46 + meta.name.length + extraLength + meta.comment.length);
+  buffer.writeUInt32LE(SIG_CENTRAL_FILE_HEADER, 0);
+  // "Version made by" (sec. 4.4.2): the upper byte is the creator's host
+  // system, which determines how the external attributes (sec. 4.4.15) are
+  // interpreted. Preserve the original host for round-tripped entries -
+  // stamping everything as Unix would turn, say, a DOS entry's zeroed high
+  // bits into Unix mode 0000. Entries built by `createEntryMeta()` are Unix.
+  buffer.writeUInt16LE((meta.madeBy << 8) | version, 4);
+  buffer.writeUInt16LE(version, 6);
+  buffer.writeUInt16LE(meta.flags, 8);
+  buffer.writeUInt16LE(meta.method, 10);
+  const { time, date } = encodeDosDateTime(meta.modified);
+  buffer.writeUInt16LE(time, 12);
+  buffer.writeUInt16LE(date, 14);
+  buffer.writeUInt32LE(meta.crc, 16);
+  buffer.writeUInt32LE(c64 ? SENTINEL32 : meta.compressedSize, 20);
+  buffer.writeUInt32LE(u64 ? SENTINEL32 : meta.uncompressedSize, 24);
+  buffer.writeUInt16LE(meta.name.length, 28);
+  buffer.writeUInt16LE(extraLength, 30);
+  buffer.writeUInt16LE(meta.comment.length, 32);
+  buffer.writeUInt16LE(0, 34); // disk number
+  buffer.writeUInt16LE(meta.internal, 36);
+  buffer.writeUInt32LE(meta.external, 38);
+  buffer.writeUInt32LE(o64 ? SENTINEL32 : localOffset, 42);
+  meta.name.copy(buffer, 46);
+  let pos = 46 + meta.name.length;
+  if (zip64Fields) {
+    buffer.writeUInt16LE(ZIP64_EXTRA_ID, pos);
+    buffer.writeUInt16LE(8 * zip64Fields, pos + 2);
+    pos += 4;
+    if (u64) {
+      writeSafeUint64(buffer, pos, meta.uncompressedSize);
+      pos += 8;
+    }
+    if (c64) {
+      writeSafeUint64(buffer, pos, meta.compressedSize);
+      pos += 8;
+    }
+    if (o64) {
+      writeSafeUint64(buffer, pos, localOffset);
+      pos += 8;
+    }
+  }
+  ts.copy(buffer, pos);
+  pos += ts.length;
+  meta.extra.copy(buffer, pos);
+  pos += meta.extra.length;
+  meta.comment.copy(buffer, pos);
+  return buffer;
+}
+
+// Zip64 data descriptor (sec. 4.3.9): emitted after a streamed entry, whose
+// local header always carries a Zip64 extra field.
+function buildDataDescriptor64(crc, compressedSize, uncompressedSize) {
+  const buffer = Buffer.allocUnsafe(24);
+  buffer.writeUInt32LE(SIG_DATA_DESCRIPTOR, 0);
+  buffer.writeUInt32LE(crc, 4);
+  writeSafeUint64(buffer, 8, compressedSize);
+  writeSafeUint64(buffer, 16, uncompressedSize);
+  return buffer;
+}
+
+// Build the end of central directory record (sec. 4.3.16); fields that
+// overflow their 16/32-bit slots are written as sentinels and the true values
+// live in the Zip64 EOCD record.
+function buildEndOfCentralDirectory(count, size, offset, comment) {
+  const buffer = Buffer.allocUnsafe(22 + comment.length);
+  buffer.writeUInt32LE(SIG_EOCD, 0);
+  buffer.writeUInt16LE(0, 4); // disk number
+  buffer.writeUInt16LE(0, 6); // Central directory disk number
+  buffer.writeUInt16LE(MathMin(count, SENTINEL16), 8);
+  buffer.writeUInt16LE(MathMin(count, SENTINEL16), 10);
+  buffer.writeUInt32LE(MathMin(size, SENTINEL32), 12);
+  buffer.writeUInt32LE(MathMin(offset, SENTINEL32), 16);
+  buffer.writeUInt16LE(comment.length, 20);
+  comment.copy(buffer, 22);
+  return buffer;
+}
+
+// Build the Zip64 end of central directory record (sec. 4.3.14): the 64-bit
+// counterpart to the EOCD, holding the real record count/size/offset.
+function buildZip64EndRecord(count, size, offset) {
+  const buffer = Buffer.allocUnsafe(56);
+  buffer.writeUInt32LE(SIG_ZIP64_EOCD_RECORD, 0);
+  writeSafeUint64(buffer, 4, 44); // Size of the remainder of this record
+  buffer.writeUInt16LE((MADE_BY_UNIX << 8) | VERSION_ZIP64, 12);
+  buffer.writeUInt16LE(VERSION_ZIP64, 14);
+  buffer.writeUInt32LE(0, 16); // disk number
+  buffer.writeUInt32LE(0, 20); // Central directory disk number
+  writeSafeUint64(buffer, 24, count);
+  writeSafeUint64(buffer, 32, count);
+  writeSafeUint64(buffer, 40, size);
+  writeSafeUint64(buffer, 48, offset);
+  return buffer;
+}
+
+// Build the Zip64 end of central directory locator (sec. 4.3.15): points the
+// reader from just before the EOCD to the Zip64 EOCD record.
+function buildZip64EndLocator(recordOffset) {
+  const buffer = Buffer.allocUnsafe(20);
+  buffer.writeUInt32LE(SIG_ZIP64_EOCD_LOCATOR, 0);
+  buffer.writeUInt32LE(0, 4); // Disk with the Zip64 EOCD record
+  writeSafeUint64(buffer, 8, recordOffset);
+  buffer.writeUInt32LE(1, 16); // total disks
+  return buffer;
+}
+
+// The archive trailer: the Zip64 EOCD record and locator
+// (sec. 4.3.14/4.3.15) when the record count, central directory offset, or
+// central directory size overflows its classic 16-/32-bit field, followed
+// by the end of central directory record (sec. 4.3.16). Shared by the
+// streaming serializers and ZipFile's in-place rewrite so the Zip64
+// switchover rule lives in exactly one place.
+function buildArchiveTrailer(count, centralDirectorySize, centralDirectoryOffset, comment) {
+  const chunks = [];
+  const zip64 =
+    count >= SENTINEL16 ||
+    centralDirectoryOffset >= SENTINEL32 ||
+    centralDirectorySize >= SENTINEL32;
+  if (zip64) {
+    const recordOffset = centralDirectoryOffset + centralDirectorySize;
+    ArrayPrototypePush(chunks, buildZip64EndRecord(count, centralDirectorySize, centralDirectoryOffset));
+    ArrayPrototypePush(chunks, buildZip64EndLocator(recordOffset));
+  }
+  ArrayPrototypePush(chunks,
+                     buildEndOfCentralDirectory(count, centralDirectorySize, centralDirectoryOffset, comment));
+  return chunks;
+}
+
+module.exports = {
+  buildLocalHeader,
+  buildCentralHeader,
+  buildDataDescriptor64,
+  buildEndOfCentralDirectory,
+  buildZip64EndRecord,
+  buildZip64EndLocator,
+  buildArchiveTrailer,
+};
diff --git a/lib/internal/zip/headers.js b/lib/internal/zip/headers.js
new file mode 100644
index 000000000000..aadfa1ca3cde
--- /dev/null
+++ b/lib/internal/zip/headers.js
@@ -0,0 +1,511 @@
+'use strict';
+
+// Reader-side header structures (sec. 4.3): the end-of-central-directory
+// record, the Zip64 EOCD record/locator, and the central/local file headers,
+// plus `findArchiveEnd()` which locates them and `readCentralDirectory()`
+// which walks the central directory into an array of headers.
+
+const {
+  ArrayPrototypePush,
+  MathMax,
+  Number,
+} = primordials;
+
+const {
+  codes: {
+    ERR_ZIP_INVALID_ARCHIVE,
+    ERR_ZIP_UNSUPPORTED_FEATURE,
+  },
+} = require('internal/errors');
+const {
+  BIGINT_MAX_SAFE_INTEGER,
+  SIG_LOCAL_FILE_HEADER,
+  SIG_CENTRAL_FILE_HEADER,
+  SIG_ZIP64_EOCD_RECORD,
+  SIG_ZIP64_EOCD_LOCATOR,
+  SIG_EOCD,
+  MADE_BY_UNIX,
+  SENTINEL16,
+  SENTINEL32,
+  ZIP64_EOCD_MAX_LENGTH,
+  S_IFLNK,
+  S_IFMT,
+} = require('internal/zip/constants');
+const {
+  validateArchiveRange,
+  readSafeUint64,
+} = require('internal/zip/binary');
+const { parseZip64Extra } = require('internal/zip/extra-fields');
+const {
+  decodeDosDateTime,
+  decodeZipName,
+  decodeZipText,
+} = require('internal/zip/dos');
+
+// End of central directory record (sec. 4.3.16).
+// Offset   Bytes   Description
+// 0        4       Signature = 0x06054b50
+// 4        2       Number of this disk
+// 6        2       Disk where central directory starts
+// 8        2       Number of central directory records on this disk
+// 10       2       Total number of central directory records
+// 12       4       Size of central directory (bytes)
+// 16       4       Offset of start of central directory
+// 20       2       Comment length (n)
+// 22       n       Comment
+class CentralEndHeader {
+  #buffer;
+  #offset;
+  constructor(buffer, offset = 0) {
+    validateArchiveRange(buffer, offset, 22, 'end of central directory record');
+    if (buffer.readUInt32LE(offset) !== SIG_EOCD) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('end of central directory signature is invalid');
+    }
+    this.#buffer = buffer;
+    this.#offset = offset;
+    if (offset + this.byteLength > buffer.length) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('end of central directory record is truncated');
+    }
+  }
+  get byteLength() { return 22 + this.commentLength; }
+  get diskNumber() { return this.#buffer.readUInt16LE(this.#offset + 4); }
+  get centralDirectoryDiskNumber() { return this.#buffer.readUInt16LE(this.#offset + 6); }
+  get centralDirectoryDiskRecords() { return this.#buffer.readUInt16LE(this.#offset + 8); }
+  get centralDirectoryTotalRecords() { return this.#buffer.readUInt16LE(this.#offset + 10); }
+  get centralDirectorySize() { return this.#buffer.readUInt32LE(this.#offset + 12); }
+  get centralDirectoryOffset() { return this.#buffer.readUInt32LE(this.#offset + 16); }
+  get commentLength() { return this.#buffer.readUInt16LE(this.#offset + 20); }
+  get commentBuffer() {
+    const start = this.#offset + 22;
+    return this.#buffer.subarray(start, start + this.commentLength);
+  }
+}
+
+// Zip64 end of central directory record (sec. 4.3.14).
+// 0    4   Signature = 0x06064b50
+// 4    8   Size of remainder of this record
+// 12   2   Version made by
+// 14   2   Version needed to extract
+// 16   4   Number of this disk
+// 20   4   Disk where central directory starts
+// 24   8   Number of central directory records on this disk
+// 32   8   Total number of central directory records
+// 40   8   Size of central directory
+// 48   8   Offset of start of central directory
+class Zip64EndRecord {
+  #buffer;
+  #offset;
+  constructor(buffer, offset = 0) {
+    validateArchiveRange(buffer, offset, 56, 'Zip64 end of central directory record');
+    if (buffer.readUInt32LE(offset) !== SIG_ZIP64_EOCD_RECORD) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        'Zip64 end of central directory signature is invalid');
+    }
+    this.#buffer = buffer;
+    this.#offset = offset;
+  }
+  get diskNumber() { return this.#buffer.readUInt32LE(this.#offset + 16); }
+  get centralDirectoryDiskNumber() { return this.#buffer.readUInt32LE(this.#offset + 20); }
+  get centralDirectoryDiskRecords() { return readSafeUint64(this.#buffer, this.#offset + 24); }
+  get centralDirectoryTotalRecords() { return readSafeUint64(this.#buffer, this.#offset + 32); }
+  get centralDirectorySize() { return readSafeUint64(this.#buffer, this.#offset + 40); }
+  get centralDirectoryOffset() { return readSafeUint64(this.#buffer, this.#offset + 48); }
+}
+
+// Zip64 end of central directory locator (sec. 4.3.15).
+// 0    4   Signature = 0x07064b50
+// 4    4   Disk with the Zip64 end of central directory record
+// 8    8   Offset of the Zip64 end of central directory record
+// 16   4   Total number of disks
+class Zip64EndLocator {
+  #buffer;
+  #offset;
+  constructor(buffer, offset = 0) {
+    validateArchiveRange(buffer, offset, 20, 'Zip64 end of central directory locator');
+    if (buffer.readUInt32LE(offset) !== SIG_ZIP64_EOCD_LOCATOR) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        'Zip64 end of central directory locator signature is invalid');
+    }
+    this.#buffer = buffer;
+    this.#offset = offset;
+  }
+  get recordDiskNumber() { return this.#buffer.readUInt32LE(this.#offset + 4); }
+  // Spec field (sec. 4.3.15); not consumed as a getter - findArchiveEnd()
+  // reads the offset leniently via readBigUInt64LE instead, so a locator
+  // signature that is really comment data cannot turn into a hard parse
+  // error on an out-of-range value.
+  // get recordOffset() { return readSafeUint64(this.#buffer, this.#offset + 8); }
+  get totalDisks() { return this.#buffer.readUInt32LE(this.#offset + 16); }
+}
+
+// Central directory file header (sec. 4.3.12).
+// 0    4   Signature = 0x02014b50
+// 4    2   Version made by
+// 6    2   Version needed to extract
+// 8    2   General purpose bit flag
+// 10   2   Compression method
+// 12   2   Last modification time
+// 14   2   Last modification date
+// 16   4   CRC-32
+// 20   4   Compressed size
+// 24   4   Uncompressed size
+// 28   2   File name length (n)
+// 30   2   Extra field length (m)
+// 32   2   File comment length (k)
+// 34   2   Disk number where file starts
+// 36   2   Internal file attributes
+// 38   4   External file attributes
+// 42   4   Relative offset of local file header
+// 46   n   File name
+// 46+n m   Extra field
+// 46+n+m k File comment
+class CentralFileHeader {
+  #buffer;
+  #offset;
+  #zip64 = null;
+  constructor(buffer, offset = 0) {
+    validateArchiveRange(buffer, offset, 46, 'central directory header');
+    if (buffer.readUInt32LE(offset) !== SIG_CENTRAL_FILE_HEADER) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('central directory header signature is invalid');
+    }
+    this.#buffer = buffer;
+    this.#offset = offset;
+    if (offset + this.byteLength > buffer.length) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('central directory header is truncated');
+    }
+  }
+  get byteOffset() { return this.#offset; }
+  get byteLength() {
+    return 46 + this.fileNameLength + this.extraFieldLength + this.fileCommentLength;
+  }
+  get version() { return this.#buffer.readUInt16LE(this.#offset + 4); }
+  // Spec field "version needed to extract" (sec. 4.4.3); not consumed today.
+  // get versionNeeded() { return this.#buffer.readUInt16LE(this.#offset + 6); }
+  get flags() { return this.#buffer.readUInt16LE(this.#offset + 8); }
+  get compressionMethod() { return this.#buffer.readUInt16LE(this.#offset + 10); }
+  get lastModified() {
+    return decodeDosDateTime(
+      this.#buffer.readUInt16LE(this.#offset + 12),
+      this.#buffer.readUInt16LE(this.#offset + 14));
+  }
+  get crc32() { return this.#buffer.readUInt32LE(this.#offset + 16); }
+  // Lazily parse the Zip64 extended-information extra field (sec. 4.5.3),
+  // supplying the true 64-bit values only for the classic fields that hold an
+  // overflow sentinel. Cached across getters.
+  #resolveZip64() {
+    if (this.#zip64 === null) {
+      this.#zip64 = parseZip64Extra(this.extraField, {
+        uncompressedSize: this.#buffer.readUInt32LE(this.#offset + 24) === SENTINEL32,
+        compressedSize: this.#buffer.readUInt32LE(this.#offset + 20) === SENTINEL32,
+        localFileHeaderOffset: this.#buffer.readUInt32LE(this.#offset + 42) === SENTINEL32,
+        diskNumber: this.#buffer.readUInt16LE(this.#offset + 34) === SENTINEL16,
+      });
+    }
+    return this.#zip64;
+  }
+  get compressedSize() {
+    const value = this.#buffer.readUInt32LE(this.#offset + 20);
+    return value === SENTINEL32 ? this.#resolveZip64().compressedSize : value;
+  }
+  get uncompressedSize() {
+    const value = this.#buffer.readUInt32LE(this.#offset + 24);
+    return value === SENTINEL32 ? this.#resolveZip64().uncompressedSize : value;
+  }
+  get fileNameLength() { return this.#buffer.readUInt16LE(this.#offset + 28); }
+  get extraFieldLength() { return this.#buffer.readUInt16LE(this.#offset + 30); }
+  get fileCommentLength() { return this.#buffer.readUInt16LE(this.#offset + 32); }
+  get diskNumber() {
+    const value = this.#buffer.readUInt16LE(this.#offset + 34);
+    return value === SENTINEL16 ? this.#resolveZip64().diskNumber : value;
+  }
+  get internalFileAttributes() { return this.#buffer.readUInt16LE(this.#offset + 36); }
+  get externalFileAttributes() { return this.#buffer.readUInt32LE(this.#offset + 38); }
+  get localFileHeaderOffset() {
+    const value = this.#buffer.readUInt32LE(this.#offset + 42);
+    return value === SENTINEL32 ? this.#resolveZip64().localFileHeaderOffset : value;
+  }
+  get fileNameBuffer() {
+    const start = this.#offset + 46;
+    return this.#buffer.subarray(start, start + this.fileNameLength);
+  }
+  get fileName() { return decodeZipName(this.fileNameBuffer, this.flags, this.extraField); }
+  get extraField() {
+    const start = this.#offset + 46 + this.fileNameLength;
+    return this.#buffer.subarray(start, start + this.extraFieldLength);
+  }
+  get fileCommentBuffer() {
+    const start = this.#offset + 46 + this.fileNameLength + this.extraFieldLength;
+    return this.#buffer.subarray(start, start + this.fileCommentLength);
+  }
+  get fileComment() { return decodeZipText(this.fileCommentBuffer, this.flags); }
+  get isUnixMode() { return (this.version >>> 8) === MADE_BY_UNIX; }
+  get mode() {
+    // Low 12 bits: permissions plus setuid/setgid/sticky (sec. 4.4.15).
+    return this.isUnixMode ? (this.externalFileAttributes >>> 16) & 0o7777 : 0;
+  }
+  get isSymlink() {
+    return this.isUnixMode &&
+      ((this.externalFileAttributes >>> 16) & S_IFMT) === S_IFLNK;
+  }
+}
+
+// Local file header (sec. 4.3.7).
+// 0    4   Signature = 0x04034b50
+// 4    2   Version needed to extract
+// 6    2   General purpose bit flag
+// 8    2   Compression method
+// 10   2   Last modification time
+// 12   2   Last modification date
+// 14   4   CRC-32
+// 18   4   Compressed size
+// 22   4   Uncompressed size
+// 26   2   File name length (n)
+// 28   2   Extra field length (m)
+// 30   n   File name
+// 30+n m   Extra field
+class LocalFileHeader {
+  #buffer;
+  #offset;
+  constructor(buffer, offset = 0) {
+    validateArchiveRange(buffer, offset, 30, 'local file header');
+    if (buffer.readUInt32LE(offset) !== SIG_LOCAL_FILE_HEADER) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('local file header signature is invalid');
+    }
+    this.#buffer = buffer;
+    this.#offset = offset;
+    if (offset + this.byteLength > buffer.length) {
+      throw new ERR_ZIP_INVALID_ARCHIVE('local file header is truncated');
+    }
+  }
+  get byteLength() { return 30 + this.fileNameLength + this.extraFieldLength; }
+  get flags() { return this.#buffer.readUInt16LE(this.#offset + 6); }
+  // Spec field (sec. 4.4.5); the central directory's method is authoritative,
+  // so the local copy is not consumed today.
+  // get compressionMethod() { return this.#buffer.readUInt16LE(this.#offset + 8); }
+  get fileNameLength() { return this.#buffer.readUInt16LE(this.#offset + 26); }
+  get extraFieldLength() { return this.#buffer.readUInt16LE(this.#offset + 28); }
+  get extraField() {
+    const start = this.#offset + 30 + this.fileNameLength;
+    return this.#buffer.subarray(start, start + this.extraFieldLength);
+  }
+  // The local header also carries the name and modification time (sec. 4.3.7),
+  // but the central directory is authoritative for both - a mismatching local
+  // name is ignored by design - so only the flags and the extra field (which
+  // may hold a higher-resolution timestamp) are consumed here.
+  // get fileName() {
+  //   const start = this.#offset + 30;
+  //   return decodeZipName(
+  //     this.#buffer.subarray(start, start + this.fileNameLength), this.flags, this.extraField);
+  // }
+  // get lastModified() {
+  //   return decodeDosDateTime(this.#buffer.readUInt16LE(this.#offset + 10),
+  //                            this.#buffer.readUInt16LE(this.#offset + 12));
+  // }
+  // Total on-disk length of the local header at `offset` (sec. 4.3.7), read
+  // straight from the length fields without constructing a header; 0 if the
+  // fixed part does not fit. Lets the reader skip to the entry data.
+  static length(buffer, offset) {
+    if (offset + 30 > buffer.length) return 0;
+    return 30 + buffer.readUInt16LE(offset + 26) + buffer.readUInt16LE(offset + 28);
+  }
+}
+
+/**
+ * Locates and validates the end-of-archive structures (EOCD, and the Zip64
+ * EOCD locator/record when present) in `buffer`. `base` is the absolute
+ * offset of `buffer[0]` when `buffer` is only the tail of a larger file; all
+ * returned offsets are absolute. `buffer` must extend to the end of the
+ * archive.
+ *
+ * When a required Zip64 EOCD record starts before `buffer[0]` (its
+ * extensible data sector can push it beyond any fixed-size tail read),
+ * returns `{ needTailFrom }` instead: the caller must retry with a buffer
+ * that starts at that absolute offset (still ending at the end of the
+ * archive). Never returned when `base` is 0.
+ * @returns {{
+ *   prefix: number,
+ *   totalRecords: number,
+ *   centralDirectoryOffset: number,
+ *   centralDirectorySize: number,
+ *   comment: Buffer,
+ * } | { needTailFrom: number }}
+ */
+function findArchiveEnd(buffer, base = 0) {
+  if (buffer.length < 22) {
+    throw new ERR_ZIP_INVALID_ARCHIVE('no end of central directory record found');
+  }
+  const min = MathMax(0, buffer.length - (22 + SENTINEL16));
+  let eocdPos = -1;
+  // Pass 1: the comment must reach exactly to the end of the buffer (this
+  // rejects a stray EOCD-looking signature inside an earlier comment).
+  for (let pos = buffer.length - 22; pos >= min; pos--) {
+    if (buffer.readUInt32LE(pos) !== SIG_EOCD) continue;
+    if (pos + 22 + buffer.readUInt16LE(pos + 20) !== buffer.length) continue;
+    eocdPos = pos;
+    break;
+  }
+  if (eocdPos < 0) {
+    // Pass 2: tolerate trailing padding after the EOCD (some streaming
+    // writers pad their output to a fixed block size); take the last
+    // candidate found.
+    for (let pos = buffer.length - 22; pos >= min; pos--) {
+      if (buffer.readUInt32LE(pos) !== SIG_EOCD) continue;
+      if (pos + 22 + buffer.readUInt16LE(pos + 20) > buffer.length) continue;
+      eocdPos = pos;
+      break;
+    }
+  }
+  if (eocdPos < 0) {
+    throw new ERR_ZIP_INVALID_ARCHIVE('no end of central directory record found');
+  }
+  const eocd = new CentralEndHeader(buffer, eocdPos);
+  let totalRecords = eocd.centralDirectoryTotalRecords;
+  let centralDirectorySize = eocd.centralDirectorySize;
+  let centralDirectoryOffset = eocd.centralDirectoryOffset;
+  let prefix;
+  // A classic field at its maximum is an overflow sentinel that makes the
+  // Zip64 record mandatory. Otherwise the classic fields are authoritative,
+  // and a Zip64 locator signature in the preceding bytes is not proof of a
+  // Zip64 archive - it may be the tail of a file comment that happens to
+  // contain those four bytes - so a failed Zip64 lookup falls back to the
+  // classic fields instead of rejecting the archive.
+  const needsZip64 =
+    eocd.diskNumber === SENTINEL16 ||
+    eocd.centralDirectoryDiskNumber === SENTINEL16 ||
+    eocd.centralDirectoryDiskRecords === SENTINEL16 ||
+    totalRecords === SENTINEL16 ||
+    centralDirectorySize === SENTINEL32 ||
+    centralDirectoryOffset === SENTINEL32;
+  let zip64 = null;
+  let recordPos = -1;
+  const locatorPos = eocdPos - 20;
+  if (
+    locatorPos >= 0 &&
+    buffer.readUInt32LE(locatorPos) === SIG_ZIP64_EOCD_LOCATOR
+  ) {
+    const locator = new Zip64EndLocator(buffer, locatorPos);
+    // Read the recorded offset leniently: on a coincidental signature these
+    // eight bytes are arbitrary comment data, which must not turn into a
+    // hard parse error.
+    const rawRecordOffset = buffer.readBigUInt64LE(locatorPos + 8);
+    const recordOffset =
+      rawRecordOffset <= BIGINT_MAX_SAFE_INTEGER ? Number(rawRecordOffset) : -1;
+    recordPos = recordOffset >= 0 ? recordOffset - base : -1;
+    if (
+      !(recordPos >= 0 &&
+        recordPos + 56 <= locatorPos &&
+        buffer.readUInt32LE(recordPos) === SIG_ZIP64_EOCD_RECORD)
+    ) {
+      // Data was prepended to the archive, shifting the record; scan
+      // backward from the locator instead of trusting its recorded offset.
+      recordPos = -1;
+      const floor = MathMax(0, locatorPos - 56 - SENTINEL16);
+      for (let pos = locatorPos - 56; pos >= floor; pos--) {
+        if (buffer.readUInt32LE(pos) !== SIG_ZIP64_EOCD_RECORD) continue;
+        const size = buffer.readBigUInt64LE(pos + 4);
+        if (size >= 44n && pos + 12 + Number(size) === locatorPos) {
+          recordPos = pos;
+          break;
+        }
+      }
+    }
+    if (recordPos < 0 && needsZip64) {
+      // The record is required but does not lie inside `buffer`: its
+      // extensible data sector may extend it beyond any fixed-size tail
+      // read. When the locator points (plausibly) before the bytes at
+      // hand, ask the caller for a longer tail instead of failing.
+      if (
+        recordOffset >= 0 &&
+        recordOffset < base &&
+        base + locatorPos - recordOffset <= ZIP64_EOCD_MAX_LENGTH
+      ) {
+        return { needTailFrom: recordOffset };
+      }
+      throw new ERR_ZIP_INVALID_ARCHIVE('Zip64 end of central directory record not found');
+    }
+    if (recordPos >= 0) {
+      if (locator.totalDisks > 1 || locator.recordDiskNumber !== 0) {
+        throw new ERR_ZIP_UNSUPPORTED_FEATURE('multi-disk archives are not supported');
+      }
+      zip64 = new Zip64EndRecord(buffer, recordPos);
+    }
+  }
+  // The `prefix` math assumes nothing sits between the central directory and
+  // the archive-end records. APPNOTE sec. 4.3.13 allows a digital-signature
+  // record there; such an archive shifts `prefix` by the signature's length
+  // and fails with a central-directory signature error rather than a targeted
+  // message - signed archives are essentially extinct, so none is emitted.
+  if (zip64 !== null) {
+    if (zip64.diskNumber !== 0 || zip64.centralDirectoryDiskNumber !== 0) {
+      throw new ERR_ZIP_UNSUPPORTED_FEATURE('multi-disk archives are not supported');
+    }
+    if (zip64.centralDirectoryDiskRecords !== zip64.centralDirectoryTotalRecords) {
+      throw new ERR_ZIP_UNSUPPORTED_FEATURE('multi-disk archives are not supported');
+    }
+    // A classic field either holds the overflow sentinel (its real value lives
+    // in the Zip64 record) or its own real value, which must then match the
+    // Zip64 record. A non-sentinel classic field that disagrees with Zip64 is a
+    // parser differential - a classic-only reader and this one would see
+    // different archives - so reject it rather than silently preferring Zip64.
+    if (
+      (totalRecords !== SENTINEL16 &&
+       totalRecords !== zip64.centralDirectoryTotalRecords) ||
+      (centralDirectorySize !== SENTINEL32 &&
+       centralDirectorySize !== zip64.centralDirectorySize) ||
+      (centralDirectoryOffset !== SENTINEL32 &&
+       centralDirectoryOffset !== zip64.centralDirectoryOffset)
+    ) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        'Zip64 and classic end-of-central-directory records disagree');
+    }
+    totalRecords = zip64.centralDirectoryTotalRecords;
+    centralDirectorySize = zip64.centralDirectorySize;
+    centralDirectoryOffset = zip64.centralDirectoryOffset;
+    prefix = base + recordPos - (centralDirectoryOffset + centralDirectorySize);
+  } else {
+    if (eocd.diskNumber !== 0 || eocd.centralDirectoryDiskNumber !== 0) {
+      throw new ERR_ZIP_UNSUPPORTED_FEATURE('multi-disk archives are not supported');
+    }
+    if (eocd.centralDirectoryDiskRecords !== totalRecords) {
+      throw new ERR_ZIP_UNSUPPORTED_FEATURE('multi-disk archives are not supported');
+    }
+    prefix = base + eocdPos - (centralDirectoryOffset + centralDirectorySize);
+  }
+  if (prefix < 0) {
+    throw new ERR_ZIP_INVALID_ARCHIVE('central directory does not fit inside the archive');
+  }
+  if (totalRecords * 46 > centralDirectorySize) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(
+      'central directory record count is inconsistent with its size');
+  }
+  return {
+    prefix,
+    totalRecords,
+    centralDirectoryOffset: centralDirectoryOffset + prefix,
+    centralDirectorySize,
+    comment: eocd.commentBuffer,
+  };
+}
+
+// Walk the contiguous run of `count` central directory file headers
+// (sec. 4.3.12) into an array, rejecting multi-disk archives.
+function readCentralDirectory(buffer, count) {
+  const result = [];
+  let pos = 0;
+  for (let index = 0; index < count; index++) {
+    const header = new CentralFileHeader(buffer, pos);
+    if (header.diskNumber !== 0) {
+      throw new ERR_ZIP_UNSUPPORTED_FEATURE('multi-disk archives are not supported');
+    }
+    ArrayPrototypePush(result, header);
+    pos += header.byteLength;
+  }
+  return result;
+}
+
+module.exports = {
+  CentralFileHeader,
+  LocalFileHeader,
+  findArchiveEnd,
+  readCentralDirectory,
+};
diff --git a/lib/zlib.js b/lib/zlib.js
index e6c5c420d551..29c61b51fc6f 100644
--- a/lib/zlib.js
+++ b/lib/zlib.js
@@ -31,7 +31,9 @@ const {
   ObjectFreeze,
   ObjectKeys,
   ObjectSetPrototypeOf,
+  ReflectApply,
   Symbol,
+  SymbolHasInstance,
   Uint32Array,
   Uint8Array,
 } = primordials;
@@ -51,6 +53,7 @@ const { Transform, finished } = require('stream');
 const {
   assignFunctionName,
   deprecateInstantiation,
+  emitExperimentalWarning,
 } = require('internal/util');
 const {
   isArrayBufferView,
@@ -73,6 +76,16 @@ const {
   validateFiniteNumber,
 } = require('internal/validators');
 const { FastBuffer } = require('internal/buffer');
+const {
+  ZipEntry,
+  ZipFile,
+  ZipBuffer,
+  createZipArchive,
+  createZipArchiveSync,
+  zipFiles,
+  getMaxZipContentSize,
+  setMaxZipContentSize,
+} = require('internal/zip');
 
 const kFlushFlag = Symbol('kFlushFlag');
 const kError = Symbol('kError');
@@ -995,6 +1008,62 @@ function createProperty(ctor) {
   };
 }
 
+// ZIP archive support is experimental. The warning fires when the API is
+// *used*, not when node:zlib is imported: the ESM facade reads every export to
+// build its bindings (see BuiltinModule.syncExports), so warning on property
+// access would fire on a bare `import 'node:zlib'`. Each public class is a thin
+// subclass whose factory methods (and, for ZipBuffer, its constructor) warn;
+// each function is a warn-on-call wrapper. A `[Symbol.hasInstance]` override
+// keeps `instanceof` matching instances produced by the internal (unwrapped)
+// implementation. The rest of node:zlib is stable and never warns.
+function emitZipExperimentalWarning() {
+  emitExperimentalWarning('The zlib ZIP archive API');
+}
+
+function experimentalZipFunction(fn, thisArg) {
+  return function(...args) {
+    emitZipExperimentalWarning();
+    return ReflectApply(fn, thisArg, args);
+  };
+}
+
+function experimentalZipProperty(value) {
+  return { __proto__: null, configurable: true, enumerable: true, value };
+}
+
+// Thin subclasses that gate *use* of the experimental ZIP API behind the
+// warning while leaving `instanceof` (and the public class name) intact.
+class ExperimentalZipEntry extends ZipEntry {
+  static [SymbolHasInstance](instance) { return instance instanceof ZipEntry; }
+}
+
+class ExperimentalZipFile extends ZipFile {
+  static [SymbolHasInstance](instance) { return instance instanceof ZipFile; }
+}
+
+class ExperimentalZipBuffer extends ZipBuffer {
+  static [SymbolHasInstance](instance) { return instance instanceof ZipBuffer; }
+  constructor(buffer) { emitZipExperimentalWarning(); super(buffer); }
+}
+
+// Shadow each public factory with a warn-on-call wrapper, and restore the
+// public class name that subclassing changed.
+for (const { 0: Wrapper, 1: Raw, 2: factories } of [
+  [ExperimentalZipEntry, ZipEntry, ['read', 'create', 'createSync', 'createStream', 'createSymlink']],
+  [ExperimentalZipFile, ZipFile, ['open', 'openSync']],
+  [ExperimentalZipBuffer, ZipBuffer, []],
+]) {
+  for (const name of factories) {
+    ObjectDefineProperty(Wrapper, name, {
+      __proto__: null,
+      configurable: true,
+      writable: true,
+      value: experimentalZipFunction(Raw[name], Raw),
+    });
+  }
+  ObjectDefineProperty(Wrapper, 'name', { __proto__: null, value: Raw.name });
+}
+
 function crc32(data, value = 0) {
   if (typeof data !== 'string' && !isArrayBufferView(data)) {
     throw new ERR_INVALID_ARG_TYPE('data', ['Buffer', 'TypedArray', 'DataView', 'string'], data);
@@ -1077,6 +1146,16 @@ ObjectDefineProperties(module.exports, {
     writable: false,
     value: ObjectFreeze(codes),
   },
+
+  // ZIP archive support (experimental).
+  ZipEntry: experimentalZipProperty(ExperimentalZipEntry),
+  ZipFile: experimentalZipProperty(ExperimentalZipFile),
+  ZipBuffer: experimentalZipProperty(ExperimentalZipBuffer),
+  createZipArchive: experimentalZipProperty(experimentalZipFunction(createZipArchive)),
+  createZipArchiveSync: experimentalZipProperty(experimentalZipFunction(createZipArchiveSync)),
+  zipFiles: experimentalZipProperty(experimentalZipFunction(zipFiles)),
+  getMaxZipContentSize: experimentalZipProperty(experimentalZipFunction(getMaxZipContentSize)),
+  setMaxZipContentSize: experimentalZipProperty(experimentalZipFunction(setMaxZipContentSize)),
 });
 
 // These should be considered deprecated
diff --git a/test/parallel/test-zlib-zip-coverage.js b/test/parallel/test-zlib-zip-coverage.js
new file mode 100644
index 000000000000..437630df95cd
--- /dev/null
+++ b/test/parallel/test-zlib-zip-coverage.js
@@ -0,0 +1,1318 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const tmpdir = require('../common/tmpdir');
+const fs = require('node:fs/promises');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+// Additional zip.js coverage beyond the other test-zlib-zip-*.js files:
+// DOS date/time edge cases, the Zip64 extra-field parser's normal and
+// out-of-range paths, the "data was prepended to the archive" central
+// directory recovery scan, buffer-coercion variants, entry-metadata
+// validation, streaming-entry state guards, the ZipBuffer/ZipFile
+// iteration protocols, and several ZipFile (on-disk) error paths that
+// aren't reachable through ZipBuffer alone.
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+async function drain(iterable) {
+  const chunks = [];
+  for await (const chunk of iterable) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+// -- DOS date/time -----------------------------------------------------------
+
+test('a zeroed DOS date/time field decodes to the 1980-01-01 epoch', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' });
+  const archive = await buildArchive([entry]);
+  const tampered = Buffer.from(archive);
+  tampered.writeUInt16LE(0, 10); // local time
+  tampered.writeUInt16LE(0, 12); // local date
+  const centralStart = 30 + 'f.txt'.length + 'hi'.length;
+  tampered.writeUInt16LE(0, centralStart + 12); // central time
+  tampered.writeUInt16LE(0, centralStart + 14); // central date
+
+  const [read] = zlib.ZipEntry.read(tampered);
+  assert.strictEqual(read.modified.getTime(), new Date(1980, 0, 1, 0, 0, 0).getTime());
+});
+
+test('serializing an entry with an invalid modified Date is rejected', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { modified: new Date(NaN) });
+  await assert.rejects(buildArchive([entry]), { code: 'ERR_INVALID_ARG_VALUE' });
+});
+
+// -- Zip64 structures ---------------------------------------------------------
+
+function buildZip64Record({ diskNumber = 0, cdDiskNumber = 0, cdDiskRecords = 0n,
+                            cdTotalRecords = 0n, cdSize = 0n, cdOffset = 0n } = {}) {
+  const buf = Buffer.allocUnsafe(56);
+  buf.writeUInt32LE(0x06064b50, 0);
+  buf.writeBigUInt64LE(44n, 4);
+  buf.writeUInt16LE((3 << 8) | 45, 12); // Made by Unix, version 4.5
+  buf.writeUInt16LE(45, 14);
+  buf.writeUInt32LE(diskNumber, 16);
+  buf.writeUInt32LE(cdDiskNumber, 20);
+  buf.writeBigUInt64LE(cdDiskRecords, 24);
+  buf.writeBigUInt64LE(cdTotalRecords, 32);
+  buf.writeBigUInt64LE(cdSize, 40);
+  buf.writeBigUInt64LE(cdOffset, 48);
+  return buf;
+}
+
+function buildZip64Locator({ recordDiskNumber = 0, recordOffset = 0n, totalDisks = 1 } = {}) {
+  const buf = Buffer.allocUnsafe(20);
+  buf.writeUInt32LE(0x07064b50, 0);
+  buf.writeUInt32LE(recordDiskNumber, 4);
+  buf.writeBigUInt64LE(recordOffset, 8);
+  buf.writeUInt32LE(totalDisks, 16);
+  return buf;
+}
+
+function buildEocd({ diskNumber = 0, cdDiskNumber = 0, cdDiskRecords = 0,
+                     totalRecords = 0, cdSize = 0, cdOffset = 0, comment = Buffer.alloc(0) } = {}) {
+  const buf = Buffer.allocUnsafe(22 + comment.length);
+  buf.writeUInt32LE(0x06054b50, 0);
+  buf.writeUInt16LE(diskNumber, 4);
+  buf.writeUInt16LE(cdDiskNumber, 6);
+  buf.writeUInt16LE(cdDiskRecords, 8);
+  buf.writeUInt16LE(totalRecords, 10);
+  buf.writeUInt32LE(cdSize, 12);
+  buf.writeUInt32LE(cdOffset, 16);
+  buf.writeUInt16LE(comment.length, 20);
+  comment.copy(buf, 22);
+  return buf;
+}
+
+// A minimal (zero-entry) Zip64 archive: record + locator + classic EOCD,
+// with the locator pointing directly at the record.
+function buildMinimalZip64Archive({ record, locator, eocd } = {}) {
+  return Buffer.concat([
+    buildZip64Record(record),
+    buildZip64Locator({ recordOffset: 0n, ...locator }),
+    buildEocd(eocd),
+  ]);
+}
+
+test('a well-formed minimal Zip64 archive round-trips its comment', () => {
+  const buf = buildMinimalZip64Archive({ eocd: { comment: Buffer.from('hi') } });
+  const zip = new zlib.ZipBuffer(buf);
+  assert.strictEqual(zip.size, 0);
+  assert.strictEqual(zip.comment, 'hi');
+});
+
+test('a Zip64 locator declaring more than one disk is rejected', () => {
+  const buf = buildMinimalZip64Archive({ locator: { totalDisks: 2 } });
+  assert.throws(() => [...zlib.ZipEntry.read(buf)], { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('a Zip64 locator pointing at another disk is rejected', () => {
+  const buf = buildMinimalZip64Archive({ locator: { recordDiskNumber: 1 } });
+  assert.throws(() => [...zlib.ZipEntry.read(buf)], { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('a Zip64 record on another disk is rejected', () => {
+  const buf = buildMinimalZip64Archive({ record: { diskNumber: 1 } });
+  assert.throws(() => [...zlib.ZipEntry.read(buf)], { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('a Zip64 record with inconsistent disk record counts is rejected', () => {
+  const buf = buildMinimalZip64Archive({ record: { cdDiskRecords: 1n, cdTotalRecords: 2n } });
+  assert.throws(() => [...zlib.ZipEntry.read(buf)], { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('a Zip64 record is found by scanning backward when data was prepended', () => {
+  // The locator's declared offset is wrong (as if the archive had been
+  // prepended with extra bytes, e.g. a self-extractor stub, after the
+  // record/locator were written), but the record still physically sits
+  // immediately before the locator; findArchiveEnd() must recover it.
+  const buf = buildMinimalZip64Archive({
+    locator: { recordOffset: 999_999n },
+    eocd: { comment: Buffer.from('recovered') },
+  });
+  const zip = new zlib.ZipBuffer(buf);
+  assert.strictEqual(zip.comment, 'recovered');
+});
+
+test('a required Zip64 record that cannot be found anywhere is rejected', () => {
+  // An EOCD overflow sentinel makes the Zip64 record mandatory; with the
+  // record's signature corrupted and the locator pointing nowhere useful,
+  // the archive is unreadable.
+  const buf = buildMinimalZip64Archive({
+    locator: { recordOffset: 999_999n },
+    eocd: { totalRecords: 0xffff, cdDiskRecords: 0xffff },
+  });
+  buf.writeUInt32LE(0xdeadbeef, 0); // Also corrupt the record actually present
+  assert.throws(() => [...zlib.ZipEntry.read(buf)], {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /Zip64 end of central directory record not found/,
+  });
+});
+
+test('a missing Zip64 record falls back to valid classic EOCD fields', () => {
+  // Same corrupted record, but no EOCD field carries an overflow sentinel:
+  // the classic fields fully describe the (empty) archive, so the stray
+  // locator signature - indistinguishable from comment bytes that happen to
+  // contain it - must not reject an otherwise valid archive.
+  const buf = buildMinimalZip64Archive({ locator: { recordOffset: 999_999n } });
+  buf.writeUInt32LE(0xdeadbeef, 0);
+  assert.strictEqual([...zlib.ZipEntry.read(buf)].length, 0);
+});
+
+// Patches a single-entry, single-record archive's central header to carry a
+// synthetic Zip64 extra field for whichever of {uncompressedSize,
+// compressedSize, localFileHeaderOffset, diskNumber} are provided, setting
+// the corresponding 32-/16-bit field to the sentinel value that tells
+// CentralFileHeader to resolve it from the extra field instead. A leading,
+// unrelated TLV record is always included ahead of the Zip64 one, so the
+// "skip past a foreign record" loop iteration is exercised too.
+function injectZip64Extra(archive, name, contentLength, fields) {
+  const centralHeaderStart = 30 + name.length + contentLength;
+  const nameStart = centralHeaderStart + 46;
+  const extraLengthOffset = centralHeaderStart + 30;
+  assert.strictEqual(archive.readUInt16LE(extraLengthOffset), 0); // sanity: no existing extra
+
+  const dummyTlv = Buffer.from([0x99, 0x99, 0x04, 0x00, 0xde, 0xad, 0xbe, 0xef]);
+  const order = ['uncompressedSize', 'compressedSize', 'localFileHeaderOffset', 'diskNumber'];
+  const dataLength = order.reduce(
+    (total, key) => total + (key in fields ? (key === 'diskNumber' ? 4 : 8) : 0), 0);
+  const zip64Tlv = Buffer.allocUnsafe(4 + dataLength);
+  zip64Tlv.writeUInt16LE(0x0001, 0);
+  zip64Tlv.writeUInt16LE(dataLength, 2);
+  let pos = 4;
+  for (const key of order) {
+    if (!(key in fields)) continue;
+    if (key === 'diskNumber') {
+      zip64Tlv.writeUInt32LE(Number(fields[key]), pos);
+      pos += 4;
+    } else {
+      zip64Tlv.writeBigUInt64LE(BigInt(fields[key]), pos);
+      pos += 8;
+    }
+  }
+  const extra = Buffer.concat([dummyTlv, zip64Tlv]);
+
+  const before = archive.subarray(0, nameStart + name.length);
+  const after = archive.subarray(nameStart + name.length); // comment + EOCD
+  const patched = Buffer.concat([before, extra, after]);
+
+  patched.writeUInt16LE(extra.length, extraLengthOffset);
+  if ('uncompressedSize' in fields) patched.writeUInt32LE(0xffffffff, centralHeaderStart + 24);
+  if ('compressedSize' in fields) patched.writeUInt32LE(0xffffffff, centralHeaderStart + 20);
+  if ('localFileHeaderOffset' in fields) patched.writeUInt32LE(0xffffffff, centralHeaderStart + 42);
+  if ('diskNumber' in fields) patched.writeUInt16LE(0xffff, centralHeaderStart + 34);
+
+  const eocdOffset = patched.length - 22;
+  assert.strictEqual(patched.readUInt32LE(eocdOffset), 0x06054b50);
+  const oldCdSize = patched.readUInt32LE(eocdOffset + 12);
+  patched.writeUInt32LE(oldCdSize + extra.length, eocdOffset + 12);
+
+  return patched;
+}
+
+test('a foreign Zip64 extra field naming only the fields it needs still resolves', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const entry = await zlib.ZipEntry.create(name, content, { method: 'store' });
+  const archive = await buildArchive([entry]);
+
+  const patched = injectZip64Extra(archive, name, content.length, {
+    uncompressedSize: content.length,
+    compressedSize: content.length,
+    localFileHeaderOffset: 0,
+    diskNumber: 0,
+  });
+
+  const [read] = zlib.ZipEntry.read(patched);
+  assert.strictEqual(read.size, content.length);
+  assert.strictEqual(read.compressedSize, content.length);
+  assert.strictEqual((await read.content()).toString(), 'hello');
+});
+
+test('a foreign Zip64 extra field carrying every field regardless of sentinels still resolves', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const entry = await zlib.ZipEntry.create(name, content, { method: 'store' });
+  const archive = await buildArchive([entry]);
+
+  // APPNOTE 4.5.3 says Zip64 fields MUST appear only for the classic fields
+  // holding the overflow sentinel, but plenty of real writers emit all four
+  // regardless. Only the compressed size is a sentinel here, so a strictly
+  // packed parse would misread the uncompressed-size slot as the compressed
+  // size; the parser must fall back to the full fixed layout instead.
+  const centralHeaderStart = 30 + name.length + content.length;
+  const nameStart = centralHeaderStart + 46;
+  const tlv = Buffer.allocUnsafe(4 + 28);
+  tlv.writeUInt16LE(0x0001, 0);
+  tlv.writeUInt16LE(28, 2);
+  tlv.writeBigUInt64LE(0x1111n, 4); // Uncompressed size (classic field wins)
+  tlv.writeBigUInt64LE(BigInt(content.length), 12); // Compressed size
+  tlv.writeBigUInt64LE(0n, 20); // Local header offset (classic field wins)
+  tlv.writeUInt32LE(0, 28); // Disk number (classic field wins)
+  const before = archive.subarray(0, nameStart + name.length);
+  const after = archive.subarray(nameStart + name.length);
+  const patched = Buffer.concat([before, tlv, after]);
+  patched.writeUInt16LE(tlv.length, centralHeaderStart + 30);
+  patched.writeUInt32LE(0xffffffff, centralHeaderStart + 20); // compressedSize sentinel only
+  const eocdOffset = patched.length - 22;
+  patched.writeUInt32LE(patched.readUInt32LE(eocdOffset + 12) + tlv.length, eocdOffset + 12);
+
+  const [read] = zlib.ZipEntry.read(patched);
+  assert.strictEqual(read.compressedSize, content.length);
+  assert.strictEqual(read.size, content.length);
+  assert.strictEqual((await read.content()).toString(), 'hello');
+
+  // Re-serialization drops the (now stale) Zip64 record - Zip64 data is
+  // regenerated from the final sizes - and the entry stays readable.
+  const rewritten = await buildArchive([read]);
+  const [reread] = zlib.ZipEntry.read(rewritten);
+  assert.strictEqual((await reread.content()).toString(), 'hello');
+});
+
+test('a Zip64 extra field value beyond Number.MAX_SAFE_INTEGER is rejected', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const entry = await zlib.ZipEntry.create(name, content, { method: 'store' });
+  const archive = await buildArchive([entry]);
+
+  const patched = injectZip64Extra(archive, name, content.length, {
+    uncompressedSize: 0xffffffffffffffffn,
+  });
+
+  const [read] = zlib.ZipEntry.read(patched);
+  assert.throws(() => read.size, {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /exceeds the safe integer range/,
+  });
+});
+
+// Injects a raw, already-built Zip64 extra-field TLV (rather than one built
+// via injectZip64Extra()'s field map), to exercise the parser's own
+// malformed/truncated-input rejections.
+function injectRawZip64Extra(archive, name, contentLength, extraBytes) {
+  const centralHeaderStart = 30 + name.length + contentLength;
+  const nameStart = centralHeaderStart + 46;
+  const extraLengthOffset = centralHeaderStart + 30;
+  assert.strictEqual(archive.readUInt16LE(extraLengthOffset), 0);
+  const before = archive.subarray(0, nameStart + name.length);
+  const after = archive.subarray(nameStart + name.length);
+  const patched = Buffer.concat([before, extraBytes, after]);
+  patched.writeUInt16LE(extraBytes.length, extraLengthOffset);
+  patched.writeUInt32LE(0xffffffff, centralHeaderStart + 24); // uncompressedSize sentinel
+  const eocdOffset = patched.length - 22;
+  const oldCdSize = patched.readUInt32LE(eocdOffset + 12);
+  patched.writeUInt32LE(oldCdSize + extraBytes.length, eocdOffset + 12);
+  return patched;
+}
+
+test('a Zip64 extra-field TLV whose declared size overflows the extra field is rejected', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const entry = await zlib.ZipEntry.create(name, content, { method: 'store' });
+  const archive = await buildArchive([entry]);
+
+  const tlv = Buffer.allocUnsafe(8);
+  tlv.writeUInt16LE(0x0001, 0);
+  tlv.writeUInt16LE(100, 2); // claims 100 bytes of data, but none follow
+  const patched = injectRawZip64Extra(archive, name, content.length, tlv);
+
+  const [read] = zlib.ZipEntry.read(patched);
+  assert.throws(() => read.size, {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /extra field is malformed/,
+  });
+});
+
+test('a Zip64 extra-field TLV too short for the field it claims to carry is rejected', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const entry = await zlib.ZipEntry.create(name, content, { method: 'store' });
+  const archive = await buildArchive([entry]);
+
+  // Declares only 4 bytes of data, but a sentinel uncompressedSize needs 8.
+  const tlv = Buffer.allocUnsafe(8);
+  tlv.writeUInt16LE(0x0001, 0);
+  tlv.writeUInt16LE(4, 2);
+  tlv.writeUInt32LE(123, 4);
+  const patched = injectRawZip64Extra(archive, name, content.length, tlv);
+
+  const [read] = zlib.ZipEntry.read(patched);
+  assert.throws(() => read.size, {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /Zip64 extended information extra field is truncated/,
+  });
+});
+
+// -- buffer coercion -----------------------------------------------------------
+
+test('create() accepts a DataView, a non-Uint8Array TypedArray, and an ArrayBuffer', async () => {
+  const ab = new ArrayBuffer(4);
+  new Uint8Array(ab).set([1, 2, 3, 4]);
+
+  const dv = new DataView(ab, 1, 2);
+  const fromDataView = await zlib.ZipEntry.create('dv.bin', dv);
+  assert.strictEqual((await fromDataView.content()).length, 2);
+
+  const i32 = new Int32Array([10, 20, 30]);
+  const fromTypedArray = await zlib.ZipEntry.create('i32.bin', i32);
+  assert.strictEqual((await fromTypedArray.content()).length, 12);
+
+  const fromArrayBuffer = await zlib.ZipEntry.create('ab.bin', ab);
+  assert.strictEqual((await fromArrayBuffer.content()).length, 4);
+});
+
+// -- entry-metadata validation -------------------------------------------------
+
+test('create() validates comment length, modified type, and method value', async () => {
+  await assert.rejects(
+    zlib.ZipEntry.create('f.txt', Buffer.alloc(0), { comment: 'x'.repeat(70000) }),
+    { code: 'ERR_ZIP_ENTRY_TOO_LARGE' },
+  );
+  await assert.rejects(
+    zlib.ZipEntry.create('f.txt', Buffer.alloc(0), { modified: 123 }),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  await assert.rejects(
+    zlib.ZipEntry.create('f.txt', Buffer.alloc(0), { method: 'bogus' }),
+    { code: 'ERR_INVALID_ARG_VALUE' },
+  );
+});
+
+test('a directory entry must have empty content, for create(), createSync(), and createStream()', async () => {
+  await assert.rejects(
+    zlib.ZipEntry.create('dir/', Buffer.from('x')), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(
+    () => zlib.ZipEntry.createSync('dir/', Buffer.from('x')), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(
+    () => zlib.ZipEntry.createStream('dir/', (async function* () {})()), { code: 'ERR_INVALID_ARG_VALUE' });
+});
+
+test('createZipArchive()/createZipArchiveSync() validate the archive comment length', async () => {
+  await assert.rejects(drain(zlib.createZipArchive([], 'x'.repeat(70000))),
+                       { code: 'ERR_ZIP_ARCHIVE_TOO_LARGE' });
+  assert.throws(() => [...zlib.createZipArchiveSync([], 'x'.repeat(70000))],
+                { code: 'ERR_ZIP_ARCHIVE_TOO_LARGE' });
+});
+
+// -- streaming-entry state guards ----------------------------------------------
+
+test('a pending streaming entry rejects size/crc32/compressedSize/content access', () => {
+  const streaming = zlib.ZipEntry.createStream(
+    'big.bin', (async function* () { yield Buffer.from('x'); })());
+  assert.throws(() => streaming.size, { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => streaming.crc32, { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => streaming.compressedSize, { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => streaming.contentIterator(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => streaming.contentSync(), { code: 'ERR_INVALID_STATE' });
+});
+
+// Once a streaming entry has been serialized on its own (via createZipArchive,
+// not into a writable ZipFile that would promote it), its source is spent and
+// there is nothing to read back. Reads must fail with a clean state error, not
+// silently decode an empty buffer and report ERR_ZIP_ENTRY_CORRUPT.
+test('a spent (serialized-but-unpromoted) streaming entry rejects reads cleanly', async () => {
+  const entry = zlib.ZipEntry.createStream('s.txt', (async function* () { yield Buffer.from('hello'); })());
+  await drain(entry);
+  await assert.rejects(entry.content(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => entry.contentSync(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => entry.contentIterator(), { code: 'ERR_INVALID_STATE' });
+});
+
+test('a streaming entry can only be serialized once', async () => {
+  const entry = zlib.ZipEntry.createStream('a.bin', (async function* () { yield Buffer.from('x'); })());
+  await drain(entry);
+  await assert.rejects(drain(entry), { code: 'ERR_INVALID_STATE' });
+});
+
+test('a streaming entry rejects a non-Uint8Array chunk from its source', async () => {
+  async function* badSource() {
+    yield Buffer.alloc(0); // An empty chunk is silently skipped
+    yield 'not a buffer';
+  }
+  const entry = zlib.ZipEntry.createStream('b.bin', badSource());
+  await assert.rejects(drain(entry), { code: 'ERR_INVALID_ARG_TYPE' });
+});
+
+test('a streaming entry can use zstd compression end-to-end', async () => {
+  const payload = 'zstd stream content '.repeat(50);
+  async function* source() { yield Buffer.from(payload); }
+  const entry = zlib.ZipEntry.createStream('c.bin', source(), { method: 'zstd' });
+  const archive = await buildArchive([entry]);
+
+  const [read] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(read.method, 93);
+  assert.strictEqual((await read.content()).toString(), payload);
+});
+
+test('an error from a streaming entry\'s source propagates and cleans up (deflate and zstd)', async () => {
+  for (const method of ['deflate', 'zstd']) {
+    async function* badSource() {
+      yield Buffer.from('some data before the error');
+      throw new Error(`source blew up (${method})`);
+    }
+    const entry = zlib.ZipEntry.createStream('big.bin', badSource(), { method });
+    await assert.rejects(drain(entry), { message: `source blew up (${method})` });
+  }
+});
+
+// -- contentIterator() / decodeMemberStream() error paths ------------------------
+
+test('contentIterator() enforces the same guards as content() and contentSync()', async () => {
+  // Encrypted.
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('secret'), { method: 'store' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    tampered.writeUInt16LE(tampered.readUInt16LE(6) | 0x0001, 6);
+    const centralStart = 30 + 'f.txt'.length + 'secret'.length;
+    tampered.writeUInt16LE(tampered.readUInt16LE(centralStart + 8) | 0x0001, centralStart + 8);
+    const [read] = zlib.ZipEntry.read(tampered);
+    await assert.rejects(drain(read.contentIterator()), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+  }
+  // Unsupported compression method.
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    tampered.writeUInt16LE(1, 8);
+    const centralStart = 30 + 'f.txt'.length + 'hi'.length;
+    tampered.writeUInt16LE(1, centralStart + 10);
+    const [read] = zlib.ZipEntry.read(tampered);
+    await assert.rejects(drain(read.contentIterator()), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+  }
+  // maxSize enforced up front.
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'));
+    await assert.rejects(drain(entry.contentIterator({ maxSize: 1 })), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+  }
+  // Declared-size mismatch.
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    const centralStart = 30 + 'f.txt'.length + 'hello world'.length;
+    tampered.writeUInt32LE(1, centralStart + 24);
+    const [read] = zlib.ZipEntry.read(tampered);
+    await assert.rejects(drain(read.contentIterator()), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+  }
+  // CRC-32 mismatch, and disabling verification.
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    tampered[30 + 'f.txt'.length] ^= 0xff;
+    const [read] = zlib.ZipEntry.read(tampered);
+    await assert.rejects(drain(read.contentIterator()), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+    const unverified = await drain(read.contentIterator({ verify: false }));
+    assert.strictEqual(unverified.length, 'hello world'.length);
+  }
+});
+
+// -- content()/contentSync() zstd-specific branches ----------------------------
+
+test('content() and contentSync() enforce maxSize and detect corruption for zstd entries', async () => {
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('y'.repeat(5000)), { method: 'zstd' });
+    const archive = await buildArchive([entry]);
+    const [read] = zlib.ZipEntry.read(archive);
+    assert.strictEqual(read.method, 93);
+    await assert.rejects(read.content({ maxSize: 10 }), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+  }
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('z'.repeat(200)), { method: 'zstd' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    const contentStart = 30 + 'f.txt'.length;
+    tampered.fill(0xff, contentStart, contentStart + 4); // Break the zstd frame itself
+    const [read] = zlib.ZipEntry.read(tampered);
+    await assert.rejects(read.content(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+    assert.throws(() => read.contentSync(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+  }
+});
+
+// `decodeMemberSync()` (used by `ZipEntry.prototype.contentSync()`) duplicates
+// `decodeMemberStream()`'s guards for its own, separate synchronous code
+// path; exercise them through a disk-backed ZipFile.
+test('ZipFile getSync().contentSync() enforces the same guards via decodeMemberSync()', async () => {
+  async function writeTempArchive(archive, suffix) {
+    const filePath = tmpdir.resolve(`zip-coverage-contentsync-${suffix}.zip`);
+    await fs.writeFile(filePath, archive);
+    return filePath;
+  }
+
+  // Encrypted.
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('secret'), { method: 'store' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    tampered.writeUInt16LE(tampered.readUInt16LE(6) | 0x0001, 6);
+    const centralStart = 30 + 'f.txt'.length + 'secret'.length;
+    tampered.writeUInt16LE(tampered.readUInt16LE(centralStart + 8) | 0x0001, centralStart + 8);
+    const filePath = await writeTempArchive(tampered, 'encrypted');
+    const zf = zlib.ZipFile.openSync(filePath);
+    assert.throws(() => zf.getSync('f.txt').contentSync(), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+    zf.closeSync();
+    await fs.unlink(filePath);
+  }
+  // maxSize, for both the deflate and the zstd decode branch.
+  for (const method of ['deflate', 'zstd']) {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('y'.repeat(5000)), { method });
+    const archive = await buildArchive([entry]);
+    const filePath = await writeTempArchive(archive, `maxsize-${method}`);
+    const zf = zlib.ZipFile.openSync(filePath);
+    assert.throws(() => zf.getSync('f.txt').contentSync({ maxSize: 10 }), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+    zf.closeSync();
+    await fs.unlink(filePath);
+  }
+  // A genuine decompression failure (not just a CRC mismatch after a
+  // successful decode).
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('y'.repeat(500)), { method: 'deflate' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    const contentStart = 30 + 'f.txt'.length;
+    tampered.fill(0xff, contentStart, contentStart + 4);
+    const filePath = await writeTempArchive(tampered, 'deflate-corrupt');
+    const zf = zlib.ZipFile.openSync(filePath);
+    assert.throws(() => zf.getSync('f.txt').contentSync(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+    zf.closeSync();
+    await fs.unlink(filePath);
+  }
+  // Declared-size mismatch ("produced N bytes, expected M").
+  {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    const centralStart = 30 + 'f.txt'.length + 'hello world'.length;
+    tampered.writeUInt32LE(1, centralStart + 24);
+    const filePath = await writeTempArchive(tampered, 'size-mismatch');
+    const zf = zlib.ZipFile.openSync(filePath);
+    assert.throws(() => zf.getSync('f.txt').contentSync(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+    zf.closeSync();
+    await fs.unlink(filePath);
+  }
+});
+
+test('contentIterator() rejects an entry that inflates to less than its declared size', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' });
+  const archive = await buildArchive([entry]);
+  const tampered = Buffer.from(archive);
+  const centralStart = 30 + 'f.txt'.length + 'hi'.length;
+  tampered.writeUInt32LE(1000, centralStart + 24); // Declared size grown beyond reality
+  const [read] = zlib.ZipEntry.read(tampered);
+  await assert.rejects(drain(read.contentIterator()), {
+    code: 'ERR_ZIP_ENTRY_CORRUPT',
+    message: /is truncated/,
+  });
+});
+
+// -- ZipBuffer / ZipFile iteration protocols -----------------------------------
+
+test('ZipBuffer exposes Map-like forEach/values/entries/iteration/toStringTag', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('1')),
+    await zlib.ZipEntry.create('b.txt', Buffer.from('2')),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+
+  const seen = [];
+  zip.forEach((entry, key, self) => {
+    seen.push(key);
+    assert.strictEqual(self, zip);
+    assert.strictEqual(entry.name, key);
+  });
+  assert.deepStrictEqual(seen.sort(), ['a.txt', 'b.txt']);
+
+  assert.deepStrictEqual([...zip.values()].map((e) => e.name).sort(), ['a.txt', 'b.txt']);
+  assert.deepStrictEqual([...zip.entries()].map(([k]) => k).sort(), ['a.txt', 'b.txt']);
+  assert.deepStrictEqual([...zip].map(([k]) => k).sort(), ['a.txt', 'b.txt']);
+  assert.strictEqual(Object.prototype.toString.call(zip), '[object ZipBuffer]');
+  assert.throws(() => zip.addEntry({}), { code: 'ERR_INVALID_ARG_TYPE' });
+});
+
+test('ZipFile exposes the same iteration protocol, plus its Sync counterparts', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('1')),
+    await zlib.ZipEntry.create('b.txt', Buffer.from('2')),
+  ]);
+  const filePath = tmpdir.resolve('zip-coverage-iteration.zip');
+  await fs.writeFile(filePath, archive);
+
+  const zf = await zlib.ZipFile.open(filePath);
+  try {
+    const pending = [];
+    zf.forEach((valuePromise) => pending.push(valuePromise));
+    await Promise.all(pending); // Let every dangling get() settle before closing
+
+    zf.forEachSync(() => {});
+    assert.deepStrictEqual([...zf.valuesSync()].map((e) => e.name).sort(), ['a.txt', 'b.txt']);
+    assert.deepStrictEqual([...zf.entriesSync()].map(([k]) => k).sort(), ['a.txt', 'b.txt']);
+    assert.deepStrictEqual([...zf.keys()].sort(), ['a.txt', 'b.txt']);
+    assert.strictEqual(zf.size, 2);
+    assert.strictEqual(Object.prototype.toString.call(zf), '[object ZipFile]');
+
+    const names = [];
+    for await (const entry of zf) names.push(entry.name);
+    assert.deepStrictEqual(names.sort(), ['a.txt', 'b.txt']);
+
+    // Synchronous iteration (Symbol.iterator) yields [name, Promise<ZipEntry>].
+    const syncPairs = [...zf];
+    assert.deepStrictEqual(syncPairs.map(([k]) => k).sort(), ['a.txt', 'b.txt']);
+    const resolved = await Promise.all(syncPairs.map(([, v]) => v));
+    assert.deepStrictEqual(resolved.map((e) => e.name).sort(), ['a.txt', 'b.txt']);
+  } finally {
+    await zf[Symbol.asyncDispose]();
+  }
+
+  const writable = await zlib.ZipFile.open(filePath, { writable: true });
+  await assert.rejects(writable.addEntry({}), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writable.addEntrySync({}), { code: 'ERR_INVALID_ARG_TYPE' });
+  await writable.close();
+
+  const zf2 = zlib.ZipFile.openSync(filePath);
+  zf2[Symbol.dispose]();
+
+  await fs.unlink(filePath);
+});
+
+// -- ZipFile (on-disk) error paths ---------------------------------------------
+
+test('ZipFile.open()/openSync() reject a file with no end-of-central-directory record', async () => {
+  const filePath = tmpdir.resolve('zip-coverage-garbage.zip');
+  await fs.writeFile(filePath, Buffer.from('not a zip file, just garbage bytes'));
+  try {
+    await assert.rejects(zlib.ZipFile.open(filePath), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+    assert.throws(() => zlib.ZipFile.openSync(filePath), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+  } finally {
+    await fs.unlink(filePath);
+  }
+});
+
+test('ZipFile get()/getSync()/stream() reject a missing entry name', async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = tmpdir.resolve('zip-coverage-notfound.zip');
+  await fs.writeFile(filePath, archive);
+  const zf = await zlib.ZipFile.open(filePath);
+  try {
+    await assert.rejects(zf.get('missing'), { code: 'ERR_ZIP_ENTRY_NOT_FOUND' });
+    assert.throws(() => zf.getSync('missing'), { code: 'ERR_ZIP_ENTRY_NOT_FOUND' });
+    await assert.rejects(zf.stream('missing'), { code: 'ERR_ZIP_ENTRY_NOT_FOUND' });
+  } finally {
+    await zf.close();
+    await fs.unlink(filePath);
+  }
+});
+
+test('a local file header offset pointing into the central directory is rejected at open', async () => {
+  const name = 'a.txt';
+  const content = Buffer.from('hello');
+  const archive = await buildArchive([await zlib.ZipEntry.create(name, content, { method: 'store' })]);
+  const centralHeaderStart = 30 + name.length + content.length;
+  const tampered = Buffer.from(archive);
+  // Point the local file header offset at the central directory itself: the
+  // member's claimed data range then crosses the directory, which the
+  // open-time overlap check rejects before anything is read.
+  tampered.writeUInt32LE(centralHeaderStart, centralHeaderStart + 42);
+  const filePath = tmpdir.resolve('zip-coverage-cd-offset.zip');
+  await fs.writeFile(filePath, tampered);
+  try {
+    await assert.rejects(zlib.ZipFile.open(filePath),
+                         { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /overlaps/ });
+    assert.throws(() => zlib.ZipFile.openSync(filePath),
+                  { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /overlaps/ });
+  } finally {
+    await fs.unlink(filePath);
+  }
+});
+
+test('a declared compressed size reaching past the end of the file is rejected', async () => {
+  const name = 'a.txt';
+  const content = Buffer.from('hello');
+  const archive = await buildArchive([await zlib.ZipEntry.create(name, content, { method: 'store' })]);
+  const centralHeaderStart = 30 + name.length + content.length;
+  const tampered = Buffer.from(archive);
+  tampered.writeUInt32LE(archive.length * 10, centralHeaderStart + 20); // compressedSize
+  const filePath = tmpdir.resolve('zip-coverage-eof.zip');
+  await fs.writeFile(filePath, tampered);
+
+  try {
+    // Member bounds are validated against the file size up front, so the lie
+    // is caught at open time - before any buffered read path could allocate
+    // `compressedSize` bytes for it.
+    await assert.rejects(zlib.ZipFile.open(filePath),
+                         { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /out of bounds/ });
+    assert.throws(() => zlib.ZipFile.openSync(filePath),
+                  { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /out of bounds/ });
+  } finally {
+    await fs.unlink(filePath);
+  }
+});
+
+test('a Zip64-declared compressed size of kMaxLength is rejected at open', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const archive = await buildArchive([await zlib.ZipEntry.create(name, content, { method: 'store' })]);
+
+  // A Zip64-declared compressedSize equal to kMaxLength is the largest value
+  // that still parses (readSafeUint64 caps at the safe-integer ceiling, which
+  // is kMaxLength on 64-bit), but such a member cannot lie inside this tiny
+  // file, so the open-time member bounds check rejects the archive before
+  // the buffering read paths (whose own kMaxLength guard remains as defense
+  // in depth for 32-bit, where kMaxLength is smaller than real file sizes)
+  // could ever allocate for it.
+  const centralHeaderStart = 30 + name.length + content.length;
+  const nameStart = centralHeaderStart + 46;
+  const tlv = Buffer.allocUnsafe(4 + 8);
+  tlv.writeUInt16LE(0x0001, 0);
+  tlv.writeUInt16LE(8, 2);
+  tlv.writeBigUInt64LE(BigInt(require('node:buffer').kMaxLength), 4);
+  const before = archive.subarray(0, nameStart + name.length);
+  const after = archive.subarray(nameStart + name.length);
+  const patched = Buffer.concat([before, tlv, after]);
+  patched.writeUInt16LE(tlv.length, centralHeaderStart + 30);
+  patched.writeUInt32LE(0xffffffff, centralHeaderStart + 20); // compressedSize sentinel
+  const eocdOffset = patched.length - 22;
+  patched.writeUInt32LE(patched.readUInt32LE(eocdOffset + 12) + tlv.length, eocdOffset + 12);
+
+  const toolargeFilePath = tmpdir.resolve('zip-coverage-toolarge.zip');
+  await fs.writeFile(toolargeFilePath, patched);
+  try {
+    await assert.rejects(zlib.ZipFile.open(toolargeFilePath),
+                         { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /out of bounds/ });
+    assert.throws(() => zlib.ZipFile.openSync(toolargeFilePath),
+                  { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /out of bounds/ });
+  } finally {
+    await fs.unlink(toolargeFilePath);
+  }
+});
+
+// -- forcing Zip64 structures without a multi-gigabyte archive -----------------
+
+test('createZipArchiveSync() also switches to Zip64 structures at 0xFFFF entries', () => {
+  const ZIP64_EOCD_SIGNATURE = Buffer.from([0x50, 0x4b, 0x06, 0x06]);
+  const entries = [];
+  for (let i = 0; i < 0x10000; i++) {
+    entries.push(zlib.ZipEntry.createSync(`entry-${i}`, Buffer.alloc(0), { method: 'store' }));
+  }
+  const chunks = [];
+  for (const chunk of zlib.createZipArchiveSync(entries)) chunks.push(chunk);
+  const archive = Buffer.concat(chunks);
+  assert.ok(archive.includes(ZIP64_EOCD_SIGNATURE));
+  assert.strictEqual([...zlib.ZipEntry.read(archive)].length, 0x10000);
+}, { timeout: 120_000 });
+
+// -- createZipArchive()'s single options argument, baseOffset, and Readable return --
+
+const CENTRAL_FILE_HEADER_SIGNATURE = Buffer.from([0x50, 0x4b, 0x01, 0x02]);
+
+test('createZipArchive() returns a pipeable, async-iterable, non-object-mode Readable', async () => {
+  const { Readable } = require('node:stream');
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'));
+  const stream = zlib.createZipArchive([entry]);
+  assert.ok(stream instanceof Readable);
+  assert.strictEqual(stream.readableObjectMode, false);
+  const chunks = [];
+  for await (const chunk of stream) chunks.push(chunk);
+  assert.strictEqual([...zlib.ZipEntry.read(Buffer.concat(chunks))][0].name, 'f.txt');
+});
+
+test('createZipArchive()/createZipArchiveSync() take a plain string as comment shorthand', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'));
+  const zip = new zlib.ZipBuffer(await drain(zlib.createZipArchive([entry], 'hello')));
+  assert.strictEqual(zip.comment, 'hello');
+
+  const entrySync = zlib.ZipEntry.createSync('f.txt', Buffer.from('hi'));
+  const chunks = [...zlib.createZipArchiveSync([entrySync], 'hello-sync')];
+  const zipSync = new zlib.ZipBuffer(Buffer.concat(chunks));
+  assert.strictEqual(zipSync.comment, 'hello-sync');
+});
+
+test('createZipArchive()/createZipArchiveSync() take an { comment, baseOffset } options object', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'));
+  const zip = new zlib.ZipBuffer(await drain(zlib.createZipArchive([entry], { comment: 'hi there' })));
+  assert.strictEqual(zip.comment, 'hi there');
+});
+
+test('createZipArchive()/createZipArchiveSync() reject a non-string, non-object options argument', async () => {
+  await assert.rejects(drain(zlib.createZipArchive([], 123)), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => [...zlib.createZipArchiveSync([], 123)], { code: 'ERR_INVALID_ARG_TYPE' });
+  await assert.rejects(drain(zlib.createZipArchive([], null)), { code: 'ERR_INVALID_ARG_TYPE' });
+});
+
+test('createZipArchive()/createZipArchiveSync() validate options.baseOffset', async () => {
+  await assert.rejects(drain(zlib.createZipArchive([], { baseOffset: -1 })), { code: 'ERR_OUT_OF_RANGE' });
+  await assert.rejects(drain(zlib.createZipArchive([], { baseOffset: 1.5 })), { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => [...zlib.createZipArchiveSync([], { baseOffset: -1 })], { code: 'ERR_OUT_OF_RANGE' });
+});
+
+test('options.baseOffset shifts every recorded offset, so a prefixed archive is ' +
+     'self-describing without relying on prefix auto-detection', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello offset'));
+  const prefix = Buffer.from('#!/bin/sh\nexit 0\n');
+
+  const shifted = await drain(zlib.createZipArchive([entry], { baseOffset: prefix.byteLength }));
+  const shiftedCentral = shifted.indexOf(CENTRAL_FILE_HEADER_SIGNATURE);
+  assert.strictEqual(shifted.readUInt32LE(shiftedCentral + 42), prefix.byteLength);
+
+  const entryUnshifted = await zlib.ZipEntry.create('f.txt', Buffer.from('hello offset'));
+  const unshifted = await drain(zlib.createZipArchive([entryUnshifted]));
+  const unshiftedCentral = unshifted.indexOf(CENTRAL_FILE_HEADER_SIGNATURE);
+  assert.strictEqual(unshifted.readUInt32LE(unshiftedCentral + 42), 0);
+
+  const combined = Buffer.concat([prefix, shifted]);
+  const zip = new zlib.ZipBuffer(combined);
+  assert.strictEqual((await zip.get('f.txt').content()).toString(), 'hello offset');
+});
+
+test('zipBuffer.toBuffer()/toBufferSync() forward the same string/options-object shorthand', async () => {
+  const zip = new zlib.ZipBuffer(await drain(zlib.createZipArchive([])));
+  await zip.add('f.txt', Buffer.from('hi'));
+
+  assert.strictEqual(new zlib.ZipBuffer(await zip.toBuffer('a comment')).comment, 'a comment');
+  assert.strictEqual(new zlib.ZipBuffer(await zip.toBuffer({ comment: 'an object comment' })).comment,
+                     'an object comment');
+  assert.strictEqual(new zlib.ZipBuffer(zip.toBufferSync('sync comment')).comment, 'sync comment');
+
+  const prefix = Buffer.from('junk\n');
+  const shifted = await zip.toBuffer({ baseOffset: prefix.byteLength });
+  const shiftedCentral = shifted.indexOf(CENTRAL_FILE_HEADER_SIGNATURE);
+  assert.strictEqual(shifted.readUInt32LE(shiftedCentral + 42), prefix.byteLength);
+});
+
+// -- round-trip fidelity of foreign metadata ----------------------------------
+
+test('a non-Unix "version made by" host survives re-serialization', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const entry = await zlib.ZipEntry.create(name, content, { method: 'store' });
+  const archive = Buffer.from(await buildArchive([entry]));
+
+  // Rewrite the entry as DOS-made (host byte 0, sec. 4.4.2) with DOS-style
+  // external attributes (0x20, the archive bit): the high 16 bits are NOT
+  // Unix permissions for this host, so `mode` must read 0, and the host byte
+  // must survive re-serialization - stamping it as Unix would turn the
+  // zeroed high bits into Unix mode 0000 for downstream extractors.
+  const centralHeaderStart = 30 + name.length + content.length;
+  archive[centralHeaderStart + 5] = 0; // "version made by" host byte
+  archive.writeUInt32LE(0x20, centralHeaderStart + 38); // external attributes
+
+  const [read] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(read.mode, 0);
+  assert.strictEqual(read.isSymlink, false);
+
+  const rewritten = await buildArchive([read]);
+  const rewrittenCentral = rewritten.indexOf(CENTRAL_FILE_HEADER_SIGNATURE);
+  assert.strictEqual(rewritten[rewrittenCentral + 5], 0); // host byte preserved
+  assert.strictEqual(rewritten.readUInt32LE(rewrittenCentral + 38), 0x20);
+  const [reread] = zlib.ZipEntry.read(rewritten);
+  assert.strictEqual(reread.mode, 0);
+  // The finalized entry itself now answers from its snapshotted metadata,
+  // which must apply the same made-by gate.
+  assert.strictEqual(read.mode, 0);
+  assert.strictEqual(read.isSymlink, false);
+});
+
+// -- content() ownership -------------------------------------------------------
+
+test('content()/contentSync() of a stored in-memory entry return caller-owned memory', async () => {
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create('s.txt', Buffer.from('hello'), { method: 'store' })]);
+  const zip = new zlib.ZipBuffer(archive);
+  const entry = zip.get('s.txt');
+
+  // If content() returned a view into the archive, zeroing it would corrupt
+  // the entry and the next read would fail CRC-32 verification.
+  (await entry.content()).fill(0);
+  assert.deepStrictEqual(await entry.content(), Buffer.from('hello'));
+  entry.contentSync().fill(0);
+  assert.deepStrictEqual(entry.contentSync(), Buffer.from('hello'));
+});
+
+// Injects a raw extra-field blob into a single-entry archive's central
+// header without touching any size/offset field (unlike injectRawZip64Extra
+// above, which also plants an overflow sentinel).
+function injectCentralExtra(archive, name, contentLength, extraBytes) {
+  const centralHeaderStart = 30 + name.length + contentLength;
+  const nameStart = centralHeaderStart + 46;
+  const extraLengthOffset = centralHeaderStart + 30;
+  assert.strictEqual(archive.readUInt16LE(extraLengthOffset), 0);
+  const before = archive.subarray(0, nameStart + name.length);
+  const after = archive.subarray(nameStart + name.length);
+  const patched = Buffer.concat([before, extraBytes, after]);
+  patched.writeUInt16LE(extraBytes.length, extraLengthOffset);
+  const eocdOffset = patched.length - 22;
+  patched.writeUInt32LE(patched.readUInt32LE(eocdOffset + 12) + extraBytes.length, eocdOffset + 12);
+  return patched;
+}
+
+// -- input coercion ------------------------------------------------------------
+
+test('a plain Uint8Array is accepted anywhere binary input is, and non-binary input is rejected', async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('u.txt', Buffer.from('hi'))]);
+  const viaU8 = new zlib.ZipBuffer(new Uint8Array(archive));
+  assert.strictEqual((await viaU8.get('u.txt').content()).toString(), 'hi');
+  const entry = await zlib.ZipEntry.create('v.txt', new Uint8Array([1, 2, 3]), { method: 'store' });
+  assert.deepStrictEqual(await entry.content(), Buffer.from([1, 2, 3]));
+  assert.throws(() => new zlib.ZipBuffer('not binary'), { code: 'ERR_INVALID_ARG_TYPE' });
+  await assert.rejects(zlib.ZipEntry.create('w.txt', 'not binary'), { code: 'ERR_INVALID_ARG_TYPE' });
+});
+
+test('forEach() passes thisArg through on ZipBuffer and ZipFile', async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('t.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const ctx = { hits: 0 };
+  zip.forEach(function() { this.hits++; }, ctx);
+  assert.strictEqual(ctx.hits, 1);
+
+  const filePath = tmpdir.resolve('zip-coverage-foreach.zip');
+  await fs.writeFile(filePath, archive);
+  const zf = await zlib.ZipFile.open(filePath);
+  try {
+    const fileCtx = { hits: 0 };
+    zf.forEach(function() { this.hits++; }, fileCtx);
+    zf.forEachSync(function() { this.hits++; }, fileCtx);
+    assert.strictEqual(fileCtx.hits, 2);
+  } finally {
+    await zf.close();
+    await fs.unlink(filePath);
+  }
+});
+
+// -- entry metadata before serialization ----------------------------------------
+
+test('freshly created entries expose their metadata before serialization', async () => {
+  const sym = zlib.ZipEntry.createSymlink('link', 'target');
+  assert.strictEqual(sym.mode, 0o777); // The symlink default
+  assert.strictEqual(sym.isSymlink, true);
+  assert.strictEqual(sym.isFile, false);
+
+  const entry = await zlib.ZipEntry.create('m.txt', Buffer.from('x'), {
+    comment: 'note', mode: 0o640, modified: new Date(1700000000000),
+  });
+  assert.deepStrictEqual(entry.nameBuffer, Buffer.from('m.txt'));
+  assert.strictEqual(entry.comment, 'note');
+  assert.strictEqual(entry.modified.getTime(), 1700000000000);
+  assert.strictEqual(entry.mode, 0o640);
+  assert.strictEqual(entry.isSymlink, false);
+});
+
+// -- extra-field edge cases ------------------------------------------------------
+
+test('a Unicode Path extra field with an unknown version is ignored', async () => {
+  const name = 'plain.txt';
+  const content = Buffer.from('hi');
+  const archive = await buildArchive([await zlib.ZipEntry.create(name, content, { method: 'store' })]);
+  const utf8Name = Buffer.from('other.txt');
+  const up = Buffer.allocUnsafe(4 + 5 + utf8Name.length);
+  up.writeUInt16LE(0x7075, 0);
+  up.writeUInt16LE(5 + utf8Name.length, 2);
+  up.writeUInt8(2, 4); // Unsupported version: only version 1 is defined
+  up.writeUInt32LE(0, 5); // CRC-32 (irrelevant; the version check comes first)
+  utf8Name.copy(up, 9);
+  const patched = injectCentralExtra(archive, name, content.length, up);
+  const [read] = zlib.ZipEntry.read(patched);
+  assert.strictEqual(read.name, 'plain.txt');
+});
+
+test('malformed or empty timestamp extra fields fall back to the DOS time', async () => {
+  const name = 't.txt';
+  const content = Buffer.from('x');
+  const modified = new Date(2024, 3, 5, 10, 20, 30);
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { method: 'store', modified })]);
+  const ntfs = Buffer.allocUnsafe(4 + 12);
+  ntfs.writeUInt16LE(0x000a, 0);
+  ntfs.writeUInt16LE(12, 2);
+  ntfs.writeUInt32LE(0, 4); // Reserved dword
+  ntfs.writeUInt16LE(1, 8); // Tag 1...
+  ntfs.writeUInt16LE(200, 10); // ...claiming 200 bytes: overruns its record
+  ntfs.writeUInt32LE(0, 12);
+  const ut = Buffer.from([0x55, 0x54, 0x01, 0x00, 0x00]); // "UT", flags 0: no mtime present
+  const ux = Buffer.allocUnsafe(4 + 4);
+  ux.writeUInt16LE(0x5855, 0);
+  ux.writeUInt16LE(4, 2); // Too short for the atime+mtime pair
+  ux.writeUInt32LE(123, 4);
+  const patched = injectCentralExtra(
+    archive, name, content.length, Buffer.concat([ntfs, ut, ux]));
+  const [read] = zlib.ZipEntry.read(patched);
+  assert.strictEqual(read.modified.getTime(), modified.getTime());
+});
+
+test('a preserved timestamp extra survives re-serialization without duplication', async () => {
+  const odd = new Date(1700000001000); // An odd second: gets a "UT" extra
+  const name = 'odd.txt';
+  const content = Buffer.from('x');
+  const first = await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { modified: odd, method: 'store' })]);
+  const [read] = zlib.ZipEntry.read(first);
+  const second = await buildArchive([read]);
+  const [reread] = zlib.ZipEntry.read(second);
+  assert.strictEqual(reread.modified.getTime(), odd.getTime());
+  // Exactly one extended-timestamp record: the preserved one, no new copy.
+  const central = second.indexOf(CENTRAL_FILE_HEADER_SIGNATURE);
+  const nameLength = second.readUInt16LE(central + 28);
+  const extraLength = second.readUInt16LE(central + 30);
+  const extra = second.subarray(
+    central + 46 + nameLength, central + 46 + nameLength + extraLength);
+  let utRecords = 0;
+  for (let pos = 0; pos + 4 <= extra.length;) {
+    if (extra.readUInt16LE(pos) === 0x5455) utRecords++;
+    pos += 4 + extra.readUInt16LE(pos + 2);
+  }
+  assert.strictEqual(utRecords, 1);
+});
+
+// -- file-backed metadata and I/O failure paths ----------------------------------
+
+test('modified falls back to the central directory when the local header is malformed', async () => {
+  const name = 'm.txt';
+  const content = Buffer.from('hello');
+  const modified = new Date(2024, 3, 5, 10, 20, 30);
+  const archive = Buffer.from(await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { method: 'store', modified })]));
+  archive.writeUInt32LE(0xdeadbeef, 0); // Corrupt the local header signature
+  const filePath = tmpdir.resolve('zip-coverage-badlocal.zip');
+  await fs.writeFile(filePath, archive);
+  const zf = await zlib.ZipFile.open(filePath);
+  try {
+    const entry = await zf.get(name);
+    // Metadata resolution swallows the local-header failure...
+    assert.strictEqual(entry.modified.getTime(), modified.getTime());
+    // ...but content reads fail loudly on it.
+    await assert.rejects(entry.content(), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+  } finally {
+    await zf.close();
+    await fs.unlink(filePath);
+  }
+});
+
+test('a file that shrinks after open is rejected as unexpected EOF when read', async () => {
+  // The open-time bounds and overlap checks guarantee every member lies
+  // inside the file *as it was at open time*; a file truncated afterwards
+  // (the only way a positioned read can now hit EOF) must fail cleanly.
+  const name = 'a.txt';
+  const content = Buffer.from('hello');
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { method: 'store' })]);
+  const filePath = tmpdir.resolve('zip-coverage-eof-local.zip');
+  await fs.writeFile(filePath, archive);
+  const zf = await zlib.ZipFile.open(filePath);
+  const zfSync = zlib.ZipFile.openSync(filePath);
+  try {
+    await fs.truncate(filePath, 10); // Cuts into the local file header
+    await assert.rejects((await zf.get(name)).content(),
+                         { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /unexpected end of file/ });
+    assert.throws(() => zfSync.getSync(name).contentSync(),
+                  { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /unexpected end of file/ });
+  } finally {
+    await zf.close();
+    zfSync.closeSync();
+    await fs.unlink(filePath);
+  }
+});
+
+test('a failed streaming addEntry() restores the archive and the queue continues', async () => {
+  const filePath = tmpdir.resolve('zip-coverage-rollback.zip');
+  await fs.writeFile(filePath, await buildArchive(
+    [await zlib.ZipEntry.create('seed.txt', Buffer.from('seed'))]));
+  const zip = await zlib.ZipFile.open(filePath, { writable: true });
+  try {
+    async function* failing() {
+      yield Buffer.from('partial data that overwrote the central directory');
+      throw new Error('source failed');
+    }
+    await assert.rejects(
+      zip.addEntry(zlib.ZipEntry.createStream('bad.txt', failing())),
+      /source failed/);
+    // The rewrite restored the directory in place, and the mutation queue
+    // keeps accepting work after a failure.
+    await zip.add('good.txt', Buffer.from('ok'));
+  } finally {
+    await zip.close();
+  }
+  const reread = await zlib.ZipFile.open(filePath);
+  try {
+    assert.deepStrictEqual([...reread.keys()].sort(), ['good.txt', 'seed.txt']);
+    assert.strictEqual((await (await reread.get('seed.txt')).content()).toString(), 'seed');
+    assert.strictEqual((await (await reread.get('good.txt')).content()).toString(), 'ok');
+  } finally {
+    await reread.close();
+    await fs.unlink(filePath);
+  }
+});
+
+test('opening a missing archive surfaces the file-system error', async () => {
+  const missing = tmpdir.resolve('zip-coverage-missing.zip');
+  await assert.rejects(zlib.ZipFile.open(missing), { code: 'ENOENT' });
+  assert.throws(() => zlib.ZipFile.openSync(missing), { code: 'ENOENT' });
+  await assert.rejects(
+    drain(zlib.zipFiles([[tmpdir.resolve('missing-src.txt'), 'a.txt']], { followSymlinks: false })),
+    { code: 'ENOENT' });
+});
+
+test('using a ZipFile after close() is rejected cleanly', async () => {
+  const filePath = tmpdir.resolve('zip-coverage-after-close.zip');
+  await fs.writeFile(filePath, await buildArchive(
+    [await zlib.ZipEntry.create('a.txt', Buffer.from('data'))]));
+
+  const zip = await zlib.ZipFile.open(filePath, { writable: true });
+  const entry = await zip.get('a.txt');
+  await zip.close();
+  // A read through a retained entry is rejected by the shared closed-state,
+  // never by falling through to the (possibly reused) raw descriptor.
+  await assert.rejects(entry.content(), { code: 'ERR_INVALID_STATE' });
+  // Further mutations are rejected the same way...
+  await assert.rejects(
+    zip.addEntry(await zlib.ZipEntry.create('b.txt', Buffer.from('x'))),
+    { code: 'ERR_INVALID_STATE' });
+  // ...and a second close() is an idempotent no-op, not a double-close.
+  await zip.close();
+
+  const zipSync = zlib.ZipFile.openSync(filePath, { writable: true });
+  const entrySync = zipSync.getSync('a.txt');
+  zipSync.closeSync();
+  assert.throws(() => entrySync.contentSync(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(
+    () => zipSync.addEntrySync(zlib.ZipEntry.createSync('b.txt', Buffer.from('x'))),
+    { code: 'ERR_INVALID_STATE' });
+  zipSync.closeSync();
+  await fs.unlink(filePath);
+});
+
+// -- writer-side Zip64 fields ----------------------------------------------------
+
+test('an entry starting beyond 4 GiB records its offset in a Zip64 extra field', async () => {
+  const BASE = 0x1_0000_0000; // 4 GiB
+  const entry = await zlib.ZipEntry.create('far.txt', Buffer.from('hello'), { method: 'store' });
+  const archive = await drain(zlib.createZipArchive([entry], { baseOffset: BASE }));
+  const central = archive.indexOf(CENTRAL_FILE_HEADER_SIGNATURE);
+  assert.notStrictEqual(central, -1);
+  assert.strictEqual(archive.readUInt16LE(central + 6), 45); // Version needed: Zip64
+  assert.strictEqual(archive.readUInt32LE(central + 42), 0xffffffff); // Offset sentinel
+  const nameLength = archive.readUInt16LE(central + 28);
+  const extraStart = central + 46 + nameLength;
+  assert.strictEqual(archive.readUInt16LE(extraStart), 0x0001);
+  assert.strictEqual(archive.readUInt16LE(extraStart + 2), 8);
+  assert.strictEqual(archive.readBigUInt64LE(extraStart + 4), BigInt(BASE));
+  // The trailer is promoted to Zip64 too: the directory offset overflows.
+  assert.notStrictEqual(archive.indexOf(Buffer.from([0x50, 0x4b, 0x06, 0x06])), -1);
+});
+
+test('extra fields that no longer fit their 16-bit length field are rejected on write', async () => {
+  const name = 'big-extra.txt';
+  const content = Buffer.from('hi');
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { method: 'store' })]);
+  // Give the entry a preserved (unknown-ID) extra field near the 65,535-byte
+  // cap; serializing it at an offset beyond 4 GiB must add a 12-byte Zip64
+  // record, pushing the total over the cap.
+  const filler = Buffer.allocUnsafe(4 + 65526);
+  filler.writeUInt16LE(0x9999, 0);
+  filler.writeUInt16LE(65526, 2);
+  filler.fill(0xab, 4);
+  const patched = injectCentralExtra(archive, name, content.length, filler);
+  const [read] = zlib.ZipEntry.read(patched);
+  await assert.rejects(
+    drain(zlib.createZipArchive([read], { baseOffset: 0x1_0000_0000 })),
+    { code: 'ERR_ZIP_ENTRY_TOO_LARGE', message: /extra fields/ });
+});
+
+// -- archive-end discovery edge cases --------------------------------------------
+
+test('a Zip64 EOCD record pushed out of the tail by its data sector is found by re-reading', async () => {
+  const PAD = 80000; // Larger than the fixed-size tail read
+  const record = Buffer.alloc(56 + PAD);
+  record.writeUInt32LE(0x06064b50, 0);
+  record.writeBigUInt64LE(BigInt(44 + PAD), 4); // Remainder size, incl. the sector
+  record.writeUInt16LE((3 << 8) | 45, 12);
+  record.writeUInt16LE(45, 14);
+  const locator = Buffer.alloc(20);
+  locator.writeUInt32LE(0x07064b50, 0);
+  locator.writeBigUInt64LE(0n, 8); // The record starts at offset 0
+  locator.writeUInt32LE(1, 16);
+  const comment = Buffer.from('sector');
+  const eocd = Buffer.alloc(22 + comment.length);
+  eocd.writeUInt32LE(0x06054b50, 0);
+  eocd.writeUInt32LE(0xffffffff, 12); // Size sentinel: the Zip64 record is required
+  eocd.writeUInt16LE(comment.length, 20);
+  comment.copy(eocd, 22);
+  const bytes = Buffer.concat([record, locator, eocd]);
+
+  // In one buffer the record is directly reachable...
+  assert.strictEqual(new zlib.ZipBuffer(bytes).size, 0);
+
+  // ...but a tail read must notice it starts before the tail and re-read.
+  const filePath = tmpdir.resolve('zip-coverage-sector.zip');
+  await fs.writeFile(filePath, bytes);
+  const zf = await zlib.ZipFile.open(filePath);
+  try {
+    assert.strictEqual(zf.size, 0);
+    assert.strictEqual(zf.comment, 'sector');
+  } finally {
+    await zf.close();
+  }
+  const zfSync = zlib.ZipFile.openSync(filePath);
+  try {
+    assert.strictEqual(zfSync.size, 0);
+  } finally {
+    zfSync.closeSync();
+  }
+  await fs.unlink(filePath);
+});
+
+test('a locator offset beyond the safe-integer range falls back to classic fields', () => {
+  const buf = buildMinimalZip64Archive({ locator: { recordOffset: 0xffffffffffffffffn } });
+  buf.writeUInt32LE(0xdeadbeef, 0); // Corrupt the record so only the fallback can succeed
+  assert.strictEqual([...zlib.ZipEntry.read(buf)].length, 0);
+});
+
+test('ZipFile rejects a central header on another disk', async () => {
+  const name = 'a.txt';
+  const content = Buffer.from('x');
+  const archive = Buffer.from(await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { method: 'store' })]));
+  const centralHeaderStart = 30 + name.length + content.length;
+  archive.writeUInt16LE(1, centralHeaderStart + 34); // Disk number
+  const filePath = tmpdir.resolve('zip-coverage-disk.zip');
+  await fs.writeFile(filePath, archive);
+  await assert.rejects(zlib.ZipFile.open(filePath), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+  assert.throws(() => zlib.ZipFile.openSync(filePath), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+  await fs.unlink(filePath);
+});
+
+test('zipFiles() keeps a directory mapping name that already ends in a slash', async () => {
+  const dir = tmpdir.resolve('zip-coverage-dir');
+  await fs.mkdir(dir, { recursive: true });
+  const archive = await drain(zlib.zipFiles([[dir, 'mapped/']]));
+  const [entry] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(entry.name, 'mapped/');
+  assert.strictEqual(entry.isDirectory, true);
+});
+
+test('a streamed entry with the store method round-trips', async () => {
+  async function* source() {
+    yield Buffer.from('stored ');
+    yield Buffer.from('stream');
+  }
+  const entry = zlib.ZipEntry.createStream('s.txt', source(), { method: 'store' });
+  const archive = await buildArchive([entry]);
+  const [read] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(read.method, 0);
+  assert.strictEqual((await read.content()).toString(), 'stored stream');
+});
+
+test('createSync() honors an explicit store method', () => {
+  const entry = zlib.ZipEntry.createSync('s.bin', Buffer.from([1, 2, 3]), { method: 'store' });
+  assert.strictEqual(entry.method, 0);
+  assert.strictEqual(entry.compressed, false);
+  assert.deepStrictEqual(entry.contentSync(), Buffer.from([1, 2, 3]));
+});
diff --git a/test/parallel/test-zlib-zip-edgecases.js b/test/parallel/test-zlib-zip-edgecases.js
new file mode 100644
index 000000000000..7d77a07ed6d0
--- /dev/null
+++ b/test/parallel/test-zlib-zip-edgecases.js
@@ -0,0 +1,188 @@
+'use strict';
+
+// Malformed / adversarial / boundary archives, drawn from the ZIP
+// parser-differential and torture-test literature (Go archive/zip testdata,
+// USENIX'25 semantic-gap paper, PyPI/uv ZIP-confusion advisories, Info-ZIP).
+// Node core does not extract to disk, so path-traversal safety is the caller's
+// job - these tests pin that our reader surfaces names verbatim and resolves
+// every ambiguity from the authoritative central directory.
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+const SIG_LOCAL = 0x04034b50;
+const SIG_CENTRAL = 0x02014b50;
+const SIG_EOCD = 0x06054b50;
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const c of zlib.createZipArchive(entries, comment)) chunks.push(c);
+  return Buffer.concat(chunks);
+}
+
+// One-entry (stored) archive with independent control of the local vs central
+// name, flags, method and sizes - the levers ZIP-confusion attacks pull.
+function buildEntryArchive(opts) {
+  const name = opts.nameBuffer;
+  const localName = opts.localNameBuffer ?? name;
+  const content = opts.content ?? Buffer.alloc(0);
+  const flags = opts.flags ?? 0;
+  const method = opts.method ?? 0;
+  const localExtra = opts.localExtra ?? Buffer.alloc(0);
+  const centralExtra = opts.centralExtra ?? Buffer.alloc(0);
+  const crc = zlib.crc32(content) >>> 0;
+
+  const local = Buffer.alloc(30);
+  local.writeUInt32LE(SIG_LOCAL, 0);
+  local.writeUInt16LE(20, 4);
+  local.writeUInt16LE(flags, 6);
+  local.writeUInt16LE(method, 8);
+  local.writeUInt16LE(0x21, 12);
+  local.writeUInt32LE(crc, 14);
+  local.writeUInt32LE(content.length, 18);
+  local.writeUInt32LE(content.length, 22);
+  local.writeUInt16LE(localName.length, 26);
+  local.writeUInt16LE(localExtra.length, 28);
+  const localRecord = Buffer.concat([local, localName, localExtra, content]);
+
+  const central = Buffer.alloc(46);
+  central.writeUInt32LE(SIG_CENTRAL, 0);
+  central.writeUInt16LE(0x0314, 4);
+  central.writeUInt16LE(20, 6);
+  central.writeUInt16LE(flags, 8);
+  central.writeUInt16LE(method, 10);
+  central.writeUInt16LE(0x21, 14);
+  central.writeUInt32LE(crc, 16);
+  central.writeUInt32LE(content.length, 20);
+  central.writeUInt32LE(content.length, 24);
+  central.writeUInt16LE(name.length, 28);
+  central.writeUInt16LE(centralExtra.length, 30);
+  central.writeUInt32LE(0, 42);
+  const centralRecord = Buffer.concat([central, name, centralExtra]);
+
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(SIG_EOCD, 0);
+  eocd.writeUInt16LE(1, 8);
+  eocd.writeUInt16LE(1, 10);
+  eocd.writeUInt32LE(centralRecord.length, 12);
+  eocd.writeUInt32LE(localRecord.length, 16);
+  return Buffer.concat([localRecord, centralRecord, eocd]);
+}
+
+// -- parser-confusion / semantic-gap defenses --------------------------------
+
+test('the central directory is authoritative when the local header disagrees', () => {
+  // Local header claims "fake.txt"; central directory says "real.txt".
+  const archive = buildEntryArchive({
+    nameBuffer: Buffer.from('real.txt'),
+    localNameBuffer: Buffer.from('fake.txt'),
+    content: Buffer.from('payload'),
+  });
+  const [entry] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(entry.name, 'real.txt');
+  assert.strictEqual(entry.contentSync().toString(), 'payload');
+});
+
+test('duplicate central-directory names: read() yields all, get() takes the last', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('dup.txt', Buffer.from('first')),
+    await zlib.ZipEntry.create('dup.txt', Buffer.from('second')),
+  ]);
+  assert.deepStrictEqual([...zlib.ZipEntry.read(archive)].map((e) => e.name), ['dup.txt', 'dup.txt']);
+  using zip = new zlib.ZipBuffer(archive);
+  assert.strictEqual(zip.size, 1);
+  assert.strictEqual(zip.get('dup.txt').contentSync().toString(), 'second');
+});
+
+test('path-unsafe names are surfaced verbatim, never normalized or rejected', () => {
+  for (const name of ['../../etc/passwd', '/etc/passwd', 'a\\b\\c.txt', 'C:\\evil.dll']) {
+    const [entry] = zlib.ZipEntry.read(buildEntryArchive({ nameBuffer: Buffer.from(name) }));
+    assert.strictEqual(entry.name, name);
+  }
+});
+
+// -- structural boundaries ----------------------------------------------------
+
+test('data prepended before the archive (SFX stub) is tolerated via prefix detection', async () => {
+  const inner = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('hello')),
+    await zlib.ZipEntry.create('b.txt', Buffer.from('world')),
+  ]);
+  const prefixed = Buffer.concat([Buffer.alloc(1000, 0x7f), inner]); // stub bytes
+  using zip = new zlib.ZipBuffer(prefixed);
+  assert.deepStrictEqual([...zip.keys()].sort(), ['a.txt', 'b.txt']);
+  assert.strictEqual(zip.get('a.txt').contentSync().toString(), 'hello');
+});
+
+test('an empty archive (EOCD only) reads as zero entries', () => {
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(SIG_EOCD, 0);
+  assert.deepStrictEqual([...zlib.ZipEntry.read(eocd)], []);
+  using zip = new zlib.ZipBuffer(eocd);
+  assert.strictEqual(zip.size, 0);
+});
+
+test('directory entries and zero-byte file entries round-trip', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('dir/', Buffer.alloc(0)),
+    await zlib.ZipEntry.create('empty.txt', Buffer.alloc(0)),
+  ]);
+  using zip = new zlib.ZipBuffer(archive);
+  assert.strictEqual(zip.get('dir/').isDirectory, true);
+  const empty = zip.get('empty.txt');
+  assert.strictEqual(empty.isDirectory, false);
+  assert.strictEqual(empty.contentSync().length, 0);
+  assert.strictEqual(empty.crc32, 0);
+});
+
+test('an archive comment at the maximum length (65535 bytes) round-trips', async () => {
+  const comment = 'z'.repeat(0xffff);
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))], comment);
+  using zip = new zlib.ZipBuffer(archive);
+  assert.strictEqual(zip.comment.length, 0xffff);
+  assert.strictEqual(zip.get('a.txt').contentSync().toString(), 'x');
+});
+
+// -- unsupported features are rejected, not misread --------------------------
+
+test('a traditional-encrypted entry (bit 0) is rejected', () => {
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({
+    nameBuffer: Buffer.from('f'),
+    content: Buffer.from('secret'),
+    flags: 0x0001,
+  }));
+  assert.throws(() => entry.contentSync(), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('a WinZip-AES entry (method 99, bit 0, 0x9901 extra) is rejected as encrypted', () => {
+  const aes = Buffer.concat([
+    Buffer.from([0x01, 0x99]),             // extra id 0x9901
+    Buffer.from([0x07, 0x00]),             // size 7
+    Buffer.from([0x01, 0x00]),             // AE-1 version
+    Buffer.from([0x41, 0x45]),             // "AE"
+    Buffer.from([0x03]),                   // AES-256
+    Buffer.from([0x00, 0x00]),             // Actual method (store)
+  ]);
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({
+    nameBuffer: Buffer.from('f'),
+    content: Buffer.from('cipher'),
+    flags: 0x0001,
+    method: 99,
+    centralExtra: aes,
+    localExtra: aes,
+  }));
+  assert.throws(() => entry.contentSync(), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('a Zip64 sentinel size with no Zip64 extra field is rejected', () => {
+  const archive = buildEntryArchive({ nameBuffer: Buffer.from('f'), content: Buffer.from('hi') });
+  // Force the central uncompressed-size field to the sentinel without adding a
+  // Zip64 extra field, so "look in the Zip64 record" points at nothing.
+  const cd = archive.readUInt32LE(archive.length - 22 + 16);
+  archive.writeUInt32LE(0xffffffff, cd + 24);
+  assert.throws(() => [...zlib.ZipEntry.read(archive)][0].size,
+                { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+});
diff --git a/test/parallel/test-zlib-zip-encoding.js b/test/parallel/test-zlib-zip-encoding.js
new file mode 100644
index 000000000000..f1091ac1f745
--- /dev/null
+++ b/test/parallel/test-zlib-zip-encoding.js
@@ -0,0 +1,244 @@
+'use strict';
+
+// Reading foreign-encoder edge cases faithfully: non-UTF-8 (CP437) and
+// Unicode-Path-extra filenames, raw name bytes, full Unix mode bits and
+// symlink type, and modification times carried in extra fields rather than
+// the coarse DOS date/time. These synthesize the exact header bytes real
+// tools (Windows Explorer, Info-ZIP, 7-Zip, WinRAR) emit, since our own
+// writer only ever produces UTF-8 names and DOS timestamps.
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+const SIG_LOCAL = 0x04034b50;
+const SIG_CENTRAL = 0x02014b50;
+const SIG_EOCD = 0x06054b50;
+
+// Build a minimal one-entry (stored) archive with full control over every
+// header field, so tests can reproduce exactly what a foreign encoder writes.
+function buildEntryArchive(opts) {
+  const name = opts.nameBuffer;
+  const content = opts.content ?? Buffer.alloc(0);
+  const flags = opts.flags ?? 0;
+  const localExtra = opts.localExtra ?? Buffer.alloc(0);
+  const centralExtra = opts.centralExtra ?? Buffer.alloc(0);
+  const external = (opts.externalAttrs ?? 0) >>> 0;
+  const versionMadeBy = opts.versionMadeBy ?? 0x0314; // host 3 (Unix), v2.0
+  const dosTime = opts.dosTime ?? 0;
+  const dosDate = opts.dosDate ?? 0x21; // 1980-01-01
+  const crc = zlib.crc32(content) >>> 0;
+
+  const local = Buffer.alloc(30);
+  local.writeUInt32LE(SIG_LOCAL, 0);
+  local.writeUInt16LE(20, 4);
+  local.writeUInt16LE(flags, 6);
+  local.writeUInt16LE(0, 8); // store
+  local.writeUInt16LE(dosTime, 10);
+  local.writeUInt16LE(dosDate, 12);
+  local.writeUInt32LE(crc, 14);
+  local.writeUInt32LE(content.length, 18);
+  local.writeUInt32LE(content.length, 22);
+  local.writeUInt16LE(name.length, 26);
+  local.writeUInt16LE(localExtra.length, 28);
+  const localRecord = Buffer.concat([local, name, localExtra, content]);
+
+  const central = Buffer.alloc(46);
+  central.writeUInt32LE(SIG_CENTRAL, 0);
+  central.writeUInt16LE(versionMadeBy, 4);
+  central.writeUInt16LE(20, 6);
+  central.writeUInt16LE(flags, 8);
+  central.writeUInt16LE(0, 10);
+  central.writeUInt16LE(dosTime, 12);
+  central.writeUInt16LE(dosDate, 14);
+  central.writeUInt32LE(crc, 16);
+  central.writeUInt32LE(content.length, 20);
+  central.writeUInt32LE(content.length, 24);
+  central.writeUInt16LE(name.length, 28);
+  central.writeUInt16LE(centralExtra.length, 30);
+  central.writeUInt16LE(0, 32); // comment length
+  central.writeUInt16LE(0, 34);
+  central.writeUInt16LE(0, 36);
+  central.writeUInt32LE(external, 38);
+  central.writeUInt32LE(0, 42); // local header offset
+  const centralRecord = Buffer.concat([central, name, centralExtra]);
+
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(SIG_EOCD, 0);
+  eocd.writeUInt16LE(1, 8);
+  eocd.writeUInt16LE(1, 10);
+  eocd.writeUInt32LE(centralRecord.length, 12);
+  eocd.writeUInt32LE(localRecord.length, 16);
+  return Buffer.concat([localRecord, centralRecord, eocd]);
+}
+
+// -- filename encoding --------------------------------------------------------
+
+test('a bit-11-clear name is decoded as CP437, not mangled as UTF-8', () => {
+  // 0x81 is "ü" in CP437; as a lone UTF-8 byte it is invalid (would be U+FFFD).
+  const nameBuffer = Buffer.from([0x63, 0x61, 0x66, 0x81]); // "caf" + ü
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({ nameBuffer }));
+  assert.strictEqual(entry.name, 'cafü');
+  assert.deepStrictEqual(entry.nameBuffer, nameBuffer);
+});
+
+test('a bit-11-set name is decoded as UTF-8, with raw bytes on nameBuffer', () => {
+  const nameBuffer = Buffer.from('café-名前.txt', 'utf8');
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({ nameBuffer, flags: 0x0800 }));
+  assert.strictEqual(entry.name, 'café-名前.txt');
+  assert.deepStrictEqual(entry.nameBuffer, nameBuffer);
+});
+
+test('a valid Unicode Path extra field (0x7075) overrides the CP437 name', () => {
+  const cp437Name = Buffer.from([0x63, 0x61, 0x66, 0x81]); // "cafü" in CP437
+  const utf8 = Buffer.from('café.txt', 'utf8');
+  const up = Buffer.concat([
+    Buffer.from([0x75, 0x70]),                 // id 0x7075
+    (() => { const b = Buffer.alloc(2); b.writeUInt16LE(5 + utf8.length, 0); return b; })(),
+    Buffer.from([0x01]),                       // version 1
+    (() => { const b = Buffer.alloc(4); b.writeUInt32LE(zlib.crc32(cp437Name) >>> 0, 0); return b; })(),
+    utf8,
+  ]);
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({ nameBuffer: cp437Name, centralExtra: up }));
+  assert.strictEqual(entry.name, 'café.txt');
+});
+
+test('a Unicode Path extra field with a stale CRC is ignored (falls back to CP437)', () => {
+  const cp437Name = Buffer.from([0x63, 0x61, 0x66, 0x81]);
+  const utf8 = Buffer.from('renamed.txt', 'utf8');
+  const up = Buffer.concat([
+    Buffer.from([0x75, 0x70]),
+    (() => { const b = Buffer.alloc(2); b.writeUInt16LE(5 + utf8.length, 0); return b; })(),
+    Buffer.from([0x01]),
+    Buffer.from([0xde, 0xad, 0xbe, 0xef]),     // wrong CRC of the standard name
+    utf8,
+  ]);
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({ nameBuffer: cp437Name, centralExtra: up }));
+  assert.strictEqual(entry.name, 'cafü'); // stale extra ignored
+});
+
+test('ZipBuffer.get() keys by the decoded (CP437) name', () => {
+  const nameBuffer = Buffer.from([0x81, 0x2e, 0x74, 0x78, 0x74]); // "ü.txt"
+  using zip = new zlib.ZipBuffer(buildEntryArchive({ nameBuffer, content: Buffer.from('x') }));
+  assert.strictEqual(zip.has('ü.txt'), true);
+  assert.strictEqual(zip.get('ü.txt').contentSync().toString(), 'x');
+});
+
+// -- Unix mode + symlink ------------------------------------------------------
+
+test('setuid/setgid/sticky bits round-trip through a read', async () => {
+  for (const mode of [0o4755, 0o2750, 0o1777, 0o755, 0o640]) {
+    const entry = await zlib.ZipEntry.create('f', Buffer.from('x'), { mode });
+    const chunks = [];
+    for await (const c of zlib.createZipArchive([entry])) chunks.push(c);
+    const [read] = zlib.ZipEntry.read(Buffer.concat(chunks));
+    assert.strictEqual(read.mode, mode, `0o${mode.toString(8)} -> 0o${read.mode.toString(8)}`);
+  }
+});
+
+test('a symlink entry is reported as a symlink, not a file', () => {
+  const target = Buffer.from('../target');
+  const S_IFLNK = 0o120000;
+  const archive = buildEntryArchive({
+    nameBuffer: Buffer.from('link'),
+    content: target,
+    externalAttrs: ((S_IFLNK | 0o777) << 16) >>> 0,
+  });
+  const [entry] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(entry.isSymlink, true);
+  assert.strictEqual(entry.isFile, false);
+  assert.strictEqual(entry.isDirectory, false);
+  assert.strictEqual(entry.mode, 0o777);
+  assert.strictEqual(entry.contentSync().toString(), '../target');
+});
+
+test('external attributes from a non-Unix host expose no mode and no symlink', () => {
+  const S_IFLNK = 0o120000;
+  const archive = buildEntryArchive({
+    nameBuffer: Buffer.from('x'),
+    externalAttrs: ((S_IFLNK | 0o777) << 16) >>> 0, // Looks like a symlink...
+    versionMadeBy: 0x0014, // ...but host 0 (FAT/DOS), so not Unix mode
+  });
+  const [entry] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(entry.mode, 0);
+  assert.strictEqual(entry.isSymlink, false);
+});
+
+// -- modification time from extra fields --------------------------------------
+
+// 2017-10-31T21:11:57Z, deliberately not representable in the 2-second DOS
+// field so an extra-field time can be told apart from the DOS fallback.
+const MTIME_SECS = 1509484317;
+
+function extField(id, body) {
+  const head = Buffer.alloc(4);
+  head.writeUInt16LE(id, 0);
+  head.writeUInt16LE(body.length, 2);
+  return Buffer.concat([head, body]);
+}
+
+test('the extended-timestamp extra field (0x5455) sets the modification time', () => {
+  const body = Buffer.alloc(5);
+  body.writeUInt8(0x01, 0); // mtime present
+  body.writeInt32LE(MTIME_SECS, 1);
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({
+    nameBuffer: Buffer.from('f'),
+    centralExtra: extField(0x5455, body),
+    dosDate: 0x4a21, // A different (2017) DOS date, to prove the extra wins
+  }));
+  assert.strictEqual(entry.modified.getTime(), MTIME_SECS * 1000);
+});
+
+test('the NTFS extra field (0x000a) sets a high-resolution modification time', () => {
+  const ns100 = (BigInt(MTIME_SECS) + 11644473600n) * 10000000n;
+  const times = Buffer.alloc(24);
+  times.writeBigUInt64LE(ns100, 0);  // mtime
+  times.writeBigUInt64LE(ns100, 8);  // atime
+  times.writeBigUInt64LE(ns100, 16); // ctime
+  const body = Buffer.concat([
+    Buffer.alloc(4),               // reserved
+    extField(0x0001, times),       // attribute tag 1
+  ]);
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({
+    nameBuffer: Buffer.from('f'),
+    localExtra: extField(0x000a, body), // NTFS times live in the local header
+  }));
+  assert.strictEqual(entry.modified.getTime(), MTIME_SECS * 1000);
+});
+
+test('the Info-ZIP Unix extra field (0x5855) sets the modification time', () => {
+  const body = Buffer.alloc(8);
+  body.writeInt32LE(1, 0);          // atime
+  body.writeInt32LE(MTIME_SECS, 4); // mtime
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({
+    nameBuffer: Buffer.from('f'),
+    centralExtra: extField(0x5855, body),
+  }));
+  assert.strictEqual(entry.modified.getTime(), MTIME_SECS * 1000);
+});
+
+test('NTFS time is preferred over the extended timestamp when both are present', () => {
+  const extBody = Buffer.alloc(5);
+  extBody.writeUInt8(0x01, 0);
+  extBody.writeInt32LE(MTIME_SECS - 3600, 1); // an hour earlier
+  const ns100 = (BigInt(MTIME_SECS) + 11644473600n) * 10000000n;
+  const times = Buffer.alloc(24);
+  times.writeBigUInt64LE(ns100, 0);
+  const ntfsBody = Buffer.concat([Buffer.alloc(4), extField(0x0001, times)]);
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({
+    nameBuffer: Buffer.from('f'),
+    localExtra: Buffer.concat([extField(0x000a, ntfsBody), extField(0x5455, extBody)]),
+  }));
+  assert.strictEqual(entry.modified.getTime(), MTIME_SECS * 1000);
+});
+
+test('with no timestamp extra field the DOS date/time is used', () => {
+  // DOS date 0x4f21 = year 1980+((0x4f21>>9)&0x7f)=1980+39=2019, month 1, day 1.
+  const [entry] = zlib.ZipEntry.read(buildEntryArchive({
+    nameBuffer: Buffer.from('f'),
+    dosDate: 0x4f21,
+  }));
+  assert.strictEqual(entry.modified.getFullYear(), 2019);
+});
diff --git a/test/parallel/test-zlib-zip-experimental-warning.js b/test/parallel/test-zlib-zip-experimental-warning.js
new file mode 100644
index 000000000000..021b8360c136
--- /dev/null
+++ b/test/parallel/test-zlib-zip-experimental-warning.js
@@ -0,0 +1,59 @@
+'use strict';
+
+// The zlib ZIP archive API is experimental and must warn when it is *used*,
+// but importing or requiring node:zlib - or merely accessing a ZIP export,
+// as the ESM loader does when building its named-export bindings - must not
+// warn. See lib/zlib.js.
+
+require('../common');
+
+const assert = require('node:assert');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const WARNING = /ExperimentalWarning: The zlib ZIP archive API/;
+
+function run(...args) {
+  return spawnSync(process.execPath, args, { encoding: 'utf8' });
+}
+
+test('importing node:zlib (ESM) does not emit the ZIP experimental warning', () => {
+  const src = "import 'node:zlib';\n" +
+    "import { ZipFile, ZipBuffer, createZipArchive } from 'node:zlib';\n" +
+    'void ZipFile; void ZipBuffer; void createZipArchive;';
+  const r = run('--input-type=module', '-e', src);
+  assert.strictEqual(r.status, 0, r.stderr);
+  assert.doesNotMatch(r.stderr, WARNING);
+});
+
+test('requiring node:zlib and only reading ZIP exports does not warn', () => {
+  const src = "const z = require('zlib');\n" +
+    'void z.ZipFile; void z.ZipEntry; void z.ZipBuffer; void z.createZipArchive;\n' +
+    'void ({} instanceof z.ZipBuffer);'; // The instanceof check must not warn.
+  const r = run('-e', src);
+  assert.strictEqual(r.status, 0, r.stderr);
+  assert.doesNotMatch(r.stderr, WARNING);
+});
+
+test('using a ZIP export emits the experimental warning (CJS)', () => {
+  const r = run('-e', "require('zlib').createZipArchive([]);");
+  assert.strictEqual(r.status, 0, r.stderr);
+  assert.match(r.stderr, WARNING);
+});
+
+test('using a ZIP export emits the experimental warning (ESM)', () => {
+  const src = "import { createZipArchive } from 'node:zlib';\ncreateZipArchive([]);";
+  const r = run('--input-type=module', '-e', src);
+  assert.strictEqual(r.status, 0, r.stderr);
+  assert.match(r.stderr, WARNING);
+});
+
+test('instanceof against the public ZIP classes still matches real instances', () => {
+  const src = "const z = require('zlib');\n" +
+    'const bytes = Buffer.concat([...z.createZipArchiveSync([])]);\n' +
+    'const buf = new z.ZipBuffer(bytes);\n' +
+    'console.log(buf instanceof z.ZipBuffer, typeof z.ZipFile, z.ZipFile.name);';
+  const r = run('-e', src);
+  assert.strictEqual(r.status, 0, r.stderr);
+  assert.match(r.stdout, /^true function ZipFile$/m);
+});
diff --git a/test/parallel/test-zlib-zip-files.js b/test/parallel/test-zlib-zip-files.js
new file mode 100644
index 000000000000..0c4ed6efe88a
--- /dev/null
+++ b/test/parallel/test-zlib-zip-files.js
@@ -0,0 +1,240 @@
+'use strict';
+
+// zlib.zipFiles(): build an archive from files on disk, capturing each file's
+// mode and modification time, streaming regular-file contents, and either
+// following symlinks (default) or storing them as symlink entries.
+
+const common = require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const tmpdir = require('../common/tmpdir');
+const path = require('node:path');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+async function collect(readable) {
+  const chunks = [];
+  for await (const chunk of readable) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+// Disposal of a streaming source completes asynchronously - its descriptor is
+// closed on the libuv threadpool - and an abandoned archive tears its queued
+// sources down one after another, each waiting on the previous close. So the
+// moment "every source is destroyed" can trail the destroy() call, arbitrarily
+// far on a loaded machine. Wait for that real end state rather than assuming a
+// fixed delay has been long enough.
+async function waitForAllDestroyed(streams) {
+  const deadline = Date.now() + common.platformTimeout(5000);
+  while (streams.some((s) => !s.destroyed) && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+}
+
+// Write `count` throwaway files and return streaming entries backed by their
+// (eagerly opened) read streams, so a test can observe whether each source is
+// destroyed. The worst case for leaks: every descriptor is open before the
+// archive starts.
+async function streamingEntries(count) {
+  const dir = await fsp.mkdtemp(path.join(tmpdir.path, 'zlib-zip-dispose-'));
+  const streams = [];
+  const entries = [];
+  for (let i = 0; i < count; i++) {
+    const p = path.join(dir, `f${i}.bin`);
+    await fsp.writeFile(p, Buffer.alloc(1024 * 1024, i));
+    const stream = fs.createReadStream(p);
+    streams.push(stream);
+    entries.push(zlib.ZipEntry.createStream(`f${i}.bin`, stream, { method: 'store' }));
+  }
+  return { dir, streams, entries };
+}
+
+async function makeTree() {
+  const dir = await fsp.mkdtemp(path.join(tmpdir.path, 'zlib-zipfiles-'));
+  await fsp.writeFile(path.join(dir, 'a.txt'), 'alpha');
+  await fsp.chmod(path.join(dir, 'a.txt'), 0o640);
+  await fsp.mkdir(path.join(dir, 'sub'));
+  await fsp.writeFile(path.join(dir, 'sub', 'b.bin'), Buffer.from([1, 2, 3, 4]));
+  return dir;
+}
+
+test('zipFiles archives files, directories, contents and Unix mode from disk', async () => {
+  const dir = await makeTree();
+  try {
+    const files = [
+      [path.join(dir, 'a.txt'), 'a.txt'],
+      [path.join(dir, 'sub'), 'sub'],
+      [path.join(dir, 'sub', 'b.bin'), 'nested/b.bin'],
+    ];
+    using zip = new zlib.ZipBuffer(await collect(zlib.zipFiles(files)));
+    assert.deepStrictEqual([...zip.keys()].sort(), ['a.txt', 'nested/b.bin', 'sub/']);
+    assert.strictEqual(zip.get('a.txt').contentSync().toString(), 'alpha');
+    // Windows has no POSIX permission bits (chmod only toggles read-only, and
+    // stat reports 0o666), so the exact captured mode is Unix-specific.
+    if (!common.isWindows) {
+      assert.strictEqual(zip.get('a.txt').mode, 0o640);
+    }
+    assert.strictEqual(zip.get('sub/').isDirectory, true);
+    assert.deepStrictEqual([...zip.get('nested/b.bin').contentSync()], [1, 2, 3, 4]);
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('zipFiles accepts any iterable of [path, name] (array, Map, Object.entries)', async () => {
+  const dir = await makeTree();
+  try {
+    const p = path.join(dir, 'a.txt');
+    const inputs = [
+      [[p, 'a.txt']],                       // array of pairs
+      new Map([[p, 'a.txt']]),              // Map
+      Object.entries({ [p]: 'a.txt' }),     // Object.entries
+    ];
+    for (const files of inputs) {
+      using zip = new zlib.ZipBuffer(await collect(zlib.zipFiles(files)));
+      assert.strictEqual(zip.get('a.txt').contentSync().toString(), 'alpha');
+    }
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('zipFiles preserves a sub-second modification time via an extra field', async () => {
+  const dir = await makeTree();
+  try {
+    const p = path.join(dir, 'a.txt');
+    // 1-second-and-a-half past an epoch second, so the DOS field alone can't
+    // represent it and the extended-timestamp extra field is what carries it.
+    const when = new Date(1700000000500);
+    await fsp.utimes(p, when, when);
+    using zip = new zlib.ZipBuffer(await collect(zlib.zipFiles([[p, 'a.txt']])));
+    assert.strictEqual(zip.get('a.txt').modified.getTime(), 1700000000000);
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('zipFiles follows symlinks by default, or stores them when disabled', {
+  skip: !common.canCreateSymLink() && 'insufficient privileges to create symlinks',
+}, async () => {
+  const dir = await makeTree();
+  try {
+    await fsp.symlink('a.txt', path.join(dir, 'link'));
+    const files = [[path.join(dir, 'link'), 'link']];
+
+    // Default: the link is resolved and archived as the target file.
+    using followed = new zlib.ZipBuffer(await collect(zlib.zipFiles(files)));
+    assert.strictEqual(followed.get('link').isSymlink, false);
+    assert.strictEqual(followed.get('link').isFile, true);
+    assert.strictEqual(followed.get('link').contentSync().toString(), 'alpha');
+
+    // followSymlinks: false: the link itself becomes a symlink entry.
+    using stored = new zlib.ZipBuffer(await collect(zlib.zipFiles(files, { followSymlinks: false })));
+    const link = stored.get('link');
+    assert.strictEqual(link.isSymlink, true);
+    assert.strictEqual(link.isFile, false);
+    assert.strictEqual(link.contentSync().toString(), 'a.txt');
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('zipFiles rejects when a listed path does not exist', async () => {
+  const dir = await makeTree();
+  try {
+    await assert.rejects(collect(zlib.zipFiles([[path.join(dir, 'missing'), 'x']])),
+                         { code: 'ENOENT' });
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+// -- entry ownership and disposal ----------------------------------------------
+
+test('an abandoned createZipArchive() destroys the sources of entries it never reached', async () => {
+  const { dir, streams, entries } = await streamingEntries(5);
+  try {
+    const archive = zlib.createZipArchive(entries);
+    archive.on('error', () => {});
+    let seen = 0;
+    for await (const chunk of archive) {
+      seen += chunk.length;
+      if (seen > 256 * 1024) break; // Bail while still inside the first member
+    }
+    archive.destroy();
+    await waitForAllDestroyed(streams);
+    const open = streams.filter((s) => !s.destroyed);
+    assert.strictEqual(open.length, 0, `${open.length} source streams left open`);
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('a fully consumed archive leaves a valid result and ends every source', async () => {
+  const { dir, streams, entries } = await streamingEntries(4);
+  try {
+    const archive = Buffer.concat(await (async () => {
+      const chunks = [];
+      for await (const chunk of zlib.createZipArchive(entries)) chunks.push(chunk);
+      return chunks;
+    })());
+    using zip = new zlib.ZipBuffer(archive);
+    assert.strictEqual(zip.size, 4);
+    assert.strictEqual((await zip.get('f2.bin').content()).length, 1024 * 1024);
+    assert.strictEqual(streams.filter((s) => !s.destroyed).length, 0);
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('zipEntry disposal destroys a streaming source, sync and async', async () => {
+  const { dir, streams, entries } = await streamingEntries(2);
+  try {
+    entries[0][Symbol.dispose]();
+    await entries[1][Symbol.asyncDispose]();
+    await waitForAllDestroyed(streams);
+    assert.strictEqual(streams[0].destroyed, true);
+    assert.strictEqual(streams[1].destroyed, true);
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('disposing an in-memory or file-backed entry is a harmless no-op', async () => {
+  const mem = await zlib.ZipEntry.create('m.txt', Buffer.from('keep me'));
+  mem[Symbol.dispose]();
+  await mem[Symbol.asyncDispose]();
+  assert.deepStrictEqual(await mem.content(), Buffer.from('keep me'));
+
+  // A file-backed entry borrows the ZipFile's descriptor; disposing it must
+  // not close that descriptor.
+  const dir = await fsp.mkdtemp(path.join(tmpdir.path, 'zlib-zip-dispose-fb-'));
+  const archivePath = path.join(dir, 'a.zip');
+  try {
+    await fsp.writeFile(archivePath, await collect(zlib.createZipArchive(
+      [await zlib.ZipEntry.create('a.txt', Buffer.from('hello'))])));
+    using zf = await zlib.ZipFile.open(archivePath);
+    const entry = await zf.get('a.txt');
+    entry[Symbol.dispose]();
+    assert.strictEqual((await entry.content()).toString(), 'hello');
+    assert.strictEqual((await (await zf.get('a.txt')).content()).toString(), 'hello');
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('createZipArchiveSync() throws on a streaming entry and disposes the rest', async () => {
+  const { dir, streams, entries } = await streamingEntries(3);
+  try {
+    assert.throws(() => Array.from(zlib.createZipArchiveSync(entries)),
+                  { code: 'ERR_INVALID_STATE' });
+    await waitForAllDestroyed(streams);
+    assert.strictEqual(streams.filter((s) => !s.destroyed).length, 0);
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
diff --git a/test/parallel/test-zlib-zip-fuzz.js b/test/parallel/test-zlib-zip-fuzz.js
new file mode 100644
index 000000000000..3b45f7af7dce
--- /dev/null
+++ b/test/parallel/test-zlib-zip-fuzz.js
@@ -0,0 +1,85 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+function mulberry32(seed) {
+  let state = seed >>> 0;
+  return function() {
+    state = (state + 0x6d2b79f5) >>> 0;
+    let t = state;
+    t = Math.imul(t ^ (t >>> 15), t | 1);
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+async function buildSeedArchive() {
+  const entries = [
+    await zlib.ZipEntry.create('hello.txt', Buffer.from('Hello, world!'.repeat(30))),
+    await zlib.ZipEntry.create('raw.bin', Buffer.from([1, 2, 3, 4, 5]), { method: 'store' }),
+    await zlib.ZipEntry.create('empty/', Buffer.alloc(0)),
+  ];
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, 'seed archive')) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+function mutate(random, seed) {
+  const buf = Buffer.from(seed);
+  const kind = Math.floor(random() * 4);
+  if (kind === 0) {
+    // Flip a handful of random bits.
+    const flips = 1 + Math.floor(random() * 8);
+    for (let i = 0; i < flips; i++) {
+      buf[Math.floor(random() * buf.length)] ^= 1 << Math.floor(random() * 8);
+    }
+  } else if (kind === 1) {
+    // Overwrite a random window with boundary-ish values.
+    const boundary = [0x00, 0xff, 0x50, 0x4b][Math.floor(random() * 4)];
+    const start = Math.floor(random() * buf.length);
+    const len = Math.min(buf.length - start, 1 + Math.floor(random() * 8));
+    buf.fill(boundary, start, start + len);
+  } else if (kind === 2) {
+    // Truncate.
+    return buf.subarray(0, Math.floor(random() * buf.length));
+  } else {
+    // Extend with random padding.
+    const pad = Buffer.allocUnsafe(1 + Math.floor(random() * 16));
+    for (let i = 0; i < pad.length; i++) pad[i] = Math.floor(random() * 256);
+    return Buffer.concat([buf, pad]);
+  }
+  return buf;
+}
+
+test('the parser only ever throws Error on mutated archives, never crashes or hangs', async () => {
+  const seed = await buildSeedArchive();
+  const random = mulberry32(0x5EED1234);
+  const iterations = 3000;
+
+  for (let i = 0; i < iterations; i++) {
+    const candidate = mutate(random, seed);
+    try {
+      const entries = [...zlib.ZipEntry.read(candidate)];
+      for (const entry of entries) {
+        try {
+          await entry.content();
+        } catch (err) {
+          assert.ok(err instanceof Error, `content() threw non-Error: ${err}`);
+        }
+      }
+    } catch (err) {
+      assert.ok(err instanceof Error, `read() threw non-Error: ${err}`);
+    }
+
+    try {
+      using zipBuffer = new zlib.ZipBuffer(candidate);
+      assert.ok(zipBuffer.size >= 0);
+    } catch (err) {
+      assert.ok(err instanceof Error, `ZipBuffer threw non-Error: ${err}`);
+    }
+  }
+}, { timeout: 60_000 });
diff --git a/test/parallel/test-zlib-zip-hardening.js b/test/parallel/test-zlib-zip-hardening.js
new file mode 100644
index 000000000000..de2a9efd4918
--- /dev/null
+++ b/test/parallel/test-zlib-zip-hardening.js
@@ -0,0 +1,376 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+function buildEocd({ diskNumber = 0, cdDiskNumber = 0, cdDiskRecords = 0,
+                     totalRecords = 0, cdSize = 0, cdOffset = 0, comment = Buffer.alloc(0) } = {}) {
+  const buf = Buffer.allocUnsafe(22 + comment.length);
+  buf.writeUInt32LE(0x06054b50, 0);
+  buf.writeUInt16LE(diskNumber, 4);
+  buf.writeUInt16LE(cdDiskNumber, 6);
+  buf.writeUInt16LE(cdDiskRecords, 8);
+  buf.writeUInt16LE(totalRecords, 10);
+  buf.writeUInt32LE(cdSize, 12);
+  buf.writeUInt32LE(cdOffset, 16);
+  buf.writeUInt16LE(comment.length, 20);
+  comment.copy(buf, 22);
+  return buf;
+}
+
+test('an empty or tiny buffer is rejected as an invalid archive', () => {
+  for (const buf of [Buffer.alloc(0), Buffer.alloc(10), Buffer.from('not a zip')]) {
+    assert.throws(() => [...zlib.ZipEntry.read(buf)], { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+  }
+});
+
+test('garbage or truncated data is rejected', () => {
+  const garbage = Buffer.alloc(100, 0x41);
+  assert.throws(() => [...zlib.ZipEntry.read(garbage)], { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+
+  const truncated = buildEocd({ totalRecords: 5, cdSize: 46 * 5 }).subarray(0, 10);
+  assert.throws(() => [...zlib.ZipEntry.read(truncated)], { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+});
+
+test('an EOCD-looking signature inside a trailing comment is not mistaken for the real one', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' });
+  // The comment scan walks backward through the trailing comment bytes
+  // before it reaches the genuine EOCD signature; embedding 4 bytes that
+  // look like one partway through must not be mistaken for the real record.
+  const fakeSignature = String.fromCharCode(0x50, 0x4b, 0x05, 0x06);
+  const archive = await buildArchive([entry], `before ${fakeSignature} after`);
+
+  const read = [...zlib.ZipEntry.read(archive)];
+  assert.strictEqual(read.length, 1);
+  assert.strictEqual(read[0].name, 'f.txt');
+});
+
+test('a declared-size mismatch is rejected as corrupt', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' });
+  const archive = await buildArchive([entry]);
+
+  // Shrink the *declared* uncompressed size in the central directory record
+  // without touching the stored bytes themselves, so the amount of data
+  // produced no longer matches what the header promised.
+  const tampered = Buffer.from(archive);
+  const centralHeaderStart = 30 + 'f.txt'.length + 'hello world'.length;
+  const uncompressedSizeOffset = centralHeaderStart + 24;
+  tampered.writeUInt32LE(1, uncompressedSizeOffset);
+
+  const [tamperedEntry] = zlib.ZipEntry.read(tampered);
+  assert.strictEqual(tamperedEntry.size, 1);
+  await assert.rejects(tamperedEntry.content(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+});
+
+test('CRC-32 verification catches a single flipped byte, and can be disabled', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' });
+  const archive = await buildArchive([entry]);
+  const tampered = Buffer.from(archive);
+  const contentStart = 30 + 'f.txt'.length;
+  tampered[contentStart] ^= 0xff;
+
+  const [tamperedEntry] = zlib.ZipEntry.read(tampered);
+  await assert.rejects(tamperedEntry.content(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+  const unverified = await tamperedEntry.content({ verify: false });
+  assert.strictEqual(unverified.length, 'hello world'.length);
+});
+
+test('content() enforces maxSize before allocating', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'));
+  await assert.rejects(entry.content({ maxSize: 1 }), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+});
+
+test('a forged small header whose content inflates past its declared size is rejected', async () => {
+  // The up-front maxSize check trusts the declared size, so a bomb forges a
+  // tiny declared size to clear it; the decompressor's maxOutputLength
+  // backstop is capped at declared + 1 bytes, so the lie is caught (as
+  // corruption - the declared size is provably wrong) without ever
+  // materializing more than the declared size, no matter how large maxSize
+  // is.
+  for (const { method, re } of [
+    { method: 'deflate', re: /inflates beyond its declared size/ },
+    { method: 'zstd', re: /decompresses beyond its declared size/ },
+  ]) {
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('x'.repeat(5000)), { method });
+    const archive = await buildArchive([entry]);
+    const tampered = Buffer.from(archive);
+    const eocd = tampered.length - 22; // No comment, so EOCD is the last 22 bytes
+    const cdOffset = tampered.readUInt32LE(eocd + 16);
+    tampered.writeUInt32LE(50, cdOffset + 24); // Forge declared uncompressedSize
+
+    const [e] = zlib.ZipEntry.read(tampered);
+    assert.strictEqual(e.size, 50); // 50 <= maxSize 100 clears the up-front check
+    await assert.rejects(e.content({ maxSize: 100 }), { code: 'ERR_ZIP_ENTRY_CORRUPT', message: re });
+    assert.throws(() => e.contentSync({ maxSize: 100 }), { code: 'ERR_ZIP_ENTRY_CORRUPT', message: re });
+  }
+});
+
+test('getMaxZipContentSize()/setMaxZipContentSize() control the default guard', async () => {
+  const original = zlib.getMaxZipContentSize();
+  try {
+    zlib.setMaxZipContentSize(1);
+    const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'));
+    await assert.rejects(entry.content(), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+  } finally {
+    zlib.setMaxZipContentSize(original);
+  }
+  assert.strictEqual(zlib.getMaxZipContentSize(), original);
+});
+
+test('streaming a partially-consumed entry does not hang or leak', async () => {
+  async function* source() {
+    for (let i = 0; i < 1000; i++) {
+      yield Buffer.alloc(1024, i & 0xff);
+    }
+  }
+  const entry = zlib.ZipEntry.createStream('big.bin', source());
+  let count = 0;
+  let bytesSeen = 0;
+  for await (const chunk of entry) {
+    count++;
+    bytesSeen += chunk.length;
+    if (count > 2) break;
+  }
+  assert.ok(count > 2);
+  assert.ok(bytesSeen > 0);
+});
+
+test('an overlong file name is rejected', async () => {
+  await assert.rejects(
+    zlib.ZipEntry.create('x'.repeat(70000), Buffer.alloc(0)),
+    { code: 'ERR_ZIP_ENTRY_TOO_LARGE' },
+  );
+});
+
+test('an empty file name is rejected', async () => {
+  await assert.rejects(
+    zlib.ZipEntry.create('', Buffer.alloc(0)),
+    { code: 'ERR_INVALID_ARG_VALUE' },
+  );
+});
+
+test('a multi-disk archive is rejected', () => {
+  const eocd = buildEocd({ diskNumber: 1, cdDiskNumber: 1 });
+  assert.throws(() => [...zlib.ZipEntry.read(eocd)], { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('an encrypted entry is rejected', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('secret'), { method: 'store' });
+  const archive = await buildArchive([entry]);
+  // Set the encrypted bit (bit 0) in both the local and central header flags.
+  const tampered = Buffer.from(archive);
+  const localFlagsOffset = 6;
+  tampered.writeUInt16LE(tampered.readUInt16LE(localFlagsOffset) | 0x0001, localFlagsOffset);
+  const centralHeaderStart = 30 + 'f.txt'.length + 'secret'.length;
+  const centralFlagsOffset = centralHeaderStart + 8;
+  tampered.writeUInt16LE(tampered.readUInt16LE(centralFlagsOffset) | 0x0001, centralFlagsOffset);
+
+  const [tamperedEntry] = zlib.ZipEntry.read(tampered);
+  await assert.rejects(tamperedEntry.content(), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+test('an entry using an unsupported compression method is rejected', async () => {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' });
+  const archive = await buildArchive([entry]);
+  // Set the method to 1 (Shrunk), which this implementation does not support,
+  // in both the local and central headers.
+  const tampered = Buffer.from(archive);
+  const localMethodOffset = 8;
+  tampered.writeUInt16LE(1, localMethodOffset);
+  const centralHeaderStart = 30 + 'f.txt'.length + 'hi'.length;
+  const centralMethodOffset = centralHeaderStart + 10;
+  tampered.writeUInt16LE(1, centralMethodOffset);
+
+  const [tamperedEntry] = zlib.ZipEntry.read(tampered);
+  assert.strictEqual(tamperedEntry.method, 1);
+  await assert.rejects(tamperedEntry.content(), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+  assert.throws(() => tamperedEntry.contentSync(), { code: 'ERR_ZIP_UNSUPPORTED_FEATURE' });
+});
+
+// -- shapes borrowed from CPython's zipfile test corpus (synthesized bytes) ------
+
+test('every possible truncation of an archive is rejected, deterministically', async () => {
+  // CPython's test_damaged_zipfile: any prefix of a valid archive must fail
+  // cleanly (never succeed, never throw a non-Error). The fuzz test samples
+  // truncation points randomly; this pins all of them for a small archive.
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' })]);
+  for (let n = 0; n < archive.length; n++) {
+    assert.throws(() => [...zlib.ZipEntry.read(archive.subarray(0, n))],
+                  { code: /^ERR_ZIP_/ }, `truncation at ${n} bytes`);
+  }
+});
+
+test('trailing padding after the EOCD is tolerated', async () => {
+  // Some streaming writers pad their output to a block size; CPython
+  // tolerates trailing newlines/NULs and so does the pass-2 EOCD scan.
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' })]);
+  const padded = Buffer.concat([archive, Buffer.from('\r\n\0\0\0')]);
+  const [entry] = zlib.ZipEntry.read(padded);
+  assert.strictEqual(entry.name, 'f.txt');
+  assert.strictEqual((await entry.content()).toString(), 'hi');
+});
+
+test('junk appended past a declared comment is tolerated and the comment preserved', async () => {
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' })],
+    'this is a comment');
+  const appended = Buffer.concat([archive, Buffer.from('abcdef\r\n')]);
+  const zip = new zlib.ZipBuffer(appended);
+  assert.strictEqual(zip.comment, 'this is a comment');
+  assert.strictEqual(zip.get('f.txt').contentSync().toString(), 'hi');
+});
+
+test('an EOCD comment length overrunning the end of the file is rejected', async () => {
+  // CPython's _EndRecData silently returns a truncated comment here; this
+  // implementation deliberately rejects the candidate instead (both scan
+  // passes require the declared comment to fit), so the archive has no
+  // recognizable EOCD at all.
+  const comment = 'padding-padding-padding';
+  const archive = Buffer.from(await buildArchive([], comment));
+  const eocdOffset = archive.length - 22 - comment.length;
+  assert.strictEqual(archive.readUInt32LE(eocdOffset), 0x06054b50);
+  archive.writeUInt16LE(comment.length + 10, eocdOffset + 20);
+  assert.throws(() => [...zlib.ZipEntry.read(archive)],
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /no end of central directory/ });
+});
+
+test('a central directory that cannot fit before the EOCD is rejected', () => {
+  // CPython: "negative central directory offset". The declared size/offset
+  // put the directory past the EOCD, so the prefix computation goes
+  // negative.
+  const eocd = buildEocd({ cdDiskRecords: 1, totalRecords: 1, cdSize: 1, cdOffset: 0xffffff });
+  assert.throws(() => [...zlib.ZipEntry.read(eocd)],
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /does not fit/ });
+});
+
+test('a record count inconsistent with the directory size is rejected', () => {
+  // 100 records cannot fit in 46 bytes of central directory. Filler bytes
+  // ahead of the EOCD stand in for that region so the directory nominally
+  // fits inside the archive and the count check is what fires.
+  const eocd = buildEocd({ cdDiskRecords: 100, totalRecords: 100, cdSize: 46 });
+  const archive = Buffer.concat([Buffer.alloc(46), eocd]);
+  assert.throws(() => [...zlib.ZipEntry.read(archive)],
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /inconsistent/ });
+});
+
+test('a corrupted or overrunning central directory header is rejected', async () => {
+  const nameA = 'a.txt';
+  const nameB = 'b.txt';
+  const content = Buffer.from('x');
+  const two = await buildArchive([
+    await zlib.ZipEntry.create(nameA, content, { method: 'store' }),
+    await zlib.ZipEntry.create(nameB, content, { method: 'store' }),
+  ]);
+  const memberSize = 30 + nameA.length + content.length;
+  const centralStart = 2 * memberSize;
+  const centralRecord = 46 + nameA.length;
+
+  // Zero the second central record's signature ("bad magic number").
+  const badMagic = Buffer.from(two);
+  badMagic.writeUInt32LE(0, centralStart + centralRecord);
+  assert.throws(() => [...zlib.ZipEntry.read(badMagic)],
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /signature is invalid/ });
+
+  // Grow the first central record's name length so it overruns the declared
+  // central directory size ("truncated central directory").
+  const overrun = Buffer.from(two);
+  overrun.writeUInt16LE(2000, centralStart + 28);
+  assert.throws(() => [...zlib.ZipEntry.read(overrun)], { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+});
+
+test('short or overrunning extra-field records do not make an entry unreadable', async () => {
+  // CPython's test_zipfile_with_short_extra_field shape: advisory extra
+  // metadata that is malformed is skipped, never fatal.
+  const name = 'f.txt';
+  const content = Buffer.from('hi');
+  const base = await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { method: 'store' })]);
+  const centralHeaderStart = 30 + name.length + content.length;
+  for (const extra of [
+    Buffer.from([0x99]), // Shorter than a TLV header
+    Buffer.from([0x99, 0x99, 0xff]), // Still shorter than a TLV header
+    Buffer.from([0x99, 0x99, 0xff, 0xff]), // Declared length overruns wildly
+  ]) {
+    const before = base.subarray(0, centralHeaderStart + 46 + name.length);
+    const after = base.subarray(centralHeaderStart + 46 + name.length);
+    const patched = Buffer.concat([before, extra, after]);
+    patched.writeUInt16LE(extra.length, centralHeaderStart + 30);
+    const eocdOffset = patched.length - 22;
+    patched.writeUInt32LE(patched.readUInt32LE(eocdOffset + 12) + extra.length, eocdOffset + 12);
+    const [entry] = zlib.ZipEntry.read(patched);
+    assert.strictEqual(entry.name, name);
+    assert.strictEqual((await entry.content()).toString(), 'hi');
+  }
+});
+
+test('two central records quoting the same data are rejected as a possible zip bomb', async () => {
+  // The "quoted overlap" bomb shape (CVE-2024-0450 in other
+  // implementations): N central records pointing at one region turn a tiny
+  // file into N full-size extractions.
+  const nameA = 'a.txt';
+  const nameB = 'b.txt';
+  const content = Buffer.from('x');
+  const two = Buffer.from(await buildArchive([
+    await zlib.ZipEntry.create(nameA, content, { method: 'store' }),
+    await zlib.ZipEntry.create(nameB, content, { method: 'store' }),
+  ]));
+  const memberSize = 30 + nameA.length + content.length;
+  const centralStart = 2 * memberSize;
+  const centralRecord = 46 + nameA.length;
+  // Point the second record's local header at the first member's.
+  two.writeUInt32LE(0, centralStart + centralRecord + 42);
+  assert.throws(() => [...zlib.ZipEntry.read(two)],
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /possible zip bomb/ });
+});
+
+test('a member whose data crosses into the central directory is rejected', async () => {
+  const name = 'f.txt';
+  const content = Buffer.from('hello');
+  const archive = Buffer.from(await buildArchive(
+    [await zlib.ZipEntry.create(name, content, { method: 'store' })]));
+  const centralHeaderStart = 30 + name.length + content.length;
+  // Lie about the compressed size so the member's data range reaches into
+  // the central directory (while staying inside the buffer).
+  archive.writeUInt32LE(content.length + 40, centralHeaderStart + 20);
+  assert.throws(() => [...zlib.ZipEntry.read(archive)],
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /possible zip bomb/ });
+});
+
+test('a Zip64 EOCD record size-field lie is tolerated when the locator is correct', () => {
+  // The record's own size field is only consulted by the backward recovery
+  // scan; when the locator points straight at a valid record, a lying size
+  // field (CPython rejects 0 or 100 here) does not matter.
+  const record = Buffer.alloc(56);
+  record.writeUInt32LE(0x06064b50, 0);
+  record.writeBigUInt64LE(100n, 4); // Lie: the remainder is 44 bytes
+  record.writeUInt16LE((3 << 8) | 45, 12);
+  record.writeUInt16LE(45, 14);
+  const locator = Buffer.alloc(20);
+  locator.writeUInt32LE(0x07064b50, 0);
+  locator.writeBigUInt64LE(0n, 8);
+  locator.writeUInt32LE(1, 16);
+  const eocd = buildEocd({ cdSize: 0xffffffff });
+  const zip = new zlib.ZipBuffer(Buffer.concat([record, locator, eocd]));
+  assert.strictEqual(zip.size, 0);
+});
+
+test('a NUL byte inside an entry name is preserved verbatim', async () => {
+  // CPython truncates the name at the NUL on read; this implementation
+  // surfaces names verbatim and leaves interpretation to the caller.
+  const name = 'foo\x00bar.txt';
+  const archive = await buildArchive(
+    [await zlib.ZipEntry.create(name, Buffer.from('x'), { method: 'store' })]);
+  const [entry] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(entry.name, name);
+});
diff --git a/test/parallel/test-zlib-zip-internals.js b/test/parallel/test-zlib-zip-internals.js
new file mode 100644
index 000000000000..78316ec37024
--- /dev/null
+++ b/test/parallel/test-zlib-zip-internals.js
@@ -0,0 +1,53 @@
+// Flags: --expose-internals
+'use strict';
+
+require('../common');
+
+// Directly exercises defense-in-depth guards in lib/internal/zip/ that the
+// public API cannot reach on this platform - they exist for 32-bit limits,
+// or for hypothetical callers that skip the pre-validation every current
+// call site performs - so their behavior stays pinned down.
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const zlib = require('node:zlib');
+
+const { readSafeUint64 } = require('internal/zip/binary');
+const { parseZip64Extra } = require('internal/zip/extra-fields');
+const { LocalFileHeader } = require('internal/zip/headers');
+const { decodeMemberSync } = require('internal/zip/compression');
+
+test('readSafeUint64 rejects a field extending past the buffer', () => {
+  // Every current caller validates the containing range first; the guard
+  // protects future call sites.
+  assert.throws(() => readSafeUint64(Buffer.alloc(7), 0),
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /out of bounds/ });
+});
+
+test('parseZip64Extra returns nothing when no field is wanted', () => {
+  // Reachable only if a caller asks with no overflow sentinel present;
+  // CentralFileHeader always wants at least one field when it calls.
+  assert.deepStrictEqual(parseZip64Extra(Buffer.alloc(0), {}), {});
+});
+
+test('LocalFileHeader.length reports 0 when the fixed part does not fit', () => {
+  // The only current caller passes exactly 30 bytes, so the short-buffer
+  // branch cannot trigger through it.
+  assert.strictEqual(LocalFileHeader.length(Buffer.alloc(10), 0), 0);
+});
+
+test('decodeMemberSync bounds output by the declared size without a caller limit', () => {
+  // The public wrappers always pass maxSize (defaulted); without one, the
+  // declared-size cap alone must stop an overrun.
+  const data = Buffer.alloc(4096, 0x61);
+  const compressed = zlib.deflateRawSync(data);
+  const info = {
+    name: 'lie.txt',
+    flags: 0,
+    method: 8,
+    crc32: zlib.crc32(data),
+    uncompressedSize: 16, // Lie: it inflates to 4096 bytes
+  };
+  assert.throws(() => decodeMemberSync(compressed, info),
+                { code: 'ERR_ZIP_ENTRY_CORRUPT', message: /beyond its declared size/ });
+});
diff --git a/test/parallel/test-zlib-zip-interop.js b/test/parallel/test-zlib-zip-interop.js
new file mode 100644
index 000000000000..429f7b02973e
--- /dev/null
+++ b/test/parallel/test-zlib-zip-interop.js
@@ -0,0 +1,132 @@
+'use strict';
+
+require('../common');
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+function hasTool(command, args = ['--help']) {
+  try {
+    const result = spawnSync(command, args, { stdio: 'ignore' });
+    // Require a clean exit, not merely a successful spawn: Windows ships an
+    // App Execution Alias stub for `python3` that runs, prints "Python was
+    // not found", and exits non-zero (9009) - `error` is undefined for it,
+    // so a spawn-only check would wrongly report the tool as present.
+    return result.error === undefined && result.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+// Rendering a UTF-8 entry name (general-purpose bit 11, which we set) through
+// Info-ZIP unzip/zipinfo needs two things that are independent of whether the
+// archive is well-formed: (1) the build must be compiled with UNICODE_SUPPORT
+// - macOS's bundled Info-ZIP is not, and mangles such names no matter what -
+// and (2) at runtime the name is converted to the process locale, which drops
+// or garbles non-ASCII bytes under the "C"/"POSIX" locale. We detect (1) and
+// pick an installed UTF-8 locale for (2); when unzip lacks UNICODE_SUPPORT the
+// non-ASCII name assertion is skipped (its round-trip is still covered by
+// bsdtar/libarchive, which handles UTF-8 correctly regardless).
+function findUtf8Locale() {
+  const result = spawnSync('locale', ['-a'], { encoding: 'utf8' });
+  if (result.status !== 0 || !result.stdout) return null;
+  const locales = result.stdout.split('\n').map((line) => line.trim());
+  const preferred = ['C.UTF-8', 'C.utf8', 'en_US.UTF-8', 'en_US.utf8'];
+  for (const name of preferred) {
+    if (locales.includes(name)) return name;
+  }
+  return locales.find((name) => /utf-?8$/i.test(name)) || null;
+}
+
+test('an archive written by createZipArchive is readable by unzip, zipinfo, and bsdtar', async (t) => {
+  if (!hasTool('unzip', ['-v']) || !hasTool('zipinfo', ['-v']) || !hasTool('bsdtar', ['--version'])) {
+    t.skip('unzip, zipinfo, or bsdtar is not available');
+    return;
+  }
+  const locale = findUtf8Locale();
+  if (!locale) {
+    t.skip('no UTF-8 locale is available to render non-ASCII entry names');
+    return;
+  }
+  const env = { ...process.env, LANG: locale, LC_ALL: locale };
+  // Only assert non-ASCII names through zipinfo when this Info-ZIP build can
+  // actually render them (see the note above).
+  const unzipBuild = spawnSync('unzip', ['-v'], { encoding: 'utf8' }).stdout || '';
+  const zipinfoUnicode = /UNICODE_SUPPORT/.test(unzipBuild);
+
+  const dir = await fs.mkdtemp(path.join(tmpdir.path, 'zlib-zip-interop-'));
+  try {
+    const files = {
+      'hello.txt': Buffer.from('Hello, world!'.repeat(50)),
+      'raw.bin': Buffer.from([1, 2, 3, 4, 5]),
+      'unicode-名前.txt': Buffer.from('unicode name'),
+    };
+    const entries = [];
+    for (const [name, data] of Object.entries(files)) {
+      entries.push(await zlib.ZipEntry.create(name, data));
+    }
+    const chunks = [];
+    for await (const chunk of zlib.createZipArchive(entries)) chunks.push(chunk);
+    const archivePath = path.join(dir, 'archive.zip');
+    await fs.writeFile(archivePath, Buffer.concat(chunks));
+
+    const unzipTest = spawnSync('unzip', ['-t', archivePath], { env });
+    assert.strictEqual(unzipTest.status, 0, unzipTest.stderr?.toString());
+
+    const zipinfo = spawnSync('zipinfo', [archivePath], { env });
+    assert.strictEqual(zipinfo.status, 0);
+    for (const name of Object.keys(files)) {
+      if (!zipinfoUnicode && /[^\x20-\x7e]/.test(name)) continue;
+      assert.ok(zipinfo.stdout.toString().includes(name), `zipinfo missing ${name}`);
+    }
+
+    const extractDir = path.join(dir, 'out');
+    await fs.mkdir(extractDir);
+    const bsdtar = spawnSync('bsdtar', ['-xf', archivePath, '-C', extractDir], { env });
+    assert.strictEqual(bsdtar.status, 0, bsdtar.stderr?.toString());
+    for (const [name, data] of Object.entries(files)) {
+      const extracted = await fs.readFile(path.join(extractDir, name));
+      assert.deepStrictEqual(extracted, data);
+    }
+  } finally {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('an archive written by Python\'s zipfile module is readable by ZipFile', async (t) => {
+  if (!hasTool('python3', ['--version'])) {
+    t.skip('python3 is not available');
+    return;
+  }
+
+  const dir = await fs.mkdtemp(path.join(tmpdir.path, 'zlib-zip-interop-'));
+  try {
+    const archivePath = path.join(dir, 'python.zip');
+    const script = `
+import zipfile
+with zipfile.ZipFile(${JSON.stringify(archivePath)}, 'w') as z:
+    z.writestr('a.txt', 'hello from python')
+    z.writestr('b.bin', bytes(range(256)))
+`;
+    const result = spawnSync('python3', ['-c', script]);
+    assert.strictEqual(result.status, 0, result.stderr?.toString());
+
+    const zip = await zlib.ZipFile.open(archivePath);
+    try {
+      const a = await zip.get('a.txt');
+      assert.strictEqual((await a.content()).toString(), 'hello from python');
+      const b = await zip.get('b.bin');
+      assert.deepStrictEqual(await b.content(), Buffer.from(Array.from({ length: 256 }, (_, i) => i)));
+    } finally {
+      await zip.close();
+    }
+  } finally {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+});
diff --git a/test/parallel/test-zlib-zip-metadata.js b/test/parallel/test-zlib-zip-metadata.js
new file mode 100644
index 000000000000..760b28414552
--- /dev/null
+++ b/test/parallel/test-zlib-zip-metadata.js
@@ -0,0 +1,96 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+async function roundTrip(options) {
+  const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('x'), options);
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive([entry])) chunks.push(chunk);
+  const archive = Buffer.concat(chunks);
+  return [...zlib.ZipEntry.read(archive)][0];
+}
+
+test('modification time round-trips at 2-second resolution', async () => {
+  const modified = new Date(2024, 5, 15, 13, 45, 30);
+  const read = await roundTrip({ modified });
+  assert.strictEqual(read.modified.getFullYear(), 2024);
+  assert.strictEqual(read.modified.getMonth(), 5);
+  assert.strictEqual(read.modified.getDate(), 15);
+  assert.strictEqual(read.modified.getHours(), 13);
+  assert.strictEqual(read.modified.getMinutes(), 45);
+  assert.strictEqual(read.modified.getSeconds(), 30);
+});
+
+test('a sub-second modification time is preserved to the second via an extra field', async () => {
+  // The DOS field is 2-second, local; a sub-second time additionally writes an
+  // extended-timestamp extra field, so it round-trips to the exact UTC second.
+  const read = await roundTrip({ modified: new Date(1700000000500) });
+  assert.strictEqual(read.modified.getTime(), 1700000000000);
+});
+
+test('an odd whole-second modification time is preserved via an extra field', async () => {
+  // The DOS fields have 2-second resolution, so an odd second is just as
+  // unrepresentable as a sub-second part and also gets the extended-timestamp
+  // extra field.
+  const read = await roundTrip({ modified: new Date(1700000001000) });
+  assert.strictEqual(read.modified.getTime(), 1700000001000);
+});
+
+test('a date before 1980 is clamped to the DOS epoch', async () => {
+  const read = await roundTrip({ modified: new Date(1970, 0, 1) });
+  assert.strictEqual(read.modified.getFullYear(), 1980);
+  assert.strictEqual(read.modified.getMonth(), 0);
+  assert.strictEqual(read.modified.getDate(), 1);
+});
+
+test('a date after 2107 is clamped to the DOS ceiling', async () => {
+  const read = await roundTrip({ modified: new Date(2200, 0, 1) });
+  assert.strictEqual(read.modified.getFullYear(), 2107);
+  assert.strictEqual(read.modified.getMonth(), 11);
+  assert.strictEqual(read.modified.getDate(), 31);
+});
+
+test('Unix mode round-trips for files and directories', async () => {
+  const file = await roundTrip({ mode: 0o600 });
+  assert.strictEqual(file.mode, 0o600);
+
+  const dirEntry = await zlib.ZipEntry.create('dir/', Buffer.alloc(0), { mode: 0o700 });
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive([dirEntry])) chunks.push(chunk);
+  const read = [...zlib.ZipEntry.read(Buffer.concat(chunks))][0];
+  assert.strictEqual(read.mode, 0o700);
+  assert.strictEqual(read.isDirectory, true);
+});
+
+test('default modes are applied when none is given', async () => {
+  const file = await roundTrip({});
+  assert.strictEqual(file.mode, 0o644);
+
+  const dirEntry = await zlib.ZipEntry.create('dir/', Buffer.alloc(0));
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive([dirEntry])) chunks.push(chunk);
+  const read = [...zlib.ZipEntry.read(Buffer.concat(chunks))][0];
+  assert.strictEqual(read.mode, 0o755);
+});
+
+test('an entry comment round-trips', async () => {
+  const read = await roundTrip({ comment: 'a comment' });
+  assert.strictEqual(read.comment, 'a comment');
+});
+
+test('zipEntry.compressed reports compressed storage for any method', async () => {
+  const big = Buffer.from('x'.repeat(1000)); // Compressible, so deflate/zstd win
+  const deflated = await zlib.ZipEntry.create('d.txt', big, { method: 'deflate' });
+  const stored = await zlib.ZipEntry.create('s.bin', Buffer.from([1, 2, 3]), { method: 'store' });
+  const zstd = await zlib.ZipEntry.create('z.txt', big, { method: 'zstd' });
+  assert.strictEqual(deflated.compressed, true);
+  assert.strictEqual(stored.compressed, false);
+  assert.strictEqual(zstd.compressed, true);
+
+  // Survives a read-back round-trip too.
+  assert.strictEqual((await roundTrip({ method: 'store' })).compressed, false);
+});
diff --git a/test/parallel/test-zlib-zip-property.js b/test/parallel/test-zlib-zip-property.js
new file mode 100644
index 000000000000..0f7cf8586fd2
--- /dev/null
+++ b/test/parallel/test-zlib-zip-property.js
@@ -0,0 +1,130 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+// A small, seeded PRNG so failures are reproducible without pulling in a
+// dependency.
+function mulberry32(seed) {
+  let state = seed >>> 0;
+  return function() {
+    state = (state + 0x6d2b79f5) >>> 0;
+    let t = state;
+    t = Math.imul(t ^ (t >>> 15), t | 1);
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+function randomBuffer(random, length) {
+  const buf = Buffer.allocUnsafe(length);
+  for (let i = 0; i < length; i++) buf[i] = Math.floor(random() * 256);
+  return buf;
+}
+
+function randomName(random, index) {
+  const unicodeBits = ['a', 'é', '日', '🙂', 'z'];
+  const segment = unicodeBits[Math.floor(random() * unicodeBits.length)];
+  return `dir-${index}/${segment}-${index}.bin`;
+}
+
+async function buildTree(random, count) {
+  const specs = [];
+  for (let i = 0; i < count; i++) {
+    const size = Math.floor(random() * 4096);
+    specs.push({
+      name: randomName(random, i),
+      data: randomBuffer(random, size),
+      method: random() < 0.5 ? 'deflate' : 'store',
+      mode: random() < 0.5 ? 0o644 : 0o600,
+      modified: new Date(2000 + Math.floor(random() * 40), Math.floor(random() * 12),
+                         1 + Math.floor(random() * 27)),
+    });
+  }
+  const entries = [];
+  for (const spec of specs) {
+    entries.push(await zlib.ZipEntry.create(spec.name, spec.data, {
+      method: spec.method, mode: spec.mode, modified: spec.modified,
+    }));
+  }
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries)) chunks.push(chunk);
+  return { archive: Buffer.concat(chunks), specs };
+}
+
+test('random archives round-trip through ZipEntry.read, ZipBuffer, and ZipFile', async () => {
+  const random = mulberry32(0xC0FFEE);
+  const rounds = 8;
+  const dir = await fs.mkdtemp(path.join(tmpdir.path, 'zlib-zip-property-'));
+  try {
+    for (let round = 0; round < rounds; round++) {
+      const { archive, specs } = await buildTree(random, 6);
+      const byName = new Map(specs.map((spec) => [spec.name, spec]));
+
+      // Path 1: ZipEntry.read
+      for (const entry of zlib.ZipEntry.read(archive)) {
+        const spec = byName.get(entry.name);
+        assert.ok(spec, `unexpected entry ${entry.name}`);
+        assert.deepStrictEqual(await entry.content(), spec.data);
+        assert.strictEqual(entry.mode, spec.mode);
+      }
+
+      // Path 2: ZipBuffer
+      using zipBuffer = new zlib.ZipBuffer(archive);
+      assert.strictEqual(zipBuffer.size, specs.length);
+      for (const [name, entry] of zipBuffer) {
+        const spec = byName.get(name);
+        assert.deepStrictEqual(await entry.content(), spec.data);
+      }
+
+      // Path 3: ZipFile (disk-backed), including one streamed read.
+      const filePath = path.join(dir, `round-${round}.zip`);
+      await fs.writeFile(filePath, archive);
+      const zipFile = await zlib.ZipFile.open(filePath);
+      try {
+        assert.strictEqual(zipFile.size, specs.length);
+        for (const spec of specs) {
+          const entry = await zipFile.get(spec.name);
+          assert.deepStrictEqual(await entry.content(), spec.data);
+        }
+        const firstName = specs[0].name;
+        const streamed = [];
+        for await (const chunk of await zipFile.stream(firstName)) streamed.push(chunk);
+        assert.deepStrictEqual(Buffer.concat(streamed), specs[0].data);
+      } finally {
+        await zipFile.close();
+      }
+    }
+  } finally {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+}, { timeout: 60_000 });
+
+test('a streamed write round-trips through a streamed read', async () => {
+  const random = mulberry32(0xBADF00D);
+  const data = randomBuffer(random, 256 * 1024);
+  async function* source() {
+    for (let i = 0; i < data.length; i += 4096) {
+      yield data.subarray(i, Math.min(i + 4096, data.length));
+    }
+  }
+  const entry = zlib.ZipEntry.createStream('streamed.bin', source());
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive([entry])) chunks.push(chunk);
+  const archive = Buffer.concat(chunks);
+
+  const [read] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(read.name, 'streamed.bin');
+  assert.strictEqual(read.size, data.length);
+  const streamedOut = [];
+  for await (const chunk of read.contentIterator()) streamedOut.push(chunk);
+  assert.deepStrictEqual(Buffer.concat(streamedOut), data);
+});
diff --git a/test/parallel/test-zlib-zip-security.js b/test/parallel/test-zlib-zip-security.js
new file mode 100644
index 000000000000..ba63af08fb2d
--- /dev/null
+++ b/test/parallel/test-zlib-zip-security.js
@@ -0,0 +1,265 @@
+'use strict';
+
+// Regression tests for the security review of the ZIP archive API. Each test
+// encodes the *desired* safe behaviour; on the pre-fix code it fails, exposing
+// the issue. See the review for context.
+
+const common = require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+let seq = 0;
+async function tempZip(entries) {
+  const dir = await fsp.mkdtemp(path.join(tmpdir.path, `zip-sec-${seq++}-`));
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries)) chunks.push(chunk);
+  const filePath = path.join(dir, 'archive.zip');
+  await fsp.writeFile(filePath, Buffer.concat(chunks));
+  return { dir, filePath, cleanup: () => fsp.rm(dir, { recursive: true, force: true }) };
+}
+
+// -- Finding 1: no closed-state guard; operations after close() fall through
+// to a raw (possibly reused) file descriptor. -------------------------------
+
+test('post-close operations are rejected cleanly, not via a raw fd', async () => {
+  const { dir, filePath, cleanup } = await tempZip(
+    [await zlib.ZipEntry.create('a.txt', Buffer.from('secret-archive-data'))]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    const retained = await zip.get('a.txt');
+    await zip.close();
+
+    // Encourage descriptor reuse: open an unrelated "victim" file right after
+    // close(), which typically reclaims the just-freed fd number.
+    const victimPath = path.join(dir, 'victim.txt');
+    const VICTIM = 'do-not-touch-this-victim-file';
+    await fsp.writeFile(victimPath, VICTIM);
+    const victimFd = fs.openSync(victimPath, 'r+');
+    try {
+      // A retained entry must not read through the (reused) descriptor.
+      await assert.rejects(retained.content(), { code: 'ERR_INVALID_STATE' });
+      // A post-close mutation must not truncate/overwrite whatever now owns
+      // the fd number.
+      await assert.rejects(
+        zip.addEntry(await zlib.ZipEntry.create('b.txt', Buffer.from('x'))),
+        { code: 'ERR_INVALID_STATE' });
+      // A second close() must be a safe no-op, not a double-close of a reused fd.
+      await zip.close();
+      // The victim file must be byte-for-byte intact.
+      assert.strictEqual(fs.readFileSync(victimPath, 'utf8'), VICTIM);
+    } finally {
+      fs.closeSync(victimFd);
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('post-close operations are rejected cleanly (sync)', async () => {
+  const { dir, filePath, cleanup } = await tempZip(
+    [await zlib.ZipEntry.create('a.txt', Buffer.from('secret-archive-data'))]);
+  try {
+    const zip = zlib.ZipFile.openSync(filePath, { writable: true });
+    const retained = zip.getSync('a.txt');
+    zip.closeSync();
+
+    const victimPath = path.join(dir, 'victim.txt');
+    const VICTIM = 'do-not-touch-this-victim-file';
+    fs.writeFileSync(victimPath, VICTIM);
+    const victimFd = fs.openSync(victimPath, 'r+');
+    try {
+      assert.throws(() => retained.contentSync(), { code: 'ERR_INVALID_STATE' });
+      assert.throws(
+        () => zip.addEntrySync(zlib.ZipEntry.createSync('b.txt', Buffer.from('x'))),
+        { code: 'ERR_INVALID_STATE' });
+      // A second closeSync() must be a safe no-op, not EBADF on a reused fd.
+      zip.closeSync();
+      assert.strictEqual(fs.readFileSync(victimPath, 'utf8'), VICTIM);
+    } finally {
+      fs.closeSync(victimFd);
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+// -- Finding 2: add() awaits ZipEntry.create() before registering the mutation,
+// so a synchronous close() can slip in and close the fd underneath it. -------
+
+test('closeSync() while an async add() is outstanding is rejected', async () => {
+  const { filePath, cleanup } = await tempZip(
+    [await zlib.ZipEntry.create('a.txt', Buffer.from('data'))]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    // add() runs synchronously up to `await ZipEntry.create(...)` and then
+    // suspends, having registered nothing yet.
+    const adding = zip.add('b.txt', Buffer.alloc(1 << 16, 7));
+    // The mutation must already be reserved, so a synchronous method sees the
+    // archive as busy instead of racing the descriptor.
+    assert.throws(() => zip.closeSync(), { code: 'ERR_INVALID_STATE' });
+    await adding;
+    await zip.close();
+
+    const check = await zlib.ZipFile.open(filePath);
+    try {
+      assert.ok(check.has('b.txt'), 'the added entry must survive');
+    } finally {
+      await check.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('an earlier add() completes before a later close()', async () => {
+  const { filePath, cleanup } = await tempZip(
+    [await zlib.ZipEntry.create('a.txt', Buffer.from('data'))]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    const adding = zip.add('b.txt', Buffer.alloc(1 << 16, 9));
+    const closing = zip.close();
+    // add() was issued first; it must land before close() tears down the fd.
+    await Promise.all([adding, closing]);
+
+    const check = await zlib.ZipFile.open(filePath);
+    try {
+      assert.ok(check.has('b.txt'), 'the earlier add() must not be lost');
+    } finally {
+      await check.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+// -- Finding 3 (root cause): zipFiles() classifies via lstat() and then
+// re-opens the path with createReadStream(), so it neither validates the
+// opened descriptor's type nor pins it against a swap. A non-regular file
+// therefore slips through as an ordinary stream source. --------------------
+
+test('zipFiles() rejects a non-regular special file', {
+  skip: common.isWindows ? 'no /dev/null semantics on Windows' : false,
+}, async () => {
+  const chunks = [];
+  await assert.rejects(
+    (async () => {
+      for await (const chunk of zlib.zipFiles([['/dev/null', 'null']])) chunks.push(chunk);
+    })(),
+    (err) => err?.code !== undefined && err.code !== 'ERR_ASSERTION',
+    'archiving a character device should be rejected, not stored as an empty file');
+});
+
+// -- Concern B (verdict: by design): the default decompression ceiling guards
+// the buffering path (content()) against a huge allocation; streaming
+// (contentIterator / ZipFile.stream) is deliberately not bound by it, so a
+// legitimately large member can be read chunk by chunk. Output is still capped
+// per chunk at the declared size, and a caller wanting a cap passes maxSize.
+// This locks in that asymmetry (a default ceiling on streaming would break
+// multi-gigabyte reads - see test/pummel/test-zlib-zip-slow.js). -------------
+
+test('the default ceiling bounds content() but not streaming', async () => {
+  const chunks = [];
+  for await (const c of zlib.createZipArchive(
+    [await zlib.ZipEntry.create('big.txt', Buffer.alloc(4096, 1), { method: 'store' })])) {
+    chunks.push(c);
+  }
+  using zip = new zlib.ZipBuffer(Buffer.concat(chunks));
+  const entry = zip.get('big.txt');
+
+  const saved = zlib.getMaxZipContentSize();
+  zlib.setMaxZipContentSize(1024); // Below the entry's 4096 declared bytes.
+  try {
+    // One-shot buffering enforces the default ceiling...
+    await assert.rejects(entry.content(), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+    // ...but streaming (the bounded-memory path) is not capped by it.
+    let total = 0;
+    for await (const chunk of entry.contentIterator()) total += chunk.length;
+    assert.strictEqual(total, 4096);
+    // An explicit maxSize still caps streaming when the caller wants it.
+    await assert.rejects((async () => {
+      let n = 0;
+      for await (const chunk of entry.contentIterator({ maxSize: 1024 })) n += chunk.length;
+      return n;
+    })(), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+  } finally {
+    zlib.setMaxZipContentSize(saved);
+  }
+});
+
+// -- Concern C: when a Zip64 end record is present its values silently override
+// the classic EOCD without checking they agree. A non-sentinel classic field
+// that disagrees with Zip64 is a parser differential (a classic-only tool and
+// Node see different archives) and must be rejected. --------------------------
+
+test('open() rejects contradictory classic-EOCD vs Zip64 metadata', async () => {
+  // 0x10000 entries forces Zip64; the classic total-records field becomes the
+  // 0xFFFF overflow sentinel.
+  const entries = [];
+  for (let i = 0; i < 0x10000; i++) {
+    entries.push(zlib.ZipEntry.createSync(`e${i}`, Buffer.alloc(0), { method: 'store' }));
+  }
+  const bytes = Buffer.concat([...zlib.createZipArchiveSync(entries)]);
+
+  const eocd = bytes.lastIndexOf(Buffer.from([0x50, 0x4b, 0x05, 0x06]));
+  assert.ok(eocd >= 0, 'classic EOCD present');
+  // The classic total-records field must be the 0xFFFF overflow sentinel.
+  assert.strictEqual(bytes.readUInt16LE(eocd + 10), 0xFFFF);
+  // Rewrite the sentinel to a smaller, non-sentinel value that disagrees with
+  // the Zip64 record (which says 0x10000).
+  const tampered = Buffer.from(bytes);
+  tampered.writeUInt16LE(3, eocd + 10);
+
+  assert.throws(() => new zlib.ZipBuffer(tampered), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+
+  const dir = await fsp.mkdtemp(path.join(tmpdir.path, `zip-sec-${seq++}-`));
+  const p = path.join(dir, 'contradiction.zip');
+  try {
+    await fsp.writeFile(p, tampered);
+    await assert.rejects(zlib.ZipFile.open(p), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+    assert.throws(() => zlib.ZipFile.openSync(p), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+}, { timeout: 120_000 });
+
+// -- Finding 4: the file-backed open-time overlap check uses a 30-byte lower
+// bound for each local header, while the in-memory reader uses the exact
+// local-header length. A crafted "quoted overlap" archive therefore passes
+// ZipFile.open() but is (correctly) rejected by ZipBuffer. -----------------
+
+test('ZipFile.open() enforces the same member-overlap check as ZipBuffer', async () => {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive([
+    await zlib.ZipEntry.create('A', Buffer.alloc(40, 1), { method: 'store' }),
+    await zlib.ZipEntry.create('B', Buffer.alloc(40, 2), { method: 'store' }),
+  ])) chunks.push(chunk);
+  const tampered = Buffer.concat(chunks);
+  // Enlarge entry A's *local* extra-field length. Its real data range (which
+  // the read path locates via the local header) now runs past entry B's local
+  // header - the quoted/overlapping zip-bomb shape. The central directory is
+  // left untouched, so the offset+30+compressedSize open check still sees room.
+  tampered.writeUInt16LE(tampered.readUInt16LE(28) + 8, 28);
+
+  // The in-memory reader rejects it outright.
+  assert.throws(() => new zlib.ZipBuffer(tampered), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+
+  // The file-backed reader must reject it too, at open time - not silently
+  // accept an archive whose members overlap.
+  const dir = await fsp.mkdtemp(path.join(tmpdir.path, `zip-sec-${seq++}-`));
+  const p = path.join(dir, 'overlap.zip');
+  try {
+    await fsp.writeFile(p, tampered);
+    await assert.rejects(zlib.ZipFile.open(p), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+    assert.throws(() => zlib.ZipFile.openSync(p), { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
diff --git a/test/parallel/test-zlib-zip-sync.js b/test/parallel/test-zlib-zip-sync.js
new file mode 100644
index 000000000000..1f7099849b9a
--- /dev/null
+++ b/test/parallel/test-zlib-zip-sync.js
@@ -0,0 +1,247 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+function buildArchiveSync(entries, comment) {
+  const chunks = [];
+  for (const chunk of zlib.createZipArchiveSync(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+function createTempZipSync(entries, comment) {
+  const dir = fs.mkdtempSync(path.join(tmpdir.path, 'zlib-zip-sync-'));
+  const filePath = path.join(dir, 'archive.zip');
+  fs.writeFileSync(filePath, buildArchiveSync(entries, comment));
+  return { filePath, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) };
+}
+
+// -- ZipEntry -----------------------------------------------------------------
+
+test('ZipEntry.createSync()/contentSync() round-trip, deflate and store', () => {
+  const deflateEntry = zlib.ZipEntry.createSync('a.txt', Buffer.from('a'.repeat(1000)));
+  assert.strictEqual(deflateEntry.method, 8);
+  assert.strictEqual(deflateEntry.contentSync().toString(), 'a'.repeat(1000));
+
+  const storeEntry = zlib.ZipEntry.createSync('b.bin', Buffer.from([1, 2, 3]), { method: 'store' });
+  assert.strictEqual(storeEntry.method, 0);
+  assert.deepStrictEqual(storeEntry.contentSync(), Buffer.from([1, 2, 3]));
+
+  // Matches the crc32/size that the async ZipEntry.create() would produce.
+  const data = Buffer.from('some content to compare');
+  assert.strictEqual(zlib.ZipEntry.createSync('x', data).crc32, zlib.crc32(data));
+});
+
+test('ZipEntry.createSync()/contentSync() round-trip, zstd', () => {
+  const zstdEntry = zlib.ZipEntry.createSync('z.txt', Buffer.from('z'.repeat(1000)), { method: 'zstd' });
+  assert.strictEqual(zstdEntry.method, 93);
+  assert.strictEqual(zstdEntry.contentSync().toString(), 'z'.repeat(1000));
+});
+
+test('ZipEntry.contentSync() enforces maxSize and CRC verification like content()', () => {
+  const entry = zlib.ZipEntry.createSync('a.txt', Buffer.from('hello world'), { method: 'store' });
+  assert.throws(() => entry.contentSync({ maxSize: 1 }), { code: 'ERR_ZIP_ENTRY_TOO_LARGE' });
+
+  const archive = buildArchiveSync([entry]);
+  const tampered = Buffer.from(archive);
+  tampered[30 + 'a.txt'.length] ^= 0xff; // Flip a content byte.
+  const [tamperedEntry] = zlib.ZipEntry.read(tampered);
+  assert.throws(() => tamperedEntry.contentSync(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
+  assert.strictEqual(tamperedEntry.contentSync({ verify: false }).length, 'hello world'.length);
+});
+
+test('createZipArchiveSync() throws for a streaming (pending) entry', () => {
+  const streaming = zlib.ZipEntry.createStream('big.bin', (async function* () {})());
+  assert.throws(() => [...zlib.createZipArchiveSync([streaming])], { code: 'ERR_INVALID_STATE' });
+});
+
+// -- ZipBuffer ----------------------------------------------------------------
+
+test('ZipBuffer.addSync()/toBufferSync() round-trip', () => {
+  const archive = buildArchiveSync([zlib.ZipEntry.createSync('a.txt', Buffer.from('a'))], 'a comment');
+  using zip = new zlib.ZipBuffer(archive);
+  const added = zip.addSync('b.txt', Buffer.from('b'));
+  assert.strictEqual(added.name, 'b.txt');
+  assert.strictEqual(zip.size, 2);
+
+  const rebuilt = zip.toBufferSync();
+  using reread = new zlib.ZipBuffer(rebuilt);
+  assert.deepStrictEqual([...reread.keys()].sort(), ['a.txt', 'b.txt']);
+  assert.strictEqual(reread.get('a.txt').contentSync().toString(), 'a');
+  assert.strictEqual(reread.get('b.txt').contentSync().toString(), 'b');
+  assert.strictEqual(reread.comment, 'a comment');
+});
+
+// -- ZipFile ------------------------------------------------------------------
+
+test('ZipFile.openSync() reads the same entries as open()', async () => {
+  const { filePath, cleanup } = createTempZipSync([
+    zlib.ZipEntry.createSync('a.txt', Buffer.from('a')),
+    zlib.ZipEntry.createSync('b.bin', Buffer.from([1, 2, 3]), { method: 'store' }),
+  ]);
+  try {
+    const zip = zlib.ZipFile.openSync(filePath);
+    try {
+      assert.strictEqual(zip.writable, false);
+      assert.strictEqual(zip.size, 2);
+      assert.strictEqual(zip.getSync('a.txt').contentSync().toString(), 'a');
+      assert.deepStrictEqual(zip.getSync('b.bin').contentSync(), Buffer.from([1, 2, 3]));
+      assert.deepStrictEqual([...zip.valuesSync()].map((e) => e.name).sort(), ['a.txt', 'b.bin']);
+      assert.deepStrictEqual([...zip.entriesSync()].map(([n]) => n).sort(), ['a.txt', 'b.bin']);
+      const seen = [];
+      zip.forEachSync((entry, name) => seen.push(name));
+      assert.deepStrictEqual(seen.sort(), ['a.txt', 'b.bin']);
+    } finally {
+      zip.closeSync();
+    }
+
+    const asyncZip = await zlib.ZipFile.open(filePath);
+    try {
+      assert.deepStrictEqual([...asyncZip.keys()].sort(), ['a.txt', 'b.bin']);
+    } finally {
+      await asyncZip.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile opened via openSync supports `using` (Symbol.dispose)', () => {
+  const { filePath, cleanup } = createTempZipSync([zlib.ZipEntry.createSync('a.txt', Buffer.from('a'))]);
+  try {
+    {
+      using zip = zlib.ZipFile.openSync(filePath);
+      assert.strictEqual(zip.getSync('a.txt').contentSync().toString(), 'a');
+    }
+    // Disposed: the fd should be closed. Re-opening the same path must still work.
+    const reopened = zlib.ZipFile.openSync(filePath);
+    reopened.closeSync();
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile.addEntrySync()/addSync()/deleteSync() alter the file synchronously', () => {
+  const { filePath, cleanup } = createTempZipSync([
+    zlib.ZipEntry.createSync('a.txt', Buffer.from('AAAA'.repeat(20))),
+    zlib.ZipEntry.createSync('b.bin', Buffer.from([1, 2, 3]), { method: 'store' }),
+  ]);
+  try {
+    const zip = zlib.ZipFile.openSync(filePath, { writable: true });
+    try {
+      assert.strictEqual(zip.writable, true);
+      const sizeBefore = fs.statSync(filePath).size;
+      const added = zip.addSync('c.txt', Buffer.from('a fresh member'));
+      assert.strictEqual(added.name, 'c.txt');
+      assert.strictEqual(zip.size, 3);
+      assert.ok(fs.statSync(filePath).size > sizeBefore);
+      assert.strictEqual(zip.getSync('c.txt').contentSync().toString(), 'a fresh member');
+      // Original entries untouched.
+      assert.strictEqual(zip.getSync('a.txt').contentSync().toString(), 'AAAA'.repeat(20));
+
+      const entry = zlib.ZipEntry.createSync('d.txt', Buffer.from('d'));
+      assert.strictEqual(zip.addEntrySync(entry), entry);
+
+      const sizeBeforeDelete = fs.statSync(filePath).size;
+      assert.strictEqual(zip.deleteSync('b.bin'), true);
+      assert.ok(fs.statSync(filePath).size < sizeBeforeDelete);
+      assert.strictEqual(zip.deleteSync('does-not-exist'), false);
+    } finally {
+      zip.closeSync();
+    }
+
+    const reread = zlib.ZipFile.openSync(filePath);
+    try {
+      assert.deepStrictEqual([...reread.keys()].sort(), ['a.txt', 'c.txt', 'd.txt']);
+    } finally {
+      reread.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile.addEntrySync() rejects a pending streaming entry', () => {
+  const { filePath, cleanup } = createTempZipSync([zlib.ZipEntry.createSync('a.txt', Buffer.from('a'))]);
+  try {
+    const zip = zlib.ZipFile.openSync(filePath, { writable: true });
+    try {
+      const streaming = zlib.ZipEntry.createStream('big.bin', (async function* () {})());
+      assert.throws(() => zip.addEntrySync(streaming), { code: 'ERR_INVALID_STATE' });
+    } finally {
+      zip.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile sync mutators throw ERR_ZIP_NOT_WRITABLE when not opened writable', () => {
+  const { filePath, cleanup } = createTempZipSync([zlib.ZipEntry.createSync('a.txt', Buffer.from('a'))]);
+  try {
+    const zip = zlib.ZipFile.openSync(filePath);
+    try {
+      assert.throws(() => zip.addSync('b.txt', Buffer.from('b')), { code: 'ERR_ZIP_NOT_WRITABLE' });
+      assert.throws(() => zip.deleteSync('a.txt'), { code: 'ERR_ZIP_NOT_WRITABLE' });
+    } finally {
+      zip.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile.compactSync() matches compact() and does not touch the open file', () => {
+  const { filePath, cleanup } = createTempZipSync([
+    zlib.ZipEntry.createSync('a.txt', Buffer.from('a'.repeat(1000))),
+    zlib.ZipEntry.createSync('b.txt', Buffer.from('b'.repeat(1000))),
+  ]);
+  try {
+    const zip = zlib.ZipFile.openSync(filePath, { writable: true });
+    try {
+      zip.deleteSync('b.txt');
+      const sizeWithDeadSpace = fs.statSync(filePath).size;
+      const compacted = zip.compactSync();
+      assert.strictEqual(fs.statSync(filePath).size, sizeWithDeadSpace);
+      assert.ok(compacted.length < sizeWithDeadSpace);
+      using reread = new zlib.ZipBuffer(compacted);
+      assert.deepStrictEqual([...reread.keys()], ['a.txt']);
+    } finally {
+      zip.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('a sync ZipFile method throws while an async mutation has not settled yet', async () => {
+  const { filePath, cleanup } = createTempZipSync([zlib.ZipEntry.createSync('seed.txt', Buffer.from('seed'))]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      // addEntry() (unlike add()) increments the busy counter synchronously,
+      // at call time - before any internal awaiting - so the checks below
+      // are guaranteed to observe the archive as busy.
+      const entry = zlib.ZipEntry.createSync('slow.txt', Buffer.from('x'));
+      const pending = zip.addEntry(entry);
+      assert.throws(() => zip.getSync('seed.txt'), { code: 'ERR_INVALID_STATE' });
+      assert.throws(() => zip.addSync('y.txt', Buffer.from('y')), { code: 'ERR_INVALID_STATE' });
+      assert.throws(() => zip.closeSync(), { code: 'ERR_INVALID_STATE' });
+      await pending;
+      // Once settled, sync methods work again.
+      assert.strictEqual(zip.getSync('seed.txt').contentSync().toString(), 'seed');
+    } finally {
+      await zip.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
diff --git a/test/parallel/test-zlib-zip-writable.js b/test/parallel/test-zlib-zip-writable.js
new file mode 100644
index 000000000000..9e036f62de31
--- /dev/null
+++ b/test/parallel/test-zlib-zip-writable.js
@@ -0,0 +1,347 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+async function createTempZip(entries, comment) {
+  const dir = await fs.mkdtemp(path.join(tmpdir.path, 'zlib-zip-writable-'));
+  const filePath = path.join(dir, 'archive.zip');
+  await fs.writeFile(filePath, await buildArchive(entries, comment));
+  return { filePath, cleanup: () => fs.rm(dir, { recursive: true, force: true }) };
+}
+
+// -- ZipBuffer --------------------------------------------------------------
+
+test('ZipBuffer is always writable', async () => {
+  const archive = await buildArchive([]);
+  using zip = new zlib.ZipBuffer(archive);
+  assert.strictEqual(zip.writable, true);
+});
+
+test('ZipBuffer preserves the archive comment across toBuffer()', async () => {
+  const archive = await buildArchive([], 'original comment');
+  using zip = new zlib.ZipBuffer(archive);
+  assert.strictEqual(zip.comment, 'original comment');
+  const rebuilt = await zip.toBuffer();
+  using reread = new zlib.ZipBuffer(rebuilt);
+  assert.strictEqual(reread.comment, 'original comment');
+});
+
+test('ZipBuffer add()/addEntry()/delete()/clear() mutate the in-memory index', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('a')),
+  ]);
+  using zip = new zlib.ZipBuffer(archive);
+  assert.strictEqual(zip.size, 1);
+
+  const added = await zip.add('b.txt', Buffer.from('b'));
+  assert.strictEqual(added.name, 'b.txt');
+  assert.strictEqual(zip.size, 2);
+  assert.strictEqual(zip.has('b.txt'), true);
+
+  const entry = await zlib.ZipEntry.create('c.txt', Buffer.from('c'));
+  assert.strictEqual(zip.addEntry(entry), entry);
+  assert.strictEqual(zip.size, 3);
+
+  assert.strictEqual(zip.delete('a.txt'), true);
+  assert.strictEqual(zip.delete('a.txt'), false);
+  assert.strictEqual(zip.size, 2);
+
+  zip.clear();
+  assert.strictEqual(zip.size, 0);
+});
+
+test('ZipBuffer.toBuffer() serializes the current live set, replacing on overwrite', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('original')),
+    await zlib.ZipEntry.create('b.txt', Buffer.from('keep')),
+  ]);
+  using zip = new zlib.ZipBuffer(archive);
+  await zip.add('a.txt', Buffer.from('replaced'));
+  zip.delete('b.txt');
+  await zip.add('c.txt', Buffer.from('new'));
+
+  const rebuilt = await zip.toBuffer();
+  using reread = new zlib.ZipBuffer(rebuilt);
+  assert.deepStrictEqual([...reread.keys()].sort(), ['a.txt', 'c.txt']);
+  assert.strictEqual((await reread.get('a.txt').content()).toString(), 'replaced');
+  assert.strictEqual((await reread.get('c.txt').content()).toString(), 'new');
+});
+
+test('ZipBuffer.addEntry() rejects a non-ZipEntry value', async () => {
+  const archive = await buildArchive([]);
+  using zip = new zlib.ZipBuffer(archive);
+  assert.throws(() => zip.addEntry({ name: 'fake.txt' }), { code: 'ERR_INVALID_ARG_TYPE' });
+});
+
+// -- ZipFile ------------------------------------------------------------------
+
+test('ZipFile defaults to read-only and rejects mutation', async () => {
+  const { filePath, cleanup } = await createTempZip([await zlib.ZipEntry.create('a.txt', Buffer.from('a'))]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath);
+    try {
+      assert.strictEqual(zip.writable, false);
+      await assert.rejects(zip.add('b.txt', Buffer.from('b')), { code: 'ERR_ZIP_NOT_WRITABLE' });
+      await assert.rejects(zip.delete('a.txt'), { code: 'ERR_ZIP_NOT_WRITABLE' });
+    } finally {
+      await zip.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('ZipFile opened writable: addEntry() appends where the old CD used to be', async () => {
+  const { filePath, cleanup } = await createTempZip([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('AAAA'.repeat(20))),
+    await zlib.ZipEntry.create('b.bin', Buffer.from([1, 2, 3]), { method: 'store' }),
+  ]);
+  try {
+    const sizeBefore = (await fs.stat(filePath)).size;
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      assert.strictEqual(zip.writable, true);
+      const added = await zip.add('c.txt', Buffer.from('a fresh member'));
+      assert.strictEqual(added.name, 'c.txt');
+      assert.strictEqual(zip.size, 3);
+
+      // The file must actually be altered by the time the call returns.
+      const sizeAfter = (await fs.stat(filePath)).size;
+      assert.ok(sizeAfter > sizeBefore);
+
+      // Original entries must be untouched.
+      assert.strictEqual((await (await zip.get('a.txt')).content()).toString(), 'AAAA'.repeat(20));
+      assert.deepStrictEqual(await (await zip.get('b.bin')).content(), Buffer.from([1, 2, 3]));
+      assert.strictEqual((await (await zip.get('c.txt')).content()).toString(), 'a fresh member');
+    } finally {
+      await zip.close();
+    }
+
+    // Re-opening from scratch must see the same three entries.
+    const reread = await zlib.ZipFile.open(filePath);
+    try {
+      assert.deepStrictEqual([...reread.keys()].sort(), ['a.txt', 'b.bin', 'c.txt']);
+    } finally {
+      await reread.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('ZipFile addEntry() promotes a spent streaming entry into a readable file-backed entry', async () => {
+  const { filePath, cleanup } = await createTempZip([
+    await zlib.ZipEntry.create('seed.txt', Buffer.from('seed')),
+  ]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      const payload = 'streamed payload'.repeat(64);
+      async function* source() {
+        yield Buffer.from(payload.slice(0, 10));
+        yield Buffer.from(payload.slice(10));
+      }
+      const streamEntry = zlib.ZipEntry.createStream('s.txt', source());
+
+      // Before it is written, a streaming entry has no readable content.
+      await assert.rejects(streamEntry.content(), { code: 'ERR_INVALID_STATE' });
+
+      const returned = await zip.addEntry(streamEntry);
+      // addEntry() returns the same object, now promoted in place.
+      assert.strictEqual(returned, streamEntry);
+
+      // The once-spent entry is now readable, both buffered and streamed.
+      assert.strictEqual((await streamEntry.content()).toString(), payload);
+      const chunks = [];
+      for await (const chunk of streamEntry.contentIterator()) chunks.push(chunk);
+      assert.strictEqual(Buffer.concat(chunks).toString(), payload);
+
+      // And re-serializable: it can be copied into a fresh archive.
+      const copy = new zlib.ZipBuffer(await buildArchive([streamEntry]));
+      assert.strictEqual(copy.get('s.txt').contentSync().toString(), payload);
+      assert.strictEqual(copy.get('s.txt').crc32 >>> 0, streamEntry.crc32 >>> 0);
+
+      // An in-memory entry added alongside keeps its own buffer (not promoted).
+      const mem = await zlib.ZipEntry.create('m.txt', Buffer.from('in memory'));
+      await zip.addEntry(mem);
+      assert.deepStrictEqual(mem.rawContent, mem.rawContent); // still a Buffer
+      assert.notStrictEqual(mem.rawContent, null);
+    } finally {
+      await zip.close();
+    }
+
+    // The bytes persisted correctly and re-open sees the streamed member.
+    const reread = await zlib.ZipFile.open(filePath);
+    try {
+      assert.strictEqual(
+        (await (await reread.get('s.txt')).content()).toString(),
+        'streamed payload'.repeat(64));
+    } finally {
+      await reread.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('an in-place rewrite keeps central and local data-descriptor flags in agreement', async () => {
+  const { filePath, cleanup } = await createTempZip([
+    await zlib.ZipEntry.create('seed.txt', Buffer.from('seed')),
+  ]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      async function* source() { yield Buffer.from('streamed payload'); }
+      await zip.addEntry(zlib.ZipEntry.createStream('s.txt', source()));
+      // A second mutation rebuilds the central directory from the freshly
+      // adopted headers. The streamed entry's on-disk local header (bit 3
+      // set, with a data descriptor after its content) is never rewritten,
+      // so the rebuilt central header must keep advertising bit 3 - a
+      // cleared flag would contradict the local header (sec. 4.3.12).
+      await zip.delete('seed.txt');
+    } finally {
+      await zip.close();
+    }
+
+    const raw = await fs.readFile(filePath);
+    const FLAG_DATA_DESCRIPTOR = 0x0008;
+    // Only s.txt is live: its central record locates its local header.
+    const centralPos = raw.indexOf(Buffer.from([0x50, 0x4b, 0x01, 0x02]));
+    assert.notStrictEqual(centralPos, -1);
+    const centralFlags = raw.readUInt16LE(centralPos + 8);
+    const localOffset = raw.readUInt32LE(centralPos + 42);
+    assert.strictEqual(raw.readUInt32LE(localOffset), 0x04034b50);
+    const localFlags = raw.readUInt16LE(localOffset + 6);
+    assert.strictEqual(localFlags & FLAG_DATA_DESCRIPTOR, FLAG_DATA_DESCRIPTOR);
+    assert.strictEqual(centralFlags & FLAG_DATA_DESCRIPTOR, FLAG_DATA_DESCRIPTOR);
+
+    // The archive stays fully readable after the rewrite.
+    const reread = await zlib.ZipFile.open(filePath);
+    try {
+      assert.strictEqual(
+        (await (await reread.get('s.txt')).content()).toString(), 'streamed payload');
+    } finally {
+      await reread.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('ZipFile opened writable: delete() rewrites the CD without growing the file', async () => {
+  const { filePath, cleanup } = await createTempZip([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('a')),
+    await zlib.ZipEntry.create('b.txt', Buffer.from('b')),
+  ]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      const sizeBefore = (await fs.stat(filePath)).size;
+      assert.strictEqual(await zip.delete('b.txt'), true);
+      const sizeAfter = (await fs.stat(filePath)).size;
+      assert.ok(sizeAfter < sizeBefore);
+      assert.strictEqual(zip.has('b.txt'), false);
+      assert.strictEqual(zip.size, 1);
+      assert.strictEqual(await zip.delete('does-not-exist'), false);
+    } finally {
+      await zip.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('ZipFile.compact() streams a fresh archive with no dead entries and does not touch the open file', async () => {
+  const { filePath, cleanup } = await createTempZip([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('a'.repeat(1000))),
+    await zlib.ZipEntry.create('b.txt', Buffer.from('b'.repeat(1000))),
+  ]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      await zip.delete('b.txt'); // Leaves dead space behind
+      const sizeWithDeadSpace = (await fs.stat(filePath)).size;
+
+      const chunks = [];
+      for await (const chunk of zip.compact()) chunks.push(chunk);
+      const compacted = Buffer.concat(chunks);
+
+      // compact() must not have modified the still-open file.
+      assert.strictEqual((await fs.stat(filePath)).size, sizeWithDeadSpace);
+
+      assert.ok(compacted.length < sizeWithDeadSpace);
+      using reread = new zlib.ZipBuffer(compacted);
+      assert.deepStrictEqual([...reread.keys()], ['a.txt']);
+      assert.strictEqual((await reread.get('a.txt').content()).toString(), 'a'.repeat(1000));
+    } finally {
+      await zip.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('ZipFile preserves the archive comment across writes', async () => {
+  const { filePath, cleanup } = await createTempZip(
+    [await zlib.ZipEntry.create('a.txt', Buffer.from('a'))], 'a comment');
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      assert.strictEqual(zip.comment, 'a comment');
+      await zip.add('b.txt', Buffer.from('b'));
+      assert.strictEqual(zip.comment, 'a comment');
+    } finally {
+      await zip.close();
+    }
+    const reread = await zlib.ZipFile.open(filePath);
+    try {
+      assert.strictEqual(reread.comment, 'a comment');
+    } finally {
+      await reread.close();
+    }
+  } finally {
+    await cleanup();
+  }
+});
+
+test('ZipFile serializes concurrent add()/delete() calls instead of racing', async () => {
+  const { filePath, cleanup } = await createTempZip([await zlib.ZipEntry.create('seed.txt', Buffer.from('seed'))]);
+  try {
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    try {
+      const names = [];
+      for (let i = 0; i < 20; i++) names.push(`f${i}.txt`);
+      await Promise.all(names.map((name) => zip.add(name, Buffer.from(name))));
+      assert.strictEqual(zip.size, names.length + 1);
+      for (const name of names) {
+        assert.strictEqual((await (await zip.get(name)).content()).toString(), name);
+      }
+    } finally {
+      await zip.close();
+    }
+
+    const reread = await zlib.ZipFile.open(filePath);
+    try {
+      assert.strictEqual(reread.size, 21);
+    } finally {
+      await reread.close();
+    }
+  } finally {
+    await cleanup();
+  }
+}, { timeout: 30_000 });
diff --git a/test/parallel/test-zlib-zip-zip64.js b/test/parallel/test-zlib-zip-zip64.js
new file mode 100644
index 000000000000..d22b14b99baa
--- /dev/null
+++ b/test/parallel/test-zlib-zip-zip64.js
@@ -0,0 +1,38 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+const ZIP64_EOCD_SIGNATURE = Buffer.from([0x50, 0x4b, 0x06, 0x06]);
+
+async function buildArchive(count) {
+  const entries = [];
+  for (let i = 0; i < count; i++) {
+    entries.push(await zlib.ZipEntry.create(`entry-${i}`, Buffer.alloc(0), { method: 'store' }));
+  }
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+test('an entry count at or above 0xFFFF forces Zip64 structures', async () => {
+  const archive = await buildArchive(0x10000);
+  assert.ok(archive.includes(ZIP64_EOCD_SIGNATURE));
+
+  const read = [...zlib.ZipEntry.read(archive)];
+  assert.strictEqual(read.length, 0x10000);
+
+  using zip = new zlib.ZipBuffer(archive);
+  assert.strictEqual(zip.size, 0x10000);
+  assert.strictEqual(zip.has('entry-0'), true);
+  assert.strictEqual(zip.has(`entry-${0x10000 - 1}`), true);
+}, { timeout: 120_000 });
+
+test('an archive below the Zip64 thresholds contains no Zip64 structures', async () => {
+  const archive = await buildArchive(10);
+  assert.ok(!archive.includes(ZIP64_EOCD_SIGNATURE));
+  assert.strictEqual([...zlib.ZipEntry.read(archive)].length, 10);
+});
diff --git a/test/parallel/test-zlib-zip.js b/test/parallel/test-zlib-zip.js
new file mode 100644
index 000000000000..910c17122d8f
--- /dev/null
+++ b/test/parallel/test-zlib-zip.js
@@ -0,0 +1,147 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const { test } = require('node:test');
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+// Deterministic high-entropy bytes that deflate/zstd cannot shrink, without
+// pulling in node:crypto (unavailable on --without-ssl builds). A xorshift32
+// PRNG is more than random enough to defeat compression.
+function incompressibleBytes(length) {
+  const out = Buffer.allocUnsafe(length);
+  let state = 0x9e3779b9;
+  for (let i = 0; i < length; i++) {
+    state ^= state << 13;
+    state ^= state >>> 17;
+    state ^= state << 5;
+    out[i] = state & 0xff;
+  }
+  return out;
+}
+
+test('round-trips a small archive through ZipEntry.read', async () => {
+  const entries = [
+    await zlib.ZipEntry.create('hello.txt', Buffer.from('Hello, world!'.repeat(20))),
+    await zlib.ZipEntry.create('raw.bin', Buffer.from([1, 2, 3, 4, 5]), { method: 'store' }),
+    await zlib.ZipEntry.create('empty.txt', Buffer.alloc(0)),
+    await zlib.ZipEntry.create('dir/', Buffer.alloc(0)),
+  ];
+  const archive = await buildArchive(entries, 'test comment');
+
+  const read = [...zlib.ZipEntry.read(archive)];
+  assert.strictEqual(read.length, 4);
+
+  const byName = new Map(read.map((entry) => [entry.name, entry]));
+  assert.strictEqual((await byName.get('hello.txt').content()).toString(),
+                     'Hello, world!'.repeat(20));
+  assert.strictEqual(byName.get('hello.txt').method, 8);
+  assert.deepStrictEqual(await byName.get('raw.bin').content(), Buffer.from([1, 2, 3, 4, 5]));
+  assert.strictEqual(byName.get('raw.bin').method, 0);
+  assert.strictEqual((await byName.get('empty.txt').content()).length, 0);
+  assert.strictEqual(byName.get('dir/').isDirectory, true);
+  assert.strictEqual(byName.get('hello.txt').isFile, true);
+});
+
+test('ZipBuffer indexes entries by name', async () => {
+  const entries = [
+    await zlib.ZipEntry.create('a.txt', Buffer.from('a')),
+    await zlib.ZipEntry.create('b.txt', Buffer.from('b')),
+  ];
+  const archive = await buildArchive(entries);
+  using zip = new zlib.ZipBuffer(archive);
+
+  assert.strictEqual(zip.size, 2);
+  assert.strictEqual(zip.has('a.txt'), true);
+  assert.strictEqual(zip.has('missing.txt'), false);
+  assert.strictEqual((await zip.get('a.txt').content()).toString(), 'a');
+  assert.deepStrictEqual([...zip.keys()].sort(), ['a.txt', 'b.txt']);
+
+  assert.throws(() => zip.get('missing.txt'), { code: 'ERR_ZIP_ENTRY_NOT_FOUND' });
+});
+
+test('an incompressible or empty entry falls back to store', async () => {
+  const random = incompressibleBytes(4096);
+  const entry = await zlib.ZipEntry.create('random.bin', random);
+  assert.strictEqual(entry.method, 0);
+  assert.deepStrictEqual(await entry.content(), random);
+
+  const empty = await zlib.ZipEntry.create('empty.bin', Buffer.alloc(0));
+  assert.strictEqual(empty.method, 0);
+});
+
+test('explicit store option is honored even for compressible data', async () => {
+  const data = Buffer.from('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+  const entry = await zlib.ZipEntry.create('stored.txt', data, { method: 'store' });
+  assert.strictEqual(entry.method, 0);
+  assert.deepStrictEqual(entry.rawContent, data);
+});
+
+test('the zstd method compresses and round-trips through an archive', async () => {
+  const data = Buffer.from('zstd content '.repeat(200));
+  const entry = await zlib.ZipEntry.create('z.txt', data, { method: 'zstd' });
+  assert.strictEqual(entry.method, 93);
+  assert.ok(entry.compressedSize < data.length);
+  assert.deepStrictEqual(await entry.content(), data);
+
+  const archive = await buildArchive([entry]);
+  const [read] = zlib.ZipEntry.read(archive);
+  assert.strictEqual(read.method, 93);
+  assert.deepStrictEqual(await read.content(), data);
+});
+
+test('an incompressible entry with method zstd falls back to store', async () => {
+  const random = incompressibleBytes(4096);
+  const entry = await zlib.ZipEntry.create('random.bin', random, { method: 'zstd' });
+  assert.strictEqual(entry.method, 0);
+  assert.deepStrictEqual(await entry.content(), random);
+});
+
+test('crc32 chains the same way as zlib.crc32', async () => {
+  const data = Buffer.from('the quick brown fox jumps over the lazy dog');
+  const entry = await zlib.ZipEntry.create('f.txt', data);
+  assert.strictEqual(entry.crc32, zlib.crc32(data));
+});
+
+test('createZipArchive rejects an overlong comment', async () => {
+  await assert.rejects(
+    buildArchive([], 'x'.repeat(70000)),
+    { code: 'ERR_ZIP_ARCHIVE_TOO_LARGE' },
+  );
+});
+
+test('directory entries cannot carry content', async () => {
+  await assert.rejects(
+    zlib.ZipEntry.create('dir/', Buffer.from('x')),
+    { code: 'ERR_INVALID_ARG_VALUE' },
+  );
+});
+
+test('ZipEntry.createSymlink round-trips as a symlink entry', async () => {
+  const entry = zlib.ZipEntry.createSymlink('link', '../target', { mode: 0o777 });
+  const [read] = zlib.ZipEntry.read(await buildArchive([entry]));
+  assert.strictEqual(read.isSymlink, true);
+  assert.strictEqual(read.isFile, false);
+  assert.strictEqual(read.mode, 0o777);
+  assert.strictEqual(read.contentSync().toString(), '../target');
+});
+
+test('a deflate and a zstd member each stream back through contentIterator', async () => {
+  for (const method of ['deflate', 'zstd']) {
+    const data = Buffer.from(`${method} payload `.repeat(500));
+    const entry = await zlib.ZipEntry.create('m.txt', data, { method });
+    const [read] = zlib.ZipEntry.read(await buildArchive([entry]));
+    const chunks = [];
+    for await (const chunk of read.contentIterator()) chunks.push(chunk);
+    assert.deepStrictEqual(Buffer.concat(chunks), data);
+  }
+});
diff --git a/test/pummel/test-zlib-zip-slow.js b/test/pummel/test-zlib-zip-slow.js
new file mode 100644
index 000000000000..c3e334c06dec
--- /dev/null
+++ b/test/pummel/test-zlib-zip-slow.js
@@ -0,0 +1,129 @@
+'use strict';
+
+// This test writes and reads back a ZIP archive whose total size exceeds
+// 4 GiB, to exercise the Zip64 promotion that is triggered by an offset or
+// size overflowing the classic 32-bit fields (as opposed to test-zlib-zip-
+// zip64.js in test/parallel, which triggers Zip64 through the 16-bit entry
+// count instead). It needs several GiB of free disk space and is too slow
+// for the default test run, hence living in test/pummel rather than
+// test/parallel.
+
+const common = require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+const { test } = require('node:test');
+
+tmpdir.refresh();
+
+const GiB = 1024 * 1024 * 1024;
+const MEMBER_SIZE = 500 * 1024 * 1024; // Four ~500 MiB stored members...
+const STORED_MEMBER_COUNT = 4;
+const STREAMED_MEMBER_SIZE = 4.5 * GiB; // ...plus one >4 GiB streamed member:
+// the total archive size (~6.5 GiB) pushes offsets over the 4 GiB Zip64
+// threshold, and the streamed member's own sizes exceed 32 bits too, so the
+// per-entry Zip64 size fields (central header and data descriptor) are
+// exercised as well as the offset promotion. Required free space includes
+// generous slack over that total.
+const REQUIRED_FREE_BYTES = 12 * GiB;
+const CHUNK_SIZE = 16 * 1024 * 1024;
+
+function fillChunk(seed) {
+  const chunk = Buffer.allocUnsafe(CHUNK_SIZE);
+  chunk.fill(seed & 0xff);
+  return chunk;
+}
+
+async function* repeatingChunks(totalSize, seed) {
+  let remaining = totalSize;
+  while (remaining > 0) {
+    const size = Math.min(CHUNK_SIZE, remaining);
+    const chunk = fillChunk(seed);
+    remaining -= size;
+    yield size === chunk.length ? chunk : chunk.subarray(0, size);
+  }
+}
+
+test('an archive larger than 4 GiB round-trips and triggers Zip64 via offset', async () => {
+  let free;
+  try {
+    const stats = await fs.statfs(tmpdir.path);
+    free = stats.bavail * stats.bsize;
+  } catch {
+    free = undefined;
+  }
+  if (free !== undefined && free < REQUIRED_FREE_BYTES) {
+    common.skip(`insufficient disk space in ${tmpdir.path} for a >4 GiB archive test`);
+    return;
+  }
+
+  const dir = await fs.mkdtemp(path.join(tmpdir.path, 'zlib-zip-slow-'));
+  const archivePath = path.join(dir, 'large.zip');
+  try {
+    const entries = [];
+    for (let i = 0; i < STORED_MEMBER_COUNT; i++) {
+      entries.push(zlib.ZipEntry.createStream(`stored-${i}.bin`, repeatingChunks(MEMBER_SIZE, i), {
+        method: 'store',
+      }));
+    }
+    entries.push(zlib.ZipEntry.createStream('streamed.bin', repeatingChunks(STREAMED_MEMBER_SIZE, 0xaa), {
+      method: 'store',
+    }));
+
+    const handle = await fs.open(archivePath, 'w');
+    try {
+      for await (const chunk of zlib.createZipArchive(entries)) {
+        await handle.write(chunk);
+      }
+    } finally {
+      await handle.close();
+    }
+
+    const stat = await fs.stat(archivePath);
+    assert.ok(stat.size > 4 * GiB, `archive is only ${stat.size} bytes`);
+
+    const zip = await zlib.ZipFile.open(archivePath);
+    try {
+      assert.strictEqual(zip.size, STORED_MEMBER_COUNT + 1);
+
+      let seen = 0;
+      for await (const chunk of await zip.stream('streamed.bin')) {
+        seen += chunk.length;
+        assert.strictEqual(chunk[0], 0xaa);
+      }
+      assert.strictEqual(seen, STREAMED_MEMBER_SIZE);
+
+      let storedSeen = 0;
+      for await (const chunk of await zip.stream('stored-2.bin')) {
+        storedSeen += chunk.length;
+        assert.strictEqual(chunk[0], 2);
+      }
+      assert.strictEqual(storedSeen, MEMBER_SIZE);
+
+      // The streamed member's sizes genuinely exceed 32 bits (stored, so
+      // compressed === uncompressed), which the reader must have resolved
+      // through the central header's Zip64 extra field.
+      const big = await zip.get('streamed.bin');
+      assert.strictEqual(big.size, STREAMED_MEMBER_SIZE);
+      assert.strictEqual(big.compressedSize, STREAMED_MEMBER_SIZE);
+
+      // Re-serialize the >4 GiB file-backed member through the archive
+      // writer, discarding the output: this exercises the non-streaming
+      // Zip64 local-header path (real 64-bit sizes up front, no data
+      // descriptor) without needing a second copy on disk.
+      let reserialized = 0;
+      for await (const chunk of zlib.createZipArchive([big])) {
+        reserialized += chunk.length;
+      }
+      assert.ok(reserialized > STREAMED_MEMBER_SIZE,
+                `re-serialized only ${reserialized} bytes`);
+    } finally {
+      await zip.close();
+    }
+  } finally {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+}, { timeout: 30 * 60 * 1000 });

From 8e848d9be353fc64d803181ed9c53e353ae3c027 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Thu, 6 Aug 2026 13:47:13 +0100
Subject: [PATCH 154/344] zlib: reject ambiguous ZIP archive ends

ZIP archives can contain more than one structurally plausible EOCD
record. Selecting based on whether a comment reaches EOF can make the
chosen central directory depend on trailing padding.

Inspect all candidates in the common tail window and reject archives
with multiple plausible interpretations.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65007
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/internal/zip/headers.js              | 83 +++++++++++++++++++-----
 test/parallel/test-zlib-zip-hardening.js | 77 +++++++++++++++++++++-
 2 files changed, 143 insertions(+), 17 deletions(-)

diff --git a/lib/internal/zip/headers.js b/lib/internal/zip/headers.js
index aadfa1ca3cde..42af8aedeadd 100644
--- a/lib/internal/zip/headers.js
+++ b/lib/internal/zip/headers.js
@@ -27,6 +27,7 @@ const {
   MADE_BY_UNIX,
   SENTINEL16,
   SENTINEL32,
+  TAIL_LENGTH,
   ZIP64_EOCD_MAX_LENGTH,
   S_IFLNK,
   S_IFMT,
@@ -310,6 +311,51 @@ class LocalFileHeader {
   }
 }
 
+// Returns whether an EOCD-looking record could describe an archive this
+// implementation supports. This is deliberately only a cheap preflight: the
+// selected record still receives the complete Zip64 and central-directory
+// validation below.
+function isPlausibleArchiveEnd(buffer, eocdPos, scanStart) {
+  const diskNumber = buffer.readUInt16LE(eocdPos + 4);
+  const centralDirectoryDiskNumber = buffer.readUInt16LE(eocdPos + 6);
+  const diskRecords = buffer.readUInt16LE(eocdPos + 8);
+  const totalRecords = buffer.readUInt16LE(eocdPos + 10);
+  const centralDirectorySize = buffer.readUInt32LE(eocdPos + 12);
+  const centralDirectoryOffset = buffer.readUInt32LE(eocdPos + 16);
+  const needsZip64 =
+    diskNumber === SENTINEL16 ||
+    centralDirectoryDiskNumber === SENTINEL16 ||
+    diskRecords === SENTINEL16 ||
+    totalRecords === SENTINEL16 ||
+    centralDirectorySize === SENTINEL32 ||
+    centralDirectoryOffset === SENTINEL32;
+
+  const locatorPos = eocdPos - 20;
+  const hasZip64Locator = locatorPos >= 0 &&
+    buffer.readUInt32LE(locatorPos) === SIG_ZIP64_EOCD_LOCATOR;
+  if (needsZip64) return hasZip64Locator;
+  // A Zip64 end record may accompany authoritative, non-sentinel classic
+  // fields. Its central directory does not immediately precede this EOCD.
+  if (hasZip64Locator) return true;
+  if (
+    diskNumber !== 0 ||
+    centralDirectoryDiskNumber !== 0 ||
+    diskRecords !== totalRecords ||
+    totalRecords * 46 > centralDirectorySize
+  ) {
+    return false;
+  }
+
+  const centralDirectoryPos = eocdPos - centralDirectorySize;
+  if (centralDirectoryPos < scanStart) {
+    // Use the same logical tail window for memory- and file-backed archives.
+    // The directory is not available for this cheap preflight in either case.
+    return true;
+  }
+  if (totalRecords === 0) return centralDirectorySize === 0;
+  return buffer.readUInt32LE(centralDirectoryPos) === SIG_CENTRAL_FILE_HEADER;
+}
+
 /**
  * Locates and validates the end-of-archive structures (EOCD, and the Zip64
  * EOCD locator/record when present) in `buffer`. `base` is the absolute
@@ -334,26 +380,30 @@ function findArchiveEnd(buffer, base = 0) {
   if (buffer.length < 22) {
     throw new ERR_ZIP_INVALID_ARCHIVE('no end of central directory record found');
   }
-  const min = MathMax(0, buffer.length - (22 + SENTINEL16));
+  // Use the same tail-sized search window for full buffers and ZipFile's tail
+  // reads. Besides keeping candidate selection consistent, the extra tail
+  // slack permits a maximum-length comment followed by modest writer padding.
+  const min = MathMax(0, buffer.length - TAIL_LENGTH);
   let eocdPos = -1;
-  // Pass 1: the comment must reach exactly to the end of the buffer (this
-  // rejects a stray EOCD-looking signature inside an earlier comment).
+  let fallbackPos = -1;
+  let exactFallbackPos = -1;
   for (let pos = buffer.length - 22; pos >= min; pos--) {
     if (buffer.readUInt32LE(pos) !== SIG_EOCD) continue;
-    if (pos + 22 + buffer.readUInt16LE(pos + 20) !== buffer.length) continue;
+    const end = pos + 22 + buffer.readUInt16LE(pos + 20);
+    if (end > buffer.length) continue;
+    if (fallbackPos < 0) fallbackPos = pos;
+    if (end === buffer.length && exactFallbackPos < 0) exactFallbackPos = pos;
+    if (!isPlausibleArchiveEnd(buffer, pos, min)) continue;
+    if (eocdPos >= 0) {
+      throw new ERR_ZIP_INVALID_ARCHIVE(
+        'ambiguous end of central directory records');
+    }
     eocdPos = pos;
-    break;
   }
+  // Preserve the targeted validation errors for a sole malformed or
+  // unsupported candidate. Plausible candidates always take precedence.
   if (eocdPos < 0) {
-    // Pass 2: tolerate trailing padding after the EOCD (some streaming
-    // writers pad their output to a fixed block size); take the last
-    // candidate found.
-    for (let pos = buffer.length - 22; pos >= min; pos--) {
-      if (buffer.readUInt32LE(pos) !== SIG_EOCD) continue;
-      if (pos + 22 + buffer.readUInt16LE(pos + 20) > buffer.length) continue;
-      eocdPos = pos;
-      break;
-    }
+    eocdPos = exactFallbackPos >= 0 ? exactFallbackPos : fallbackPos;
   }
   if (eocdPos < 0) {
     throw new ERR_ZIP_INVALID_ARCHIVE('no end of central directory record found');
@@ -474,7 +524,10 @@ function findArchiveEnd(buffer, base = 0) {
   if (prefix < 0) {
     throw new ERR_ZIP_INVALID_ARCHIVE('central directory does not fit inside the archive');
   }
-  if (totalRecords * 46 > centralDirectorySize) {
+  if (
+    (totalRecords === 0 && centralDirectorySize !== 0) ||
+    totalRecords * 46 > centralDirectorySize
+  ) {
     throw new ERR_ZIP_INVALID_ARCHIVE(
       'central directory record count is inconsistent with its size');
   }
diff --git a/test/parallel/test-zlib-zip-hardening.js b/test/parallel/test-zlib-zip-hardening.js
index de2a9efd4918..9427a546c889 100644
--- a/test/parallel/test-zlib-zip-hardening.js
+++ b/test/parallel/test-zlib-zip-hardening.js
@@ -3,8 +3,10 @@
 require('../common');
 
 const assert = require('node:assert');
+const fs = require('node:fs');
 const zlib = require('node:zlib');
 const { test } = require('node:test');
+const tmpdir = require('../common/tmpdir');
 
 async function buildArchive(entries, comment) {
   const chunks = [];
@@ -47,13 +49,71 @@ test('an EOCD-looking signature inside a trailing comment is not mistaken for th
   // before it reaches the genuine EOCD signature; embedding 4 bytes that
   // look like one partway through must not be mistaken for the real record.
   const fakeSignature = String.fromCharCode(0x50, 0x4b, 0x05, 0x06);
-  const archive = await buildArchive([entry], `before ${fakeSignature} after`);
+  const archive = await buildArchive(
+    [entry], `before ${fakeSignature} this is not a valid EOCD record after`);
 
   const read = [...zlib.ZipEntry.read(archive)];
   assert.strictEqual(read.length, 1);
   assert.strictEqual(read[0].name, 'f.txt');
 });
 
+test('multiple plausible EOCD records describing different archives are rejected', async () => {
+  const first = await buildArchive([
+    await zlib.ZipEntry.create('install.sh', Buffer.from('malicious'), { method: 'store' }),
+  ]);
+  const second = await buildArchive([
+    await zlib.ZipEntry.create('install.sh', Buffer.from('benign'), { method: 'store' }),
+  ]);
+  const archive = Buffer.concat([first, second, Buffer.from([0])]);
+  const firstEocd = first.length - 22;
+
+  // Make the first EOCD exact-to-EOF by treating the second archive and its
+  // padding as a comment. The second EOCD remains a plausible archive end for
+  // readers which tolerate trailing padding and select the rightmost record.
+  archive.writeUInt16LE(archive.length - firstEocd - 22, firstEocd + 20);
+
+  const expected = {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /ambiguous end of central directory/,
+  };
+  assert.throws(() => [...zlib.ZipEntry.read(archive)], expected);
+  assert.throws(() => new zlib.ZipBuffer(archive), expected);
+
+  tmpdir.refresh();
+  const file = tmpdir.resolve('ambiguous.zip');
+  fs.writeFileSync(file, archive);
+  await assert.rejects(zlib.ZipFile.open(file), expected);
+  assert.throws(() => zlib.ZipFile.openSync(file), expected);
+});
+
+test('an exact EOCD embedded in a genuine comment is rejected as ambiguous', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('f.txt', Buffer.from('content'), { method: 'store' }),
+  ]);
+  const nested = Buffer.concat([archive, buildEocd()]);
+  nested.writeUInt16LE(22, archive.length - 2);
+
+  assert.throws(() => [...zlib.ZipEntry.read(nested)], {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /ambiguous end of central directory/,
+  });
+});
+
+test('multiple padded EOCD records are rejected as ambiguous', async () => {
+  const first = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('first'), { method: 'store' }),
+  ]);
+  const second = await buildArchive([
+    await zlib.ZipEntry.create('b.txt', Buffer.from('second'), { method: 'store' }),
+  ]);
+  const archive = Buffer.concat([first, second, Buffer.from('\0\0')]);
+
+  assert.throws(() => new zlib.ZipBuffer(archive), {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /ambiguous end of central directory/,
+  });
+});
+
 test('a declared-size mismatch is rejected as corrupt', async () => {
   const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' });
   const archive = await buildArchive([entry]);
@@ -212,7 +272,7 @@ test('every possible truncation of an archive is rejected, deterministically', a
 
 test('trailing padding after the EOCD is tolerated', async () => {
   // Some streaming writers pad their output to a block size; CPython
-  // tolerates trailing newlines/NULs and so does the pass-2 EOCD scan.
+  // tolerates trailing newlines/NULs and so does the EOCD scan.
   const archive = await buildArchive(
     [await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' })]);
   const padded = Buffer.concat([archive, Buffer.from('\r\n\0\0\0')]);
@@ -221,6 +281,15 @@ test('trailing padding after the EOCD is tolerated', async () => {
   assert.strictEqual((await entry.content()).toString(), 'hi');
 });
 
+test('a maximum-length comment followed by block padding is tolerated', async () => {
+  const comment = 'x'.repeat(0xffff);
+  const archive = await buildArchive([], comment);
+  const padded = Buffer.concat([archive, Buffer.alloc(4096)]);
+  const zip = new zlib.ZipBuffer(padded);
+
+  assert.strictEqual(zip.comment, comment);
+});
+
 test('junk appended past a declared comment is tolerated and the comment preserved', async () => {
   const archive = await buildArchive(
     [await zlib.ZipEntry.create('f.txt', Buffer.from('hi'), { method: 'store' })],
@@ -262,6 +331,10 @@ test('a record count inconsistent with the directory size is rejected', () => {
   const archive = Buffer.concat([Buffer.alloc(46), eocd]);
   assert.throws(() => [...zlib.ZipEntry.read(archive)],
                 { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /inconsistent/ });
+
+  const zeroRecords = Buffer.concat([Buffer.alloc(46), buildEocd({ cdSize: 46 })]);
+  assert.throws(() => [...zlib.ZipEntry.read(zeroRecords)],
+                { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /inconsistent/ });
 });
 
 test('a corrupted or overrunning central directory header is rejected', async () => {

From 575260d3b4f1e2476375af10a0cdd0ac8485355c Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Wed, 12 Aug 2026 10:02:57 +0100
Subject: [PATCH 155/344] zlib: validate central directory record count

ZIP readers trusted the EOCD record count. They did not check that
the parsed headers consumed the declared central directory size.
Reject archives whose count leaves directory bytes unparsed.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65002
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/internal/zip/entry.js               |  4 +++
 lib/internal/zip/headers.js             |  4 +++
 test/parallel/test-zlib-zip-security.js | 34 +++++++++++++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/lib/internal/zip/entry.js b/lib/internal/zip/entry.js
index 4eab161db9b2..c9fb1cac62cd 100644
--- a/lib/internal/zip/entry.js
+++ b/lib/internal/zip/entry.js
@@ -941,6 +941,10 @@ function* readArchiveEntries(buf, end) {
     });
     pos = central.byteOffset + central.byteLength;
   }
+  if (pos !== cdEnd) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(
+      'central directory record count is inconsistent with its size');
+  }
   // Sort a separate range list; entries themselves are yielded in central
   // directory order.
   const ranges = ArrayPrototypeSort(ArrayPrototypeSlice(parsed), (a, b) => a.start - b.start);
diff --git a/lib/internal/zip/headers.js b/lib/internal/zip/headers.js
index 42af8aedeadd..f1f028cb511b 100644
--- a/lib/internal/zip/headers.js
+++ b/lib/internal/zip/headers.js
@@ -553,6 +553,10 @@ function readCentralDirectory(buffer, count) {
     ArrayPrototypePush(result, header);
     pos += header.byteLength;
   }
+  if (pos !== buffer.length) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(
+      'central directory record count is inconsistent with its size');
+  }
   return result;
 }
 
diff --git a/test/parallel/test-zlib-zip-security.js b/test/parallel/test-zlib-zip-security.js
index ba63af08fb2d..aa4b37f4c608 100644
--- a/test/parallel/test-zlib-zip-security.js
+++ b/test/parallel/test-zlib-zip-security.js
@@ -230,6 +230,40 @@ test('open() rejects contradictory classic-EOCD vs Zip64 metadata', async () =>
   }
 }, { timeout: 120_000 });
 
+test('central-directory record count must account for its full declared size', async () => {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive([
+    await zlib.ZipEntry.create('visible.txt', Buffer.from('visible'), { method: 'store' }),
+    await zlib.ZipEntry.create('hidden.txt', Buffer.from('hidden'), { method: 'store' }),
+  ])) chunks.push(chunk);
+  const tampered = Buffer.concat(chunks);
+  const eocd = tampered.length - 22;
+  assert.strictEqual(tampered.readUInt16LE(eocd + 8), 2);
+  assert.strictEqual(tampered.readUInt16LE(eocd + 10), 2);
+
+  // Keep the single-disk counts consistent with each other, but make both
+  // disagree with the two complete records in the declared directory size.
+  tampered.writeUInt16LE(1, eocd + 8);
+  tampered.writeUInt16LE(1, eocd + 10);
+  const expected = {
+    code: 'ERR_ZIP_INVALID_ARCHIVE',
+    message: /central directory record count is inconsistent with its size/,
+  };
+
+  assert.throws(() => [...zlib.ZipEntry.read(tampered)], expected);
+  assert.throws(() => new zlib.ZipBuffer(tampered), expected);
+
+  const dir = await fsp.mkdtemp(path.join(tmpdir.path, `zip-sec-${seq++}-`));
+  const p = path.join(dir, 'record-count-mismatch.zip');
+  try {
+    await fsp.writeFile(p, tampered);
+    await assert.rejects(zlib.ZipFile.open(p), expected);
+    assert.throws(() => zlib.ZipFile.openSync(p), expected);
+  } finally {
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
 // -- Finding 4: the file-backed open-time overlap check uses a 30-byte lower
 // bound for each local header, while the in-memory reader uses the exact
 // local-header length. A crafted "quoted overlap" archive therefore passes

From e3fda695fea00fd820e356521e1ba400d1edd934 Mon Sep 17 00:00:00 2001
From: Chemi Atlow <chemi@atlow.co.il>
Date: Thu, 13 Aug 2026 16:26:26 +0300
Subject: [PATCH 156/344] test_runner: extend tag filter with boolean
 expression DSL

Upgrades the experimental tag filter introduced by stage 1 to accept a
boolean expression instead of a literal tag name.

Grammar: `and`/`&&`, `or`/`||`, `not`/`!`, parentheses for grouping,
and `*` wildcards inside identifiers. Standard precedence
(`not > and > or`); binary operators are left-associative. Word forms
require whitespace separation; punctuation forms do not. Untagged
tests evaluate `false` for any include expression and `true` for
`not X`, so excluding tags does not accidentally remove untagged
tests.

The flag and `testTagFilters` option are still repeatable; multiple
expressions still AND together. Malformed expressions fail fast at
the parent process at startup.

Tag value validation tightens to reject whitespace, operator
characters (`& | ! ( ) *`), and the reserved words `and`/`or`/`not`
in any casing - a breaking change relative to the stage 1 ship,
acceptable at Stability 1.0 (Early development).

Signed-off-by: atlowChemi <chemi@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/63054
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
---
 doc/api/cli.md                                |  22 +-
 doc/api/test.md                               |  99 +++-
 doc/node.1                                    |  20 +-
 lib/internal/test_runner/runner.js            |  35 +-
 lib/internal/test_runner/tag_filter.js        | 446 ++++++++++++++++--
 lib/internal/test_runner/utils.js             |  18 +-
 test/parallel/test-runner-tag-filter-cli.mjs  |  81 +++-
 .../test-runner-tag-filter-parser.mjs         | 257 ++++++++++
 test/parallel/test-runner-tags-events.mjs     |   8 +
 .../test-runner-tags-experimental-warning.mjs |   2 +-
 test/parallel/test-runner-tags-validation.mjs |  29 +-
 11 files changed, 920 insertions(+), 97 deletions(-)
 create mode 100644 test/parallel/test-runner-tag-filter-parser.mjs

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 7e503bdde4f2..71f91a825095 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -1480,7 +1480,7 @@ Enable module mocking in the test runner.
 
 This feature requires `--allow-worker` if used with the [Permission Model][].
 
-### `--experimental-test-tag-filter=<tag>`
+### `--experimental-test-tag-filter='<expr>'`
 
 <!-- YAML
 added: v26.2.0
@@ -1488,14 +1488,20 @@ added: v26.2.0
 
 > Stability: 1.0 - Early development
 
-Run only tests whose tag set contains `<tag>`. Tests declare tags via the
-`tags` option on `test()`, `it()`, `suite()`, or `describe()`; tags
-inherit from suites to nested tests by union. Filtering is
-case-insensitive.
+Run only tests that match the provided boolean tag-filter expression. Tests
+declare tags via the `tags` option on `test()`, `it()`, `suite()`, or
+`describe()`. Tags inherit from suites to nested tests by union.
 
-The flag may be specified more than once; tests must contain **every**
-filter value to run. See [Test tags][] for details on declaring and
-inheriting tags.
+The expression supports boolean operators (`and`/`&&`, `or`/`||`,
+`not`/`!`), parentheses for grouping, and `*` wildcards inside identifiers.
+Standard precedence applies: `not` binds tighter than `and`, which binds
+tighter than `or`. See [Test tags][] for the full grammar and behavior.
+
+The flag may be specified more than once; multiple expressions are combined
+with AND, so a test must satisfy every expression to run.
+
+A malformed expression causes the test runner to exit with a non-zero status
+before running any tests.
 
 ### `--experimental-vfs`
 
diff --git a/doc/api/test.md b/doc/api/test.md
index 7199d78a0ee9..1b47eaf70f75 100644
--- a/doc/api/test.md
+++ b/doc/api/test.md
@@ -489,8 +489,8 @@ added: v26.2.0
 
 Tags annotate tests and suites with arbitrary string labels. The
 [`--experimental-test-tag-filter`][] CLI flag (or the `testTagFilters`
-option on [`run()`][]) selects tests whose tag set contains every
-provided filter value.
+option on [`run()`][]) selects tests by a boolean expression over those
+labels.
 
 Tags are an alternative to encoding metadata into test names. They are
 useful for cross-cutting axes such as subsystem, speed bucket, flakiness,
@@ -523,37 +523,89 @@ describe('database', { tags: ['db'] }, () => {
 });
 ```
 
-Tag values must be non-empty strings. Tags are matched case-insensitively;
-the canonical form is lowercase. Duplicates within a single `tags` array
-are collapsed on the lowercased form, preserving the first-seen
-declaration order.
+Tag values must be non-empty strings that contain no whitespace, no
+operator characters (`& | ! ( ) *`), and are not the reserved words
+`'and'`, `'or'`, or `'not'` in any casing. Tags are matched
+case-insensitively; the canonical form is lowercase. Duplicates within a
+single `tags` array are collapsed on the lowercased form, preserving the
+first-seen declaration order.
 
 Hooks (`before`, `after`, `beforeEach`, `afterEach`) do not declare their
 own tags. They run as part of their owning suite, which carries the
 suite's tags.
 
-### Filtering by tag
+### Filtering syntax
 
-Each [`--experimental-test-tag-filter`][] value is a literal tag name. A
-test runs only when its tag set contains that name. The flag may be
-specified more than once; tests must match **every** filter to run. The
-same applies to the `testTagFilters` array on [`run()`][]. Filters are
-case-insensitive and AND'd with [`--test-name-pattern`][],
-[`--test-skip-pattern`][], and `.only` filtering.
+The filter expression supports:
 
-Untagged tests are excluded under any non-empty filter, since the filter
-requires the tag to be present.
+* Identifiers—any non-whitespace, non-operator characters. A literal
+  identifier matches a tag of the same value (case-insensitive).
+* `*` wildcards inside an identifier match any sequence of characters.
+  A bare `*` matches any tagged test.
+* Boolean operators with two equivalent forms:
+  * `and` / `&&`
+  * `or` / `||`
+  * `not` / `!`
+* Parentheses for grouping.
 
-### Reading tags from inside a test
+The word forms (`and`, `or`, `not`) require whitespace separation; the
+punctuation forms do not.
+
+#### Operator precedence
+
+The expression is evaluated with the standard precedence
+`not > and > or`. Binary operators are left-associative.
+
+| Expression     | Equivalent grouping |
+| -------------- | ------------------- |
+| `a or b and c` | `a or (b and c)`    |
+| `not a and b`  | `(not a) and b`     |
+
+Use parentheses to override:
+
+| Expression                     | Selects                                    |
+| ------------------------------ | ------------------------------------------ |
+| `(unit or smoke) and not slow` | unit-or-smoke tests that are not also slow |
+| `db && !flaky`                 | db tests that are not flaky                |
+| `*`                            | every tagged test                          |
+
+#### Untagged tests
+
+Untagged tests behave as if they have an empty tag set. As a result:
+
+| Filter expression        | Untagged test | Why                                              |
+| ------------------------ | ------------- | ------------------------------------------------ |
+| `db`                     | excluded      | Positive match against an empty tag set is false |
+| `*`                      | excluded      | The bare wildcard requires at least one tag      |
+| `db or unit`             | excluded      | Both branches are false against an empty tag set |
+| `not flaky`              | included      | Negation against an empty tag set is true        |
+| `not flaky and not slow` | included      | Both negations are true against an empty tag set |
+| `db or not flaky`        | included      | The negated branch is true                       |
+
+For example, `--experimental-test-tag-filter='not flaky'` runs every test
+that is not tagged `flaky`, including all untagged tests.
+
+#### Composing multiple filters
+
+[`--experimental-test-tag-filter`][] may be specified more than once on the
+command line. Multiple expressions compose by AND—a test must satisfy
+every expression to run. The same applies to passing an array to
+`testTagFilters` on [`run()`][]. The tag filter is also AND'd with
+[`--test-name-pattern`][], [`--test-skip-pattern`][], and `.only`
+filtering.
+
+#### Reading tags from inside a test
 
 The [`TestContext`][] object exposes the test's tags as a frozen array
 through [`context.tags`][], so tests can branch on their own metadata.
 
-### Errors
+#### Errors
 
 A tag value that violates the validation rules above throws
 `ERR_INVALID_ARG_VALUE` at the registration site, before any test runs.
-A non-array `tags` value throws `ERR_INVALID_ARG_TYPE`.
+A non-array `tags` value throws `ERR_INVALID_ARG_TYPE`. A malformed
+filter expression on the CLI causes the test runner to exit with a
+non-zero status before running any test files.
 
 ## Extraneous asynchronous activity
 
@@ -826,7 +878,7 @@ test runner functionality:
 
 * `--test` - Prevented to avoid recursive test execution
 * `--experimental-test-coverage` - Managed by the test runner
-* `--experimental-test-tag-filter` - Filter values are validated by the parent
+* `--experimental-test-tag-filter` - Filter expressions are validated by the parent
   process and re-emitted to child processes
 * `--watch` - Watch mode is handled at the parent level
 * `--experimental-default-config-file` - Config file loading is handled by the parent
@@ -1740,10 +1792,11 @@ changes:
     For each test that is executed, any corresponding test hooks, such as
     `beforeEach()`, are also run.
     **Default:** `undefined`.
-  * `testTagFilters` {string|string\[]} A tag name, or an array of tag names,
-    used to filter tests by their declared tags. Tests must contain every
-    listed tag to run. Equivalent to passing [`--experimental-test-tag-filter`][]
-    on the command line. See [Test tags][]. **Default:** `undefined`.
+  * `testTagFilters` {string|string\[]} A boolean expression, or an array of
+    boolean expressions, used to filter tests by their declared tags.
+    Multiple expressions compose by AND. Equivalent to passing
+    [`--experimental-test-tag-filter`][] on the command line. See
+    [Test tags][]. **Default:** `undefined`.
   * `timeout` {number} A number of milliseconds the test execution will
     fail after.
     If unspecified, subtests inherit this value from their parent.
diff --git a/doc/node.1 b/doc/node.1
index 5d7ce00a6f7b..4d9b8922ba75 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -810,14 +810,18 @@ collecting code coverage from tests for more details.
 Enable module mocking in the test runner.
 This feature requires \fB--allow-worker\fR if used with the Permission Model.
 .
-.It Fl -experimental-test-tag-filter Ns = Ns Ar <tag>
-Run only tests whose tag set contains \fB<tag>\fR. Tests declare tags via the
-\fBtags\fR option on \fBtest()\fR, \fBit()\fR, \fBsuite()\fR, or \fBdescribe()\fR; tags
-inherit from suites to nested tests by union. Filtering is
-case-insensitive.
-The flag may be specified more than once; tests must contain \fBevery\fR
-filter value to run. See Test tags for details on declaring and
-inheriting tags.
+.It Fl -experimental-test-tag-filter Ns = Ns Ar '<expr>'
+Run only tests that match the provided boolean tag-filter expression. Tests
+declare tags via the \fBtags\fR option on \fBtest()\fR, \fBit()\fR, \fBsuite()\fR, or
+\fBdescribe()\fR. Tags inherit from suites to nested tests by union.
+The expression supports boolean operators (\fBand\fR/\fB&&\fR, \fBor\fR/\fB||\fR,
+\fBnot\fR/\fB!\fR), parentheses for grouping, and \fB*\fR wildcards inside identifiers.
+Standard precedence applies: \fBnot\fR binds tighter than \fBand\fR, which binds
+tighter than \fBor\fR. See Test tags for the full grammar and behavior.
+The flag may be specified more than once; multiple expressions are combined
+with AND, so a test must satisfy every expression to run.
+A malformed expression causes the test runner to exit with a non-zero status
+before running any tests.
 .
 .It Fl -experimental-vfs
 Enable the experimental \fBnode:vfs\fR module.
diff --git a/lib/internal/test_runner/runner.js b/lib/internal/test_runner/runner.js
index 548ed006e152..49ef9cb465b4 100644
--- a/lib/internal/test_runner/runner.js
+++ b/lib/internal/test_runner/runner.js
@@ -12,6 +12,7 @@ const {
   ArrayPrototypePush,
   ArrayPrototypePushApply,
   ArrayPrototypeShift,
+  ArrayPrototypeSlice,
   ArrayPrototypeSome,
   ArrayPrototypeSort,
   MathMax,
@@ -93,7 +94,7 @@ const {
   parseCommandLine,
 } = require('internal/test_runner/utils');
 const {
-  validateAndCanonicalizeTagFilter,
+  parseTagFilterExpression,
 } = require('internal/test_runner/tag_filter');
 const { Glob } = require('internal/fs/glob');
 const { once } = require('events');
@@ -182,7 +183,7 @@ function getRunArgs(path, { forceExit,
                             inspectPort,
                             testNamePatterns,
                             testSkipPatterns,
-                            testTagFilters,
+                            testTagFilterExpressions,
                             only,
                             hasFiles,
                             testFiles,
@@ -224,8 +225,8 @@ function getRunArgs(path, { forceExit,
   if (testSkipPatterns != null) {
     ArrayPrototypeForEach(testSkipPatterns, (pattern) => ArrayPrototypePush(runArgs, `--test-skip-pattern=${pattern}`));
   }
-  if (testTagFilters != null) {
-    ArrayPrototypeForEach(testTagFilters, (value) => ArrayPrototypePush(runArgs, `--experimental-test-tag-filter=${value}`));
+  if (testTagFilterExpressions != null) {
+    ArrayPrototypeForEach(testTagFilterExpressions, (expr) => ArrayPrototypePush(runArgs, `--experimental-test-tag-filter=${expr}`));
   }
   if (only === true) {
     ArrayPrototypePush(runArgs, '--test-only');
@@ -872,19 +873,37 @@ function run(options = kEmptyObject) {
     });
   }
 
+  // The public contract of testTagFilters is `string | string[]`. The
+  // parseCommandLine bootstrap path piggybacks the already-parsed AST array
+  // on the same field, identifiable by the sibling testTagFilterExpressions
+  // field which only that path sets. When that marker is present and the
+  // first element isn't a string, treat the array as ASTs and skip the
+  // public validation loop. Otherwise validate every element as a string,
+  // so any non-string input throws ERR_INVALID_ARG_TYPE with the offending
+  // index regardless of position.
+  let testTagFilterExpressions = null;
   if (testTagFilters != null) {
     if (!ArrayIsArray(testTagFilters)) {
       testTagFilters = [testTagFilters];
     }
     if (testTagFilters.length === 0) {
       testTagFilters = null;
+    } else if (options.testTagFilterExpressions != null &&
+               typeof testTagFilters[0] !== 'string') {
+      // Internal bootstrap: trust the AST array as already-parsed.
     } else {
       emitExperimentalWarning('Test tags');
-      testTagFilters = ArrayPrototypeMap(testTagFilters, (value, i) => (
-        validateAndCanonicalizeTagFilter(value, `options.testTagFilters[${i}]`)
-      ));
+      testTagFilterExpressions = ArrayPrototypeSlice(testTagFilters);
+      testTagFilters = ArrayPrototypeMap(testTagFilters, (value, i) => {
+        const name = `options.testTagFilters[${i}]`;
+        if (typeof value !== 'string') {
+          throw new ERR_INVALID_ARG_TYPE(name, 'string', value);
+        }
+        return parseTagFilterExpression(value, name);
+      });
     }
   }
+  testTagFilterExpressions ??= options.testTagFilterExpressions;
 
   validateOneOf(isolation, 'options.isolation', ['process', 'none']);
   validateBoolean(coverage, 'options.coverage');
@@ -986,7 +1005,7 @@ function run(options = kEmptyObject) {
     inspectPort,
     testNamePatterns,
     testSkipPatterns,
-    testTagFilters,
+    testTagFilterExpressions,
     hasFiles: files != null,
     globPatterns,
     only,
diff --git a/lib/internal/test_runner/tag_filter.js b/lib/internal/test_runner/tag_filter.js
index 35dc2647a2aa..0151abf31cc7 100644
--- a/lib/internal/test_runner/tag_filter.js
+++ b/lib/internal/test_runner/tag_filter.js
@@ -2,8 +2,14 @@
 const {
   ArrayPrototypePush,
   ObjectFreeze,
+  RegExp,
+  RegExpPrototypeExec,
   SafeSet,
+  StringPrototypeCharCodeAt,
+  StringPrototypeSlice,
+  StringPrototypeSplit,
   StringPrototypeToLowerCase,
+  StringPrototypeTrim,
 } = primordials;
 
 const {
@@ -19,14 +25,68 @@ const {
   validateString,
 } = require('internal/validators');
 
+const kCharAmpersand = 0x26;
+const kCharBackslash = 0x5C;
+const kCharCarriageReturn = 0x0D;
+const kCharCaret = 0x5E;
+const kCharDollar = 0x24;
+const kCharDot = 0x2E;
+const kCharExclaim = 0x21;
+const kCharFormFeed = 0x0C;
+const kCharLBrace = 0x7B;
+const kCharLBracket = 0x5B;
+const kCharLineFeed = 0x0A;
+const kCharLParen = 0x28;
+const kCharPipe = 0x7C;
+const kCharPlus = 0x2B;
+const kCharQuestion = 0x3F;
+const kCharRBrace = 0x7D;
+const kCharRBracket = 0x5D;
+const kCharRParen = 0x29;
+const kCharSpace = 0x20;
+const kCharStar = 0x2A;
+const kCharTab = 0x09;
+const kCharVerticalTab = 0x0B;
+
+// Single `&` and `|` are allowed here: standalone they have no operator
+// meaning, only the doubled forms `&&` and `||` do.
+const kTagForbiddenChars = new SafeSet([
+  kCharTab, kCharLineFeed, kCharVerticalTab, kCharFormFeed, kCharCarriageReturn, kCharSpace,
+  kCharAmpersand, kCharExclaim, kCharLParen, kCharPipe, kCharRParen, kCharStar,
+]);
+
+const kReservedWords = new SafeSet(['and', 'or', 'not']);
+
+/**
+ * Frozen, shared empty array used as the canonical "no tags" value for
+ * tests that don't declare their own and have no tagged ancestors.
+ * Sharing one frozen instance avoids per-test allocation.
+ * @type {readonly string[]}
+ */
 const kEmptyTagArray = ObjectFreeze([]);
 
+function isWhitespace(ch) {
+  return ch === kCharTab || ch === kCharLineFeed || ch === kCharVerticalTab ||
+         ch === kCharFormFeed || ch === kCharCarriageReturn || ch === kCharSpace;
+}
+
+// `*` is intentionally not a break char: it's allowed inside an identifier
+// and becomes a wildcard.
+function isIdentBreak(ch) {
+  return isWhitespace(ch) ||
+         ch === kCharAmpersand || ch === kCharPipe ||
+         ch === kCharExclaim || ch === kCharLParen || ch === kCharRParen;
+}
+
 /**
  * Validate and canonicalize a `tags` option value supplied to `test()`,
  * `it()`, `suite()`, or `describe()`.
  *
- * Each tag must be a non-empty string. Tags are canonicalized to lowercase
- * and deduplicated, preserving first-seen declaration order.
+ * Each tag must be a non-empty string that contains no whitespace, no
+ * operator characters (`& | ! ( ) *`), and is not the reserved word
+ * `'and'`, `'or'`, or `'not'` in any casing. Tags are canonicalized to
+ * lowercase and deduplicated on the lowercased form, preserving the
+ * first-seen declaration order.
  *
  * Calling this with a non-empty array also emits the one-shot
  * `ExperimentalWarning` for the test-tags feature.
@@ -37,7 +97,8 @@ const kEmptyTagArray = ObjectFreeze([]);
  *   Returns an empty array when `tags` is `[]`.
  * @throws {ERR_INVALID_ARG_TYPE} If `tags` is not an array, or any element
  *   is not a string.
- * @throws {ERR_INVALID_ARG_VALUE} If any element is empty.
+ * @throws {ERR_INVALID_ARG_VALUE} If any element is empty, contains a
+ *   forbidden character, or is a reserved word in any casing.
  */
 function validateAndCanonicalizeTagValues(tags, optName) {
   validateArray(tags, optName);
@@ -55,7 +116,34 @@ function validateAndCanonicalizeTagValues(tags, optName) {
     const tag = tags[i];
     const elemName = `${optName}[${i}]`;
 
-    const lower = validateAndCanonicalizeTagFilter(tag, elemName);
+    validateString(tag, elemName);
+
+    if (tag.length === 0) {
+      throw new ERR_INVALID_ARG_VALUE(elemName, tag, 'must not be empty');
+    }
+
+    for (let j = 0; j < tag.length; j++) {
+      const ch = StringPrototypeCharCodeAt(tag, j);
+      if (kTagForbiddenChars.has(ch)) {
+        throw new ERR_INVALID_ARG_VALUE(
+          elemName,
+          tag,
+          'contains a forbidden character. Tags must not contain whitespace, ' +
+          'operator characters (&, |, !, (, ), *), or be the reserved words ' +
+          '\'and\', \'or\', or \'not\'',
+        );
+      }
+    }
+
+    const lower = StringPrototypeToLowerCase(tag);
+
+    if (kReservedWords.has(lower)) {
+      throw new ERR_INVALID_ARG_VALUE(
+        elemName,
+        tag,
+        'must not be the reserved word \'and\', \'or\', or \'not\'',
+      );
+    }
 
     if (!seen.has(lower)) {
       seen.add(lower);
@@ -66,43 +154,341 @@ function validateAndCanonicalizeTagValues(tags, optName) {
   return ObjectFreeze(result);
 }
 
+// ---------------------------------------------------------------------------
+// Lexer
+// ---------------------------------------------------------------------------
+
+// Token types
+const T_AND = 'AND';
+const T_OR = 'OR';
+const T_NOT = 'NOT';
+const T_LPAREN = 'LPAREN';
+const T_RPAREN = 'RPAREN';
+const T_IDENT = 'IDENT';
+const T_EOF = 'EOF';
+
+function lex(expr, name) {
+  const tokens = [];
+  let i = 0;
+  const len = expr.length;
+
+  while (i < len) {
+    const ch = StringPrototypeCharCodeAt(expr, i);
+
+    if (isWhitespace(ch)) {
+      i++;
+      continue;
+    }
+
+    if (ch === kCharAmpersand) {
+      if (i + 1 < len && StringPrototypeCharCodeAt(expr, i + 1) === kCharAmpersand) {
+        ArrayPrototypePush(tokens, { __proto__: null, type: T_AND, pos: i });
+        i += 2;
+      } else {
+        throw new ERR_INVALID_ARG_VALUE(
+          name, expr,
+          `unexpected '&' at position ${i}; use '&&' or 'and'`,
+        );
+      }
+      continue;
+    }
+
+    if (ch === kCharPipe) {
+      if (i + 1 < len && StringPrototypeCharCodeAt(expr, i + 1) === kCharPipe) {
+        ArrayPrototypePush(tokens, { __proto__: null, type: T_OR, pos: i });
+        i += 2;
+      } else {
+        throw new ERR_INVALID_ARG_VALUE(
+          name, expr,
+          `unexpected '|' at position ${i}; use '||' or 'or'`,
+        );
+      }
+      continue;
+    }
+
+    if (ch === kCharExclaim) {
+      ArrayPrototypePush(tokens, { __proto__: null, type: T_NOT, pos: i });
+      i++;
+      continue;
+    }
+
+    if (ch === kCharLParen) {
+      ArrayPrototypePush(tokens, { __proto__: null, type: T_LPAREN, pos: i });
+      i++;
+      continue;
+    }
+
+    if (ch === kCharRParen) {
+      ArrayPrototypePush(tokens, { __proto__: null, type: T_RPAREN, pos: i });
+      i++;
+      continue;
+    }
+
+    const start = i;
+    while (i < len && !isIdentBreak(StringPrototypeCharCodeAt(expr, i))) {
+      i++;
+    }
+    const ident = StringPrototypeSlice(expr, start, i);
+    const lower = StringPrototypeToLowerCase(ident);
+
+    if (lower === 'and') {
+      ArrayPrototypePush(tokens, { __proto__: null, type: T_AND, pos: start });
+    } else if (lower === 'or') {
+      ArrayPrototypePush(tokens, { __proto__: null, type: T_OR, pos: start });
+    } else if (lower === 'not') {
+      ArrayPrototypePush(tokens, { __proto__: null, type: T_NOT, pos: start });
+    } else {
+      ArrayPrototypePush(tokens, { __proto__: null, type: T_IDENT, value: ident, pos: start });
+    }
+  }
+
+  ArrayPrototypePush(tokens, { __proto__: null, type: T_EOF, pos: len });
+  return tokens;
+}
+
+// ---------------------------------------------------------------------------
+// Regex escaping for wildcard tags
+// ---------------------------------------------------------------------------
+
+// `*` is the only metacharacter intentionally not escaped: the caller
+// handles it as a wildcard.
+function escapeForRegExp(str) {
+  let result = '';
+  for (let i = 0; i < str.length; i++) {
+    const ch = StringPrototypeCharCodeAt(str, i);
+    if (
+      ch === kCharLBracket || ch === kCharRBracket ||
+      ch === kCharLParen || ch === kCharRParen ||
+      ch === kCharLBrace || ch === kCharRBrace ||
+      ch === kCharCaret || ch === kCharDollar ||
+      ch === kCharDot || ch === kCharPlus ||
+      ch === kCharQuestion || ch === kCharBackslash ||
+      ch === kCharPipe
+    ) {
+      result += '\\';
+    }
+    result += StringPrototypeSlice(str, i, i + 1);
+  }
+  return result;
+}
+
+function buildWildcardRegex(ident) {
+  // Lowercase the source first and drop the /i flag, so wildcard matching
+  // uses the same casing semantics as literal matching (which lowercases the
+  // tag value at validation time). Using /i would diverge for non-ASCII
+  // characters whose String.prototype.toLowerCase() output differs from
+  // RegExp /i case folding (e.g. Turkish I-with-dot U+0130).
+  const parts = StringPrototypeSplit(StringPrototypeToLowerCase(ident), '*');
+  let pattern = '^';
+  for (let i = 0; i < parts.length; i++) {
+    if (i > 0) {
+      pattern += '.*';
+    }
+    pattern += escapeForRegExp(parts[i]);
+  }
+  pattern += '$';
+  return new RegExp(pattern);
+}
+
+function makeTagNode(ident) {
+  for (let i = 0; i < ident.length; i++) {
+    if (StringPrototypeCharCodeAt(ident, i) === kCharStar) {
+      return { __proto__: null, type: 'wildcard', re: buildWildcardRegex(ident) };
+    }
+  }
+  return { __proto__: null, type: 'tag', value: StringPrototypeToLowerCase(ident) };
+}
+
+// ---------------------------------------------------------------------------
+// Parser - recursive descent
+// Precedence: not > and > or  (standard Boolean)
+// ---------------------------------------------------------------------------
+
 /**
- * Validate and canonicalize a single tag-filter string supplied via
- * `--experimental-test-tag-filter` or `testTagFilters`.
+ * Parse a tag filter expression string into an AST suitable for
+ * `evaluateTagFilters`.
  *
- * Filters are literal tag names: a test passes the filter when its tag set
- * contains the lowercased filter value. Multi-occurrence composes by AND
- * at the call site (see `evaluateTagFilters`).
- * @param {unknown} value - The supplied filter string.
- * @param {string} name - Argument name embedded in thrown error messages.
- * @returns {string} The lowercased filter value.
- * @throws {ERR_INVALID_ARG_TYPE} If `value` is not a string.
- * @throws {ERR_INVALID_ARG_VALUE} If `value` is empty.
+ * Supported syntax:
+ *   - Identifiers: any non-whitespace, non-operator characters; case-
+ *     insensitive when matched. A `*` inside an identifier becomes a
+ *     wildcard that matches any sequence of characters; a bare `*`
+ *     matches any non-empty tag.
+ *   - Boolean operators: `and`/`&&`, `or`/`||`, `not`/`!`, with the
+ *     standard precedence `not > and > or` and left-associative binary
+ *     operators. Word forms must be whitespace-separated; punctuation
+ *     forms do not.
+ *   - Parentheses for grouping.
+ * @param {string} expr - The expression to parse.
+ * @param {string} name - Option name to embed in thrown error messages
+ *   (typically `'--experimental-test-tag-filter[<i>]'` or
+ *   `'options.testTagFilters[<i>]'`).
+ * @returns {object} An opaque AST node. The shape is internal; pass it
+ *   only to `evaluateTagFilters`.
+ * @throws {ERR_INVALID_ARG_TYPE} If `expr` is not a string.
+ * @throws {ERR_INVALID_ARG_VALUE} If `expr` is empty, contains only
+ *   whitespace, or has a syntax error (unbalanced parentheses, dangling
+ *   operator, adjacent identifiers, etc.). The error message includes
+ *   the offending position.
  */
-function validateAndCanonicalizeTagFilter(value, name) {
-  validateString(value, name);
+function parseTagFilterExpression(expr, name) {
+  validateString(expr, name);
+
+  if (StringPrototypeTrim(expr).length === 0) {
+    throw new ERR_INVALID_ARG_VALUE(name, expr, 'must not be empty');
+  }
+
+  const tokens = lex(expr, name);
+  let pos = 0;
+
+  function peek() {
+    return tokens[pos];
+  }
+
+  function consume() {
+    return tokens[pos++];
+  }
+
+  function parseExpr() {
+    return parseOr();
+  }
+
+  function parseOr() {
+    let left = parseAnd();
+    while (peek().type === T_OR) {
+      consume();
+      const right = parseAnd();
+      left = { __proto__: null, type: 'or', left, right };
+    }
+    return left;
+  }
 
-  if (value.length === 0) {
-    throw new ERR_INVALID_ARG_VALUE(name, value, 'must not be empty');
+  function parseAnd() {
+    let left = parseNot();
+    while (peek().type === T_AND) {
+      consume();
+      const right = parseNot();
+      left = { __proto__: null, type: 'and', left, right };
+    }
+    return left;
   }
 
-  return StringPrototypeToLowerCase(value);
+  function parseNot() {
+    if (peek().type === T_NOT) {
+      const { pos: notPos } = consume();
+      if (peek().type === T_EOF) {
+        throw new ERR_INVALID_ARG_VALUE(
+          name, expr,
+          `expected operand after 'not' at position ${notPos}`,
+        );
+      }
+      const operand = parseNot();
+      return { __proto__: null, type: 'not', operand };
+    }
+
+    if (peek().type === T_LPAREN) {
+      const { pos: lPos } = consume();
+      if (peek().type === T_EOF) {
+        throw new ERR_INVALID_ARG_VALUE(
+          name, expr,
+          `unmatched '(' at position ${lPos}`,
+        );
+      }
+      const inner = parseExpr();
+      if (peek().type !== T_RPAREN) {
+        throw new ERR_INVALID_ARG_VALUE(
+          name, expr,
+          `expected ')' at position ${peek().pos}`,
+        );
+      }
+      consume();
+      return inner;
+    }
+
+    if (peek().type === T_IDENT) {
+      const { value } = consume();
+      return makeTagNode(value);
+    }
+
+    const tok = peek();
+    throw new ERR_INVALID_ARG_VALUE(
+      name, expr,
+      `unexpected token '${tok.type}' at position ${tok.pos}`,
+    );
+  }
+
+  const ast = parseExpr();
+
+  if (peek().type !== T_EOF) {
+    const tok = peek();
+    throw new ERR_INVALID_ARG_VALUE(
+      name, expr,
+      `unexpected token at position ${tok.pos}`,
+    );
+  }
+
+  return ast;
 }
 
+// ---------------------------------------------------------------------------
+// Evaluator
+// ---------------------------------------------------------------------------
+
 /**
- * Evaluate a list of tag filters against a test's tag set.
+ * Evaluate a tag filter AST against a set of test tags.
+ *
+ * Untagged tests have an empty SafeSet. The semantics are:
+ *   - An include expression (tag/wildcard/and/or) evaluates false for empty set.
+ *   - 'not X' evaluates true when X is false (so untagged tests pass 'not X').
+ * @param {object} ast - AST node from parseTagFilterExpression.
+ * @param {SafeSet} tags - Lowercased canonical tags for the test.
+ * @returns {boolean}
+ */
+function evaluateTagFilter(ast, tags) {
+  const { type } = ast;
+
+  if (type === 'or') {
+    return evaluateTagFilter(ast.left, tags) || evaluateTagFilter(ast.right, tags);
+  }
+
+  if (type === 'and') {
+    return evaluateTagFilter(ast.left, tags) && evaluateTagFilter(ast.right, tags);
+  }
+
+  if (type === 'not') {
+    return !evaluateTagFilter(ast.operand, tags);
+  }
+
+  if (type === 'tag') {
+    return tags.has(ast.value);
+  }
+
+  // type === 'wildcard'
+  let matched = false;
+  tags.forEach((tag) => {
+    if (!matched && RegExpPrototypeExec(ast.re, tag) !== null) {
+      matched = true;
+    }
+  });
+  return matched;
+}
+
+/**
+ * Evaluate one or more tag filter ASTs against a test's tag set.
+ *
+ * Multiple ASTs compose by AND: a test passes only when every AST
+ * evaluates true for it. An empty `asts` array always passes.
  *
- * Multiple filters compose by AND: a test passes only when every filter is
- * present in its tag set. An empty `filters` array always passes. Untagged
- * tests have an empty tag set and so are excluded under any non-empty
- * filter.
- * @param {string[]} filters - Lowercased canonical filter values.
- * @param {SafeSet<string>} tags - The test's lowercased canonical tag set.
+ * Untagged tests (an empty `tags` set) fail any include expression
+ * (`tag`, `wildcard`, `and`, `or`) and pass `not X`, so excluding tags
+ * does not accidentally remove untagged tests.
+ * @param {object[]} asts - ASTs returned by `parseTagFilterExpression`.
+ * @param {SafeSet<string>} tags - The test's lowercased canonical tag
+ *   set (use `Set` in non-internal contexts; both work).
  * @returns {boolean} `true` if the test should run.
  */
-function evaluateTagFilters(filters, tags) {
-  for (let i = 0; i < filters.length; i++) {
-    if (!tags.has(filters[i])) {
+function evaluateTagFilters(asts, tags) {
+  for (let i = 0; i < asts.length; i++) {
+    if (!evaluateTagFilter(asts[i], tags)) {
       return false;
     }
   }
@@ -112,6 +498,6 @@ function evaluateTagFilters(filters, tags) {
 module.exports = {
   evaluateTagFilters,
   kEmptyTagArray,
-  validateAndCanonicalizeTagFilter,
+  parseTagFilterExpression,
   validateAndCanonicalizeTagValues,
 };
diff --git a/lib/internal/test_runner/utils.js b/lib/internal/test_runner/utils.js
index 982fc6ef7bfe..38b54c31685c 100644
--- a/lib/internal/test_runner/utils.js
+++ b/lib/internal/test_runner/utils.js
@@ -30,7 +30,7 @@ const {
 } = primordials;
 
 const {
-  validateAndCanonicalizeTagFilter,
+  parseTagFilterExpression,
 } = require('internal/test_runner/tag_filter');
 
 const { AsyncResource } = require('async_hooks');
@@ -273,6 +273,7 @@ function parseCommandLine() {
   let testNamePatterns = mapPatternFlagToRegExArray('--test-name-pattern');
   let testSkipPatterns = mapPatternFlagToRegExArray('--test-skip-pattern');
   let testTagFilters = null;
+  let testTagFilterExpressions = null;
 
   if (isChildProcessV8) {
     kBuiltinReporters.set('v8-serializer', 'internal/test_runner/reporter/v8-serializer');
@@ -308,13 +309,14 @@ function parseCommandLine() {
     const tagFilterFlag = getOptionValue('--experimental-test-tag-filter');
     if (tagFilterFlag?.length > 0) {
       emitExperimentalWarning('Test tags');
-      // File wrappers are exempt from tag filtering, so holding the filters
-      // in the parent is safe under any isolation mode; under
-      // isolation='process' the canonical values are re-emitted to the
-      // child processes, which apply the filter themselves.
+      // File wrappers are exempt from tag filtering, so holding the parsed
+      // ASTs in the parent is safe under any isolation mode; under
+      // isolation='process' the source expressions are re-emitted to the
+      // child processes, which re-parse and apply the filter themselves.
+      testTagFilterExpressions = tagFilterFlag;
       testTagFilters = ArrayPrototypeMap(
         tagFilterFlag,
-        (value, i) => validateAndCanonicalizeTagFilter(value, `--experimental-test-tag-filter[${i}]`),
+        (expr, i) => parseTagFilterExpression(expr, `--experimental-test-tag-filter[${i}]`),
       );
     }
 
@@ -359,9 +361,10 @@ function parseCommandLine() {
     const tagFilterFlag = getOptionValue('--experimental-test-tag-filter');
     if (tagFilterFlag?.length > 0) {
       emitExperimentalWarning('Test tags');
+      testTagFilterExpressions = tagFilterFlag;
       testTagFilters = ArrayPrototypeMap(
         tagFilterFlag,
-        (value, i) => validateAndCanonicalizeTagFilter(value, `--experimental-test-tag-filter[${i}]`),
+        (expr, i) => parseTagFilterExpression(expr, `--experimental-test-tag-filter[${i}]`),
       );
     }
   }
@@ -426,6 +429,7 @@ function parseCommandLine() {
     sourceMaps,
     testNamePatterns,
     testSkipPatterns,
+    testTagFilterExpressions,
     testTagFilters,
     timeout,
     updateSnapshots,
diff --git a/test/parallel/test-runner-tag-filter-cli.mjs b/test/parallel/test-runner-tag-filter-cli.mjs
index 13717d34b3ed..e7a1cd2d1d5f 100644
--- a/test/parallel/test-runner-tag-filter-cli.mjs
+++ b/test/parallel/test-runner-tag-filter-cli.mjs
@@ -62,32 +62,55 @@ test('untagged parent runs only the matching tagged child', () => {
   assert.doesNotMatch(stdout, /plain sibling/);
 });
 
+test('not X also includes untagged tests', () => {
+  const { status, stdout } = run(['--experimental-test-tag-filter=not flaky']);
+  assert.strictEqual(status, 0);
+  pass(stdout, 8);
+  assert.match(stdout, /ok \d+ - untagged/);
+  assert.doesNotMatch(stdout, /db flaky/);
+  assert.doesNotMatch(stdout, /^ok \d+ - only flaky/m);
+});
+
 test('repeated --experimental-test-tag-filter ANDs together', () => {
-  // db AND integration: only "db plus integration" satisfies both.
   const { status, stdout } = run([
     '--experimental-test-tag-filter=db',
-    '--experimental-test-tag-filter=integration',
+    '--experimental-test-tag-filter=not flaky',
   ]);
   assert.strictEqual(status, 0);
-  pass(stdout, 1);
+  pass(stdout, 2);
+  assert.match(stdout, /ok \d+ - db only/);
   assert.match(stdout, /ok \d+ - db plus integration/);
-  assert.doesNotMatch(stdout, /^ok \d+ - db only/m);
-  assert.doesNotMatch(stdout, /^ok \d+ - db flaky/m);
+  assert.doesNotMatch(stdout, /db flaky/);
 });
 
-test('untagged tests are excluded under any positive filter', () => {
-  const { status, stdout } = run(['--experimental-test-tag-filter=db']);
+test('bare * matches any tagged test, excludes untagged', () => {
+  const { status, stdout } = run(['--experimental-test-tag-filter=*']);
   assert.strictEqual(status, 0);
+  pass(stdout, 8);
   assert.doesNotMatch(stdout, /^ok \d+ - untagged/m);
 });
 
+test('wildcard prefix: db* matches db, db:postgres, etc.', () => {
+  const { status, stdout } = run(['--experimental-test-tag-filter=db*']);
+  assert.strictEqual(status, 0);
+  pass(stdout, 4);
+  assert.match(stdout, /db wildcard match/);
+});
+
+test('boolean composition: unit && !slow', () => {
+  const { status, stdout } = run(['--experimental-test-tag-filter=unit && !slow']);
+  assert.strictEqual(status, 0);
+  pass(stdout, 1);
+  assert.match(stdout, /ok \d+ - unit only/);
+});
+
 test('isolation=none produces identical filtered set', () => {
-  const proc = run(['--experimental-test-tag-filter=db']);
-  const none = run(['--experimental-test-tag-filter=db'], ['--test-isolation=none']);
+  const proc = run(['--experimental-test-tag-filter=unit && !slow']);
+  const none = run(['--experimental-test-tag-filter=unit && !slow'], ['--test-isolation=none']);
   assert.strictEqual(proc.status, 0);
   assert.strictEqual(none.status, 0);
-  pass(proc.stdout, 3);
-  pass(none.stdout, 3);
+  pass(proc.stdout, 1);
+  pass(none.stdout, 1);
 });
 
 test('combined with --test-skip-pattern (pure AND)', () => {
@@ -101,8 +124,44 @@ test('combined with --test-skip-pattern (pure AND)', () => {
   assert.doesNotMatch(stdout, /db flaky/);
 });
 
+test('malformed expression: unbalanced parenthesis errors at startup', () => {
+  const { status, stderr, stdout } = run(['--experimental-test-tag-filter=(a']);
+  assert.notStrictEqual(status, 0);
+  // Match the full sentinel error line so noise elsewhere in stderr can't
+  // satisfy the assertion via interleaved substrings.
+  assert.match(
+    stderr,
+    /^TypeError \[ERR_INVALID_ARG_VALUE\]: The argument '--experimental-test-tag-filter\[0\]' expected '\)' at position \d+/m,
+  );
+  // No file should have been spawned.
+  assert.doesNotMatch(stdout, /^ok 1 -/m);
+});
+
+test('malformed expression: dangling operator errors at startup', () => {
+  const { status, stderr } = run(['--experimental-test-tag-filter=a and']);
+  assert.notStrictEqual(status, 0);
+  assert.match(
+    stderr,
+    /^TypeError \[ERR_INVALID_ARG_VALUE\]: The argument '--experimental-test-tag-filter\[0\]' unexpected token 'EOF' at position \d+/m,
+  );
+});
+
 test('empty --experimental-test-tag-filter= is rejected by argv parser', () => {
   const { status, stderr } = run(['--experimental-test-tag-filter=']);
   assert.notStrictEqual(status, 0);
   assert.match(stderr, /requires an argument/);
 });
+
+test('reserved word as tag value errors at registration', () => {
+  const child = spawnSync(process.execPath, [
+    '-e',
+    "require('node:test').test('x', { tags: ['and'] }, () => {});",
+  ]);
+  assert.notStrictEqual(child.status, 0);
+  // Match the full sentinel error line so noise elsewhere in stderr can't
+  // satisfy the assertion via interleaved substrings.
+  assert.match(
+    child.stderr.toString(),
+    /^TypeError \[ERR_INVALID_ARG_VALUE\]: The property 'options\.tags\[0\]' must not be the reserved word/m,
+  );
+});
diff --git a/test/parallel/test-runner-tag-filter-parser.mjs b/test/parallel/test-runner-tag-filter-parser.mjs
new file mode 100644
index 000000000000..0a9ab93dc98c
--- /dev/null
+++ b/test/parallel/test-runner-tag-filter-parser.mjs
@@ -0,0 +1,257 @@
+// Flags: --expose-internals
+
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { test } from 'node:test';
+import tagFilter from 'internal/test_runner/tag_filter';
+
+const { evaluateTagFilters, parseTagFilterExpression } = tagFilter;
+
+function tagSet(...tags) {
+  return new Set(tags);
+}
+
+function matches(expr, ...tags) {
+  return evaluateTagFilters([parseTagFilterExpression(expr, 'expr')], tagSet(...tags));
+}
+
+test('single identifier', () => {
+  assert.strictEqual(matches('db', 'db'), true);
+  assert.strictEqual(matches('db', 'other'), false);
+  assert.strictEqual(matches('db'), false);
+});
+
+test('case-insensitive match', () => {
+  // The evaluator expects an already-lowercased tag set, so 'DB' in the set
+  // must not match 'db' in the filter.
+  assert.strictEqual(matches('DB', 'db'), true);
+  assert.strictEqual(matches('db', 'DB'), false);
+});
+
+test('and / && have higher precedence than or / ||', () => {
+  for (const expr of ['a or b and c', 'a || b && c']) {
+    assert.strictEqual(matches(expr, 'a'), true);
+    assert.strictEqual(matches(expr, 'b'), false);
+    assert.strictEqual(matches(expr, 'c'), false);
+    assert.strictEqual(matches(expr, 'a', 'b'), true);
+    assert.strictEqual(matches(expr, 'a', 'c'), true);
+    assert.strictEqual(matches(expr, 'b', 'c'), true);
+    assert.strictEqual(matches(expr, 'a', 'b', 'c'), true);
+  }
+});
+
+test('not has higher precedence than and', () => {
+  for (const expr of ['not a and b', '!a && b']) {
+    assert.strictEqual(matches(expr, 'b'), true);
+    assert.strictEqual(matches(expr, 'a', 'b'), false);
+  }
+});
+
+test('not has higher precedence than or', () => {
+  for (const expr of ['not a or b', '!a || b']) {
+    assert.strictEqual(matches(expr), true);
+    assert.strictEqual(matches(expr, 'a'), false);
+    assert.strictEqual(matches(expr, 'b'), true);
+    assert.strictEqual(matches(expr, 'a', 'b'), true);
+  }
+});
+
+test('parentheses override precedence', () => {
+  for (const expr of ['(a or b) and c', '(a || b) && c']) {
+    assert.strictEqual(matches(expr, 'a'), false);
+    assert.strictEqual(matches(expr, 'c'), false);
+    assert.strictEqual(matches(expr, 'a', 'c'), true);
+    assert.strictEqual(matches(expr, 'b', 'c'), true);
+  }
+});
+
+test('double negation', () => {
+  for (const expr of ['not not a', '!!a']) {
+    assert.strictEqual(matches(expr, 'a'), true);
+    assert.strictEqual(matches(expr), false);
+  }
+});
+
+test('mixing word and punctuation forms in one expression', () => {
+  for (const expr of ['unit && not flaky', 'unit and !flaky']) {
+    assert.strictEqual(matches(expr, 'unit'), true);
+    assert.strictEqual(matches(expr, 'unit', 'flaky'), false);
+  }
+});
+
+test('mixed forms inside parentheses, word and punct equivalence', () => {
+  // Each pair below is the same expression in word form and punctuation form.
+  for (const expr of ['a and (b || not c)', 'a && (b or not c)']) {
+    assert.strictEqual(matches(expr, 'a'), true);
+    assert.strictEqual(matches(expr, 'a', 'b'), true);
+    assert.strictEqual(matches(expr, 'a', 'c'), false);
+    assert.strictEqual(matches(expr, 'a', 'b', 'c'), true);
+    assert.strictEqual(matches(expr, 'b'), false);
+  }
+
+  for (const expr of ['(a || b) && !c', '(a or b) and not c']) {
+    assert.strictEqual(matches(expr, 'a'), true);
+    assert.strictEqual(matches(expr, 'b'), true);
+    assert.strictEqual(matches(expr, 'a', 'c'), false);
+    assert.strictEqual(matches(expr, 'c'), false);
+  }
+
+  for (const expr of ['not (a or b) and c', '!(a || b) && c']) {
+    assert.strictEqual(matches(expr, 'c'), true);
+    assert.strictEqual(matches(expr, 'a', 'c'), false);
+    assert.strictEqual(matches(expr, 'b', 'c'), false);
+  }
+
+  for (const expr of ['!(a && b) || c', 'not (a and b) or c']) {
+    assert.strictEqual(matches(expr, 'a'), true);
+    assert.strictEqual(matches(expr, 'a', 'b'), false);
+    assert.strictEqual(matches(expr, 'a', 'b', 'c'), true);
+  }
+});
+
+test('nested parentheses and wildcards mixed with word forms', () => {
+  for (const expr of [
+    '(db* or unit) and not (slow || flaky)',
+    '(db* || unit) && !(slow or flaky)',
+  ]) {
+    assert.strictEqual(matches(expr, 'db'), true);
+    assert.strictEqual(matches(expr, 'db:postgres'), true);
+    assert.strictEqual(matches(expr, 'unit'), true);
+    assert.strictEqual(matches(expr, 'unit', 'slow'), false);
+    assert.strictEqual(matches(expr, 'db', 'flaky'), false);
+    assert.strictEqual(matches(expr, 'mongo'), false);
+  }
+});
+
+test("'notslow' is one identifier, 'not slow' is two tokens", () => {
+  assert.strictEqual(matches('notslow', 'notslow'), true);
+  assert.strictEqual(matches('notslow', 'slow'), false);
+  assert.strictEqual(matches('not slow'), true);
+  assert.strictEqual(matches('not slow', 'slow'), false);
+});
+
+test('punctuation does not need whitespace separation', () => {
+  assert.strictEqual(matches('!a', 'b'), true);
+  assert.strictEqual(matches('!a', 'a'), false);
+  assert.strictEqual(matches('a&&b', 'a', 'b'), true);
+  assert.strictEqual(matches('a||b', 'a'), true);
+});
+
+test('wildcard expands across allowed alphabet', () => {
+  assert.strictEqual(matches('db*', 'db'), true);
+  assert.strictEqual(matches('db*', 'db1'), true);
+  assert.strictEqual(matches('db*', 'db:postgres'), true);
+  assert.strictEqual(matches('db*', 'mongo'), false);
+});
+
+test('bare * matches any tagged test', () => {
+  assert.strictEqual(matches('*', 'anything'), true);
+  assert.strictEqual(matches('*', 'a', 'b'), true);
+  assert.strictEqual(matches('*'), false);
+});
+
+test('wildcard in middle and at start', () => {
+  assert.strictEqual(matches('*db', 'mydb'), true);
+  assert.strictEqual(matches('*db', 'db'), true);
+  assert.strictEqual(matches('*db', 'dbmy'), false);
+  assert.strictEqual(matches('a*z', 'abz'), true);
+  assert.strictEqual(matches('a*z', 'az'), true);
+  assert.strictEqual(matches('a*z', 'abc'), false);
+});
+
+test('regex metacharacters in tags are escaped', () => {
+  // The literal `.` in the filter must match a literal dot only, not any
+  // arbitrary character (which would be the unescaped regex meaning).
+  assert.strictEqual(matches('a.b*', 'a.b'), true);
+  assert.strictEqual(matches('a.b*', 'axb'), false);
+});
+
+test('wildcard case-folding matches literal-tag case-folding for non-ASCII', () => {
+  // Authoring a tag 'İ' (U+0130) goes through String.prototype.toLowerCase
+  // and stores 'i̇' (two code points). Wildcard matching must use the same
+  // fold so authors see consistent behavior across literal and wildcard
+  // filters.
+  const folded = 'İ'.toLowerCase();
+  assert.strictEqual(matches('İ', folded), true);
+  assert.strictEqual(matches('İ*', folded), true);
+  assert.strictEqual(matches('İ*', `${folded}foo`), true);
+  assert.strictEqual(matches('*İ', `foo${folded}`), true);
+});
+
+test('untagged test fails any include expression', () => {
+  for (const expr of ['a', 'a or b', 'a || b', 'a and b', 'a && b', '*']) {
+    assert.strictEqual(matches(expr), false);
+  }
+});
+
+test("'not X' against an untagged test is true", () => {
+  for (const expr of ['not a', '!a']) {
+    assert.strictEqual(matches(expr), true);
+  }
+});
+
+test('multiple filters AND together', () => {
+  const f1 = parseTagFilterExpression('a', 'expr');
+  const f2 = parseTagFilterExpression('not b', 'expr');
+  assert.strictEqual(evaluateTagFilters([f1, f2], tagSet('a')), true);
+  assert.strictEqual(evaluateTagFilters([f1, f2], tagSet('a', 'b')), false);
+  assert.strictEqual(evaluateTagFilters([f1, f2], tagSet('b')), false);
+  assert.strictEqual(evaluateTagFilters([f1, f2], tagSet()), false);
+});
+
+test('empty filter list always passes', () => {
+  assert.strictEqual(evaluateTagFilters([], tagSet()), true);
+  assert.strictEqual(evaluateTagFilters([], tagSet('a')), true);
+});
+
+// --- Malformed expressions -------------------------------------------------
+
+function expectInvalid(expr) {
+  assert.throws(
+    () => parseTagFilterExpression(expr, 'expr'),
+    { code: 'ERR_INVALID_ARG_VALUE' },
+    `expected '${expr}' to be invalid`,
+  );
+}
+
+test('rejects empty / whitespace-only expressions', () => {
+  for (const expr of ['', '   ', '\t\n']) {
+    expectInvalid(expr);
+  }
+});
+
+test('rejects unbalanced parentheses', () => {
+  for (const expr of ['(', '((', '(a', 'a)', '((a)', '(a))']) {
+    expectInvalid(expr);
+  }
+});
+
+test('rejects dangling operators', () => {
+  for (const expr of ['not', 'a and', 'a or', '&& a', '|| a', 'a &&', 'a ||']) {
+    expectInvalid(expr);
+  }
+});
+
+test('rejects two adjacent identifiers', () => {
+  expectInvalid('foo bar');
+});
+
+test('rejects single & and single |', () => {
+  for (const expr of ['a & b', 'a | b']) {
+    expectInvalid(expr);
+  }
+});
+
+test('rejects empty parentheses', () => {
+  expectInvalid('()');
+});
+
+test('rejects non-string expressions', () => {
+  for (const expr of [42, null, undefined, true, [], {}, Symbol('s')]) {
+    assert.throws(
+      () => parseTagFilterExpression(expr, 'expr'),
+      { code: 'ERR_INVALID_ARG_TYPE' },
+      `expected ${String(expr)} to be rejected`,
+    );
+  }
+});
diff --git a/test/parallel/test-runner-tags-events.mjs b/test/parallel/test-runner-tags-events.mjs
index 7d1b35f7349d..fab32cfe92c0 100644
--- a/test/parallel/test-runner-tags-events.mjs
+++ b/test/parallel/test-runner-tags-events.mjs
@@ -101,4 +101,12 @@ describe('tag-bearing event payloads', { concurrency: false }, () => {
     // eslint-disable-next-line no-unused-vars
     for await (const _ of stream);
   });
+
+  it('process isolation forwards --experimental-test-tag-filter to children', async () => {
+    const stream = run({ files: [fixture], testTagFilters: ['not nonexistent'] });
+    stream.on('test:fail', common.mustNotCall());
+    stream.on('test:pass', common.mustCall(13));
+    // eslint-disable-next-line no-unused-vars
+    for await (const _ of stream);
+  });
 });
diff --git a/test/parallel/test-runner-tags-experimental-warning.mjs b/test/parallel/test-runner-tags-experimental-warning.mjs
index 522cc781ed3e..4fbe46fd144a 100644
--- a/test/parallel/test-runner-tags-experimental-warning.mjs
+++ b/test/parallel/test-runner-tags-experimental-warning.mjs
@@ -50,7 +50,7 @@ test('--experimental-test-tag-filter fires the warning', () => {
   const { stderr } = runChild([
     '--test',
     '--test-reporter=tap',
-    '--experimental-test-tag-filter=db',
+    '--experimental-test-tag-filter=*',
     '--test-isolation=none',
     fixture,
   ]);
diff --git a/test/parallel/test-runner-tags-validation.mjs b/test/parallel/test-runner-tags-validation.mjs
index 4e0249479627..3b6138bbf782 100644
--- a/test/parallel/test-runner-tags-validation.mjs
+++ b/test/parallel/test-runner-tags-validation.mjs
@@ -37,6 +37,26 @@ test('empty-string tag throws ERR_INVALID_ARG_VALUE', () => {
   );
 });
 
+test('forbidden characters throw ERR_INVALID_ARG_VALUE', () => {
+  for (const bad of ['a b', 'a\tb', 'a\nb', 'a&b', 'a|b', 'a!b', 'a(b', 'a)b', 'a*b', '*', '&&', '||']) {
+    assert.throws(
+      () => test('x', { tags: [bad] }, () => {}),
+      { code: 'ERR_INVALID_ARG_VALUE' },
+      `expected throw for tag=${JSON.stringify(bad)}`,
+    );
+  }
+});
+
+test('reserved words throw ERR_INVALID_ARG_VALUE in any casing', () => {
+  for (const word of ['and', 'AND', 'And', 'or', 'OR', 'Or', 'not', 'NOT', 'Not']) {
+    assert.throws(
+      () => test('x', { tags: [word] }, () => {}),
+      { code: 'ERR_INVALID_ARG_VALUE' },
+      `expected throw for reserved word ${word}`,
+    );
+  }
+});
+
 test('Unicode and most punctuation are allowed', () => {
   // None of these should throw.
   test('unicode-1', { tags: ['café'] }, () => {});
@@ -80,7 +100,7 @@ test('suite() and describe() validate tags identically', () => {
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
   assert.throws(
-    () => describe('s', { tags: [''] }, () => {}),
+    () => describe('s', { tags: ['and'] }, () => {}),
     { code: 'ERR_INVALID_ARG_VALUE' },
   );
 });
@@ -92,6 +112,13 @@ test('it() validates tags identically to test()', () => {
   );
 });
 
+test('it() validates tags identically to test()', () => {
+  assert.throws(
+    () => it('i', { tags: ['a b'] }, () => {}),
+    { code: 'ERR_INVALID_ARG_VALUE' },
+  );
+});
+
 test('run() rejects non-string testTagFilters values', () => {
   for (const bad of [[42], [{}], [null], [undefined], [true], [Symbol('s')]]) {
     assert.throws(

From 72c37b133e377591c84095541ba7dcb2a1ddb46d Mon Sep 17 00:00:00 2001
From: Edy Silva <edigleyssonsilva@gmail.com>
Date: Thu, 13 Aug 2026 10:59:56 -0300
Subject: [PATCH 157/344] sqlite: expose prepared statement statistics

Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64541
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 doc/api/sqlite.md                           |  51 +++++
 src/node_sqlite.cc                          |  74 ++++++-
 src/node_sqlite.h                           |  28 +++
 test/parallel/test-sqlite-statement-sync.js | 206 ++++++++++++++++++++
 4 files changed, 353 insertions(+), 6 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index f43e27a1d8f1..804b765e59ac 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -1188,6 +1188,18 @@ returns an empty iterator. The prepared statement [parameters are bound][] using
 the values in `namedParameters` and `anonymousParameters`. See
 [Binding parameters][].
 
+### `statement.resetStats()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Resets every counter reported by [`statement.stat()`][] back to zero, except
+`memused`, which reports current memory usage and cannot be reset. This
+method is a wrapper around [`sqlite3_stmt_status()`][] and is useful for
+measuring a specific workload without the counts accumulated by earlier
+executions of the same prepared statement.
+
 ### `statement.run([namedParameters][, ...anonymousParameters])`
 
 <!-- YAML
@@ -1314,6 +1326,43 @@ added: REPLACEME
 Finalizes the prepared statement. If the prepared statement is already
 finalized, then this is a no-op.
 
+### `statement.stat(counter)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `counter` {string} The name of the counter to read. One of:
+
+  * `'fullscanStep'` The number of times SQLite has stepped forward in a table
+    as part of a full table scan.
+  * `'sort'` The number of sort operations that have occurred.
+  * `'autoindex'` The number of rows inserted into transient indices that were
+    created automatically to help joins run faster.
+  * `'vmStep'` The number of virtual machine operations executed by the
+    prepared statement.
+  * `'reprepare'` The number of times the statement has been automatically
+    reprepared due to schema changes or changes to bound parameters.
+  * `'run'` The number of execution cycles started by the prepared statement.
+  * `'filterMiss'` The number of times the Bloom filter returned a result that
+    required the join step to be processed as normal.
+  * `'filterHit'` The number of times a join step was bypassed because a Bloom
+    filter returned not-found.
+  * `'memused'` The approximate number of bytes of heap memory used to store
+    the prepared statement.
+
+* Returns: {number} The current value of the requested counter.
+
+Returns one of the runtime counters that SQLite tracks for this prepared
+statement. This method is a wrapper around [`sqlite3_stmt_status()`][] and does
+not reset the counter. Asserting that a statement does not perform a full table
+scan (`statement.stat('fullscanStep') === 0`) is a useful check to guard
+against degenerate performance.
+
+The `'filterMiss'` and `'filterHit'` counters require SQLite 3.38.0 or later.
+Builds linked against an older SQLite with `--shared-sqlite` do not expose them,
+and passing either name throws `ERR_INVALID_ARG_VALUE`.
+
 ## Class: `SQLTagStore`
 
 <!-- YAML
@@ -1832,6 +1881,7 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3_serialize()`]: https://sqlite.org/c3ref/serialize.html
 [`sqlite3_set_authorizer()`]: https://sqlite.org/c3ref/set_authorizer.html
 [`sqlite3_sql()`]: https://www.sqlite.org/c3ref/expanded_sql.html
+[`sqlite3_stmt_status()`]: https://www.sqlite.org/c3ref/stmt_status.html
 [`sqlite3changeset_apply()`]: https://www.sqlite.org/session/sqlite3changeset_apply.html
 [`sqlite3session_attach()`]: https://www.sqlite.org/session/sqlite3session_attach.html
 [`sqlite3session_changeset()`]: https://www.sqlite.org/session/sqlite3session_changeset.html
@@ -1840,6 +1890,7 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3session_patchset()`]: https://www.sqlite.org/session/sqlite3session_patchset.html
 [`statement.setAllowBareNamedParameters()`]: #statementsetallowbarenamedparametersenabled
 [`statement.setAllowUnknownNamedParameters()`]: #statementsetallowunknownnamedparametersenabled
+[`statement.stat()`]: #statementstatcounter
 [busy timeout]: https://sqlite.org/c3ref/busy_timeout.html
 [connection]: https://www.sqlite.org/c3ref/sqlite3.html
 [data types]: https://www.sqlite.org/datatype3.html
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 9c80d18cdaab..156d4f2e5f5c 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -177,9 +177,11 @@ Local<DictionaryTemplate> getLazyIterTemplate(Environment* env) {
 }
 }  // namespace
 
-// Helper function to find limit info from JS property name
-static constexpr const LimitInfo* GetLimitInfoFromName(std::string_view name) {
-  for (const auto& info : kLimitMapping) {
+// Helper function to look up a mapping entry by its JS-facing name
+template <typename T, size_t N>
+static constexpr const T* FindByJsName(const std::array<T, N>& mapping,
+                                       std::string_view name) {
+  for (const auto& info : mapping) {
     if (name == info.js_name) {
       return &info;
     }
@@ -793,7 +795,8 @@ Intercepted DatabaseSyncLimits::LimitsGetter(
   Isolate* isolate = env->isolate();
 
   Utf8Value prop_name(isolate, property);
-  const LimitInfo* limit_info = GetLimitInfoFromName(prop_name.ToStringView());
+  const LimitInfo* limit_info =
+      FindByJsName(kLimitMapping, prop_name.ToStringView());
 
   if (limit_info == nullptr) {
     return Intercepted::kNo;  // Unknown property, let default handling occur
@@ -825,7 +828,8 @@ Intercepted DatabaseSyncLimits::LimitsSetter(
   Isolate* isolate = env->isolate();
 
   Utf8Value prop_name(isolate, property);
-  const LimitInfo* limit_info = GetLimitInfoFromName(prop_name.ToStringView());
+  const LimitInfo* limit_info =
+      FindByJsName(kLimitMapping, prop_name.ToStringView());
 
   if (limit_info == nullptr) {
     return Intercepted::kNo;
@@ -873,7 +877,8 @@ Intercepted DatabaseSyncLimits::LimitsQuery(
 
   Isolate* isolate = info.GetIsolate();
   Utf8Value prop_name(isolate, property);
-  const LimitInfo* limit_info = GetLimitInfoFromName(prop_name.ToStringView());
+  const LimitInfo* limit_info =
+      FindByJsName(kLimitMapping, prop_name.ToStringView());
 
   if (!limit_info) {
     return Intercepted::kNo;
@@ -2694,6 +2699,7 @@ void StatementSync::Finalize() {
 
 void StatementSync::InvalidateColumnNameCache() {
   cached_column_names_.clear();
+  cached_column_names_reprepare_count_ = -1;
 }
 
 inline bool StatementSync::IsFinalized() {
@@ -3350,6 +3356,60 @@ void StatementSync::ExpandedSQLGetter(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(result);
 }
 
+void StatementSync::Stat(const FunctionCallbackInfo<Value>& args) {
+  StatementSync* stmt;
+  ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, stmt->IsFinalized(), "statement has been finalized");
+  Isolate* isolate = env->isolate();
+
+  if (!args[0]->IsString()) {
+    THROW_ERR_INVALID_ARG_TYPE(isolate,
+                               "The \"counter\" argument must be a string.");
+    return;
+  }
+
+  Utf8Value counter(isolate, args[0].As<String>());
+  const StatusInfo* status_info =
+      FindByJsName(kStatusMapping, counter.ToStringView());
+  if (status_info == nullptr) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        isolate, "The \"counter\" argument is not a valid statistic name.");
+    return;
+  }
+
+  // The reset flag is always false; the counter is read without being cleared.
+  int value = sqlite3_stmt_status(
+      stmt->statement_.get(), status_info->sqlite_status_id, false);
+  args.GetReturnValue().Set(Integer::New(isolate, value));
+}
+
+void StatementSync::ResetStats(const FunctionCallbackInfo<Value>& args) {
+  StatementSync* stmt;
+  ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, stmt->IsFinalized(), "statement has been finalized");
+
+  // sqlite3_stmt_status() resets a single counter per call, so every exposed
+  // counter is visited. The returned value is the pre-reset one and is unused.
+  // SQLITE_STMTSTATUS_MEMUSED is skipped: it reports current memory usage
+  // rather than an accumulated counter, and SQLite ignores the reset flag for
+  // it.
+  for (const auto& info : kStatusMapping) {
+    if (info.sqlite_status_id == SQLITE_STMTSTATUS_MEMUSED) {
+      continue;
+    }
+    sqlite3_stmt_status(stmt->statement_.get(), info.sqlite_status_id, true);
+  }
+
+  // The column name cache is keyed on SQLITE_STMTSTATUS_REPREPARE, which was
+  // just zeroed. Without invalidating, a later re-prepare can make the counter
+  // match the cached generation again and the stale names would be reused.
+  stmt->InvalidateColumnNameCache();
+}
+
 void StatementSync::SetAllowBareNamedParameters(
     const FunctionCallbackInfo<Value>& args) {
   StatementSync* stmt;
@@ -3775,6 +3835,8 @@ Local<FunctionTemplate> StatementSync::GetConstructorTemplate(
                             tmpl,
                             FIXED_ONE_BYTE_STRING(isolate, "expandedSQL"),
                             StatementSync::ExpandedSQLGetter);
+    SetProtoMethodNoSideEffect(isolate, tmpl, "stat", StatementSync::Stat);
+    SetProtoMethod(isolate, tmpl, "resetStats", StatementSync::ResetStats);
     SetProtoMethod(isolate,
                    tmpl,
                    "setAllowBareNamedParameters",
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 17025a528622..5f51a48fe1cc 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -52,6 +52,32 @@ static_assert(
     CheckLimitIndices(),
     "Each kLimitMapping entry's sqlite_limit_id must match its index");
 
+// Mapping from JavaScript counter names to SQLite statement status constants
+struct StatusInfo {
+  std::string_view js_name;
+  int sqlite_status_id;
+};
+
+// SQLITE_STMTSTATUS_FILTER_HIT and SQLITE_STMTSTATUS_FILTER_MISS require
+// SQLite >= 3.38.0. Older shared-library builds omit the two counters.
+#if SQLITE_VERSION_NUMBER >= 3038000
+#define NODE_SQLITE_HAS_FILTER_STATUS 1
+#endif
+
+inline constexpr auto kStatusMapping = std::to_array<StatusInfo>({
+    {"fullscanStep", SQLITE_STMTSTATUS_FULLSCAN_STEP},
+    {"sort", SQLITE_STMTSTATUS_SORT},
+    {"autoindex", SQLITE_STMTSTATUS_AUTOINDEX},
+    {"vmStep", SQLITE_STMTSTATUS_VM_STEP},
+    {"reprepare", SQLITE_STMTSTATUS_REPREPARE},
+    {"run", SQLITE_STMTSTATUS_RUN},
+#ifdef NODE_SQLITE_HAS_FILTER_STATUS
+    {"filterMiss", SQLITE_STMTSTATUS_FILTER_MISS},
+    {"filterHit", SQLITE_STMTSTATUS_FILTER_HIT},
+#endif
+    {"memused", SQLITE_STMTSTATUS_MEMUSED},
+});
+
 class DatabaseOpenConfiguration {
  public:
   explicit DatabaseOpenConfiguration(std::string&& location)
@@ -284,6 +310,8 @@ class StatementSync : public BaseObject {
   static void SourceSQLGetter(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void ExpandedSQLGetter(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Stat(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void ResetStats(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetAllowBareNamedParameters(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetAllowUnknownNamedParameters(
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index a55e19fd14f3..a52634f59ac6 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -564,6 +564,212 @@ suite('StatementSync.prototype.expandedSQL', () => {
   });
 });
 
+suite('StatementSync.prototype.stat()', () => {
+  const counters = [
+    'fullscanStep', 'sort', 'autoindex', 'vmStep', 'reprepare',
+    'run', 'memused',
+  ];
+
+  // 'filterMiss' and 'filterHit' map to SQLITE_STMTSTATUS_FILTER_MISS and
+  // SQLITE_STMTSTATUS_FILTER_HIT, which were added in SQLite 3.38.0. Builds
+  // using an older shared SQLite do not expose them.
+  const [major, minor] = process.versions.sqlite.split('.').map(Number);
+  const hasFilterCounters = major > 3 || (major === 3 && minor >= 38);
+
+  if (hasFilterCounters) {
+    counters.push('filterMiss', 'filterHit');
+  }
+
+  test('returns a number for every valid counter', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;');
+    const stmt = db.prepare('SELECT * FROM data');
+    for (const counter of counters) {
+      t.assert.strictEqual(typeof stmt.stat(counter), 'number');
+    }
+  });
+
+  test('counts virtual machine steps and runs after execution', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;');
+    const insert = db.prepare('INSERT INTO data (key, val) VALUES (?, ?)');
+    for (let i = 1; i <= 5; i++) {
+      insert.run(i, `val-${i}`);
+    }
+    const stmt = db.prepare('SELECT * FROM data');
+    t.assert.strictEqual(stmt.stat('run'), 0);
+    t.assert.strictEqual(stmt.stat('vmStep'), 0);
+    stmt.all();
+    t.assert.strictEqual(stmt.stat('run'), 1);
+    t.assert.ok(stmt.stat('vmStep') > 0);
+    t.assert.ok(stmt.stat('memused') > 0);
+  });
+
+  test('detects full table scans', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;');
+    const insert = db.prepare('INSERT INTO data (key, val) VALUES (?, ?)');
+    for (let i = 1; i <= 10; i++) {
+      insert.run(i, `val-${i}`);
+    }
+
+    // Filtering on a non-indexed column forces a full table scan.
+    const scan = db.prepare('SELECT * FROM data WHERE val = ?');
+    scan.all('val-5');
+    t.assert.ok(scan.stat('fullscanStep') > 0);
+
+    // Filtering on the primary key uses the index; no full scan occurs.
+    const indexed = db.prepare('SELECT * FROM data WHERE key = ?');
+    indexed.all(5);
+    t.assert.strictEqual(indexed.stat('fullscanStep'), 0);
+  });
+
+  test('reading a counter does not reset it', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;');
+    const stmt = db.prepare('SELECT * FROM data');
+    stmt.all();
+    const first = stmt.stat('run');
+    t.assert.strictEqual(stmt.stat('run'), first);
+  });
+
+  test('throws if the counter argument is not a string', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('SELECT 1');
+    t.assert.throws(() => stmt.stat(), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      message: /The "counter" argument must be a string/,
+    });
+    t.assert.throws(() => stmt.stat(42), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      message: /The "counter" argument must be a string/,
+    });
+  });
+
+  test('throws if the counter name is unknown', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('SELECT 1');
+    t.assert.throws(() => stmt.stat('nope'), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /The "counter" argument is not a valid statistic name/,
+    });
+  });
+
+  test('throws if the statement is finalized', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('SELECT 1');
+    db.close();
+    t.assert.throws(() => stmt.stat('run'), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+});
+
+suite('StatementSync.prototype.resetStats()', () => {
+  test('returns undefined', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('SELECT 1');
+    t.assert.strictEqual(stmt.resetStats(), undefined);
+  });
+
+  // The column name cache is keyed on the reprepare counter, which
+  // resetStats() zeroes. A later re-prepare must not be able to make the
+  // counter match the cached generation again and reuse stale names.
+  test('invalidates cached iterator column names', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(a); INSERT INTO data VALUES (1)');
+    const stmt = db.prepare('SELECT * FROM data');
+
+    db.exec('ALTER TABLE data RENAME COLUMN a TO b');
+    stmt.iterate().toArray();
+    stmt.resetStats();
+    db.exec('ALTER TABLE data RENAME COLUMN b TO c');
+
+    t.assert.deepStrictEqual(stmt.iterate().toArray(), [
+      { __proto__: null, c: 1 },
+    ]);
+  });
+
+  test('invalidates the cache when the column count grows', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t(a); INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT * FROM t');
+
+    db.exec('ALTER TABLE t ADD COLUMN b DEFAULT 2');
+    stmt.iterate().toArray();
+    stmt.resetStats();
+    db.exec('ALTER TABLE t ADD COLUMN c DEFAULT 3');
+
+    t.assert.deepStrictEqual(stmt.iterate().toArray(), [
+      { __proto__: null, a: 1, b: 2, c: 3 },
+    ]);
+  });
+
+  test('does not reset memused', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t(a); INSERT INTO t VALUES (1),(2),(3)');
+    const stmt = db.prepare('SELECT * FROM t ORDER BY a');
+    stmt.all();
+
+    // The memused counter reports current memory usage rather than an
+    // accumulated total, so SQLite ignores the reset flag for it.
+    const before = stmt.stat('memused');
+    t.assert.ok(before > 0);
+    stmt.resetStats();
+    t.assert.strictEqual(stmt.stat('memused'), before);
+  });
+
+  test('clears every counter', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;');
+    const insert = db.prepare('INSERT INTO data (key, val) VALUES (?, ?)');
+    for (let i = 1; i <= 5; i++) {
+      insert.run(i, `val-${i}`);
+    }
+
+    // Force a full table scan so more than one counter is non-zero.
+    const stmt = db.prepare('SELECT * FROM data WHERE val = ?');
+    stmt.all('val-3');
+    t.assert.ok(stmt.stat('run') > 0);
+    t.assert.ok(stmt.stat('vmStep') > 0);
+    t.assert.ok(stmt.stat('fullscanStep') > 0);
+
+    stmt.resetStats();
+    t.assert.strictEqual(stmt.stat('run'), 0);
+    t.assert.strictEqual(stmt.stat('vmStep'), 0);
+    t.assert.strictEqual(stmt.stat('fullscanStep'), 0);
+  });
+
+  test('counters accumulate again after a reset', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;');
+    const stmt = db.prepare('SELECT * FROM data');
+    stmt.all();
+    stmt.resetStats();
+    t.assert.strictEqual(stmt.stat('run'), 0);
+    stmt.all();
+    t.assert.strictEqual(stmt.stat('run'), 1);
+  });
+
+  test('is a no-op when no counters have been incremented', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('SELECT 1');
+    stmt.resetStats();
+    t.assert.strictEqual(stmt.stat('run'), 0);
+  });
+
+  test('throws if the statement is finalized', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('SELECT 1');
+    db.close();
+    t.assert.throws(() => stmt.resetStats(), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+});
+
 suite('StatementSync.prototype.setReadBigInts()', () => {
   test('BigInts support can be toggled', (t) => {
     const db = new DatabaseSync(':memory:');

From 87ee7bff38ef95e4f25e43bb86201a3b456b23dd Mon Sep 17 00:00:00 2001
From: Hendrik Liebau <mail@hendrik-liebau.de>
Date: Thu, 13 Aug 2026 16:36:25 +0200
Subject: [PATCH 158/344] test: cover `realpathSync` resolving symlinks after a
 FIFO stat

While walking a path, `realpathSync` skips the components it already
knows are real, and in that branch it reads the shared stat buffer to
decide whether the walk has reached a pipe or a socket. That buffer
holds the result of the last stat made anywhere in the process rather
than the last one made by the walk, so an unrelated stat of a FIFO ends
the walk early and the path comes back with its symlinks unresolved. The
unresolved path is then written to the cache, so every later resolution
repeats it.

The walk only takes that branch once the ancestors are established as
real, which is the state the module loader's cache is in. The test goes
through `require()` to reach it, where the stale read costs a second
copy of a module reached through a symlink.

Signed-off-by: Hendrik Liebau <mail@hendrik-liebau.de>
PR-URL: https://github.com/nodejs/node/pull/65113
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/fs.js                                     | 25 +++++--
 ...est-fs-realpath-async-stale-stat-values.js | 62 ++++++++++++++++
 .../test-fs-realpath-stale-stat-values.js     | 73 +++++++++++++++++++
 3 files changed, 153 insertions(+), 7 deletions(-)
 create mode 100644 test/parallel/test-fs-realpath-async-stale-stat-values.js
 create mode 100644 test/parallel/test-fs-realpath-stale-stat-values.js

diff --git a/lib/fs.js b/lib/fs.js
index 4fbdaf813018..81c4d2b9c884 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -81,7 +81,6 @@ const {
 
 const {
   FSReqCallback,
-  statValues,
 } = binding;
 const { toPathIfFileURL } = require('internal/url');
 const {
@@ -3254,6 +3253,11 @@ function realpathSync(p, options) {
   const seenLinks = new SafeMap();
   const knownHard = new SafeSet();
   const original = p;
+  // Whether the symlink this walk resolved last pointed at a pipe or a
+  // socket, which is where the walk stops. It cannot be read back from the
+  // shared stat buffer, which holds the last stat made anywhere in the
+  // process rather than the last one made here.
+  let reachedPipeOrSocket = false;
 
   // Current character position in p
   let pos;
@@ -3297,8 +3301,7 @@ function realpathSync(p, options) {
 
     // Continue if not a symlink, break if a pipe/socket
     if (knownHard.has(base) || cache?.get(base) === base) {
-      if (isFileType(statValues, S_IFIFO) ||
-          isFileType(statValues, S_IFSOCK)) {
+      if (reachedPipeOrSocket) {
         break;
       }
       continue;
@@ -3336,7 +3339,9 @@ function realpathSync(p, options) {
         }
       }
       if (linkTarget === null) {
-        binding.stat(base, false, undefined, true);
+        const targetStats = binding.stat(base, false, undefined, true);
+        reachedPipeOrSocket = isFileType(targetStats, S_IFIFO) ||
+          isFileType(targetStats, S_IFSOCK);
         linkTarget = binding.readlink(base, undefined);
       }
       resolvedLink = pathModule.resolve(previous, linkTarget);
@@ -3418,6 +3423,11 @@ function realpath(p, options, callback) {
 
   const seenLinks = new SafeMap();
   const knownHard = new SafeSet();
+  // Whether the symlink this walk resolved last pointed at a pipe or a
+  // socket, which is where the walk stops. It cannot be read back from the
+  // shared stat buffer, which holds the last stat made anywhere in the
+  // process rather than the last one made here.
+  let reachedPipeOrSocket = false;
 
   // Current character position in p
   let pos;
@@ -3466,8 +3476,7 @@ function realpath(p, options, callback) {
 
     // Continue if not a symlink, break if a pipe/socket
     if (knownHard.has(base)) {
-      if (isFileType(statValues, S_IFIFO) ||
-          isFileType(statValues, S_IFSOCK)) {
+      if (reachedPipeOrSocket) {
         return callback(null, encodeRealpathResult(p, options));
       }
       return process.nextTick(LOOP);
@@ -3497,9 +3506,11 @@ function realpath(p, options, callback) {
         return gotTarget(null, seenLinks.get(id));
       }
     }
-    fs.stat(base, (err) => {
+    fs.stat(base, (err, targetStats) => {
       if (err) return callback(err);
 
+      reachedPipeOrSocket = targetStats.isFIFO() || targetStats.isSocket();
+
       fs.readlink(base, (err, target) => {
         if (!isWindows) seenLinks.set(id, target);
         gotTarget(err, target);
diff --git a/test/parallel/test-fs-realpath-async-stale-stat-values.js b/test/parallel/test-fs-realpath-async-stale-stat-values.js
new file mode 100644
index 000000000000..83e8af7b3eaf
--- /dev/null
+++ b/test/parallel/test-fs-realpath-async-stale-stat-values.js
@@ -0,0 +1,62 @@
+'use strict';
+
+// The async realpath() reads the shared stat buffer the same way realpathSync()
+// did, to decide whether the walk has reached a pipe or a socket. The walk's
+// own fs.stat() does leave the right value there, but it is not read until
+// after fs.readlink() and a process.nextTick(), and any stat completing in that
+// window replaces it.
+//
+// Truncating the walk only costs something when a second symlink follows the
+// one being resolved, so the path used here has two.
+
+const common = require('../common');
+
+if (common.isWindows)
+  common.skip('no mkfifo on Windows');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const real = tmpdir.resolve('real');
+const pkg = tmpdir.resolve('pkg');
+const fifo = tmpdir.resolve('fifo');
+
+fs.mkdirSync(real);
+fs.mkdirSync(pkg);
+fs.writeFileSync(path.join(real, 'index.js'), '');
+fs.symlinkSync(path.join('..', 'real'), path.join(pkg, 'sub'));
+fs.symlinkSync('pkg', tmpdir.resolve('link'));
+execFileSync('mkfifo', [fifo]);
+
+const throughLinks = tmpdir.resolve('link', 'sub', 'index.js');
+const expected = path.join(real, 'index.js');
+
+// Keep stats of the FIFO completing for as long as the walk runs, so that one
+// of them lands in the buffer during the window.
+let settled = false;
+(function statFifo() {
+  if (settled) return;
+  fs.stat(fifo, statFifo);
+})();
+
+let error;
+let resolvedPath;
+
+fs.realpath(throughLinks, common.mustCall((err, resolved) => {
+  settled = true;
+  error = err;
+  resolvedPath = resolved;
+}));
+
+// Asserted on exit rather than in the callback. An assertion that fails inside
+// this callback is lost: it does not reach an `uncaughtException` handler and
+// the process still exits 0, so the test would pass over the bug it covers.
+process.on('exit', () => {
+  assert.ifError(error);
+  assert.strictEqual(resolvedPath, expected);
+});
diff --git a/test/parallel/test-fs-realpath-stale-stat-values.js b/test/parallel/test-fs-realpath-stale-stat-values.js
new file mode 100644
index 000000000000..2a5dfdad7a45
--- /dev/null
+++ b/test/parallel/test-fs-realpath-stale-stat-values.js
@@ -0,0 +1,73 @@
+// Flags: --expose-internals
+'use strict';
+
+// Resolving a path must not depend on what was stat'ed before it.
+//
+// While walking a path, realpath skips the components it already knows are
+// real, and in that branch it consulted the shared stat buffer to decide
+// whether the walk had reached a pipe or a socket. That buffer holds the result
+// of the last stat made anywhere in the process, so an unrelated stat of a FIFO
+// made the walk stop early and hand back the path with its symlinks unresolved.
+// The unresolved path is then cached, so every later resolution repeats it.
+
+const common = require('../common');
+
+if (common.isWindows)
+  common.skip('no mkfifo on Windows');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { realpathCacheKey } = require('internal/fs/utils');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const pkg = tmpdir.resolve('pkg');
+const link = tmpdir.resolve('pkg-link');
+const fifo = tmpdir.resolve('fifo');
+
+fs.mkdirSync(pkg);
+fs.writeFileSync(path.join(pkg, 'index.js'), 'module.exports = {};\n');
+fs.writeFileSync(tmpdir.resolve('warm.js'), 'module.exports = {};\n');
+fs.symlinkSync('pkg', link);
+execFileSync('mkfifo', [fifo]);
+
+const throughLink = path.join(link, 'index.js');
+const throughReal = path.join(pkg, 'index.js');
+
+// The walk only skips a component once something has established it as real. A
+// cache carrying the ancestors is that state, and it is the state the module
+// loader's own cache is in after it has resolved anything else under the
+// directory.
+function ancestorCache() {
+  const cache = new Map();
+  let dir = '';
+  for (const part of tmpdir.path.split(path.sep).slice(1)) {
+    dir += path.sep + part;
+    cache.set(dir, dir);
+  }
+  return cache;
+}
+
+fs.statSync(path.join(pkg, 'index.js'));
+assert.strictEqual(
+  fs.realpathSync(throughLink, { [realpathCacheKey]: ancestorCache() }),
+  throughReal,
+);
+
+fs.statSync(fifo);
+assert.strictEqual(
+  fs.realpathSync(throughLink, { [realpathCacheKey]: ancestorCache() }),
+  throughReal,
+);
+
+// What the stale read costs through the module loader, whose cache puts the
+// walk in that same state: the symlink stays unresolved, so the file is loaded
+// a second time under a second name.
+require(tmpdir.resolve('warm.js'));
+fs.statSync(fifo);
+
+assert.strictEqual(require.resolve(throughLink), throughReal);
+assert.strictEqual(require(throughLink), require(throughReal));

From be2ab89730303da87354833e987c5faf0cb78616 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Thu, 13 Aug 2026 07:58:23 -0700
Subject: [PATCH 159/344] ffi: reject detached ArrayBuffers as pointers

Reject detached ArrayBuffers and ArrayBuffer views in getRawPointer()
and FFI pointer argument conversion. This prevents detached backing
stores from being silently passed to native functions as null pointers.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65083
Fixes: https://github.com/nodejs/node/issues/65082
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 lib/internal/ffi/fast-api.js     | 31 ++++++++++++++++++++++++++--
 src/ffi/data.cc                  | 19 +++++++++++++----
 src/ffi/fast.cc                  | 31 ++++++++++++++++++++++++++--
 src/ffi/types.cc                 | 13 ++++++++++++
 test/ffi/test-ffi-fast-buffer.js | 27 +++++++++++++++++++++++-
 test/ffi/test-ffi-memory.js      | 35 ++++++++++++++++++++++++++++++++
 6 files changed, 147 insertions(+), 9 deletions(-)

diff --git a/lib/internal/ffi/fast-api.js b/lib/internal/ffi/fast-api.js
index a232caa1af24..4d46b9c7a8bb 100644
--- a/lib/internal/ffi/fast-api.js
+++ b/lib/internal/ffi/fast-api.js
@@ -1,13 +1,16 @@
 'use strict';
 
 const {
+  ArrayBufferPrototypeGetDetached,
   ArrayPrototypeIncludes,
+  DataViewPrototypeGetBuffer,
   NumberIsInteger,
   ObjectDefineProperty,
   ReflectApply,
   SafeWeakMap,
   StringPrototypeIncludes,
   TypeError,
+  TypedArrayPrototypeGetBuffer,
 } = primordials;
 
 const {
@@ -16,7 +19,9 @@ const {
 
 const {
   isAnyArrayBuffer,
+  isArrayBuffer,
   isArrayBufferView,
+  isDataView,
 } = require('internal/util/types');
 
 const {
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
   return entry.pointer;
 }
 
+function getRawPointerArg(value, index) {
+  let buffer;
+  let isView = false;
+  if (isArrayBuffer(value)) {
+    buffer = value;
+  } else if (isArrayBufferView(value)) {
+    isView = true;
+    buffer = isDataView(value) ?
+      DataViewPrototypeGetBuffer(value) :
+      TypedArrayPrototypeGetBuffer(value);
+  }
+
+  if (buffer !== undefined && isArrayBuffer(buffer) &&
+      ArrayBufferPrototypeGetDetached(buffer)) {
+    throwFFIArgError(isView ?
+      `Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+      `Argument ${index} is a detached ArrayBuffer`);
+  }
+
+  return getRawPointer(value);
+}
+
 function convertPointerArg(type, value, stringState, index) {
   validateFastPointerArg(type, value, index);
   if (needsNullPointerConversion(type) &&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
     return getStringConversionPointer(stringState, value, index);
   }
   if (hasPointerMemoryArg(type, value)) {
-    return getRawPointer(value);
+    return getRawPointerArg(value, index);
   }
   // Pointer-like values (e.g. BigInt addresses) are passed through, matching
   // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
         if (fastBufferInvoke !== undefined) {
           return fastBufferInvoke(arg);
         }
-        arg = getRawPointer(arg);
+        arg = getRawPointerArg(arg, 0);
       }
       return rawFn(arg);
     };
diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 73b575395c8c..6a8d54ca0d39 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
       args[0]->IsArrayBufferView()) {
     view.ReadValue(args[0]);
     if (view.WasDetached()) {
-      THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+      THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
       return;
     }
   } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
   std::shared_ptr<BackingStore> store;
 
   if (args[0]->IsArrayBuffer()) {
-    store = args[0].As<ArrayBuffer>()->GetBackingStore();
+    Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+    if (buffer->WasDetached()) {
+      THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+      return;
+    }
+    store = buffer->GetBackingStore();
   } else if (args[0]->IsSharedArrayBuffer()) {
     store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
   } else if (args[0]->IsArrayBufferView()) {
+    Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+    if (view->Buffer()->WasDetached()) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env, "ArrayBufferView is backed by a detached ArrayBuffer");
+      return;
+    }
     // Access the store here to ensure that it exists. Small typed arrays
     // may not have a store until this point and can instead be stored
     // entirely in-heap.
-    store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
-    offset = args[0].As<ArrayBufferView>()->ByteOffset();
+    store = view->Buffer()->GetBackingStore();
+    offset = view->ByteOffset();
   } else {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
diff --git a/src/ffi/fast.cc b/src/ffi/fast.cc
index 80ee49e08b28..919bacf061a8 100644
--- a/src/ffi/fast.cc
+++ b/src/ffi/fast.cc
@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
   // returns zero after throwing, preventing the native target from seeing an
   // invalid pointer value.
   constexpr uintptr_t kInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+  v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
   // Accept only memory-backed JS values in the native helper. Other pointer
   // conversions, including strings, stay in the JS wrapper so their temporary
   // lifetime is explicit.
   if (value->IsArrayBufferView()) {
+    v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+    if (view->Buffer()->WasDetached()) {
+      if (isolate != nullptr) {
+        // No HandleScope is active during a Fast API call, so open one before
+        // creating the error object.
+        v8::HandleScope scope(isolate);
+        THROW_ERR_INVALID_ARG_VALUE(
+            isolate,
+            "Argument %u is an ArrayBufferView backed by a detached "
+            "ArrayBuffer",
+            index);
+      }
+      return kInvalidBuffer;
+    }
     return PointerFromValue(value);
   }
-  if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+  if (value->IsArrayBuffer()) {
+    if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+      if (isolate != nullptr) {
+        // No HandleScope is active during a Fast API call, so open one before
+        // creating the error object.
+        v8::HandleScope scope(isolate);
+        THROW_ERR_INVALID_ARG_VALUE(
+            isolate, "Argument %u is a detached ArrayBuffer", index);
+      }
+      return kInvalidBuffer;
+    }
+    return PointerFromValue(value);
+  }
+  if (value->IsSharedArrayBuffer()) {
     return PointerFromValue(value);
   }
 
-  v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
   if (isolate != nullptr) {
     // No HandleScope is active during a Fast API call, so open one before
     // creating the error object.
diff --git a/src/ffi/types.cc b/src/ffi/types.cc
index 9ba3cc4da448..db0c913c547d 100644
--- a/src/ffi/types.cc
+++ b/src/ffi/types.cc
@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
       // invalidating that backing store during the active FFI call is
       // unsupported and dangerous.
       Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+      if (view->Buffer()->WasDetached()) {
+        THROW_ERR_INVALID_ARG_VALUE(
+            env,
+            "Argument %u is an ArrayBufferView backed by a detached "
+            "ArrayBuffer",
+            index);
+        return {};
+      }
       std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
       if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
       // that backing store during the active FFI call is unsupported and
       // dangerous.
       Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+      if (buffer->WasDetached()) {
+        THROW_ERR_INVALID_ARG_VALUE(
+            env, "Argument %u is a detached ArrayBuffer", index);
+        return {};
+      }
       std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
       if (!store) {
diff --git a/test/ffi/test-ffi-fast-buffer.js b/test/ffi/test-ffi-fast-buffer.js
index e4399ee8ee47..a6b196efc014 100644
--- a/test/ffi/test-ffi-fast-buffer.js
+++ b/test/ffi/test-ffi-fast-buffer.js
@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions', () => {
   const lib = new ffi.DynamicLibrary(libraryPath);
+  const asPointer = lib.getFunction('pointer_to_usize', {
+    arguments: ['pointer'],
+    return: 'u64',
+  });
   const asBuffer = lib.getFunction('pointer_to_usize', {
     arguments: ['buffer'],
     return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
     return: 'u64',
   });
 
+  function callPointer(value) {
+    return asPointer(value);
+  }
+
   function callBuffer(value) {
     return asBuffer(value);
   }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
   try {
     for (let i = 0; i < 100_000; i++) {
+      assert.strictEqual(callPointer(0n), 0n);
       assert.strictEqual(callBuffer(0n), 0n);
       assert.strictEqual(callArrayBuffer(0n), 0n);
     }
 
-    for (const call of [callBuffer, callArrayBuffer]) {
+    for (const call of [callPointer, callBuffer, callArrayBuffer]) {
       assert.strictEqual(call(null), 0n);
       assert.strictEqual(call(undefined), 0n);
       assert.notStrictEqual(call('ffi'), 0n);
 
       const bytes = Buffer.alloc(1);
       assert.strictEqual(call(bytes), ffi.getRawPointer(bytes));
+
+      const arrayBuffer = new ArrayBuffer(8);
+      const typedArray = new Uint8Array(arrayBuffer);
+      const dataView = new DataView(arrayBuffer);
+      arrayBuffer.transfer();
+
+      assert.throws(() => call(arrayBuffer), {
+        code: 'ERR_INVALID_ARG_VALUE',
+        message: 'Argument 0 is a detached ArrayBuffer',
+      });
+      for (const view of [typedArray, dataView]) {
+        assert.throws(() => call(view), {
+          code: 'ERR_INVALID_ARG_VALUE',
+          message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+        });
+      }
     }
   } finally {
     lib.close();
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index f17f56c410f8..ee88e9ef4151 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
   assert.strictEqual(sharedViewPointer, sharedArrayBufferPointer + 2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers', () => {
+  const arrayBuffer = new ArrayBuffer(8);
+  const typedArray = new Uint8Array(arrayBuffer);
+  const dataView = new DataView(arrayBuffer);
+
+  arrayBuffer.transfer();
+
+  assert.throws(() => ffi.exportArrayBuffer(arrayBuffer, 0n, 0), {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: 'ArrayBuffer is detached',
+  });
+
+  for (const [value, rawPointerMessage, argumentMessage] of [
+    [
+      arrayBuffer,
+      'ArrayBuffer is detached',
+      'Argument 0 is a detached ArrayBuffer',
+    ],
+    ...[typedArray, dataView].map((view) => [
+      view,
+      'ArrayBufferView is backed by a detached ArrayBuffer',
+      'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+    ]),
+  ]) {
+    assert.throws(() => ffi.getRawPointer(value), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: rawPointerMessage,
+    });
+    assert.throws(() => symbols.pointer_to_usize(value), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: argumentMessage,
+    });
+  }
+});
+
 test('ffi exportString and exportBuffer copy data into native memory', () => {
   withAllocations(common.mustCall((alloc) => {
     const stringPtr = alloc(16);

From eacd65e9c2ca69310179c0478077d36bafb79d07 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Thu, 13 Aug 2026 08:25:11 -0700
Subject: [PATCH 160/344] ffi: reject detached ArrayBufferViews

Detached ArrayBuffers were rejected with ERR_INVALID_ARG_VALUE, but
detached views were not: typed arrays exported zero bytes and DataViews
threw a bare TypeError from byteLength.

Track detachment in ArrayBufferViewContents::Read() and skip the JS
length check for detached buffers, so every detached input is rejected.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65086
Fixes: https://github.com/nodejs/node/issues/65085
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 lib/ffi.js                  | 13 ++++++++++++-
 src/util-inl.h              |  1 +
 test/ffi/test-ffi-memory.js | 17 +++++++++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/lib/ffi.js b/lib/ffi.js
index edb12ed4ed45..cbd188793200 100644
--- a/lib/ffi.js
+++ b/lib/ffi.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const {
+  ArrayBufferPrototypeGetDetached,
+  DataViewPrototypeGetBuffer,
   FunctionPrototypeCall,
   ObjectDefineProperty,
   ObjectFreeze,
@@ -10,11 +12,14 @@ const {
   SafeWeakMap,
   SafeWeakRef,
   SymbolDispose,
+  TypedArrayPrototypeGetBuffer,
 } = primordials;
 const { Buffer } = require('buffer');
 const { emitExperimentalWarning } = require('internal/util');
 const {
+  isDataView,
   isArrayBufferView,
+  isSharedArrayBuffer,
 } = require('internal/util/types');
 const {
   codes: {
@@ -299,7 +304,13 @@ function exportArrayBufferView(source, data, len) {
 
   validateInteger(len, 'len', 0);
 
-  if (len < source.byteLength) {
+  // Reading byteLength throws for a detached DataView. Let the native binding
+  // reject detached views consistently with detached ArrayBuffers.
+  const buffer = isDataView(source) ?
+    DataViewPrototypeGetBuffer(source) : TypedArrayPrototypeGetBuffer(source);
+  if ((isSharedArrayBuffer(buffer) ||
+       !ArrayBufferPrototypeGetDetached(buffer)) &&
+      len < source.byteLength) {
     throw new ERR_OUT_OF_RANGE('len', `>= ${source.byteLength}`, len);
   }
 
diff --git a/src/util-inl.h b/src/util-inl.h
index 4ac8726aa43f..0a5a90def488 100644
--- a/src/util-inl.h
+++ b/src/util-inl.h
@@ -572,6 +572,7 @@ ArrayBufferViewContents<T, S>::ArrayBufferViewContents(
 template <typename T, size_t S>
   requires(sizeof(T) == 1)
 void ArrayBufferViewContents<T, S>::Read(v8::Local<v8::ArrayBufferView> abv) {
+  was_detached_ = abv->Buffer()->WasDetached();
   length_ = abv->ByteLength();
   if (length_ > sizeof(stack_storage_) || abv->HasBuffer()) {
     auto buf_data = abv->Buffer()->Data();
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index ee88e9ef4151..e5bf4ba07e13 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -286,6 +286,23 @@ test('ffi validates memory access arguments', () => {
     assert.throws(() => ffi.exportArrayBufferView('bad', ptr, 4), { code: 'ERR_INVALID_ARG_TYPE' });
     assert.throws(() => ffi.exportArrayBufferView(new Uint8Array([1]), ptr, -1), { code: 'ERR_OUT_OF_RANGE' });
     assert.throws(() => ffi.exportArrayBufferView(new Uint8Array([1, 2]), ptr, 1), { code: 'ERR_OUT_OF_RANGE' });
+    ffi.exportArrayBufferView(new Uint8Array(new SharedArrayBuffer(1)), ptr, 1);
+
+    const detachedArrayBuffer = new ArrayBuffer(1);
+    detachedArrayBuffer.transfer();
+    assert.throws(() => ffi.exportArrayBuffer(detachedArrayBuffer, ptr, 1), {
+      code: 'ERR_INVALID_ARG_VALUE',
+    });
+
+    for (const View of [Uint8Array, DataView]) {
+      const arrayBuffer = new ArrayBuffer(1);
+      const view = new View(arrayBuffer);
+      arrayBuffer.transfer();
+      assert.throws(() => ffi.exportArrayBufferView(view, ptr, 1), {
+        code: 'ERR_INVALID_ARG_VALUE',
+      });
+    }
+
     assert.throws(() => ffi.toBuffer(maxPointer, 8), /pointer and length exceed the platform address range/);
     assert.throws(() => ffi.toArrayBuffer(maxPointer, 8), /pointer and length exceed the platform address range/);
     assert.throws(() => ffi.toBuffer(1n, bufferConstants.MAX_LENGTH + 1), { code: 'ERR_BUFFER_TOO_LARGE' });

From 6ca9c1e0786299396c49bf54d0bb14df133ba307 Mon Sep 17 00:00:00 2001
From: Hiroki Osame <hiroki.osame@gmail.com>
Date: Fri, 14 Aug 2026 01:13:28 +0900
Subject: [PATCH 161/344] util: preserve function names without source map
 names

Signed-off-by: Hiroki Osame <hiroki.osame@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65108
Fixes: https://github.com/nodejs/node/issues/65104
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
---
 lib/util.js                                          |  3 +--
 .../get-call-sites-function-name-mapped.js           |  2 ++
 .../get-call-sites-function-name-mapped.map          |  7 +++++++
 test/parallel/test-util-getcallsites-sourcemap.js    | 12 ++++++++++++
 4 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 test/fixtures/source-map/get-call-sites-function-name-mapped.js
 create mode 100644 test/fixtures/source-map/get-call-sites-function-name-mapped.map

diff --git a/lib/util.js b/lib/util.js
index e828229380d9..7a9c06e8bdbb 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -515,8 +515,7 @@ function reconstructCallSite(callSite) {
   if (!entry?.originalSource) return;
   return {
     __proto__: null,
-    // If the name is not found, it is an empty string to match the behavior of `util.getCallSite()`
-    functionName: entry.name ?? '',
+    functionName: entry.name || callSite.functionName,
     scriptName: entry.originalSource,
     lineNumber: entry.originalLine + 1,
     column: entry.originalColumn + 1,
diff --git a/test/fixtures/source-map/get-call-sites-function-name-mapped.js b/test/fixtures/source-map/get-call-sites-function-name-mapped.js
new file mode 100644
index 000000000000..d400af7f2fb8
--- /dev/null
+++ b/test/fixtures/source-map/get-call-sites-function-name-mapped.js
@@ -0,0 +1,2 @@
+const{getCallSites}=require('node:util');function foo(){process.stdout.write(JSON.stringify(getCallSites({sourceMap:true})[0]))}foo();
+//# sourceMappingURL=get-call-sites-function-name-mapped.map
diff --git a/test/fixtures/source-map/get-call-sites-function-name-mapped.map b/test/fixtures/source-map/get-call-sites-function-name-mapped.map
new file mode 100644
index 000000000000..de70e4512ffa
--- /dev/null
+++ b/test/fixtures/source-map/get-call-sites-function-name-mapped.map
@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["get-call-sites-function-name-original.js"],
+  "sourcesContent": ["const { getCallSites } = require('node:util'); function foo() { process.stdout.write(JSON.stringify(getCallSites({ sourceMap: true })[0])); } foo();"],
+  "mappings": "AAAA,KAAM,CAAE,YAAa,EAAI,QAAQ,WAAW,EAAG,SAAS,KAAM,CAAE,QAAQ,OAAO,MAAM,KAAK,UAAU,aAAa,CAAE,UAAW,EAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAG,CAAE,IAAI",
+  "names": []
+}
diff --git a/test/parallel/test-util-getcallsites-sourcemap.js b/test/parallel/test-util-getcallsites-sourcemap.js
index 4499ea106fdd..9259832261ee 100644
--- a/test/parallel/test-util-getcallsites-sourcemap.js
+++ b/test/parallel/test-util-getcallsites-sourcemap.js
@@ -39,6 +39,18 @@ const fixtures = require('../common/fixtures');
   assert.strictEqual(callSite.columnNumber, 1);
 }
 
+// A source map may omit names, so preserve the function name from the call site.
+{
+  const file = fixtures.path('source-map', 'get-call-sites-function-name-mapped.js');
+  const { status, stderr, stdout } = spawnSync(
+    process.execPath,
+    ['--enable-source-maps', file],
+  );
+  assert.strictEqual(status, 0, stderr.toString());
+  const callSite = JSON.parse(stdout.toString());
+  assert.strictEqual(callSite.functionName, 'foo');
+}
+
 // Without --enable-source-maps the generated file path is preserved.
 {
   const file = fixtures.path('source-map', 'get-call-sites-mapped.js');

From 922d47cbd72f2dea2b67c4a0ee5b90ee45eef076 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 13 Aug 2026 18:34:53 +0200
Subject: [PATCH 162/344] src: escape Windows environment variables in task
 runner

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65217
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
---
 src/node_task_runner.cc        |  3 ++-
 test/parallel/test-node-run.js | 17 ++++++++++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/node_task_runner.cc b/src/node_task_runner.cc
index 9263a502a45f..e7cc9ccf3f13 100644
--- a/src/node_task_runner.cc
+++ b/src/node_task_runner.cc
@@ -154,7 +154,7 @@ std::string EscapeShell(const std::string_view input) {
   }
 
   static constexpr std::string_view forbidden_characters =
-      "[\t\n\r \"#$&'()*;<>?\\\\`|~]";
+      "[\t\n\r \"#$&'()*;<>%?\\\\`|~]";
 
   // Check if input contains any forbidden characters
   // If it doesn't, return the input as is.
@@ -174,6 +174,7 @@ std::string EscapeShell(const std::string_view input) {
   static const std::regex tripleSingleQuote("\\\\\"\"\"");
   escaped = std::regex_replace(escaped, leadingQuotePairs, "");
   escaped = std::regex_replace(escaped, tripleSingleQuote, "\\\"");
+  escaped = std::regex_replace(escaped, std::regex("%"), "^%");
 #else
   // Replace single quotes("'") with `'"'"'` and wrap the result
   // in single quotes.
diff --git a/test/parallel/test-node-run.js b/test/parallel/test-node-run.js
index ece9e48878b3..bac90cf5db58 100644
--- a/test/parallel/test-node-run.js
+++ b/test/parallel/test-node-run.js
@@ -12,7 +12,7 @@ const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const envSuffix = common.isWindows ? '-windows' : '';
 
-describe('node --run [command]', () => {
+describe('node --run [command]', { concurrency: !process.env.TEST_PARALLEL }, () => {
   it('returns error on non-existent file', async () => {
     const child = await common.spawnPromisified(
       process.execPath,
@@ -286,4 +286,19 @@ describe('node --run [command]', () => {
     assert.strictEqual(child.stdout, '');
     assert.strictEqual(child.code, 1);
   });
+
+  it('escapes shell characters', async () => {
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run', `positional-args${envSuffix}`, '--', '%PAYLOAD%', '$PAYLOAD'],
+      { cwd: fixtures.path('run-script'), env: { ...process.env, PAYLOAD: 'env value' } },
+    );
+    assert.strictEqual(
+      child.stdout,
+      common.isWindows ?
+        `Raw '"^%PAYLOAD^%" "$PAYLOAD"'\r\nArguments: '%PAYLOAD% $PAYLOAD'\r\nThe total number of arguments is: 2\r\n` :
+        "Arguments: '%PAYLOAD% $PAYLOAD'\nThe total number of arguments is: 2\n");
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+  });
 });

From fbec4eb386c2fc44a1829e5ddba2932e2a3d617c Mon Sep 17 00:00:00 2001
From: Edy Silva <edigleyssonsilva@gmail.com>
Date: Thu, 13 Aug 2026 15:36:12 -0300
Subject: [PATCH 163/344] benchmark: complete the sqlite is-transaction fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65218
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 benchmark/sqlite/sqlite-is-transaction.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/benchmark/sqlite/sqlite-is-transaction.js b/benchmark/sqlite/sqlite-is-transaction.js
index 3bfc896cf91c..dca31a18d986 100644
--- a/benchmark/sqlite/sqlite-is-transaction.js
+++ b/benchmark/sqlite/sqlite-is-transaction.js
@@ -16,14 +16,14 @@ function main(conf) {
   }
 
   let i;
-  let deadCodeElimination = true;
+  let deadCodeElimination;
 
   bench.start();
   for (i = 0; i < conf.n; i += 1)
-    deadCodeElimination &&= db.isTransaction;
+    deadCodeElimination = db.isTransaction;
   bench.end(conf.n);
 
-  assert.ok(deadCodeElimination === (conf.transaction === 'true'));
+  assert.strictEqual(deadCodeElimination, conf.transaction === 'true');
 
   if (conf.transaction === 'true') {
     db.exec('ROLLBACK');

From 501f81612d32bde007e66239a0539c0b2a62db99 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Fri, 14 Aug 2026 00:39:12 +0300
Subject: [PATCH 164/344] crypto: improve SubtleCrypto.supports() accuracy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Constrain context parameters, ML-KEM derived-key imports, HKDF output
lengths, and RSA key generation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65222
Refs: https://redirect.github.com/w3c/webcrypto/pull/558
Refs: https://redirect.github.com/WICG/webcrypto-modern-algos/pull/76
Refs: https://redirect.github.com/WICG/webcrypto-modern-algos/pull/77
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
---
 lib/internal/crypto/hkdf.js                   | 10 ++-
 lib/internal/crypto/rsa.js                    | 13 +--
 lib/internal/crypto/util.js                   | 12 ++-
 lib/internal/crypto/webcrypto.js              | 85 +++++++++++++------
 lib/internal/crypto/webidl.js                 | 40 ++++++++-
 test/fixtures/webcrypto/supports-level-2.mjs  | 32 +++++++
 .../webcrypto/supports-modern-algorithms.mjs  | 16 ++++
 .../webcrypto/supports-secure-curves.mjs      |  2 +
 .../test-webcrypto-derivebits-hkdf.js         | 21 +++++
 test/parallel/test-webcrypto-keygen.js        | 19 ++++-
 ...-webcrypto-promise-prototype-pollution.mjs | 13 ++-
 .../test-webcrypto-sign-verify-eddsa.js       | 20 ++---
 .../test-webcrypto-sign-verify-ml-dsa.js      | 16 ++--
 .../test-webcrypto-sign-verify-rsa.js         | 12 ---
 test/parallel/test-webcrypto-supports.mjs     | 36 ++++++--
 test/parallel/test-webcrypto-util.js          | 10 ++-
 16 files changed, 264 insertions(+), 93 deletions(-)

diff --git a/lib/internal/crypto/hkdf.js b/lib/internal/crypto/hkdf.js
index c9b868e23af4..d55968907541 100644
--- a/lib/internal/crypto/hkdf.js
+++ b/lib/internal/crypto/hkdf.js
@@ -22,6 +22,7 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
+  getDigestSizeInBytes,
   jobPromise,
   normalizeHashName,
   toBuf,
@@ -141,7 +142,7 @@ function hkdfSync(hash, key, salt, info, length) {
   return bits;
 }
 
-function validateHkdfDeriveBitsLength(length) {
+function validateHkdfDeriveBitsLength(length, hash) {
   if (length === null)
     throw lazyDOMException('length cannot be null', 'OperationError');
   if (length % 8) {
@@ -149,11 +150,16 @@ function validateHkdfDeriveBitsLength(length) {
       'length must be a multiple of 8',
       'OperationError');
   }
+  if (length > 255 * getDigestSizeInBytes(hash.name) * 8) {
+    throw lazyDOMException(
+      'length exceeds the maximum derived bit length',
+      'OperationError');
+  }
 }
 
 function hkdfDeriveBits(algorithm, baseKey, length) {
-  validateHkdfDeriveBitsLength(length);
   const { hash, salt, info } = algorithm;
+  validateHkdfDeriveBitsLength(length, hash);
 
   if (length === 0)
     return PromiseResolve(new ArrayBuffer(0));
diff --git a/lib/internal/crypto/rsa.js b/lib/internal/crypto/rsa.js
index d153ab664bd8..846b6b7bf748 100644
--- a/lib/internal/crypto/rsa.js
+++ b/lib/internal/crypto/rsa.js
@@ -103,12 +103,6 @@ function rsaKeyGenerate(
   extractable,
   usages,
 ) {
-  const publicExponentConverted = bigIntArrayToUnsignedInt(algorithm.publicExponent);
-  if (publicExponentConverted === undefined) {
-    throw lazyDOMException(
-      'The publicExponent must be equivalent to an unsigned 32-bit value',
-      'OperationError');
-  }
   const {
     name,
     modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
   const allowedUsages = kUsages[name];
   const usagesSet = validateKeyUsages(usages, allowedUsages.keygen, name);
+  const publicExponentConverted = bigIntArrayToUnsignedInt(publicExponent);
 
   const keyAlgorithm = {
     name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
     hash,
   };
 
-  if (publicExponentConverted < 3 || publicExponentConverted % 2 === 0) {
-    throw lazyDOMException(
-      'The operation failed for an operation-specific reason',
-      'OperationError');
-  }
-
   const keyUsages = getKeyPairUsages(usagesSet, allowedUsages);
   validateUsagesNotEmpty(keyUsages.private);
 
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index 3a70d32b8d21..08088069f9f6 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -341,6 +341,7 @@ const kAlgorithmDefinitions = {
     'importKey': null,
     'encapsulate': null,
     'decapsulate': null,
+    'get shared key length': null,
   },
   'ML-KEM-768': {
     'generateKey': null,
@@ -348,6 +349,7 @@ const kAlgorithmDefinitions = {
     'importKey': null,
     'encapsulate': null,
     'decapsulate': null,
+    'get shared key length': null,
   },
   'ML-KEM-1024': {
     'generateKey': null,
@@ -355,6 +357,7 @@ const kAlgorithmDefinitions = {
     'importKey': null,
     'encapsulate': null,
     'decapsulate': null,
+    'get shared key length': null,
   },
   'PBKDF2': {
     'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 function bigIntArrayToUnsignedInt(input) {
   let result = 0;
   const length = TypedArrayPrototypeGetLength(input);
 
   for (let n = 0; n < length; ++n) {
     const n_reversed = length - n - 1;
-    if (n_reversed >= 4 && input[n])
-      return;  // Too large
+    if (n_reversed >= 4 && input[n]) {
+      throw lazyDOMException(
+        'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+        'OperationError');
+    }
     result |= input[n] << 8 * n_reversed;
   }
 
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index c2803cca1372..55953d8e4745 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
   }
 }
 
+function getSharedKeyLength({ name }) {
+  switch (name) {
+    case 'ML-KEM-512':
+      // Fall through
+    case 'ML-KEM-768':
+      // Fall through
+    case 'ML-KEM-1024':
+      return 256;
+    /* c8 ignore start */
+    default: {
+      const assert = require('internal/assert');
+      assert.fail('Unreachable code');
+    }
+    /* c8 ignore stop */
+  }
+}
+
+function canImportRawSecret(algorithm, sharedKeyLength) {
+  switch (algorithm.name) {
+    case 'AES-OCB':
+    case 'AES-KW':
+    case 'AES-GCM':
+    case 'AES-CTR':
+    case 'AES-CBC':
+      return sharedKeyLength === 128 ||
+             sharedKeyLength === 192 ||
+             sharedKeyLength === 256;
+    case 'ChaCha20-Poly1305':
+      return sharedKeyLength === 256;
+    case 'HKDF':
+    case 'PBKDF2':
+    case 'Argon2i':
+    case 'Argon2d':
+    case 'Argon2id':
+      return true;
+    case 'HMAC':
+      if (sharedKeyLength === 0)
+        return false;
+      // Fall through
+    case 'KMAC128':
+    case 'KMAC256':
+      return algorithm.length === undefined ||
+             numBitsToBytes(algorithm.length) * 8 === sharedKeyLength;
+    default:
+      return false;
+  }
+}
+
 function deriveKey(
   algorithm,
   baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
         },
       );
 
+      let sharedKeyLength;
       let normalizedAdditionalAlgorithm;
       try {
+        const normalizedAlgorithm =
+          normalizeAlgorithm(algorithm, 'get shared key length');
+        sharedKeyLength = getSharedKeyLength(normalizedAlgorithm);
         normalizedAdditionalAlgorithm = normalizeAlgorithm(additionalAlgorithm, 'importKey');
       } catch {
         return false;
       }
 
-      switch (normalizedAdditionalAlgorithm.name) {
-        case 'AES-OCB':
-        case 'AES-KW':
-        case 'AES-GCM':
-        case 'AES-CTR':
-        case 'AES-CBC':
-        case 'ChaCha20-Poly1305':
-        case 'HKDF':
-        case 'PBKDF2':
-        case 'Argon2i':
-        case 'Argon2d':
-        case 'Argon2id':
-          break;
-        case 'HMAC':
-        case 'KMAC128':
-        case 'KMAC256':
-          if (normalizedAdditionalAlgorithm.length === undefined ||
-              numBitsToBytes(normalizedAdditionalAlgorithm.length) === 32) {
-            break;
-          }
-          return false;
-        default:
-          return false;
-      }
+      if (!canImportRawSecret(normalizedAdditionalAlgorithm, sharedKeyLength))
+        return false;
     }
 
     try {
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
   }
 
   switch (op) {
-    case 'decapsulate':
-    case 'decrypt':
     case 'digest': {
       if ((normalizedAlgorithm.name === 'cSHAKE128' ||
            normalizedAlgorithm.name === 'cSHAKE256') &&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
       }
       return true;
     }
+    case 'decapsulate':
+    case 'decrypt':
     case 'encapsulate':
     case 'encrypt':
     case 'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
       return true;
     case 'deriveBits': {
       if (normalizedAlgorithm.name === 'HKDF') {
-        require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+        require('internal/crypto/hkdf')
+          .validateHkdfDeriveBitsLength(length, normalizedAlgorithm.hash);
       }
 
       if (normalizedAlgorithm.name === 'PBKDF2') {
diff --git a/lib/internal/crypto/webidl.js b/lib/internal/crypto/webidl.js
index 9be253daaf2e..6ec400256820 100644
--- a/lib/internal/crypto/webidl.js
+++ b/lib/internal/crypto/webidl.js
@@ -24,6 +24,7 @@ const {
   getCryptoKeyType,
 } = require('internal/crypto/keys');
 const {
+  bigIntArrayToUnsignedInt,
   validateMaxBufferLength,
   getBufferSourceByteLength,
   getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
   type,
 } = require('internal/webidl');
 
+const kRsaKeyGenMinimumModulusLength = isFips ? 2048 : 512;
+
 function validateByteLength(buf, name, target) {
   if (getBufferSourceByteLength(buf) !== target) {
     throw lazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
     key: 'modulusLength',
     converter: (V, opts) =>
       converters['unsigned long'](V, enforceRangeOptions(opts)),
+    validator: (modulusLength) => {
+      if (modulusLength < kRsaKeyGenMinimumModulusLength) {
+        throw lazyDOMException(
+          `algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+          'OperationError');
+      }
+    },
     required: true,
   },
   {
     key: 'publicExponent',
     converter: converters.BigInteger,
+    validator: (publicExponent) => {
+      const converted = bigIntArrayToUnsignedInt(publicExponent);
+
+      if (converted < 3) {
+        throw lazyDOMException(
+          'algorithm.publicExponent must be at least 3',
+          'OperationError');
+      }
+
+      if (converted % 2 === 0) {
+        throw lazyDOMException(
+          'algorithm.publicExponent must be odd',
+          'OperationError');
+      }
+    },
     required: true,
   },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
         key: 'context',
         converter: converters.BufferSource,
         validator(V, dict) {
+          const validateLength = (V) =>
+            validateMaxBufferLength(V, 'ContextParams.context', 255);
+
           if (process.features.openssl_is_boringssl) {
-            this.validator = undefined;
+            this.validator = validateLength;
           } else {
             let { 0: major, 1: minor } =
               StringPrototypeSplit(process.versions.openssl, '.');
             major = NumberParseInt(major, 10);
             minor = NumberParseInt(minor, 10);
             if (major > 3 || (major === 3 && minor >= 2)) {
-              this.validator = undefined;
+              this.validator = validateLength;
             } else {
-              this.validator = validateZeroLength('ContextParams.context');
-              this.validator(V, dict);
+              const validateEmpty = validateZeroLength('ContextParams.context');
+              this.validator = (V, dict) => {
+                validateLength(V);
+                validateEmpty(V, dict);
+              };
             }
           }
+          this.validator(V, dict);
         },
       },
     ],
diff --git a/test/fixtures/webcrypto/supports-level-2.mjs b/test/fixtures/webcrypto/supports-level-2.mjs
index 674e4cf8c6de..3d0f8a630394 100644
--- a/test/fixtures/webcrypto/supports-level-2.mjs
+++ b/test/fixtures/webcrypto/supports-level-2.mjs
@@ -1,4 +1,7 @@
+import { getFips } from 'node:crypto';
+
 const { subtle } = globalThis.crypto;
+const RSA_MINIMUM_MODULUS_LENGTH = getFips() === 1 ? 2048 : 512;
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
     [true, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256', ...RSA_KEY_GEN }],
     [true, { name: 'RSA-PSS', hash: 'SHA-256', ...RSA_KEY_GEN }],
     [true, { name: 'RSA-OAEP', hash: 'SHA-256', ...RSA_KEY_GEN }],
+    [true, {
+      name: 'RSA-PSS',
+      hash: 'SHA-256',
+      modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+      publicExponent: new Uint8Array([1, 0, 1]),
+    }],
+    [false, {
+      name: 'RSASSA-PKCS1-v1_5',
+      hash: 'SHA-256',
+      modulusLength: RSA_MINIMUM_MODULUS_LENGTH - 1,
+      publicExponent: new Uint8Array([1, 0, 1]),
+    }],
+    [false, {
+      name: 'RSA-PSS',
+      hash: 'SHA-256',
+      ...RSA_KEY_GEN,
+      publicExponent: new Uint8Array([2]),
+    }],
+    [false, {
+      name: 'RSA-OAEP',
+      hash: 'SHA-256',
+      ...RSA_KEY_GEN,
+      publicExponent: new Uint8Array([1, 0, 0, 0, 1]),
+    }],
     [true, { name: 'ECDSA', namedCurve: 'P-256' }],
     [false, { name: 'ECDSA', namedCurve: 'X25519' }],
     [true, { name: 'AES-CTR', length: 128 }],
@@ -146,6 +173,8 @@ export const vectors = {
   'deriveBits': [
     [true, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 8],
     [true, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 0],
+    [true, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 65280],
+    [false, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 65288],
     [false, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, null],
     [false, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 7],
     [false, { name: 'HKDF', hash: 'Invalid', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 8],
@@ -234,4 +263,7 @@ export const vectors = {
   'get key length': [
     [false, { name: 'HMAC', hash: 'SHA-256' }],
   ],
+  'get shared key length': [
+    [false, 'ML-KEM-768'],
+  ],
 };
diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
index acb0e249dd38..4b44e02d479d 100644
--- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -70,6 +70,12 @@ export const vectors = {
     [pqc, { name: 'ML-DSA-44', context: Buffer.alloc(32) }],
     [pqc, { name: 'ML-DSA-65', context: Buffer.alloc(32) }],
     [pqc, { name: 'ML-DSA-87', context: Buffer.alloc(32) }],
+    [pqc, { name: 'ML-DSA-44', context: Buffer.alloc(255) }],
+    [pqc, { name: 'ML-DSA-65', context: Buffer.alloc(255) }],
+    [pqc, { name: 'ML-DSA-87', context: Buffer.alloc(255) }],
+    [false, { name: 'ML-DSA-44', context: Buffer.alloc(256) }],
+    [false, { name: 'ML-DSA-65', context: Buffer.alloc(256) }],
+    [false, { name: 'ML-DSA-87', context: Buffer.alloc(256) }],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
     [false, 'Argon2id'],
@@ -225,9 +231,14 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256' }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 256 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
+    [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 257 }],
     [false, 'ML-KEM-768', { name: 'KMAC128', length: 248 }],
+    [false, 'ML-KEM-768', 'Ed25519'],
   ],
   'decapsulateBits': [
     [pqc && !boringSSL, 'ML-KEM-512'],
@@ -246,8 +257,13 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256' }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 256 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
+    [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 257 }],
     [false, 'ML-KEM-768', { name: 'KMAC128', length: 248 }],
+    [false, 'ML-KEM-768', 'Ed25519'],
   ],
 };
diff --git a/test/fixtures/webcrypto/supports-secure-curves.mjs b/test/fixtures/webcrypto/supports-secure-curves.mjs
index 56bb89c28afa..a3a84f6c9f9a 100644
--- a/test/fixtures/webcrypto/supports-secure-curves.mjs
+++ b/test/fixtures/webcrypto/supports-secure-curves.mjs
@@ -19,6 +19,8 @@ export const vectors = {
     [!boringSSL, 'Ed448'],
     [!boringSSL, { name: 'Ed448', context: Buffer.alloc(0) }],
     [!boringSSL && supportsContext, { name: 'Ed448', context: Buffer.alloc(32) }],
+    [!boringSSL && supportsContext, { name: 'Ed448', context: Buffer.alloc(255) }],
+    [false, { name: 'Ed448', context: Buffer.alloc(256) }],
   ],
   'generateKey': [
     [!boringSSL, 'X448'],
diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js
index d2057d1f782e..539440ea7c31 100644
--- a/test/parallel/test-webcrypto-derivebits-hkdf.js
+++ b/test/parallel/test-webcrypto-derivebits-hkdf.js
@@ -639,6 +639,27 @@ async function testWrongKeyType(
   assert.deepStrictEqual(bits, new ArrayBuffer(0));
 })().then(common.mustCall());
 
+// HKDF output is limited to 255 digest blocks.
+(async function() {
+  const key = await crypto.subtle.importKey(
+    'raw', new Uint8Array(0), 'HKDF', false, ['deriveBits']);
+  const algorithm = {
+    name: 'HKDF',
+    hash: 'SHA-256',
+    info: new Uint8Array(0),
+    salt: new Uint8Array(0),
+  };
+
+  const bits = await crypto.subtle.deriveBits(algorithm, key, 65280);
+  assert.strictEqual(bits.byteLength, 8160);
+
+  await assert.rejects(
+    crypto.subtle.deriveBits(algorithm, key, 65288), {
+      name: 'OperationError',
+      message: 'length exceeds the maximum derived bit length',
+    });
+})().then(common.mustCall());
+
 // OpenSSL limits info to 1024 bytes
 (async function() {
   const key = await crypto.subtle.importKey('raw', new Uint8Array(0), 'HKDF', false, ['deriveBits']);
diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js
index 6ea2579ae041..6e264031c4d1 100644
--- a/test/parallel/test-webcrypto-keygen.js
+++ b/test/parallel/test-webcrypto-keygen.js
@@ -18,6 +18,7 @@ const {
 const { subtle } = globalThis.crypto;
 const fips3 = hasFIPS(3);
 const fips35 = hasFIPS(3, 5);
+const rsaMinimumModulusLength = getFips() === 1 ? 2048 : 512;
 
 const { bigIntArrayToUnsignedBigInt } = require('internal/crypto/util');
 
@@ -432,7 +433,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
       subtle.generateKey(
         { name, modulusLength, publicExponent: new Uint8Array([1, 1, 1, 1, 1]), hash }, true, usages),
       {
-        message: /The publicExponent must be equivalent to an unsigned 32-bit value/,
+        message: 'algorithm.publicExponent must fit in an unsigned 32-bit integer',
         name: 'OperationError',
       });
 
@@ -456,16 +457,30 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
       });
     }));
 
-    await Promise.all([[1], [1, 0, 0]].map((publicExponent) => {
+    await Promise.all([
+      [[1], 'algorithm.publicExponent must be at least 3'],
+      [[1, 0, 0], 'algorithm.publicExponent must be odd'],
+    ].map(({ 0: publicExponent, 1: message }) => {
       return assert.rejects(subtle.generateKey({
         name,
         modulusLength,
         publicExponent: new Uint8Array(publicExponent),
         hash
       }, true, usages), {
+        message,
         name: 'OperationError',
       });
     }));
+
+    await assert.rejects(subtle.generateKey({
+      name,
+      modulusLength: rsaMinimumModulusLength - 1,
+      publicExponent: new Uint8Array([3]),
+      hash,
+    }, true, usages), {
+      message: `algorithm.modulusLength must be at least ${rsaMinimumModulusLength}`,
+      name: 'OperationError',
+    });
   }
 
   const kTests = [
diff --git a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
index 6d8a3fa3df9f..f25acd356e33 100644
--- a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
@@ -996,7 +996,8 @@ const keyLengthTargets = {
 function getSupportedAlgorithmOperations() {
   const algorithms = new Map();
   for (const operation of Object.keys(kSupportedAlgorithms)) {
-    if (operation === 'get key length')
+    if (operation === 'get key length' ||
+        operation === 'get shared key length')
       continue;
     for (const name of Object.keys(kSupportedAlgorithms[operation])) {
       if (!algorithms.has(name))
@@ -1029,6 +1030,7 @@ const operationOrder = [
 const coveredOperations = new Set([
   ...operationOrder,
   'get key length',
+  'get shared key length',
 ]);
 
 for (const operation of Object.keys(kSupportedAlgorithms)) {
@@ -1037,6 +1039,15 @@ for (const operation of Object.keys(kSupportedAlgorithms)) {
     `missing prototype pollution operation coverage for ${operation}`);
 }
 
+const sharedKeyLengthAlgorithms =
+  Object.keys(kSupportedAlgorithms['get shared key length'] ?? {});
+assert.deepStrictEqual(
+  sharedKeyLengthAlgorithms,
+  Object.keys(kSupportedAlgorithms.encapsulate ?? {}));
+assert.deepStrictEqual(
+  sharedKeyLengthAlgorithms,
+  Object.keys(kSupportedAlgorithms.decapsulate ?? {}));
+
 const supportedAlgorithms = getSupportedAlgorithmOperations();
 for (const [name, operations] of supportedAlgorithms) {
   const fixture = fixtures.get(name);
diff --git a/test/parallel/test-webcrypto-sign-verify-eddsa.js b/test/parallel/test-webcrypto-sign-verify-eddsa.js
index ad587a1220e0..e34a3d43d2a3 100644
--- a/test/parallel/test-webcrypto-sign-verify-eddsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-eddsa.js
@@ -152,14 +152,12 @@ async function testVerify({ name,
       message: /Key algorithm mismatch/
     });
 
-  if (name === 'Ed448' && supportsContext) {
+  if (name === 'Ed448') {
     // Test failure when too long context
     await assert.rejects(
-      subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), (err) => {
-        assert.strictEqual(err.name, 'OperationError');
-        assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-        assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-        return true;
+      subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), {
+        name: 'OperationError',
+        message: 'ContextParams.context must be at most 255 bytes',
       });
   }
 
@@ -278,14 +276,12 @@ async function testSign({ name,
       message: /Key algorithm mismatch/
     });
 
-  if (name === 'Ed448' && supportsContext) {
+  if (name === 'Ed448') {
     // Test failure when too long context
     await assert.rejects(
-      subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), (err) => {
-        assert.strictEqual(err.name, 'OperationError');
-        assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-        assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-        return true;
+      subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), {
+        name: 'OperationError',
+        message: 'ContextParams.context must be at most 255 bytes',
       });
   }
 }
diff --git a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
index 67c85f92e4e2..ba6eab08efb1 100644
--- a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
@@ -101,11 +101,9 @@ async function testVerify({ name,
 
   // Test failure when too long context
   await assert.rejects(
-    subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-      return true;
+    subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), {
+      name: 'OperationError',
+      message: 'ContextParams.context must be at most 255 bytes',
     });
 
   // Test failure when signature is altered
@@ -209,11 +207,9 @@ async function testSign({ name,
 
   // Test failure when too long context
   await assert.rejects(
-    subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-      return true;
+    subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), {
+      name: 'OperationError',
+      message: 'ContextParams.context must be at most 255 bytes',
     });
 }
 
diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
index 3e706941595d..62e9cbe7826a 100644
--- a/test/parallel/test-webcrypto-sign-verify-rsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
@@ -259,18 +259,6 @@ async function testSaltLength(keyLength, hash, hLen) {
       testFipsSignRejected(vector) : testSign(vector));
   });
 
-  if (fips3) {
-    variations.push(assert.rejects(
-      subtle.generateKey({
-        name: 'RSA-PSS',
-        modulusLength: 1024,
-        publicExponent: new Uint8Array([1, 0, 1]),
-        hash: 'SHA-256',
-      }, false, ['sign', 'verify']),
-      (err) => err.name === 'OperationError' &&
-               err.cause?.code === 'ERR_OSSL_RSA_INVALID_MODULUS'));
-  }
-
   for (const keyLength of fips3 ? [2048] : [1024, 2048]) {
     for (const [hash, hLen] of [
       ['SHA-1', 20],
diff --git a/test/parallel/test-webcrypto-supports.mjs b/test/parallel/test-webcrypto-supports.mjs
index 2bc9d589b478..6c3b2c640fd7 100644
--- a/test/parallel/test-webcrypto-supports.mjs
+++ b/test/parallel/test-webcrypto-supports.mjs
@@ -66,21 +66,45 @@ function supportsRawSecret(alg) {
   return false;
 }
 
-function supportsEncapsulatedRawSecret(alg) {
+function getSharedKeyLength(alg) {
+  switch (alg?.name?.toLowerCase?.() ?? alg?.toLowerCase?.()) {
+    case 'ml-kem-512':
+    case 'ml-kem-768':
+    case 'ml-kem-1024':
+      return 256;
+  }
+}
+
+function supportsEncapsulatedRawSecret(encapsulationAlgorithm, alg) {
   if (!supportsRawSecret(alg)) return false;
-  switch (alg?.name?.toLowerCase?.()) {
+
+  const sharedKeyLength = getSharedKeyLength(encapsulationAlgorithm);
+  const name = alg?.name?.toLowerCase?.() ?? alg?.toLowerCase?.();
+  if (name?.startsWith('aes')) {
+    return sharedKeyLength === 128 ||
+           sharedKeyLength === 192 ||
+           sharedKeyLength === 256;
+  }
+
+  switch (name) {
+    case 'chacha20-poly1305':
+      return sharedKeyLength === 256;
     case 'hmac':
+      if (sharedKeyLength === 0) return false;
+      // Fall through
     case 'kmac128':
     case 'kmac256':
-      return typeof alg.length !== 'number' || Math.ceil(alg.length / 8) === 32;
+      return typeof alg !== 'object' ||
+             typeof alg.length !== 'number' ||
+             Math.ceil(alg.length / 8) * 8 === sharedKeyLength;
     default:
-      return true;
+      return sharedKeyLength !== undefined;
   }
 }
 
 for (const encap of vectors.encapsulateBits) {
   for (const imp of vectors.importKey) {
-    if (supportsEncapsulatedRawSecret(imp[1])) {
+    if (supportsEncapsulatedRawSecret(encap[1], imp[1])) {
       vectors.encapsulateKey.push([encap[0] && imp[0], encap[1], imp[1]]);
     } else {
       vectors.encapsulateKey.push([false, encap[1], imp[1]]);
@@ -90,7 +114,7 @@ for (const encap of vectors.encapsulateBits) {
 
 for (const decap of vectors.decapsulateBits) {
   for (const imp of vectors.importKey) {
-    if (supportsEncapsulatedRawSecret(imp[1])) {
+    if (supportsEncapsulatedRawSecret(decap[1], imp[1])) {
       vectors.decapsulateKey.push([decap[0] && imp[0], decap[1], imp[1]]);
     } else {
       vectors.decapsulateKey.push([false, decap[1], imp[1]]);
diff --git a/test/parallel/test-webcrypto-util.js b/test/parallel/test-webcrypto-util.js
index 9763acfb71e0..c0c565a15f3d 100644
--- a/test/parallel/test-webcrypto-util.js
+++ b/test/parallel/test-webcrypto-util.js
@@ -27,8 +27,14 @@ const {
     bigIntArrayToUnsignedInt(new Uint8Array([1, 0, 1])),
     65537);
   assert.strictEqual(
-    bigIntArrayToUnsignedInt(new Uint8Array([1, 0, 0, 0, 0])),
-    undefined);
+    bigIntArrayToUnsignedInt(new Uint8Array([0, 0, 1, 0, 1])),
+    65537);
+  assert.throws(
+    () => bigIntArrayToUnsignedInt(new Uint8Array([1, 0, 0, 0, 0])),
+    {
+      name: 'OperationError',
+      message: 'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+    });
 }
 
 {

From 6bffc306aa269fd15ef59677a8180ccd636e37a7 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Thu, 13 Aug 2026 17:54:37 -0400
Subject: [PATCH 165/344] meta: move one or more collaborators to emeritus

PR-URL: https://github.com/nodejs/node/pull/65182
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index a6cf7d6683fa..e27d95f26f1f 100644
--- a/README.md
+++ b/README.md
@@ -323,8 +323,6 @@ For information about the governance of the Node.js project, see
   **Erick Wendel** <<erick.workspace@gmail.com>> (he/him)
 * [Ethan-Arrowood](https://github.com/Ethan-Arrowood) -
   **Ethan Arrowood** <<ethan@arrowood.dev>> (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-  **Franziska Hinkelmann** <<franziska.hinkelmann@gmail.com>> (she/her)
 * [Flarna](https://github.com/Flarna) -
   **Gerhard Stöbich** <<deb2001-github@yahoo.de>> (he/they)
 * [gabrielschulhof](https://github.com/gabrielschulhof) -
@@ -525,6 +523,8 @@ For information about the governance of the Node.js project, see
   **Evan Lucas** <<evanlucas@me.com>> (he/him)
 * [F3n67u](https://github.com/F3n67u) -
   **Feng Yu** <<F3n67u@outlook.com>> (he/him)
+* [fhinkel](https://github.com/fhinkel) -
+  **Franziska Hinkelmann** <<franziska.hinkelmann@gmail.com>> (she/her)
 * [firedfox](https://github.com/firedfox) -
   **Daniel Wang** <<wangyang0123@gmail.com>>
 * [Fishrock123](https://github.com/Fishrock123) -

From ebbe4af8698830cf261407894dd40cf9de7cbdb9 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 14 Aug 2026 01:11:32 +0200
Subject: [PATCH 166/344] tools: fix linter when `permittedInsecurePackages` is
 empty

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65226
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 tools/dep_updaters/update-nixpkgs-pin.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh
index cd95bb811a9d..48dfa8270d6d 100755
--- a/tools/dep_updaters/update-nixpkgs-pin.sh
+++ b/tools/dep_updaters/update-nixpkgs-pin.sh
@@ -65,7 +65,7 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
   }
 " | jq -r '"{
   pkgs ? import ./pkgs.nix {
-    config.permittedInsecurePackages = [ \(.permittedInsecurePackages | map(@json) | join(" ")) ];
+    config.permittedInsecurePackages = [ \(.permittedInsecurePackages | if length > 0 then "\(map(@json) | join(" ")) " else "" end)];
   },
 }:
 

From eb095a94bdf49053a77baa55bf383b96ba264404 Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Fri, 14 Aug 2026 09:41:51 +0900
Subject: [PATCH 167/344] typings: add internal_only_v8 binding typeis

Add an InternalOnlyV8Binding declaration for
internalBinding('internal_only_v8') and wire it into
InternalBindingMap.

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65071
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 typings/globals.d.ts                          | 2 ++
 typings/internalBinding/internal_only_v8.d.ts | 3 +++
 2 files changed, 5 insertions(+)
 create mode 100644 typings/internalBinding/internal_only_v8.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index 536a8c4c2822..b294042d790b 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -15,6 +15,7 @@ import { HeapUtilsBinding } from './internalBinding/heap_utils';
 import { HttpParserBinding } from './internalBinding/http_parser';
 import { ICUBinding } from './internalBinding/icu';
 import { InspectorBinding } from './internalBinding/inspector';
+import { InternalOnlyV8Binding } from './internalBinding/internal_only_v8';
 import { IPCSerdesBinding } from './internalBinding/ipc_serdes';
 import { LocksBinding } from './internalBinding/locks';
 import { MessagingBinding } from './internalBinding/messaging';
@@ -55,6 +56,7 @@ interface InternalBindingMap {
   http_parser: HttpParserBinding;
   icu: ICUBinding;
   inspector: InspectorBinding;
+  internal_only_v8: InternalOnlyV8Binding;
   ipc_serdes: IPCSerdesBinding;
   locks: LocksBinding;
   messaging: MessagingBinding;
diff --git a/typings/internalBinding/internal_only_v8.d.ts b/typings/internalBinding/internal_only_v8.d.ts
new file mode 100644
index 000000000000..3f1108e38dbf
--- /dev/null
+++ b/typings/internalBinding/internal_only_v8.d.ts
@@ -0,0 +1,3 @@
+export interface InternalOnlyV8Binding {
+  queryObjects(prototype: unknown): object[];
+}

From 9b4f349b011c96e268e20dbe2339207e3a3d8b41 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:54:41 -0700
Subject: [PATCH 168/344] ffi: refresh cached string buffers on every call

Native code can mutate temporary string storage during an FFI call.
Rewrite cached buffers on every conversion so a later call with the
same JavaScript string receives a fresh copy of its UTF-8 bytes.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65051
Fixes: https://github.com/nodejs/node/issues/65050
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/ffi/fast-api.js                |  5 -----
 test/ffi/fixture_library/ffi_test_library.c |  5 +++++
 test/ffi/test-ffi-fast-buffer.js            | 18 ++++++++++++++++++
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/lib/internal/ffi/fast-api.js b/lib/internal/ffi/fast-api.js
index 4d46b9c7a8bb..b93d061b00cd 100644
--- a/lib/internal/ffi/fast-api.js
+++ b/lib/internal/ffi/fast-api.js
@@ -148,9 +148,6 @@ function getStringConversionPointer(state, value, index) {
   const size = value.length * 3 + 1;
   const buffers = state.buffers[state.depth - 1];
   let entry = buffers[index];
-  if (entry !== undefined && entry.string === value) {
-    return entry.pointer;
-  }
   if (StringPrototypeIncludes(value, '\0')) {
     throwFFIArgError(`Argument ${index} must not contain null bytes`);
   }
@@ -160,7 +157,6 @@ function getStringConversionPointer(state, value, index) {
       __proto__: null,
       buffer,
       pointer: getRawPointer(buffer),
-      string: undefined,
     };
     buffers[index] = entry;
   }
@@ -168,7 +164,6 @@ function getStringConversionPointer(state, value, index) {
   const buffer = entry.buffer;
   const written = buffer.write(value, 0, size - 1, 'utf8');
   buffer[written] = 0;
-  entry.string = value;
   return entry.pointer;
 }
 
diff --git a/test/ffi/fixture_library/ffi_test_library.c b/test/ffi/fixture_library/ffi_test_library.c
index 10d2ed9f66c9..71c54a49fefe 100644
--- a/test/ffi/fixture_library/ffi_test_library.c
+++ b/test/ffi/fixture_library/ffi_test_library.c
@@ -108,6 +108,11 @@ FFI_EXPORT uint8_t string_equals_hello(const char* str) {
   return str && strcmp(str, "hello") == 0;
 }
 
+FFI_EXPORT uint8_t overwrite_string(char* str, int32_t value, uint64_t length) {
+  memset(str, value, (size_t)length);
+  return (uint8_t)str[0];
+}
+
 FFI_EXPORT char* string_concat(const char* a, const char* b) {
   if (!a || !b) {
     // NOLINTNEXTLINE (readability/null_usage)
diff --git a/test/ffi/test-ffi-fast-buffer.js b/test/ffi/test-ffi-fast-buffer.js
index a6b196efc014..173ee29a32f1 100644
--- a/test/ffi/test-ffi-fast-buffer.js
+++ b/test/ffi/test-ffi-fast-buffer.js
@@ -96,6 +96,24 @@ test('fast FFI string buffers survive reentrant callbacks', {
   }
 });
 
+test('fast FFI refreshes cached temporary string buffers', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+  const overwriteString = lib.getFunction('overwrite_string', {
+    arguments: ['string', 'i32', 'u64'],
+    return: 'u8',
+  });
+
+  try {
+    const mutated = overwriteString('hello', 0x79, 1n);
+    assert.strictEqual(mutated, 0x79);
+
+    const refreshed = overwriteString('hello', 0x79, 0n);
+    assert.strictEqual(refreshed, 0x68);
+  } finally {
+    lib.close();
+  }
+});
+
 test('optimized buffer signatures preserve pointer-like conversions', () => {
   const lib = new ffi.DynamicLibrary(libraryPath);
   const asPointer = lib.getFunction('pointer_to_usize', {

From 31742f2f4265fb71fce6c7b95b107f5055d19266 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Tue, 4 Aug 2026 14:19:48 +0200
Subject: [PATCH 169/344] test: cover ZIP header-confusion and DoS guards

Add regression tests for node:zlib ZIP hardening:

- A local file header that disagrees with the central directory on
  compression method, sizes, CRC, or the encryption flag lets another
  ZIP reader extract a different member from the same archive; such an
  archive must be rejected (fixed in a follow-up commit).
- zipFiles() must reject a FIFO/special source rather than block forever
  on open() (fixed in a follow-up commit).
- Streaming (contentIterator) is hard-bounded by the header's declared
  uncompressed size and rejects a member that inflates past it, so
  entry.size is a ceiling a consumer can trust up front; lock that in.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65016
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 .../test-zlib-zip-security-hardening.js       | 120 ++++++++++++++++++
 1 file changed, 120 insertions(+)
 create mode 100644 test/parallel/test-zlib-zip-security-hardening.js

diff --git a/test/parallel/test-zlib-zip-security-hardening.js b/test/parallel/test-zlib-zip-security-hardening.js
new file mode 100644
index 000000000000..97d5105a616f
--- /dev/null
+++ b/test/parallel/test-zlib-zip-security-hardening.js
@@ -0,0 +1,120 @@
+'use strict';
+
+// Security-hardening regression tests for node:zlib ZIP support. Each test
+// describes a distinct issue found by audit and asserts the *secure* behavior,
+// so every test fails on the pre-fix code and passes once its fix lands.
+//
+//  1. Local-vs-central header confusion (parser-confusion / inspect-then-consume
+//     divergence): the central directory is authoritative in this reader, but a
+//     local file header that disagrees on method, sizes, CRC, or the encryption
+//     flag lets another ZIP tool (which extracts from the local header) read a
+//     different member from the same archive. Such an archive must be rejected.
+//  2. The archiver (zipFiles) must not block forever on a FIFO/special source.
+//  3. The streaming read path (contentIterator) is hard-bounded by the header's
+//     declared uncompressed size: a member that inflates past it is rejected
+//     mid-stream, so entry.size is a ceiling a consumer can trust up front.
+
+require('../common');
+const assert = require('assert');
+const { test } = require('node:test');
+const zlib = require('zlib');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+
+const SIG_LOCAL = 0x04034b50;
+const SIG_CENTRAL = 0x02014b50;
+
+// A minimal single-member archive; caller patches its headers.
+function buildStored(name, content, method = 'store') {
+  const entry = zlib.ZipEntry.createSync(name, Buffer.from(content), { method });
+  const chunks = [];
+  for (const chunk of zlib.createZipArchiveSync([entry])) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+function centralOffset(buf) {
+  for (let i = buf.length - 22; i >= 0; i--) {
+    if (buf.readUInt32LE(i) === SIG_CENTRAL) return i;
+  }
+  throw new Error('no central directory header found');
+}
+
+// A ZipBuffer parses the central directory; reading a member resolves and
+// checks its local header. Do both so the assertion holds whether the check
+// is eager (parse time) or lazy (read time).
+function readsThrow(buf, name) {
+  assert.throws(() => {
+    const zb = new zlib.ZipBuffer(buf);
+    zb.get(name).contentSync();
+  }, { code: 'ERR_ZIP_INVALID_ARCHIVE' });
+}
+
+// 1a. Local vs central compressed/uncompressed size disagreement.
+test('a local/central size disagreement is rejected', () => {
+  const buf = buildStored('a.txt', 'hello');
+  assert.strictEqual(buf.readUInt32LE(0), SIG_LOCAL);
+  buf.writeUInt32LE(999, 18); // Local compressed size
+  buf.writeUInt32LE(999, 22); // Local uncompressed size
+  readsThrow(buf, 'a.txt');
+});
+
+// 1b. Local vs central compression-method disagreement.
+test('a local/central method disagreement is rejected', () => {
+  const buf = buildStored('a.txt', 'hello');
+  buf.writeUInt16LE(8, 8); // Local method deflate; central stays store(0)
+  readsThrow(buf, 'a.txt');
+});
+
+// 1c. Central marks the member encrypted while the local header does not:
+// a central-directory reader (e.g. python) treats it as opaque/encrypted, so
+// Node must not silently decode it either.
+test('a local/central encryption-flag disagreement is rejected', () => {
+  const buf = buildStored('a.txt', 'hello');
+  const c = centralOffset(buf);
+  buf.writeUInt16LE(buf.readUInt16LE(c + 8) | 0x0001, c + 8); // Central encrypted bit
+  readsThrow(buf, 'a.txt');
+});
+
+// 2. zipFiles must reject a FIFO source rather than block on open() forever.
+test('zipFiles rejects a FIFO source instead of hanging', () => {
+  if (process.platform === 'win32') return; // no mkfifo
+  tmpdir.refresh();
+  const fifo = path.join(tmpdir.path, 'evil.fifo');
+  if (spawnSync('mkfifo', [fifo]).status !== 0) return; // mkfifo unavailable
+  const script =
+    'const zlib = require("zlib");' +
+    '(async () => {' +
+    '  try {' +
+    `    for await (const _ of zlib.zipFiles([[${JSON.stringify(fifo)}, "x"]], ` +
+    '      { followSymlinks: false })) {}' +
+    '    console.log("COMPLETED");' +
+    '  } catch (e) { console.log("REJECTED:" + e.code); }' +
+    '})();';
+  const res = spawnSync(process.execPath, ['--no-warnings', '-e', script],
+                        { timeout: 5000, encoding: 'utf8' });
+  assert.ok(res.signal === null,
+            'zipFiles hung on a FIFO source (killed by timeout)');
+  assert.match(res.stdout, /REJECTED:ERR_ZIP_UNSUPPORTED_FEATURE/);
+});
+
+// 3. Streaming is hard-bounded by the declared uncompressed size: a member
+// whose data inflates past it is rejected mid-stream, so a consumer can trust
+// entry.size as the ceiling before choosing to buffer.
+test('contentIterator rejects a member that inflates past its declared size', async () => {
+  const big = zlib.ZipEntry.createSync(
+    'big', Buffer.alloc(64 * 1024), { method: 'deflate' });
+  const chunks = [];
+  for (const chunk of zlib.createZipArchiveSync([big])) chunks.push(chunk);
+  const buf = Buffer.concat(chunks);
+  // Shrink the declared uncompressed size in both headers (kept consistent so
+  // the header cross-check passes) below what the data actually inflates to.
+  const c = centralOffset(buf);
+  buf.writeUInt32LE(100, 22); // Local uncompressed size
+  buf.writeUInt32LE(100, c + 24); // Central uncompressed size
+  const entry = new zlib.ZipBuffer(buf).get('big');
+  await assert.rejects(async () => {
+    // eslint-disable-next-line no-unused-vars
+    for await (const _ of entry.contentIterator()) { /* drain */ }
+  }, { code: 'ERR_ZIP_ENTRY_CORRUPT', message: /inflates beyond its declared size/ });
+});

From 55b04957c9e639688db55c1f733442a283af47b1 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Tue, 4 Aug 2026 15:28:11 +0200
Subject: [PATCH 170/344] zlib: reject local/central ZIP header mismatch

The reader treats the central directory as authoritative for a member's
method, sizes, CRC, and name, but read the local header only for its
signature. An archive whose local file header disagrees with the
central directory therefore extracts different bytes here than in a
reader that uses the local header (e.g. Info-ZIP unzip), and its
encrypted bit was read from the local header while its identity came
from the central directory - a parser-confusion split that defeats
inspect-then-consume pipelines and can slip an encrypted member past a
central-directory scanner.

Cross-check the local header against the central entry when a member is
read: method, CRC, and both sizes (exempting a data-descriptor entry,
whose local crc/sizes are legitimately zero), plus the encryption flag.
Reject a mismatch with ERR_ZIP_INVALID_ARCHIVE, consistent with the
reject-rather-than-silently-choose stance already taken for ambiguous
archive ends.

The existing hardening/coverage tests that forged a decode-time size,
CRC, or Zip64 lie in the central header alone now trip this earlier
check; update them to patch both headers consistently so they still
exercise the decode-time guards they target.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65016
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/zip/entry.js                |  8 ++++
 lib/internal/zip/headers.js              | 61 ++++++++++++++++++++++--
 test/parallel/test-zlib-zip-coverage.js  | 20 ++++----
 test/parallel/test-zlib-zip-hardening.js | 24 ++++++----
 4 files changed, 92 insertions(+), 21 deletions(-)

diff --git a/lib/internal/zip/entry.js b/lib/internal/zip/entry.js
index c9fb1cac62cd..4921cc8ab9ce 100644
--- a/lib/internal/zip/entry.js
+++ b/lib/internal/zip/entry.js
@@ -76,6 +76,7 @@ const {
 const {
   CentralFileHeader,
   LocalFileHeader,
+  assertConsistentLocalHeader,
   findArchiveEnd,
 } = require('internal/zip/headers');
 const {
@@ -399,6 +400,9 @@ class ZipEntry {
       await readFdFully(fd, full.subarray(30), this.#localOffset + 30);
     }
     this.#local = new LocalFileHeader(full, 0);
+    if (this.#central !== null) {
+      assertConsistentLocalHeader(this.#local, this.#central);
+    }
     this.#contentOffset = this.#localOffset + length;
     return this.#local;
   }
@@ -419,6 +423,9 @@ class ZipEntry {
       readFdFullySync(fd, full.subarray(30), this.#localOffset + 30);
     }
     this.#local = new LocalFileHeader(full, 0);
+    if (this.#central !== null) {
+      assertConsistentLocalHeader(this.#local, this.#central);
+    }
     this.#contentOffset = this.#localOffset + length;
     return this.#local;
   }
@@ -930,6 +937,7 @@ function* readArchiveEntries(buf, end) {
     }
     const localOffset = central.localFileHeaderOffset + end.prefix;
     const local = new LocalFileHeader(buf, localOffset);
+    assertConsistentLocalHeader(local, central);
     const dataStart = localOffset + local.byteLength;
     const length = central.compressedSize;
     validateArchiveRange(buf, dataStart, length, 'entry data');
diff --git a/lib/internal/zip/headers.js b/lib/internal/zip/headers.js
index f1f028cb511b..bf6f7901516a 100644
--- a/lib/internal/zip/headers.js
+++ b/lib/internal/zip/headers.js
@@ -25,6 +25,8 @@ const {
   SIG_ZIP64_EOCD_LOCATOR,
   SIG_EOCD,
   MADE_BY_UNIX,
+  FLAG_ENCRYPTED,
+  FLAG_DATA_DESCRIPTOR,
   SENTINEL16,
   SENTINEL32,
   TAIL_LENGTH,
@@ -267,6 +269,7 @@ class CentralFileHeader {
 class LocalFileHeader {
   #buffer;
   #offset;
+  #zip64 = null;
   constructor(buffer, offset = 0) {
     validateArchiveRange(buffer, offset, 30, 'local file header');
     if (buffer.readUInt32LE(offset) !== SIG_LOCAL_FILE_HEADER) {
@@ -280,9 +283,31 @@ class LocalFileHeader {
   }
   get byteLength() { return 30 + this.fileNameLength + this.extraFieldLength; }
   get flags() { return this.#buffer.readUInt16LE(this.#offset + 6); }
-  // Spec field (sec. 4.4.5); the central directory's method is authoritative,
-  // so the local copy is not consumed today.
-  // get compressionMethod() { return this.#buffer.readUInt16LE(this.#offset + 8); }
+  // The central directory is authoritative, but these local fields are read to
+  // reject an archive whose local header contradicts it (assertConsistentLocalHeader).
+  get compressionMethod() { return this.#buffer.readUInt16LE(this.#offset + 8); }
+  get crc32() { return this.#buffer.readUInt32LE(this.#offset + 14); }
+  // The Zip64 extra supplies the true 64-bit sizes for whichever classic size
+  // field holds an overflow sentinel; a local header has no offset/disk field.
+  #resolveZip64() {
+    if (this.#zip64 === null) {
+      this.#zip64 = parseZip64Extra(this.extraField, {
+        uncompressedSize: this.#buffer.readUInt32LE(this.#offset + 22) === SENTINEL32,
+        compressedSize: this.#buffer.readUInt32LE(this.#offset + 18) === SENTINEL32,
+        localFileHeaderOffset: false,
+        diskNumber: false,
+      });
+    }
+    return this.#zip64;
+  }
+  get compressedSize() {
+    const value = this.#buffer.readUInt32LE(this.#offset + 18);
+    return value === SENTINEL32 ? this.#resolveZip64().compressedSize : value;
+  }
+  get uncompressedSize() {
+    const value = this.#buffer.readUInt32LE(this.#offset + 22);
+    return value === SENTINEL32 ? this.#resolveZip64().uncompressedSize : value;
+  }
   get fileNameLength() { return this.#buffer.readUInt16LE(this.#offset + 26); }
   get extraFieldLength() { return this.#buffer.readUInt16LE(this.#offset + 28); }
   get extraField() {
@@ -311,6 +336,35 @@ class LocalFileHeader {
   }
 }
 
+// Reject an archive whose local file header contradicts the central directory
+// on a field that decides which bytes a member yields. This reader treats the
+// central directory as authoritative, but a divergent local header lets a
+// local-header-based extractor (Info-ZIP unzip, and others) read a different
+// member, method, or size from the same archive - a parser-confusion split that
+// defeats inspect-then-consume pipelines. Reject rather than silently diverge.
+function assertConsistentLocalHeader(local, central) {
+  if (local.compressionMethod !== central.compressionMethod) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(
+      'local and central compression methods disagree');
+  }
+  if ((local.flags & FLAG_ENCRYPTED) !== (central.flags & FLAG_ENCRYPTED)) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(
+      'local and central encryption flags disagree');
+  }
+  // A streamed entry (data-descriptor bit) writes zero crc and sizes in the
+  // local header, deferring the true values to the central directory; only then
+  // is a difference on those three fields expected.
+  const deferred = (local.flags & FLAG_DATA_DESCRIPTOR) !== 0 &&
+    local.crc32 === 0 && local.compressedSize === 0 && local.uncompressedSize === 0;
+  if (!deferred &&
+      (local.crc32 !== central.crc32 ||
+       local.compressedSize !== central.compressedSize ||
+       local.uncompressedSize !== central.uncompressedSize)) {
+    throw new ERR_ZIP_INVALID_ARCHIVE(
+      'local and central header crc-32 or sizes disagree');
+  }
+}
+
 // Returns whether an EOCD-looking record could describe an archive this
 // implementation supports. This is deliberately only a cheap preflight: the
 // selected record still receives the complete Zip64 and central-directory
@@ -563,6 +617,7 @@ function readCentralDirectory(buffer, count) {
 module.exports = {
   CentralFileHeader,
   LocalFileHeader,
+  assertConsistentLocalHeader,
   findArchiveEnd,
   readCentralDirectory,
 };
diff --git a/test/parallel/test-zlib-zip-coverage.js b/test/parallel/test-zlib-zip-coverage.js
index 437630df95cd..74cdab3b431b 100644
--- a/test/parallel/test-zlib-zip-coverage.js
+++ b/test/parallel/test-zlib-zip-coverage.js
@@ -288,8 +288,9 @@ test('a Zip64 extra field value beyond Number.MAX_SAFE_INTEGER is rejected', asy
     uncompressedSize: 0xffffffffffffffffn,
   });
 
-  const [read] = zlib.ZipEntry.read(patched);
-  assert.throws(() => read.size, {
+  // The header cross-check resolves the sizes as the archive is read, so a
+  // malformed Zip64 value is rejected at read time rather than at .size access.
+  assert.throws(() => [...zlib.ZipEntry.read(patched)], {
     code: 'ERR_ZIP_INVALID_ARCHIVE',
     message: /exceeds the safe integer range/,
   });
@@ -325,8 +326,7 @@ test('a Zip64 extra-field TLV whose declared size overflows the extra field is r
   tlv.writeUInt16LE(100, 2); // claims 100 bytes of data, but none follow
   const patched = injectRawZip64Extra(archive, name, content.length, tlv);
 
-  const [read] = zlib.ZipEntry.read(patched);
-  assert.throws(() => read.size, {
+  assert.throws(() => [...zlib.ZipEntry.read(patched)], {
     code: 'ERR_ZIP_INVALID_ARCHIVE',
     message: /extra field is malformed/,
   });
@@ -345,8 +345,7 @@ test('a Zip64 extra-field TLV too short for the field it claims to carry is reje
   tlv.writeUInt32LE(123, 4);
   const patched = injectRawZip64Extra(archive, name, content.length, tlv);
 
-  const [read] = zlib.ZipEntry.read(patched);
-  assert.throws(() => read.size, {
+  assert.throws(() => [...zlib.ZipEntry.read(patched)], {
     code: 'ERR_ZIP_INVALID_ARCHIVE',
     message: /Zip64 extended information extra field is truncated/,
   });
@@ -500,7 +499,8 @@ test('contentIterator() enforces the same guards as content() and contentSync()'
     const archive = await buildArchive([entry]);
     const tampered = Buffer.from(archive);
     const centralStart = 30 + 'f.txt'.length + 'hello world'.length;
-    tampered.writeUInt32LE(1, centralStart + 24);
+    tampered.writeUInt32LE(1, 22); // Local uncompressed size
+    tampered.writeUInt32LE(1, centralStart + 24); // Central uncompressed size
     const [read] = zlib.ZipEntry.read(tampered);
     await assert.rejects(drain(read.contentIterator()), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
   }
@@ -593,7 +593,8 @@ test('ZipFile getSync().contentSync() enforces the same guards via decodeMemberS
     const archive = await buildArchive([entry]);
     const tampered = Buffer.from(archive);
     const centralStart = 30 + 'f.txt'.length + 'hello world'.length;
-    tampered.writeUInt32LE(1, centralStart + 24);
+    tampered.writeUInt32LE(1, 22); // Local uncompressed size
+    tampered.writeUInt32LE(1, centralStart + 24); // Central uncompressed size
     const filePath = await writeTempArchive(tampered, 'size-mismatch');
     const zf = zlib.ZipFile.openSync(filePath);
     assert.throws(() => zf.getSync('f.txt').contentSync(), { code: 'ERR_ZIP_ENTRY_CORRUPT' });
@@ -607,7 +608,8 @@ test('contentIterator() rejects an entry that inflates to less than its declared
   const archive = await buildArchive([entry]);
   const tampered = Buffer.from(archive);
   const centralStart = 30 + 'f.txt'.length + 'hi'.length;
-  tampered.writeUInt32LE(1000, centralStart + 24); // Declared size grown beyond reality
+  tampered.writeUInt32LE(1000, 22); // Local declared size
+  tampered.writeUInt32LE(1000, centralStart + 24); // Central declared size grown beyond reality
   const [read] = zlib.ZipEntry.read(tampered);
   await assert.rejects(drain(read.contentIterator()), {
     code: 'ERR_ZIP_ENTRY_CORRUPT',
diff --git a/test/parallel/test-zlib-zip-hardening.js b/test/parallel/test-zlib-zip-hardening.js
index 9427a546c889..3ec0b015a238 100644
--- a/test/parallel/test-zlib-zip-hardening.js
+++ b/test/parallel/test-zlib-zip-hardening.js
@@ -118,13 +118,14 @@ test('a declared-size mismatch is rejected as corrupt', async () => {
   const entry = await zlib.ZipEntry.create('f.txt', Buffer.from('hello world'), { method: 'store' });
   const archive = await buildArchive([entry]);
 
-  // Shrink the *declared* uncompressed size in the central directory record
-  // without touching the stored bytes themselves, so the amount of data
-  // produced no longer matches what the header promised.
+  // Shrink the *declared* uncompressed size in both the local and central
+  // headers (kept consistent so the header cross-check passes) without touching
+  // the stored bytes, so the produced amount no longer matches the headers'
+  // promise and the decode-time size check fires.
   const tampered = Buffer.from(archive);
   const centralHeaderStart = 30 + 'f.txt'.length + 'hello world'.length;
-  const uncompressedSizeOffset = centralHeaderStart + 24;
-  tampered.writeUInt32LE(1, uncompressedSizeOffset);
+  tampered.writeUInt32LE(1, 22); // Local uncompressed size
+  tampered.writeUInt32LE(1, centralHeaderStart + 24); // Central uncompressed size
 
   const [tamperedEntry] = zlib.ZipEntry.read(tampered);
   assert.strictEqual(tamperedEntry.size, 1);
@@ -165,7 +166,10 @@ test('a forged small header whose content inflates past its declared size is rej
     const tampered = Buffer.from(archive);
     const eocd = tampered.length - 22; // No comment, so EOCD is the last 22 bytes
     const cdOffset = tampered.readUInt32LE(eocd + 16);
-    tampered.writeUInt32LE(50, cdOffset + 24); // Forge declared uncompressedSize
+    // Forge the declared uncompressedSize in both headers (kept consistent so
+    // the header cross-check passes; the decompressor still catches the lie).
+    tampered.writeUInt32LE(50, 22); // Local uncompressedSize
+    tampered.writeUInt32LE(50, cdOffset + 24); // Central uncompressedSize
 
     const [e] = zlib.ZipEntry.read(tampered);
     assert.strictEqual(e.size, 50); // 50 <= maxSize 100 clears the up-front check
@@ -413,9 +417,11 @@ test('a member whose data crosses into the central directory is rejected', async
   const archive = Buffer.from(await buildArchive(
     [await zlib.ZipEntry.create(name, content, { method: 'store' })]));
   const centralHeaderStart = 30 + name.length + content.length;
-  // Lie about the compressed size so the member's data range reaches into
-  // the central directory (while staying inside the buffer).
-  archive.writeUInt32LE(content.length + 40, centralHeaderStart + 20);
+  // Lie about the compressed size in both headers (kept consistent so the
+  // header cross-check passes) so the member's data range reaches into the
+  // central directory (while staying inside the buffer).
+  archive.writeUInt32LE(content.length + 40, 18); // Local compressed size
+  archive.writeUInt32LE(content.length + 40, centralHeaderStart + 20); // Central
   assert.throws(() => [...zlib.ZipEntry.read(archive)],
                 { code: 'ERR_ZIP_INVALID_ARCHIVE', message: /possible zip bomb/ });
 });

From 2bda6db916aaf2598c62c969f92b9d9a1e2547d1 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Tue, 4 Aug 2026 15:30:43 +0200
Subject: [PATCH 171/344] zlib: do not hang archiving a FIFO or device

zipFiles() opened each source before fstat-ing it, so open() on a FIFO
(or a slow/blocking device) blocked indefinitely - the regular-file
guard ran too late to prevent it, and each stuck open pinned a libuv
threadpool thread. Open with O_NONBLOCK so the open returns promptly and
the fstat can reject anything that is not a regular file; O_NONBLOCK has
no effect on a regular file's subsequent reads.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65016
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/zip/archive.js | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/lib/internal/zip/archive.js b/lib/internal/zip/archive.js
index 7693ce1297f2..b2aef250d5ad 100644
--- a/lib/internal/zip/archive.js
+++ b/lib/internal/zip/archive.js
@@ -133,12 +133,15 @@ async function* fileEntries(files, followSymlinks) {
       // would let a symlink swapped in after the classification above redirect
       // the read - a TOCTOU that defeats followSymlinks:false. O_NOFOLLOW makes
       // a final-component symlink fail the open outright when not following;
-      // the fstat then confirms a regular file, never a FIFO, device, or
-      // socket (which as a stream source could block or emit unbounded data).
+      // O_NONBLOCK keeps the open itself from blocking on a FIFO or a slow
+      // device (it has no effect on a regular file's reads), so the fstat can
+      // then reject anything that is not a regular file - a FIFO, device, or
+      // socket, which as a stream source could block or emit unbounded data.
       // Metadata comes from that same fstat so it describes the inode we read.
-      const flags = followSymlinks ?
+      const flags = (followSymlinks ?
         fs.constants.O_RDONLY :
-        fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
+        fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0)) |
+        (fs.constants.O_NONBLOCK || 0);
       const handle = await fs.promises.open(sourcePath, flags);
       let ownsHandle = true;
       try {

From 00b687bc4a83ebb497241637a752bead129853b6 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Tue, 4 Aug 2026 15:44:03 +0200
Subject: [PATCH 172/344] test: cover ZIP fd lifecycle and add rollback

Add regression tests for two node:zlib ZipFile robustness issues:

- A read in flight when close() is called must complete on a live
  descriptor; close() must not release the fd out from under it (which
  surfaces as EBADF, or an OS-reused-fd cross-file read).
- If the central-directory rewrite fails after add() has written the
  member bytes, both the in-memory state and the on-disk archive must be
  rolled back, not left half-updated.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65016
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 test/parallel/test-zlib-zip-file-lifecycle.js | 92 +++++++++++++++++++
 1 file changed, 92 insertions(+)
 create mode 100644 test/parallel/test-zlib-zip-file-lifecycle.js

diff --git a/test/parallel/test-zlib-zip-file-lifecycle.js b/test/parallel/test-zlib-zip-file-lifecycle.js
new file mode 100644
index 000000000000..85a06f86b75e
--- /dev/null
+++ b/test/parallel/test-zlib-zip-file-lifecycle.js
@@ -0,0 +1,92 @@
+'use strict';
+
+// Lifecycle-hardening regression tests for node:zlib ZipFile (the on-disk,
+// fd-backed reader/writer). Each asserts the secure behavior, so it fails on
+// the pre-fix code and passes once its fix lands.
+//
+//  1. A read in flight when close() is called must complete on a live
+//     descriptor - close() must not pull the fd out from under it (which would
+//     surface as EBADF, or worse read another file once the fd number is
+//     reused).
+//  2. If the central-directory rewrite fails after an add() has written the
+//     member bytes, the in-memory state and the on-disk archive must be rolled
+//     back to exactly what they were before the call, not left half-updated.
+
+require('../common');
+const assert = require('assert');
+const { test } = require('node:test');
+const zlib = require('zlib');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+
+const SIG_CENTRAL = 0x02014b50;
+const SIG_EOCD = 0x06054b50;
+
+function writeArchive(file, entries) {
+  const chunks = [];
+  for (const chunk of zlib.createZipArchiveSync(entries)) chunks.push(chunk);
+  fs.writeFileSync(file, Buffer.concat(chunks));
+}
+
+// 1. A read that is in flight when the ZipFile is closed still completes.
+test('close() waits for an in-flight read instead of closing under it', async () => {
+  tmpdir.refresh();
+  const file = tmpdir.resolve('inflight.zip');
+  const payload = Buffer.alloc(8 * 1024 * 1024, 0x5a);
+  writeArchive(file, [zlib.ZipEntry.createSync('big', payload, { method: 'store' })]);
+
+  const zf = zlib.ZipFile.openSync(file);
+  const entry = zf.getSync('big');
+  const reading = entry.content(); // In flight; do not await yet
+  await zf.close(); // Must wait for the read, not close the fd under it
+  const data = await reading; // Must resolve with correct bytes, not reject EBADF
+  assert.strictEqual(data.length, payload.length);
+  assert.ok(data.equals(payload));
+});
+
+// 2. A failed central-directory rewrite during add() is rolled back.
+test('a failed directory rewrite during addEntrySync is rolled back', () => {
+  tmpdir.refresh();
+  const file = tmpdir.resolve('addfail.zip');
+  writeArchive(file, [zlib.ZipEntry.createSync('first.txt', Buffer.from('original'),
+                                               { method: 'store' })]);
+
+  const zf = zlib.ZipFile.openSync(file, { writable: true });
+  const toAdd = zlib.ZipEntry.createSync('second.txt', Buffer.from('added'), { method: 'store' });
+
+  // Fail only the first central-directory write (its buffer starts with the
+  // central-header or EOCD signature); the member bytes start with the local
+  // header signature and pass through, and the rollback rewrite that follows
+  // succeeds so the on-disk archive is restored.
+  const realWriteSync = fs.writeSync;
+  let failNextDirectoryWrite = true;
+  fs.writeSync = function(fd, buffer, offset, length, position) {
+    if (failNextDirectoryWrite && Buffer.isBuffer(buffer) && buffer.length - offset >= 4) {
+      const sig = buffer.readUInt32LE(offset);
+      if (sig === SIG_CENTRAL || sig === SIG_EOCD) {
+        failNextDirectoryWrite = false;
+        const err = new Error('ENOSPC: simulated no space left on device');
+        err.code = 'ENOSPC';
+        throw err;
+      }
+    }
+    return realWriteSync.call(fs, fd, buffer, offset, length, position);
+  };
+  try {
+    assert.throws(() => zf.addEntrySync(toAdd), { code: 'ENOSPC' });
+  } finally {
+    fs.writeSync = realWriteSync;
+  }
+
+  // In-memory: the half-added entry is gone and the original is still readable.
+  assert.ok(!zf.has('second.txt'));
+  assert.strictEqual(zf.getSync('first.txt').contentSync().toString(), 'original');
+  zf.closeSync();
+
+  // On disk: reopening shows the original, uncorrupted archive.
+  const reopened = zlib.ZipFile.openSync(file);
+  assert.ok(reopened.has('first.txt'));
+  assert.ok(!reopened.has('second.txt'));
+  assert.strictEqual(reopened.getSync('first.txt').contentSync().toString(), 'original');
+  reopened.closeSync();
+});

From d29cc0926a1dac6f38cdb143ca99a7c4b0b0085d Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Tue, 4 Aug 2026 16:01:20 +0200
Subject: [PATCH 173/344] zlib: let a ZipFile read finish before close()

An entry read runs on a file descriptor shared with its ZipFile, but
reads did not take part in close()'s lifecycle: close() marked the
handle closed and released the fd while a read was still in flight, so
the read landed on a closed - or worse, an OS-reused - descriptor
(surfacing as EBADF, or a cross-file read once the number was
reclaimed), despite the class comment promising otherwise.

Track in-flight reads on the shared handle. close() now marks the handle
closing (rejecting new reads at once), waits for the in-flight reads to
finish on the still-open fd, and only then closes it; closeSync(), which
cannot wait, refuses while an asynchronous read is outstanding.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65016
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/zip/entry.js | 85 ++++++++++++++++++++++++++++-----------
 lib/internal/zip/file.js  | 34 ++++++++++++----
 2 files changed, 89 insertions(+), 30 deletions(-)

diff --git a/lib/internal/zip/entry.js b/lib/internal/zip/entry.js
index 4921cc8ab9ce..566f5ba58a51 100644
--- a/lib/internal/zip/entry.js
+++ b/lib/internal/zip/entry.js
@@ -175,6 +175,17 @@ function createEntryMeta(filename, options) {
   };
 }
 
+// Release one in-flight read on a shared ZipFile descriptor handle. When the
+// last read settles, wake a close() that is waiting to release the fd (see
+// ZipFile.close() in file.js), so a read never lands on a closed/reused fd.
+function endHandleRead(handle) {
+  if (--handle.reads === 0 && handle.drain !== null) {
+    const drain = handle.drain;
+    handle.drain = null;
+    drain();
+  }
+}
+
 /**
  * A single file or directory inside a ZIP archive: reading, writing, and
  * (de)serializing one archive member.
@@ -490,17 +501,30 @@ class ZipEntry {
   // The entry's raw compressed bytes as a bounded-memory chunk stream, read
   // straight from disk (file-backed entries only). Nothing is retained.
   async *#rawChunks() {
-    this.#liveDescriptor();
-    let pos = await this.#resolveContentOffset();
-    let remaining = this.compressedSize;
-    while (remaining > 0) {
-      const take = MathMin(READ_CHUNK_SIZE, remaining);
-      const chunk = Buffer.allocUnsafe(take);
-      // Re-check per chunk: the ZipFile may be closed mid-stream.
-      await readFdFully(this.#liveDescriptor(), chunk, pos);
-      pos += take;
-      remaining -= take;
-      yield chunk;
+    // Count the whole stream as one in-flight read so a concurrent close()
+    // waits for it (the finally runs when the consumer stops iterating); a
+    // stream begun after close() was requested is rejected up front.
+    const handle = this.#fd;
+    if (handle.closing) {
+      throw new ERR_INVALID_STATE(
+        'cannot read a ZipEntry after its backing ZipFile has been closed');
+    }
+    handle.reads++;
+    try {
+      this.#liveDescriptor();
+      let pos = await this.#resolveContentOffset();
+      let remaining = this.compressedSize;
+      while (remaining > 0) {
+        const take = MathMin(READ_CHUNK_SIZE, remaining);
+        const chunk = Buffer.allocUnsafe(take);
+        // Re-check per chunk: the ZipFile may be closed mid-stream.
+        await readFdFully(this.#liveDescriptor(), chunk, pos);
+        pos += take;
+        remaining -= take;
+        yield chunk;
+      }
+    } finally {
+      endHandleRead(handle);
     }
   }
   // Sync counterpart of #rawChunks().
@@ -533,18 +557,33 @@ class ZipEntry {
         `entry ${JSONStringify(this.name)} declares ${declared} bytes, ` +
         `exceeding the ${maxSize} byte limit`);
     }
-    const compressed = await this.#compressedBytes();
-    const data = await decodeMemberAsync(compressed, {
-      name: this.name,
-      flags: this.flags,
-      method: this.method,
-      crc32: this.crc32,
-      uncompressedSize: declared,
-    }, { verify: options?.verify, maxSize });
-    // `data === compressed` only on the store path; copy the in-memory case
-    // (the entry's retained buffer, see #compressedBytes()) so the result is
-    // caller-owned on every path.
-    return data === compressed && this.#fd === null ? Buffer.from(data) : data;
+    // Count this read on the shared handle so a concurrent close() waits for it
+    // rather than releasing the fd mid-read; a read begun after close() was
+    // requested is rejected up front (in-memory entries have no fd).
+    const handle = this.#fd;
+    if (handle !== null) {
+      if (handle.closing) {
+        throw new ERR_INVALID_STATE(
+          'cannot read a ZipEntry after its backing ZipFile has been closed');
+      }
+      handle.reads++;
+    }
+    try {
+      const compressed = await this.#compressedBytes();
+      const data = await decodeMemberAsync(compressed, {
+        name: this.name,
+        flags: this.flags,
+        method: this.method,
+        crc32: this.crc32,
+        uncompressedSize: declared,
+      }, { verify: options?.verify, maxSize });
+      // `data === compressed` only on the store path; copy the in-memory case
+      // (the entry's retained buffer, see #compressedBytes()) so the result is
+      // caller-owned on every path.
+      return data === compressed && this.#fd === null ? Buffer.from(data) : data;
+    } finally {
+      if (handle !== null) endHandleRead(handle);
+    }
   }
 
   /**
diff --git a/lib/internal/zip/file.js b/lib/internal/zip/file.js
index b43c091e8630..cf260a42f3d7 100644
--- a/lib/internal/zip/file.js
+++ b/lib/internal/zip/file.js
@@ -19,6 +19,7 @@ const {
   MapPrototypeKeys,
   MapPrototypeSet,
   MathMin,
+  Promise,
   PromisePrototypeThen,
   PromiseResolve,
   SymbolAsyncDispose,
@@ -218,12 +219,14 @@ function checkMemberOverlap(members, centralDirectoryOffset) {
  * corrupt the archive.
  */
 class ZipFile {
-  // Shared descriptor handle ({ fd, closed }) handed to every ZipEntry this
-  // archive produces, so close() can invalidate them all at once. `#closing`
-  // is set synchronously the moment close()/closeSync() is called, gating any
-  // further public call; `handle.closed` is set once the fd is actually gone,
-  // gating reads through already-handed-out entries. Neither read ever falls
-  // through to a bare (possibly OS-reused) descriptor number.
+  // Shared descriptor handle ({ fd, closed, reads, drain }) handed to every
+  // ZipEntry this archive produces, so close() can invalidate them all at once.
+  // `#closing` is set synchronously the moment close()/closeSync() is called,
+  // gating any further public call; `handle.closed` then stops new reads, and
+  // `handle.reads` counts in-flight reads through already-handed-out entries so
+  // close() can wait for them to finish before releasing the fd. Neither a new
+  // nor an in-flight read ever falls through to a closed (possibly OS-reused)
+  // descriptor number.
   #handle;
   #closing = false;
   #closePromise = null;
@@ -240,7 +243,7 @@ class ZipFile {
    * @private
    */
   constructor(fd, centralHeaders, prefix, centralDirectoryOffset, comment, writable) {
-    this.#handle = { fd, closed: false };
+    this.#handle = { fd, closed: false, closing: false, reads: 0, drain: null };
     this.#writable = writable;
     this.#comment = comment;
     this.#centralDirectoryOffset = centralDirectoryOffset;
@@ -655,7 +658,16 @@ class ZipFile {
   close() {
     if (this.#closing) return this.#closePromise ?? PromiseResolve();
     this.#closing = true;
+    // Block *new* reads immediately; reads already in flight keep the still-open
+    // fd until they finish (handle.closed, set below, is what stops mid-read).
+    this.#handle.closing = true;
     this.#closePromise = this.#enqueue(async () => {
+      // Let reads already in flight through handed-out entries finish on the
+      // open fd before releasing it; endHandleRead() (entry.js) resolves this
+      // once the last one settles.
+      if (this.#handle.reads > 0) {
+        await new Promise((resolve) => { this.#handle.drain = resolve; });
+      }
       this.#handle.closed = true;
       MapPrototypeClear(this.#entries);
       await fsCloseAsync(this.#handle.fd);
@@ -669,7 +681,15 @@ class ZipFile {
   closeSync() {
     if (this.#closing) return;
     this.#assertNotBusy();
+    // A synchronous close cannot wait for an async read the way close() does,
+    // so refuse rather than pull the fd out from under one still in flight.
+    if (this.#handle.reads > 0) {
+      throw new ERR_INVALID_STATE(
+        'cannot synchronously close a ZipFile while an asynchronous read is ' +
+        'still in flight');
+    }
     this.#closing = true;
+    this.#handle.closing = true;
     this.#handle.closed = true;
     MapPrototypeClear(this.#entries);
     fs.closeSync(this.#handle.fd);

From 1aafd198137f2d26d2f48e9cc0ea7a400015e6c3 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Tue, 4 Aug 2026 16:04:19 +0200
Subject: [PATCH 174/344] zlib: roll back a failed add() directory rewrite

add()/addEntrySync() advanced the central-directory offset and adopted
the new entry into memory before the final directory rewrite. If that
rewrite failed (ENOSPC/EIO after the member bytes were already written),
the in-memory state and the on-disk archive were left diverged and
half-updated, with no restore, corrupting the next add().

Wrap the rewrite: on failure, restore the previous offset and directory
entry and rewrite the original directory back, leaving the archive and
handle exactly as before the call, then rethrow.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65016
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/zip/file.js | 52 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 46 insertions(+), 6 deletions(-)

diff --git a/lib/internal/zip/file.js b/lib/internal/zip/file.js
index cf260a42f3d7..bae71ed485d5 100644
--- a/lib/internal/zip/file.js
+++ b/lib/internal/zip/file.js
@@ -387,10 +387,11 @@ class ZipFile {
     return this.#enqueue(async () =>
       this.#doAdd(await ZipEntry.create(filename, data, options)));
   }
-  // Append the entry's bytes where the central directory currently starts,
-  // then rewrite the directory to include it. On write failure, restore the
-  // original directory (the partial write may have clobbered it) and rethrow;
-  // on success, promote a spent stream entry to its on-disk copy.
+  // Append the entry's bytes where the central directory currently starts, then
+  // rewrite the directory to include it. If the member write or the directory
+  // rewrite fails, restore the original directory and drop the half-adopted
+  // entry so the archive is left exactly as it was, then rethrow; on success,
+  // promote a spent stream entry to its on-disk copy.
   async #doAdd(entry) {
     const localOffset = this.#centralDirectoryOffset;
     let written = 0;
@@ -413,9 +414,30 @@ class ZipFile {
       }
       throw err;
     }
+    const previousEntry = MapPrototypeGet(this.#entries, entry.name);
     this.#centralDirectoryOffset = localOffset + written;
     MapPrototypeSet(this.#entries, entry.name, { central: null, entry, localOffset });
-    await this.#rewriteCentralDirectory();
+    try {
+      await this.#rewriteCentralDirectory();
+    } catch (err) {
+      // The directory rewrite failed after the member bytes landed. Undo the
+      // in-memory adoption and rewrite the original directory back at its old
+      // offset (where the failed member bytes started), leaving the archive and
+      // this handle exactly as before the call.
+      this.#centralDirectoryOffset = localOffset;
+      if (previousEntry === undefined) {
+        MapPrototypeDelete(this.#entries, entry.name);
+      } else {
+        MapPrototypeSet(this.#entries, entry.name, previousEntry);
+      }
+      try {
+        await this.#rewriteCentralDirectory();
+      } catch {
+        // Restoring failed too (the device is likely full or gone); the
+        // original error is the actionable one.
+      }
+      throw err;
+    }
     // The entry now has a stable home in this archive; if it was a spent
     // streaming entry, rebind it to that on-disk copy so it stays readable.
     entry[kPromote](this.#handle, localOffset);
@@ -453,9 +475,27 @@ class ZipFile {
       }
       throw err;
     }
+    const previousEntry = MapPrototypeGet(this.#entries, entry.name);
     this.#centralDirectoryOffset = localOffset + written;
     MapPrototypeSet(this.#entries, entry.name, { central: null, entry, localOffset });
-    this.#rewriteCentralDirectorySync();
+    try {
+      this.#rewriteCentralDirectorySync();
+    } catch (err) {
+      // See #doAdd(): undo the in-memory adoption and restore the original
+      // directory so a failed rewrite leaves the archive exactly as it was.
+      this.#centralDirectoryOffset = localOffset;
+      if (previousEntry === undefined) {
+        MapPrototypeDelete(this.#entries, entry.name);
+      } else {
+        MapPrototypeSet(this.#entries, entry.name, previousEntry);
+      }
+      try {
+        this.#rewriteCentralDirectorySync();
+      } catch {
+        // Restoring failed too; the original error is the actionable one.
+      }
+      throw err;
+    }
     entry[kPromote](this.#handle, localOffset);
     return entry;
   }

From e2f4ea03a36e2e450c0e63d2a1a0647a9a638463 Mon Sep 17 00:00:00 2001
From: Harjoth Khara <harjoth.khara@gmail.com>
Date: Thu, 13 Aug 2026 20:39:59 -0700
Subject: [PATCH 175/344] doc: document http2 header constants

Signed-off-by: harjoth <harjoth.khara@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64548
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/http2.md | 151 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 145 insertions(+), 6 deletions(-)

diff --git a/doc/api/http2.md b/doc/api/http2.md
index 871b300c3079..566aebe74598 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -3364,6 +3364,142 @@ client.close();
 added: v8.4.0
 -->
 
+#### Header name constants
+
+The `HTTP2_HEADER_*` constants provide names for HTTP/2 pseudo-headers and
+known HTTP header names. Using these string constants is optional. For example,
+`http2.constants.HTTP2_HEADER_CONTENT_TYPE` is equal to `'content-type'`.
+For APIs that accept regular header names,
+`http2.constants.HTTP2_HEADER_CONTENT_TYPE`, `'content-type'`, and
+`'Content-Type'` have the same effect; Node.js serializes the name in
+lower-case.
+
+Regular header constants can be used with the compatibility API wherever the
+corresponding literal header name is accepted. In compatibility API request
+handlers, prefer `request.method`, `request.authority`, `request.scheme`, and
+`request.url` for the corresponding pseudo-headers. Other incoming
+pseudo-headers remain available through `request.headers`. Set response status
+through `response.statusCode` or the `statusCode` argument to
+`response.writeHead()`. Passing `HTTP2_HEADER_STATUS` (`':status'`) to
+`response.setHeader()` or in `response.writeHead()`'s headers object throws
+`ERR_HTTP2_PSEUDOHEADER_NOT_ALLOWED`. `HTTP2_HEADER_PROTOCOL` is a request
+pseudo-header and cannot be sent in a response.
+
+Incoming header object keys are lower-case, so use a constant or a lower-case
+literal when accessing them as object properties. Using a constant does not
+change header validation, and the availability of a constant does not imply
+that the header is valid in every HTTP/2 context. See [HTTP/2 Headers Object][]
+and [Invalid character handling in header names and values][] for details about
+header casing and validation.
+
+##### Pseudo-header constants
+
+`HTTP2_HEADER_METHOD`, `HTTP2_HEADER_AUTHORITY`, `HTTP2_HEADER_SCHEME`, and
+`HTTP2_HEADER_PATH` identify request pseudo-headers. `HTTP2_HEADER_STATUS`
+identifies the response pseudo-header. `HTTP2_HEADER_PROTOCOL` identifies the
+extended `CONNECT` request pseudo-header. Pseudo-headers are not permitted in
+trailers.
+
+| Constant                                 | Value          |
+| ---------------------------------------- | -------------- |
+| `http2.constants.HTTP2_HEADER_STATUS`    | `':status'`    |
+| `http2.constants.HTTP2_HEADER_METHOD`    | `':method'`    |
+| `http2.constants.HTTP2_HEADER_AUTHORITY` | `':authority'` |
+| `http2.constants.HTTP2_HEADER_SCHEME`    | `':scheme'`    |
+| `http2.constants.HTTP2_HEADER_PATH`      | `':path'`      |
+| `http2.constants.HTTP2_HEADER_PROTOCOL`  | `':protocol'`  |
+
+##### Regular header constants
+
+The `HTTP2_HEADER_CONNECTION`, `HTTP2_HEADER_UPGRADE`,
+`HTTP2_HEADER_HTTP2_SETTINGS`, `HTTP2_HEADER_KEEP_ALIVE`,
+`HTTP2_HEADER_PROXY_CONNECTION`, and `HTTP2_HEADER_TRANSFER_ENCODING`
+constants identify connection-specific headers that HTTP/2 does not permit.
+`HTTP2_HEADER_TE` is permitted only when its value is `'trailers'`.
+
+| Constant                                                        | Value                                |
+| --------------------------------------------------------------- | ------------------------------------ |
+| `http2.constants.HTTP2_HEADER_ACCEPT_ENCODING`                  | `'accept-encoding'`                  |
+| `http2.constants.HTTP2_HEADER_ACCEPT_LANGUAGE`                  | `'accept-language'`                  |
+| `http2.constants.HTTP2_HEADER_ACCEPT_RANGES`                    | `'accept-ranges'`                    |
+| `http2.constants.HTTP2_HEADER_ACCEPT`                           | `'accept'`                           |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS` | `'access-control-allow-credentials'` |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_ALLOW_HEADERS`     | `'access-control-allow-headers'`     |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_ALLOW_METHODS`     | `'access-control-allow-methods'`     |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN`      | `'access-control-allow-origin'`      |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS`    | `'access-control-expose-headers'`    |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_REQUEST_HEADERS`   | `'access-control-request-headers'`   |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_REQUEST_METHOD`    | `'access-control-request-method'`    |
+| `http2.constants.HTTP2_HEADER_AGE`                              | `'age'`                              |
+| `http2.constants.HTTP2_HEADER_AUTHORIZATION`                    | `'authorization'`                    |
+| `http2.constants.HTTP2_HEADER_CACHE_CONTROL`                    | `'cache-control'`                    |
+| `http2.constants.HTTP2_HEADER_CONNECTION`                       | `'connection'`                       |
+| `http2.constants.HTTP2_HEADER_CONTENT_DISPOSITION`              | `'content-disposition'`              |
+| `http2.constants.HTTP2_HEADER_CONTENT_ENCODING`                 | `'content-encoding'`                 |
+| `http2.constants.HTTP2_HEADER_CONTENT_LENGTH`                   | `'content-length'`                   |
+| `http2.constants.HTTP2_HEADER_CONTENT_TYPE`                     | `'content-type'`                     |
+| `http2.constants.HTTP2_HEADER_COOKIE`                           | `'cookie'`                           |
+| `http2.constants.HTTP2_HEADER_DATE`                             | `'date'`                             |
+| `http2.constants.HTTP2_HEADER_ETAG`                             | `'etag'`                             |
+| `http2.constants.HTTP2_HEADER_FORWARDED`                        | `'forwarded'`                        |
+| `http2.constants.HTTP2_HEADER_HOST`                             | `'host'`                             |
+| `http2.constants.HTTP2_HEADER_IF_MODIFIED_SINCE`                | `'if-modified-since'`                |
+| `http2.constants.HTTP2_HEADER_IF_NONE_MATCH`                    | `'if-none-match'`                    |
+| `http2.constants.HTTP2_HEADER_IF_RANGE`                         | `'if-range'`                         |
+| `http2.constants.HTTP2_HEADER_LAST_MODIFIED`                    | `'last-modified'`                    |
+| `http2.constants.HTTP2_HEADER_LINK`                             | `'link'`                             |
+| `http2.constants.HTTP2_HEADER_LOCATION`                         | `'location'`                         |
+| `http2.constants.HTTP2_HEADER_RANGE`                            | `'range'`                            |
+| `http2.constants.HTTP2_HEADER_REFERER`                          | `'referer'`                          |
+| `http2.constants.HTTP2_HEADER_SERVER`                           | `'server'`                           |
+| `http2.constants.HTTP2_HEADER_SET_COOKIE`                       | `'set-cookie'`                       |
+| `http2.constants.HTTP2_HEADER_STRICT_TRANSPORT_SECURITY`        | `'strict-transport-security'`        |
+| `http2.constants.HTTP2_HEADER_TRANSFER_ENCODING`                | `'transfer-encoding'`                |
+| `http2.constants.HTTP2_HEADER_TE`                               | `'te'`                               |
+| `http2.constants.HTTP2_HEADER_UPGRADE_INSECURE_REQUESTS`        | `'upgrade-insecure-requests'`        |
+| `http2.constants.HTTP2_HEADER_UPGRADE`                          | `'upgrade'`                          |
+| `http2.constants.HTTP2_HEADER_USER_AGENT`                       | `'user-agent'`                       |
+| `http2.constants.HTTP2_HEADER_VARY`                             | `'vary'`                             |
+| `http2.constants.HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS`           | `'x-content-type-options'`           |
+| `http2.constants.HTTP2_HEADER_X_FRAME_OPTIONS`                  | `'x-frame-options'`                  |
+| `http2.constants.HTTP2_HEADER_KEEP_ALIVE`                       | `'keep-alive'`                       |
+| `http2.constants.HTTP2_HEADER_PROXY_CONNECTION`                 | `'proxy-connection'`                 |
+| `http2.constants.HTTP2_HEADER_X_XSS_PROTECTION`                 | `'x-xss-protection'`                 |
+| `http2.constants.HTTP2_HEADER_ALT_SVC`                          | `'alt-svc'`                          |
+| `http2.constants.HTTP2_HEADER_CONTENT_SECURITY_POLICY`          | `'content-security-policy'`          |
+| `http2.constants.HTTP2_HEADER_EARLY_DATA`                       | `'early-data'`                       |
+| `http2.constants.HTTP2_HEADER_EXPECT_CT`                        | `'expect-ct'`                        |
+| `http2.constants.HTTP2_HEADER_ORIGIN`                           | `'origin'`                           |
+| `http2.constants.HTTP2_HEADER_PURPOSE`                          | `'purpose'`                          |
+| `http2.constants.HTTP2_HEADER_TIMING_ALLOW_ORIGIN`              | `'timing-allow-origin'`              |
+| `http2.constants.HTTP2_HEADER_X_FORWARDED_FOR`                  | `'x-forwarded-for'`                  |
+| `http2.constants.HTTP2_HEADER_PRIORITY`                         | `'priority'`                         |
+| `http2.constants.HTTP2_HEADER_ACCEPT_CHARSET`                   | `'accept-charset'`                   |
+| `http2.constants.HTTP2_HEADER_ACCESS_CONTROL_MAX_AGE`           | `'access-control-max-age'`           |
+| `http2.constants.HTTP2_HEADER_ALLOW`                            | `'allow'`                            |
+| `http2.constants.HTTP2_HEADER_CONTENT_LANGUAGE`                 | `'content-language'`                 |
+| `http2.constants.HTTP2_HEADER_CONTENT_LOCATION`                 | `'content-location'`                 |
+| `http2.constants.HTTP2_HEADER_CONTENT_MD5`                      | `'content-md5'`                      |
+| `http2.constants.HTTP2_HEADER_CONTENT_RANGE`                    | `'content-range'`                    |
+| `http2.constants.HTTP2_HEADER_DNT`                              | `'dnt'`                              |
+| `http2.constants.HTTP2_HEADER_EXPECT`                           | `'expect'`                           |
+| `http2.constants.HTTP2_HEADER_EXPIRES`                          | `'expires'`                          |
+| `http2.constants.HTTP2_HEADER_FROM`                             | `'from'`                             |
+| `http2.constants.HTTP2_HEADER_IF_MATCH`                         | `'if-match'`                         |
+| `http2.constants.HTTP2_HEADER_IF_UNMODIFIED_SINCE`              | `'if-unmodified-since'`              |
+| `http2.constants.HTTP2_HEADER_MAX_FORWARDS`                     | `'max-forwards'`                     |
+| `http2.constants.HTTP2_HEADER_PREFER`                           | `'prefer'`                           |
+| `http2.constants.HTTP2_HEADER_PROXY_AUTHENTICATE`               | `'proxy-authenticate'`               |
+| `http2.constants.HTTP2_HEADER_PROXY_AUTHORIZATION`              | `'proxy-authorization'`              |
+| `http2.constants.HTTP2_HEADER_REFRESH`                          | `'refresh'`                          |
+| `http2.constants.HTTP2_HEADER_RETRY_AFTER`                      | `'retry-after'`                      |
+| `http2.constants.HTTP2_HEADER_TRAILER`                          | `'trailer'`                          |
+| `http2.constants.HTTP2_HEADER_TK`                               | `'tk'`                               |
+| `http2.constants.HTTP2_HEADER_VIA`                              | `'via'`                              |
+| `http2.constants.HTTP2_HEADER_WARNING`                          | `'warning'`                          |
+| `http2.constants.HTTP2_HEADER_WWW_AUTHENTICATE`                 | `'www-authenticate'`                 |
+| `http2.constants.HTTP2_HEADER_HTTP2_SETTINGS`                   | `'http2-settings'`                   |
+
 #### Error codes for `RST_STREAM` and `GOAWAY`
 
 | Value  | Name                | Constant                                      |
@@ -3930,9 +4066,10 @@ API:
 ```mjs
 import { createServer } from 'node:http2';
 const server = createServer((req, res) => {
-  res.setHeader('Content-Type', 'text/html');
-  res.setHeader('X-Foo', 'bar');
-  res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
+  res.writeHead(200, {
+    'Content-Type': 'text/plain; charset=utf-8',
+    'X-Foo': 'bar',
+  });
   res.end('ok');
 });
 ```
@@ -3940,9 +4077,10 @@ const server = createServer((req, res) => {
 ```cjs
 const http2 = require('node:http2');
 const server = http2.createServer((req, res) => {
-  res.setHeader('Content-Type', 'text/html');
-  res.setHeader('X-Foo', 'bar');
-  res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
+  res.writeHead(200, {
+    'Content-Type': 'text/plain; charset=utf-8',
+    'X-Foo': 'bar',
+  });
   res.end('ok');
 });
 ```
@@ -5033,6 +5171,7 @@ you need to implement any fall-back behavior yourself.
 [HTTP/2 Settings Object]: #settings-object
 [HTTP/2 Unencrypted]: https://http2.github.io/faq/#does-http2-require-encryption
 [HTTPS]: https.md
+[Invalid character handling in header names and values]: #invalid-character-handling-in-header-names-and-values
 [Performance Observer]: perf_hooks.md
 [RFC 7838]: https://tools.ietf.org/html/rfc7838
 [RFC 8336]: https://tools.ietf.org/html/rfc8336

From a9b31dfe309e6b64b37ff02258cc43c84808e569 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 14 Aug 2026 11:09:48 -0400
Subject: [PATCH 176/344] meta: add unified http api initiative

HTTP APIs in Node.js have become a bit of a mess.

We have separate `node:http`, `node:https`, and `node:http2`
modules. We have separate `fetch` implementation. We have
`http3` support in development. There are new http features
like datagrams and priorities that are entirely unsupported,
etc.

This strategic initiative will be focused on the development
of a unified HTTP API built around the web standard fetch
model. Client and Server.. independent of underlying transport
and updated to modern HTTP protocol capabilities.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65139
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
---
 doc/contributing/strategic-initiatives.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/contributing/strategic-initiatives.md b/doc/contributing/strategic-initiatives.md
index c56876238ef0..ac154c0e2bb7 100644
--- a/doc/contributing/strategic-initiatives.md
+++ b/doc/contributing/strategic-initiatives.md
@@ -8,7 +8,8 @@ agenda to ensure they are active and have the support they need.
 
 | Initiative             | Champion                         | Links                                         |
 | ---------------------- | -------------------------------- | --------------------------------------------- |
-| QUIC / HTTP3           | [James M Snell][jasnell]         | <https://github.com/nodejs/quic>              |
+| QUIC / HTTP3           | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
+| Unified HTTP API       | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Shadow Realm           | [Chengzhong Wu][legendecas]      | <https://github.com/nodejs/node/issues/42528> |
 | V8 Currency            | [Michaël Zasso][targos]          |                                               |
 | Next-10                | [Jacob Smith][JakobJingleheimer] | <https://github.com/nodejs/next-10>           |

From 099801641bce419643a0d35654af20333149b39d Mon Sep 17 00:00:00 2001
From: Joyee Cheung <joyeec9h3@gmail.com>
Date: Fri, 14 Aug 2026 18:14:48 +0200
Subject: [PATCH 177/344] inspector: avoid calling into JS from V8 interrupts

Our inspector implementation dispatches inspector messages from
a V8 interrupt handler, so they could be handled during an arbitrary
point of JS execution where re-calling into another irrelevant JS
code is not safe.

This patch tracks V8 interrupt state in this case and rewrite the
async hook toggling as state reconciliation, so requests only record
the desired state, which is applied once calling into JS is possible
and safe, and the actual invocation is deferred to an immediate when
inside an interrupt. This simplifies the previous mechanism and
makes re-entracy and early termination safer.

Drive-by: skip installing command line API extensions during
teardown when calling into JS is no longer safe.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65028
Refs: https://issues.chromium.org/u/1/issues/42212250
Refs: https://chromium-review.googlesource.com/c/v8/v8/+/8173727
Refs: https://github.com/nodejs/node/pull/26935
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 src/env-inl.h                                 |   4 +
 src/env.cc                                    |   2 +
 src/env.h                                     |   7 ++
 src/inspector_agent.cc                        | 112 ++++++++++--------
 src/inspector_agent.h                         |  13 +-
 .../test-inspector-async-hook-after-done.js   |   4 +-
 6 files changed, 83 insertions(+), 59 deletions(-)

diff --git a/src/env-inl.h b/src/env-inl.h
index e9f940c63e53..efabadbcc0bc 100644
--- a/src/env-inl.h
+++ b/src/env-inl.h
@@ -623,6 +623,10 @@ inline void Environment::set_can_call_into_js(bool can_call_into_js) {
   can_call_into_js_ = can_call_into_js;
 }
 
+inline bool Environment::is_processing_v8_interrupt() const {
+  return is_processing_v8_interrupt_;
+}
+
 inline bool Environment::has_run_bootstrapping_code() const {
   return principal_realm_->has_run_bootstrapping_code();
 }
diff --git a/src/env.cc b/src/env.cc
index 13344ad135e2..61921995cdd0 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -1549,7 +1549,9 @@ void Environment::RequestInterruptFromV8() {
       return;
     }
     env->interrupt_data_.store(nullptr);
+    env->is_processing_v8_interrupt_ = true;
     env->RunAndClearInterrupts();
+    env->is_processing_v8_interrupt_ = false;
   }, interrupt_data);
 }
 
diff --git a/src/env.h b/src/env.h
index c2bf9fdd497a..288084e3a589 100644
--- a/src/env.h
+++ b/src/env.h
@@ -799,6 +799,12 @@ class Environment final : public MemoryRetainer {
   inline bool can_call_into_js() const;
   inline void set_can_call_into_js(bool can_call_into_js);
 
+  // True while RequestInterrupt() callbacks are being invoked from the
+  // v8::Isolate::RequestInterrupt() handler, i.e. potentially at an
+  // arbitrary point during JS execution. Calling into JS must be avoided
+  // in that case.
+  inline bool is_processing_v8_interrupt() const;
+
   // Increase or decrease a counter that manages whether this Environment
   // keeps the event loop alive on its own or not. The counter starts out at 0,
   // meaning it does not, and any positive value will make it keep the event
@@ -1252,6 +1258,7 @@ class Environment final : public MemoryRetainer {
   bool task_queues_async_initialized_ = false;
 
   std::atomic<Environment**> interrupt_data_ {nullptr};
+  bool is_processing_v8_interrupt_ = false;
   void RequestInterruptFromV8();
   static void CheckImmediate(uv_check_t* handle);
 
diff --git a/src/inspector_agent.cc b/src/inspector_agent.cc
index 00b4982d9b83..4bb34e56bcbf 100644
--- a/src/inspector_agent.cc
+++ b/src/inspector_agent.cc
@@ -555,11 +555,7 @@ class NodeInspectorClient : public V8InspectorClient {
       return;
     }
     if (auto agent = env_->inspector_agent()) {
-      if (depth == 0) {
-        agent->DisableAsyncHook();
-      } else {
-        agent->EnableAsyncHook();
-      }
+      agent->SetAsyncHookTrackingEnabled(depth != 0);
     }
   }
 
@@ -655,6 +651,7 @@ class NodeInspectorClient : public V8InspectorClient {
 
   void installAdditionalCommandLineAPI(Local<Context> context,
                                        Local<Object> target) override {
+    if (!env_->can_call_into_js()) return;
     Local<Function> installer = env_->inspector_console_extension_installer();
     if (!installer.IsEmpty()) {
       Local<Value> argv[] = {target};
@@ -1076,58 +1073,69 @@ void Agent::RegisterAsyncHook(Isolate* isolate,
                               Local<Function> disable_function) {
   parent_env_->set_inspector_enable_async_hooks(enable_function);
   parent_env_->set_inspector_disable_async_hooks(disable_function);
-  if (pending_enable_async_hook_) {
-    CHECK(!pending_disable_async_hook_);
-    pending_enable_async_hook_ = false;
-    EnableAsyncHook();
-  } else if (pending_disable_async_hook_) {
-    CHECK(!pending_enable_async_hook_);
-    pending_disable_async_hook_ = false;
-    DisableAsyncHook();
-  }
+  SyncAsyncHookState();
 }
 
-void Agent::EnableAsyncHook() {
-  HandleScope scope(parent_env_->isolate());
-  Local<Function> enable = parent_env_->inspector_enable_async_hooks();
-  if (!enable.IsEmpty()) {
-    ToggleAsyncHook(parent_env_->isolate(), enable);
-  } else if (pending_disable_async_hook_) {
-    CHECK(!pending_enable_async_hook_);
-    pending_disable_async_hook_ = false;
-  } else {
-    pending_enable_async_hook_ = true;
-  }
+void Agent::SetAsyncHookTrackingEnabled(bool enabled) {
+  async_hook_wanted_ = enabled;
+  SyncAsyncHookState();
 }
 
-void Agent::DisableAsyncHook() {
-  HandleScope scope(parent_env_->isolate());
-  Local<Function> disable = parent_env_->inspector_disable_async_hooks();
-  if (!disable.IsEmpty()) {
-    ToggleAsyncHook(parent_env_->isolate(), disable);
-  } else if (pending_enable_async_hook_) {
-    CHECK(!pending_disable_async_hook_);
-    pending_enable_async_hook_ = false;
-  } else {
-    pending_disable_async_hook_ = true;
-  }
-}
+// Reconcile the state of the async hook used for async stack traces with the
+// state last requested by the protocol. The hook is set up in JS land,
+// (see inspector_async_hooks.js), which isn't safe to do when:
+// 1. We are in early bootstrap and the setup functions aren't registered in
+//    C++ yet.
+// 2. We are in a V8 interrupt requested by inspector protocol message
+//    dispatch e.g. from maxAsyncCallStackDepthChanged() notifications.
+// When it's not safe to call into JS, this is a no-op and we'll try again in
+// RegisterAsyncHook() (for 1) or from a scheduled immediate (for 2).
+void Agent::SyncAsyncHookState() {
+  // The debugger can request an interrupt within the toggle JS function itself,
+  // A nested call only records the new requested state, the outermost call sees
+  // it when re-checking the loop condition after each toggle.
+  if (syncing_async_hook_state_) return;
+  syncing_async_hook_state_ = true;
+  auto on_exit = OnScopeLeave([this]() { syncing_async_hook_state_ = false; });
+
+  Isolate* isolate = parent_env_->isolate();
+  HandleScope scope(isolate);
+  while (async_hook_wanted_ != async_hook_enabled_) {
+    // Guard against running this during cleanup -- no async events will be
+    // emitted anyway at that point anymore, and calling into JS is not
+    // possible. This should probably not be something we're attempting in the
+    // first place,
+    // Refs: https://github.com/nodejs/node/pull/34362#discussion_r456006039
+    if (!parent_env_->can_call_into_js()) return;
+
+    bool enable = async_hook_wanted_;
+    Local<Function> fn = enable ? parent_env_->inspector_enable_async_hooks()
+                                : parent_env_->inspector_disable_async_hooks();
+    if (fn.IsEmpty()) return;
+
+    if (parent_env_->is_processing_v8_interrupt()) {
+      parent_env_->SetImmediate(
+          [](Environment* env) {
+            Agent* agent = env->inspector_agent();
+            if (agent != nullptr) agent->SyncAsyncHookState();
+          },
+          CallbackFlags::kUnrefed);
+      return;
+    }
 
-void Agent::ToggleAsyncHook(Isolate* isolate, Local<Function> fn) {
-  // Guard against running this during cleanup -- no async events will be
-  // emitted anyway at that point anymore, and calling into JS is not possible.
-  // This should probably not be something we're attempting in the first place,
-  // Refs: https://github.com/nodejs/node/pull/34362#discussion_r456006039
-  if (!parent_env_->can_call_into_js()) return;
-  CHECK(parent_env_->has_run_bootstrapping_code());
-  HandleScope handle_scope(isolate);
-  CHECK(!fn.IsEmpty());
-  auto context = parent_env_->context();
-  v8::TryCatch try_catch(isolate);
-  USE(fn->Call(context, Undefined(isolate), 0, nullptr));
-  if (try_catch.HasCaught() && !try_catch.HasTerminated()) {
-    PrintCaughtException(isolate, context, try_catch);
-    UNREACHABLE("Cannot toggle Inspector's AsyncHook, please report this.");
+    CHECK(parent_env_->has_run_bootstrapping_code());
+    Local<Context> context = parent_env_->context();
+    v8::TryCatch try_catch(isolate);
+    USE(fn->Call(context, Undefined(isolate), 0, nullptr));
+    if (try_catch.HasCaught()) {
+      // Termination may abort the toggle invocation, retrying now would just
+      // be terminated again. Instead of recording the toggle that may not have
+      // taken effect, leave the states as-is so that a later sync retries.
+      if (try_catch.HasTerminated()) return;
+      PrintCaughtException(isolate, context, try_catch);
+      UNREACHABLE("Cannot toggle Inspector's AsyncHook, please report this.");
+    }
+    async_hook_enabled_ = enable;
   }
 }
 
diff --git a/src/inspector_agent.h b/src/inspector_agent.h
index 5ace72a64012..932e4e8dce89 100644
--- a/src/inspector_agent.h
+++ b/src/inspector_agent.h
@@ -90,8 +90,7 @@ class Agent {
   void RegisterAsyncHook(v8::Isolate* isolate,
     v8::Local<v8::Function> enable_function,
     v8::Local<v8::Function> disable_function);
-  void EnableAsyncHook();
-  void DisableAsyncHook();
+  void SetAsyncHookTrackingEnabled(bool enabled);
 
   void SetParentHandle(std::unique_ptr<ParentInspectorHandle> parent_handle);
   std::unique_ptr<ParentInspectorHandle> GetParentHandle(uint64_t thread_id,
@@ -132,7 +131,7 @@ class Agent {
   std::shared_ptr<NetworkResourceManager> GetNetworkResourceManager();
 
  private:
-  void ToggleAsyncHook(v8::Isolate* isolate, v8::Local<v8::Function> fn);
+  void SyncAsyncHookState();
   void ToggleNetworkTracking(v8::Isolate* isolate, v8::Local<v8::Function> fn);
 
   node::Environment* parent_env_;
@@ -150,8 +149,12 @@ class Agent {
   DebugOptions debug_options_;
   std::shared_ptr<ExclusiveAccess<HostPort>> host_port_;
 
-  bool pending_enable_async_hook_ = false;
-  bool pending_disable_async_hook_ = false;
+  // The state of the async hook used for async stack traces that the protocol
+  // last requested, and the state JS currently has. SyncAsyncHookState()
+  // reconciles the two when it is possible and safe to call into JS.
+  bool async_hook_wanted_ = false;
+  bool async_hook_enabled_ = false;
+  bool syncing_async_hook_state_ = false;
 
   bool network_tracking_enabled_ = false;
   bool pending_enable_network_tracking = false;
diff --git a/test/parallel/test-inspector-async-hook-after-done.js b/test/parallel/test-inspector-async-hook-after-done.js
index f9cd7b491360..b4eff0467ecd 100644
--- a/test/parallel/test-inspector-async-hook-after-done.js
+++ b/test/parallel/test-inspector-async-hook-after-done.js
@@ -34,8 +34,8 @@ function onAttachToWorker({ params: { sessionId } }) {
       session.once('NodeWorker.receivedMessageFromWorker', onMessageReceived);
       return;
     }
-    // Force a call to node::inspector::Agent::ToggleAsyncHook by changing the
-    // async call stack depth
+    // Force a call to node::inspector::Agent::SyncAsyncHookState by changing
+    // the async call stack depth
     postToWorkerInspector('Debugger.setAsyncCallStackDepth', { maxDepth: 1 });
     // This is were the original crash happened
     session.post('NodeWorker.detach', { sessionId }, () => {

From bca3367583e5678f8286410bd867ca9ee085dc93 Mon Sep 17 00:00:00 2001
From: Maya Lekova <maya@igalia.com>
Date: Fri, 14 Aug 2026 19:14:58 +0300
Subject: [PATCH 178/344] test: add a simple test for `import defer` of a CJS
 module

This tests imports a CommonJS modules with the `defer` modifier.
It ensures that the imported module is not evaluated before
accessing properties from its exports.

Signed-off-by: Maya Lekova <maya@igalia.com>
PR-URL: https://github.com/nodejs/node/pull/64694
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
---
 .../test-cjs-defer-static-import-eval.mjs     | 30 +++++++++++++++++++
 .../es-modules/module-cjs-deferred-eval.js    | 17 +++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 test/es-module/test-cjs-defer-static-import-eval.mjs
 create mode 100644 test/fixtures/es-modules/module-cjs-deferred-eval.js

diff --git a/test/es-module/test-cjs-defer-static-import-eval.mjs b/test/es-module/test-cjs-defer-static-import-eval.mjs
new file mode 100644
index 000000000000..0150f6f40b38
--- /dev/null
+++ b/test/es-module/test-cjs-defer-static-import-eval.mjs
@@ -0,0 +1,30 @@
+// Flags: --js-defer-import-eval
+
+// Test that uses import.defer for a CJS module. It ensures that:
+//   1. the module is imported successfully;
+//   2. it's evaluated synchronously, regardless of the `defer` modifier;
+//   3. Evaluation of the imported module is deferred
+//      until first namespace access.
+
+import '../common/index.mjs';
+import * as assert from 'assert';
+
+// Import the CJS module with the `defer` modifier.
+import defer * as imported from '../fixtures/es-modules/module-cjs-deferred-eval.js';
+
+// At this point, the deferred module should not yet be evaluated. Initialize
+// the `eval_list`, which will be populated only when the module is evaluated
+// for the first time, triggered by namespace access below.
+globalThis.eval_list = [];
+
+// Additionally check that the exported properties `foo` and `identifier`
+// are defined and have their values assigned at this point.
+assert.strictEqual(imported.foo, 42);
+assert.strictEqual(imported.identifier, 'package-type-commonjs');
+
+// Check that the module has been evaluated at this point,
+// also that it's not evaluated more than once.
+assert.deepStrictEqual(['defer-1'], globalThis.eval_list);
+
+// Clean-up
+delete globalThis.eval_list;
diff --git a/test/fixtures/es-modules/module-cjs-deferred-eval.js b/test/fixtures/es-modules/module-cjs-deferred-eval.js
new file mode 100644
index 000000000000..a7239e6ff454
--- /dev/null
+++ b/test/fixtures/es-modules/module-cjs-deferred-eval.js
@@ -0,0 +1,17 @@
+// This fixture is imported as a module
+// in test/es-module/test-cjs-defer-static-import-eval.mjs
+// to ensure a CommonJS module imported with `import defer`
+// is only executed once.
+const assert = require('assert');
+
+const identifier = 'package-type-commonjs';
+
+module.exports.foo = 42;
+module.exports.identifier = identifier;
+
+// The `eval_list` is initialised by the importing module,
+// so by the time the fixture is executed, `eval_list` should
+// already be initialised.
+assert.deepEqual(globalThis.eval_list, []);
+
+globalThis.eval_list.push('defer-1');

From abb7a15a8daf0e6c0eff8e051fd66c7c016950f3 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Fri, 14 Aug 2026 14:33:27 -0400
Subject: [PATCH 179/344] deps: update perfetto to 57.2

PR-URL: https://github.com/nodejs/node/pull/65114
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 deps/perfetto/LICENSE         |    20 +
 deps/perfetto/VERSION         |     2 +-
 deps/perfetto/sdk/perfetto.cc |  6726 +++++++---
 deps/perfetto/sdk/perfetto.h  | 23033 ++++++++++++++------------------
 4 files changed, 15265 insertions(+), 14516 deletions(-)

diff --git a/deps/perfetto/LICENSE b/deps/perfetto/LICENSE
index cbdc2881d57d..681d40008ee3 100644
--- a/deps/perfetto/LICENSE
+++ b/deps/perfetto/LICENSE
@@ -224,6 +224,26 @@ Files: src/trace_processor/perfetto_sql/stdlib/chromium/*, protos/third_party/ch
    OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
+------------------
+
+Files: src/trace_processor/perfetto_sql/syntaqlite/syntaqlite_perfetto.{c, h}
+
+   Copyright 2025 The syntaqlite Authors. All rights reserved.
+
+   Machine-generated amalgamation of syntaqlite runtime + Perfetto dialect
+   sources (https://github.com/LalitMaganti/syntaqlite). Portions derive
+   from SQLite's public-domain `parse.y` grammar.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
 ------------------
 
 Files: src/trace_processor/perfetto_sql/preprocessor/preprocessor_grammar.{c, h}
diff --git a/deps/perfetto/VERSION b/deps/perfetto/VERSION
index 517ac763657c..06b0aef2d7b5 100644
--- a/deps/perfetto/VERSION
+++ b/deps/perfetto/VERSION
@@ -1 +1 @@
-54.0
+57.2
diff --git a/deps/perfetto/sdk/perfetto.cc b/deps/perfetto/sdk/perfetto.cc
index 2ccd11f7b831..4df59d2c46dd 100644
--- a/deps/perfetto/sdk/perfetto.cc
+++ b/deps/perfetto/sdk/perfetto.cc
@@ -560,6 +560,7 @@ struct std::hash<::perfetto::base::StringView> {
 #include <cinttypes>
 #include <optional>
 #include <string>
+#include <string_view>
 #include <system_error>
 #include <vector>
 
@@ -723,7 +724,9 @@ std::vector<std::string> SplitString(const std::string& text,
                                      const std::string& delimiter);
 std::string StripPrefix(const std::string& str, const std::string& prefix);
 std::string StripSuffix(const std::string& str, const std::string& suffix);
+std::string_view TrimWhitespace(std::string_view str);
 std::string TrimWhitespace(const std::string& str);
+std::string_view TrimWhitespace(const char* str);
 std::string ToLower(const std::string& str);
 std::string ToUpper(const std::string& str);
 std::string StripChars(const std::string& str,
@@ -1544,10 +1547,10 @@ std::optional<std::string> Base64Decode(const char* src, size_t src_size) {
 
 }  // namespace base
 }  // namespace perfetto
-// gen_amalgamated begin source: src/base/crash_keys.cc
-// gen_amalgamated begin header: include/perfetto/ext/base/crash_keys.h
+// gen_amalgamated begin source: src/base/cpu_info.cc
+// gen_amalgamated begin header: include/perfetto/ext/base/cpu_info.h
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright (C) 2026 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1562,154 +1565,42 @@ std::optional<std::string> Base64Decode(const char* src, size_t src_size) {
  * limitations under the License.
  */
 
-#ifndef INCLUDE_PERFETTO_EXT_BASE_CRASH_KEYS_H_
-#define INCLUDE_PERFETTO_EXT_BASE_CRASH_KEYS_H_
-
-#include <algorithm>
-#include <atomic>
+#ifndef INCLUDE_PERFETTO_EXT_BASE_CPU_INFO_H_
+#define INCLUDE_PERFETTO_EXT_BASE_CPU_INFO_H_
 
 #include <stdint.h>
-#include <string.h>
-
-// gen_amalgamated expanded: #include "perfetto/base/compiler.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/string_view.h"
-
-// Crash keys are very simple global variables with static-storage that
-// are reported on crash time for managed crashes (CHECK/FATAL/Watchdog).
-// - Translation units can define a CrashKey and register it at some point
-//   during initialization.
-// - CrashKey instances must be long-lived. They should really be just global
-//   static variable in the anonymous namespace.
-// Example:
-// subsystem_1.cc
-//   CrashKey g_client_id("ipc_client_id");
-//   ...
-//   OnIpcReceived(client_id) {
-//      g_client_id.Set(client_id);
-//      ... // Process the IPC
-//      g_client_id.Clear();
-//   }
-//   Or equivalently:
-//   OnIpcReceived(client_id) {
-//      auto scoped_key = g_client_id.SetScoped(client_id);
-//      ... // Process the IPC
-//   }
-//
-// If a crash happens while processing the IPC, the crash report will
-// have a line "ipc_client_id: 42".
-//
-// Thread safety considerations:
-// CrashKeys can be registered and set/cleared from any thread.
-// There is no compelling use-case to have full acquire/release consistency when
-// setting a key. This means that if a thread crashes immediately after a
-// crash key has been set on another thread, the value printed on the crash
-// report could be incomplete. The code guarantees defined behavior and does
-// not rely on null-terminated string (in the worst case 32 bytes of random
-// garbage will be printed out).
-
-// The tests live in logging_unittest.cc.
+#include <optional>
+#include <string>
+#include <vector>
 
 namespace perfetto {
 namespace base {
 
-constexpr size_t kCrashKeyMaxStrSize = 32;
-
-// CrashKey instances must be long lived
-class CrashKey {
- public:
-  class ScopedClear {
-   public:
-    explicit ScopedClear(CrashKey* k) : key_(k) {}
-    ~ScopedClear() {
-      if (key_)
-        key_->Clear();
-    }
-    ScopedClear(const ScopedClear&) = delete;
-    ScopedClear& operator=(const ScopedClear&) = delete;
-    ScopedClear& operator=(ScopedClear&&) = delete;
-    ScopedClear(ScopedClear&& other) noexcept : key_(other.key_) {
-      other.key_ = nullptr;
-    }
-
-   private:
-    CrashKey* key_;
-  };
-
-  // constexpr so it can be used in the anon namespace without requiring a
-  // global constructor.
-  // |name| must be a long-lived string.
-  constexpr explicit CrashKey(const char* name)
-      : registered_{}, type_(Type::kUnset), name_(name), str_value_{} {}
-  CrashKey(const CrashKey&) = delete;
-  CrashKey& operator=(const CrashKey&) = delete;
-  CrashKey(CrashKey&&) = delete;
-  CrashKey& operator=(CrashKey&&) = delete;
-
-  enum class Type : uint8_t { kUnset = 0, kInt, kStr };
-
-  void Clear() {
-    int_value_.store(0, std::memory_order_relaxed);
-    type_.store(Type::kUnset, std::memory_order_relaxed);
-  }
-
-  void Set(int64_t value) {
-    int_value_.store(value, std::memory_order_relaxed);
-    type_.store(Type::kInt, std::memory_order_relaxed);
-    if (PERFETTO_UNLIKELY(!registered_.load(std::memory_order_relaxed)))
-      Register();
-  }
-
-  void Set(StringView sv) {
-    size_t len = std::min(sv.size(), sizeof(str_value_) - 1);
-    for (size_t i = 0; i < len; ++i)
-      str_value_[i].store(sv.data()[i], std::memory_order_relaxed);
-    str_value_[len].store('\0', std::memory_order_relaxed);
-    type_.store(Type::kStr, std::memory_order_relaxed);
-    if (PERFETTO_UNLIKELY(!registered_.load(std::memory_order_relaxed)))
-      Register();
-  }
-
-  ScopedClear SetScoped(int64_t value) PERFETTO_WARN_UNUSED_RESULT {
-    Set(value);
-    return ScopedClear(this);
-  }
-
-  ScopedClear SetScoped(StringView sv) PERFETTO_WARN_UNUSED_RESULT {
-    Set(sv);
-    return ScopedClear(this);
-  }
-
-  void Register();
-
-  int64_t int_value() const {
-    return int_value_.load(std::memory_order_relaxed);
-  }
-  size_t ToString(char* dst, size_t len);
-
- private:
-  std::atomic<bool> registered_;
-  std::atomic<Type> type_;
-  const char* const name_;
-  union {
-    std::atomic<char> str_value_[kCrashKeyMaxStrSize];
-    std::atomic<int64_t> int_value_;
-  };
+struct CpuInfo {
+  std::string processor;
+  uint32_t cpu_index = 0;
+  std::optional<uint32_t> implementer;
+  std::optional<uint32_t> architecture;
+  std::optional<uint32_t> variant;
+  std::optional<uint32_t> part;
+  std::optional<uint32_t> revision;
+  uint64_t features = 0;
+  char arm_cpuid[32] = {};
 };
 
-// Fills |dst| with a string containing one line for each crash key
-// (excluding the unset ones).
-// Returns number of chars written, without counting the NUL terminator.
-// This is used in logging.cc when emitting the crash report abort message.
-size_t SerializeCrashKeys(char* dst, size_t len);
+// Parses the contents of the input string into per-CPU entries.
+std::vector<CpuInfo> ParseCpuInfo(std::string proc_cpu_info);
 
-void UnregisterAllCrashKeysForTesting();
+// Reads /proc/cpuinfo and parses it into per-CPU entries.
+std::vector<CpuInfo> ReadCpuInfo();
 
 }  // namespace base
 }  // namespace perfetto
 
-#endif  // INCLUDE_PERFETTO_EXT_BASE_CRASH_KEYS_H_
+#endif  // INCLUDE_PERFETTO_EXT_BASE_CPU_INFO_H_
+// gen_amalgamated begin header: include/perfetto/ext/base/cpu_info_features_allowlist.h
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright (C) 2025 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1724,91 +1615,29 @@ void UnregisterAllCrashKeysForTesting();
  * limitations under the License.
  */
 
-// gen_amalgamated expanded: #include "perfetto/ext/base/crash_keys.h"
-
-#include <string.h>
-
-#include <atomic>
-#include <cinttypes>
-
-// gen_amalgamated expanded: #include "perfetto/ext/base/string_utils.h"
+#ifndef INCLUDE_PERFETTO_EXT_BASE_CPU_INFO_FEATURES_ALLOWLIST_H_
+#define INCLUDE_PERFETTO_EXT_BASE_CPU_INFO_FEATURES_ALLOWLIST_H_
 
 namespace perfetto {
 namespace base {
 
-namespace {
-
-constexpr size_t kMaxKeys = 32;
-
-std::atomic<CrashKey*> g_keys[kMaxKeys]{};
-std::atomic<uint32_t> g_num_keys{};
-}  // namespace
-
-void CrashKey::Register() {
-  // If doesn't matter if we fail below. If there are no slots left, don't
-  // keep trying re-registering on every Set(), the outcome won't change.
-
-  // If two threads raced on the Register(), avoid registering the key twice.
-  if (registered_.exchange(true))
-    return;
-
-  uint32_t slot = g_num_keys.fetch_add(1);
-  if (slot >= kMaxKeys) {
-    PERFETTO_LOG("Too many crash keys registered");
-    return;
-  }
-  g_keys[slot].store(this);
-}
-
-// Returns the number of chars written, without counting the \0.
-size_t CrashKey::ToString(char* dst, size_t len) {
-  if (len > 0)
-    *dst = '\0';
-  switch (type_.load(std::memory_order_relaxed)) {
-    case Type::kUnset:
-      break;
-    case Type::kInt:
-      return SprintfTrunc(dst, len, "%s: %" PRId64 "\n", name_,
-                          int_value_.load(std::memory_order_relaxed));
-    case Type::kStr:
-      char buf[sizeof(str_value_)];
-      for (size_t i = 0; i < sizeof(str_value_); i++)
-        buf[i] = str_value_[i].load(std::memory_order_relaxed);
-
-      // Don't assume |str_value_| is properly null-terminated.
-      return SprintfTrunc(dst, len, "%s: %.*s\n", name_, int(sizeof(buf)), buf);
-  }
-  return 0;
-}
-
-void UnregisterAllCrashKeysForTesting() {
-  g_num_keys.store(0);
-  for (auto& key : g_keys)
-    key.store(nullptr);
-}
-
-size_t SerializeCrashKeys(char* dst, size_t len) {
-  size_t written = 0;
-  uint32_t num_keys = g_num_keys.load();
-  if (len > 0)
-    *dst = '\0';
-  for (uint32_t i = 0; i < num_keys && written < len; i++) {
-    CrashKey* key = g_keys[i].load();
-    if (!key)
-      continue;  // Can happen if we hit this between the add and the store.
-    written += key->ToString(dst + written, len - written);
-  }
-  PERFETTO_DCHECK(written <= len);
-  PERFETTO_DCHECK(len == 0 || dst[written] == '\0');
-  return written;
-}
+// APPEND ONLY. DO NOT EVER REMOVE ENTRIES FROM THIS ARRAY OR REORDER.
+// This array is used both by traced_probes and trace_processor to index the
+// cpuinfo flags. Changing the order will break trace_processor compatibility
+// with old traces.
+constexpr const char* kCpuInfoFeatures[] = {
+    "mte",   // DO NOT REMOVE/REODER.
+    "mte3",  // DO NOT REMOVE/REODER.
+};
 
 }  // namespace base
 }  // namespace perfetto
-// gen_amalgamated begin source: src/base/ctrl_c_handler.cc
-// gen_amalgamated begin header: include/perfetto/ext/base/ctrl_c_handler.h
+
+#endif  // INCLUDE_PERFETTO_EXT_BASE_CPU_INFO_FEATURES_ALLOWLIST_H_
+// gen_amalgamated begin header: include/perfetto/ext/base/file_utils.h
+// gen_amalgamated begin header: include/perfetto/base/status.h
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright (C) 2019 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1823,106 +1652,107 @@ size_t SerializeCrashKeys(char* dst, size_t len) {
  * limitations under the License.
  */
 
-#ifndef INCLUDE_PERFETTO_EXT_BASE_CTRL_C_HANDLER_H_
-#define INCLUDE_PERFETTO_EXT_BASE_CTRL_C_HANDLER_H_
+#ifndef INCLUDE_PERFETTO_BASE_STATUS_H_
+#define INCLUDE_PERFETTO_BASE_STATUS_H_
+
+#include <optional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/base/compiler.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+// gen_amalgamated expanded: #include "perfetto/base/logging.h"
 
 namespace perfetto {
 namespace base {
 
-// On Linux/Android/Mac: installs SIGINT + SIGTERM signal handlers.
-// On Windows: installs a SetConsoleCtrlHandler() handler.
-// The passed handler must be async safe.
-using CtrlCHandlerFunction = void (*)();
-void InstallCtrlCHandler(CtrlCHandlerFunction);
+// Represents either the success or the failure message of a function.
+// This can used as the return type of functions which would usually return an
+// bool for success or int for errno but also wants to add some string context
+// (ususally for logging).
+//
+// Similar to absl::Status, an optional "payload" can also be included with more
+// context about the error. This allows passing additional metadata about the
+// error (e.g. location of errors, potential mitigations etc).
+class PERFETTO_EXPORT_COMPONENT Status {
+ public:
+  Status() : ok_(true) {}
+  explicit Status(std::string msg) : ok_(false), message_(std::move(msg)) {
+    PERFETTO_CHECK(!message_.empty());
+  }
 
-}  // namespace base
-}  // namespace perfetto
+  // Copy operations.
+  Status(const Status&) = default;
+  Status& operator=(const Status&) = default;
 
-#endif  // INCLUDE_PERFETTO_EXT_BASE_CTRL_C_HANDLER_H_
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
+  // Move operations. The moved-from state is valid but unspecified.
+  Status(Status&&) noexcept = default;
+  Status& operator=(Status&&) = default;
 
-// gen_amalgamated expanded: #include "perfetto/ext/base/ctrl_c_handler.h"
+  bool ok() const { return ok_; }
 
-// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
-// gen_amalgamated expanded: #include "perfetto/base/compiler.h"
-// gen_amalgamated expanded: #include "perfetto/base/logging.h"
+  // When ok() is false this returns the error message. Returns the empty string
+  // otherwise.
+  const std::string& message() const { return message_; }
+  const char* c_message() const { return message_.c_str(); }
 
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-#include <windows.h>
+  //////////////////////////////////////////////////////////////////////////////
+  // Payload Management APIs
+  //////////////////////////////////////////////////////////////////////////////
 
-#include <io.h>
-#else
-#include <signal.h>
-#include <unistd.h>
-#endif
+  // Payloads can be attached to error statuses to provide additional context.
+  //
+  // Payloads are (key, value) pairs, where the key is a string acting as a
+  // unique "type URL" and the value is an opaque string. The "type URL" should
+  // be unique, follow the format of a URL and, ideally, documentation on how to
+  // interpret its associated data should be available.
+  //
+  // To attach a payload to a status object, call `Status::SetPayload()`.
+  // Similarly, to extract the payload from a status, call
+  // `Status::GetPayload()`.
+  //
+  // Note: the payload APIs are only meaningful to call when the status is an
+  // error. Otherwise, all methods are noops.
 
-namespace perfetto {
-namespace base {
+  // Gets the payload for the given |type_url| if one exists.
+  //
+  // Will always return std::nullopt if |ok()|.
+  std::optional<std::string_view> GetPayload(std::string_view type_url) const;
 
-namespace {
-CtrlCHandlerFunction g_handler = nullptr;
+  // Sets the payload for the given key. The key should
+  //
+  // Will always do nothing if |ok()|.
+  void SetPayload(std::string_view type_url, std::string value);
 
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-BOOL WINAPI Trampoline(DWORD type) {
-  if (type == CTRL_C_EVENT) {
-    g_handler();
-    return TRUE;
-  }
-  return FALSE;
-}
-#endif
-}  // namespace
+  // Erases the payload for the given string and returns true if the payload
+  // existed and was erased.
+  //
+  // Will always do nothing if |ok()|.
+  bool ErasePayload(std::string_view type_url);
 
-void InstallCtrlCHandler(CtrlCHandlerFunction handler) {
-  PERFETTO_CHECK(g_handler == nullptr);
-  g_handler = handler;
+ private:
+  struct Payload {
+    std::string type_url;
+    std::string payload;
+  };
 
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-  ::SetConsoleCtrlHandler(Trampoline, true);
-#elif PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX) || \
-    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) || \
-    PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)
-  // Setup signal handler.
-  struct sigaction sa{};
+  bool ok_ = false;
+  std::string message_;
+  std::vector<Payload> payloads_;
+};
 
-// Glibc headers for sa_sigaction trigger this.
-#pragma GCC diagnostic push
-#if defined(__clang__)
-#pragma GCC diagnostic ignored "-Wdisabled-macro-expansion"
-#endif
-  sa.sa_handler = [](int) { g_handler(); };
-#if !PERFETTO_BUILDFLAG(PERFETTO_OS_QNX)
-  sa.sa_flags = static_cast<decltype(sa.sa_flags)>(SA_RESETHAND | SA_RESTART);
-#else  // POSIX-compliant
-  sa.sa_flags = static_cast<decltype(sa.sa_flags)>(SA_RESETHAND);
-#endif
-#pragma GCC diagnostic pop
-  sigaction(SIGINT, &sa, nullptr);
-  sigaction(SIGTERM, &sa, nullptr);
-#else
-  // Do nothing on NaCL and Fuchsia.
-  ignore_result(handler);
-#endif
+// Returns a status object which represents the Ok status.
+inline Status OkStatus() {
+  return Status();
 }
 
+Status ErrStatus(const char* format, ...) PERFETTO_PRINTF_FORMAT(1, 2);
+
 }  // namespace base
 }  // namespace perfetto
-// gen_amalgamated begin source: src/base/event_fd.cc
-// gen_amalgamated begin header: include/perfetto/ext/base/event_fd.h
+
+#endif  // INCLUDE_PERFETTO_BASE_STATUS_H_
 // gen_amalgamated begin header: include/perfetto/ext/base/scoped_file.h
 /*
  * Copyright (C) 2017 The Android Open Source Project
@@ -2061,58 +1891,198 @@ using ScopedDir = ScopedResource<DIR*, closedir, nullptr>;
  * limitations under the License.
  */
 
-#ifndef INCLUDE_PERFETTO_EXT_BASE_EVENT_FD_H_
-#define INCLUDE_PERFETTO_EXT_BASE_EVENT_FD_H_
+#ifndef INCLUDE_PERFETTO_EXT_BASE_FILE_UTILS_H_
+#define INCLUDE_PERFETTO_EXT_BASE_FILE_UTILS_H_
+
+#include <fcntl.h>  // For mode_t & O_RDONLY/RDWR. Exists also on Windows.
+#include <stddef.h>
+
+#include <functional>
+#include <memory>
+#include <optional>
+#include <string>
+#include <vector>
 
 // gen_amalgamated expanded: #include "perfetto/base/build_config.h"
-// gen_amalgamated expanded: #include "perfetto/base/platform_handle.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+// gen_amalgamated expanded: #include "perfetto/base/status.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/scoped_file.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/sys_types.h"
 
 namespace perfetto {
 namespace base {
 
-// A waitable event that can be used with poll/select.
-// This is really a wrapper around eventfd_create with a pipe-based fallback
-// for other platforms where eventfd is not supported.
-class EventFd {
- public:
-  EventFd();
-  ~EventFd();
-  EventFd(EventFd&&) noexcept = default;
-  EventFd& operator=(EventFd&&) = default;
+class TaskRunner;
 
-  // The non-blocking file descriptor that can be polled to wait for the event.
-  PlatformHandle fd() const { return event_handle_.get(); }
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+using FileOpenMode = int;
+inline constexpr char kDevNull[] = "NUL";
+inline constexpr char kFopenReadFlag[] = "r";
+#else
+using FileOpenMode = mode_t;
+inline constexpr char kDevNull[] = "/dev/null";
+inline constexpr char kFopenReadFlag[] = "re";
+#endif
 
-  // Can be called from any thread.
-  void Notify();
+constexpr FileOpenMode kFileModeInvalid = static_cast<FileOpenMode>(-1);
 
-  // Can be called from any thread. If more Notify() are queued a Clear() call
-  // can clear all of them (up to 16 per call).
-  void Clear();
+// Cross-platform variant of ReadFileDescriptor() that takes a PlatformHandle.
+// On Windows normalizes ERROR_BROKEN_PIPE to EOF so behavior matches POSIX.
+bool ReadPlatformHandle(PlatformHandle, std::string* out);
 
- private:
-  // The eventfd, when eventfd is supported, otherwise this is the read end of
-  // the pipe for fallback mode.
-  ScopedPlatformHandle event_handle_;
+// Reads from |fd|, appending what is currently available into |*out|.
+// Returns:
+//  True: EOF reached (all writers of |fd| have closed their end).
+//  False: read error. On a non-blocking |fd| this includes EAGAIN (no data
+//    currently available but writers are still alive); callers can check
+//    IsAgain(errno) and retry on the next readability notification.
+bool ReadFileDescriptor(int fd, std::string* out);
 
-// QNX is specified because it is a non-Linux UNIX platform but it
-// still sets the PERFETTO_OS_LINUX flag to be as compatible as possible
-// with the Linux build.
-#if !PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX_BUT_NOT_QNX) && \
-    !PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) &&           \
-    !PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-  // On Mac and other non-Linux UNIX platforms a pipe-based fallback is used.
-  // The write end of the wakeup pipe.
-  ScopedFile write_fd_;
-#endif
+// Convenience wrapper around ReadFileDescriptor() that takes a FILE*.
+bool ReadFileStream(FILE* f, std::string* out);
+
+// Opens |path| read-only and reads its contents into |*out|.
+// Returns false if the file cannot be opened.
+bool ReadFile(const std::string& path, std::string* out);
+
+// A wrapper around read(2). It deals with Linux vs Windows includes. It also
+// deals with handling EINTR. Has the same semantics of UNIX's read(2).
+ssize_t Read(int fd, void* dst, size_t dst_size);
+
+// Call write until all data is written or an error is detected.
+//
+// man 2 write:
+//   If a write() is interrupted by a signal handler before any bytes are
+//   written, then the call fails with the error EINTR; if it is
+//   interrupted after at least one byte has been written, the call
+//   succeeds, and returns the number of bytes written.
+ssize_t WriteAll(int fd, const void* buf, size_t count);
+
+// Copies all data from |fd_in| to |fd_out|. Saves the offset of |fd_in|,
+// rewinds it to the beginning, copies the content, and restores the offset.
+// |fd_in| can't be a pipe, socket of FIFO.
+base::Status CopyFileContents(int fd_in, int fd_out);
+
+ssize_t WriteAllHandle(PlatformHandle, const void* buf, size_t count);
+
+ScopedFile OpenFile(const std::string& path,
+                    int flags,
+                    FileOpenMode = kFileModeInvalid);
+ScopedFstream OpenFstream(const std::string& path, const std::string& mode);
+
+// This is an alias for close(). It's to avoid leaking windows.h in headers.
+// Exported because ScopedFile is used in the /include/ext API by Chromium
+// component builds.
+int PERFETTO_EXPORT_COMPONENT CloseFile(int fd);
+
+bool FlushFile(int fd);
+
+// Returns true if mkdir succeeds, false if it fails (see errno in that case).
+// `mode` is the permission bits for the new directory; it is ignored on
+// Windows.
+bool Mkdir(const std::string& path, uint32_t mode = 0755);
+
+// Calls rmdir() on UNIX, _rmdir() on Windows.
+bool Rmdir(const std::string& path);
+
+// Removes a file: unlink() on UNIX, _unlink() on Windows. Takes a const char*
+// and is async-signal-safe on POSIX, so it's callable from a signal handler.
+bool Unlink(const char* path);
+
+// Wrapper around access(path, F_OK).
+bool FileExists(const std::string& path);
+
+// Gets the extension for a filename. If the file has two extensions, returns
+// only the last one (foo.pb.gz => .gz). Returns empty string if there is no
+// extension.
+std::string GetFileExtension(const std::string& filename);
+
+// Returns the basename component of a path (the final component after the last
+// directory separator). Behaves like man 2 basename, but works with both '/'
+// and '\' separators for cross-platform compatibility.
+// Examples:
+//   Basename("/usr/bin/ls") => "ls"
+//   Basename("/usr/bin/") => "bin"
+//   Basename("/") => "/"
+//   Basename("foo") => "foo"
+//   Basename("") => "."
+//   Basename("C:\\Windows\\System32") => "System32"
+std::string Basename(const std::string& path);
+
+// Returns the directory component of a path (everything up to but not
+// including the final component). Behaves like man 2 dirname, but works with
+// both '/' and '\' separators for cross-platform compatibility.
+// Examples:
+//   Dirname("/usr/bin/ls") => "/usr/bin"
+//   Dirname("/usr/bin") => "/usr"
+//   Dirname("/") => "/"
+//   Dirname("foo") => "."
+//   Dirname("") => "."
+//   Dirname("C:\\Windows\\System32") => "C:\\Windows"
+std::string Dirname(const std::string& path);
+
+// Puts the path to all files under |dir_path| in |output|, recursively walking
+// subdirectories. File paths are relative to |dir_path|. Only files are
+// included, not directories. Path separator is always '/', even on windows (not
+// '\').
+base::Status ListFilesRecursive(const std::string& dir_path,
+                                std::vector<std::string>& output);
+
+// Lists immediate subdirectories in |dir_path| (non-recursive). Directory names
+// are relative to |dir_path| and do not include the path separator. Returns
+// only directories, not files. Works on both Unix and Windows.
+base::Status ListDirectories(const std::string& dir_path,
+                             std::vector<std::string>& output);
+
+// Sets |path|'s owner group to |group_name| and permission mode bits to
+// |mode_bits|.
+base::Status SetFilePermissions(const std::string& path,
+                                const std::string& group_name,
+                                const std::string& mode_bits);
+
+// Returns the size of the file located at |path|, or nullopt in case of error.
+std::optional<uint64_t> GetFileSize(const std::string& path);
+
+// Returns the size of the open file |fd|, or nullopt in case of error.
+std::optional<uint64_t> GetFileSize(PlatformHandle fd);
+
+// This class uses inotify (on Linux/Android) to watch for the creation of
+// files in the filesystem. When the specified file is created, it triggers a
+// callback function.
+// Destroying the returned unique_ptr will automatically unregister the watch.
+//
+// Note: This only works with filesystem paths (not abstract sockets or other
+// special file types).
+// It's only supported on Linux and Android, it's a no-op (returns nullptr) on
+// other platforms.
+//
+// Usage:
+//   auto watch = LinuxFileWatch::WatchFileCreation(
+//       task_runner, "/tmp/my_file", []() {
+//         // Called when /tmp/my_file is created
+//       });
+class LinuxFileWatch {
+ public:
+  // Creates a watcher for file creation. Returns nullptr if the path is not a
+  // valid filesystem path or if the platform doesn't support inotify. The
+  // callback will be invoked on the provided TaskRunner when the file is
+  // created.
+  static std::unique_ptr<LinuxFileWatch> WatchFileCreation(
+      TaskRunner*,
+      const char* path,
+      std::function<void()> callback);
+
+  virtual ~LinuxFileWatch();
+
+ protected:
+  LinuxFileWatch() = default;
 };
 
 }  // namespace base
 }  // namespace perfetto
 
-#endif  // INCLUDE_PERFETTO_EXT_BASE_EVENT_FD_H_
-// gen_amalgamated begin header: include/perfetto/ext/base/pipe.h
+#endif  // INCLUDE_PERFETTO_EXT_BASE_FILE_UTILS_H_
+// gen_amalgamated begin header: include/perfetto/ext/base/string_splitter.h
 /*
  * Copyright (C) 2018 The Android Open Source Project
  *
@@ -2129,42 +2099,93 @@ class EventFd {
  * limitations under the License.
  */
 
-#ifndef INCLUDE_PERFETTO_EXT_BASE_PIPE_H_
-#define INCLUDE_PERFETTO_EXT_BASE_PIPE_H_
+#ifndef INCLUDE_PERFETTO_EXT_BASE_STRING_SPLITTER_H_
+#define INCLUDE_PERFETTO_EXT_BASE_STRING_SPLITTER_H_
 
-// gen_amalgamated expanded: #include "perfetto/base/platform_handle.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/scoped_file.h"
+#include <string>
 
 namespace perfetto {
 namespace base {
 
-class Pipe {
+// C++ version of strtok(). Splits a string without making copies or any heap
+// allocations. Destructs the original string passed in input.
+// Supports the special case of using \0 as a delimiter.
+// The token returned in output are valid as long as the input string is valid.
+class StringSplitter {
  public:
-  enum Flags {
-    kBothBlock = 0,
-#if !PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-    kBothNonBlock,
-    kRdNonBlock,
-    kWrNonBlock,
-#endif
+  // Whether an empty string (two delimiters side-to-side) is a valid token.
+  enum class EmptyTokenMode {
+    DISALLOW_EMPTY_TOKENS,
+    ALLOW_EMPTY_TOKENS,
+
+    DEFAULT = DISALLOW_EMPTY_TOKENS,
   };
 
-  static Pipe Create(Flags = kBothBlock);
+  // Can take ownership of the string if passed via std::move(), e.g.:
+  // StringSplitter(std::move(str), '\n');
+  StringSplitter(std::string,
+                 char delimiter,
+                 EmptyTokenMode empty_token_mode = EmptyTokenMode::DEFAULT);
 
-  Pipe();
-  Pipe(Pipe&&) noexcept;
-  Pipe& operator=(Pipe&&);
+  // Splits a C-string. The input string will be forcefully null-terminated (so
+  // str[size - 1] should be == '\0' or the last char will be truncated).
+  StringSplitter(char* str,
+                 size_t size,
+                 char delimiter,
+                 EmptyTokenMode empty_token_mode = EmptyTokenMode::DEFAULT);
 
-  ScopedPlatformHandle rd;
-  ScopedPlatformHandle wr;
+  // Splits the current token from an outer StringSplitter instance. This is to
+  // chain splitters as follows:
+  // for (base::StringSplitter lines(x, '\n'); ss.Next();)
+  //   for (base::StringSplitter words(&lines, ' '); words.Next();)
+  StringSplitter(StringSplitter*,
+                 char delimiter,
+                 EmptyTokenMode empty_token_mode = EmptyTokenMode::DEFAULT);
+
+  // Returns true if a token is found (in which case it will be stored in
+  // cur_token()), false if no more tokens are found.
+  bool Next();
+
+  // Returns the next token if found (in which case it will be stored in
+  // cur_token()), nullptr if no more tokens are found.
+  char* NextToken() { return Next() ? cur_token() : nullptr; }
+
+  // Returns the current token iff last call to Next() returned true. In this
+  // case it guarantees that the returned string is always null terminated.
+  // In all other cases (before the 1st call to Next() and after Next() returns
+  // false) returns nullptr.
+  char* cur_token() { return cur_; }
+
+  // Returns the length of the current token (excluding the null terminator).
+  size_t cur_token_size() const { return cur_size_; }
+
+  // Return the untokenized remainder of the input string that occurs after the
+  // current token.
+  char* remainder() { return next_; }
+
+  // Returns the size of the untokenized input
+  size_t remainder_size() { return static_cast<size_t>(end_ - next_); }
+
+ private:
+  StringSplitter(const StringSplitter&) = delete;
+  StringSplitter& operator=(const StringSplitter&) = delete;
+  void Initialize(char* str, size_t size);
+
+  std::string str_;
+  char* cur_;
+  size_t cur_size_;
+  char* next_;
+  char* end_;  // STL-style, points one past the last char.
+  const char delimiter_;
+  const EmptyTokenMode empty_token_mode_;
 };
 
 }  // namespace base
 }  // namespace perfetto
 
-#endif  // INCLUDE_PERFETTO_EXT_BASE_PIPE_H_
+#endif  // INCLUDE_PERFETTO_EXT_BASE_STRING_SPLITTER_H_
 /*
- * Copyright (C) 2018 The Android Open Source Project
+ * Copyright (C) 2026 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2179,110 +2200,166 @@ class Pipe {
  * limitations under the License.
  */
 
-// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
-
-#include <errno.h>
-#include <stdint.h>
-
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-#include <windows.h>
-
-#include <synchapi.h>
-#elif PERFETTO_BUILDFLAG(PERFETTO_OS_QNX)
-#include <unistd.h>
-#elif PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX) || \
-    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
-#include <sys/eventfd.h>
-#include <unistd.h>
-#else  // Mac, Fuchsia and other non-Linux UNIXes
-#include <unistd.h>
-#endif
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
 
-// gen_amalgamated expanded: #include "perfetto/base/logging.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/event_fd.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/pipe.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/cpu_info.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/cpu_info_features_allowlist.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/file_utils.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/string_splitter.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/string_utils.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/utils.h"
 
 namespace perfetto {
 namespace base {
+namespace {
 
-EventFd::~EventFd() = default;
+// Key for default processor string in /proc/cpuinfo as seen on arm. Note the
+// uppercase P.
+const char kDefaultProcessor[] = "Processor";
 
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-EventFd::EventFd() {
-  event_handle_.reset(
-      CreateEventA(/*lpEventAttributes=*/nullptr, /*bManualReset=*/true,
-                   /*bInitialState=*/false, /*bInitialState=*/nullptr));
-}
+// Key for processor entry in /proc/cpuinfo. Used to determine whether a group
+// of lines describes a CPU.
+const char kProcessor[] = "processor";
 
-void EventFd::Notify() {
-  if (!SetEvent(event_handle_.get()))  // 0: fail, !0: success, unlike UNIX.
-    PERFETTO_DFATAL("EventFd::Notify()");
-}
+// Key for CPU implementer in /proc/cpuinfo. Arm only.
+const char kImplementer[] = "CPU implementer";
 
-void EventFd::Clear() {
-  if (!ResetEvent(event_handle_.get()))  // 0: fail, !0: success, unlike UNIX.
-    PERFETTO_DFATAL("EventFd::Clear()");
-}
+// Key for CPU architecture in /proc/cpuinfo. Arm only.
+const char kArchitecture[] = "CPU architecture";
 
-#elif PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX_BUT_NOT_QNX) || \
-    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
+// Key for CPU variant in /proc/cpuinfo. Arm only.
+const char kVariant[] = "CPU variant";
 
-EventFd::EventFd() {
-  event_handle_.reset(eventfd(/*initval=*/0, EFD_CLOEXEC | EFD_NONBLOCK));
-  PERFETTO_CHECK(event_handle_);
-}
+// Key for CPU part in /proc/cpuinfo. Arm only.
+const char kPart[] = "CPU part";
 
-void EventFd::Notify() {
-  const uint64_t value = 1;
-  ssize_t ret = write(event_handle_.get(), &value, sizeof(value));
-  if (ret <= 0 && errno != EAGAIN)
-    PERFETTO_DFATAL("EventFd::Notify()");
-}
+// Key for CPU revision in /proc/cpuinfo. Arm only.
+const char kRevision[] = "CPU revision";
 
-void EventFd::Clear() {
-  uint64_t value;
-  ssize_t ret =
-      PERFETTO_EINTR(read(event_handle_.get(), &value, sizeof(value)));
-  if (ret <= 0 && errno != EAGAIN)
-    PERFETTO_DFATAL("EventFd::Clear()");
+// Key for feature flags in /proc/cpuinfo. Arm calls them Features,
+// Intel calls them Flags.
+const char kFeatures[] = "Features";
+const char kFlags[] = "Flags";
+
+std::string ReadFile(const std::string& path) {
+  std::string contents;
+  if (!base::ReadFile(path, &contents))
+    return "";
+  return contents;
 }
 
-#else
+}  // namespace
 
-EventFd::EventFd() {
-  // Make the pipe non-blocking so that we never block the waking thread (either
-  // the main thread or another one) when scheduling a wake-up.
-  Pipe pipe = Pipe::Create(Pipe::kBothNonBlock);
-  event_handle_ = ScopedPlatformHandle(std::move(pipe.rd).release());
-  write_fd_ = std::move(pipe.wr);
-}
+std::vector<CpuInfo> ParseCpuInfo(std::string proc_cpu_info) {
+  std::vector<CpuInfo> cpus;
+  std::string processor = "unknown";
+
+  std::optional<uint32_t> cpu_index;
+  std::optional<uint32_t> implementer;
+  std::optional<uint32_t> architecture;
+  std::optional<uint32_t> variant;
+  std::optional<uint32_t> part;
+  std::optional<uint32_t> revision;
+  uint64_t features = 0;
+  uint32_t next_cpu_index = 0;
+
+  auto flush_cpu = [&] {
+    if (cpu_index.has_value()) {
+      CpuInfo cpu{};
+      cpu.processor = processor;
+      cpu.cpu_index = *cpu_index;
+      cpu.implementer = implementer;
+      cpu.architecture = architecture;
+      cpu.variant = variant;
+      cpu.part = part;
+      cpu.revision = revision;
+      cpu.features = features;
+#if PERFETTO_BUILDFLAG(PERFETTO_ARCH_CPU_ARM64)
+      if (cpu.implementer && cpu.part) {
+        std::string cpuid =
+            base::Uint64ToHexStringNoPrefix(cpu.implementer.value()) +
+            base::Uint64ToHexStringNoPrefix(cpu.part.value());
+        if (cpu.variant) {
+          cpuid += base::Uint64ToHexStringNoPrefix(cpu.variant.value());
+          if (cpu.revision) {
+            cpuid += base::Uint64ToHexStringNoPrefix(cpu.revision.value());
+          }
+        }
+        base::StringCopy(cpu.arm_cpuid, cpuid.c_str(), sizeof(cpu.arm_cpuid));
+      }
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_ARCH_CPU_ARM64)
+      cpus.emplace_back(std::move(cpu));
+      next_cpu_index++;
+    }
+    cpu_index = std::nullopt;
+    implementer = std::nullopt;
+    architecture = std::nullopt;
+    variant = std::nullopt;
+    part = std::nullopt;
+    revision = std::nullopt;
+    features = 0;
+  };
 
-void EventFd::Notify() {
-  const uint64_t value = 1;
-  ssize_t ret = write(write_fd_.get(), &value, sizeof(uint8_t));
-  if (ret <= 0 && errno != EAGAIN)
-    PERFETTO_DFATAL("EventFd::Notify()");
+  for (base::StringSplitter lines(
+           std::move(proc_cpu_info), '\n',
+           base::StringSplitter::EmptyTokenMode::ALLOW_EMPTY_TOKENS);
+       lines.Next();) {
+    std::string line(lines.cur_token(), lines.cur_token_size());
+    if (line.empty() && cpu_index.has_value()) {
+      flush_cpu();
+      continue;
+    }
+
+    auto splits = base::SplitString(line, ":");
+    if (splits.size() != 2)
+      continue;
+    std::string key =
+        base::StripSuffix(base::StripChars(splits[0], "\t", ' '), " ");
+    std::string value = base::StripPrefix(splits[1], " ");
+
+    if (key == kDefaultProcessor) {
+      processor = value;
+    } else if (key == kProcessor) {
+      cpu_index = base::StringToUInt32(value);
+    } else if (key == kImplementer) {
+      implementer = base::CStringToUInt32(value.data(), 16);
+    } else if (key == kArchitecture) {
+      architecture = base::CStringToUInt32(value.data(), 10);
+    } else if (key == kVariant) {
+      variant = base::CStringToUInt32(value.data(), 16);
+    } else if (key == kPart) {
+      part = base::CStringToUInt32(value.data(), 16);
+    } else if (key == kRevision) {
+      revision = base::CStringToUInt32(value.data(), 10);
+    } else if (key == kFeatures || key == kFlags) {
+      for (base::StringSplitter ss(value.data(), ' '); ss.Next();) {
+        for (size_t i = 0; i < base::ArraySize(kCpuInfoFeatures); ++i) {
+          if (strcmp(ss.cur_token(), kCpuInfoFeatures[i]) == 0) {
+            static_assert(base::ArraySize(kCpuInfoFeatures) < 64);
+            features |= 1ull << i;
+          }
+        }
+      }
+    }
+  }
+
+  flush_cpu();
+  return cpus;
 }
 
-void EventFd::Clear() {
-  // Drain the byte(s) written to the wake-up pipe. We can potentially read
-  // more than one byte if several wake-ups have been scheduled.
-  char buffer[16];
-  ssize_t ret =
-      PERFETTO_EINTR(read(event_handle_.get(), &buffer[0], sizeof(buffer)));
-  if (ret <= 0 && errno != EAGAIN)
-    PERFETTO_DFATAL("EventFd::Clear()");
+std::vector<CpuInfo> ReadCpuInfo() {
+  return ParseCpuInfo(ReadFile("/proc/cpuinfo"));
 }
-#endif
 
 }  // namespace base
 }  // namespace perfetto
-// gen_amalgamated begin source: src/base/file_utils.cc
-// gen_amalgamated begin header: include/perfetto/ext/base/file_utils.h
-// gen_amalgamated begin header: include/perfetto/base/status.h
+// gen_amalgamated begin source: src/base/crash_keys.cc
+// gen_amalgamated begin header: include/perfetto/ext/base/crash_keys.h
 /*
- * Copyright (C) 2019 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2297,107 +2374,695 @@ void EventFd::Clear() {
  * limitations under the License.
  */
 
-#ifndef INCLUDE_PERFETTO_BASE_STATUS_H_
-#define INCLUDE_PERFETTO_BASE_STATUS_H_
+#ifndef INCLUDE_PERFETTO_EXT_BASE_CRASH_KEYS_H_
+#define INCLUDE_PERFETTO_EXT_BASE_CRASH_KEYS_H_
 
-#include <optional>
-#include <string>
-#include <string_view>
-#include <vector>
+#include <algorithm>
+#include <atomic>
+
+#include <stdint.h>
+#include <string.h>
 
 // gen_amalgamated expanded: #include "perfetto/base/compiler.h"
-// gen_amalgamated expanded: #include "perfetto/base/export.h"
-// gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/string_view.h"
+
+// Crash keys are very simple global variables with static-storage that
+// are reported on crash time for managed crashes (CHECK/FATAL/Watchdog).
+// - Translation units can define a CrashKey and register it at some point
+//   during initialization.
+// - CrashKey instances must be long-lived. They should really be just global
+//   static variable in the anonymous namespace.
+// Example:
+// subsystem_1.cc
+//   CrashKey g_client_id("ipc_client_id");
+//   ...
+//   OnIpcReceived(client_id) {
+//      g_client_id.Set(client_id);
+//      ... // Process the IPC
+//      g_client_id.Clear();
+//   }
+//   Or equivalently:
+//   OnIpcReceived(client_id) {
+//      auto scoped_key = g_client_id.SetScoped(client_id);
+//      ... // Process the IPC
+//   }
+//
+// If a crash happens while processing the IPC, the crash report will
+// have a line "ipc_client_id: 42".
+//
+// Thread safety considerations:
+// CrashKeys can be registered and set/cleared from any thread.
+// There is no compelling use-case to have full acquire/release consistency when
+// setting a key. This means that if a thread crashes immediately after a
+// crash key has been set on another thread, the value printed on the crash
+// report could be incomplete. The code guarantees defined behavior and does
+// not rely on null-terminated string (in the worst case 32 bytes of random
+// garbage will be printed out).
+
+// The tests live in logging_unittest.cc.
 
 namespace perfetto {
 namespace base {
 
-// Represents either the success or the failure message of a function.
-// This can used as the return type of functions which would usually return an
-// bool for success or int for errno but also wants to add some string context
-// (ususally for logging).
-//
-// Similar to absl::Status, an optional "payload" can also be included with more
-// context about the error. This allows passing additional metadata about the
-// error (e.g. location of errors, potential mitigations etc).
-class PERFETTO_EXPORT_COMPONENT Status {
+constexpr size_t kCrashKeyMaxStrSize = 32;
+
+// CrashKey instances must be long lived
+class CrashKey {
  public:
-  Status() : ok_(true) {}
-  explicit Status(std::string msg) : ok_(false), message_(std::move(msg)) {
-    PERFETTO_CHECK(!message_.empty());
-  }
+  class ScopedClear {
+   public:
+    explicit ScopedClear(CrashKey* k) : key_(k) {}
+    ~ScopedClear() {
+      if (key_)
+        key_->Clear();
+    }
+    ScopedClear(const ScopedClear&) = delete;
+    ScopedClear& operator=(const ScopedClear&) = delete;
+    ScopedClear& operator=(ScopedClear&&) = delete;
+    ScopedClear(ScopedClear&& other) noexcept : key_(other.key_) {
+      other.key_ = nullptr;
+    }
 
-  // Copy operations.
-  Status(const Status&) = default;
-  Status& operator=(const Status&) = default;
+   private:
+    CrashKey* key_;
+  };
 
-  // Move operations. The moved-from state is valid but unspecified.
-  Status(Status&&) noexcept = default;
-  Status& operator=(Status&&) = default;
+  // constexpr so it can be used in the anon namespace without requiring a
+  // global constructor.
+  // |name| must be a long-lived string.
+  constexpr explicit CrashKey(const char* name)
+      : registered_{}, type_(Type::kUnset), name_(name), str_value_{} {}
+  CrashKey(const CrashKey&) = delete;
+  CrashKey& operator=(const CrashKey&) = delete;
+  CrashKey(CrashKey&&) = delete;
+  CrashKey& operator=(CrashKey&&) = delete;
 
-  bool ok() const { return ok_; }
+  enum class Type : uint8_t { kUnset = 0, kInt, kStr };
 
-  // When ok() is false this returns the error message. Returns the empty string
-  // otherwise.
-  const std::string& message() const { return message_; }
-  const char* c_message() const { return message_.c_str(); }
+  void Clear() {
+    int_value_.store(0, std::memory_order_relaxed);
+    type_.store(Type::kUnset, std::memory_order_relaxed);
+  }
 
-  //////////////////////////////////////////////////////////////////////////////
-  // Payload Management APIs
-  //////////////////////////////////////////////////////////////////////////////
+  void Set(int64_t value) {
+    int_value_.store(value, std::memory_order_relaxed);
+    type_.store(Type::kInt, std::memory_order_relaxed);
+    if (PERFETTO_UNLIKELY(!registered_.load(std::memory_order_relaxed)))
+      Register();
+  }
 
-  // Payloads can be attached to error statuses to provide additional context.
-  //
-  // Payloads are (key, value) pairs, where the key is a string acting as a
-  // unique "type URL" and the value is an opaque string. The "type URL" should
-  // be unique, follow the format of a URL and, ideally, documentation on how to
-  // interpret its associated data should be available.
-  //
-  // To attach a payload to a status object, call `Status::SetPayload()`.
-  // Similarly, to extract the payload from a status, call
-  // `Status::GetPayload()`.
-  //
-  // Note: the payload APIs are only meaningful to call when the status is an
-  // error. Otherwise, all methods are noops.
+  void Set(StringView sv) {
+    size_t len = std::min(sv.size(), sizeof(str_value_) - 1);
+    for (size_t i = 0; i < len; ++i)
+      str_value_[i].store(sv.data()[i], std::memory_order_relaxed);
+    str_value_[len].store('\0', std::memory_order_relaxed);
+    type_.store(Type::kStr, std::memory_order_relaxed);
+    if (PERFETTO_UNLIKELY(!registered_.load(std::memory_order_relaxed)))
+      Register();
+  }
 
-  // Gets the payload for the given |type_url| if one exists.
-  //
-  // Will always return std::nullopt if |ok()|.
-  std::optional<std::string_view> GetPayload(std::string_view type_url) const;
+  ScopedClear SetScoped(int64_t value) PERFETTO_WARN_UNUSED_RESULT {
+    Set(value);
+    return ScopedClear(this);
+  }
 
-  // Sets the payload for the given key. The key should
-  //
-  // Will always do nothing if |ok()|.
-  void SetPayload(std::string_view type_url, std::string value);
+  ScopedClear SetScoped(StringView sv) PERFETTO_WARN_UNUSED_RESULT {
+    Set(sv);
+    return ScopedClear(this);
+  }
 
-  // Erases the payload for the given string and returns true if the payload
-  // existed and was erased.
-  //
-  // Will always do nothing if |ok()|.
-  bool ErasePayload(std::string_view type_url);
+  void Register();
+
+  int64_t int_value() const {
+    return int_value_.load(std::memory_order_relaxed);
+  }
+  size_t ToString(char* dst, size_t len);
 
  private:
-  struct Payload {
-    std::string type_url;
-    std::string payload;
+  std::atomic<bool> registered_;
+  std::atomic<Type> type_;
+  const char* const name_;
+  union {
+    std::atomic<char> str_value_[kCrashKeyMaxStrSize];
+    std::atomic<int64_t> int_value_;
   };
+};
 
-  bool ok_ = false;
-  std::string message_;
-  std::vector<Payload> payloads_;
+// Fills |dst| with a string containing one line for each crash key
+// (excluding the unset ones).
+// Returns number of chars written, without counting the NUL terminator.
+// This is used in logging.cc when emitting the crash report abort message.
+size_t SerializeCrashKeys(char* dst, size_t len);
+
+void UnregisterAllCrashKeysForTesting();
+
+}  // namespace base
+}  // namespace perfetto
+
+#endif  // INCLUDE_PERFETTO_EXT_BASE_CRASH_KEYS_H_
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/crash_keys.h"
+
+#include <string.h>
+
+#include <atomic>
+#include <cinttypes>
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/string_utils.h"
+
+namespace perfetto {
+namespace base {
+
+namespace {
+
+constexpr size_t kMaxKeys = 32;
+
+std::atomic<CrashKey*> g_keys[kMaxKeys]{};
+std::atomic<uint32_t> g_num_keys{};
+}  // namespace
+
+void CrashKey::Register() {
+  // If doesn't matter if we fail below. If there are no slots left, don't
+  // keep trying re-registering on every Set(), the outcome won't change.
+
+  // If two threads raced on the Register(), avoid registering the key twice.
+  if (registered_.exchange(true))
+    return;
+
+  uint32_t slot = g_num_keys.fetch_add(1);
+  if (slot >= kMaxKeys) {
+    PERFETTO_LOG("Too many crash keys registered");
+    return;
+  }
+  g_keys[slot].store(this);
+}
+
+// Returns the number of chars written, without counting the \0.
+size_t CrashKey::ToString(char* dst, size_t len) {
+  if (len > 0)
+    *dst = '\0';
+  switch (type_.load(std::memory_order_relaxed)) {
+    case Type::kUnset:
+      break;
+    case Type::kInt:
+      return SprintfTrunc(dst, len, "%s: %" PRId64 "\n", name_,
+                          int_value_.load(std::memory_order_relaxed));
+    case Type::kStr:
+      char buf[sizeof(str_value_)];
+      for (size_t i = 0; i < sizeof(str_value_); i++)
+        buf[i] = str_value_[i].load(std::memory_order_relaxed);
+
+      // Don't assume |str_value_| is properly null-terminated.
+      return SprintfTrunc(dst, len, "%s: %.*s\n", name_, int(sizeof(buf)), buf);
+  }
+  return 0;
+}
+
+void UnregisterAllCrashKeysForTesting() {
+  g_num_keys.store(0);
+  for (auto& key : g_keys)
+    key.store(nullptr);
+}
+
+size_t SerializeCrashKeys(char* dst, size_t len) {
+  size_t written = 0;
+  uint32_t num_keys = g_num_keys.load();
+  if (len > 0)
+    *dst = '\0';
+  for (uint32_t i = 0; i < num_keys && written < len; i++) {
+    CrashKey* key = g_keys[i].load();
+    if (!key)
+      continue;  // Can happen if we hit this between the add and the store.
+    written += key->ToString(dst + written, len - written);
+  }
+  PERFETTO_DCHECK(written <= len);
+  PERFETTO_DCHECK(len == 0 || dst[written] == '\0');
+  return written;
+}
+
+}  // namespace base
+}  // namespace perfetto
+// gen_amalgamated begin source: src/base/ctrl_c_handler.cc
+// gen_amalgamated begin header: include/perfetto/ext/base/ctrl_c_handler.h
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INCLUDE_PERFETTO_EXT_BASE_CTRL_C_HANDLER_H_
+#define INCLUDE_PERFETTO_EXT_BASE_CTRL_C_HANDLER_H_
+
+namespace perfetto {
+namespace base {
+
+// On Linux/Android/Mac: installs SIGINT + SIGTERM signal handlers.
+// On Windows: installs a SetConsoleCtrlHandler() handler.
+// The passed handler must be async safe.
+using CtrlCHandlerFunction = void (*)();
+void InstallCtrlCHandler(CtrlCHandlerFunction);
+
+}  // namespace base
+}  // namespace perfetto
+
+#endif  // INCLUDE_PERFETTO_EXT_BASE_CTRL_C_HANDLER_H_
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/ctrl_c_handler.h"
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+// gen_amalgamated expanded: #include "perfetto/base/compiler.h"
+// gen_amalgamated expanded: #include "perfetto/base/logging.h"
+
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+#include <windows.h>
+
+#include <io.h>
+#else
+#include <signal.h>
+#include <unistd.h>
+#endif
+
+namespace perfetto {
+namespace base {
+
+namespace {
+CtrlCHandlerFunction g_handler = nullptr;
+
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+BOOL WINAPI Trampoline(DWORD type) {
+  if (type == CTRL_C_EVENT) {
+    g_handler();
+    return TRUE;
+  }
+  return FALSE;
+}
+#endif
+}  // namespace
+
+void InstallCtrlCHandler(CtrlCHandlerFunction handler) {
+  PERFETTO_CHECK(g_handler == nullptr);
+  g_handler = handler;
+
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  ::SetConsoleCtrlHandler(Trampoline, true);
+#elif PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX) || \
+    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) || \
+    PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)
+  // Setup signal handler.
+  struct sigaction sa{};
+
+// Glibc headers for sa_sigaction trigger this.
+#pragma GCC diagnostic push
+#if defined(__clang__)
+#pragma GCC diagnostic ignored "-Wdisabled-macro-expansion"
+#endif
+  sa.sa_handler = [](int) { g_handler(); };
+#if !PERFETTO_BUILDFLAG(PERFETTO_OS_QNX)
+  sa.sa_flags = static_cast<decltype(sa.sa_flags)>(SA_RESETHAND | SA_RESTART);
+#else  // POSIX-compliant
+  sa.sa_flags = static_cast<decltype(sa.sa_flags)>(SA_RESETHAND);
+#endif
+#pragma GCC diagnostic pop
+  sigaction(SIGINT, &sa, nullptr);
+  sigaction(SIGTERM, &sa, nullptr);
+#else
+  // Do nothing on NaCL and Fuchsia.
+  ignore_result(handler);
+#endif
+}
+
+}  // namespace base
+}  // namespace perfetto
+// gen_amalgamated begin source: src/base/dynamic_string_writer.cc
+// gen_amalgamated begin header: include/perfetto/ext/base/dynamic_string_writer.h
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INCLUDE_PERFETTO_EXT_BASE_DYNAMIC_STRING_WRITER_H_
+#define INCLUDE_PERFETTO_EXT_BASE_DYNAMIC_STRING_WRITER_H_
+
+#include <string.h>
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <cstdlib>
+#include <limits>
+#include <memory>
+#include <type_traits>
+
+// gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/string_utils.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/string_view.h"
+
+namespace perfetto {
+namespace base {
+
+// A helper class which writes formatted data to a string buffer.
+// This is used in the trace processor where we write O(GBs) of strings and
+// sprintf is too slow.
+class DynamicStringWriter {
+ public:
+  using ScopedCString = std::unique_ptr<char, void (*)(void*)>;
+
+  // Creates a string buffer from a char buffer and length.
+  DynamicStringWriter() {}
+
+  // Appends n instances of a char to the buffer.
+  void AppendChar(char in, size_t n = 1) { buffer_.append(n, in); }
+
+  // Appends a length delimited string to the buffer.
+  void AppendString(const char* in, size_t n) { buffer_.append(in, n); }
+
+  void AppendStringView(StringView sv) { AppendString(sv.data(), sv.size()); }
+
+  // Appends a null-terminated string literal to the buffer.
+  template <size_t N>
+  inline void AppendLiteral(const char (&in)[N]) {
+    AppendString(in, N - 1);
+  }
+
+  // Appends a StringView to the buffer.
+  void AppendString(StringView data) {
+    buffer_.append(data.data(), data.size());
+  }
+
+  // Appends an integer to the buffer.
+  void AppendInt(int64_t value) {
+    constexpr size_t STACK_BUFFER_SIZE = 32;
+    StackString<STACK_BUFFER_SIZE> buf("%" PRId64, value);
+    AppendString(buf.string_view());
+  }
+
+  // Appends an integer to the buffer, padding with |padchar| if the number of
+  // digits of the integer is less than |padding|.
+  template <char padchar, uint64_t padding>
+  void AppendPaddedInt(int64_t sign_value) {
+    const bool negate = std::signbit(static_cast<double>(sign_value));
+    uint64_t absolute_value;
+    if (sign_value == std::numeric_limits<int64_t>::min()) {
+      absolute_value =
+          static_cast<uint64_t>(std::numeric_limits<int64_t>::max()) + 1;
+    } else {
+      absolute_value = static_cast<uint64_t>(std::abs(sign_value));
+    }
+    AppendPaddedIntImpl<padchar, padding>(absolute_value, negate);
+  }
+
+  void AppendUnsignedInt(uint64_t value) {
+    constexpr size_t STACK_BUFFER_SIZE = 32;
+    StackString<STACK_BUFFER_SIZE> buf("%" PRIu64, value);
+    AppendString(buf.string_view());
+  }
+
+  template <char padchar, uint64_t padding>
+  void AppendPaddedUnsignedInt(uint64_t value) {
+    AppendPaddedIntImpl<padchar, padding>(value, false);
+  }
+
+  template <typename IntType>
+  void AppendPaddedHexInt(IntType value, char padchar, uint64_t padding) {
+    using UnsignedType = std::make_unsigned_t<IntType>;
+    constexpr size_t kMaxHexDigits = sizeof(IntType) * 2;
+    constexpr size_t kBufferSize = 32;
+    auto size_needed =
+        kMaxHexDigits > padding ? kMaxHexDigits : static_cast<size_t>(padding);
+    PERFETTO_DCHECK(size_needed <= kBufferSize);
+
+    std::array<char, kBufferSize> data;
+    constexpr char hex_asc[] = "0123456789abcdef";
+
+    size_t idx = size_needed - 1;
+    auto uvalue = static_cast<UnsignedType>(value);
+    do {
+      data[idx--] = hex_asc[uvalue & 0xF];
+      uvalue >>= 4;
+    } while (uvalue != 0);
+
+    if (padding > 0) {
+      const auto num_digits = static_cast<uint64_t>(size_needed - 1 - idx);
+      // std::max() needed to work around GCC not being able to tell that
+      // padding > 0.
+      for (auto i = num_digits; i < std::max(uint64_t{1u}, padding); i++) {
+        data[idx--] = padchar;
+      }
+    }
+    AppendString(&data[idx + 1], size_needed - idx - 1);
+  }
+
+  // Appends a hex integer to the buffer.
+  template <typename IntType>
+  void AppendHexInt(IntType value) {
+    constexpr size_t STACK_BUFFER_SIZE = 64;
+    StackString<STACK_BUFFER_SIZE> buf("%" PRIx64, value);
+    AppendString(buf.string_view());
+  }
+
+  void AppendHexString(const uint8_t* data, size_t size, char separator);
+
+  void AppendHexString(StringView data, char separator) {
+    AppendHexString(reinterpret_cast<const uint8_t*>(data.data()), data.size(),
+                    separator);
+  }
+
+  // Appends a double to the buffer.
+  void AppendDouble(double value) {
+    constexpr size_t STACK_BUFFER_SIZE = 32;
+    StackString<STACK_BUFFER_SIZE> buf("%.16g", value);
+    AppendString(buf.string_view());
+  }
+
+  void AppendBool(bool value) {
+    if (value) {
+      AppendLiteral("true");
+      return;
+    }
+    AppendLiteral("false");
+  }
+
+  StringView GetStringView() {
+    return StringView(buffer_.c_str(), buffer_.size());
+  }
+
+  ScopedCString CreateStringCopy() const {
+    size_t n = buffer_.size();
+    char* dup = reinterpret_cast<char*>(malloc(n + 1));
+    if (dup) {
+      memcpy(dup, buffer_.data(), n);
+      dup[n] = '\0';
+    }
+    return {dup, free};
+  }
+
+  size_t pos() const { return buffer_.size(); }
+
+  void Clear() { buffer_.clear(); }
+
+ private:
+  template <char padchar, uint64_t padding>
+  void AppendPaddedIntImpl(uint64_t absolute_value, bool negate) {
+    // Need to add 2 to the number of digits to account for minus sign and
+    // rounding down of digits10.
+    constexpr auto kMaxDigits = std::numeric_limits<uint64_t>::digits10 + 2;
+    constexpr auto kSizeNeeded = kMaxDigits > padding ? kMaxDigits : padding;
+
+    char data[kSizeNeeded];
+
+    size_t idx;
+    for (idx = kSizeNeeded - 1; absolute_value >= 10;) {
+      char digit = absolute_value % 10;
+      absolute_value /= 10;
+      data[idx--] = digit + '0';
+    }
+    data[idx--] = static_cast<char>(absolute_value) + '0';
+
+    if (padding > 0) {
+      size_t num_digits = kSizeNeeded - 1 - idx;
+      // std::max() needed to work around GCC not being able to tell that
+      // padding > 0.
+      for (size_t i = num_digits; i < std::max(uint64_t{1u}, padding); i++) {
+        data[idx--] = padchar;
+      }
+    }
+
+    if (negate)
+      AppendChar('-');
+    AppendString(&data[idx + 1], kSizeNeeded - idx - 1);
+  }
+
+  std::string buffer_;
 };
 
-// Returns a status object which represents the Ok status.
-inline Status OkStatus() {
-  return Status();
-}
+}  // namespace base
+}  // namespace perfetto
+
+#endif  // INCLUDE_PERFETTO_EXT_BASE_DYNAMIC_STRING_WRITER_H_
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/dynamic_string_writer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+
+namespace perfetto {
+namespace base {
+
+void DynamicStringWriter::AppendHexString(const uint8_t* data,
+                                          size_t size,
+                                          char separator) {
+  // Truncate to 64 bytes, as this is the maximum supported by the Linux
+  // kernel's vsnprintf implementation.
+  size_t printed_size = std::min<size_t>(size, size_t{64});
+
+  if (printed_size) {
+    AppendPaddedHexInt(data[0], '0', 2);
+  }
+  for (size_t pos = 1; pos < printed_size; pos++) {
+    AppendChar(separator);
+    AppendPaddedHexInt(data[pos], '0', 2);
+  }
+}
+
+}  // namespace base
+}  // namespace perfetto
+// gen_amalgamated begin source: src/base/event_fd.cc
+// gen_amalgamated begin header: include/perfetto/ext/base/event_fd.h
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INCLUDE_PERFETTO_EXT_BASE_EVENT_FD_H_
+#define INCLUDE_PERFETTO_EXT_BASE_EVENT_FD_H_
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+// gen_amalgamated expanded: #include "perfetto/base/platform_handle.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/scoped_file.h"
+
+namespace perfetto {
+namespace base {
+
+// A waitable event that can be used with poll/select.
+// This is really a wrapper around eventfd_create with a pipe-based fallback
+// for other platforms where eventfd is not supported.
+class EventFd {
+ public:
+  EventFd();
+  ~EventFd();
+  EventFd(EventFd&&) noexcept = default;
+  EventFd& operator=(EventFd&&) = default;
+
+  // The non-blocking file descriptor that can be polled to wait for the event.
+  PlatformHandle fd() const { return event_handle_.get(); }
+
+  // Can be called from any thread.
+  void Notify();
+
+  // Can be called from any thread. If more Notify() are queued a Clear() call
+  // can clear all of them (up to 16 per call).
+  void Clear();
+
+ private:
+  // The eventfd, when eventfd is supported, otherwise this is the read end of
+  // the pipe for fallback mode.
+  ScopedPlatformHandle event_handle_;
 
-Status ErrStatus(const char* format, ...) PERFETTO_PRINTF_FORMAT(1, 2);
+// QNX is specified because it is a non-Linux UNIX platform but it
+// still sets the PERFETTO_OS_LINUX flag to be as compatible as possible
+// with the Linux build.
+#if !PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX_BUT_NOT_QNX) && \
+    !PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) &&           \
+    !PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  // On Mac and other non-Linux UNIX platforms a pipe-based fallback is used.
+  // The write end of the wakeup pipe.
+  ScopedFile write_fd_;
+#endif
+};
 
 }  // namespace base
 }  // namespace perfetto
 
-#endif  // INCLUDE_PERFETTO_BASE_STATUS_H_
+#endif  // INCLUDE_PERFETTO_EXT_BASE_EVENT_FD_H_
+// gen_amalgamated begin header: include/perfetto/ext/base/pipe.h
 /*
  * Copyright (C) 2018 The Android Open Source Project
  *
@@ -2414,177 +3079,156 @@ Status ErrStatus(const char* format, ...) PERFETTO_PRINTF_FORMAT(1, 2);
  * limitations under the License.
  */
 
-#ifndef INCLUDE_PERFETTO_EXT_BASE_FILE_UTILS_H_
-#define INCLUDE_PERFETTO_EXT_BASE_FILE_UTILS_H_
-
-#include <fcntl.h>  // For mode_t & O_RDONLY/RDWR. Exists also on Windows.
-#include <stddef.h>
-
-#include <functional>
-#include <memory>
-#include <optional>
-#include <string>
-#include <vector>
+#ifndef INCLUDE_PERFETTO_EXT_BASE_PIPE_H_
+#define INCLUDE_PERFETTO_EXT_BASE_PIPE_H_
 
-// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
-// gen_amalgamated expanded: #include "perfetto/base/export.h"
-// gen_amalgamated expanded: #include "perfetto/base/status.h"
+// gen_amalgamated expanded: #include "perfetto/base/platform_handle.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/scoped_file.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/sys_types.h"
 
 namespace perfetto {
 namespace base {
 
-class TaskRunner;
-
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
-using FileOpenMode = int;
-inline constexpr char kDevNull[] = "NUL";
-inline constexpr char kFopenReadFlag[] = "r";
-#else
-using FileOpenMode = mode_t;
-inline constexpr char kDevNull[] = "/dev/null";
-inline constexpr char kFopenReadFlag[] = "re";
+class Pipe {
+ public:
+  enum Flags {
+    kBothBlock = 0,
+#if !PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+    kBothNonBlock,
+    kRdNonBlock,
+    kWrNonBlock,
 #endif
+  };
 
-constexpr FileOpenMode kFileModeInvalid = static_cast<FileOpenMode>(-1);
+  static Pipe Create(Flags = kBothBlock);
 
-bool ReadPlatformHandle(PlatformHandle, std::string* out);
-bool ReadFileDescriptor(int fd, std::string* out);
-bool ReadFileStream(FILE* f, std::string* out);
-bool ReadFile(const std::string& path, std::string* out);
+  Pipe();
+  Pipe(Pipe&&) noexcept;
+  Pipe& operator=(Pipe&&);
 
-// A wrapper around read(2). It deals with Linux vs Windows includes. It also
-// deals with handling EINTR. Has the same semantics of UNIX's read(2).
-ssize_t Read(int fd, void* dst, size_t dst_size);
+  ScopedPlatformHandle rd;
+  ScopedPlatformHandle wr;
+};
 
-// Call write until all data is written or an error is detected.
-//
-// man 2 write:
-//   If a write() is interrupted by a signal handler before any bytes are
-//   written, then the call fails with the error EINTR; if it is
-//   interrupted after at least one byte has been written, the call
-//   succeeds, and returns the number of bytes written.
-ssize_t WriteAll(int fd, const void* buf, size_t count);
+}  // namespace base
+}  // namespace perfetto
 
-// Copies all data from |fd_in| to |fd_out|. Saves the offset of |fd_in|,
-// rewinds it to the beginning, copies the content, and restores the offset.
-// |fd_in| can't be a pipe, socket of FIFO.
-base::Status CopyFileContents(int fd_in, int fd_out);
+#endif  // INCLUDE_PERFETTO_EXT_BASE_PIPE_H_
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
-ssize_t WriteAllHandle(PlatformHandle, const void* buf, size_t count);
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
 
-ScopedFile OpenFile(const std::string& path,
-                    int flags,
-                    FileOpenMode = kFileModeInvalid);
-ScopedFstream OpenFstream(const std::string& path, const std::string& mode);
+#include <errno.h>
+#include <stdint.h>
 
-// This is an alias for close(). It's to avoid leaking windows.h in headers.
-// Exported because ScopedFile is used in the /include/ext API by Chromium
-// component builds.
-int PERFETTO_EXPORT_COMPONENT CloseFile(int fd);
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+#include <windows.h>
 
-bool FlushFile(int fd);
+#include <synchapi.h>
+#elif PERFETTO_BUILDFLAG(PERFETTO_OS_QNX)
+#include <unistd.h>
+#elif PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX) || \
+    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
+#include <sys/eventfd.h>
+#include <unistd.h>
+#else  // Mac, Fuchsia and other non-Linux UNIXes
+#include <unistd.h>
+#endif
 
-// Returns true if mkdir succeeds, false if it fails (see errno in that case).
-bool Mkdir(const std::string& path);
+// gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/event_fd.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/pipe.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/utils.h"
 
-// Calls rmdir() on UNIX, _rmdir() on Windows.
-bool Rmdir(const std::string& path);
+namespace perfetto {
+namespace base {
 
-// Wrapper around access(path, F_OK).
-bool FileExists(const std::string& path);
+EventFd::~EventFd() = default;
 
-// Gets the extension for a filename. If the file has two extensions, returns
-// only the last one (foo.pb.gz => .gz). Returns empty string if there is no
-// extension.
-std::string GetFileExtension(const std::string& filename);
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+EventFd::EventFd() {
+  event_handle_.reset(
+      CreateEventA(/*lpEventAttributes=*/nullptr, /*bManualReset=*/true,
+                   /*bInitialState=*/false, /*bInitialState=*/nullptr));
+}
 
-// Returns the basename component of a path (the final component after the last
-// directory separator). Behaves like man 2 basename, but works with both '/'
-// and '\' separators for cross-platform compatibility.
-// Examples:
-//   Basename("/usr/bin/ls") => "ls"
-//   Basename("/usr/bin/") => "bin"
-//   Basename("/") => "/"
-//   Basename("foo") => "foo"
-//   Basename("") => "."
-//   Basename("C:\\Windows\\System32") => "System32"
-std::string Basename(const std::string& path);
+void EventFd::Notify() {
+  if (!SetEvent(event_handle_.get()))  // 0: fail, !0: success, unlike UNIX.
+    PERFETTO_DFATAL("EventFd::Notify()");
+}
 
-// Returns the directory component of a path (everything up to but not
-// including the final component). Behaves like man 2 dirname, but works with
-// both '/' and '\' separators for cross-platform compatibility.
-// Examples:
-//   Dirname("/usr/bin/ls") => "/usr/bin"
-//   Dirname("/usr/bin") => "/usr"
-//   Dirname("/") => "/"
-//   Dirname("foo") => "."
-//   Dirname("") => "."
-//   Dirname("C:\\Windows\\System32") => "C:\\Windows"
-std::string Dirname(const std::string& path);
+void EventFd::Clear() {
+  if (!ResetEvent(event_handle_.get()))  // 0: fail, !0: success, unlike UNIX.
+    PERFETTO_DFATAL("EventFd::Clear()");
+}
 
-// Puts the path to all files under |dir_path| in |output|, recursively walking
-// subdirectories. File paths are relative to |dir_path|. Only files are
-// included, not directories. Path separator is always '/', even on windows (not
-// '\').
-base::Status ListFilesRecursive(const std::string& dir_path,
-                                std::vector<std::string>& output);
+#elif PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX_BUT_NOT_QNX) || \
+    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
 
-// Lists immediate subdirectories in |dir_path| (non-recursive). Directory names
-// are relative to |dir_path| and do not include the path separator. Returns
-// only directories, not files. Works on both Unix and Windows.
-base::Status ListDirectories(const std::string& dir_path,
-                             std::vector<std::string>& output);
+EventFd::EventFd() {
+  event_handle_.reset(eventfd(/*initval=*/0, EFD_CLOEXEC | EFD_NONBLOCK));
+  PERFETTO_CHECK(event_handle_);
+}
 
-// Sets |path|'s owner group to |group_name| and permission mode bits to
-// |mode_bits|.
-base::Status SetFilePermissions(const std::string& path,
-                                const std::string& group_name,
-                                const std::string& mode_bits);
+void EventFd::Notify() {
+  const uint64_t value = 1;
+  ssize_t ret = write(event_handle_.get(), &value, sizeof(value));
+  if (ret <= 0 && errno != EAGAIN)
+    PERFETTO_DFATAL("EventFd::Notify()");
+}
 
-// Returns the size of the file located at |path|, or nullopt in case of error.
-std::optional<uint64_t> GetFileSize(const std::string& path);
+void EventFd::Clear() {
+  uint64_t value;
+  ssize_t ret =
+      PERFETTO_EINTR(read(event_handle_.get(), &value, sizeof(value)));
+  if (ret <= 0 && errno != EAGAIN)
+    PERFETTO_DFATAL("EventFd::Clear()");
+}
 
-// Returns the size of the open file |fd|, or nullopt in case of error.
-std::optional<uint64_t> GetFileSize(PlatformHandle fd);
+#else
 
-// This class uses inotify (on Linux/Android) to watch for the creation of
-// files in the filesystem. When the specified file is created, it triggers a
-// callback function.
-// Destroying the returned unique_ptr will automatically unregister the watch.
-//
-// Note: This only works with filesystem paths (not abstract sockets or other
-// special file types).
-// It's only supported on Linux and Android, it's a no-op (returns nullptr) on
-// other platforms.
-//
-// Usage:
-//   auto watch = LinuxFileWatch::WatchFileCreation(
-//       task_runner, "/tmp/my_file", []() {
-//         // Called when /tmp/my_file is created
-//       });
-class LinuxFileWatch {
- public:
-  // Creates a watcher for file creation. Returns nullptr if the path is not a
-  // valid filesystem path or if the platform doesn't support inotify. The
-  // callback will be invoked on the provided TaskRunner when the file is
-  // created.
-  static std::unique_ptr<LinuxFileWatch> WatchFileCreation(
-      TaskRunner*,
-      const char* path,
-      std::function<void()> callback);
+EventFd::EventFd() {
+  // Make the pipe non-blocking so that we never block the waking thread (either
+  // the main thread or another one) when scheduling a wake-up.
+  Pipe pipe = Pipe::Create(Pipe::kBothNonBlock);
+  event_handle_ = ScopedPlatformHandle(std::move(pipe.rd).release());
+  write_fd_ = std::move(pipe.wr);
+}
 
-  virtual ~LinuxFileWatch();
+void EventFd::Notify() {
+  const uint64_t value = 1;
+  ssize_t ret = write(write_fd_.get(), &value, sizeof(uint8_t));
+  if (ret <= 0 && errno != EAGAIN)
+    PERFETTO_DFATAL("EventFd::Notify()");
+}
 
- protected:
-  LinuxFileWatch() = default;
-};
+void EventFd::Clear() {
+  // Drain the byte(s) written to the wake-up pipe. We can potentially read
+  // more than one byte if several wake-ups have been scheduled.
+  char buffer[16];
+  ssize_t ret =
+      PERFETTO_EINTR(read(event_handle_.get(), &buffer[0], sizeof(buffer)));
+  if (ret <= 0 && errno != EAGAIN)
+    PERFETTO_DFATAL("EventFd::Clear()");
+}
+#endif
 
 }  // namespace base
 }  // namespace perfetto
-
-#endif  // INCLUDE_PERFETTO_EXT_BASE_FILE_UTILS_H_
+// gen_amalgamated begin source: src/base/file_utils.cc
 // gen_amalgamated begin header: include/perfetto/base/task_runner.h
 /*
  * Copyright (C) 2017 The Android Open Source Project
@@ -3121,11 +3765,12 @@ bool FlushFile(int fd) {
 #endif
 }
 
-bool Mkdir(const std::string& path) {
+bool Mkdir(const std::string& path, uint32_t mode) {
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  base::ignore_result(mode);
   return _mkdir(path.c_str()) == 0;
 #else
-  return mkdir(path.c_str(), 0755) == 0;
+  return mkdir(path.c_str(), mode) == 0;
 #endif
 }
 
@@ -3137,6 +3782,14 @@ bool Rmdir(const std::string& path) {
 #endif
 }
 
+bool Unlink(const char* path) {
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  return _unlink(path) == 0;
+#else
+  return unlink(path) == 0;
+#endif
+}
+
 int CloseFile(int fd) {
   return close(fd);
 }
@@ -3265,6 +3918,9 @@ base::Status ListFilesRecursive(const std::string& dir_path,
       struct stat dirstat;
       std::string full_path = cur_dir + dirent->d_name;
       PERFETTO_CHECK(stat(full_path.c_str(), &dirstat) == 0);
+      // MSan's stat() interceptor on glibc 2.35+ does not mark the output
+      // buffer as initialized (the syscall goes through statx).
+      PERFETTO_MSAN_UNPOISON(&dirstat, sizeof(dirstat));
       if (S_ISDIR(dirstat.st_mode)) {
         dir_queue.push_back(full_path + '/');
       } else if (S_ISREG(dirstat.st_mode)) {
@@ -3596,275 +4252,6 @@ LinuxFileWatch::~LinuxFileWatch() = default;
 
 #endif  // OS_LINUX || OS_ANDROID
 
-}  // namespace base
-}  // namespace perfetto
-// gen_amalgamated begin source: src/base/fixed_string_writer.cc
-// gen_amalgamated begin header: include/perfetto/ext/base/fixed_string_writer.h
-/*
- * Copyright (C) 2019 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef INCLUDE_PERFETTO_EXT_BASE_FIXED_STRING_WRITER_H_
-#define INCLUDE_PERFETTO_EXT_BASE_FIXED_STRING_WRITER_H_
-
-#include <string.h>
-
-#include <algorithm>
-#include <array>
-#include <cmath>
-#include <cstdlib>
-#include <limits>
-#include <type_traits>
-
-// gen_amalgamated expanded: #include "perfetto/base/logging.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/string_utils.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/string_view.h"
-
-namespace perfetto {
-namespace base {
-
-// A helper class which writes formatted data to a string buffer.
-// This is used in the trace processor where we write O(GBs) of strings and
-// sprintf is too slow.
-class FixedStringWriter {
- public:
-  // Creates a string buffer from a char buffer and length.
-  FixedStringWriter(char* buffer, size_t size) : buffer_(buffer), size_(size) {}
-
-  // Appends n instances of a char to the buffer.
-  void AppendChar(char in, size_t n = 1) {
-    PERFETTO_DCHECK(pos_ + n <= size_);
-    memset(&buffer_[pos_], in, n);
-    pos_ += n;
-  }
-
-  // Appends a length delimited string to the buffer.
-  void AppendString(const char* in, size_t n) {
-    PERFETTO_DCHECK(pos_ + n <= size_);
-    memcpy(&buffer_[pos_], in, n);
-    pos_ += n;
-  }
-
-  void AppendStringView(StringView sv) { AppendString(sv.data(), sv.size()); }
-
-  // Appends a null-terminated string literal to the buffer.
-  template <size_t N>
-  inline void AppendLiteral(const char (&in)[N]) {
-    AppendString(in, N - 1);
-  }
-
-  // Appends a StringView to the buffer.
-  void AppendString(StringView data) { AppendString(data.data(), data.size()); }
-
-  // Appends an integer to the buffer.
-  void AppendInt(int64_t value) { AppendPaddedInt<'0', 0>(value); }
-
-  // Appends an integer to the buffer, padding with |padchar| if the number of
-  // digits of the integer is less than |padding|.
-  template <char padchar, uint64_t padding>
-  void AppendPaddedInt(int64_t sign_value) {
-    const bool negate = std::signbit(static_cast<double>(sign_value));
-    uint64_t absolute_value;
-    if (sign_value == std::numeric_limits<int64_t>::min()) {
-      absolute_value =
-          static_cast<uint64_t>(std::numeric_limits<int64_t>::max()) + 1;
-    } else {
-      absolute_value = static_cast<uint64_t>(std::abs(sign_value));
-    }
-    AppendPaddedInt<padchar, padding>(absolute_value, negate);
-  }
-
-  void AppendUnsignedInt(uint64_t value) {
-    AppendPaddedUnsignedInt<'0', 0>(value);
-  }
-
-  // Appends an unsigned integer to the buffer, padding with |padchar| if the
-  // number of digits of the integer is less than |padding|.
-  template <char padchar, uint64_t padding>
-  void AppendPaddedUnsignedInt(uint64_t value) {
-    AppendPaddedInt<padchar, padding>(value, false);
-  }
-
-  template <typename IntType>
-  void AppendPaddedHexInt(IntType value, char padchar, uint64_t padding) {
-    using UnsignedType = std::make_unsigned_t<IntType>;
-    constexpr size_t kMaxHexDigits = sizeof(IntType) * 2;
-    // 32 bytes is more than enough for any integer type (max 16 hex digits for
-    // 64-bit)
-    constexpr size_t kBufferSize = 32;
-    auto size_needed =
-        kMaxHexDigits > padding ? kMaxHexDigits : static_cast<size_t>(padding);
-    PERFETTO_DCHECK(size_needed <= kBufferSize);
-    PERFETTO_DCHECK(pos_ + size_needed <= size_);
-
-    std::array<char, kBufferSize> data;
-    constexpr char hex_asc[] = "0123456789abcdef";
-
-    size_t idx = size_needed - 1;
-    auto uvalue = static_cast<UnsignedType>(value);
-    do {
-      data[idx--] = hex_asc[uvalue & 0xF];
-      uvalue >>= 4;
-    } while (uvalue != 0);
-
-    if (padding > 0) {
-      const auto num_digits = static_cast<uint64_t>(size_needed - 1 - idx);
-      // std::max() needed to work around GCC not being able to tell that
-      // padding > 0.
-      for (auto i = num_digits; i < std::max(uint64_t{1u}, padding); i++) {
-        data[idx--] = padchar;
-      }
-    }
-    AppendString(&data[idx + 1], size_needed - idx - 1);
-  }
-
-  // Appends a hex integer to the buffer.
-  template <typename IntType>
-  void AppendHexInt(IntType value) {
-    AppendPaddedHexInt(value, '0', 0);
-  }
-
-  // Appends a hex string to the buffer.
-  void AppendHexString(const uint8_t* data, size_t size, char separator);
-
-  void AppendHexString(StringView data, char separator) {
-    AppendHexString(reinterpret_cast<const uint8_t*>(data.data()), data.size(),
-                    separator);
-  }
-
-  // Appends a double to the buffer.
-  void AppendDouble(double value) {
-    // TODO(lalitm): trying to optimize this is premature given we almost never
-    // print doubles. Reevaluate this in the future if we do print them more.
-    size_t res = base::SprintfTrunc(buffer_ + pos_, size_ - pos_, "%lf", value);
-    PERFETTO_DCHECK(pos_ + res <= size_);
-    pos_ += res;
-  }
-
-  void AppendBool(bool value) {
-    if (value) {
-      AppendLiteral("true");
-      return;
-    }
-    AppendLiteral("false");
-  }
-
-  StringView GetStringView() {
-    PERFETTO_DCHECK(pos_ <= size_);
-    return StringView(buffer_, pos_);
-  }
-
-  char* CreateStringCopy() {
-    char* dup = reinterpret_cast<char*>(malloc(pos_ + 1));
-    if (dup) {
-      memcpy(dup, buffer_, pos_);
-      dup[pos_] = '\0';
-    }
-    return dup;
-  }
-
-  size_t pos() const { return pos_; }
-  size_t size() const { return size_; }
-  void reset() { pos_ = 0; }
-
- private:
-  template <char padchar, uint64_t padding>
-  void AppendPaddedInt(uint64_t absolute_value, bool negate) {
-    // Need to add 2 to the number of digits to account for minus sign and
-    // rounding down of digits10.
-    constexpr auto kMaxDigits = std::numeric_limits<uint64_t>::digits10 + 2;
-    constexpr auto kSizeNeeded = kMaxDigits > padding ? kMaxDigits : padding;
-    PERFETTO_DCHECK(pos_ + kSizeNeeded <= size_);
-
-    char data[kSizeNeeded];
-
-    size_t idx;
-    for (idx = kSizeNeeded - 1; absolute_value >= 10;) {
-      char digit = absolute_value % 10;
-      absolute_value /= 10;
-      data[idx--] = digit + '0';
-    }
-    data[idx--] = static_cast<char>(absolute_value) + '0';
-
-    if (padding > 0) {
-      size_t num_digits = kSizeNeeded - 1 - idx;
-      // std::max() needed to work around GCC not being able to tell that
-      // padding > 0.
-      for (size_t i = num_digits; i < std::max(uint64_t{1u}, padding); i++) {
-        data[idx--] = padchar;
-      }
-    }
-
-    if (negate)
-      buffer_[pos_++] = '-';
-    AppendString(&data[idx + 1], kSizeNeeded - idx - 1);
-  }
-
-  char* buffer_ = nullptr;
-  size_t size_ = 0;
-  size_t pos_ = 0;
-};
-
-}  // namespace base
-}  // namespace perfetto
-
-#endif  // INCLUDE_PERFETTO_EXT_BASE_FIXED_STRING_WRITER_H_
-/*
- * Copyright (C) 2026 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// gen_amalgamated expanded: #include "perfetto/ext/base/fixed_string_writer.h"
-
-#include <algorithm>
-#include <cstddef>
-#include <cstdint>
-
-namespace perfetto {
-namespace base {
-
-void FixedStringWriter::AppendHexString(const uint8_t* data,
-                                        size_t size,
-                                        char separator) {
-  // Truncate to 64 bytes, as this is the maximum supported by the Linux
-  // kernel's vsnprintf implementation.
-  size_t printed_size = std::min<size_t>(size, size_t{64});
-  // Remove trailing separator from calculation if printed_size > 0.
-  size_t max_chars = printed_size * 3 - (printed_size > 0 ? 1 : 0);
-  PERFETTO_DCHECK(pos_ + max_chars <= size_);
-
-  if (printed_size) {
-    AppendPaddedHexInt(data[0], '0', 2);
-  }
-  for (size_t pos = 1; pos < printed_size; pos++) {
-    AppendChar(separator);
-    AppendPaddedHexInt(data[pos], '0', 2);
-  }
-}
-
 }  // namespace base
 }  // namespace perfetto
 // gen_amalgamated begin source: src/base/getopt_compat.cc
@@ -3997,6 +4384,36 @@ const option* LookupShortOpt(const std::vector<option>& opts, char c) {
   return nullptr;
 }
 
+// Returns true if |token| is an option-bearing argv element whose argument
+// is supplied by the next argv element (rather than embedded or absent).
+// Used by the GNU-style permutation logic in getopt_long().
+bool TokenConsumesNextArg(const char* token, const std::vector<option>& opts) {
+  if (token[0] != '-' || token[1] == '\0')
+    return false;
+  if (token[1] == '-') {
+    // Long option: "--name" needs a separate arg if it's required_argument
+    // and there is no embedded "=value".
+    if (token[2] == '\0')
+      return false;  // "--" alone.
+    if (strchr(token + 2, '=') != nullptr)
+      return false;
+    size_t len = strlen(token + 2);
+    const option* opt = LookupLongOpt(opts, token + 2, len);
+    return opt && opt->has_arg == required_argument;
+  }
+  // Short option chain: "-abc" / "-aXYZ". Walk until we find an option that
+  // requires an argument; if it is the last character of the token, the next
+  // argv element is the argument. Anything after it would be the embedded arg.
+  for (size_t i = 1; token[i] != '\0'; ++i) {
+    const option* opt = LookupShortOpt(opts, token[i]);
+    if (!opt)
+      return false;
+    if (opt->has_arg == required_argument)
+      return token[i + 1] == '\0';
+  }
+  return false;
+}
+
 bool ParseOpts(const char* shortopts,
                const option* longopts,
                std::vector<option>* res) {
@@ -4052,6 +4469,37 @@ int getopt_long(int argc,
   if (!ParseOpts(shortopts, longopts, &opts))
     return '?';
 
+  // GNU-style permutation: if we're at a non-option, move the next option
+  // (and its separate argument, if any) into position |optind|, shifting any
+  // intervening non-options to the right. This matches the default behavior
+  // of GNU getopt(3) so positional args can be freely interleaved with flags.
+  // We only permute when |nextchar| is null (i.e. we're not in the middle of
+  // a "-abc" short-option chain).
+  if (!nextchar) {
+    int scan = optind;
+    while (scan < argc) {
+      const char* s = argv[scan];
+      // Stop at the next option-bearing token ("-x", "--long", or "--").
+      if (s[0] == '-' && s[1] != '\0')
+        break;
+      ++scan;
+    }
+    // No permutation if there's nothing before the next option, or if the
+    // next token is "--" (the explicit end-of-options marker).
+    if (scan < argc && scan > optind && strcmp(argv[scan], "--") != 0) {
+      bool takes_next = TokenConsumesNextArg(argv[scan], opts);
+      int count = (takes_next && scan + 1 < argc) ? 2 : 1;
+      char* opt_token = argv[scan];
+      char* opt_arg = count == 2 ? argv[scan + 1] : nullptr;
+      // Shift argv[optind..scan) right by |count| to make room.
+      for (int k = scan - 1; k >= optind; --k)
+        argv[k + count] = argv[k];
+      argv[optind] = opt_token;
+      if (count == 2)
+        argv[optind + 1] = opt_arg;
+    }
+  }
+
   char* arg = argv[optind];
   optopt = 0;
 
@@ -5448,7 +5896,15 @@ enum Tags : uint32_t {
   F(PROFILER_UNWIND_ATTEMPT), \
   F(PROFILER_MAPS_PARSE), \
   F(PROFILER_MAPS_REPARSE), \
-  F(PROFILER_UNWIND_CACHE_CLEAR)
+  F(PROFILER_UNWIND_CACHE_CLEAR), \
+  F(ANDROID_CPU_PER_UID_TICK), \
+  F(ANDROID_KERNEL_WAKELOCKS_TICK), \
+  F(ANDROID_POWER_TICK), \
+  F(ANDROID_POWER_WRITE_BATTERY_COUNTERS), \
+  F(ANDROID_POWER_WRITE_ENERGY_ESTIMATION_BREAKDOWN), \
+  F(ANDROID_POWER_WRITE_ENTITY_STATE_RESIDENCY), \
+  F(ANDROID_POWER_WRITE_POWER_RAILS_DATA), \
+  F(LINUX_POWER_SYSFS_TICK)
 
 // Append only, see above.
 //
@@ -5456,6 +5912,13 @@ enum Tags : uint32_t {
 // * FTRACE_SERVICE_COMMIT_DATA is a bit-packed representation of an event, see
 //   tracing_service_impl.cc for the format.
 // * PROFILER_UNWIND_CURRENT_PID represents the PID that is being unwound.
+// * WATCHDOG_CRASH_REASON represents the base::WatchdogCrashReason enum.
+// * WATCHDOG_CRASH_TIME_BOOT_MS The time in ms since boot when the watchdog
+//   timeout alarm triggered (i.e. when it would have caused a crash, without
+//   counting for the optional handler time).
+// * WATCHDOG_CRASH_ACTUAL_{MONO,BOOT,CPU} are the elapsed seconds (since the
+//   offending fatal timer was created) sampled from CLOCK_MONOTONIC,
+//   CLOCK_BOOTTIME and CLOCK_PROCESS_CPUTIME_ID respectively.
 //
 #define PERFETTO_METATRACE_COUNTERS(F) \
   F(COUNTER_ZERO_UNUSED),\
@@ -5463,7 +5926,13 @@ enum Tags : uint32_t {
   F(PS_PIDS_SCANNED), \
   F(TRACE_SERVICE_COMMIT_DATA), \
   F(PROFILER_UNWIND_QUEUE_SZ), \
-  F(PROFILER_UNWIND_CURRENT_PID)
+  F(PROFILER_UNWIND_CURRENT_PID), \
+  F(WATCHDOG_CRASH_REASON), \
+  F(WATCHDOG_CRASH_TIME_BOOT_MS), \
+  F(WATCHDOG_CRASH_ACTUAL_MONO), \
+  F(WATCHDOG_CRASH_ACTUAL_BOOT), \
+  F(WATCHDOG_CRASH_ACTUAL_CPU), \
+  F(FTRACE_SESSIONS)
 
 // clang-format on
 
@@ -6648,51 +7117,6 @@ Pipe Pipe::Create(Flags flags) {
 }  // namespace perfetto
 // gen_amalgamated begin source: src/base/rt_mutex.cc
 // gen_amalgamated begin header: include/perfetto/ext/base/rt_mutex.h
-// gen_amalgamated begin header: include/perfetto/ext/base/flags.h
-/*
- * Copyright (C) 2025 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef INCLUDE_PERFETTO_EXT_BASE_FLAGS_H_
-#define INCLUDE_PERFETTO_EXT_BASE_FLAGS_H_
-
-// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
-
-#if PERFETTO_BUILDFLAG(PERFETTO_ANDROID_BUILD) && \
-    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
-// Android: aconfig generates PERFETTO_FLAGS_* macros in perfetto_flags.h
-#include <perfetto_flags.h>
-#else
-// Non-Android: Define fallback PERFETTO_FLAGS_* macros
-// These match the pattern from Android's aconfig codegen
-#define PERFETTO_FLAGS(FLAG) PERFETTO_FLAGS_##FLAG
-
-#define PERFETTO_FLAGS_TEST_READ_ONLY_FLAG false
-#define PERFETTO_FLAGS_USE_LOCKFREE_TASKRUNNER \
-  PERFETTO_BUILDFLAG(PERFETTO_ENABLE_LOCKFREE_TASKRUNNER)
-#define PERFETTO_FLAGS_USE_RT_MUTEX false
-#define PERFETTO_FLAGS_USE_RT_FUTEX false
-#define PERFETTO_FLAGS_BUFFER_CLONE_PRESERVE_READ_ITER true
-#define PERFETTO_FLAGS_SMA_PREVENT_DUPLICATE_IMMEDIATE_FLUSHES true
-#define PERFETTO_FLAGS_USE_UNIX_SOCKET_INOTIFY \
-  PERFETTO_BUILDFLAG(PERFETTO_ENABLE_SOCK_INOTIFY)
-#define PERFETTO_FLAGS_TRACK_EVENT_INCREMENTAL_STATE_CLEAR_NOT_DESTROY true
-
-#endif  // PERFETTO_BUILDFLAG(PERFETTO_ANDROID_BUILD) && ...
-
-#endif  // INCLUDE_PERFETTO_EXT_BASE_FLAGS_H_
 /*
  * Copyright (C) 2025 The Android Open Source Project
  *
@@ -6726,7 +7150,6 @@ Pipe Pipe::Create(Flags flags) {
 
 // gen_amalgamated expanded: #include "perfetto/base/build_config.h"
 // gen_amalgamated expanded: #include "perfetto/base/thread_annotations.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/flags.h"
 // gen_amalgamated expanded: #include "perfetto/public/compiler.h"
 
 #define _PERFETTO_MUTEX_MODE_STD 0
@@ -6748,11 +7171,7 @@ Pipe Pipe::Create(Flags flags) {
 //    tracing is initialized from a static constructor (see b/443178555).
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) && \
     PERFETTO_BUILDFLAG(PERFETTO_ANDROID_BUILD)
-#if PERFETTO_FLAGS_USE_RT_FUTEX
 #define _PERFETTO_MUTEX_MODE _PERFETTO_MUTEX_MODE_RT_FUTEX
-#elif PERFETTO_FLAGS_USE_RT_MUTEX
-#define _PERFETTO_MUTEX_MODE _PERFETTO_MUTEX_MODE_RT_MUTEX
-#endif
 #elif PERFETTO_BUILDFLAG(PERFETTO_ENABLE_RT_MUTEX)
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
 #define _PERFETTO_MUTEX_MODE _PERFETTO_MUTEX_MODE_RT_FUTEX
@@ -7862,108 +8281,6 @@ bool Status::ErasePayload(std::string_view type_url) {
 
 }  // namespace perfetto::base
 // gen_amalgamated begin source: src/base/string_splitter.cc
-// gen_amalgamated begin header: include/perfetto/ext/base/string_splitter.h
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef INCLUDE_PERFETTO_EXT_BASE_STRING_SPLITTER_H_
-#define INCLUDE_PERFETTO_EXT_BASE_STRING_SPLITTER_H_
-
-#include <string>
-
-namespace perfetto {
-namespace base {
-
-// C++ version of strtok(). Splits a string without making copies or any heap
-// allocations. Destructs the original string passed in input.
-// Supports the special case of using \0 as a delimiter.
-// The token returned in output are valid as long as the input string is valid.
-class StringSplitter {
- public:
-  // Whether an empty string (two delimiters side-to-side) is a valid token.
-  enum class EmptyTokenMode {
-    DISALLOW_EMPTY_TOKENS,
-    ALLOW_EMPTY_TOKENS,
-
-    DEFAULT = DISALLOW_EMPTY_TOKENS,
-  };
-
-  // Can take ownership of the string if passed via std::move(), e.g.:
-  // StringSplitter(std::move(str), '\n');
-  StringSplitter(std::string,
-                 char delimiter,
-                 EmptyTokenMode empty_token_mode = EmptyTokenMode::DEFAULT);
-
-  // Splits a C-string. The input string will be forcefully null-terminated (so
-  // str[size - 1] should be == '\0' or the last char will be truncated).
-  StringSplitter(char* str,
-                 size_t size,
-                 char delimiter,
-                 EmptyTokenMode empty_token_mode = EmptyTokenMode::DEFAULT);
-
-  // Splits the current token from an outer StringSplitter instance. This is to
-  // chain splitters as follows:
-  // for (base::StringSplitter lines(x, '\n'); ss.Next();)
-  //   for (base::StringSplitter words(&lines, ' '); words.Next();)
-  StringSplitter(StringSplitter*,
-                 char delimiter,
-                 EmptyTokenMode empty_token_mode = EmptyTokenMode::DEFAULT);
-
-  // Returns true if a token is found (in which case it will be stored in
-  // cur_token()), false if no more tokens are found.
-  bool Next();
-
-  // Returns the next token if found (in which case it will be stored in
-  // cur_token()), nullptr if no more tokens are found.
-  char* NextToken() { return Next() ? cur_token() : nullptr; }
-
-  // Returns the current token iff last call to Next() returned true. In this
-  // case it guarantees that the returned string is always null terminated.
-  // In all other cases (before the 1st call to Next() and after Next() returns
-  // false) returns nullptr.
-  char* cur_token() { return cur_; }
-
-  // Returns the length of the current token (excluding the null terminator).
-  size_t cur_token_size() const { return cur_size_; }
-
-  // Return the untokenized remainder of the input string that occurs after the
-  // current token.
-  char* remainder() { return next_; }
-
-  // Returns the size of the untokenized input
-  size_t remainder_size() { return static_cast<size_t>(end_ - next_); }
-
- private:
-  StringSplitter(const StringSplitter&) = delete;
-  StringSplitter& operator=(const StringSplitter&) = delete;
-  void Initialize(char* str, size_t size);
-
-  std::string str_;
-  char* cur_;
-  size_t cur_size_;
-  char* next_;
-  char* end_;  // STL-style, points one past the last char.
-  const char delimiter_;
-  const EmptyTokenMode empty_token_mode_;
-};
-
-}  // namespace base
-}  // namespace perfetto
-
-#endif  // INCLUDE_PERFETTO_EXT_BASE_STRING_SPLITTER_H_
 /*
  * Copyright (C) 2018 The Android Open Source Project
  *
@@ -8186,16 +8503,23 @@ std::vector<std::string> SplitString(const std::string& text,
   return output;
 }
 
-std::string TrimWhitespace(const std::string& str) {
-  std::string whitespaces = "\t\n ";
+std::string_view TrimWhitespace(std::string_view str) {
+  static constexpr char kWhitespaces[] = "\t\n ";
+  size_t front_idx = str.find_first_not_of(kWhitespaces);
+  if (front_idx == std::string_view::npos)
+    return {};
+  std::string_view front_trimmed = str.substr(front_idx);
+  size_t end_idx = front_trimmed.find_last_not_of(kWhitespaces);
+  PERFETTO_DCHECK(end_idx != std::string_view::npos);
+  return front_trimmed.substr(0, end_idx + 1);
+}
 
-  size_t front_idx = str.find_first_not_of(whitespaces);
-  std::string front_trimmed =
-      front_idx == std::string::npos ? "" : str.substr(front_idx);
+std::string TrimWhitespace(const std::string& str) {
+  return std::string(TrimWhitespace(std::string_view(str)));
+}
 
-  size_t end_idx = front_trimmed.find_last_not_of(whitespaces);
-  return end_idx == std::string::npos ? ""
-                                      : front_trimmed.substr(0, end_idx + 1);
+std::string_view TrimWhitespace(const char* str) {
+  return TrimWhitespace(std::string_view(str));
 }
 
 std::string StripPrefix(const std::string& str, const std::string& prefix) {
@@ -10134,10 +10458,15 @@ void WaitableEvent::Notify() {
 
 #include <stdint.h>
 
+#include <functional>
+
 namespace perfetto {
 namespace base {
 
+class TaskRunner;
+
 enum class WatchdogCrashReason;  // Defined in watchdog.h.
+struct WatchdogCrashInfo;        // Defined in watchdog.h.
 
 class Watchdog {
  public:
@@ -10155,7 +10484,8 @@ class Watchdog {
   Timer CreateFatalTimer(uint32_t /*ms*/, WatchdogCrashReason) {
     return Timer();
   }
-  void Start() {}
+  void Start(TaskRunner* /*task_runner*/ = nullptr,
+             std::function<void(WatchdogCrashInfo)> /*handler*/ = {}) {}
   void SetMemoryLimit(uint64_t /*bytes*/, uint32_t /*window_ms*/) {}
   void SetCpuLimit(uint32_t /*percentage*/, uint32_t /*window_ms*/) {}
 };
@@ -10207,6 +10537,28 @@ enum class WatchdogCrashReason {
   kTraceDidntStop = 4,
 };
 
+// Information about an imminent watchdog-triggered crash. Passed to the fatal
+// handler installed via Watchdog::Start() so embedders can record it (e.g. via
+// metatrace counters) before the process is force-killed.
+struct WatchdogCrashInfo {
+  int thread_id = 0;
+  WatchdogCrashReason reason = WatchdogCrashReason::kUnspecified;
+
+  // The time in CLOCK_BOOTTIME when the watchdog triggered.
+  int64_t alarm_time_ms = 0;
+
+  // The initial timeout passed to CreateFatalTimer.
+  int timeout_s = 0;
+
+  // Elapsed seconds, since the offending fatal timer was created, sampled
+  // from CLOCK_MONOTONIC, CLOCK_BOOTTIME and CLOCK_PROCESS_CPUTIME_ID
+  // respectively. These mirror the wdog_actual_{mono,boot,cpu} crash keys.
+  // They are 0 for cpu/memory guardrail crashes (no associated timer).
+  int actual_mono_s = 0;
+  int actual_boot_s = 0;
+  int actual_cpu_s = 0;
+};
+
 // Make the limits more relaxed on desktop, where multi-GB traces are likely.
 // Multi-GB traces can take bursts of cpu time to write into disk at the end of
 // the trace.
@@ -10260,6 +10612,7 @@ inline void RunTaskWithWatchdogGuard(const std::function<void()>& task) {
  */
 
 // gen_amalgamated expanded: #include "perfetto/ext/base/platform.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/string_utils.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/watchdog.h"
 
 #if PERFETTO_BUILDFLAG(PERFETTO_WATCHDOG)
@@ -10280,6 +10633,7 @@ inline void RunTaskWithWatchdogGuard(const std::function<void()>& task) {
 
 // gen_amalgamated expanded: #include "perfetto/base/build_config.h"
 // gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/base/task_runner.h"
 // gen_amalgamated expanded: #include "perfetto/base/thread_utils.h"
 // gen_amalgamated expanded: #include "perfetto/base/time.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/crash_keys.h"
@@ -10294,7 +10648,15 @@ namespace {
 
 constexpr uint32_t kDefaultPollingInterval = 30 * 1000;
 
+// Grace period given to a fatal handler (passed to Start()) to
+// crash the process on its own before the watchdog force-kills it.
+constexpr uint32_t kFatalHandlerGraceMs = 60 * 1000;
+
 base::CrashKey g_crash_key_reason("wdog_reason");
+base::CrashKey g_crash_key_timeout("wdog_timeout");
+base::CrashKey g_crash_key_actual_mono("wdog_actual_mono");
+base::CrashKey g_crash_key_actual_boot("wdog_actual_boot");
+base::CrashKey g_crash_key_actual_cpu("wdog_actual_cpu");
 
 bool IsMultipleOf(uint32_t number, uint32_t divisor) {
   return number >= divisor && number % divisor == 0;
@@ -10346,11 +10708,10 @@ Watchdog::~Watchdog() {
   }
   PERFETTO_DCHECK(enabled_);
   enabled_ = false;
-
   // Rearm the timer to 1ns from now. This will cause the watchdog thread to
   // wakeup from the poll() and see |enabled_| == false.
-  // This code path is used only in tests. In production code the watchdog is
-  // a singleton and is never destroyed.
+  // This code path is used only in tests. In production code the watchdog
+  // is a singleton and is never destroyed.
   struct itimerspec ts{};
   ts.it_value.tv_sec = 0;
   ts.it_value.tv_nsec = 1;
@@ -10409,13 +10770,20 @@ void Watchdog::RearmTimerFd_Locked() {
   PERFETTO_DCHECK(res == 0);
 }
 
-void Watchdog::Start() {
+void Watchdog::Start(TaskRunner* task_runner,
+                     std::function<void(WatchdogCrashInfo)> fatal_handler) {
   std::lock_guard<std::mutex> guard(mutex_);
   if (thread_.joinable()) {
     PERFETTO_DCHECK(enabled_);
   } else {
     PERFETTO_DCHECK(!enabled_);
 
+    // |fatal_handler_*| are written here, before the watchdog thread is
+    // created. The watchdog thread is the only reader, so no locking is
+    // needed when accessing them from ThreadMain().
+    fatal_handler_task_runner_ = task_runner;
+    fatal_handler_ = std::move(fatal_handler);
+
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX) || \
     PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
     // Kick the thread to start running but only on Android or Linux.
@@ -10459,6 +10827,10 @@ void Watchdog::SetCpuLimit(uint32_t percentage, uint32_t window_ms) {
 void Watchdog::ThreadMain() {
   // Register crash keys explicitly to avoid running out of slots at crash time.
   g_crash_key_reason.Register();
+  g_crash_key_timeout.Register();
+  g_crash_key_actual_boot.Register();
+  g_crash_key_actual_mono.Register();
+  g_crash_key_actual_cpu.Register();
 
   base::ScopedFile stat_fd(base::OpenFile("/proc/self/stat", O_RDONLY));
   if (!stat_fd) {
@@ -10499,24 +10871,42 @@ void Watchdog::ThreadMain() {
     auto res = PERFETTO_EINTR(read(*timer_fd_, &expired, sizeof(expired)));
     PERFETTO_DCHECK((res < 0 && (errno == EAGAIN)) ||
                     (res == sizeof(expired) && expired > 0));
-    const auto now = GetWallTimeMs();
+    const TimeMillis now_mono_ms = GetWallTimeMs();
 
     // Check if any of the timers expired.
-    int tid_to_kill = 0;
-    WatchdogCrashReason crash_reason{};
+    WatchdogCrashInfo info{};
     {
       std::lock_guard<std::mutex> guard(mutex_);
       for (const auto& timer : timers_) {
-        if (now >= timer.deadline) {
-          tid_to_kill = timer.thread_id;
-          crash_reason = timer.crash_reason;
+        if (now_mono_ms >= timer.deadline) {
+          info.thread_id = timer.thread_id;
+          info.reason = timer.crash_reason;
+          const TimeMillis now_boot_ms = GetBootTimeMs();
+          info.alarm_time_ms = now_boot_ms.count();
+          info.timeout_s =
+              static_cast<int>(std::chrono::duration_cast<TimeSeconds>(
+                                   timer.deadline - timer.ctime_mono)
+                                   .count());
+          info.actual_mono_s =
+              static_cast<int>(std::chrono::duration_cast<TimeSeconds>(
+                                   now_mono_ms - timer.ctime_mono)
+                                   .count());
+          info.actual_boot_s =
+              static_cast<int>(std::chrono::duration_cast<TimeSeconds>(
+                                   now_boot_ms - timer.ctime_boot)
+                                   .count());
+          info.actual_cpu_s =
+              static_cast<int>(std::chrono::duration_cast<TimeSeconds>(
+                                   GetProcessCPUTimeNs() - timer.ctime_cpu)
+                                   .count());
           break;
         }
       }
     }
 
-    if (tid_to_kill)
-      SerializeLogsAndKillThread(tid_to_kill, crash_reason);
+    if (info.thread_id) {
+      SerializeLogsAndKillThread(info.thread_id, info);
+    }
 
     // Check CPU and memory guardrails (if enabled).
     lseek(stat_fd.get(), 0, SEEK_SET);
@@ -10528,6 +10918,7 @@ void Watchdog::ThreadMain() {
         static_cast<uint64_t>(stat.rss_pages) * base::GetSysPageSize();
 
     bool threshold_exceeded = false;
+    WatchdogCrashReason crash_reason{};
     {
       std::lock_guard<std::mutex> guard(mutex_);
       if (CheckMemory_Locked(rss_bytes) && !IsSyncMemoryTaggingEnabled()) {
@@ -10539,14 +10930,40 @@ void Watchdog::ThreadMain() {
       }
     }
 
-    if (threshold_exceeded)
-      SerializeLogsAndKillThread(getpid(), crash_reason);
+    if (threshold_exceeded) {
+      info.reason = crash_reason;
+      // No associated timer: info.actual_*_s remain 0.
+      SerializeLogsAndKillThread(getpid(), info);
+    }
   }
 }
 
 void Watchdog::SerializeLogsAndKillThread(int tid,
-                                          WatchdogCrashReason crash_reason) {
-  g_crash_key_reason.Set(static_cast<int>(crash_reason));
+                                          const WatchdogCrashInfo& info) {
+  g_crash_key_timeout.Set(info.timeout_s);
+  g_crash_key_actual_mono.Set(info.actual_mono_s);
+  g_crash_key_actual_boot.Set(info.actual_boot_s);
+  g_crash_key_actual_cpu.Set(info.actual_cpu_s);
+  g_crash_key_reason.Set(static_cast<int>(info.reason));
+
+  // If the embedder installed a fatal handler, give it a chance to run (e.g.
+  // to flush in-flight state) before we force-kill the process. The handler
+  // is expected to crash the process on its own (e.g. via PERFETTO_FATAL once
+  // it's done). If it doesn't crash within |kFatalHandlerGraceMs|, we proceed
+  // and force-kill from here.
+  // |fatal_handler_*| are set in Start() before the watchdog thread is
+  // created, so no locking is needed. Clearing them after invocation prevents
+  // re-posting if the same expired condition is observed again.
+  if (fatal_handler_ && fatal_handler_task_runner_) {
+    fatal_handler_task_runner_->PostTask(
+        [h = std::move(fatal_handler_), info] { h(info); });
+    fatal_handler_ = nullptr;
+    fatal_handler_task_runner_ = nullptr;
+    if (!disable_kill_failsafe_for_testing_) {
+      std::this_thread::sleep_for(
+          std::chrono::milliseconds(kFatalHandlerGraceMs));
+    }
+  }
 
   // We are about to die. Serialize the logs into the crash buffer so the
   // debuggerd crash handler picks them up and attaches to the bugreport.
@@ -10658,7 +11075,13 @@ Watchdog::Timer::Timer(Watchdog* watchdog,
     : watchdog_(watchdog) {
   if (!ms)
     return;  // No-op timer created when the watchdog is disabled.
-  timer_data_.deadline = GetWallTimeMs() + std::chrono::milliseconds(ms);
+
+  TimeMillis now_mono = GetWallTimeMs();
+  timer_data_.deadline = now_mono + std::chrono::milliseconds(ms);
+  timer_data_.ctime_mono = now_mono;
+  timer_data_.ctime_boot = GetBootTimeMs();
+  timer_data_.ctime_cpu =
+      std::chrono::duration_cast<TimeMillis>(GetProcessCPUTimeNs());
   timer_data_.thread_id = GetThreadId();
   timer_data_.crash_reason = crash_reason;
   PERFETTO_DCHECK(watchdog_);
@@ -10798,6 +11221,51 @@ void WeakRunner::PostDelayedTask(std::function<void()> f,
 }  // namespace perfetto::base
 // gen_amalgamated begin source: src/base/lock_free_task_runner.cc
 // gen_amalgamated begin header: include/perfetto/ext/base/lock_free_task_runner.h
+// gen_amalgamated begin header: include/perfetto/ext/base/flags.h
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INCLUDE_PERFETTO_EXT_BASE_FLAGS_H_
+#define INCLUDE_PERFETTO_EXT_BASE_FLAGS_H_
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+
+#if PERFETTO_BUILDFLAG(PERFETTO_ANDROID_BUILD) && \
+    PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
+// Android: aconfig generates PERFETTO_FLAGS_* macros in perfetto_flags.h
+#include <perfetto_flags.h>
+#else
+// Non-Android: Define fallback PERFETTO_FLAGS_* macros
+// These match the pattern from Android's aconfig codegen
+#define PERFETTO_FLAGS(FLAG) PERFETTO_FLAGS_##FLAG
+
+#define PERFETTO_FLAGS_TEST_READ_ONLY_FLAG false
+#define PERFETTO_FLAGS_USE_LOCKFREE_TASKRUNNER \
+  PERFETTO_BUILDFLAG(PERFETTO_ENABLE_LOCKFREE_TASKRUNNER)
+#define PERFETTO_FLAGS_BUFFER_CLONE_PRESERVE_READ_ITER true
+#define PERFETTO_FLAGS_USE_UNIX_SOCKET_INOTIFY \
+  PERFETTO_BUILDFLAG(PERFETTO_ENABLE_SOCK_INOTIFY)
+#define PERFETTO_FLAGS_TRACK_EVENT_INCREMENTAL_STATE_CLEAR_NOT_DESTROY true
+#define PERFETTO_FLAGS_TRIGGER_PERFETTO_ON_TRACED_PROBES_DISCONNECT false
+#define PERFETTO_FLAGS_USE_PCRE2 PERFETTO_BUILDFLAG(PERFETTO_PCRE2)
+#define PERFETTO_FLAGS_SYS_STATS_LARGE_READ true
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_ANDROID_BUILD) && ...
+
+#endif  // INCLUDE_PERFETTO_EXT_BASE_FLAGS_H_
 // gen_amalgamated begin header: include/perfetto/ext/base/unix_task_runner.h
 /*
  * Copyright (C) 2017 The Android Open Source Project
@@ -11409,6 +11877,17 @@ void LockFreeTaskRunner::PostTask(std::function<void()> closure) {
     Slab* slab = tail_.load();
     PERFETTO_DCHECK(slab);  // The tail_ must be always valid.
     ScopedRefcount scoped_refcount(this, slab);
+    // After incrementing the refcount, re-verify that `slab` is still the
+    // current tail. If it isn't, the slab might have been deleted between
+    // our tail_.load() above and the refcount inc (the reader's check on
+    // refcount==0 may have happened before our inc). Retry with the new tail.
+    // If the second tail.load() returns the same slab, in seq_cst order
+    // any subsequent CAS that replaces tail_ comes after this load, hence
+    // any reader's later refcount check is also after our inc and will
+    // observe refcount > 0.
+    if (PERFETTO_UNLIKELY(tail_.load() != slab)) {
+      continue;
+    }
 
     // Now that we have a slab, try appending a task to it (if there is space).
     // We have 3 cases:
@@ -12618,6 +13097,10 @@ class Subprocess {
 
   Status Poll();
 
+  // Kills the process (SIGKILL if not specified) but doesn't wait for its
+  // termination.
+  void Kill(int sig_num = 0);
+
   // Sends a signal (SIGKILL if not specified) and wait for process termination.
   void KillAndWaitForTermination(int sig_num = 0);
 
@@ -13215,8 +13698,12 @@ void Subprocess::TryReadStdoutAndErr() {
   }
 }
 
-void Subprocess::KillAndWaitForTermination(int sig_num) {
+void Subprocess::Kill(int sig_num) {
   kill(s_->pid, sig_num ? sig_num : SIGKILL);
+}
+
+void Subprocess::KillAndWaitForTermination(int sig_num) {
+  Kill(sig_num);
   Wait();
   // TryReadExitStatus must have joined the thread.
   PERFETTO_DCHECK(!s_->waitpid_thread.joinable());
@@ -13552,9 +14039,13 @@ bool Subprocess::Wait(int timeout_ms) {
   return true;
 }
 
-void Subprocess::KillAndWaitForTermination(int exit_code) {
+void Subprocess::Kill(int exit_code) {
   auto code = exit_code ? static_cast<DWORD>(exit_code) : STATUS_CONTROL_C_EXIT;
   ::TerminateProcess(*s_->win_proc_handle, code);
+}
+
+void Subprocess::KillAndWaitForTermination(int exit_code) {
+  Kill(exit_code);
   Wait();
   // TryReadExitStatus must have joined the threads.
   PERFETTO_DCHECK(!s_->stdin_thread.joinable());
@@ -14116,6 +14607,7 @@ void PackedBufferBase::Reset() {
 // gen_amalgamated expanded: #include "perfetto/base/logging.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/utils.h"
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+// gen_amalgamated expanded: #include "perfetto/public/compiler.h"
 
 namespace protozero {
 
@@ -14125,6 +14617,8 @@ using namespace proto_utils;
 #error Unimplemented for big endian archs.
 #endif
 
+const Field TypedProtoDecoderBase::kInvalidField{};
+
 namespace {
 
 struct ParseFieldResult {
@@ -14136,8 +14630,10 @@ struct ParseFieldResult {
 
 // Parses one field and returns the field itself and a pointer to the next
 // field to parse. If parsing fails, the returned |next| == |buffer|.
-ParseFieldResult ParseOneField(const uint8_t* const buffer,
-                               const uint8_t* const end) {
+// Force-inlined so that, after inlining, the result struct is decomposed by
+// the compiler and does not round-trip through memory.
+PERFETTO_ALWAYS_INLINE ParseFieldResult
+ParseOneField(const uint8_t* const buffer, const uint8_t* const end) {
   ParseFieldResult res{ParseFieldResult::kAbort, buffer, Field{}};
 
   const uint8_t* pos = buffer;
@@ -14150,8 +14646,8 @@ ParseFieldResult ParseOneField(const uint8_t* const buffer,
   if (PERFETTO_LIKELY(*pos < 0x80)) {  // Fastpath for fields with ID < 16.
     preamble = *(pos++);
   } else {
-    const uint8_t* next = ParseVarInt(pos, end, &preamble);
-    if (PERFETTO_UNLIKELY(pos == next))
+    const uint8_t* next = ParseVarIntFast(pos, end, &preamble);
+    if (PERFETTO_UNLIKELY(!next))
       return res;
     pos = next;
   }
@@ -14167,56 +14663,47 @@ ParseFieldResult ParseOneField(const uint8_t* const buffer,
   uint64_t int_value = 0;
   uint64_t size = 0;
 
-  switch (field_type) {
-    case static_cast<uint8_t>(ProtoWireType::kVarInt): {
-      new_pos = ParseVarInt(pos, end, &int_value);
-
-      // new_pos not being greater than pos means ParseVarInt could not fully
-      // parse the number. This is because we are out of space in the buffer.
-      // Set the id to zero and return but don't update the offset so a future
-      // read can read this field.
-      if (PERFETTO_UNLIKELY(new_pos == pos))
-        return res;
-
-      break;
-    }
-
-    case static_cast<uint8_t>(ProtoWireType::kLengthDelimited): {
-      uint64_t payload_length;
-      new_pos = ParseVarInt(pos, end, &payload_length);
-      if (PERFETTO_UNLIKELY(new_pos == pos))
-        return res;
-
-      // ParseVarInt guarantees that |new_pos| <= |end| when it succeeds;
-      if (payload_length > static_cast<uint64_t>(end - new_pos))
-        return res;
-
-      const uintptr_t payload_start = reinterpret_cast<uintptr_t>(new_pos);
-      int_value = payload_start;
-      size = payload_length;
-      new_pos += payload_length;
-      break;
-    }
-
-    case static_cast<uint8_t>(ProtoWireType::kFixed64): {
-      new_pos = pos + sizeof(uint64_t);
-      if (PERFETTO_UNLIKELY(new_pos > end))
-        return res;
-      memcpy(&int_value, pos, sizeof(uint64_t));
-      break;
-    }
+  // If-chain ordered by observed frequency: wire types within a message are
+  // near-constant, so these branches predict better than a switch jump.
+  if (PERFETTO_LIKELY(field_type ==
+                      static_cast<uint8_t>(ProtoWireType::kVarInt))) {
+    new_pos = ParseVarIntFast(pos, end, &int_value);
+
+    // new_pos being null means ParseVarIntFast could not fully parse the
+    // number. This is because we are out of space in the buffer. Set the id
+    // to zero and return but don't update the offset so a future read can
+    // read this field.
+    if (PERFETTO_UNLIKELY(!new_pos))
+      return res;
+  } else if (PERFETTO_LIKELY(
+                 field_type ==
+                 static_cast<uint8_t>(ProtoWireType::kLengthDelimited))) {
+    uint64_t payload_length;
+    new_pos = ParseVarIntFast(pos, end, &payload_length);
+    if (PERFETTO_UNLIKELY(!new_pos))
+      return res;
 
-    case static_cast<uint8_t>(ProtoWireType::kFixed32): {
-      new_pos = pos + sizeof(uint32_t);
-      if (PERFETTO_UNLIKELY(new_pos > end))
-        return res;
-      memcpy(&int_value, pos, sizeof(uint32_t));
-      break;
-    }
+    // ParseVarIntFast guarantees that |new_pos| <= |end| when it succeeds;
+    if (payload_length > static_cast<uint64_t>(end - new_pos))
+      return res;
 
-    default:
-      PERFETTO_DLOG("Invalid proto field type: %u", field_type);
+    const uintptr_t payload_start = reinterpret_cast<uintptr_t>(new_pos);
+    int_value = payload_start;
+    size = payload_length;
+    new_pos += payload_length;
+  } else if (field_type == static_cast<uint8_t>(ProtoWireType::kFixed64)) {
+    new_pos = pos + sizeof(uint64_t);
+    if (PERFETTO_UNLIKELY(new_pos > end))
+      return res;
+    memcpy(&int_value, pos, sizeof(uint64_t));
+  } else if (field_type == static_cast<uint8_t>(ProtoWireType::kFixed32)) {
+    new_pos = pos + sizeof(uint32_t);
+    if (PERFETTO_UNLIKELY(new_pos > end))
       return res;
+    memcpy(&int_value, pos, sizeof(uint32_t));
+  } else {
+    PERFETTO_DLOG("Invalid proto field type: %u", field_type);
+    return res;
   }
 
   res.next = new_pos;
@@ -14242,6 +14729,26 @@ ParseFieldResult ParseOneField(const uint8_t* const buffer,
   return res;
 }
 
+// Grows the selective-decoding spill area once the inline slots are
+// exhausted, moving the spilled fields to the heap. The append itself is
+// open-coded in the decode loop; see the comment there.
+PERFETTO_NO_INLINE void ExpandSpill(Field** spill,
+                                    uint32_t* spill_capacity,
+                                    uint32_t spill_size,
+                                    std::unique_ptr<Field[]>* heap_spill) {
+  // Double the capacity, with a floor so that an exhausted spill that somehow
+  // starts from zero capacity (e.g. a moved-from state) doesn't keep doubling
+  // zero. The floor matches SelectiveTypedProtoDecoder::kSpillStackCapacity.
+  const uint32_t new_capacity = std::max(*spill_capacity * 2, 16u);
+  PERFETTO_CHECK(new_capacity > spill_size);
+  std::unique_ptr<Field[]> new_storage(new Field[new_capacity]);
+  if (spill_size > 0)
+    memcpy(&new_storage[0], *spill, sizeof(Field) * spill_size);
+  *heap_spill = std::move(new_storage);
+  *spill = &(*heap_spill)[0];
+  *spill_capacity = new_capacity;
+}
+
 }  // namespace
 
 Field ProtoDecoder::FindField(uint32_t field_id) {
@@ -14268,6 +14775,31 @@ Field ProtoDecoder::ReadField() {
 }
 
 void TypedProtoDecoderBase::ParseAllFields() {
+  ParseAllFieldsImpl<false>(nullptr, nullptr, nullptr, nullptr, nullptr);
+}
+
+void TypedProtoDecoderBase::ParseAllFieldsSelective(
+    const uint64_t* dense_mask,
+    Field** spill,
+    uint32_t* spill_capacity,
+    uint32_t* spill_size,
+    std::unique_ptr<Field[]>* heap_spill) {
+  PERFETTO_DCHECK(dense_mask && spill && spill_capacity && spill_size &&
+                  heap_spill);
+  ParseAllFieldsImpl<true>(dense_mask, spill, spill_capacity, spill_size,
+                           heap_spill);
+}
+
+// Force-inlined into the two thin entry points above: the plain
+// instantiation compiles to a loop with no trace of the mask support and
+// the wrappers' arguments fold away entirely.
+template <bool kSelective>
+PERFETTO_ALWAYS_INLINE void TypedProtoDecoderBase::ParseAllFieldsImpl(
+    const uint64_t* dense_mask,
+    Field** spill,
+    uint32_t* spill_capacity,
+    uint32_t* spill_size,
+    std::unique_ptr<Field[]>* heap_spill) {
   const uint8_t* cur = begin_;
   ParseFieldResult res;
   for (;;) {
@@ -14282,8 +14814,36 @@ void TypedProtoDecoderBase::ParseAllFields() {
     PERFETTO_DCHECK(res.parse_res == ParseFieldResult::kOk);
     PERFETTO_DCHECK(res.field.valid());
     auto field_id = res.field.id();
-    if (PERFETTO_UNLIKELY(field_id >= num_fields_))
+    if constexpr (kSelective) {
+      // Selective decoding: only allowlisted in-range ids go to the dense
+      // storage; everything else (including ids beyond the in-tree range) is
+      // appended, in wire order, to the spill area. |num_fields_| is capped
+      // at the mask's extent by SelectiveTypedProtoDecoder, so this also
+      // bounds the mask read.
+      const bool dense =
+          field_id < num_fields_ &&
+          (dense_mask[field_id / 64] & (1ULL << (field_id % 64))) != 0;
+      if (!dense) {
+        // The spill append is open-coded from the field's scalar components:
+        // a function taking the whole Field (by value or reference) makes
+        // the compiler materialize the packed Field representation on every
+        // loop iteration, including for fields that are not spilled.
+        if (PERFETTO_UNLIKELY(*spill_size >= *spill_capacity))
+          ExpandSpill(spill, spill_capacity, *spill_size, heap_spill);
+        (*spill)[(*spill_size)++].initialize(
+            field_id, static_cast<uint8_t>(res.field.type()),
+            res.field.raw_int_value(), res.field.raw_size());
+        continue;
+      }
+    } else if (PERFETTO_UNLIKELY(field_id >= num_fields_)) {
+      // Fields with an id beyond the highest field id known in-tree at compile
+      // time are out-of-tree "extension" fields (e.g. carved out of
+      // TracePacket's `extensions 1000 to 1999` range). They are intentionally
+      // not stored here because fields_ is indexed directly by field id, and
+      // extension ids are sparse and potentially very high. Callers that need
+      // them should decode selectively and consume them from unknown_fields().
       continue;
+    }
 
     // There are two reasons why we might want to expand the heap capacity:
     // 1. We are writing a non-repeated field, which has an id >
@@ -14295,8 +14855,9 @@ void TypedProtoDecoderBase::ParseAllFields() {
 
     PERFETTO_DCHECK(field_id < size_);
     Field* fld = &fields_[field_id];
-    if (PERFETTO_LIKELY(!fld->valid())) {
+    if (PERFETTO_LIKELY(!HasField(field_id))) {
       // This is the first time we see this field.
+      SetField(field_id);
       *fld = std::move(res.field);
     } else {
       // Repeated field case.
@@ -14337,13 +14898,11 @@ void TypedProtoDecoderBase::ExpandHeapStorage() {
   static_assert(std::is_trivially_copyable<Field>::value,
                 "Field must be trivially copyable");
 
-  // Zero-initialize the slots for known field IDs slots, as they can be
-  // randomly accessed. Instead, there is no need to initialize the repeated
-  // slots, because they are written linearly with no gaps and are always
-  // initialized before incrementing |size_|.
+  // There is no need to initialize the slots for known field IDs: reads of
+  // them are gated on the presence bitmap. There is also no need to initialize
+  // the repeated slots, because they are written linearly with no gaps and are
+  // always initialized before incrementing |size_|.
   const uint32_t new_size = std::max(size_, num_fields_);
-  memset(&new_storage[size_], 0, sizeof(Field) * (new_size - size_));
-
   memcpy(&new_storage[0], fields_, sizeof(Field) * size_);
 
   heap_storage_ = std::move(new_storage);
@@ -14805,7 +15364,9 @@ VmOpMerge::VmOpMerge(VmOpMerge&&) noexcept = default;
 VmOpMerge& VmOpMerge::operator=(VmOpMerge&&) = default;
 
 bool VmOpMerge::operator==(const VmOpMerge& other) const {
-  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_);
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(skip_submessages_, other.skip_submessages_)
+   && ::protozero::internal::gen_helpers::EqualsField(del_if_src_empty_, other.del_if_src_empty_);
 }
 
 bool VmOpMerge::ParseFromArray(const void* raw, size_t size) {
@@ -14818,6 +15379,12 @@ bool VmOpMerge::ParseFromArray(const void* raw, size_t size) {
       _has_field_.set(field.id());
     }
     switch (field.id()) {
+      case 1 /* skip_submessages */:
+        field.get(&skip_submessages_);
+        break;
+      case 2 /* del_if_src_empty */:
+        field.get(&del_if_src_empty_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -14839,6 +15406,16 @@ std::vector<uint8_t> VmOpMerge::SerializeAsArray() const {
 }
 
 void VmOpMerge::Serialize(::protozero::Message* msg) const {
+  // Field 1: skip_submessages
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(1, skip_submessages_, msg);
+  }
+
+  // Field 2: del_if_src_empty
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(2, del_if_src_empty_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -17233,9 +17810,12 @@ bool GpuCounterDescriptor::operator==(const GpuCounterDescriptor& other) const {
   return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
    && ::protozero::internal::gen_helpers::EqualsField(specs_, other.specs_)
    && ::protozero::internal::gen_helpers::EqualsField(blocks_, other.blocks_)
+   && ::protozero::internal::gen_helpers::EqualsField(counter_groups_, other.counter_groups_)
    && ::protozero::internal::gen_helpers::EqualsField(min_sampling_period_ns_, other.min_sampling_period_ns_)
    && ::protozero::internal::gen_helpers::EqualsField(max_sampling_period_ns_, other.max_sampling_period_ns_)
-   && ::protozero::internal::gen_helpers::EqualsField(supports_instrumented_sampling_, other.supports_instrumented_sampling_);
+   && ::protozero::internal::gen_helpers::EqualsField(supports_instrumented_sampling_, other.supports_instrumented_sampling_)
+   && ::protozero::internal::gen_helpers::EqualsField(supports_counter_names_, other.supports_counter_names_)
+   && ::protozero::internal::gen_helpers::EqualsField(supports_counter_name_globs_, other.supports_counter_name_globs_);
 }
 
 int GpuCounterDescriptor::specs_size() const { return static_cast<int>(specs_.size()); }
@@ -17244,9 +17824,13 @@ GpuCounterDescriptor_GpuCounterSpec* GpuCounterDescriptor::add_specs() { specs_.
 int GpuCounterDescriptor::blocks_size() const { return static_cast<int>(blocks_.size()); }
 void GpuCounterDescriptor::clear_blocks() { blocks_.clear(); }
 GpuCounterDescriptor_GpuCounterBlock* GpuCounterDescriptor::add_blocks() { blocks_.emplace_back(); return &blocks_.back(); }
+int GpuCounterDescriptor::counter_groups_size() const { return static_cast<int>(counter_groups_.size()); }
+void GpuCounterDescriptor::clear_counter_groups() { counter_groups_.clear(); }
+GpuCounterDescriptor_GpuCounterGroupSpec* GpuCounterDescriptor::add_counter_groups() { counter_groups_.emplace_back(); return &counter_groups_.back(); }
 bool GpuCounterDescriptor::ParseFromArray(const void* raw, size_t size) {
   specs_.clear();
   blocks_.clear();
+  counter_groups_.clear();
   unknown_fields_.clear();
   bool packed_error = false;
 
@@ -17264,6 +17848,10 @@ bool GpuCounterDescriptor::ParseFromArray(const void* raw, size_t size) {
         blocks_.emplace_back();
         blocks_.back().ParseFromArray(field.data(), field.size());
         break;
+      case 6 /* counter_groups */:
+        counter_groups_.emplace_back();
+        counter_groups_.back().ParseFromArray(field.data(), field.size());
+        break;
       case 3 /* min_sampling_period_ns */:
         field.get(&min_sampling_period_ns_);
         break;
@@ -17273,6 +17861,12 @@ bool GpuCounterDescriptor::ParseFromArray(const void* raw, size_t size) {
       case 5 /* supports_instrumented_sampling */:
         field.get(&supports_instrumented_sampling_);
         break;
+      case 7 /* supports_counter_names */:
+        field.get(&supports_counter_names_);
+        break;
+      case 8 /* supports_counter_name_globs */:
+        field.get(&supports_counter_name_globs_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -17304,6 +17898,11 @@ void GpuCounterDescriptor::Serialize(::protozero::Message* msg) const {
     it.Serialize(msg->BeginNestedMessage<::protozero::Message>(2));
   }
 
+  // Field 6: counter_groups
+  for (auto& it : counter_groups_) {
+    it.Serialize(msg->BeginNestedMessage<::protozero::Message>(6));
+  }
+
   // Field 3: min_sampling_period_ns
   if (_has_field_[3]) {
     ::protozero::internal::gen_helpers::SerializeVarInt(3, min_sampling_period_ns_, msg);
@@ -17319,6 +17918,100 @@ void GpuCounterDescriptor::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(5, supports_instrumented_sampling_, msg);
   }
 
+  // Field 7: supports_counter_names
+  if (_has_field_[7]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(7, supports_counter_names_, msg);
+  }
+
+  // Field 8: supports_counter_name_globs
+  if (_has_field_[8]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(8, supports_counter_name_globs_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
+GpuCounterDescriptor_GpuCounterGroupSpec::GpuCounterDescriptor_GpuCounterGroupSpec() = default;
+GpuCounterDescriptor_GpuCounterGroupSpec::~GpuCounterDescriptor_GpuCounterGroupSpec() = default;
+GpuCounterDescriptor_GpuCounterGroupSpec::GpuCounterDescriptor_GpuCounterGroupSpec(const GpuCounterDescriptor_GpuCounterGroupSpec&) = default;
+GpuCounterDescriptor_GpuCounterGroupSpec& GpuCounterDescriptor_GpuCounterGroupSpec::operator=(const GpuCounterDescriptor_GpuCounterGroupSpec&) = default;
+GpuCounterDescriptor_GpuCounterGroupSpec::GpuCounterDescriptor_GpuCounterGroupSpec(GpuCounterDescriptor_GpuCounterGroupSpec&&) noexcept = default;
+GpuCounterDescriptor_GpuCounterGroupSpec& GpuCounterDescriptor_GpuCounterGroupSpec::operator=(GpuCounterDescriptor_GpuCounterGroupSpec&&) = default;
+
+bool GpuCounterDescriptor_GpuCounterGroupSpec::operator==(const GpuCounterDescriptor_GpuCounterGroupSpec& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(group_id_, other.group_id_)
+   && ::protozero::internal::gen_helpers::EqualsField(name_, other.name_)
+   && ::protozero::internal::gen_helpers::EqualsField(description_, other.description_)
+   && ::protozero::internal::gen_helpers::EqualsField(counter_ids_, other.counter_ids_);
+}
+
+bool GpuCounterDescriptor_GpuCounterGroupSpec::ParseFromArray(const void* raw, size_t size) {
+  counter_ids_.clear();
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* group_id */:
+        field.get(&group_id_);
+        break;
+      case 2 /* name */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &name_);
+        break;
+      case 3 /* description */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &description_);
+        break;
+      case 4 /* counter_ids */:
+        counter_ids_.emplace_back();
+        field.get(&counter_ids_.back());
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string GpuCounterDescriptor_GpuCounterGroupSpec::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> GpuCounterDescriptor_GpuCounterGroupSpec::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void GpuCounterDescriptor_GpuCounterGroupSpec::Serialize(::protozero::Message* msg) const {
+  // Field 1: group_id
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(1, group_id_, msg);
+  }
+
+  // Field 2: name
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeString(2, name_, msg);
+  }
+
+  // Field 3: description
+  if (_has_field_[3]) {
+    ::protozero::internal::gen_helpers::SerializeString(3, description_, msg);
+  }
+
+  // Field 4: counter_ids
+  for (auto& it : counter_ids_) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(4, it, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -17433,7 +18126,8 @@ bool GpuCounterDescriptor_GpuCounterSpec::operator==(const GpuCounterDescriptor_
    && ::protozero::internal::gen_helpers::EqualsField(numerator_units_, other.numerator_units_)
    && ::protozero::internal::gen_helpers::EqualsField(denominator_units_, other.denominator_units_)
    && ::protozero::internal::gen_helpers::EqualsField(select_by_default_, other.select_by_default_)
-   && ::protozero::internal::gen_helpers::EqualsField(groups_, other.groups_);
+   && ::protozero::internal::gen_helpers::EqualsField(groups_, other.groups_)
+   && ::protozero::internal::gen_helpers::EqualsField(value_direction_, other.value_direction_);
 }
 
 bool GpuCounterDescriptor_GpuCounterSpec::ParseFromArray(const void* raw, size_t size) {
@@ -17479,6 +18173,9 @@ bool GpuCounterDescriptor_GpuCounterSpec::ParseFromArray(const void* raw, size_t
         groups_.emplace_back();
         field.get(&groups_.back());
         break;
+      case 11 /* value_direction */:
+        field.get(&value_direction_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -17545,6 +18242,11 @@ void GpuCounterDescriptor_GpuCounterSpec::Serialize(::protozero::Message* msg) c
     ::protozero::internal::gen_helpers::SerializeVarInt(10, it, msg);
   }
 
+  // Field 11: value_direction
+  if (_has_field_[11]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(11, value_direction_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -18026,7 +18728,8 @@ bool PerfEvents_RawEvent::operator==(const PerfEvents_RawEvent& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(type_, other.type_)
    && ::protozero::internal::gen_helpers::EqualsField(config_, other.config_)
    && ::protozero::internal::gen_helpers::EqualsField(config1_, other.config1_)
-   && ::protozero::internal::gen_helpers::EqualsField(config2_, other.config2_);
+   && ::protozero::internal::gen_helpers::EqualsField(config2_, other.config2_)
+   && ::protozero::internal::gen_helpers::EqualsField(pmu_name_, other.pmu_name_);
 }
 
 bool PerfEvents_RawEvent::ParseFromArray(const void* raw, size_t size) {
@@ -18051,6 +18754,9 @@ bool PerfEvents_RawEvent::ParseFromArray(const void* raw, size_t size) {
       case 4 /* config2 */:
         field.get(&config2_);
         break;
+      case 5 /* pmu_name */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &pmu_name_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -18092,6 +18798,11 @@ void PerfEvents_RawEvent::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(4, config2_, msg);
   }
 
+  // Field 5: pmu_name
+  if (_has_field_[5]) {
+    ::protozero::internal::gen_helpers::SerializeString(5, pmu_name_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -18334,28 +19045,6 @@ void PerfEvents_Timebase::Serialize(::protozero::Message* msg) const {
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
-}  // namespace perfetto
-}  // namespace protos
-}  // namespace gen
-#if defined(__GNUC__) || defined(__clang__)
-#pragma GCC diagnostic pop
-#endif
-// gen_amalgamated begin source: gen/protos/perfetto/common/protolog_common.gen.cc
-// gen_amalgamated expanded: #include "perfetto/protozero/gen_field_helpers.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/scattered_heap_buffer.h"
-// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
-#if defined(__GNUC__) || defined(__clang__)
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wfloat-equal"
-#endif
-// gen_amalgamated expanded: #include "protos/perfetto/common/protolog_common.gen.h"
-
-namespace perfetto {
-namespace protos {
-namespace gen {
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -18425,7 +19114,8 @@ bool SystemInfo::operator==(const SystemInfo& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(num_cpus_, other.num_cpus_)
    && ::protozero::internal::gen_helpers::EqualsField(timezone_off_mins_, other.timezone_off_mins_)
    && ::protozero::internal::gen_helpers::EqualsField(hz_, other.hz_)
-   && ::protozero::internal::gen_helpers::EqualsField(system_ram_bytes_, other.system_ram_bytes_);
+   && ::protozero::internal::gen_helpers::EqualsField(system_ram_bytes_, other.system_ram_bytes_)
+   && ::protozero::internal::gen_helpers::EqualsField(machine_name_, other.machine_name_);
 }
 
 bool SystemInfo::ParseFromArray(const void* raw, size_t size) {
@@ -18486,6 +19176,9 @@ bool SystemInfo::ParseFromArray(const void* raw, size_t size) {
       case 16 /* system_ram_bytes */:
         field.get(&system_ram_bytes_);
         break;
+      case 17 /* machine_name */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &machine_name_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -18587,6 +19280,11 @@ void SystemInfo::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(16, system_ram_bytes_, msg);
   }
 
+  // Field 17: machine_name
+  if (_has_field_[17]) {
+    ::protozero::internal::gen_helpers::SerializeString(17, machine_name_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -18672,6 +19370,161 @@ void Utsname::Serialize(::protozero::Message* msg) const {
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+// gen_amalgamated begin source: gen/protos/perfetto/common/trace_attributes.gen.cc
+// gen_amalgamated expanded: #include "perfetto/protozero/gen_field_helpers.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/scattered_heap_buffer.h"
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
+#endif
+// gen_amalgamated expanded: #include "protos/perfetto/common/trace_attributes.gen.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+TraceAttributes::TraceAttributes() = default;
+TraceAttributes::~TraceAttributes() = default;
+TraceAttributes::TraceAttributes(const TraceAttributes&) = default;
+TraceAttributes& TraceAttributes::operator=(const TraceAttributes&) = default;
+TraceAttributes::TraceAttributes(TraceAttributes&&) noexcept = default;
+TraceAttributes& TraceAttributes::operator=(TraceAttributes&&) = default;
+
+bool TraceAttributes::operator==(const TraceAttributes& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(attribute_, other.attribute_);
+}
+
+int TraceAttributes::attribute_size() const { return static_cast<int>(attribute_.size()); }
+void TraceAttributes::clear_attribute() { attribute_.clear(); }
+TraceAttributes_Attribute* TraceAttributes::add_attribute() { attribute_.emplace_back(); return &attribute_.back(); }
+bool TraceAttributes::ParseFromArray(const void* raw, size_t size) {
+  attribute_.clear();
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* attribute */:
+        attribute_.emplace_back();
+        attribute_.back().ParseFromArray(field.data(), field.size());
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string TraceAttributes::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> TraceAttributes::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void TraceAttributes::Serialize(::protozero::Message* msg) const {
+  // Field 1: attribute
+  for (auto& it : attribute_) {
+    it.Serialize(msg->BeginNestedMessage<::protozero::Message>(1));
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
+TraceAttributes_Attribute::TraceAttributes_Attribute() = default;
+TraceAttributes_Attribute::~TraceAttributes_Attribute() = default;
+TraceAttributes_Attribute::TraceAttributes_Attribute(const TraceAttributes_Attribute&) = default;
+TraceAttributes_Attribute& TraceAttributes_Attribute::operator=(const TraceAttributes_Attribute&) = default;
+TraceAttributes_Attribute::TraceAttributes_Attribute(TraceAttributes_Attribute&&) noexcept = default;
+TraceAttributes_Attribute& TraceAttributes_Attribute::operator=(TraceAttributes_Attribute&&) = default;
+
+bool TraceAttributes_Attribute::operator==(const TraceAttributes_Attribute& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(key_, other.key_)
+   && ::protozero::internal::gen_helpers::EqualsField(long_value_, other.long_value_)
+   && ::protozero::internal::gen_helpers::EqualsField(string_value_, other.string_value_);
+}
+
+bool TraceAttributes_Attribute::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* key */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &key_);
+        break;
+      case 2 /* long_value */:
+        field.get(&long_value_);
+        break;
+      case 3 /* string_value */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &string_value_);
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string TraceAttributes_Attribute::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> TraceAttributes_Attribute::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void TraceAttributes_Attribute::Serialize(::protozero::Message* msg) const {
+  // Field 1: key
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeString(1, key_, msg);
+  }
+
+  // Field 2: long_value
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(2, long_value_, msg);
+  }
+
+  // Field 3: string_value
+  if (_has_field_[3]) {
+    ::protozero::internal::gen_helpers::SerializeString(3, string_value_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -19927,7 +20780,9 @@ bool TracingServiceState_Producer::operator==(const TracingServiceState_Producer
    && ::protozero::internal::gen_helpers::EqualsField(pid_, other.pid_)
    && ::protozero::internal::gen_helpers::EqualsField(uid_, other.uid_)
    && ::protozero::internal::gen_helpers::EqualsField(sdk_version_, other.sdk_version_)
-   && ::protozero::internal::gen_helpers::EqualsField(frozen_, other.frozen_);
+   && ::protozero::internal::gen_helpers::EqualsField(frozen_, other.frozen_)
+   && ::protozero::internal::gen_helpers::EqualsField(machine_id_, other.machine_id_)
+   && ::protozero::internal::gen_helpers::EqualsField(machine_name_, other.machine_name_);
 }
 
 bool TracingServiceState_Producer::ParseFromArray(const void* raw, size_t size) {
@@ -19958,6 +20813,12 @@ bool TracingServiceState_Producer::ParseFromArray(const void* raw, size_t size)
       case 6 /* frozen */:
         field.get(&frozen_);
         break;
+      case 7 /* machine_id */:
+        field.get(&machine_id_);
+        break;
+      case 8 /* machine_name */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &machine_name_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -20009,6 +20870,16 @@ void TracingServiceState_Producer::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(6, frozen_, msg);
   }
 
+  // Field 7: machine_id
+  if (_has_field_[7]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(7, machine_id_, msg);
+  }
+
+  // Field 8: machine_name
+  if (_has_field_[8]) {
+    ::protozero::internal::gen_helpers::SerializeString(8, machine_name_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -20191,6 +21062,83 @@ void TrackEventCategory::Serialize(::protozero::Message* msg) const {
 namespace perfetto {
 namespace protos {
 namespace gen {
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+// gen_amalgamated begin source: gen/protos/perfetto/config/android/android_aflags_config.gen.cc
+// gen_amalgamated expanded: #include "perfetto/protozero/gen_field_helpers.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/scattered_heap_buffer.h"
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
+#endif
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+AndroidAflagsConfig::AndroidAflagsConfig() = default;
+AndroidAflagsConfig::~AndroidAflagsConfig() = default;
+AndroidAflagsConfig::AndroidAflagsConfig(const AndroidAflagsConfig&) = default;
+AndroidAflagsConfig& AndroidAflagsConfig::operator=(const AndroidAflagsConfig&) = default;
+AndroidAflagsConfig::AndroidAflagsConfig(AndroidAflagsConfig&&) noexcept = default;
+AndroidAflagsConfig& AndroidAflagsConfig::operator=(AndroidAflagsConfig&&) = default;
+
+bool AndroidAflagsConfig::operator==(const AndroidAflagsConfig& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(poll_ms_, other.poll_ms_);
+}
+
+bool AndroidAflagsConfig::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* poll_ms */:
+        field.get(&poll_ms_);
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string AndroidAflagsConfig::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> AndroidAflagsConfig::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void AndroidAflagsConfig::Serialize(::protozero::Message* msg) const {
+  // Field 1: poll_ms
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(1, poll_ms_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -20305,7 +21253,8 @@ bool AndroidInputEventConfig::operator==(const AndroidInputEventConfig& other) c
    && ::protozero::internal::gen_helpers::EqualsField(mode_, other.mode_)
    && ::protozero::internal::gen_helpers::EqualsField(rules_, other.rules_)
    && ::protozero::internal::gen_helpers::EqualsField(trace_dispatcher_input_events_, other.trace_dispatcher_input_events_)
-   && ::protozero::internal::gen_helpers::EqualsField(trace_dispatcher_window_dispatch_, other.trace_dispatcher_window_dispatch_);
+   && ::protozero::internal::gen_helpers::EqualsField(trace_dispatcher_window_dispatch_, other.trace_dispatcher_window_dispatch_)
+   && ::protozero::internal::gen_helpers::EqualsField(trace_evdev_events_, other.trace_evdev_events_);
 }
 
 int AndroidInputEventConfig::rules_size() const { return static_cast<int>(rules_.size()); }
@@ -20335,6 +21284,9 @@ bool AndroidInputEventConfig::ParseFromArray(const void* raw, size_t size) {
       case 4 /* trace_dispatcher_window_dispatch */:
         field.get(&trace_dispatcher_window_dispatch_);
         break;
+      case 5 /* trace_evdev_events */:
+        field.get(&trace_evdev_events_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -20376,6 +21328,11 @@ void AndroidInputEventConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(4, trace_dispatcher_window_dispatch_, msg);
   }
 
+  // Field 5: trace_evdev_events
+  if (_has_field_[5]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(5, trace_evdev_events_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -21017,6 +21974,110 @@ void CpuPerUidConfig::Serialize(::protozero::Message* msg) const {
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+// gen_amalgamated begin source: gen/protos/perfetto/config/android/display_video_config.gen.cc
+// gen_amalgamated expanded: #include "perfetto/protozero/gen_field_helpers.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/scattered_heap_buffer.h"
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
+#endif
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/display_video_config.gen.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+DisplayVideoConfig::DisplayVideoConfig() = default;
+DisplayVideoConfig::~DisplayVideoConfig() = default;
+DisplayVideoConfig::DisplayVideoConfig(const DisplayVideoConfig&) = default;
+DisplayVideoConfig& DisplayVideoConfig::operator=(const DisplayVideoConfig&) = default;
+DisplayVideoConfig::DisplayVideoConfig(DisplayVideoConfig&&) noexcept = default;
+DisplayVideoConfig& DisplayVideoConfig::operator=(DisplayVideoConfig&&) = default;
+
+bool DisplayVideoConfig::operator==(const DisplayVideoConfig& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(scale_, other.scale_)
+   && ::protozero::internal::gen_helpers::EqualsField(format_, other.format_)
+   && ::protozero::internal::gen_helpers::EqualsField(key_frame_interval_secs_, other.key_frame_interval_secs_)
+   && ::protozero::internal::gen_helpers::EqualsField(max_stream_size_bytes_, other.max_stream_size_bytes_);
+}
+
+bool DisplayVideoConfig::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* scale */:
+        field.get(&scale_);
+        break;
+      case 2 /* format */:
+        field.get(&format_);
+        break;
+      case 3 /* key_frame_interval_secs */:
+        field.get(&key_frame_interval_secs_);
+        break;
+      case 4 /* max_stream_size_bytes */:
+        field.get(&max_stream_size_bytes_);
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string DisplayVideoConfig::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> DisplayVideoConfig::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void DisplayVideoConfig::Serialize(::protozero::Message* msg) const {
+  // Field 1: scale
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeFixed(1, scale_, msg);
+  }
+
+  // Field 2: format
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(2, format_, msg);
+  }
+
+  // Field 3: key_frame_interval_secs
+  if (_has_field_[3]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(3, key_frame_interval_secs_, msg);
+  }
+
+  // Field 4: max_stream_size_bytes
+  if (_has_field_[4]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(4, max_stream_size_bytes_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -21344,11 +22405,13 @@ PackagesListConfig& PackagesListConfig::operator=(PackagesListConfig&&) = defaul
 bool PackagesListConfig::operator==(const PackagesListConfig& other) const {
   return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
    && ::protozero::internal::gen_helpers::EqualsField(package_name_filter_, other.package_name_filter_)
+   && ::protozero::internal::gen_helpers::EqualsField(package_name_regex_filter_, other.package_name_regex_filter_)
    && ::protozero::internal::gen_helpers::EqualsField(only_write_on_cpu_use_every_ms_, other.only_write_on_cpu_use_every_ms_);
 }
 
 bool PackagesListConfig::ParseFromArray(const void* raw, size_t size) {
   package_name_filter_.clear();
+  package_name_regex_filter_.clear();
   unknown_fields_.clear();
   bool packed_error = false;
 
@@ -21362,6 +22425,10 @@ bool PackagesListConfig::ParseFromArray(const void* raw, size_t size) {
         package_name_filter_.emplace_back();
         ::protozero::internal::gen_helpers::DeserializeString(field, &package_name_filter_.back());
         break;
+      case 3 /* package_name_regex_filter */:
+        package_name_regex_filter_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &package_name_regex_filter_.back());
+        break;
       case 2 /* only_write_on_cpu_use_every_ms */:
         field.get(&only_write_on_cpu_use_every_ms_);
         break;
@@ -21391,6 +22458,11 @@ void PackagesListConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeString(1, it, msg);
   }
 
+  // Field 3: package_name_regex_filter
+  for (auto& it : package_name_regex_filter_) {
+    ::protozero::internal::gen_helpers::SerializeString(3, it, msg);
+  }
+
   // Field 2: only_write_on_cpu_use_every_ms
   if (_has_field_[2]) {
     ::protozero::internal::gen_helpers::SerializeVarInt(2, only_write_on_cpu_use_every_ms_, msg);
@@ -21516,7 +22588,6 @@ void PixelModemConfig::Serialize(::protozero::Message* msg) const {
 #pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/protolog_config.gen.h"
-// gen_amalgamated expanded: #include "protos/perfetto/common/protolog_common.gen.h"
 
 namespace perfetto {
 namespace protos {
@@ -21949,7 +23020,8 @@ WindowManagerConfig& WindowManagerConfig::operator=(WindowManagerConfig&&) = def
 bool WindowManagerConfig::operator==(const WindowManagerConfig& other) const {
   return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
    && ::protozero::internal::gen_helpers::EqualsField(log_frequency_, other.log_frequency_)
-   && ::protozero::internal::gen_helpers::EqualsField(log_level_, other.log_level_);
+   && ::protozero::internal::gen_helpers::EqualsField(log_level_, other.log_level_)
+   && ::protozero::internal::gen_helpers::EqualsField(log_mode_, other.log_mode_);
 }
 
 bool WindowManagerConfig::ParseFromArray(const void* raw, size_t size) {
@@ -21968,6 +23040,9 @@ bool WindowManagerConfig::ParseFromArray(const void* raw, size_t size) {
       case 2 /* log_level */:
         field.get(&log_level_);
         break;
+      case 3 /* log_mode */:
+        field.get(&log_mode_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -21999,6 +23074,11 @@ void WindowManagerConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(2, log_level_, msg);
   }
 
+  // Field 3: log_mode
+  if (_has_field_[3]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(3, log_mode_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -22857,12 +23937,15 @@ bool GpuCounterConfig::operator==(const GpuCounterConfig& other) const {
   return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
    && ::protozero::internal::gen_helpers::EqualsField(counter_period_ns_, other.counter_period_ns_)
    && ::protozero::internal::gen_helpers::EqualsField(counter_ids_, other.counter_ids_)
+   && ::protozero::internal::gen_helpers::EqualsField(counter_names_, other.counter_names_)
    && ::protozero::internal::gen_helpers::EqualsField(instrumented_sampling_, other.instrumented_sampling_)
+   && ::protozero::internal::gen_helpers::EqualsField(instrumented_sampling_config_, other.instrumented_sampling_config_)
    && ::protozero::internal::gen_helpers::EqualsField(fix_gpu_clock_, other.fix_gpu_clock_);
 }
 
 bool GpuCounterConfig::ParseFromArray(const void* raw, size_t size) {
   counter_ids_.clear();
+  counter_names_.clear();
   unknown_fields_.clear();
   bool packed_error = false;
 
@@ -22879,9 +23962,16 @@ bool GpuCounterConfig::ParseFromArray(const void* raw, size_t size) {
         counter_ids_.emplace_back();
         field.get(&counter_ids_.back());
         break;
+      case 6 /* counter_names */:
+        counter_names_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &counter_names_.back());
+        break;
       case 3 /* instrumented_sampling */:
         field.get(&instrumented_sampling_);
         break;
+      case 5 /* instrumented_sampling_config */:
+        (*instrumented_sampling_config_).ParseFromArray(field.data(), field.size());
+        break;
       case 4 /* fix_gpu_clock */:
         field.get(&fix_gpu_clock_);
         break;
@@ -22916,11 +24006,21 @@ void GpuCounterConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(2, it, msg);
   }
 
+  // Field 6: counter_names
+  for (auto& it : counter_names_) {
+    ::protozero::internal::gen_helpers::SerializeString(6, it, msg);
+  }
+
   // Field 3: instrumented_sampling
   if (_has_field_[3]) {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(3, instrumented_sampling_, msg);
   }
 
+  // Field 5: instrumented_sampling_config
+  if (_has_field_[5]) {
+    (*instrumented_sampling_config_).Serialize(msg->BeginNestedMessage<::protozero::Message>(5));
+  }
+
   // Field 4: fix_gpu_clock
   if (_has_field_[4]) {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(4, fix_gpu_clock_, msg);
@@ -22929,6 +24029,230 @@ void GpuCounterConfig::Serialize(::protozero::Message* msg) const {
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
+
+GpuCounterConfig_InstrumentedSamplingConfig::GpuCounterConfig_InstrumentedSamplingConfig() = default;
+GpuCounterConfig_InstrumentedSamplingConfig::~GpuCounterConfig_InstrumentedSamplingConfig() = default;
+GpuCounterConfig_InstrumentedSamplingConfig::GpuCounterConfig_InstrumentedSamplingConfig(const GpuCounterConfig_InstrumentedSamplingConfig&) = default;
+GpuCounterConfig_InstrumentedSamplingConfig& GpuCounterConfig_InstrumentedSamplingConfig::operator=(const GpuCounterConfig_InstrumentedSamplingConfig&) = default;
+GpuCounterConfig_InstrumentedSamplingConfig::GpuCounterConfig_InstrumentedSamplingConfig(GpuCounterConfig_InstrumentedSamplingConfig&&) noexcept = default;
+GpuCounterConfig_InstrumentedSamplingConfig& GpuCounterConfig_InstrumentedSamplingConfig::operator=(GpuCounterConfig_InstrumentedSamplingConfig&&) = default;
+
+bool GpuCounterConfig_InstrumentedSamplingConfig::operator==(const GpuCounterConfig_InstrumentedSamplingConfig& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(activity_name_filters_, other.activity_name_filters_)
+   && ::protozero::internal::gen_helpers::EqualsField(activity_tx_include_globs_, other.activity_tx_include_globs_)
+   && ::protozero::internal::gen_helpers::EqualsField(activity_tx_exclude_globs_, other.activity_tx_exclude_globs_)
+   && ::protozero::internal::gen_helpers::EqualsField(activity_ranges_, other.activity_ranges_);
+}
+
+int GpuCounterConfig_InstrumentedSamplingConfig::activity_name_filters_size() const { return static_cast<int>(activity_name_filters_.size()); }
+void GpuCounterConfig_InstrumentedSamplingConfig::clear_activity_name_filters() { activity_name_filters_.clear(); }
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter* GpuCounterConfig_InstrumentedSamplingConfig::add_activity_name_filters() { activity_name_filters_.emplace_back(); return &activity_name_filters_.back(); }
+int GpuCounterConfig_InstrumentedSamplingConfig::activity_ranges_size() const { return static_cast<int>(activity_ranges_.size()); }
+void GpuCounterConfig_InstrumentedSamplingConfig::clear_activity_ranges() { activity_ranges_.clear(); }
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange* GpuCounterConfig_InstrumentedSamplingConfig::add_activity_ranges() { activity_ranges_.emplace_back(); return &activity_ranges_.back(); }
+bool GpuCounterConfig_InstrumentedSamplingConfig::ParseFromArray(const void* raw, size_t size) {
+  activity_name_filters_.clear();
+  activity_tx_include_globs_.clear();
+  activity_tx_exclude_globs_.clear();
+  activity_ranges_.clear();
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 3 /* activity_name_filters */:
+        activity_name_filters_.emplace_back();
+        activity_name_filters_.back().ParseFromArray(field.data(), field.size());
+        break;
+      case 6 /* activity_tx_include_globs */:
+        activity_tx_include_globs_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &activity_tx_include_globs_.back());
+        break;
+      case 7 /* activity_tx_exclude_globs */:
+        activity_tx_exclude_globs_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &activity_tx_exclude_globs_.back());
+        break;
+      case 5 /* activity_ranges */:
+        activity_ranges_.emplace_back();
+        activity_ranges_.back().ParseFromArray(field.data(), field.size());
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string GpuCounterConfig_InstrumentedSamplingConfig::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> GpuCounterConfig_InstrumentedSamplingConfig::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void GpuCounterConfig_InstrumentedSamplingConfig::Serialize(::protozero::Message* msg) const {
+  // Field 3: activity_name_filters
+  for (auto& it : activity_name_filters_) {
+    it.Serialize(msg->BeginNestedMessage<::protozero::Message>(3));
+  }
+
+  // Field 6: activity_tx_include_globs
+  for (auto& it : activity_tx_include_globs_) {
+    ::protozero::internal::gen_helpers::SerializeString(6, it, msg);
+  }
+
+  // Field 7: activity_tx_exclude_globs
+  for (auto& it : activity_tx_exclude_globs_) {
+    ::protozero::internal::gen_helpers::SerializeString(7, it, msg);
+  }
+
+  // Field 5: activity_ranges
+  for (auto& it : activity_ranges_) {
+    it.Serialize(msg->BeginNestedMessage<::protozero::Message>(5));
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange() = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::~GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange() = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&) = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange& GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::operator=(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&) = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange(GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&&) noexcept = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange& GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::operator=(GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&&) = default;
+
+bool GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::operator==(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(skip_, other.skip_)
+   && ::protozero::internal::gen_helpers::EqualsField(count_, other.count_);
+}
+
+bool GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* skip */:
+        field.get(&skip_);
+        break;
+      case 2 /* count */:
+        field.get(&count_);
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange::Serialize(::protozero::Message* msg) const {
+  // Field 1: skip
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(1, skip_, msg);
+  }
+
+  // Field 2: count
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(2, count_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter() = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::~GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter() = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&) = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter& GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::operator=(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&) = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter(GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&&) noexcept = default;
+GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter& GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::operator=(GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&&) = default;
+
+bool GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::operator==(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(name_glob_, other.name_glob_)
+   && ::protozero::internal::gen_helpers::EqualsField(name_base_, other.name_base_);
+}
+
+bool GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* name_glob */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &name_glob_);
+        break;
+      case 2 /* name_base */:
+        field.get(&name_base_);
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::Serialize(::protozero::Message* msg) const {
+  // Field 1: name_glob
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeString(1, name_glob_, msg);
+  }
+
+  // Field 2: name_base
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(2, name_base_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -23393,6 +24717,105 @@ void ConsoleConfig::Serialize(::protozero::Message* msg) const {
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+// gen_amalgamated begin source: gen/protos/perfetto/config/linux/journald_config.gen.cc
+// gen_amalgamated expanded: #include "perfetto/protozero/gen_field_helpers.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/scattered_heap_buffer.h"
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
+#endif
+// gen_amalgamated expanded: #include "protos/perfetto/config/linux/journald_config.gen.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+SystemdJournaldConfig::SystemdJournaldConfig() = default;
+SystemdJournaldConfig::~SystemdJournaldConfig() = default;
+SystemdJournaldConfig::SystemdJournaldConfig(const SystemdJournaldConfig&) = default;
+SystemdJournaldConfig& SystemdJournaldConfig::operator=(const SystemdJournaldConfig&) = default;
+SystemdJournaldConfig::SystemdJournaldConfig(SystemdJournaldConfig&&) noexcept = default;
+SystemdJournaldConfig& SystemdJournaldConfig::operator=(SystemdJournaldConfig&&) = default;
+
+bool SystemdJournaldConfig::operator==(const SystemdJournaldConfig& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(min_prio_, other.min_prio_)
+   && ::protozero::internal::gen_helpers::EqualsField(filter_identifiers_, other.filter_identifiers_)
+   && ::protozero::internal::gen_helpers::EqualsField(filter_units_, other.filter_units_);
+}
+
+bool SystemdJournaldConfig::ParseFromArray(const void* raw, size_t size) {
+  filter_identifiers_.clear();
+  filter_units_.clear();
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* min_prio */:
+        field.get(&min_prio_);
+        break;
+      case 2 /* filter_identifiers */:
+        filter_identifiers_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &filter_identifiers_.back());
+        break;
+      case 3 /* filter_units */:
+        filter_units_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &filter_units_.back());
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string SystemdJournaldConfig::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> SystemdJournaldConfig::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void SystemdJournaldConfig::Serialize(::protozero::Message* msg) const {
+  // Field 1: min_prio
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(1, min_prio_, msg);
+  }
+
+  // Field 2: filter_identifiers
+  for (auto& it : filter_identifiers_) {
+    ::protozero::internal::gen_helpers::SerializeString(2, it, msg);
+  }
+
+  // Field 3: filter_units
+  for (auto& it : filter_units_) {
+    ::protozero::internal::gen_helpers::SerializeString(3, it, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -24143,6 +25566,7 @@ void HeapprofdConfig_ContinuousDumpConfig::Serialize(::protozero::Message* msg)
 #pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/java_hprof_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/profiling/smaps_config.gen.h"
 
 namespace perfetto {
 namespace protos {
@@ -24162,8 +25586,11 @@ bool JavaHprofConfig::operator==(const JavaHprofConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(target_installed_by_, other.target_installed_by_)
    && ::protozero::internal::gen_helpers::EqualsField(continuous_dump_config_, other.continuous_dump_config_)
    && ::protozero::internal::gen_helpers::EqualsField(min_anonymous_memory_kb_, other.min_anonymous_memory_kb_)
+   && ::protozero::internal::gen_helpers::EqualsField(min_java_heap_size_kb_, other.min_java_heap_size_kb_)
    && ::protozero::internal::gen_helpers::EqualsField(dump_smaps_, other.dump_smaps_)
-   && ::protozero::internal::gen_helpers::EqualsField(ignored_types_, other.ignored_types_);
+   && ::protozero::internal::gen_helpers::EqualsField(smaps_config_, other.smaps_config_)
+   && ::protozero::internal::gen_helpers::EqualsField(ignored_types_, other.ignored_types_)
+   && ::protozero::internal::gen_helpers::EqualsField(dump_oome_callstack_, other.dump_oome_callstack_);
 }
 
 bool JavaHprofConfig::ParseFromArray(const void* raw, size_t size) {
@@ -24198,13 +25625,22 @@ bool JavaHprofConfig::ParseFromArray(const void* raw, size_t size) {
       case 4 /* min_anonymous_memory_kb */:
         field.get(&min_anonymous_memory_kb_);
         break;
+      case 9 /* min_java_heap_size_kb */:
+        field.get(&min_java_heap_size_kb_);
+        break;
       case 5 /* dump_smaps */:
         field.get(&dump_smaps_);
         break;
+      case 8 /* smaps_config */:
+        (*smaps_config_).ParseFromArray(field.data(), field.size());
+        break;
       case 6 /* ignored_types */:
         ignored_types_.emplace_back();
         ::protozero::internal::gen_helpers::DeserializeString(field, &ignored_types_.back());
         break;
+      case 10 /* dump_oome_callstack */:
+        field.get(&dump_oome_callstack_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -24251,16 +25687,31 @@ void JavaHprofConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(4, min_anonymous_memory_kb_, msg);
   }
 
+  // Field 9: min_java_heap_size_kb
+  if (_has_field_[9]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(9, min_java_heap_size_kb_, msg);
+  }
+
   // Field 5: dump_smaps
   if (_has_field_[5]) {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(5, dump_smaps_, msg);
   }
 
+  // Field 8: smaps_config
+  if (_has_field_[8]) {
+    (*smaps_config_).Serialize(msg->BeginNestedMessage<::protozero::Message>(8));
+  }
+
   // Field 6: ignored_types
   for (auto& it : ignored_types_) {
     ::protozero::internal::gen_helpers::SerializeString(6, it, msg);
   }
 
+  // Field 10: dump_oome_callstack
+  if (_has_field_[10]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(10, dump_oome_callstack_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -24374,6 +25825,8 @@ bool PerfEventConfig::operator==(const PerfEventConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(followers_, other.followers_)
    && ::protozero::internal::gen_helpers::EqualsField(callstack_sampling_, other.callstack_sampling_)
    && ::protozero::internal::gen_helpers::EqualsField(target_cpu_, other.target_cpu_)
+   && ::protozero::internal::gen_helpers::EqualsField(ignore_open_failure_, other.ignore_open_failure_)
+   && ::protozero::internal::gen_helpers::EqualsField(cpuid_, other.cpuid_)
    && ::protozero::internal::gen_helpers::EqualsField(ring_buffer_read_period_ms_, other.ring_buffer_read_period_ms_)
    && ::protozero::internal::gen_helpers::EqualsField(ring_buffer_pages_, other.ring_buffer_pages_)
    && ::protozero::internal::gen_helpers::EqualsField(max_enqueued_footprint_kb_, other.max_enqueued_footprint_kb_)
@@ -24397,6 +25850,7 @@ FollowerEvent* PerfEventConfig::add_followers() { followers_.emplace_back(); ret
 bool PerfEventConfig::ParseFromArray(const void* raw, size_t size) {
   followers_.clear();
   target_cpu_.clear();
+  cpuid_.clear();
   target_installed_by_.clear();
   target_pid_.clear();
   target_cmdline_.clear();
@@ -24425,6 +25879,13 @@ bool PerfEventConfig::ParseFromArray(const void* raw, size_t size) {
         target_cpu_.emplace_back();
         field.get(&target_cpu_.back());
         break;
+      case 21 /* ignore_open_failure */:
+        field.get(&ignore_open_failure_);
+        break;
+      case 22 /* cpuid */:
+        cpuid_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &cpuid_.back());
+        break;
       case 8 /* ring_buffer_read_period_ms */:
         field.get(&ring_buffer_read_period_ms_);
         break;
@@ -24516,6 +25977,16 @@ void PerfEventConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(20, it, msg);
   }
 
+  // Field 21: ignore_open_failure
+  if (_has_field_[21]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(21, ignore_open_failure_, msg);
+  }
+
+  // Field 22: cpuid
+  for (auto& it : cpuid_) {
+    ::protozero::internal::gen_helpers::SerializeString(22, it, msg);
+  }
+
   // Field 8: ring_buffer_read_period_ms
   if (_has_field_[8]) {
     ::protozero::internal::gen_helpers::SerializeVarInt(8, ring_buffer_read_period_ms_, msg);
@@ -24775,6 +26246,208 @@ void PerfEventConfig_Scope::Serialize(::protozero::Message* msg) const {
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+// gen_amalgamated begin source: gen/protos/perfetto/config/profiling/smaps_config.gen.cc
+// gen_amalgamated expanded: #include "perfetto/protozero/gen_field_helpers.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/scattered_heap_buffer.h"
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
+#endif
+// gen_amalgamated expanded: #include "protos/perfetto/config/profiling/smaps_config.gen.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+RedactionRule::RedactionRule() = default;
+RedactionRule::~RedactionRule() = default;
+RedactionRule::RedactionRule(const RedactionRule&) = default;
+RedactionRule& RedactionRule::operator=(const RedactionRule&) = default;
+RedactionRule::RedactionRule(RedactionRule&&) noexcept = default;
+RedactionRule& RedactionRule::operator=(RedactionRule&&) = default;
+
+bool RedactionRule::operator==(const RedactionRule& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(pattern_, other.pattern_)
+   && ::protozero::internal::gen_helpers::EqualsField(match_mode_, other.match_mode_)
+   && ::protozero::internal::gen_helpers::EqualsField(keep_full_, other.keep_full_)
+   && ::protozero::internal::gen_helpers::EqualsField(replacement_name_, other.replacement_name_)
+   && ::protozero::internal::gen_helpers::EqualsField(keep_file_extension_, other.keep_file_extension_)
+   && ::protozero::internal::gen_helpers::EqualsField(keep_path_elements_, other.keep_path_elements_);
+}
+
+bool RedactionRule::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* pattern */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &pattern_);
+        break;
+      case 2 /* match_mode */:
+        field.get(&match_mode_);
+        break;
+      case 3 /* keep_full */:
+        field.get(&keep_full_);
+        break;
+      case 4 /* replacement_name */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &replacement_name_);
+        break;
+      case 5 /* keep_file_extension */:
+        field.get(&keep_file_extension_);
+        break;
+      case 6 /* keep_path_elements */:
+        field.get(&keep_path_elements_);
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string RedactionRule::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> RedactionRule::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void RedactionRule::Serialize(::protozero::Message* msg) const {
+  // Field 1: pattern
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeString(1, pattern_, msg);
+  }
+
+  // Field 2: match_mode
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(2, match_mode_, msg);
+  }
+
+  // Field 3: keep_full
+  if (_has_field_[3]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(3, keep_full_, msg);
+  }
+
+  // Field 4: replacement_name
+  if (_has_field_[4]) {
+    ::protozero::internal::gen_helpers::SerializeString(4, replacement_name_, msg);
+  }
+
+  // Field 5: keep_file_extension
+  if (_has_field_[5]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(5, keep_file_extension_, msg);
+  }
+
+  // Field 6: keep_path_elements
+  if (_has_field_[6]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(6, keep_path_elements_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
+SmapsConfig::SmapsConfig() = default;
+SmapsConfig::~SmapsConfig() = default;
+SmapsConfig::SmapsConfig(const SmapsConfig&) = default;
+SmapsConfig& SmapsConfig::operator=(const SmapsConfig&) = default;
+SmapsConfig::SmapsConfig(SmapsConfig&&) noexcept = default;
+SmapsConfig& SmapsConfig::operator=(SmapsConfig&&) = default;
+
+bool SmapsConfig::operator==(const SmapsConfig& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(vma_fields_, other.vma_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(unaggregated_, other.unaggregated_)
+   && ::protozero::internal::gen_helpers::EqualsField(name_redaction_rules_, other.name_redaction_rules_);
+}
+
+int SmapsConfig::name_redaction_rules_size() const { return static_cast<int>(name_redaction_rules_.size()); }
+void SmapsConfig::clear_name_redaction_rules() { name_redaction_rules_.clear(); }
+RedactionRule* SmapsConfig::add_name_redaction_rules() { name_redaction_rules_.emplace_back(); return &name_redaction_rules_.back(); }
+bool SmapsConfig::ParseFromArray(const void* raw, size_t size) {
+  vma_fields_.clear();
+  name_redaction_rules_.clear();
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* vma_fields */:
+        vma_fields_.emplace_back();
+        field.get(&vma_fields_.back());
+        break;
+      case 2 /* unaggregated */:
+        field.get(&unaggregated_);
+        break;
+      case 3 /* name_redaction_rules */:
+        name_redaction_rules_.emplace_back();
+        name_redaction_rules_.back().ParseFromArray(field.data(), field.size());
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string SmapsConfig::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> SmapsConfig::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void SmapsConfig::Serialize(::protozero::Message* msg) const {
+  // Field 1: vma_fields
+  for (auto& it : vma_fields_) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(1, it, msg);
+  }
+
+  // Field 2: unaggregated
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(2, unaggregated_, msg);
+  }
+
+  // Field 3: name_redaction_rules
+  for (auto& it : name_redaction_rules_) {
+    it.Serialize(msg->BeginNestedMessage<::protozero::Message>(3));
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -25235,7 +26908,8 @@ bool SysStatsConfig::operator==(const SysStatsConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(psi_period_ms_, other.psi_period_ms_)
    && ::protozero::internal::gen_helpers::EqualsField(thermal_period_ms_, other.thermal_period_ms_)
    && ::protozero::internal::gen_helpers::EqualsField(cpuidle_period_ms_, other.cpuidle_period_ms_)
-   && ::protozero::internal::gen_helpers::EqualsField(gpufreq_period_ms_, other.gpufreq_period_ms_);
+   && ::protozero::internal::gen_helpers::EqualsField(gpufreq_period_ms_, other.gpufreq_period_ms_)
+   && ::protozero::internal::gen_helpers::EqualsField(slab_period_ms_, other.slab_period_ms_);
 }
 
 bool SysStatsConfig::ParseFromArray(const void* raw, size_t size) {
@@ -25296,6 +26970,9 @@ bool SysStatsConfig::ParseFromArray(const void* raw, size_t size) {
       case 14 /* gpufreq_period_ms */:
         field.get(&gpufreq_period_ms_);
         break;
+      case 15 /* slab_period_ms */:
+        field.get(&slab_period_ms_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -25387,6 +27064,11 @@ void SysStatsConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(14, gpufreq_period_ms_, msg);
   }
 
+  // Field 15: slab_period_ms
+  if (_has_field_[15]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(15, slab_period_ms_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -25421,7 +27103,8 @@ SystemInfoConfig::SystemInfoConfig(SystemInfoConfig&&) noexcept = default;
 SystemInfoConfig& SystemInfoConfig::operator=(SystemInfoConfig&&) = default;
 
 bool SystemInfoConfig::operator==(const SystemInfoConfig& other) const {
-  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_);
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(irq_names_, other.irq_names_);
 }
 
 bool SystemInfoConfig::ParseFromArray(const void* raw, size_t size) {
@@ -25434,6 +27117,9 @@ bool SystemInfoConfig::ParseFromArray(const void* raw, size_t size) {
       _has_field_.set(field.id());
     }
     switch (field.id()) {
+      case 1 /* irq_names */:
+        field.get(&irq_names_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -25455,6 +27141,11 @@ std::vector<uint8_t> SystemInfoConfig::SerializeAsArray() const {
 }
 
 void SystemInfoConfig::Serialize(::protozero::Message* msg) const {
+  // Field 1: irq_names
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(1, irq_names_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -25932,6 +27623,7 @@ void ChromiumHistogramSamplesConfig_HistogramSample::Serialize(::protozero::Mess
 // gen_amalgamated expanded: #include "protos/perfetto/config/priority_boost/priority_boost_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/data_source_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/qnx/qnx_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/linux/journald_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/chrome/histogram_samples.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/system_info/system_info_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/track_event/track_event_config.gen.h"
@@ -25941,6 +27633,7 @@ void ChromiumHistogramSamplesConfig_HistogramSample::Serialize(::protozero::Mess
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/perf_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/perf_events.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/java_hprof_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/profiling/smaps_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/heapprofd_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/process_stats/process_stats_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/statsd/statsd_tracing_config.gen.h"
@@ -25963,8 +27656,8 @@ void ChromiumHistogramSamplesConfig_HistogramSample::Serialize(::protozero::Mess
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/user_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_transactions_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_layers_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/display_video_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/protolog_config.gen.h"
-// gen_amalgamated expanded: #include "protos/perfetto/common/protolog_common.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/pixel_modem_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/packages_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/network_trace_config.gen.h"
@@ -25979,6 +27672,7 @@ void ChromiumHistogramSamplesConfig_HistogramSample::Serialize(::protozero::Mess
 // gen_amalgamated expanded: #include "protos/perfetto/common/android_log_constants.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 
@@ -26853,6 +28547,9 @@ bool DataSourceConfig::operator==(const DataSourceConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(cpu_per_uid_config_, other.cpu_per_uid_config_)
    && ::protozero::internal::gen_helpers::EqualsField(user_list_config_, other.user_list_config_)
    && ::protozero::internal::gen_helpers::EqualsField(inputmethod_config_, other.inputmethod_config_)
+   && ::protozero::internal::gen_helpers::EqualsField(android_aflags_config_, other.android_aflags_config_)
+   && ::protozero::internal::gen_helpers::EqualsField(journald_config_, other.journald_config_)
+   && ::protozero::internal::gen_helpers::EqualsField(display_video_config_, other.display_video_config_)
    && ::protozero::internal::gen_helpers::EqualsField(qnx_config_, other.qnx_config_)
    && ::protozero::internal::gen_helpers::EqualsField(legacy_config_, other.legacy_config_)
    && ::protozero::internal::gen_helpers::EqualsField(for_testing_, other.for_testing_);
@@ -27021,6 +28718,15 @@ bool DataSourceConfig::ParseFromArray(const void* raw, size_t size) {
       case 139 /* inputmethod_config */:
         ::protozero::internal::gen_helpers::DeserializeString(field, &inputmethod_config_);
         break;
+      case 140 /* android_aflags_config */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &android_aflags_config_);
+        break;
+      case 141 /* journald_config */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &journald_config_);
+        break;
+      case 142 /* display_video_config */:
+        ::protozero::internal::gen_helpers::DeserializeString(field, &display_video_config_);
+        break;
       case 150 /* qnx_config */:
         ::protozero::internal::gen_helpers::DeserializeString(field, &qnx_config_);
         break;
@@ -27306,6 +29012,21 @@ void DataSourceConfig::Serialize(::protozero::Message* msg) const {
     msg->AppendString(139, inputmethod_config_);
   }
 
+  // Field 140: android_aflags_config
+  if (_has_field_[140]) {
+    msg->AppendString(140, android_aflags_config_);
+  }
+
+  // Field 141: journald_config
+  if (_has_field_[141]) {
+    msg->AppendString(141, journald_config_);
+  }
+
+  // Field 142: display_video_config
+  if (_has_field_[142]) {
+    msg->AppendString(142, display_video_config_);
+  }
+
   // Field 150: qnx_config
   if (_has_field_[150]) {
     msg->AppendString(150, qnx_config_);
@@ -27359,7 +29080,10 @@ bool EtwConfig::operator==(const EtwConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(kernel_flags_, other.kernel_flags_)
    && ::protozero::internal::gen_helpers::EqualsField(scheduler_provider_events_, other.scheduler_provider_events_)
    && ::protozero::internal::gen_helpers::EqualsField(memory_provider_events_, other.memory_provider_events_)
-   && ::protozero::internal::gen_helpers::EqualsField(file_provider_events_, other.file_provider_events_);
+   && ::protozero::internal::gen_helpers::EqualsField(file_provider_events_, other.file_provider_events_)
+   && ::protozero::internal::gen_helpers::EqualsField(stack_sampling_events_, other.stack_sampling_events_)
+   && ::protozero::internal::gen_helpers::EqualsField(disk_provider_events_, other.disk_provider_events_)
+   && ::protozero::internal::gen_helpers::EqualsField(system_io_provider_events_, other.system_io_provider_events_);
 }
 
 bool EtwConfig::ParseFromArray(const void* raw, size_t size) {
@@ -27367,6 +29091,9 @@ bool EtwConfig::ParseFromArray(const void* raw, size_t size) {
   scheduler_provider_events_.clear();
   memory_provider_events_.clear();
   file_provider_events_.clear();
+  stack_sampling_events_.clear();
+  disk_provider_events_.clear();
+  system_io_provider_events_.clear();
   unknown_fields_.clear();
   bool packed_error = false;
 
@@ -27392,6 +29119,18 @@ bool EtwConfig::ParseFromArray(const void* raw, size_t size) {
         file_provider_events_.emplace_back();
         ::protozero::internal::gen_helpers::DeserializeString(field, &file_provider_events_.back());
         break;
+      case 5 /* stack_sampling_events */:
+        stack_sampling_events_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &stack_sampling_events_.back());
+        break;
+      case 6 /* disk_provider_events */:
+        disk_provider_events_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &disk_provider_events_.back());
+        break;
+      case 7 /* system_io_provider_events */:
+        system_io_provider_events_.emplace_back();
+        ::protozero::internal::gen_helpers::DeserializeString(field, &system_io_provider_events_.back());
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -27433,6 +29172,21 @@ void EtwConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeString(4, it, msg);
   }
 
+  // Field 5: stack_sampling_events
+  for (auto& it : stack_sampling_events_) {
+    ::protozero::internal::gen_helpers::SerializeString(5, it, msg);
+  }
+
+  // Field 6: disk_provider_events
+  for (auto& it : disk_provider_events_) {
+    ::protozero::internal::gen_helpers::SerializeString(6, it, msg);
+  }
+
+  // Field 7: system_io_provider_events
+  for (auto& it : system_io_provider_events_) {
+    ::protozero::internal::gen_helpers::SerializeString(7, it, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -27545,6 +29299,7 @@ void InterceptorConfig::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/priority_boost/priority_boost_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/data_source_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/qnx/qnx_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/linux/journald_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/chrome/histogram_samples.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/system_info/system_info_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/track_event/track_event_config.gen.h"
@@ -27554,6 +29309,7 @@ void InterceptorConfig::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/perf_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/perf_events.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/java_hprof_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/profiling/smaps_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/heapprofd_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/process_stats/process_stats_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/statsd/statsd_tracing_config.gen.h"
@@ -27576,8 +29332,8 @@ void InterceptorConfig::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/user_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_transactions_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_layers_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/display_video_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/protolog_config.gen.h"
-// gen_amalgamated expanded: #include "protos/perfetto/common/protolog_common.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/pixel_modem_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/packages_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/network_trace_config.gen.h"
@@ -27592,6 +29348,7 @@ void InterceptorConfig::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/common/android_log_constants.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 
@@ -28149,6 +29906,7 @@ void TestConfig_DummyFields::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/priority_boost/priority_boost_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/data_source_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/qnx/qnx_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/linux/journald_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/chrome/histogram_samples.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/system_info/system_info_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/track_event/track_event_config.gen.h"
@@ -28158,6 +29916,7 @@ void TestConfig_DummyFields::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/perf_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/perf_events.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/java_hprof_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/profiling/smaps_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/heapprofd_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/process_stats/process_stats_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/statsd/statsd_tracing_config.gen.h"
@@ -28180,8 +29939,8 @@ void TestConfig_DummyFields::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/user_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_transactions_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_layers_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/display_video_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/protolog_config.gen.h"
-// gen_amalgamated expanded: #include "protos/perfetto/common/protolog_common.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/pixel_modem_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/packages_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/network_trace_config.gen.h"
@@ -28196,6 +29955,7 @@ void TestConfig_DummyFields::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/common/android_log_constants.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 
@@ -29722,7 +31482,8 @@ bool TraceConfig_BuiltinDataSource::operator==(const TraceConfig_BuiltinDataSour
    && ::protozero::internal::gen_helpers::EqualsField(primary_trace_clock_, other.primary_trace_clock_)
    && ::protozero::internal::gen_helpers::EqualsField(snapshot_interval_ms_, other.snapshot_interval_ms_)
    && ::protozero::internal::gen_helpers::EqualsField(prefer_suspend_clock_for_snapshot_, other.prefer_suspend_clock_for_snapshot_)
-   && ::protozero::internal::gen_helpers::EqualsField(disable_chunk_usage_histograms_, other.disable_chunk_usage_histograms_);
+   && ::protozero::internal::gen_helpers::EqualsField(disable_chunk_usage_histograms_, other.disable_chunk_usage_histograms_)
+   && ::protozero::internal::gen_helpers::EqualsField(disable_extension_descriptors_, other.disable_extension_descriptors_);
 }
 
 bool TraceConfig_BuiltinDataSource::ParseFromArray(const void* raw, size_t size) {
@@ -29759,6 +31520,9 @@ bool TraceConfig_BuiltinDataSource::ParseFromArray(const void* raw, size_t size)
       case 8 /* disable_chunk_usage_histograms */:
         field.get(&disable_chunk_usage_histograms_);
         break;
+      case 9 /* disable_extension_descriptors */:
+        field.get(&disable_extension_descriptors_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -29820,6 +31584,11 @@ void TraceConfig_BuiltinDataSource::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(8, disable_chunk_usage_histograms_, msg);
   }
 
+  // Field 9: disable_extension_descriptors
+  if (_has_field_[9]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(9, disable_extension_descriptors_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -30041,12 +31810,12 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/common/perf_events.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/common/protolog_common.pbzero.cc
-// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/common/sys_stats_counters.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/common/system_info.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/common/trace_attributes.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/common/trace_stats.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/common/tracing_service_capabilities.pbzero.cc
@@ -30055,23 +31824,7 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/common/track_event_descriptor.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/graphics/insets.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/graphics/point.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/graphics/rect.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/winscope_extensions.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/protolog.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/shell_transition.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/surfaceflinger_common.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/surfaceflinger_layers.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/surfaceflinger_transactions.pbzero.cc
+// gen_amalgamated begin source: gen/protos/perfetto/trace/android/android_aflags.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/android_game_intervention_list.pbzero.cc
 // Intentionally empty (crbug.com/998165)
@@ -30079,26 +31832,18 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/android_system_property.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/app_wakelock_data.pbzero.cc
-// Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/bluetooth_trace.pbzero.cc
-// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/camera_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/cpu_per_uid_data.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/frame_timeline_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/gpu_mem_event.pbzero.cc
-// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/graphics_frame_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/initial_display_state.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/kernel_wakelock_data.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/network_trace.pbzero.cc
-// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/packages_list.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/pixel_modem_events.pbzero.cc
@@ -30119,15 +31864,17 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/gpu/gpu_log.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/gpu/gpu_mem_event.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/gpu/gpu_render_stage_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/gpu/vulkan_api_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/gpu/vulkan_memory_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/deobfuscation.pbzero.cc
+// gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/art_process_metadata.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/heap_graph.pbzero.cc
+// gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/deobfuscation.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/profile_common.pbzero.cc
 // Intentionally empty (crbug.com/998165)
@@ -30181,6 +31928,8 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/track_event/source_location.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/track_event/state_descriptor.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/track_event/task_execution.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/track_event/thread_descriptor.pbzero.cc
@@ -34344,7 +36093,9 @@ Screenshot& Screenshot::operator=(Screenshot&&) = default;
 
 bool Screenshot::operator==(const Screenshot& other) const {
   return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
-   && ::protozero::internal::gen_helpers::EqualsField(jpg_image_, other.jpg_image_);
+   && ::protozero::internal::gen_helpers::EqualsField(jpg_image_, other.jpg_image_)
+   && ::protozero::internal::gen_helpers::EqualsField(pam_image_, other.pam_image_)
+   && ::protozero::internal::gen_helpers::EqualsField(ppm_image_, other.ppm_image_);
 }
 
 bool Screenshot::ParseFromArray(const void* raw, size_t size) {
@@ -34360,6 +36111,12 @@ bool Screenshot::ParseFromArray(const void* raw, size_t size) {
       case 1 /* jpg_image */:
         field.get(&jpg_image_);
         break;
+      case 2 /* pam_image */:
+        field.get(&pam_image_);
+        break;
+      case 3 /* ppm_image */:
+        field.get(&ppm_image_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -34386,6 +36143,16 @@ void Screenshot::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeString(1, jpg_image_, msg);
   }
 
+  // Field 2: pam_image
+  if (_has_field_[2]) {
+    ::protozero::internal::gen_helpers::SerializeString(2, pam_image_, msg);
+  }
+
+  // Field 3: ppm_image
+  if (_has_field_[3]) {
+    ::protozero::internal::gen_helpers::SerializeString(3, ppm_image_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -34566,6 +36333,74 @@ void UnsymbolizedSourceLocation::Serialize(::protozero::Message* msg) const {
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+// gen_amalgamated begin source: gen/protos/perfetto/trace/track_event/state_descriptor.gen.cc
+// gen_amalgamated expanded: #include "perfetto/protozero/gen_field_helpers.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/scattered_heap_buffer.h"
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
+#endif
+// gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/state_descriptor.gen.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+StateDescriptor::StateDescriptor() = default;
+StateDescriptor::~StateDescriptor() = default;
+StateDescriptor::StateDescriptor(const StateDescriptor&) = default;
+StateDescriptor& StateDescriptor::operator=(const StateDescriptor&) = default;
+StateDescriptor::StateDescriptor(StateDescriptor&&) noexcept = default;
+StateDescriptor& StateDescriptor::operator=(StateDescriptor&&) = default;
+
+bool StateDescriptor::operator==(const StateDescriptor& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_);
+}
+
+bool StateDescriptor::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string StateDescriptor::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> StateDescriptor::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void StateDescriptor::Serialize(::protozero::Message* msg) const {
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -34801,6 +36636,7 @@ void ThreadDescriptor::Serialize(::protozero::Message* msg) const {
 #pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
 // gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/track_descriptor.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/state_descriptor.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/counter_descriptor.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/thread_descriptor.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/process_descriptor.gen.h"
@@ -34831,12 +36667,15 @@ bool TrackDescriptor::operator==(const TrackDescriptor& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(thread_, other.thread_)
    && ::protozero::internal::gen_helpers::EqualsField(chrome_thread_, other.chrome_thread_)
    && ::protozero::internal::gen_helpers::EqualsField(counter_, other.counter_)
+   && ::protozero::internal::gen_helpers::EqualsField(state_, other.state_)
    && ::protozero::internal::gen_helpers::EqualsField(disallow_merging_with_system_tracks_, other.disallow_merging_with_system_tracks_)
    && ::protozero::internal::gen_helpers::EqualsField(child_ordering_, other.child_ordering_)
    && ::protozero::internal::gen_helpers::EqualsField(sibling_order_rank_, other.sibling_order_rank_)
    && ::protozero::internal::gen_helpers::EqualsField(sibling_merge_behavior_, other.sibling_merge_behavior_)
    && ::protozero::internal::gen_helpers::EqualsField(sibling_merge_key_, other.sibling_merge_key_)
-   && ::protozero::internal::gen_helpers::EqualsField(sibling_merge_key_int_, other.sibling_merge_key_int_);
+   && ::protozero::internal::gen_helpers::EqualsField(sibling_merge_key_int_, other.sibling_merge_key_int_)
+   && ::protozero::internal::gen_helpers::EqualsField(process_ordering_, other.process_ordering_)
+   && ::protozero::internal::gen_helpers::EqualsField(thread_ordering_, other.thread_ordering_);
 }
 
 bool TrackDescriptor::ParseFromArray(const void* raw, size_t size) {
@@ -34882,6 +36721,9 @@ bool TrackDescriptor::ParseFromArray(const void* raw, size_t size) {
       case 8 /* counter */:
         (*counter_).ParseFromArray(field.data(), field.size());
         break;
+      case 18 /* state */:
+        (*state_).ParseFromArray(field.data(), field.size());
+        break;
       case 9 /* disallow_merging_with_system_tracks */:
         field.get(&disallow_merging_with_system_tracks_);
         break;
@@ -34900,6 +36742,12 @@ bool TrackDescriptor::ParseFromArray(const void* raw, size_t size) {
       case 17 /* sibling_merge_key_int */:
         field.get(&sibling_merge_key_int_);
         break;
+      case 19 /* process_ordering */:
+        field.get(&process_ordering_);
+        break;
+      case 20 /* thread_ordering */:
+        field.get(&thread_ordering_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -34976,6 +36824,11 @@ void TrackDescriptor::Serialize(::protozero::Message* msg) const {
     (*counter_).Serialize(msg->BeginNestedMessage<::protozero::Message>(8));
   }
 
+  // Field 18: state
+  if (_has_field_[18]) {
+    (*state_).Serialize(msg->BeginNestedMessage<::protozero::Message>(18));
+  }
+
   // Field 9: disallow_merging_with_system_tracks
   if (_has_field_[9]) {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(9, disallow_merging_with_system_tracks_, msg);
@@ -35006,6 +36859,16 @@ void TrackDescriptor::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(17, sibling_merge_key_int_, msg);
   }
 
+  // Field 19: process_ordering
+  if (_has_field_[19]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(19, process_ordering_, msg);
+  }
+
+  // Field 20: thread_ordering
+  if (_has_field_[20]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(20, thread_ordering_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -36089,6 +37952,8 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 #endif
 // gen_amalgamated begin source: gen/protos/perfetto/common/semantic_type.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/config/android/android_aflags_config.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/android/android_game_intervention_list_config.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/android/android_input_event_config.pbzero.cc
@@ -36105,6 +37970,8 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/android/cpu_per_uid_config.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/config/android/display_video_config.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/android/inputmethod_config.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/android/kernel_wakelocks_config.pbzero.cc
@@ -36139,6 +38006,8 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/interceptors/console_config.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/config/linux/journald_config.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/power/android_power_config.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/priority_boost/priority_boost_config.pbzero.cc
@@ -36151,6 +38020,8 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/profiling/perf_event_config.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/config/profiling/smaps_config.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/protovm/protovm_config.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/config/qnx/qnx_config.pbzero.cc
@@ -36369,10 +38240,14 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/ftrace/workqueue.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/generic_kernel/generic_gpu_frequency.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/generic_kernel/generic_power.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/generic_kernel/generic_task.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/linux/journald_event.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/perfetto/perfetto_metatrace.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/perfetto/trace_provenance.pbzero.cc
@@ -36397,6 +38272,10 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/system_info/cpu_info.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/system_info/gpu_info.pbzero.cc
+// Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/system_info/interrupt_info.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/translation/translation_table.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/remote_clock_sync.pbzero.cc
@@ -36417,8 +38296,6 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/ui_state.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/evdev.pbzero.cc
-// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: src/tracing/trace_writer_base.cc
 /*
  * Copyright (C) 2019 The Android Open Source Project
@@ -38601,9 +40478,6 @@ struct PERFETTO_EXPORT_COMPONENT TracingServiceInitOpts {
   using CompressorFn = void (*)(std::vector<TracePacket>*);
   CompressorFn compressor_fn = nullptr;
 
-  // Whether the relay endpoint is enabled on producer transport(s).
-  bool enable_relay_endpoint = false;
-
   // An (optional) list of proto extension descriptors to dump into each trace
   // recorded. This is to support injecting protos that are known by the
   // embedder (e.g. the Android vendor image) but not by the upstream perfetto.
@@ -39324,6 +41198,9 @@ class SharedMemoryArbiterImpl : public SharedMemoryArbiter {
   // true iff all occurrences were replaced.
   bool ReplaceCommitPlaceholderBufferIdsLocked();
 
+  void CommitDataWithSplitting(std::unique_ptr<CommitDataRequest> req,
+                               std::function<void()> callback);
+
   // Update and return |fully_bound_| based on the arbiter's |pending_writers_|
   // state.
   bool UpdateFullyBoundLocked();
@@ -39785,7 +41662,6 @@ class TraceWriterImpl : public TraceWriter,
 // gen_amalgamated expanded: #include "perfetto/base/logging.h"
 // gen_amalgamated expanded: #include "perfetto/base/task_runner.h"
 // gen_amalgamated expanded: #include "perfetto/base/time.h"
-// gen_amalgamated expanded: #include "perfetto/ext/base/flags.h"
 // gen_amalgamated expanded: #include "perfetto/ext/tracing/core/commit_data_request.h"
 // gen_amalgamated expanded: #include "perfetto/ext/tracing/core/shared_memory.h"
 // gen_amalgamated expanded: #include "perfetto/ext/tracing/core/shared_memory_abi.h"
@@ -39801,6 +41677,10 @@ static_assert(sizeof(BufferID) == sizeof(uint16_t),
               "The MaybeUnboundBufferID logic requires BufferID not to grow "
               "above uint16_t.");
 
+constexpr size_t kMaxCommitDataRequestChunkSize =
+    128 * 1024 - 512;  // This is ipc::kIPCBufferSize - 512, see
+                       // |kMaxTracePacketSliceSize| in tracing_service_impl.h
+
 MaybeUnboundBufferID MakeTargetBufferIdForReservation(uint16_t reservation_id) {
   // Reservation IDs are stored in the upper bits.
   PERFETTO_CHECK(reservation_id > 0);
@@ -40148,15 +42028,11 @@ void SharedMemoryArbiterImpl::UpdateCommitDataRequest(
     // trace.
     if (fully_bound_ &&
         (last_patch_req || bytes_pending_commit_ >= shmem_abi_.size() / 2)) {
-      bool should_post_immediate_flush = true;
-      if constexpr (PERFETTO_FLAGS(SMA_PREVENT_DUPLICATE_IMMEDIATE_FLUSHES)) {
-        // Only post an immediate flush task if we haven't already posted one.
-        // This prevents spamming the task runner with immediate flushes when
-        // the buffer remains over 50% full while chunks continue to be
-        // committed. See b/330580374.
-        should_post_immediate_flush = !immediate_flush_scheduled_;
-      }
-      if (should_post_immediate_flush) {
+      // Only post an immediate flush task if we haven't already posted one.
+      // This prevents spamming the task runner with immediate flushes when
+      // the buffer remains over 50% full while chunks continue to be
+      // committed. See b/330580374.
+      if (!immediate_flush_scheduled_) {
         weak_this = weak_ptr_factory_.GetWeakPtr();
         task_runner_to_post_delayed_callback_on = task_runner_;
         flush_delay_ms = 0;
@@ -40182,18 +42058,13 @@ void SharedMemoryArbiterImpl::UpdateCommitDataRequest(
         scoped_lock.unlock();
         FlushPendingCommitDataRequests();
       } else {
-        bool should_post_immediate_flush = true;
-        if constexpr (PERFETTO_FLAGS(SMA_PREVENT_DUPLICATE_IMMEDIATE_FLUSHES)) {
-          // Only post an immediate flush task if we haven't already posted one.
-          // This prevents spamming the task runner with immediate flushes when
-          // the buffer remains over 50% full while chunks continue to be
-          // committed. See b/330580374.
-          should_post_immediate_flush = !immediate_flush_scheduled_;
-        }
-
         // Since we aren't on the |task_runner_| thread post a task instead,
         // in order to prevent non-overlaping commit data request flushes.
-        if (should_post_immediate_flush) {
+        // Only post an immediate flush task if we haven't already posted one.
+        // This prevents spamming the task runner with immediate flushes when
+        // the buffer remains over 50% full while chunks continue to be
+        // committed. See b/330580374.
+        if (!immediate_flush_scheduled_) {
           weak_this = weak_ptr_factory_.GetWeakPtr();
           task_runner_to_post_delayed_callback_on = task_runner_;
           flush_delay_ms = 0;
@@ -40403,7 +42274,11 @@ void SharedMemoryArbiterImpl::FlushPendingCommitDataRequests(
   }  // scoped_lock
 
   if (req) {
-    producer_endpoint_->CommitData(*req, callback);
+    if (use_shmem_emulation_) {
+      CommitDataWithSplitting(std::move(req), std::move(callback));
+    } else {
+      producer_endpoint_->CommitData(*req, std::move(callback));
+    }
   } else if (callback) {
     // If |req| was nullptr, it means that an enqueued deferred commit was
     // executed just before this. At this point send an empty commit request
@@ -40413,6 +42288,60 @@ void SharedMemoryArbiterImpl::FlushPendingCommitDataRequests(
   }
 }
 
+void SharedMemoryArbiterImpl::CommitDataWithSplitting(
+    std::unique_ptr<CommitDataRequest> req,
+    std::function<void()> callback) {
+  PERFETTO_DCHECK(use_shmem_emulation_);
+
+  // If the request is small enough to be sent in a single IPC
+  // avoid the request splitting.
+  uint32_t total_bytes = 0;
+  for (const auto& ctm : req->chunks_to_move()) {
+    total_bytes += static_cast<uint32_t>(ctm.data().size());
+  }
+  if (total_bytes < kMaxCommitDataRequestChunkSize) {
+    producer_endpoint_->CommitData(*req, std::move(callback));
+    return;
+  }
+
+  uint32_t current_req_bytes = 0;
+  auto split_req = std::make_unique<CommitDataRequest>();
+
+  for (auto& ctm : *req->mutable_chunks_to_move()) {
+    // If the pending requests exceed the size of the IPC buffer, then
+    // split them into multiple commits to avoid an |IPC Frame too large|
+    // error on the receiving side. This is based on the fact that chunks
+    // cannot be greater than |kMaxPageSize| in size, which is less than
+    // |kIPCBufferSize|. We provide 512-bytes of headroom for message
+    // overhead.
+    if (current_req_bytes + ctm.data().size() >=
+        kMaxCommitDataRequestChunkSize) {
+      producer_endpoint_->CommitData(*split_req);
+      split_req.reset(new CommitDataRequest());
+      current_req_bytes = 0;
+    }
+
+    current_req_bytes += ctm.data().size();
+    auto* new_ctm = split_req->add_chunks_to_move();
+    new_ctm->set_page(ctm.page());
+    new_ctm->set_chunk(ctm.chunk());
+    new_ctm->set_target_buffer(ctm.target_buffer());
+    new_ctm->set_chunk_incomplete(ctm.chunk_incomplete());
+    new_ctm->set_data(ctm.data());
+  }
+
+  // In shmem emulation mode, the pending commit data requests splitting
+  // is done on a best effort basis, meaning that although rare it is
+  // possible for the last commit data request to exceed the
+  // |kIPCBufferSize| since, we aren't checking the size of the chunk
+  // patches.
+  *split_req->mutable_chunks_to_patch() =
+      std::move(*req->mutable_chunks_to_patch());
+  split_req->set_flush_request_id(req->flush_request_id());
+
+  producer_endpoint_->CommitData(*split_req, std::move(callback));
+}
+
 bool SharedMemoryArbiterImpl::TryShutdown() {
   std::lock_guard<base::MaybeRtMutex> scoped_lock(lock_);
   did_shutdown_ = true;
@@ -40684,7 +42613,7 @@ void SharedMemoryArbiterImpl::ScrapeEmulatedSharedMemoryBuffer(
     if (writer == buffer_for_writers.end())
       return;
     BufferID target_buffer_id = writer->second;
-    auto* ctm = commit_data_req_->add_chunks_to_move();
+    auto* ctm = commit_req.add_chunks_to_move();
     auto page_and_chunk = shmem_abi_.GetPageAndChunkIndex(*chunk);
     ctm->set_page(static_cast<uint32_t>(page_and_chunk.first));
     ctm->set_chunk(static_cast<uint32_t>(page_and_chunk.second));
@@ -41123,9 +43052,13 @@ TraceWriterImpl::TracePacketHandle TraceWriterImpl::NewTracePacket() {
 
     if (PERFETTO_UNLIKELY(was_dropping_packets)) {
       // We've succeeded to get a new chunk from the SMB after we entered
-      // drop_packets_ mode. Record a marker into the new packet to indicate the
-      // data loss.
-      cur_packet_->set_previous_packet_dropped(true);
+      // drop_packets_ mode. We only enter that mode when the SMB was full and
+      // we couldn't acquire a chunk, so attribute the loss to
+      // DATA_LOSS_SMB_FULL (OR-ed with DATA_LOSS_PRESENT, which every loss
+      // carries).
+      cur_packet_->set_previous_packet_dropped(
+          protos::pbzero::TracePacket::DATA_LOSS_PRESENT |
+          protos::pbzero::TracePacket::DATA_LOSS_SMB_FULL);
     }
   }
 
@@ -44877,6 +46810,7 @@ void TracingMuxerImpl::AddProducerBackend(TracingProducerBackend* backend,
   rb.producer_conn_args.shmem_page_size_hint_bytes =
       args.shmem_page_size_hint_kb * 1024;
   rb.producer_conn_args.create_socket_async = args.create_socket_async;
+  rb.producer_conn_args.machine_id = args.machine_id;
   rb.producer->Initialize(rb.backend->ConnectProducer(rb.producer_conn_args));
 }
 
@@ -46157,6 +48091,9 @@ TracingMuxerImpl::FindDataSourceRes TracingMuxerImpl::FindDataSource(
     TracingBackendId backend_id,
     DataSourceInstanceID instance_id) {
   PERFETTO_DCHECK_THREAD(thread_checker_);
+  // 0 is the sentinel id for unadopted startup data sources; never match it.
+  if (instance_id == 0)
+    return FindDataSourceRes();
   RegisteredProducerBackend& backend = *FindProducerBackendById(backend_id);
   for (const auto& rds : data_sources_) {
     DataSourceStaticState* static_state = rds.static_state;
@@ -47005,6 +48942,10 @@ protos::pbzero::BuiltinClock TrackEventInternal::clock_ = kDefaultTraceClock;
 // static
 bool TrackEventInternal::disallow_merging_with_system_tracks_ = false;
 
+// static
+BufferExhaustedPolicy TrackEventInternal::buffer_exhausted_policy_ =
+    BufferExhaustedPolicy::kDrop;
+
 // static
 void TrackEventInternal::EnableRegistry(
     const TrackEventCategoryRegistry* registry,
@@ -48100,6 +50041,9 @@ void Tracing::InitializeInternal(const TracingInitArgs& args) {
     if (args.disallow_merging_with_system_tracks) {
       internal::TrackEventInternal::SetDisallowMergingWithSystemTracks(true);
     }
+
+    internal::TrackEventInternal::SetBufferExhaustedPolicy(
+        args.track_event_buffer_exhausted_policy);
   }
 
   internal::TracingMuxerImpl::InitializeInstance(args);
@@ -48315,7 +50259,7 @@ TracingPolicy::~TracingPolicy() = default;
 namespace perfetto {
 
 // static
-uint64_t Track::process_uuid;
+uint64_t Track::process_uuid = 0;
 
 protos::gen::TrackDescriptor Track::Serialize() const {
   protos::gen::TrackDescriptor desc;
@@ -48398,12 +50342,7 @@ void ThreadTrack::Serialize(protos::pbzero::TrackDescriptor* desc) const {
 }
 
 protos::gen::TrackDescriptor NamedTrack::Serialize() const {
-  auto desc = Track::Serialize();
-  if (static_name_) {
-    desc.set_static_name(static_name_.value);
-  } else {
-    desc.set_name(dynamic_name_.value);
-  }
+  auto desc = NamedTrackBase::Serialize();
   if (sibling_merge_behavior_ != perfetto::protos::gen::TrackDescriptor::
                                      SIBLING_MERGE_BEHAVIOR_UNSPECIFIED) {
     desc.set_sibling_merge_behavior(sibling_merge_behavior_);
@@ -48416,9 +50355,11 @@ protos::gen::TrackDescriptor NamedTrack::Serialize() const {
   return desc;
 }
 
-void NamedTrack::Serialize(protos::pbzero::TrackDescriptor* desc) const {
-  auto bytes = Serialize().SerializeAsString();
-  desc->AppendRawProtoBytes(bytes.data(), bytes.size());
+protos::gen::TrackDescriptor StateTrack::Serialize() const {
+  auto desc = NamedTrackBase::Serialize();
+  // Initialize the state submessage to mark this track as a StateTrack.
+  desc.mutable_state();
+  return desc;
 }
 
 protos::gen::TrackDescriptor CounterTrack::Serialize() const {
@@ -49307,6 +51248,820 @@ void MaybeLogTriggerEvent(PerfettoTriggerAtom, int64_t, const std::string&) {}
 #endif
 
 }  // namespace perfetto::android_stats
+// gen_amalgamated begin source: src/base/regex/regex.cc
+// gen_amalgamated begin header: include/perfetto/ext/base/regex.h
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INCLUDE_PERFETTO_EXT_BASE_REGEX_H_
+#define INCLUDE_PERFETTO_EXT_BASE_REGEX_H_
+
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/status_or.h"
+
+namespace perfetto {
+namespace base {
+
+// Pimpl for the regex engine. Defined in src/base/regex/regex.cc.
+class RegexImpl;
+
+// A regular expression abstraction that hides the underlying engine.
+//
+// Construct via the two static factories:
+//   - Create()        – fallible; returns StatusOr<Regex>.
+//   - CreateOrCheck() – infallible; crashes on invalid pattern.
+//                       Use for compile-time constant patterns only.
+//
+// Regex is movable but NOT copyable. Use CopyableRegex when copy semantics
+// are needed (e.g. for storage in copyable containers).
+//
+// Patterns use ECMAScript syntax, supporting Perl-style shorthands (\d, \w,
+// \s).
+//
+// Operations:
+//   GlobalReplace()          – global substitution; returns a new string.
+//   FullMatch()              – anchored, no groups.
+//   FullMatchWithGroups()    – anchored, with capture groups.
+//   PartialMatch()           – unanchored, no groups.
+//   PartialMatchWithGroups() – unanchored, with capture groups.
+//   PartialMatchAll()        – iterator over all non-overlapping matches.
+class Regex {
+ public:
+  // Controls whether matching is case-sensitive or case-insensitive.
+  enum class CaseSensitivity : uint8_t {
+    kSensitive,
+    kInsensitive,
+  };
+
+  Regex(Regex&&) noexcept;
+  Regex& operator=(Regex&&) noexcept;
+  ~Regex();
+
+  // Regex is not copyable. Use CopyableRegex for copy semantics.
+  Regex(const Regex&) = delete;
+  Regex& operator=(const Regex&) = delete;
+
+  // Compiles |pattern| into a Regex.
+  // Returns an error if the pattern syntax is invalid.
+  static StatusOr<Regex> Create(
+      std::string_view pattern,
+      CaseSensitivity cs = CaseSensitivity::kSensitive);
+
+  // Like Create(), but crashes (PERFETTO_CHECK) on an invalid pattern.
+  // Use only for patterns that are known at compile time.
+  static Regex CreateOrCheck(std::string_view pattern,
+                             CaseSensitivity cs = CaseSensitivity::kSensitive);
+
+  // Replaces every occurrence of the regex in |s| with |replacement| and
+  // returns the resulting string.  |s| is unchanged.
+  std::string GlobalReplace(std::string_view s,
+                            std::string_view replacement) const;
+
+  // Returns true if the regex matches the entirety of |s|.
+  bool FullMatch(std::string_view s) const;
+
+  // Like FullMatch(), but also fills |out| with captured groups on success.
+  //   out[0]    – the full match.
+  //   out[1..N] – the parenthesised sub-groups.
+  // Returns false (and clears |out|) when there is no match.
+  //
+  // The string_views in |out| point into |s|; they are invalidated if |s| is
+  // modified or destroyed.
+  bool FullMatchWithGroups(std::string_view s,
+                           std::vector<std::string_view>& out) const;
+
+  // Returns true if the regex matches any substring of |s|.
+  bool PartialMatch(std::string_view s) const;
+
+  // Like PartialMatch(), but also fills |out| with captured groups on success.
+  //   out[0]    – the full match.
+  //   out[1..N] – the parenthesised sub-groups.
+  // Returns false (and clears |out|) when there is no match.
+  //
+  // The string_views in |out| point into |s|; they are invalidated if |s| is
+  // modified or destroyed.
+  bool PartialMatchWithGroups(std::string_view s,
+                              std::vector<std::string_view>& out) const;
+
+  // Iterator over all non-overlapping matches in a string.
+  class PartialMatchIterator {
+   public:
+    // Returns the next match, or std::nullopt when no more matches remain.
+    std::optional<std::string_view> Next();
+
+    // Returns the next match with capture groups. Groups are filled into
+    // |groups|. Returns std::nullopt when no more matches remain.
+    std::optional<std::string_view> NextWithGroups(
+        std::vector<std::string_view>& groups);
+
+   private:
+    friend class Regex;
+    PartialMatchIterator(const Regex* re, std::string_view input);
+    const Regex* re_;
+    std::string_view input_;
+    size_t offset_ = 0;
+    std::vector<std::string_view> groups_;  // Cached for Next().
+  };
+
+  // Returns an iterator that yields all non-overlapping matches in |s|.
+  PartialMatchIterator PartialMatchAll(std::string_view s) const;
+
+  // Accessors for pattern and case sensitivity (used by CopyableRegex).
+  const std::string& pattern() const { return pattern_; }
+  CaseSensitivity case_sensitivity() const { return cs_; }
+
+ private:
+  Regex() = default;
+  std::unique_ptr<RegexImpl> impl_;
+  std::string pattern_;
+  CaseSensitivity cs_ = CaseSensitivity::kSensitive;
+};
+
+// A copyable wrapper around Regex. Copying re-compiles the pattern from the
+// stored string, so prefer moving when the source is no longer needed.
+//
+// Use this class when Regex needs to be stored in a copyable container
+// (e.g. std::optional in a copyable struct).
+class CopyableRegex {
+ public:
+  explicit CopyableRegex(Regex regex);
+
+  CopyableRegex(const CopyableRegex& other);
+  CopyableRegex& operator=(const CopyableRegex& other);
+  CopyableRegex(CopyableRegex&&) noexcept = default;
+  CopyableRegex& operator=(CopyableRegex&&) noexcept = default;
+  ~CopyableRegex() = default;
+
+  std::string GlobalReplace(std::string_view s,
+                            std::string_view replacement) const {
+    return regex_.GlobalReplace(s, replacement);
+  }
+  bool FullMatch(std::string_view s) const { return regex_.FullMatch(s); }
+  bool FullMatchWithGroups(std::string_view s,
+                           std::vector<std::string_view>& out) const {
+    return regex_.FullMatchWithGroups(s, out);
+  }
+  bool PartialMatch(std::string_view s) const { return regex_.PartialMatch(s); }
+  bool PartialMatchWithGroups(std::string_view s,
+                              std::vector<std::string_view>& out) const {
+    return regex_.PartialMatchWithGroups(s, out);
+  }
+  Regex::PartialMatchIterator PartialMatchAll(std::string_view s) const {
+    return regex_.PartialMatchAll(s);
+  }
+
+ private:
+  Regex regex_;
+};
+
+}  // namespace base
+}  // namespace perfetto
+
+#endif  // INCLUDE_PERFETTO_EXT_BASE_REGEX_H_
+// gen_amalgamated begin header: src/base/regex/regex_pcre2.h
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SRC_BASE_REGEX_REGEX_PCRE2_H_
+#define SRC_BASE_REGEX_REGEX_PCRE2_H_
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+
+// See note in regex_re2.h. Also honor PERFETTO_REGEX_FORCE_STD: targets that
+// define it (e.g. libperfetto_client_experimental) opt out of the optional
+// backends and must not pull in <pcre2.h>, even when PERFETTO_PCRE2 is set.
+#if PERFETTO_BUILDFLAG(PERFETTO_PCRE2) && !defined(PERFETTO_REGEX_FORCE_STD)
+
+#include <limits>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/status_or.h"
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+namespace perfetto {
+namespace base {
+
+struct Pcre2CodeDeleter {
+  void operator()(pcre2_code* p) const { pcre2_code_free(p); }
+};
+
+struct Pcre2MatchDataDeleter {
+  void operator()(pcre2_match_data* p) const { pcre2_match_data_free(p); }
+};
+
+using ScopedPcre2Code = std::unique_ptr<pcre2_code, Pcre2CodeDeleter>;
+using ScopedPcre2MatchData =
+    std::unique_ptr<pcre2_match_data, Pcre2MatchDataDeleter>;
+
+// PCRE2 backend for Regex. Used on Android when the use_pcre2 flag is enabled.
+// Header-only so the compiler can inline through unique_ptr<RegexImpl>.
+class RegexPcre2 {
+ public:
+  RegexPcre2(RegexPcre2&&) noexcept = default;
+  RegexPcre2& operator=(RegexPcre2&&) noexcept = default;
+  ~RegexPcre2() = default;
+
+  RegexPcre2(const RegexPcre2&) = delete;
+  RegexPcre2& operator=(const RegexPcre2&) = delete;
+
+  static StatusOr<RegexPcre2> Create(std::string_view pattern,
+                                     bool case_insensitive) {
+    RegexPcre2 result;
+    int error_code;
+    size_t error_offset;
+    uint32_t pcre2_flags = 0;
+    if (case_insensitive) {
+      pcre2_flags |= PCRE2_CASELESS;
+    }
+    result.code_.reset(pcre2_compile(
+        reinterpret_cast<PCRE2_SPTR>(pattern.data()), pattern.size(),
+        pcre2_flags, &error_code, &error_offset, nullptr));
+    if (!result.code_) {
+      PCRE2_UCHAR buffer[256];
+      pcre2_get_error_message(error_code, buffer, sizeof(buffer));
+      return ErrStatus("PCRE2 compile error at offset %zu: %s", error_offset,
+                       reinterpret_cast<char*>(buffer));
+    }
+    // JIT-compile for faster matching. Non-fatal if JIT is unavailable.
+    pcre2_jit_compile(result.code_.get(), PCRE2_JIT_COMPLETE);
+    result.match_data_.reset(
+        pcre2_match_data_create_from_pattern(result.code_.get(), nullptr));
+    return std::move(result);
+  }
+
+  std::string GlobalReplace(std::string_view s,
+                            std::string_view replacement) const {
+    std::string out;
+    size_t out_len = s.size() + replacement.size() * 2 + 64;
+    auto do_substitute = [&](size_t* len) {
+      out.resize(*len);
+      return pcre2_substitute(
+          code_.get(), reinterpret_cast<PCRE2_SPTR>(s.data()), s.size(),
+          /*startoffset=*/0,
+          PCRE2_SUBSTITUTE_GLOBAL | PCRE2_SUBSTITUTE_OVERFLOW_LENGTH,
+          /*match_data=*/nullptr, /*mcontext=*/nullptr,
+          reinterpret_cast<PCRE2_SPTR>(replacement.data()), replacement.size(),
+          reinterpret_cast<PCRE2_UCHAR*>(out.data()), len);
+    };
+    int rc = do_substitute(&out_len);
+    if (rc == PCRE2_ERROR_NOMEMORY) {
+      // PCRE2_SUBSTITUTE_OVERFLOW_LENGTH sets out_len to the required size.
+      rc = do_substitute(&out_len);
+    }
+    if (rc >= 0) {
+      out.resize(out_len);
+      return out;
+    }
+    return std::string(s);
+  }
+
+  bool FullMatch(std::string_view s) const {
+    int rc = pcre2_match(code_.get(), reinterpret_cast<PCRE2_SPTR>(s.data()),
+                         s.size(),
+                         /*startoffset=*/0, PCRE2_ANCHORED | PCRE2_ENDANCHORED,
+                         match_data_.get(), /*mcontext=*/nullptr);
+    return rc >= 0;
+  }
+
+  bool FullMatchWithGroups(std::string_view s,
+                           std::vector<std::string_view>& out) const {
+    out.clear();
+    int rc = pcre2_match(code_.get(), reinterpret_cast<PCRE2_SPTR>(s.data()),
+                         s.size(),
+                         /*startoffset=*/0, PCRE2_ANCHORED | PCRE2_ENDANCHORED,
+                         match_data_.get(), /*mcontext=*/nullptr);
+    if (rc <= 0)
+      return false;
+    FillGroups(s, out);
+    return true;
+  }
+
+  bool PartialMatch(std::string_view s) const {
+    int rc = pcre2_match(code_.get(), reinterpret_cast<PCRE2_SPTR>(s.data()),
+                         s.size(),
+                         /*startoffset=*/0, /*options=*/0, match_data_.get(),
+                         /*mcontext=*/nullptr);
+    return rc >= 0;
+  }
+
+  bool PartialMatchWithGroups(std::string_view s,
+                              std::vector<std::string_view>& out) const {
+    out.clear();
+    int rc = pcre2_match(code_.get(), reinterpret_cast<PCRE2_SPTR>(s.data()),
+                         s.size(),
+                         /*startoffset=*/0, /*options=*/0, match_data_.get(),
+                         /*mcontext=*/nullptr);
+    if (rc <= 0)
+      return false;
+    FillGroups(s, out);
+    return true;
+  }
+
+  bool SearchWithOffset(std::string_view s,
+                        size_t start_offset,
+                        std::vector<std::string_view>& out) const {
+    out.clear();
+    if (start_offset > s.size())
+      return false;
+    int rc =
+        pcre2_match(code_.get(), reinterpret_cast<PCRE2_SPTR>(s.data()),
+                    s.size(), start_offset, /*options=*/0, match_data_.get(),
+                    /*mcontext=*/nullptr);
+    if (rc <= 0)
+      return false;
+    FillGroups(s, out);
+    return true;
+  }
+
+ private:
+  RegexPcre2() = default;
+
+  void FillGroups(std::string_view s,
+                  std::vector<std::string_view>& out) const {
+    uint32_t count = pcre2_get_ovector_count(match_data_.get());
+    size_t* ovector = pcre2_get_ovector_pointer(match_data_.get());
+    for (uint32_t i = 0; i < count; ++i) {
+      if (ovector[2 * i] == std::numeric_limits<PCRE2_SIZE>::max()) {
+        out.emplace_back();
+      } else {
+        out.emplace_back(s.data() + ovector[2 * i],
+                         ovector[2 * i + 1] - ovector[2 * i]);
+      }
+    }
+  }
+
+  ScopedPcre2Code code_;
+  // pcre2_match() requires a non-null match_data even when capture groups
+  // aren't needed (FullMatch, PartialMatch). A separate minimal match_data
+  // with ovecsize=1 could be used for those cases, but the savings are
+  // negligible: PCRE2's internal backtracking frame size depends on the
+  // pattern's capture groups regardless of ovector size. We reuse a single
+  // cached match_data created from the pattern to avoid per-call allocation.
+  mutable ScopedPcre2MatchData match_data_;
+};
+
+}  // namespace base
+}  // namespace perfetto
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_PCRE2) &&
+        // !defined(PERFETTO_REGEX_FORCE_STD)
+
+#endif  // SRC_BASE_REGEX_REGEX_PCRE2_H_
+// gen_amalgamated begin header: src/base/regex/regex_re2.h
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SRC_BASE_REGEX_REGEX_RE2_H_
+#define SRC_BASE_REGEX_REGEX_RE2_H_
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+
+// Guarded because gen_amalgamated inlines the body even when the include
+// site in regex.cc is preprocessed out. Also honor PERFETTO_REGEX_FORCE_STD:
+// targets that define it opt out of the optional backends and must not pull in
+// <re2/re2.h>, even when PERFETTO_RE2 is set.
+#if PERFETTO_BUILDFLAG(PERFETTO_RE2) && !defined(PERFETTO_REGEX_FORCE_STD)
+
+#include <memory>
+#include <string>
+#include <string_view>
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/status_or.h"
+
+// Using quotes instead of angle brackets because Bazel passes external repo
+// paths via -iquote (not -isystem), which only covers quoted includes.
+// See google/re2 commit baeed1c and bazelbuild/bazel#18974.
+#include "re2/re2.h"  // gen_amalgamated:keep
+
+namespace perfetto {
+namespace base {
+
+// RE2 backend for Regex. Used on non-Android builds (standalone, Chromium).
+// Header-only so the compiler can inline through unique_ptr<RegexImpl>.
+class RegexRe2 {
+ public:
+  RegexRe2(RegexRe2&&) noexcept = default;
+  RegexRe2& operator=(RegexRe2&&) noexcept = default;
+  ~RegexRe2() = default;
+
+  RegexRe2(const RegexRe2&) = delete;
+  RegexRe2& operator=(const RegexRe2&) = delete;
+
+  static StatusOr<RegexRe2> Create(std::string_view pattern,
+                                   bool case_insensitive) {
+    RegexRe2 result;
+    re2::RE2::Options options;
+    options.set_log_errors(false);
+    options.set_case_sensitive(!case_insensitive);
+    result.re_ = std::make_unique<re2::RE2>(std::string(pattern), options);
+    if (!result.re_->ok()) {
+      return ErrStatus("RE2 compile error: %s", result.re_->error().c_str());
+    }
+    result.groups_.resize(
+        static_cast<size_t>(result.re_->NumberOfCapturingGroups() + 1));
+    return std::move(result);
+  }
+
+  std::string GlobalReplace(std::string_view s,
+                            std::string_view replacement) const {
+    std::string out(s);
+    re2::RE2::GlobalReplace(&out, *re_, replacement);
+    return out;
+  }
+
+  bool FullMatch(std::string_view s) const {
+    return re2::RE2::FullMatch(s, *re_);
+  }
+
+  bool FullMatchWithGroups(std::string_view s,
+                           std::vector<std::string_view>& out) const {
+    out.clear();
+    int n = static_cast<int>(groups_.size());
+    if (!re_->Match(s, 0, s.size(), re2::RE2::ANCHOR_BOTH, groups_.data(), n))
+      return false;
+    out.assign(groups_.begin(), groups_.begin() + n);
+    return true;
+  }
+
+  bool PartialMatch(std::string_view s) const {
+    return re2::RE2::PartialMatch(s, *re_);
+  }
+
+  bool PartialMatchWithGroups(std::string_view s,
+                              std::vector<std::string_view>& out) const {
+    out.clear();
+    int n = static_cast<int>(groups_.size());
+    if (!re_->Match(s, 0, s.size(), re2::RE2::UNANCHORED, groups_.data(), n))
+      return false;
+    out.assign(groups_.begin(), groups_.begin() + n);
+    return true;
+  }
+
+  bool SearchWithOffset(std::string_view s,
+                        size_t start_offset,
+                        std::vector<std::string_view>& out) const {
+    out.clear();
+    if (start_offset > s.size())
+      return false;
+    int n = static_cast<int>(groups_.size());
+    if (!re_->Match(s, start_offset, s.size(), re2::RE2::UNANCHORED,
+                    groups_.data(), n))
+      return false;
+    out.assign(groups_.begin(), groups_.begin() + n);
+    return true;
+  }
+
+ private:
+  RegexRe2() = default;
+  std::unique_ptr<re2::RE2> re_;
+  // Must be absl::string_view, not std::string_view, to match RE2::Match()
+  // signature. These can be distinct types in different builds.
+  mutable std::vector<absl::string_view> groups_;
+};
+
+}  // namespace base
+}  // namespace perfetto
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_RE2) &&
+        // !defined(PERFETTO_REGEX_FORCE_STD)
+
+#endif  // SRC_BASE_REGEX_REGEX_RE2_H_
+// gen_amalgamated begin header: src/base/regex/regex_std.h
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SRC_BASE_REGEX_REGEX_STD_H_
+#define SRC_BASE_REGEX_REGEX_STD_H_
+
+#include <regex>
+#include <string>
+#include <string_view>
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/status_or.h"
+
+namespace perfetto {
+namespace base {
+
+// std::regex backend for Regex. Uses ECMAScript syntax for Perl-style
+// shorthands (\d, \w, \s).
+class RegexStd {
+ public:
+  RegexStd(RegexStd&&) noexcept = default;
+  RegexStd& operator=(RegexStd&&) noexcept = default;
+  ~RegexStd() = default;
+
+  RegexStd(const RegexStd&) = delete;
+  RegexStd& operator=(const RegexStd&) = delete;
+
+  static StatusOr<RegexStd> Create(std::string_view pattern,
+                                   bool case_insensitive) {
+    RegexStd result;
+    auto flags = std::regex::ECMAScript;
+    if (case_insensitive) {
+      flags |= std::regex::icase;
+    }
+    result.re_ = std::regex(std::string(pattern), flags);
+    return std::move(result);
+  }
+
+  std::string GlobalReplace(std::string_view s,
+                            std::string_view replacement) const {
+    return std::regex_replace(std::string(s), re_, std::string(replacement));
+  }
+
+  bool FullMatch(std::string_view s) const {
+    return std::regex_match(s.data(), s.data() + s.size(), re_);
+  }
+
+  bool FullMatchWithGroups(std::string_view s,
+                           std::vector<std::string_view>& out) const {
+    out.clear();
+    if (!std::regex_match(s.data(), s.data() + s.size(), match_data_, re_))
+      return false;
+    FillGroups(s.data(), out);
+    return true;
+  }
+
+  bool PartialMatch(std::string_view s) const {
+    return std::regex_search(s.data(), s.data() + s.size(), re_);
+  }
+
+  bool PartialMatchWithGroups(std::string_view s,
+                              std::vector<std::string_view>& out) const {
+    out.clear();
+    if (!std::regex_search(s.data(), s.data() + s.size(), match_data_, re_))
+      return false;
+    FillGroups(s.data(), out);
+    return true;
+  }
+
+  bool SearchWithOffset(std::string_view s,
+                        size_t start_offset,
+                        std::vector<std::string_view>& out) const {
+    out.clear();
+    const char* begin = s.data() + start_offset;
+    const char* end = s.data() + s.size();
+    if (begin > end)
+      return false;
+    if (!std::regex_search(begin, end, match_data_, re_))
+      return false;
+    FillGroups(begin, out);
+    return true;
+  }
+
+ private:
+  RegexStd() = default;
+
+  void FillGroups(const char* base, std::vector<std::string_view>& out) const {
+    for (size_t i = 0; i < match_data_.size(); ++i) {
+      if (match_data_[i].matched) {
+        out.emplace_back(base + match_data_.position(i),
+                         static_cast<size_t>(match_data_.length(i)));
+      } else {
+        out.emplace_back();
+      }
+    }
+  }
+
+  std::regex re_;
+  mutable std::cmatch match_data_;
+};
+
+}  // namespace base
+}  // namespace perfetto
+
+#endif  // SRC_BASE_REGEX_REGEX_STD_H_
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "perfetto/ext/base/regex.h"
+
+#include <optional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+// gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/flags.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/status_macros.h"
+
+// Unconditional: each header self-guards, so the amalgamator can see through.
+// gen_amalgamated expanded: #include "src/base/regex/regex_pcre2.h"
+// gen_amalgamated expanded: #include "src/base/regex/regex_re2.h"
+// gen_amalgamated expanded: #include "src/base/regex/regex_std.h"
+
+// Picks the regex backend and exposes it as PERFETTO_REGEX_BACKEND.
+// Preference order:
+//   1. PERFETTO_REGEX_FORCE_STD -> std::regex
+//   2. PCRE2 (when enabled and the runtime flag is on)
+//   3. RE2   (when enabled)
+//   4. std::regex (fallback)
+#if defined(PERFETTO_REGEX_FORCE_STD)
+#define PERFETTO_REGEX_BACKEND ::perfetto::base::RegexStd
+#elif PERFETTO_BUILDFLAG(PERFETTO_PCRE2) && PERFETTO_FLAGS_USE_PCRE2
+#define PERFETTO_REGEX_BACKEND ::perfetto::base::RegexPcre2
+#elif PERFETTO_BUILDFLAG(PERFETTO_RE2)
+#define PERFETTO_REGEX_BACKEND ::perfetto::base::RegexRe2
+#else
+#define PERFETTO_REGEX_BACKEND ::perfetto::base::RegexStd
+#endif
+
+namespace perfetto {
+namespace base {
+
+// Pimpl for Regex. Holds the selected backend; Regex reaches into `backend`
+// directly (Regex is a friend below).
+class RegexImpl {
+ public:
+  using Backend = PERFETTO_REGEX_BACKEND;
+  explicit RegexImpl(Backend b) : backend(std::move(b)) {}
+
+ private:
+  friend class Regex;
+  Backend backend;
+};
+#undef PERFETTO_REGEX_BACKEND
+
+Regex::Regex(Regex&&) noexcept = default;
+Regex& Regex::operator=(Regex&&) noexcept = default;
+Regex::~Regex() = default;
+
+StatusOr<Regex> Regex::Create(std::string_view pattern,
+                              Regex::CaseSensitivity cs) {
+  bool insensitive = (cs == CaseSensitivity::kInsensitive);
+  ASSIGN_OR_RETURN(auto backend,
+                   RegexImpl::Backend::Create(pattern, insensitive));
+  Regex regex;
+  regex.pattern_ = std::string(pattern);
+  regex.cs_ = cs;
+  regex.impl_ = std::make_unique<RegexImpl>(std::move(backend));
+  return std::move(regex);
+}
+
+Regex Regex::CreateOrCheck(std::string_view pattern,
+                           Regex::CaseSensitivity cs) {
+  auto re_or = Create(pattern, cs);
+  PERFETTO_CHECK(re_or.ok());
+  return std::move(*re_or);
+}
+
+std::string Regex::GlobalReplace(std::string_view s,
+                                 std::string_view replacement) const {
+  PERFETTO_DCHECK(impl_);
+  return impl_->backend.GlobalReplace(s, replacement);
+}
+
+bool Regex::FullMatch(std::string_view s) const {
+  PERFETTO_DCHECK(impl_);
+  return impl_->backend.FullMatch(s);
+}
+
+bool Regex::FullMatchWithGroups(std::string_view s,
+                                std::vector<std::string_view>& out) const {
+  PERFETTO_DCHECK(impl_);
+  return impl_->backend.FullMatchWithGroups(s, out);
+}
+
+bool Regex::PartialMatch(std::string_view s) const {
+  PERFETTO_DCHECK(impl_);
+  return impl_->backend.PartialMatch(s);
+}
+
+bool Regex::PartialMatchWithGroups(std::string_view s,
+                                   std::vector<std::string_view>& out) const {
+  PERFETTO_DCHECK(impl_);
+  return impl_->backend.PartialMatchWithGroups(s, out);
+}
+
+// --- PartialMatchIterator ---
+
+Regex::PartialMatchIterator::PartialMatchIterator(const Regex* re,
+                                                  std::string_view input)
+    : re_(re), input_(input) {}
+
+std::optional<std::string_view> Regex::PartialMatchIterator::Next() {
+  return NextWithGroups(groups_);
+}
+
+std::optional<std::string_view> Regex::PartialMatchIterator::NextWithGroups(
+    std::vector<std::string_view>& groups) {
+  if (offset_ > input_.size())
+    return std::nullopt;
+  PERFETTO_DCHECK(re_->impl_);
+  if (!re_->impl_->backend.SearchWithOffset(input_, offset_, groups))
+    return std::nullopt;
+  if (groups.empty())
+    return std::nullopt;
+  std::string_view match = groups[0];
+  size_t match_end =
+      static_cast<size_t>(match.data() - input_.data()) + match.size();
+  // Advance past the match. If match is empty, advance by one to avoid
+  // infinite loops.
+  offset_ = match.size() == 0 ? match_end + 1 : match_end;
+  return match;
+}
+
+Regex::PartialMatchIterator Regex::PartialMatchAll(std::string_view s) const {
+  return PartialMatchIterator(this, s);
+}
+
+// --- CopyableRegex ---
+
+CopyableRegex::CopyableRegex(Regex regex) : regex_(std::move(regex)) {}
+
+CopyableRegex::CopyableRegex(const CopyableRegex& other)
+    : regex_(Regex::CreateOrCheck(other.regex_.pattern(),
+                                  other.regex_.case_sensitivity())) {}
+
+CopyableRegex& CopyableRegex::operator=(const CopyableRegex& other) {
+  if (this != &other) {
+    this->~CopyableRegex();
+    new (this) CopyableRegex(other);
+  }
+  return *this;
+}
+
+}  // namespace base
+}  // namespace perfetto
 // gen_amalgamated begin source: src/base/clock_snapshots.cc
 /*
  * Copyright (C) 2024 The Android Open Source Project
@@ -49443,8 +52198,8 @@ const char* GetVersionCode();
 #ifndef GEN_PERFETTO_VERSION_GEN_H_
 #define GEN_PERFETTO_VERSION_GEN_H_
 
-#define PERFETTO_VERSION_STRING() "v54.0-7616314b3"
-#define PERFETTO_VERSION_SCM_REVISION() "7616314b391aa5fe69aa57705216c40727eb0160"
+#define PERFETTO_VERSION_STRING() "v57.2-da1d152cf"
+#define PERFETTO_VERSION_SCM_REVISION() "da1d152cff27890903d158fe96751de3aab883cc"
 
 #endif  // GEN_PERFETTO_VERSION_GEN_H_
 /*
@@ -49597,6 +52352,18 @@ void LogStacktraceMessage(Stacktrace& stacktrace,
     }                                                                   \
   } while (0)
 
+#define PROTOVM_INTERNAL_CONCAT_IMPL(x, y) x##y
+#define PROTOVM_INTERNAL_MACRO_CONCAT(x, y) PROTOVM_INTERNAL_CONCAT_IMPL(x, y)
+
+// Evaluates |rhs| which should return a StatusOr<T> and assigns this
+// to |lhs|. If the status is an error status, returns the status from the
+// current function.
+#define PROTOVM_ASSIGN_OR_RETURN(lhs, rhs)                       \
+  PROTOVM_INTERNAL_MACRO_CONCAT(auto status_or, __LINE__) = rhs; \
+  PROTOVM_RETURN_IF_NOT_OK(                                      \
+      PROTOVM_INTERNAL_MACRO_CONCAT(status_or, __LINE__));       \
+  lhs = std::move(PROTOVM_INTERNAL_MACRO_CONCAT(status_or, __LINE__).value())
+
 enum class Status : uint8_t {
   kOk,
   kError,
@@ -49922,7 +52689,6 @@ namespace protovm {
 
 struct Node;
 
-namespace internal {
 struct MapNode {
   struct Traits {
     using KeyType = uint64_t;
@@ -49940,14 +52706,9 @@ struct MapNode {
   OwnedPtr<Node> value;
 };
 
-}  // namespace internal
-
-using IntrusiveMap =
-    base::IntrusiveTree<internal::MapNode, internal::MapNode::Traits>;
+using IntrusiveMap = base::IntrusiveTree<MapNode, MapNode::Traits>;
 
 struct Node {
-  using MapNode = internal::MapNode;
-
   struct Bytes {
     OwnedPtr<void> data;
     size_t size;
@@ -49961,10 +52722,6 @@ struct Node {
 
   struct IndexedRepeatedField {
     IntrusiveMap index_to_node;
-
-    // Flag needed to track the merge state of indexed repeated field
-    // (see implementation of Merge operation in RW proto)
-    bool has_been_merged;
   };
 
   struct Message {
@@ -49986,14 +52743,15 @@ struct Node {
   std::variant<Bytes,
                Empty,
                IndexedRepeatedField,
-               MapNode,
                MappedRepeatedField,
                Message,
                Scalar>
       value;
-};
 
-Node& GetOuterNode(Node::MapNode& map_node);
+  // Flag needed to track the merge state of repeated fields
+  // (see implementation of Merge operation in RW proto)
+  bool has_been_merged = false;
+};
 
 }  // namespace protovm
 }  // namespace perfetto
@@ -51045,6 +53803,14 @@ struct HashEq<std::string> {
   }
 };
 
+// Specialization for double to prevent spurious -Wfloat-equal warnings.
+//
+// Trace processor legitimately has a need to compare with exact equality
+template <>
+struct HashEq<double> {
+  bool operator()(double a, double b) const { return std::equal_to<>()(a, b); }
+};
+
 // Helper to check if a lookup key type K is allowed.
 // Returns true if:
 // 1. K can be implicitly converted to Key, OR
@@ -51054,9 +53820,7 @@ template <typename K, typename Key, typename Hasher>
 static constexpr bool IsLookupKeyAllowed() {
   if constexpr (HasIsTransparent<Hasher>::value) {
     return std::is_invocable_v<Hasher, const K&> &&
-           std::is_same_v<decltype(std::declval<const Key&>() ==
-                                   std::declval<const K&>()),
-                          bool>;
+           std::is_invocable_v<std::equal_to<>, const Key&, const K&>;
   } else if constexpr (std::is_convertible_v<K, Key>) {
     return true;
   } else {
@@ -51908,6 +54672,7 @@ class SlabAllocator {
 #ifndef SRC_PROTOVM_ALLOCATOR_H_
 #define SRC_PROTOVM_ALLOCATOR_H_
 
+#include <algorithm>
 #include <cstdlib>
 
 // gen_amalgamated expanded: #include "perfetto/protozero/field.h"
@@ -51924,13 +54689,34 @@ namespace protovm {
 // the overall proto VM's memory footprint.
 class Allocator {
  public:
+  static constexpr size_t kNodeSize = std::max(sizeof(Node), sizeof(MapNode));
+  static constexpr size_t kNodeAlign =
+      std::max(alignof(Node), alignof(MapNode));
+
   explicit Allocator(size_t memory_limit_bytes);
+
+  template <class T, class... Args>
+  StatusOr<OwnedPtr<Node>> CreateNode(Args&&... args) {
+    auto p = Allocate();
+    PROTOVM_RETURN_IF_NOT_OK(p);
+
+    // 1. Construct node's inner value T passing args (struct aggregate
+    // initialization)
+    // 2. Construct node passing T (struct aggregate initialization)
+    new (*p) Node{T{std::forward<Args>(args)...}};
+
+    return OwnedPtr<Node>(static_cast<Node*>(*p));
+  }
+
+  StatusOr<OwnedPtr<MapNode>> CreateMapNode(uint64_t key, OwnedPtr<Node> value);
+
   StatusOr<Node::Bytes> AllocateAndCopyBytes(protozero::ConstBytes data);
 
   // Deeply delete a node and all the referenced data. E.g. if the node holds a
   // Node::Message, recursively delete the message fields and finally delete the
   // node.
   void Delete(Node* node);
+  void Delete(MapNode* node);
 
   // Deeply delete a node's referenced data, but do not delete the node itself.
   // E.g. if the node holds a Node::Message, recursively delete the message
@@ -51945,39 +54731,15 @@ class Allocator {
   // struct itself.
   void DeleteReferencedData(Node::Bytes* bytes);
 
-  template <class T, class... Args>
-  StatusOr<OwnedPtr<Node>> CreateNode(Args&&... args) {
-    if (used_memory_bytes_ + sizeof(Node) > memory_limit_bytes_) {
-      PROTOVM_ABORT(
-          "Failed to allocate node (%zu bytes). Memory limit: %zu [bytes]. "
-          "Used: %zu "
-          "[bytes].)",
-          sizeof(Node), memory_limit_bytes_, used_memory_bytes_);
-    }
-
-    auto* p = slab_allocator_.Allocate();
-    if (!p) {
-      PROTOVM_ABORT("Failed to allocate node");
-    }
-
-    used_memory_bytes_ += sizeof(Node);
-
-    // 1. Construct node's inner value T passing args (struct aggregate
-    // initialization)
-    // 2. Construct node passing T (struct aggregate initialization)
-    new (p) Node{T{std::forward<Args>(args)...}};
-
-    return OwnedPtr<Node>(static_cast<Node*>(p));
-  }
-
   size_t GetMemoryUsageBytes() const { return used_memory_bytes_; }
 
  private:
   void DeallocateBytes(OwnedPtr<void> p, size_t size);
+  StatusOr<void*> Allocate();
 
   size_t memory_limit_bytes_{0};
   size_t used_memory_bytes_{0};
-  SlabAllocator<sizeof(Node), alignof(Node)> slab_allocator_;
+  SlabAllocator<kNodeSize, kNodeAlign> slab_allocator_;
 };
 
 }  // namespace protovm
@@ -52008,6 +54770,18 @@ namespace protovm {
 Allocator::Allocator(size_t memory_limit_bytes)
     : memory_limit_bytes_{memory_limit_bytes}, used_memory_bytes_{0} {}
 
+StatusOr<OwnedPtr<MapNode>> Allocator::CreateMapNode(uint64_t key,
+                                                     OwnedPtr<Node> value) {
+  PERFETTO_DCHECK(value);
+  auto p = Allocate();
+  if (!p.IsOk()) {
+    Delete(value.release());
+    PROTOVM_RETURN(p);
+  }
+  new (*p) MapNode{key, std::move(value)};
+  return OwnedPtr<MapNode>(static_cast<MapNode*>(*p));
+}
+
 StatusOr<Node::Bytes> Allocator::AllocateAndCopyBytes(
     protozero::ConstBytes data) {
   if (used_memory_bytes_ + data.size > memory_limit_bytes_) {
@@ -52035,7 +54809,14 @@ void Allocator::Delete(Node* node) {
   DeleteReferencedData(node);
   node->~Node();
   slab_allocator_.Free(node);
-  used_memory_bytes_ -= sizeof(Node);
+  used_memory_bytes_ -= kNodeSize;
+}
+
+void Allocator::Delete(MapNode* node) {
+  Delete(node->value.release());
+  node->~MapNode();
+  slab_allocator_.Free(node);
+  used_memory_bytes_ -= kNodeSize;
 }
 
 void Allocator::DeleteReferencedData(Node* node) {
@@ -52045,16 +54826,14 @@ void Allocator::DeleteReferencedData(Node* node) {
     for (auto it = indexed_fields->index_to_node.begin(); it;) {
       auto& map_node = *it;
       it = indexed_fields->index_to_node.Remove(it);
-      Delete(&GetOuterNode(map_node));
+      Delete(&map_node);
     }
   } else if (auto* mapped_fields = node->GetIf<Node::MappedRepeatedField>()) {
     for (auto it = mapped_fields->key_to_node.begin(); it;) {
       auto& map_node = *it;
       it = mapped_fields->key_to_node.Remove(it);
-      Delete(&GetOuterNode(map_node));
+      Delete(&map_node);
     }
-  } else if (auto* map_node = node->GetIf<Node::MapNode>()) {
-    Delete(map_node->value.release());
   } else if (auto* bytes = node->GetIf<Node::Bytes>()) {
     DeleteReferencedData(bytes);
   }
@@ -52064,7 +54843,7 @@ void Allocator::DeleteReferencedData(Node::Message* message) {
   for (auto it = message->field_id_to_node.begin(); it;) {
     auto& map_node = *it;
     it = message->field_id_to_node.Remove(it);
-    Delete(&GetOuterNode(map_node));
+    Delete(&map_node);
   }
 }
 
@@ -52077,6 +54856,22 @@ void Allocator::DeallocateBytes(OwnedPtr<void> p, size_t size) {
   used_memory_bytes_ -= size;
 }
 
+StatusOr<void*> Allocator::Allocate() {
+  if (used_memory_bytes_ + kNodeSize > memory_limit_bytes_) {
+    PROTOVM_ABORT(
+        "Failed to allocate element (%zu bytes). Memory limit: %zu [bytes]. "
+        "Used: %zu "
+        "[bytes].)",
+        kNodeSize, memory_limit_bytes_, used_memory_bytes_);
+  }
+  auto* p = slab_allocator_.Allocate();
+  if (!p) {
+    PROTOVM_ABORT("Failed to allocate node");
+  }
+  used_memory_bytes_ += kNodeSize;
+  return p;
+}
+
 }  // namespace protovm
 }  // namespace perfetto
 // gen_amalgamated begin source: src/protovm/error_handling.cc
@@ -52253,6 +55048,12 @@ namespace protovm {
 
 class RwProtoCursor {
  public:
+  enum MergeFlags : uint32_t {
+    kNone = 0,
+    kSkipSubmessages = 1 << 0,
+    kDelIfSrcEmpty = 1 << 1,
+  };
+
   class RepeatedFieldIterator {
    public:
     RepeatedFieldIterator();
@@ -52268,6 +55069,11 @@ class RwProtoCursor {
 
   RwProtoCursor();
   explicit RwProtoCursor(Node* node, Allocator* allocator);
+
+  bool operator==(const RwProtoCursor& other) const;
+  bool operator!=(const RwProtoCursor& other) const;
+
+  StatusOr<bool> IsRoot() const;
   StatusOr<bool> HasField(uint32_t field_id);
   StatusOr<void> EnterField(uint32_t field_id);
   StatusOr<void> EnterRepeatedFieldAt(uint32_t field_id, uint32_t index);
@@ -52314,12 +55120,19 @@ class RwProtoCursor {
   // message. Merge fields from the 'data' message into the message pointed by
   // cursor. Existing fields in the cursor's message are overwritten by fields
   // from 'data'. Fields present in 'data' but not in the cursor's message are
-  // be added/created.
-  StatusOr<void> Merge(protozero::ConstBytes data);
+  // added/created. If skip_submessages is set to true, any message node already
+  // resolved in the dst are skipped, thus not overwritten by the parent merge.
+  StatusOr<void> Merge(protozero::ConstBytes data, uint32_t flags);
 
   StatusOr<void> Delete();
 
  private:
+  struct ParentLink {
+    Node* node;
+    IntrusiveMap* map;
+    MapNode* map_node;
+  };
+
   StatusOr<void> ConvertToMessageIfNeeded(Node* node);
   StatusOr<OwnedPtr<Node>> CreateNodeFromField(protozero::Field field);
   StatusOr<void> ConvertToMappedRepeatedFieldIfNeeded(
@@ -52339,8 +55152,10 @@ class RwProtoCursor {
                                              OwnedPtr<Node> map_value);
   StatusOr<uint64_t> ReadScalarField(const Node& node, uint32_t field_id);
 
+  StatusOr<void> CheckIsValid() const;
+
   Node* node_ = nullptr;
-  std::pair<IntrusiveMap*, Node::MapNode*> holding_map_and_node_ = {};
+  ParentLink parent_link_ = {};
   Allocator* allocator_ = nullptr;
 };
 
@@ -52544,11 +55359,17 @@ struct Cursors {
   RwProto::Cursor dst;
   CursorEnum selected{CursorEnum::VM_CURSOR_UNSPECIFIED};
   bool create_if_not_exist{false};
+
+  // Used internally by Parser to detect illegal "del" operations.
+  // See detailed explanation in the Parser implementation.
+  const RwProto::Cursor* innermost_saved_dst{nullptr};
 };
 
 // Executor's methods are virtual to be overridden in tests
 class Executor {
  public:
+  using MergeFlags = RwProto::Cursor::MergeFlags;
+
   virtual ~Executor();
   virtual StatusOr<void> EnterField(Cursors* cursors, uint32_t field_id) const;
   virtual StatusOr<void> EnterRepeatedFieldAt(Cursors* cursors,
@@ -52567,7 +55388,7 @@ class Executor {
   virtual StatusOr<uint64_t> ReadRegister(uint8_t reg_id) const;
   virtual StatusOr<void> WriteRegister(const Cursors& cursors, uint8_t reg_id);
   virtual StatusOr<void> Delete(RwProto::Cursor* dst) const;
-  virtual StatusOr<void> Merge(Cursors* cursors) const;
+  virtual StatusOr<void> Merge(Cursors* cursors, uint32_t flags) const;
   virtual StatusOr<void> Set(Cursors* cursors) const;
 
  private:
@@ -52685,14 +55506,14 @@ StatusOr<void> Executor::Delete(RwProto::Cursor* dst) const {
   return dst->Delete();
 }
 
-StatusOr<void> Executor::Merge(Cursors* cursors) const {
+StatusOr<void> Executor::Merge(Cursors* cursors, uint32_t flags) const {
   if (!cursors->src.IsBytes()) {
     PROTOVM_ABORT(
         "Attempted MERGE operation but src cursor has incompatible data "
         "type");
   }
 
-  return cursors->dst.Merge(*cursors->src.GetBytes());
+  return cursors->dst.Merge(*cursors->src.GetBytes(), flags);
 }
 
 StatusOr<void> Executor::Set(Cursors* cursors) const {
@@ -52745,8 +55566,6 @@ const char* Node::GetTypeName() const {
           return "Empty";
         } else if constexpr (std::is_same_v<T, Node::IndexedRepeatedField>) {
           return "IndexedRepeatedField";
-        } else if constexpr (std::is_same_v<T, Node::MapNode>) {
-          return "MapEntry";
         } else if constexpr (std::is_same_v<T, Node::MappedRepeatedField>) {
           return "MappedRepeatedField";
         } else if constexpr (std::is_same_v<T, Node::Message>) {
@@ -52760,20 +55579,6 @@ const char* Node::GetTypeName() const {
       value);
 }
 
-Node& GetOuterNode(Node::MapNode& map_node) {
-  // Hackish solution to obtain offsetof(Node, MapNode). Alas, there isn't
-  // anything like the standard offsetof that works with std::variant. Note that
-  // the calculation can't be constexpr, however the compiler optimizes it out.
-  const Node tmp{Node::MapNode{0, nullptr}};
-  const auto* tmp_map_node = std::get_if<Node::MapNode>(&tmp.value);
-  const auto kOffset = reinterpret_cast<const char*>(tmp_map_node) -
-                       reinterpret_cast<const char*>(&tmp);
-
-  auto* node = reinterpret_cast<char*>(&map_node);
-  node -= kOffset;
-  return *reinterpret_cast<Node*>(node);
-}
-
 }  // namespace protovm
 }  // namespace perfetto
 // gen_amalgamated begin source: src/protovm/parser.cc
@@ -52818,6 +55623,8 @@ class Parser {
       protozero::RepeatedFieldIterator<protozero::ConstBytes> it_instruction);
   StatusOr<void> ParseInstruction(
       const protos::pbzero::VmInstruction::Decoder& instruction);
+  StatusOr<void> ParseMerge(
+      const protos::pbzero::VmInstruction::Decoder& instruction);
   StatusOr<void> ParseRegLoad(
       const protos::pbzero::VmInstruction::Decoder& instruction);
   StatusOr<void> ParseSelect(
@@ -52853,6 +55660,8 @@ class Parser {
  */
 
 // gen_amalgamated expanded: #include "src/protovm/parser.h"
+// gen_amalgamated expanded: #include "protos/perfetto/protovm/vm_program.pbzero.h"
+// gen_amalgamated expanded: #include "src/protovm/error_handling.h"
 
 namespace perfetto {
 namespace protovm {
@@ -52863,6 +55672,7 @@ Parser::Parser(protozero::ConstBytes program, Executor* executor)
 StatusOr<void> Parser::Run(RoCursor src, RwProto::Cursor dst) {
   cursors_.src = src;
   cursors_.dst = dst;
+  cursors_.innermost_saved_dst = nullptr;
   return ParseInstructions(program_.instructions());
 }
 
@@ -52911,10 +55721,23 @@ StatusOr<void> Parser::ParseInstruction(
     auto status = ParseRegLoad(instruction);
     PROTOVM_RETURN_IF_NOT_OK(status, "reg_load");
   } else if (instruction.has_del()) {
+    PROTOVM_ASSIGN_OR_RETURN(bool is_root, cursors_.dst.IsRoot());
+    if (cursors_.innermost_saved_dst != nullptr &&
+        cursors_.dst == *cursors_.innermost_saved_dst && !is_root) {
+      // Illegal operation
+      // For each "select" operation we effectively save a snapshot of the
+      // cursors on the stack, so that they can be restored when a frame is
+      // exited. This "del" operation is attempting to delete a "dst" cursor
+      // that is currently aliased in the parent stack frame. This would result
+      // in a dangling pointer when the current frame is exited and the aliased
+      // "dst" is restored.
+      PROTOVM_ABORT(
+          "del would invalidate a cursor saved by an enclosing select");
+    }
     auto status = executor_->Delete(&cursors_.dst);
     PROTOVM_RETURN_IF_NOT_OK(status, "del");
   } else if (instruction.has_merge()) {
-    auto status = executor_->Merge(&cursors_);
+    auto status = ParseMerge(instruction);
     PROTOVM_RETURN_IF_NOT_OK(status, "merge");
   } else if (instruction.has_set()) {
     auto status = executor_->Set(&cursors_);
@@ -52926,6 +55749,19 @@ StatusOr<void> Parser::ParseInstruction(
   return ParseInstructions(instruction.nested_instructions());
 }
 
+StatusOr<void> Parser::ParseMerge(
+    const protos::pbzero::VmInstruction::Decoder& instruction) {
+  protos::pbzero::VmOpMerge::Decoder merge(instruction.merge());
+  uint32_t flags = Executor::MergeFlags::kNone;
+  if (merge.skip_submessages())
+    flags |= Executor::MergeFlags::kSkipSubmessages;
+  if (merge.del_if_src_empty())
+    flags |= Executor::MergeFlags::kDelIfSrcEmpty;
+  auto status = executor_->Merge(&cursors_, flags);
+  PROTOVM_RETURN_IF_NOT_OK(status);
+  return status;
+}
+
 StatusOr<void> Parser::ParseRegLoad(
     const protos::pbzero::VmInstruction::Decoder& instruction) {
   auto saved_selected = cursors_.selected;
@@ -52947,6 +55783,7 @@ StatusOr<void> Parser::ParseRegLoad(
 StatusOr<void> Parser::ParseSelect(
     const protos::pbzero::VmInstruction::Decoder& instruction) {
   auto saved_cursors = cursors_;
+  cursors_.innermost_saved_dst = &saved_cursors.dst;
 
   protos::pbzero::VmOpSelect::Decoder select(instruction.select());
   cursors_.selected = !select.has_cursor()
@@ -53383,6 +56220,7 @@ void RwProto::SerializeField(uint32_t field_id,
 // gen_amalgamated expanded: #include "src/protovm/rw_proto_cursor.h"
 
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "src/protovm/error_handling.h"
 
 namespace perfetto {
 namespace protovm {
@@ -53414,8 +56252,20 @@ RwProtoCursor::RwProtoCursor() = default;
 RwProtoCursor::RwProtoCursor(Node* node, Allocator* allocator)
     : node_{node}, allocator_{allocator} {}
 
+bool RwProtoCursor::operator==(const RwProtoCursor& other) const {
+  return node_ == other.node_;
+}
+bool RwProtoCursor::operator!=(const RwProtoCursor& other) const {
+  return !(*this == other);
+}
+
+StatusOr<bool> RwProtoCursor::IsRoot() const {
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
+  return parent_link_.node == nullptr;
+}
+
 StatusOr<bool> RwProtoCursor::HasField(uint32_t field_id) {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   // Eagerly decompose bytes because the field being tested will be entered
   // later anyways. See Executor::EnterField().
@@ -53427,7 +56277,7 @@ StatusOr<bool> RwProtoCursor::HasField(uint32_t field_id) {
 }
 
 StatusOr<void> RwProtoCursor::EnterField(uint32_t field_id) {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   auto status_or_it = FindOrCreateMessageField(node_, field_id);
   PROTOVM_RETURN_IF_NOT_OK(status_or_it);
@@ -53447,15 +56297,15 @@ StatusOr<void> RwProtoCursor::EnterField(uint32_t field_id) {
         field_id);
   }
 
-  holding_map_and_node_ = {&node_->GetIf<Node::Message>()->field_id_to_node,
-                           std::addressof(*it)};
+  parent_link_ = {node_, &node_->GetIf<Node::Message>()->field_id_to_node,
+                  std::addressof(*it)};
   node_ = it->value.get();
   return StatusOr<void>::Ok();
 }
 
 StatusOr<void> RwProtoCursor::EnterRepeatedFieldAt(uint32_t field_id,
                                                    uint32_t index) {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   auto status_or_message_field = FindOrCreateMessageField(node_, field_id);
   PROTOVM_RETURN_IF_NOT_OK(status_or_message_field);
@@ -53469,7 +56319,8 @@ StatusOr<void> RwProtoCursor::EnterRepeatedFieldAt(uint32_t field_id,
       FindOrCreateIndexedRepeatedField(message_field->value.get(), index);
   PROTOVM_RETURN_IF_NOT_OK(status_or_repeated_field);
 
-  holding_map_and_node_ = {
+  parent_link_ = {
+      message_field->value.get(),
       &message_field->value->GetIf<Node::IndexedRepeatedField>()->index_to_node,
       std::addressof(**status_or_repeated_field)};
   node_ = (*status_or_repeated_field)->value.get();
@@ -53479,7 +56330,7 @@ StatusOr<void> RwProtoCursor::EnterRepeatedFieldAt(uint32_t field_id,
 
 StatusOr<RwProtoCursor::RepeatedFieldIterator>
 RwProtoCursor::IterateRepeatedField(uint32_t field_id) {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   auto status_convertion_to_message = ConvertToMessageIfNeeded(node_);
   PROTOVM_RETURN_IF_NOT_OK(status_convertion_to_message);
@@ -53504,7 +56355,7 @@ RwProtoCursor::IterateRepeatedField(uint32_t field_id) {
 StatusOr<void> RwProtoCursor::EnterRepeatedFieldByKey(uint32_t field_id,
                                                       uint32_t map_key_field_id,
                                                       uint64_t key) {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   auto status_or_message_field = FindOrCreateMessageField(node_, field_id);
   PROTOVM_RETURN_IF_NOT_OK(status_or_message_field);
@@ -53518,7 +56369,8 @@ StatusOr<void> RwProtoCursor::EnterRepeatedFieldByKey(uint32_t field_id,
       FindOrCreateMappedRepeatedField(message_field->value.get(), key);
   PROTOVM_RETURN_IF_NOT_OK(status_or_repeated_field);
 
-  holding_map_and_node_ = {
+  parent_link_ = {
+      message_field->value.get(),
       &message_field->value->GetIf<Node::MappedRepeatedField>()->key_to_node,
       std::addressof(**status_or_repeated_field)};
   node_ = (*status_or_repeated_field)->value.get();
@@ -53527,7 +56379,7 @@ StatusOr<void> RwProtoCursor::EnterRepeatedFieldByKey(uint32_t field_id,
 }
 
 StatusOr<Scalar> RwProtoCursor::GetScalar() const {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   auto* scalar = node_->GetIf<Scalar>();
   if (!scalar) {
@@ -53538,7 +56390,7 @@ StatusOr<Scalar> RwProtoCursor::GetScalar() const {
 }
 
 StatusOr<void> RwProtoCursor::SetBytes(protozero::ConstBytes data) {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   if (bool is_compatible = node_->GetIf<Node::Empty>() ||
                            node_->GetIf<Node::Bytes>() ||
@@ -53558,7 +56410,7 @@ StatusOr<void> RwProtoCursor::SetBytes(protozero::ConstBytes data) {
 }
 
 StatusOr<void> RwProtoCursor::SetScalar(Scalar scalar) {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   if (bool is_compatible =
           node_->GetIf<Node::Empty>() || node_->GetIf<Scalar>();
@@ -53571,8 +56423,9 @@ StatusOr<void> RwProtoCursor::SetScalar(Scalar scalar) {
   return StatusOr<void>::Ok();
 }
 
-StatusOr<void> RwProtoCursor::Merge(protozero::ConstBytes data) {
-  PERFETTO_DCHECK(node_);
+StatusOr<void> RwProtoCursor::Merge(protozero::ConstBytes data,
+                                    uint32_t flags) {
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
   if (bool is_compatible = node_->GetIf<Node::Empty>() ||
                            node_->GetIf<Node::Message>() ||
@@ -53586,23 +56439,43 @@ StatusOr<void> RwProtoCursor::Merge(protozero::ConstBytes data) {
     return StatusOr<void>::Ok();
   }
 
-  auto status_convertion = ConvertToMessageIfNeeded(node_);
-  PROTOVM_RETURN_IF_NOT_OK(status_convertion);
+  auto status_convert_to_message = ConvertToMessageIfNeeded(node_);
+  PROTOVM_RETURN_IF_NOT_OK(status_convert_to_message);
   auto* message = node_->GetIf<Node::Message>();
 
   protozero::ProtoDecoder decoder(data);
 
   for (auto field = decoder.ReadField(); field.valid();
        field = decoder.ReadField()) {
+    auto it = message->field_id_to_node.Find(field.id());
+
+    bool del_if_src_empty = (flags & kDelIfSrcEmpty) != 0;
+    if (it && del_if_src_empty &&
+        field.type() ==
+            protozero::proto_utils::ProtoWireType::kLengthDelimited &&
+        field.size() == 0) {
+      // Implements remove submessage semantics: empty src field means delete
+      // the dst field
+      message->field_id_to_node.Remove(*it);
+      allocator_->Delete(&*it);
+      continue;
+    }
+
+    bool skip_submessages = (flags & kSkipSubmessages) != 0;
+    if (skip_submessages && it && it->value->GetIf<Node::Message>()) {
+      // Implements deep merge semantics: skip this message that was already
+      // merged by a previous operation
+      continue;
+    }
+
     auto status_or_map_value = CreateNodeFromField(field);
     PROTOVM_RETURN_IF_NOT_OK(status_or_map_value);
 
-    auto it = message->field_id_to_node.Find(field.id());
-
     if (!it) {
       auto status_or_it = MapInsert(&message->field_id_to_node, field.id(),
                                     std::move(*status_or_map_value));
       PROTOVM_RETURN_IF_NOT_OK(status_or_it);
+      (*status_or_it)->value->has_been_merged = true;
       continue;
     }
 
@@ -53613,15 +56486,25 @@ StatusOr<void> RwProtoCursor::Merge(protozero::ConstBytes data) {
           field.id());
     }
 
+    // Promote field as repeated if needed:
+    // If this is the second time that the same field ID is being merged, then
+    // they are a repeated fields and they should live within an
+    // IndexedRepeatedField node.
+    if (it->value->has_been_merged) {
+      auto status_convert_to_indexed =
+          ConvertToIndexedRepeatedFieldIfNeeded(it->value.get());
+      PROTOVM_RETURN_IF_NOT_OK(status_convert_to_indexed);
+    }
+
     if (auto* indexed_fields = it->value->GetIf<Node::IndexedRepeatedField>()) {
       // Implements merge semantics for repeated fields: all existing fields are
       // removed and replaced with the newly received fields.
-      if (!indexed_fields->has_been_merged) {
+      if (!it->value->has_been_merged) {
         // Optimization opportunity: reuse the existing nodes to avoid N
         // allocation-deallocation pairs, where N is the number of newly
         // received repeated fields.
         allocator_->DeleteReferencedData(it->value.get());
-        indexed_fields->has_been_merged = true;
+        it->value->has_been_merged = true;
       }
       MapInsert(&indexed_fields->index_to_node,
                 indexed_fields->index_to_node.Size(),
@@ -53633,35 +56516,35 @@ StatusOr<void> RwProtoCursor::Merge(protozero::ConstBytes data) {
     // allocation-deallocation pair
     allocator_->Delete(it->value.release());
     it->value = std::move(*status_or_map_value);
+    it->value->has_been_merged = true;
   }
 
-  // Reset the merge state of repeated fields
+  // Reset the merge flags
   for (auto& field : message->field_id_to_node) {
-    if (auto* indexed_fields =
-            field.value->GetIf<Node::IndexedRepeatedField>()) {
-      indexed_fields->has_been_merged = false;
-    }
+    field.value->has_been_merged = false;
   }
 
   return StatusOr<void>::Ok();
 }
 
 StatusOr<void> RwProtoCursor::Delete() {
-  PERFETTO_DCHECK(node_);
+  PROTOVM_RETURN_IF_NOT_OK(CheckIsValid());
 
-  bool is_root_node = !holding_map_and_node_.first;
-  if (is_root_node) {
+  PROTOVM_ASSIGN_OR_RETURN(bool is_root, IsRoot());
+  if (is_root) {
     node_->value = Node::Empty{};
     return StatusOr<void>::Ok();
   }
 
-  auto [holding_map, map_node] = holding_map_and_node_;
-  PERFETTO_DCHECK(holding_map);
-  PERFETTO_DCHECK(map_node);
-  holding_map->Remove(*map_node);
-  allocator_->Delete(&GetOuterNode(*map_node));
+  PERFETTO_DCHECK(parent_link_.map);
+  PERFETTO_DCHECK(parent_link_.map_node);
 
-  node_ = nullptr;  // Delete operation invalidates cursor
+  parent_link_.map->Remove(*parent_link_.map_node);
+  allocator_->Delete(parent_link_.map_node);
+
+  // Delete operation invalidates cursor
+  node_ = nullptr;
+  parent_link_ = {};
 
   return StatusOr<void>::Ok();
 }
@@ -53946,22 +56829,18 @@ StatusOr<IntrusiveMap::Iterator> RwProtoCursor::MapInsert(
     uint64_t key,
     OwnedPtr<Node> map_value) {
   auto status_or_map_node =
-      allocator_->CreateNode<Node::MapNode>(key, std::move(map_value));
-  if (!status_or_map_node.IsOk()) {
-    allocator_->Delete(map_value.release());
-    PROTOVM_RETURN(status_or_map_node, "Failed to allocate node");
-  }
+      allocator_->CreateMapNode(key, std::move(map_value));
+  PROTOVM_RETURN_IF_NOT_OK(status_or_map_node, "Failed to allocate node");
 
-  auto [it, inserted] =
-      map->Insert(*status_or_map_node->release()->GetIf<Node::MapNode>());
+  auto [it, inserted] = map->Insert(*status_or_map_node->get());
   if (!inserted) {
-    allocator_->Delete(map_value.release());
     allocator_->Delete(status_or_map_node->release());
     PROTOVM_ABORT(
         "Failed to insert intrusive map entry (key = %d). Duplicated key?",
         static_cast<int>(key));
   }
 
+  status_or_map_node->release();
   return it;
 }
 
@@ -54014,6 +56893,13 @@ StatusOr<uint64_t> RwProtoCursor::ReadScalarField(const Node& node,
       field_id, node.GetTypeName());
 }
 
+StatusOr<void> RwProtoCursor::CheckIsValid() const {
+  if (!node_) {
+    PROTOVM_ABORT("Attempted to access invalid cursor");
+  }
+  return StatusOr<void>::Ok();
+}
+
 }  // namespace protovm
 }  // namespace perfetto
 // gen_amalgamated begin source: src/protovm/vm.cc
@@ -54994,12 +57880,13 @@ FilterBytecodeParser::QueryResult FilterBytecodeParser::Query(
 #include <array>
 #include <cstddef>
 #include <cstdint>
-#include <regex>
+#include <optional>
 #include <string>
 #include <string_view>
 #include <vector>
 
 // gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/regex.h"
 // gen_amalgamated expanded: #include "perfetto/public/compiler.h"
 
 namespace protozero {
@@ -55096,7 +57983,7 @@ class StringFilter {
  private:
   struct Rule {
     Policy policy;
-    std::regex pattern;
+    std::optional<perfetto::base::CopyableRegex> pattern;
     std::string atrace_payload_starts_with;
     std::string name;
     SemanticTypeMask semantic_type_mask = SemanticTypeMask::Unspecified();
@@ -55106,6 +57993,10 @@ class StringFilter {
 
   // All rules, in the order they were added.
   std::vector<Rule> rules_;
+
+  // Reusable buffer for regex match groups, avoiding heap allocations on each
+  // filter call.
+  mutable std::vector<std::string_view> matches_;
 };
 
 }  // namespace protozero
@@ -55132,20 +58023,16 @@ class StringFilter {
 #include <algorithm>
 #include <cstdint>
 #include <cstring>
-#include <regex>
 #include <string>
 #include <string_view>
 #include <utility>
 #include <vector>
 
-// gen_amalgamated expanded: #include "perfetto/base/logging.h"
 // gen_amalgamated expanded: #include "perfetto/public/compiler.h"
 
 namespace protozero {
 namespace {
 
-using Matches = std::match_results<char*>;
-
 constexpr std::string_view kRedacted = "P60REDACTED";
 constexpr char kRedactedDash = '-';
 
@@ -55201,21 +58088,25 @@ PERFETTO_ALWAYS_INLINE bool StartsWith(const char* ptr,
   return memcmp(ptr + 1, starts_with.data() + 1, len - 1) == 0;
 }
 
-void RedactMatches(const Matches& matches) {
+void RedactMatches(const std::vector<std::string_view>& matches) {
   // Go through every group in the matches.
   for (size_t i = 1; i < matches.size(); ++i) {
     const auto& match = matches[i];
-    PERFETTO_CHECK(match.second >= match.first);
+    // Skip unmatched optional groups: empty string_view may have nullptr
+    // data(), and passing nullptr to memcpy/memset is UB even with size 0.
+    if (match.empty())
+      continue;
 
     // Overwrite the match with characters from |kRedacted|. If match is
     // smaller, we will not use all of |kRedacted| but that's fine (i.e. we
     // will overwrite with a truncated |kRedacted|).
-    auto match_len = static_cast<size_t>(match.second - match.first);
+    size_t match_len = match.size();
     size_t redacted_len = std::min(match_len, kRedacted.size());
-    memcpy(match.first, kRedacted.data(), redacted_len);
+    memcpy(const_cast<char*>(match.data()), kRedacted.data(), redacted_len);
 
     // Overwrite any characters after |kRedacted| with |kRedactedDash|.
-    memset(match.first + redacted_len, kRedactedDash, match_len - redacted_len);
+    memset(const_cast<char*>(match.data()) + redacted_len, kRedactedDash,
+           match_len - redacted_len);
   }
 }
 
@@ -55226,12 +58117,10 @@ void StringFilter::AddRule(Policy policy,
                            std::string atrace_payload_starts_with,
                            std::string name,
                            SemanticTypeMask semantic_type_mask) {
-  Rule new_rule{
-      policy,
-      std::regex(pattern_str.begin(), pattern_str.end(),
-                 std::regex::ECMAScript | std::regex_constants::optimize),
-      std::move(atrace_payload_starts_with), std::move(name),
-      semantic_type_mask};
+  perfetto::base::CopyableRegex re(
+      perfetto::base::Regex::CreateOrCheck(std::string(pattern_str)));
+  Rule new_rule{policy, std::move(re), std::move(atrace_payload_starts_with),
+                std::move(name), semantic_type_mask};
   // If name is non-empty, look for existing rule with same name and replace.
   if (!new_rule.name.empty()) {
     for (Rule& existing : rules_) {
@@ -55247,26 +58136,26 @@ void StringFilter::AddRule(Policy policy,
 bool StringFilter::MaybeFilterInternal(char* ptr,
                                        size_t len,
                                        uint32_t semantic_type) const {
-  std::match_results<char*> matches;
   bool atrace_find_tried = false;
   const char* atrace_payload_ptr = nullptr;
+  std::string_view input(ptr, len);
+
   for (const Rule& rule : rules_) {
     if (!rule.semantic_type_mask.IsSet(semantic_type)) {
       continue;
     }
     switch (rule.policy) {
-      case Policy::kMatchRedactGroups:
       case Policy::kMatchBreak:
+        if (PERFETTO_UNLIKELY(rule.pattern->FullMatch(input)))
+          return false;
+        break;
+      case Policy::kMatchRedactGroups:
         if (PERFETTO_UNLIKELY(
-                std::regex_match(ptr, ptr + len, matches, rule.pattern))) {
-          if (rule.policy == Policy::kMatchBreak) {
-            return false;
-          }
-          RedactMatches(matches);
+                rule.pattern->FullMatchWithGroups(input, matches_))) {
+          RedactMatches(matches_);
           return true;
         }
         break;
-      case Policy::kAtraceMatchRedactGroups:
       case Policy::kAtraceMatchBreak:
         atrace_payload_ptr = atrace_find_tried
                                  ? atrace_payload_ptr
@@ -55275,11 +58164,21 @@ bool StringFilter::MaybeFilterInternal(char* ptr,
         if (atrace_payload_ptr &&
             StartsWith(atrace_payload_ptr, ptr + len,
                        rule.atrace_payload_starts_with) &&
-            std::regex_match(ptr, ptr + len, matches, rule.pattern)) {
-          if (rule.policy == Policy::kAtraceMatchBreak) {
-            return false;
-          }
-          RedactMatches(matches);
+            rule.pattern->FullMatch(input)) {
+          return false;
+        }
+        break;
+      case Policy::kAtraceMatchRedactGroups:
+        atrace_payload_ptr = atrace_find_tried
+                                 ? atrace_payload_ptr
+                                 : FindAtracePayloadPtr(ptr, ptr + len);
+        atrace_find_tried = true;
+        if (atrace_payload_ptr &&
+            StartsWith(atrace_payload_ptr, ptr + len,
+                       rule.atrace_payload_starts_with) &&
+            PERFETTO_UNLIKELY(
+                rule.pattern->FullMatchWithGroups(input, matches_))) {
+          RedactMatches(matches_);
           return true;
         }
         break;
@@ -55290,11 +58189,11 @@ bool StringFilter::MaybeFilterInternal(char* ptr,
         atrace_find_tried = true;
         if (atrace_payload_ptr && StartsWith(atrace_payload_ptr, ptr + len,
                                              rule.atrace_payload_starts_with)) {
-          auto beg = std::regex_iterator<char*>(ptr, ptr + len, rule.pattern);
-          auto end = std::regex_iterator<char*>();
-          bool has_any_matches = beg != end;
-          for (auto it = std::move(beg); it != end; ++it) {
-            RedactMatches(*it);
+          bool has_any_matches = false;
+          for (auto iter = rule.pattern->PartialMatchAll(input);
+               iter.NextWithGroups(matches_);) {
+            RedactMatches(matches_);
+            has_any_matches = true;
           }
           if (has_any_matches) {
             return true;
@@ -56098,6 +58997,170 @@ void MessageFilter::IncrementCurrentFieldUsage(uint32_t field_id,
   field_usage_[field_path] += allowed ? 1 : -1;
 }
 
+}  // namespace protozero
+// gen_amalgamated begin source: src/protozero/filtering/message_filter_config.cc
+// gen_amalgamated begin header: src/protozero/filtering/message_filter_config.h
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SRC_PROTOZERO_FILTERING_MESSAGE_FILTER_CONFIG_H_
+#define SRC_PROTOZERO_FILTERING_MESSAGE_FILTER_CONFIG_H_
+
+// gen_amalgamated expanded: #include "perfetto/base/status.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/trace_config.gen.h"
+// gen_amalgamated expanded: #include "src/protozero/filtering/message_filter.h"
+
+namespace protozero {
+
+// Loads a MessageFilter from the trace_filter field of a TraceConfig.
+// This sets up the string filter rules (both base and v54 chains) and loads
+// the bytecode (v1/v2 + v54 overlay).
+// On failure, returns a non-ok status with a descriptive error message.
+// On success, the caller may optionally call SetFilterRoot() to adjust the
+// root message (e.g. for per-packet filtering in the tracing service).
+perfetto::base::Status LoadMessageFilterConfig(
+    const perfetto::protos::gen::TraceConfig::TraceFilter& filt,
+    MessageFilter* filter);
+
+}  // namespace protozero
+
+#endif  // SRC_PROTOZERO_FILTERING_MESSAGE_FILTER_CONFIG_H_
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "src/protozero/filtering/message_filter_config.h"
+
+#include <cstdint>
+#include <optional>
+#include <string>
+
+// gen_amalgamated expanded: #include "perfetto/base/status.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/trace_config.gen.h"
+// gen_amalgamated expanded: #include "src/protozero/filtering/message_filter.h"
+// gen_amalgamated expanded: #include "src/protozero/filtering/string_filter.h"
+
+namespace protozero {
+
+namespace {
+
+using TraceFilter = perfetto::protos::gen::TraceConfig::TraceFilter;
+using StringFilterRule = TraceFilter::StringFilterRule;
+
+std::optional<StringFilter::Policy> ConvertPolicy(
+    TraceFilter::StringFilterPolicy policy) {
+  switch (policy) {
+    case TraceFilter::SFP_UNSPECIFIED:
+      return std::nullopt;
+    case TraceFilter::SFP_MATCH_REDACT_GROUPS:
+      return StringFilter::Policy::kMatchRedactGroups;
+    case TraceFilter::SFP_ATRACE_MATCH_REDACT_GROUPS:
+      return StringFilter::Policy::kAtraceMatchRedactGroups;
+    case TraceFilter::SFP_MATCH_BREAK:
+      return StringFilter::Policy::kMatchBreak;
+    case TraceFilter::SFP_ATRACE_MATCH_BREAK:
+      return StringFilter::Policy::kAtraceMatchBreak;
+    case TraceFilter::SFP_ATRACE_REPEATED_SEARCH_REDACT_GROUPS:
+      return StringFilter::Policy::kAtraceRepeatedSearchRedactGroups;
+  }
+  return std::nullopt;
+}
+
+std::optional<StringFilter::SemanticTypeMask> ConvertSemanticTypeMask(
+    const StringFilterRule& rule) {
+  // UNSPECIFIED (0) is treated as its own category - it only matches rules
+  // that explicitly include bit 0 in their mask. If no semantic types are
+  // specified, default to matching only UNSPECIFIED (bit 0).
+  if (rule.semantic_type().empty()) {
+    return StringFilter::SemanticTypeMask::Unspecified();
+  }
+  StringFilter::SemanticTypeMask mask;
+  for (const auto& type : rule.semantic_type()) {
+    auto semantic_type = static_cast<uint32_t>(type);
+    if (semantic_type >= StringFilter::SemanticTypeMask::kLimit) {
+      return std::nullopt;
+    }
+    mask.Set(semantic_type);
+  }
+  return mask;
+}
+
+}  // namespace
+
+perfetto::base::Status LoadMessageFilterConfig(const TraceFilter& filt,
+                                               MessageFilter* filter) {
+  StringFilter& string_filter = filter->string_filter();
+
+  auto add_rule = [&](const auto& rule) -> perfetto::base::Status {
+    auto policy = ConvertPolicy(rule.policy());
+    if (!policy.has_value()) {
+      return perfetto::base::ErrStatus(
+          "Trace filter has invalid string filtering rules");
+    }
+    auto semantic_type = ConvertSemanticTypeMask(rule);
+    if (!semantic_type.has_value()) {
+      return perfetto::base::ErrStatus(
+          "Trace filter has invalid semantic types in string filtering rules");
+    }
+    string_filter.AddRule(*policy, rule.regex_pattern(),
+                          rule.atrace_payload_starts_with(), rule.name(),
+                          *semantic_type);
+    return perfetto::base::OkStatus();
+  };
+
+  // Load base string filter chain.
+  for (const auto& rule : filt.string_filter_chain().rules()) {
+    auto status = add_rule(rule);
+    if (!status.ok())
+      return status;
+  }
+
+  // Load v54 string filter chain. Rules with matching names will replace
+  // existing rules; others will be appended.
+  for (const auto& rule : filt.string_filter_chain_v54().rules()) {
+    auto status = add_rule(rule);
+    if (!status.ok())
+      return status;
+  }
+
+  const std::string& bytecode_v1 = filt.bytecode();
+  const std::string& bytecode_v2 = filt.bytecode_v2();
+  const std::string& bytecode = bytecode_v2.empty() ? bytecode_v1 : bytecode_v2;
+  const std::string& overlay = filt.bytecode_overlay_v54();
+  if (!filter->LoadFilterBytecode(bytecode.data(), bytecode.size(),
+                                  overlay.empty() ? nullptr : overlay.data(),
+                                  overlay.size())) {
+    return perfetto::base::ErrStatus("Trace filter bytecode invalid");
+  }
+
+  return perfetto::base::OkStatus();
+}
+
 }  // namespace protozero
 // gen_amalgamated begin source: src/tracing/service/clock.cc
 // gen_amalgamated begin header: src/tracing/service/clock.h
@@ -56360,9 +59423,9 @@ void MetatraceWriter::WriteAllAvailableEvents() {
 void MetatraceWriter::WriteAllAndFlushTraceWriter(
     std::function<void()> callback) {
   PERFETTO_DCHECK_THREAD(thread_checker_);
-  if (!started_)
-    return;
-  WriteAllAvailableEvents();
+  if (started_) {
+    WriteAllAvailableEvents();
+  }
   trace_writer_->Flush(std::move(callback));
 }
 
@@ -56454,6 +59517,9 @@ const uint32_t kReservedFieldIds[] = {
     protos::pbzero::TracePacket::kSynchronizationMarkerFieldNumber,
     protos::pbzero::TracePacket::kTrustedPidFieldNumber,
     protos::pbzero::TracePacket::kMachineIdFieldNumber,
+    protos::pbzero::TracePacket::kServiceEventFieldNumber,
+    protos::pbzero::TracePacket::kTraceProvenanceFieldNumber,
+    protos::pbzero::TracePacket::kProtovmsFieldNumber,
 };
 
 // This translation unit is quite subtle and perf-sensitive. Remember to check
@@ -56939,10 +60005,14 @@ class TraceBuffer {
   // Returns the next packet in the buffer, if any, and the producer_id,
   // producer_uid, and writer_id of the producer/writer that wrote it.
   // Returns false if no packets can be read at this point.
+  // |previous_packet_on_sequence_dropped| is a bitmask: 0 if no data was lost
+  // on the sequence before this packet, otherwise nonzero. TraceBufferV2 sets
+  // the DataLossReason cause bits; TraceBufferV1 just sets 1. The value is
+  // forwarded into TracePacket.previous_packet_dropped.
   virtual bool ReadNextTracePacket(
       TracePacket*,
       PacketSequenceProperties* sequence_properties,
-      bool* previous_packet_on_sequence_dropped) = 0;
+      uint32_t* previous_packet_on_sequence_dropped) = 0;
 
   // Creates a read-only clone of the trace buffer. The read iterators of the
   // new buffer will be reset, as if no Read() had been called.
@@ -57230,9 +60300,10 @@ class TraceBufferV1 : public TraceBuffer {
   //   P1, P4, P7, P2, P3, P5, P8, P9, P6
   // But the following is guaranteed to NOT happen:
   //   P1, P5, P7, P4 (P4 cannot come after P5)
-  bool ReadNextTracePacket(TracePacket*,
-                           PacketSequenceProperties* sequence_properties,
-                           bool* previous_packet_on_sequence_dropped) override;
+  bool ReadNextTracePacket(
+      TracePacket*,
+      PacketSequenceProperties* sequence_properties,
+      uint32_t* previous_packet_on_sequence_dropped) override;
 
   // Creates a read-only clone of the trace buffer. Calls to
   // CopyChunkUntrusted() and TryPatchChunkContents() on the returned cloned
@@ -58242,7 +61313,7 @@ void TraceBufferV1::SequenceIterator::MoveNext() {
 bool TraceBufferV1::ReadNextTracePacket(
     TracePacket* packet,
     PacketSequenceProperties* sequence_properties,
-    bool* previous_packet_on_sequence_dropped) {
+    uint32_t* previous_packet_on_sequence_dropped) {
   // Note: MoveNext() moves only within the next chunk within the same
   // {ProducerID, WriterID} sequence. Here we want to:
   // - return the next patched+complete packet in the current sequence, if any.
@@ -58252,7 +61323,7 @@ bool TraceBufferV1::ReadNextTracePacket(
 
   // Just in case we forget to initialize these below.
   *sequence_properties = {0, ClientIdentity(), 0};
-  *previous_packet_on_sequence_dropped = false;
+  *previous_packet_on_sequence_dropped = 0;
 
   // At the start of each sequence iteration, we consider the last read packet
   // dropped. While iterating over the chunks in the sequence, we update this
@@ -58369,7 +61440,7 @@ bool TraceBufferV1::ReadNextTracePacket(
         if (PERFETTO_LIKELY(result == ReadPacketResult::kSucceeded)) {
           *sequence_properties = {trusted_producer_id, client_identity,
                                   writer_id};
-          *previous_packet_on_sequence_dropped = previous_packet_dropped;
+          *previous_packet_on_sequence_dropped = !!previous_packet_dropped;
           return true;
         } else if (result == ReadPacketResult::kFailedEmptyPacket) {
           // We can ignore and skip empty packets.
@@ -58395,7 +61466,7 @@ bool TraceBufferV1::ReadNextTracePacket(
         stats_.set_readaheads_succeeded(stats_.readaheads_succeeded() + 1);
         *sequence_properties = {trusted_producer_id, client_identity,
                                 writer_id};
-        *previous_packet_on_sequence_dropped = previous_packet_dropped;
+        *previous_packet_on_sequence_dropped = !!previous_packet_dropped;
         return true;
       }
 
@@ -58735,9 +61806,10 @@ class TraceBufferV1WithV2Shadow : public TraceBuffer {
   void BeginRead() override;
 
   // ReadNextTracePacket forwards to V1 only. Hash comparison is performed.
-  bool ReadNextTracePacket(TracePacket*,
-                           PacketSequenceProperties* sequence_properties,
-                           bool* previous_packet_on_sequence_dropped) override;
+  bool ReadNextTracePacket(
+      TracePacket*,
+      PacketSequenceProperties* sequence_properties,
+      uint32_t* previous_packet_on_sequence_dropped) override;
 
   std::unique_ptr<TraceBuffer> CloneReadOnly() const override;
 
@@ -58865,6 +61937,9 @@ class CircularQueue {
       ignore_result(generation);
     }
 
+    // Needed so std::reverse_iterator<Iterator> is default constructible, which
+    // some libstdc++ versions require. Never used default-constructed.
+    Iterator() noexcept = default;
     Iterator(const Iterator&) noexcept = default;
     Iterator& operator=(const Iterator&) noexcept = default;
     Iterator(Iterator&&) noexcept = default;
@@ -58962,11 +62037,11 @@ class CircularQueue {
       PERFETTO_DCHECK(pos_ <= queue_->end_);
     }
 
-    CircularQueue* queue_;
-    uint64_t pos_;
+    CircularQueue* queue_ = nullptr;
+    uint64_t pos_ = 0;
 
 #if PERFETTO_DCHECK_IS_ON()
-    uint32_t generation_;
+    uint32_t generation_ = 0;
 #endif
   };
 
@@ -59490,7 +62565,7 @@ struct TBChunk {
   // The number of payload bytes unconsumed. This starts at payload_size and
   // shrinks until it reaches 0 as we consume fragments.
   // It is always <= size and <= payload_size.
-  // Effectively (payload_size - payload-avail) is the offset of the the next
+  // Effectively (payload_size - payload-avail) is the offset of the next
   // unconsumed fragment header (the varint with the size).
   uint16_t payload_avail = 0;
 
@@ -59542,7 +62617,7 @@ struct TBChunk {
 // Remember that this struct must be copyable for CloneReadOnly(). Don't hold
 // onto any pointers in here.
 // SequenceState(s) are not deleted aggressively to preserve the
-// last_chunk_id_consumed and detect data losses in long tracing mode. We allow
+// last_chunk_consumed and detect data losses in long tracing mode. We allow
 // the last kKeepLastEmptySeq to stay alive to balance data loss detection with
 // memory bloats.
 struct SequenceState {
@@ -59564,11 +62639,21 @@ struct SequenceState {
   // objects around.
   uint64_t age_for_gc = 0;
 
-  std::optional<ChunkID> last_chunk_id_consumed;
+  // Snapshot of the last chunk that was erased (consumed or evicted) in this
+  // sequence. Used to detect gaps between consecutive chunks and to decide
+  // whether a re-committed chunk should be accepted or discarded.
+  // |payload_size| and |was_incomplete| capture the chunk's state at the time
+  // of consumption; see CopyChunkUntrusted() for how they are used.
+  struct ConsumedChunkInfo {
+    ChunkID chunk_id = 0;
+    uint16_t payload_size = 0;
+    bool was_incomplete = false;
+  };
+  std::optional<ConsumedChunkInfo> last_chunk_consumed;
 
-  // This is set whenever a data loss is detected and cleared when reading the
-  // next packet for the sequence (which will report previous_packet_dropped).
-  bool data_loss = false;
+  // Pending DataLossReason bitmask for this sequence, OR-ed until the next read
+  // copies it into previous_packet_dropped and resets it. Zero means no loss.
+  uint32_t data_loss_reasons = 0;
 
   // An ordered list of chunk offsets, sorted by their ChunkID. Each member
   // corresponsds to the offset within buf_ for the chunk.
@@ -59726,8 +62811,15 @@ class ChunkSeqReader {
   ChunkSeqReader& operator=(ChunkSeqReader&&) = delete;
 
   enum class FragReassemblyResult { kSuccess = 0, kNotEnoughData, kDataLoss };
-  FragReassemblyResult ReassembleFragmentedPacket(TracePacket* out_packet,
-                                                  Frag* initial_frag);
+
+  // Return type of ReassembleFragmentedPacket(). |reason| is a
+  // DataLossReason value, only valid when |result| == kDataLoss.
+  struct FragReassemblyOutcome {
+    FragReassemblyResult result = FragReassemblyResult::kNotEnoughData;
+    uint32_t reason = 0;
+  };
+  FragReassemblyOutcome ReassembleFragmentedPacket(TracePacket* out_packet,
+                                                   Frag* initial_frag);
   void ConsumeFragment(TBChunk*, Frag*);
 
   TraceBufferV2* const buf_ = nullptr;
@@ -59873,9 +62965,10 @@ class TraceBufferV2 : public TraceBuffer {
   //   P1, P4, P7, P2, P3, P5, P8, P9, P6
   // But the following is guaranteed to NOT happen:
   //   P1, P5, P7, P4 (P4 cannot come after P5)
-  bool ReadNextTracePacket(TracePacket*,
-                           PacketSequenceProperties* sequence_properties,
-                           bool* previous_packet_on_sequence_dropped) override;
+  bool ReadNextTracePacket(
+      TracePacket*,
+      PacketSequenceProperties* sequence_properties,
+      uint32_t* previous_packet_on_sequence_dropped) override;
 
   // Creates a read-only clone of the trace buffer. The read iterators of the
   // new buffer will be reset, as if no Read() had been called. Calls to
@@ -60156,7 +63249,7 @@ void TraceBufferV1WithV2Shadow::BeginRead() {
   for (;;) {
     TracePacket packet;
     PacketSequenceProperties seq_props{};
-    bool prev_dropped = false;
+    uint32_t prev_dropped = 0;
     if (!v2_->ReadNextTracePacket(&packet, &seq_props, &prev_dropped))
       break;
     auto hash = ComputePacketHash(packet, seq_props);
@@ -60167,7 +63260,7 @@ void TraceBufferV1WithV2Shadow::BeginRead() {
 bool TraceBufferV1WithV2Shadow::ReadNextTracePacket(
     TracePacket* packet,
     PacketSequenceProperties* sequence_properties,
-    bool* previous_packet_on_sequence_dropped) {
+    uint32_t* previous_packet_on_sequence_dropped) {
   bool result = v1_->ReadNextTracePacket(packet, sequence_properties,
                                          previous_packet_on_sequence_dropped);
   if (result && packets_seen_ < kMaxPacketHashes) {
@@ -60295,21 +63388,25 @@ bool TraceBufferV1WithV2Shadow::has_data() const {
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
 // gen_amalgamated expanded: #include "src/protovm/vm.h"
 
+// gen_amalgamated expanded: #include "protos/perfetto/trace/trace_packet.pbzero.h"
+
 // Set manually when debugging test failures.
 // TRACE_BUFFER_V2_DLOG is too verbose, even for debug builds.
 #define TRACE_BUFFER_V2_VERBOSE_LOGGING() 0
 
-#if TRACE_BUFFER_V2_VERBOSE_LOGGING()
-#define TRACE_BUFFER_V2_DLOG PERFETTO_DLOG
-#else
-#define TRACE_BUFFER_V2_DLOG(...) base::ignore_result(__VA_ARGS__)
-#endif
+#define TRACE_BUFFER_V2_DLOG(...)                    \
+  do {                                               \
+    if constexpr (TRACE_BUFFER_V2_VERBOSE_LOGGING()) \
+      PERFETTO_DLOG(__VA_ARGS__);                    \
+  } while (0)
 
 using protozero::proto_utils::ParseVarInt;
 namespace proto_utils = ::protozero::proto_utils;
 
 namespace perfetto {
 
+using DataLossReason = protos::pbzero::TracePacket_DataLossReason;
+
 namespace {
 
 // The names below need some mangling because v1/v2.cc collide in the
@@ -60354,6 +63451,14 @@ constexpr size_t kEmptySequencesGcTreshold = kKeepLastEmptySeq + 128;
 
 namespace internal {
 
+namespace {
+void AddSeqDataLoss(SequenceState* seq, uint32_t reason) {
+  PERFETTO_DCHECK(reason != 0);
+  // DATA_LOSS_PRESENT is always set so any nonzero value reads as "dropped".
+  seq->data_loss_reasons |= DataLossReason::DATA_LOSS_PRESENT | reason;
+}
+}  // namespace
+
 SequenceState::SequenceState(ProducerID p, WriterID w, ClientIdentity c)
     : producer_id(p),
       writer_id(w),
@@ -60475,13 +63580,14 @@ TBChunk* ChunkSeqIterator::NextChunkInSequence() {
   //    we do this, each iteration erases the last chunk before moving onto the
   //    next one. We can't use the SequenceState.chunks because the upcoming
   //    chunk will always be the "first" in this case. However, we can look at
-  //    last_chunk_id_consumed.
+  //    last_chunk_consumed.
   // 2) We are iterating read-only as part of ReassembleFragmentedPacket(). In
   //    this case we are not consuming any chunk, and we can use the combination
   //    of SequenceState.chunks[SequenceState.next_seq_idx].
   std::optional<ChunkID> last_chunk_id;
   if (chunk_->is_padding()) {
-    last_chunk_id = seq_->last_chunk_id_consumed;  // Case 1.
+    if (seq_->last_chunk_consumed.has_value())
+      last_chunk_id = seq_->last_chunk_consumed->chunk_id;  // Case 1.
   } else {
     last_chunk_id = chunk_->chunk_id;  // Case 2
   }
@@ -60502,7 +63608,9 @@ void ChunkSeqIterator::EraseCurrentChunk() {
   TRACE_BUFFER_V2_DLOG("EraseChunk() id=%u off=%zu", chunk_->chunk_id,
                        chunk_off);
   const uint32_t chunk_size = chunk_->size;
-  seq_->last_chunk_id_consumed = chunk_->chunk_id;
+  const bool was_incomplete = chunk_->flags & kChunkIncomplete;
+  seq_->last_chunk_consumed = SequenceState::ConsumedChunkInfo{
+      chunk_->chunk_id, chunk_->payload_size, was_incomplete};
 
   auto& chunk_list = seq_->chunks;
 
@@ -60547,12 +63655,23 @@ ChunkSeqReader::ChunkSeqReader(TraceBufferV2* buf,
       frag_iter_(iter_) {
   PERFETTO_DCHECK(!iter_->is_padding());
   TRACE_BUFFER_V2_DLOG("ChunkSeqReader() last_id=%u iter_=%u end_=%u",
-                       seq_->last_chunk_id_consumed.value_or(0),
+                       seq_->last_chunk_consumed.has_value()
+                           ? seq_->last_chunk_consumed->chunk_id
+                           : 0,
                        iter_->chunk_id, end_->chunk_id);
 
-  if (seq_->last_chunk_id_consumed.has_value() &&
-      iter_->chunk_id != *seq_->last_chunk_id_consumed + 1) {
-    seq_->data_loss = true;
+  if (seq_->last_chunk_consumed.has_value()) {
+    const auto& last = *seq_->last_chunk_consumed;
+    // Re-admit: an incomplete chunk that was evicted has been re-committed
+    // with strictly more payload. The chunk_id is unchanged, so the +1
+    // successor check below would fire spuriously even though the re-admit
+    // recovered the deferred fragments without losing data. Keep this
+    // predicate in sync with the re-admit acceptance check in
+    // TraceBufferV2::CopyChunkUntrusted.
+    bool readmit = last.was_incomplete && iter_->chunk_id == last.chunk_id;
+    if (!readmit && iter_->chunk_id != last.chunk_id + 1) {
+      AddSeqDataLoss(seq_, DataLossReason::DATA_LOSS_READ_GAP);
+    }
   }
 }
 
@@ -60579,7 +63698,7 @@ bool ChunkSeqReader::ReadNextPacketInSeqOrder(TracePacket* out_packet) {
       bool end_reached = iter_ == end_;
 
       if (frag_iter_.chunk_corrupted()) {
-        seq_->data_loss = true;
+        AddSeqDataLoss(seq_, DataLossReason::DATA_LOSS_CHUNK_CORRUPTED);
       }
 
       // If a chunk is incomplete, this is the point where we stop processing
@@ -60627,15 +63746,15 @@ bool ChunkSeqReader::ReadNextPacketInSeqOrder(TracePacket* out_packet) {
         // should iterate over the Continue/End in ReassembleFragmentedPacket(),
         // which performs the lookahead. If we hit this code path, either a
         // producer emitted a chunk sequence like [kWholePacket],[kFragEnd]
-        // or, more realistically, we had a data losss and missed the chunk with
+        // or, more realistically, we had a data loss and missed the chunk with
         // the kFragBegin.
-        seq_->data_loss = true;
+        AddSeqDataLoss(seq_, DataLossReason::DATA_LOSS_ORPHAN_CONTINUATION);
         ConsumeFragment(iter_, &frag);
         break;  // Break the switch, continue the loop.
 
       case Frag::kFragBegin:
-        auto reassembly_res = ReassembleFragmentedPacket(out_packet, &frag);
-        if (reassembly_res == FragReassemblyResult::kSuccess) {
+        auto reassembly = ReassembleFragmentedPacket(out_packet, &frag);
+        if (reassembly.result == FragReassemblyResult::kSuccess) {
           buf_->stats_.set_readaheads_succeeded(
               buf_->stats_.readaheads_succeeded() + 1);
 
@@ -60650,12 +63769,12 @@ bool ChunkSeqReader::ReadNextPacketInSeqOrder(TracePacket* out_packet) {
           return true;
         }
 
-        // If we get here reassembly_res is either kNotEnoughData or kDataLoss.
+        // Reassembly failed: kNotEnoughData or kDataLoss.
 
         buf_->stats_.set_readaheads_failed(buf_->stats_.readaheads_failed() +
                                            1);
 
-        if (reassembly_res == FragReassemblyResult::kNotEnoughData &&
+        if (reassembly.result == FragReassemblyResult::kNotEnoughData &&
             mode_ == kReadMode) {
           // If we got no more chunks, there is no point insisting with this
           // chunk, give up and let the caller try other chunks in buffer order.
@@ -60673,8 +63792,8 @@ bool ChunkSeqReader::ReadNextPacketInSeqOrder(TracePacket* out_packet) {
         // In either case we want to continue the loop and let the prologue of
         // the next loop iteration do EraseCurrentChunk().
         PERFETTO_DCHECK(
-            reassembly_res == FragReassemblyResult::kDataLoss ||
-            (reassembly_res == FragReassemblyResult::kNotEnoughData &&
+            reassembly.result == FragReassemblyResult::kDataLoss ||
+            (reassembly.result == FragReassemblyResult::kNotEnoughData &&
              mode_ == kEraseMode));
 
         // If we detect a data loss, ReassembleFragmentedPacket() consumes all
@@ -60687,7 +63806,13 @@ bool ChunkSeqReader::ReadNextPacketInSeqOrder(TracePacket* out_packet) {
         //   so we rewind (we go back on the sequence's chunk list).
         // - Then we find that, in this sequence, there is a "broken" packet.
         // We should keep going on the same sequence and mark the data loss.
-        seq_->data_loss = true;
+        if (reassembly.result == FragReassemblyResult::kDataLoss) {
+          AddSeqDataLoss(seq_, reassembly.reason);
+        } else {
+          // kNotEnoughData + kEraseMode: begin fragment evicted by ring-buffer
+          // wrap while its continuation chunks were missing or unpatched.
+          AddSeqDataLoss(seq_, DataLossReason::DATA_LOSS_OVERWRITE);
+        }
         break;  // case kFragBegin
     }  // switch(frag.type)
   }  // for(;;)
@@ -60703,12 +63828,17 @@ void ChunkSeqReader::ConsumeFragment(TBChunk* chunk, Frag* frag) {
 
   PERFETTO_DCHECK(chunk->payload_avail >= frag->size_with_header());
   chunk->payload_avail -= frag->size_with_header();
+
   if (chunk->payload_avail == 0) {
     TRACE_BUFFER_V2_DLOG("  Fully consumed chunk @ %zu", buf_->OffsetOf(chunk));
+    auto& stats = buf_->stats_;
     if (mode_ == kReadMode) {
-      auto& stats = buf_->stats_;
       stats.set_chunks_read(stats.chunks_read() + 1);
       stats.set_bytes_read(stats.bytes_read() + chunk->outer_size());
+    } else if (mode_ == kEraseMode) {
+      stats.set_chunks_overwritten(stats.chunks_overwritten() + 1);
+      stats.set_bytes_overwritten(stats.bytes_overwritten() +
+                                  chunk->outer_size());
     }
   }
 }
@@ -60716,37 +63846,36 @@ void ChunkSeqReader::ConsumeFragment(TBChunk* chunk, Frag* frag) {
 // Tries to reassemble the packet following the chunks in sequence order (by
 // cloning the ChunkSeqIterator). If there is a data loss, it consumes anyways
 // the fragments. If there isn't enough data, leaves the fragments untouched.
-ChunkSeqReader::FragReassemblyResult ChunkSeqReader::ReassembleFragmentedPacket(
-    TracePacket* out_packet,
-    Frag* initial_frag) {
+ChunkSeqReader::FragReassemblyOutcome
+ChunkSeqReader::ReassembleFragmentedPacket(TracePacket* out_packet,
+                                           Frag* initial_frag) {
   PERFETTO_DCHECK(initial_frag->type == Frag::kFragBegin);
-
   TBChunk* initial_chunk = seq_iter_.chunk();
-  if (initial_chunk->flags & kChunkNeedsPatch)
-    return FragReassemblyResult::kNotEnoughData;
 
   struct FragAndChunk {
     FragAndChunk(Frag f, TBChunk* c) : frag(std::move(f)), chunk(c) {}
     Frag frag;
     TBChunk* chunk;
   };
-
   base::SmallVector<FragAndChunk, 8> frags;
   frags.emplace_back(*initial_frag, initial_chunk);
   ChunkSeqIterator chunk_iter = seq_iter_;  // Make copy.
 
-  // Iterate over chunks using the linked list.
-  FragReassemblyResult res;
-  for (;;) {
+  // Iterate over chunks using the linked list, unless the chunk needs patching
+  // in which case we skip down leaving the default outcome (kNotEnoughData).
+  FragReassemblyOutcome outcome;
+  const bool chunk_needs_patching = initial_chunk->flags & kChunkNeedsPatch;
+  while (!chunk_needs_patching) {
     PERFETTO_DCHECK((chunk_iter.valid()));
     TBChunk* next_chunk = chunk_iter.NextChunkInSequence();
     if (!next_chunk || next_chunk->flags & kChunkNeedsPatch) {
-      res = FragReassemblyResult::kNotEnoughData;
+      outcome.result = FragReassemblyResult::kNotEnoughData;
       break;
     }
     if (chunk_iter.sequence_gap_detected()) {
       // There is a gap in the sequence ID.
-      res = FragReassemblyResult::kDataLoss;
+      outcome.result = FragReassemblyResult::kDataLoss;
+      outcome.reason = DataLossReason::DATA_LOSS_REASSEMBLY_GAP;
       break;
     }
     FragIterator frag_iter = FragIterator(next_chunk);
@@ -60761,7 +63890,8 @@ ChunkSeqReader::FragReassemblyResult ChunkSeqReader::ReassembleFragmentedPacket(
     std::optional<Frag> frag = frag_iter.NextFragmentInChunk();
     if (!frag.has_value()) {
       if (frag_iter.chunk_corrupted()) {
-        res = FragReassemblyResult::kDataLoss;
+        outcome.result = FragReassemblyResult::kDataLoss;
+        outcome.reason = DataLossReason::DATA_LOSS_CHUNK_CORRUPTED;
         break;
       }
       // This can happen if a chunk in the middle of a sequence is empty. Rare
@@ -60777,7 +63907,7 @@ ChunkSeqReader::FragReassemblyResult ChunkSeqReader::ReassembleFragmentedPacket(
     if (frag_type == Frag::kFragEnd) {
       frags.emplace_back(*frag, next_chunk);
 
-      res = FragReassemblyResult::kSuccess;
+      outcome.result = FragReassemblyResult::kSuccess;
       break;
     }
     // else: kFragBegin or kFragWholePacket
@@ -60787,10 +63917,12 @@ ChunkSeqReader::FragReassemblyResult ChunkSeqReader::ReassembleFragmentedPacket(
     // to us. The next ReadNextPacketInSeqOrder calls will deal with them. Our
     // job here is to consume only fragments for the packet we are trying to
     // reassemble.
-    res = FragReassemblyResult::kDataLoss;
+    outcome.result = FragReassemblyResult::kDataLoss;
+    outcome.reason = DataLossReason::DATA_LOSS_REASSEMBLY_BROKEN_CHAIN;
     break;
   }  // for (chunk in list)
 
+  const auto& res = outcome.result;
   for (FragAndChunk& fc : frags) {
     Frag& f = fc.frag;
     if (res == FragReassemblyResult::kSuccess && f.size > 0) {
@@ -60798,11 +63930,12 @@ ChunkSeqReader::FragReassemblyResult ChunkSeqReader::ReassembleFragmentedPacket(
         out_packet->AddSlice(f.begin, f.size);
     }
     if (res == FragReassemblyResult::kSuccess ||
-        res == FragReassemblyResult::kDataLoss) {
+        res == FragReassemblyResult::kDataLoss ||
+        (res == FragReassemblyResult::kNotEnoughData && mode_ == kEraseMode)) {
       ConsumeFragment(fc.chunk, &f);
     }
   }
-  return res;
+  return outcome;
 }
 
 }  // namespace internal
@@ -60858,9 +63991,9 @@ void TraceBufferV2::BeginRead() {
 bool TraceBufferV2::ReadNextTracePacket(
     TracePacket* out_packet,
     PacketSequenceProperties* sequence_properties,
-    bool* previous_packet_on_sequence_dropped) {
+    uint32_t* previous_packet_on_sequence_dropped) {
   *sequence_properties = {0, ClientIdentity(), 0};
-  *previous_packet_on_sequence_dropped = false;
+  *previous_packet_on_sequence_dropped = 0;
 
   // When reading back chunks, we visit the buffer in two layers
   // (see /docs/design-docs/trace-buffer.md):
@@ -60898,8 +64031,8 @@ bool TraceBufferV2::ReadNextTracePacket(
       if (chunk_seq_reader_->ReadNextPacketInSeqOrder(out_packet)) {
         SequenceState& s = *chunk_seq_reader_->seq();
         *sequence_properties = {s.producer_id, s.client_identity, s.writer_id};
-        *previous_packet_on_sequence_dropped = s.data_loss;
-        s.data_loss = false;
+        *previous_packet_on_sequence_dropped = s.data_loss_reasons;
+        s.data_loss_reasons = 0;
         return true;
       }
       // If ReadNextPacketInSeqOrder rans out of data, skip to the block below
@@ -60979,6 +64112,7 @@ void TraceBufferV2::CopyChunkUntrusted(
   bool trace_writer_data_drop = frag_iter.trace_writer_data_drop();
 
   PERFETTO_CHECK(all_frags_size <= src_size);
+  const uint16_t all_frags_size_u16 = static_cast<uint16_t>(all_frags_size);
 
   // Make space in the buffer for the chunk we are about to copy.
 
@@ -61009,59 +64143,67 @@ void TraceBufferV2::CopyChunkUntrusted(
   SequenceState& seq = seq_it->second;
   if (trace_writer_data_drop) {
     stats_.set_trace_writer_packet_loss(stats_.trace_writer_packet_loss() + 1);
-    seq.data_loss = true;
-  }
-
-  // Don't allow re-commit of chunks that have been consumed already. It's too
-  // late and they will only mess up future chunks more.
-  if (seq.last_chunk_id_consumed.has_value() &&
-      ChunkIdCompare(chunk_id, *seq.last_chunk_id_consumed) <= 0) {
-    stats_.set_chunks_discarded(stats_.chunks_discarded() + 1);
-    PERFETTO_DCHECK(suppress_client_dchecks_for_testing_);
-    return;
+    internal::AddSeqDataLoss(&seq, DataLossReason::DATA_LOSS_WRITER_ABORT);
   }
 
-  // If there isn't enough room from the given write position: write a padding
-  // record to clear the end of the buffer, wrap and start at offset 0.
-  const size_t cached_size_to_end = size_to_end();
-  if (PERFETTO_UNLIKELY(tbchunk_outer_size > cached_size_to_end)) {
-    // If we reached the end of the buffer and we are using discard policy,
-    // this is where we stop. This buffer will no longer accept data.
-    if (overwrite_policy_ == kDiscard)
-      return DiscardWrite();
-
-    DeleteNextChunksFor(cached_size_to_end);
-    wr_ = 0;
-    stats_.set_write_wrap_count(stats_.write_wrap_count() + 1);
-    PERFETTO_DCHECK(size_to_end() >= tbchunk_outer_size);
+  // Don't allow re-commit of chunks that have been consumed already, unless
+  // the chunk was evicted while incomplete (scraped) and the new commit has
+  // strictly more payload. In that case we re-admit it so the previously-
+  // dropped fragments can be recovered. Keep this acceptance condition in
+  // sync with the re-admit branch of the gap check in ChunkSeqReader's ctor.
+  //
+  // When re-admitting, |previously_consumed_payload| records how many payload
+  // bytes were already consumed before eviction, so we can skip them below.
+  uint16_t previously_consumed_payload = 0;
+  if (seq.last_chunk_consumed.has_value()) {
+    int cmp = ChunkIdCompare(chunk_id, seq.last_chunk_consumed->chunk_id);
+    if (cmp == 0 && seq.last_chunk_consumed->was_incomplete &&
+        seq.last_chunk_consumed->payload_size < all_frags_size) {
+      previously_consumed_payload = seq.last_chunk_consumed->payload_size;
+      TRACE_BUFFER_V2_DLOG("  Re-admitting chunk %u (prev_payload=%u)",
+                           chunk_id, previously_consumed_payload);
+    } else if (cmp <= 0) {
+      // Older or same chunk with no new data to recover.
+      stats_.set_chunks_discarded(stats_.chunks_discarded() + 1);
+      PERFETTO_DCHECK(suppress_client_dchecks_for_testing_);
+      return;
+    }
   }
 
-  // Deletes all chunks from |wptr_| to |wptr_| + |record_size|.
-  DeleteNextChunksFor(tbchunk_outer_size);
-
   // Find the insert position in the SequenceState's chunk list. We iterate the
   // list in reverse order as in the majority of cases chunks arrive naturally
   // in order. SMB scraping is really the only thing that might commit chunks
   // slightly out of order.
+  //
+  // This search runs BEFORE the wrap path / DeleteNextChunksFor below: a
+  // re-commit must be handled in place, and the eviction below could
+  // otherwise destroy the chunk we'd want to rewrite (silent duplication
+  // when the consumer has already drained an incomplete copy).
   auto& chunk_list = seq.chunks;
-  auto insert_pos = chunk_list.rbegin();
-  TBChunk* recommit_chunk = nullptr;
-  for (; insert_pos != chunk_list.rend(); ++insert_pos) {
-    TBChunk* other_chunk = GetTBChunkAt(*insert_pos);
-    int cmp = ChunkIdCompare(chunk_id, other_chunk->chunk_id);
-    if (cmp > 0)
-      break;
-    if (cmp == 0) {
-      // The producer is trying to re-commit a previously copied chunk. This
-      // can happen when the service does SMB scraping (the same chunk could
-      // be scraped more than once), and later the producer does a commit.
-      // We allow recommit only if the new chunk is larger than the existing.
-      recommit_chunk = other_chunk;
-      break;
+  size_t chunk_list_size_before_remove = chunk_list.size();
+
+  using InsIter = base::CircularQueue<size_t>::ReverseIterator;
+  auto compute_insert_position = [&]() -> std::pair<InsIter, TBChunk*> const {
+    TBChunk* _recommit_chunk = nullptr;
+    auto _insert_pos = chunk_list.rbegin();
+    for (; _insert_pos != chunk_list.rend(); ++_insert_pos) {
+      TBChunk* other_chunk = GetTBChunkAt(*_insert_pos);
+      int cmp = ChunkIdCompare(chunk_id, other_chunk->chunk_id);
+      if (cmp > 0)
+        break;
+      if (cmp == 0) {
+        // The producer is trying to re-commit a previously copied chunk. This
+        // can happen when the service does SMB scraping (the same chunk could
+        // be scraped more than once), and later the producer does a commit.
+        // We allow recommit only if the new chunk is larger than the existing.
+        _recommit_chunk = other_chunk;
+        break;
+      }
     }
-  }
+    return std::make_pair(_insert_pos, _recommit_chunk);
+  };
 
-  const uint16_t all_frags_size_u16 = static_cast<uint16_t>(all_frags_size);
+  auto [insert_pos, recommit_chunk] = compute_insert_position();
 
   // In the case of a re-commit we don't need to create a new chunk, we just
   // want to overwrite the existing one.
@@ -61076,7 +64218,11 @@ void TraceBufferV2::CopyChunkUntrusted(
       PERFETTO_DCHECK(suppress_client_dchecks_for_testing_);
       return;
     }
-    recommit_chunk->flags &= ~kChunkIncomplete;
+    // Only clear kChunkIncomplete on real IPC recommits (chunk_complete=true).
+    // During scraping the producer may still be writing, so the chunk should
+    // remain incomplete until the producer explicitly commits it.
+    if (chunk_complete)
+      recommit_chunk->flags &= ~kChunkIncomplete;
     if (all_frags_size == recommit_chunk->payload_size) {
       TRACE_BUFFER_V2_DLOG("  skipping recommit of identical chunk");
       return;
@@ -61091,9 +64237,44 @@ void TraceBufferV2::CopyChunkUntrusted(
     return;
   }
 
+  // If there isn't enough room from the given write position: write a padding
+  // record to clear the end of the buffer, wrap and start at offset 0.
+  const size_t cached_size_to_end = size_to_end();
+  if (PERFETTO_UNLIKELY(tbchunk_outer_size > cached_size_to_end)) {
+    // If we reached the end of the buffer and we are using discard policy,
+    // this is where we stop. This buffer will no longer accept data.
+    if (overwrite_policy_ == kDiscard)
+      return DiscardWrite();
+
+    // Skip the tail cleanup if the previous write landed exactly at the end
+    // of the buffer (|wr_| == |size_|): there is no leftover tail to clear.
+    if (cached_size_to_end > 0)
+      DeleteNextChunksFor(cached_size_to_end);
+
+    wr_ = 0;
+    stats_.set_write_wrap_count(stats_.write_wrap_count() + 1);
+    PERFETTO_DCHECK(size_to_end() >= tbchunk_outer_size);
+  }
+
+  // Deletes all chunks from |wptr_| to |wptr_| + |record_size|.
+  DeleteNextChunksFor(tbchunk_outer_size);
+
+  // If the DeleteNextChunksFor happens to delete a chunk in the same sequence,
+  // the insert_pos becomes invalid and we need to recompute that.
+  // Why don't we compute the insert_pos here? Because we also need to check
+  // for re-commits (which are rare, but possible) and don't want to iterate
+  // over the chunk list twice in most cases.
+  if (PERFETTO_UNLIKELY(chunk_list.size() != chunk_list_size_before_remove)) {
+    std::tie(insert_pos, std::ignore) = compute_insert_position();
+  }
+
   TBChunk* tbchunk = CreateTBChunk(wr_, tbchunk_size);
   tbchunk->payload_size = all_frags_size_u16;
-  tbchunk->payload_avail = all_frags_size_u16;
+  // Either 0 (normal write) or strictly less (re-admission).
+  PERFETTO_DCHECK(previously_consumed_payload == 0 ||
+                  previously_consumed_payload < all_frags_size_u16);
+  // For re-admitted chunks, skip already-consumed payload (0 otherwise).
+  tbchunk->payload_avail = all_frags_size_u16 - previously_consumed_payload;
   tbchunk->chunk_id = chunk_id;
   tbchunk->flags = chunk_flags;
   tbchunk->pri_wri_id = seq_key;
@@ -61119,7 +64300,6 @@ void TraceBufferV2::CopyChunkUntrusted(
 
   wr_ += tbchunk_outer_size;
   PERFETTO_DCHECK(wr_ <= size_ && wr_ <= used_size_);
-  wr_ = wr_ >= size_ ? 0 : wr_;
 
   stats_.set_chunks_written(stats_.chunks_written() + 1);
   stats_.set_bytes_written(stats_.bytes_written() + tbchunk_outer_size);
@@ -61210,15 +64390,12 @@ void TraceBufferV2::DeleteNextChunksFor(size_t bytes_to_clear) {
     // In future this branch should become "&& !protovm_has_consumed_packet"
     // We shouldn't report a data loss if ProtoVM merged the outgoing packet.
     if (has_cleared_unconsumed_fragments) {
-      csr.seq()->data_loss = true;
+      internal::AddSeqDataLoss(csr.seq(), DataLossReason::DATA_LOSS_OVERWRITE);
     }
 
     // ChunkSeqReader(kEraseMode) must delete the chunk once
     // ReadNextPacketInSeqOrder() returns false.
     PERFETTO_DCHECK(chunk->is_padding());
-
-    stats_.set_chunks_overwritten(stats_.chunks_overwritten() + 1);
-    stats_.set_bytes_overwritten(stats_.bytes_overwritten() + chunk_outer_size);
   }
 
   // Having consumed the packets above, this loop wipes out the contents of the
@@ -61314,7 +64491,7 @@ void TraceBufferV2::DiscardWrite() {
 }
 
 // When a sequence has 0 chunks we could delete it straight away. However doing
-// do would remove also the last_chunk_id_consumed used to detect data losses.
+// do would remove also the last_chunk_consumed used to detect data losses.
 // Here we have to balance the tradeoff between:
 // - Bounding memory usage: if we have a lot of writer threads, we can't just
 //   keeping growing the SequenceStates without bounds.
@@ -63028,6 +66205,16 @@ void ConsumerEndpointImpl::QueryServiceState(
     producer->set_uid(static_cast<int32_t>(kv.second->uid()));
     producer->set_pid(static_cast<int32_t>(kv.second->pid()));
     producer->set_frozen(kv.second->IsAndroidProcessFrozen());
+    // We only surface machine info for non-host producers (those connected
+    // through traced_relay). The IPC layer fills in machine_name with the
+    // host's sysname for every locally-connected producer too, so guarding on
+    // machine_id is what tells host vs. relay apart.
+    if (kv.second->client_identity().has_non_default_machine_id()) {
+      producer->set_machine_id(kv.second->client_identity().machine_id());
+      if (!kv.second->machine_name_.empty()) {
+        producer->set_machine_name(kv.second->machine_name_);
+      }
+    }
   }
 
   for (const auto& kv : service_->data_sources_) {
@@ -63199,16 +66386,15 @@ void ProducerEndpointImpl::CommitData(const CommitDataRequest& req_untrusted,
   }
   PERFETTO_DCHECK(shmem_abi_.is_valid());
   for (const auto& entry : req_untrusted.chunks_to_move()) {
-    const uint32_t page_idx = entry.page();
-    if (page_idx >= shmem_abi_.num_pages())
-      continue;  // A buggy or malicious producer.
-
     SharedMemoryABI::Chunk chunk;
     bool commit_data_over_ipc = entry.has_data();
     bool chunk_complete = true;
     if (PERFETTO_UNLIKELY(commit_data_over_ipc)) {
       // Chunk data is passed over the wire. Create a chunk using the serialized
-      // protobuf message.
+      // protobuf message. In this path entry.page() is informational only: the
+      // chunk's payload comes from entry.data(), so we do not need to validate
+      // page() against the service-side SMB which can be smaller than the
+      // producer-side emulated SMB (issue #6051).
       const std::string& data = entry.data();
       if (data.size() > SharedMemoryABI::Chunk::kMaxSize) {
         PERFETTO_DFATAL("IPC data commit too large: %zu", data.size());
@@ -63221,8 +66407,15 @@ void ProducerEndpointImpl::CommitData(const CommitDataRequest& req_untrusted,
           static_cast<uint16_t>(entry.data().size()),
           static_cast<uint8_t>(entry.chunk()));
       chunk_complete = !entry.chunk_incomplete();
-    } else
+    } else {
+      // Real-shmem path: entry.page() indexes into the service's SMB and must
+      // be in range. (This check is only meaningful for the non-IPC path: the
+      // commit_data_over_ipc branch above never touches shmem_abi_.)
+      const uint32_t page_idx = entry.page();
+      if (page_idx >= shmem_abi_.num_pages())
+        continue;  // A buggy or malicious producer.
       chunk = shmem_abi_.TryAcquireChunkForReading(page_idx, entry.chunk());
+    }
     if (!chunk.is_valid()) {
       PERFETTO_DLOG("Asked to move chunk %u:%u, but it's not complete",
                     entry.page(), entry.chunk());
@@ -63563,7 +66756,6 @@ inline base::StatusOr<base::SchedPolicyAndPrio> CreateSchedPolicyFromConfig(
 #include <map>
 #include <memory>
 #include <optional>
-#include <regex>
 #include <set>
 #include <string>
 #include <tuple>
@@ -63606,6 +66798,7 @@ inline base::StatusOr<base::SchedPolicyAndPrio> CreateSchedPolicyFromConfig(
 // gen_amalgamated expanded: #include "perfetto/ext/base/fnv_hash.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/metatrace.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/periodic_task.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/regex.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/scoped_file.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/scoped_sched_boost.h"
 // gen_amalgamated expanded: #include "perfetto/ext/base/string_utils.h"  // IWYU pragma: keep
@@ -63636,6 +66829,7 @@ inline base::StatusOr<base::SchedPolicyAndPrio> CreateSchedPolicyFromConfig(
 // gen_amalgamated expanded: #include "src/android_stats/statsd_logging_helper.h"
 // gen_amalgamated expanded: #include "src/protovm/vm.h"
 // gen_amalgamated expanded: #include "src/protozero/filtering/message_filter.h"
+// gen_amalgamated expanded: #include "src/protozero/filtering/message_filter_config.h"
 // gen_amalgamated expanded: #include "src/protozero/filtering/string_filter.h"
 // gen_amalgamated expanded: #include "src/tracing/core/shared_memory_arbiter_impl.h"
 // gen_amalgamated expanded: #include "src/tracing/service/clock.h"
@@ -63796,15 +66990,15 @@ std::tuple<size_t /*shm_size*/, size_t /*page_size*/> EnsureValidShmSizes(
 bool NameMatchesFilter(const std::string& name,
                        const std::vector<std::string>& name_filter,
                        const std::vector<std::string>& name_regex_filter) {
-  bool filter_matches = std::find(name_filter.begin(), name_filter.end(),
-                                  name) != name_filter.end();
-  bool filter_regex_matches =
-      std::find_if(name_regex_filter.begin(), name_regex_filter.end(),
-                   [&](const std::string& regex) {
-                     return std::regex_match(
-                         name, std::regex(regex, std::regex::extended));
-                   }) != name_regex_filter.end();
-  return filter_matches || filter_regex_matches;
+  if (std::find(name_filter.begin(), name_filter.end(), name) !=
+      name_filter.end()) {
+    return true;
+  }
+  return std::any_of(
+      name_regex_filter.begin(), name_regex_filter.end(),
+      [&](const std::string& pattern) {
+        return base::Regex::CreateOrCheck(pattern).FullMatch(name);
+      });
 }
 
 // Used when TraceConfig.write_into_file == true and output_path is not empty.
@@ -63874,47 +67068,14 @@ void AppendOwnedSlicesToPacket(std::unique_ptr<uint8_t[]> data,
   }
 }
 
-using TraceFilter = protos::gen::TraceConfig::TraceFilter;
-std::optional<protozero::StringFilter::Policy> ConvertPolicy(
-    TraceFilter::StringFilterPolicy policy) {
-  switch (policy) {
-    case TraceFilter::SFP_UNSPECIFIED:
-      return std::nullopt;
-    case TraceFilter::SFP_MATCH_REDACT_GROUPS:
-      return protozero::StringFilter::Policy::kMatchRedactGroups;
-    case TraceFilter::SFP_ATRACE_MATCH_REDACT_GROUPS:
-      return protozero::StringFilter::Policy::kAtraceMatchRedactGroups;
-    case TraceFilter::SFP_MATCH_BREAK:
-      return protozero::StringFilter::Policy::kMatchBreak;
-    case TraceFilter::SFP_ATRACE_MATCH_BREAK:
-      return protozero::StringFilter::Policy::kAtraceMatchBreak;
-    case TraceFilter::SFP_ATRACE_REPEATED_SEARCH_REDACT_GROUPS:
-      return protozero::StringFilter::Policy::kAtraceRepeatedSearchRedactGroups;
-  }
-  return std::nullopt;
-}
-
-using StringFilterRule =
-    protos::gen::TraceConfig::TraceFilter::StringFilterRule;
-
-std::optional<protozero::StringFilter::SemanticTypeMask>
-ConvertSemanticTypeMask(const StringFilterRule& rule) {
-  // UNSPECIFIED (0) is treated as its own category - it only matches rules
-  // that explicitly include bit 0 in their mask. If no semantic types are
-  // specified, default to matching only UNSPECIFIED (bit 0).
-  if (rule.semantic_type().empty()) {
-    return protozero::StringFilter::SemanticTypeMask::Unspecified();
-  }
-
-  protozero::StringFilter::SemanticTypeMask mask;
-  for (const auto& type : rule.semantic_type()) {
-    auto semantic_type = static_cast<uint32_t>(type);
-    if (semantic_type >= protozero::StringFilter::SemanticTypeMask::kLimit) {
-      return std::nullopt;
-    }
-    mask.Set(semantic_type);
-  }
-  return mask;
+// Shmem emulation is only for relay (remote-host) producers whose SMB is copied
+// over IPC. An in-process producer always has a real shared SMB, so it must use
+// kDefault even when it carries a non-default machine id.
+SharedMemoryABI::ShmemMode GetShmemMode(const ClientIdentity& client_identity,
+                                        bool in_process) {
+  return (client_identity.machine_id() == kDefaultMachineID || in_process)
+             ? SharedMemoryABI::ShmemMode::kDefault
+             : SharedMemoryABI::ShmemMode::kShmemEmulation;
 }
 
 }  // namespace
@@ -64005,9 +67166,7 @@ TracingServiceImpl::ConnectProducer(Producer* producer,
       PERFETTO_DLOG(
           "Adopting producer-provided SMB of %zu kB for producer \"%s\"",
           shm_size / 1024, endpoint->name_.c_str());
-      auto shmem_mode = client_identity.machine_id() == kDefaultMachineID
-                            ? SharedMemoryABI::ShmemMode::kDefault
-                            : SharedMemoryABI::ShmemMode::kShmemEmulation;
+      auto shmem_mode = GetShmemMode(client_identity, in_process);
       endpoint->SetupSharedMemory(std::move(shm), page_size,
                                   /*provided_by_producer=*/true, shmem_mode);
     } else {
@@ -64030,10 +67189,24 @@ void TracingServiceImpl::DisconnectProducer(ProducerID id) {
   PERFETTO_DLOG("Producer %" PRIu16 " disconnected", id);
   PERFETTO_DCHECK(producers_.count(id));
 
-  // Scrape remaining chunks for this producer to ensure we don't lose data.
   if (auto* producer = GetProducer(id)) {
-    for (auto& session_id_and_session : tracing_sessions_)
+    // Scrape remaining chunks for this producer to ensure we don't lose data.
+    for (auto& session_id_and_session : tracing_sessions_) {
       ScrapeSharedMemoryBuffers(&session_id_and_session.second, producer);
+    }
+
+    // Fire a disconnect trigger so pre-configured sessions can capture
+    // diagnostics when the host traced_probes crashes. Skip producers
+    // relayed from another machine (e.g. a VM): they share the same
+    // producer name but their disconnects are expected on VM teardown.
+    if constexpr (PERFETTO_FLAGS(
+                      TRIGGER_PERFETTO_ON_TRACED_PROBES_DISCONNECT)) {
+      if (producer->name_ == "perfetto.traced_probes" &&
+          producer->client_identity().machine_id() == kDefaultMachineID) {
+        PERFETTO_ELOG("traced_probes disconnected, firing disconnect trigger");
+        ActivateTriggers(id, {"perfetto.traced_probes.disconnect"});
+      }
+    }
   }
 
   for (auto it = data_sources_.begin(); it != data_sources_.end();) {
@@ -64576,55 +67749,14 @@ base::Status TracingServiceImpl::EnableTracing(ConsumerEndpointImpl* consumer,
   // unfiltered.
   std::unique_ptr<protozero::MessageFilter> trace_filter;
   if (cfg.has_trace_filter()) {
-    const auto& filt = cfg.trace_filter();
     trace_filter.reset(new protozero::MessageFilter());
 
-    protozero::StringFilter& string_filter = trace_filter->string_filter();
-    auto add_rule = [&](const auto& rule) -> base::Status {
-      auto policy = ConvertPolicy(rule.policy());
-      if (!policy.has_value()) {
-        MaybeLogUploadEvent(
-            cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidFilter);
-        return PERFETTO_SVC_ERR(
-            "Trace filter has invalid string filtering rules, aborting");
-      }
-      auto semantic_type = ConvertSemanticTypeMask(rule);
-      if (!semantic_type.has_value()) {
-        MaybeLogUploadEvent(
-            cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidFilter);
-        return PERFETTO_SVC_ERR(
-            "Trace filter has invalid semantic types in string filtering "
-            "rules, aborting");
-      }
-      string_filter.AddRule(*policy, rule.regex_pattern(),
-                            rule.atrace_payload_starts_with(), rule.name(),
-                            *semantic_type);
-      return base::OkStatus();
-    };
-
-    // Load base string filter chain.
-    for (const auto& rule : filt.string_filter_chain().rules()) {
-      auto status = add_rule(rule);
-      if (!status.ok())
-        return status;
-    }
-
-    // Load v54 string filter chain. Rules with matching names will replace
-    // existing rules; others will be appended.
-    for (const auto& rule : filt.string_filter_chain_v54().rules()) {
-      auto status = add_rule(rule);
-      if (!status.ok())
-        return status;
-    }
-
-    const std::string& bytecode_v1 = filt.bytecode();
-    const std::string& bytecode_v2 = filt.bytecode_v2();
-    const std::string& bytecode =
-        bytecode_v2.empty() ? bytecode_v1 : bytecode_v2;
-    if (!trace_filter->LoadFilterBytecode(bytecode.data(), bytecode.size())) {
+    auto filter_status = protozero::LoadMessageFilterConfig(cfg.trace_filter(),
+                                                            trace_filter.get());
+    if (!filter_status.ok()) {
       MaybeLogUploadEvent(
           cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidFilter);
-      return PERFETTO_SVC_ERR("Trace filter bytecode invalid, aborting");
+      return PERFETTO_SVC_ERR("%s", filter_status.c_message());
     }
 
     // The filter is created using perfetto.protos.Trace as root message
@@ -65500,11 +68632,11 @@ void TracingServiceImpl::ActivateTriggers(
       // If this trigger requires a certain producer to have sent it
       // (non-empty producer_name()) ensure the producer who sent this trigger
       // matches.
-      if (!iter->producer_name_regex().empty() &&
-          !std::regex_match(
-              producer->name_,
-              std::regex(iter->producer_name_regex(), std::regex::extended))) {
-        continue;
+      if (!iter->producer_name_regex().empty()) {
+        auto re = base::Regex::CreateOrCheck(iter->producer_name_regex());
+        if (!re.FullMatch(producer->name_)) {
+          continue;
+        }
       }
 
       // Use a random number between 0 and 1 to check if we should allow this
@@ -66281,7 +69413,10 @@ std::vector<TracePacket> TracingServiceImpl::ReadBuffers(
   }
   if (!tracing_session->did_emit_initial_packets) {
     EmitUuid(tracing_session, &packets);
-    EmitExtensionDescriptors(tracing_session, &packets);
+    if (!tracing_session->config.builtin_data_sources()
+             .disable_extension_descriptors()) {
+      EmitExtensionDescriptors(tracing_session, &packets);
+    }
     EmitTraceProvenance(tracing_session, &packets);
     if (!tracing_session->config.builtin_data_sources().disable_system_info()) {
       EmitSystemInfo(&packets);
@@ -66329,7 +69464,7 @@ std::vector<TracePacket> TracingServiceImpl::ReadBuffers(
     while (!did_hit_threshold) {
       TracePacket packet;
       TraceBuffer::PacketSequenceProperties sequence_properties{};
-      bool previous_packet_dropped;
+      uint32_t previous_packet_dropped;
       if (!tbuf.ReadNextTracePacket(&packet, &sequence_properties,
                                     &previous_packet_dropped)) {
         break;
@@ -67061,9 +70196,7 @@ DataSourceInstance* TracingServiceImpl::SetupDataSource(
     // physical memory.
     auto shared_memory = shm_factory_->CreateSharedMemory(shm_size);
     auto shmem_mode =
-        producer->client_identity().machine_id() == kDefaultMachineID
-            ? SharedMemoryABI::ShmemMode::kDefault
-            : SharedMemoryABI::ShmemMode::kShmemEmulation;
+        GetShmemMode(producer->client_identity(), producer->in_process_);
     producer->SetupSharedMemory(std::move(shared_memory), page_size,
                                 /*provided_by_producer=*/false, shmem_mode);
   }
@@ -68573,6 +71706,220 @@ bool TracingSession::AllDataSourceInstancesStopped() {
 }
 
 }  // namespace perfetto::tracing_service
+// gen_amalgamated begin source: src/tracing/service/zlib_compressor.cc
+// gen_amalgamated begin header: src/tracing/service/zlib_compressor.h
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
+#define SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
+
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+// gen_amalgamated expanded: #include "perfetto/ext/tracing/core/trace_packet.h"
+
+namespace perfetto {
+
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+// Matches TracingServiceImpl::kMaxTracePacketSliceSize. Exposed for testing.
+static constexpr size_t kZlibCompressSliceSize = 128 * 1024 - 512;
+
+void ZlibCompressFn(std::vector<TracePacket>*);
+#endif
+
+}  // namespace perfetto
+
+#endif  // SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "src/tracing/service/zlib_compressor.h"
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+
+// File compiles to nothing when the buildflag is off (e.g. SDK opt-out).
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+
+#include <zlib.h>
+
+// gen_amalgamated expanded: #include "protos/perfetto/trace/trace.pbzero.h"
+// gen_amalgamated expanded: #include "protos/perfetto/trace/trace_packet.pbzero.h"
+
+namespace perfetto {
+
+namespace {
+
+struct Preamble {
+  uint32_t size;
+  std::array<uint8_t, 16> buf;
+};
+
+template <uint32_t id>
+Preamble GetPreamble(size_t sz) {
+  Preamble preamble;
+  uint8_t* ptr = preamble.buf.data();
+  constexpr uint32_t tag = protozero::proto_utils::MakeTagLengthDelimited(id);
+  ptr = protozero::proto_utils::WriteVarInt(tag, ptr);
+  ptr = protozero::proto_utils::WriteVarInt(sz, ptr);
+  preamble.size =
+      static_cast<uint32_t>(reinterpret_cast<uintptr_t>(ptr) -
+                            reinterpret_cast<uintptr_t>(preamble.buf.data()));
+  PERFETTO_DCHECK(preamble.size < preamble.buf.size());
+  return preamble;
+}
+
+Slice PreambleToSlice(const Preamble& preamble) {
+  Slice slice = Slice::Allocate(preamble.size);
+  memcpy(slice.own_data(), preamble.buf.data(), preamble.size);
+  return slice;
+}
+
+// A compressor for `TracePacket`s that uses zlib. The class is exposed for
+// testing.
+class ZlibPacketCompressor {
+ public:
+  ZlibPacketCompressor();
+  ~ZlibPacketCompressor();
+
+  // Can be called multiple times, before Finish() is called.
+  void PushPacket(const TracePacket& packet);
+
+  // Returned the compressed data. Can be called at most once. After this call,
+  // the object is unusable (PushPacket should not be called) and must be
+  // destroyed.
+  TracePacket Finish();
+
+ private:
+  void PushData(const void* data, uint32_t size);
+  void NewOutputSlice();
+  void PushCurSlice();
+
+  z_stream stream_;
+  size_t total_new_slices_size_ = 0;
+  std::vector<Slice> new_slices_;
+  std::unique_ptr<uint8_t[]> cur_slice_;
+};
+
+ZlibPacketCompressor::ZlibPacketCompressor() {
+  memset(&stream_, 0, sizeof(stream_));
+  int status = deflateInit(&stream_, 6);
+  PERFETTO_CHECK(status == Z_OK);
+}
+
+ZlibPacketCompressor::~ZlibPacketCompressor() {
+  int status = deflateEnd(&stream_);
+  PERFETTO_CHECK(status == Z_OK);
+}
+
+void ZlibPacketCompressor::PushPacket(const TracePacket& packet) {
+  // We need to be able to tokenize packets in the compressed stream, so we
+  // prefix a proto preamble to each packet. The compressed stream looks like a
+  // valid Trace proto.
+  Preamble preamble =
+      GetPreamble<protos::pbzero::Trace::kPacketFieldNumber>(packet.size());
+  PushData(preamble.buf.data(), preamble.size);
+  for (const Slice& slice : packet.slices()) {
+    PushData(slice.start, static_cast<uint32_t>(slice.size));
+  }
+}
+
+void ZlibPacketCompressor::PushData(const void* data, uint32_t size) {
+  stream_.next_in = const_cast<Bytef*>(static_cast<const Bytef*>(data));
+  stream_.avail_in = static_cast<uInt>(size);
+  while (stream_.avail_in != 0) {
+    if (stream_.avail_out == 0) {
+      NewOutputSlice();
+    }
+    int status = deflate(&stream_, Z_NO_FLUSH);
+    PERFETTO_CHECK(status == Z_OK);
+  }
+}
+
+TracePacket ZlibPacketCompressor::Finish() {
+  for (;;) {
+    int status = deflate(&stream_, Z_FINISH);
+    if (status == Z_STREAM_END)
+      break;
+    PERFETTO_CHECK(status == Z_OK || status == Z_BUF_ERROR);
+    NewOutputSlice();
+  }
+
+  PushCurSlice();
+
+  TracePacket packet;
+  packet.AddSlice(PreambleToSlice(
+      GetPreamble<protos::pbzero::TracePacket::kCompressedPacketsFieldNumber>(
+          total_new_slices_size_)));
+  for (auto& slice : new_slices_) {
+    packet.AddSlice(std::move(slice));
+  }
+  return packet;
+}
+
+void ZlibPacketCompressor::NewOutputSlice() {
+  PushCurSlice();
+  cur_slice_ = std::make_unique<uint8_t[]>(kZlibCompressSliceSize);
+  stream_.next_out = reinterpret_cast<Bytef*>(cur_slice_.get());
+  stream_.avail_out = kZlibCompressSliceSize;
+}
+
+void ZlibPacketCompressor::PushCurSlice() {
+  if (cur_slice_) {
+    total_new_slices_size_ += kZlibCompressSliceSize - stream_.avail_out;
+    new_slices_.push_back(Slice::TakeOwnership(
+        std::move(cur_slice_), kZlibCompressSliceSize - stream_.avail_out));
+  }
+}
+
+}  // namespace
+
+void ZlibCompressFn(std::vector<TracePacket>* packets) {
+  if (packets->empty()) {
+    return;
+  }
+
+  ZlibPacketCompressor stream;
+
+  for (const TracePacket& packet : *packets) {
+    stream.PushPacket(packet);
+  }
+
+  TracePacket packet = stream.Finish();
+
+  packets->clear();
+  packets->push_back(std::move(packet));
+}
+
+}  // namespace perfetto
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
 // gen_amalgamated begin source: src/tracing/internal/in_process_tracing_backend.cc
 /*
  * Copyright (C) 2019 The Android Open Source Project
@@ -68601,6 +71948,10 @@ bool TracingSession::AllDataSourceInstancesStopped() {
 
 // gen_amalgamated expanded: #include "src/tracing/core/in_process_shared_memory.h"
 
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+// gen_amalgamated expanded: #include "src/tracing/service/zlib_compressor.h"
+#endif
+
 // TODO(primiano): When the in-process backend is used, we should never end up
 // in a situation where the thread where the TracingService and Producer live
 // writes a packet and hence can get into the GetNewChunk() stall.
@@ -68626,7 +71977,8 @@ std::unique_ptr<ProducerEndpoint> InProcessTracingBackend::ConnectProducer(
     const ConnectProducerArgs& args) {
   PERFETTO_DCHECK(args.task_runner->RunsTasksOnCurrentThread());
   return GetOrCreateService(args.task_runner)
-      ->ConnectProducer(args.producer, ClientIdentity(/*uid=*/0, /*pid=*/0),
+      ->ConnectProducer(args.producer,
+                        ClientIdentity(/*uid=*/0, /*pid=*/0, args.machine_id),
                         args.producer_name, args.shmem_size_hint_bytes,
                         /*in_process=*/true,
                         TracingService::ProducerSMBScrapingMode::kEnabled,
@@ -68644,7 +71996,16 @@ TracingService* InProcessTracingBackend::GetOrCreateService(
   if (!service_) {
     std::unique_ptr<InProcessSharedMemory::Factory> shm(
         new InProcessSharedMemory::Factory());
-    service_ = TracingService::CreateInstance(std::move(shm), task_runner);
+    TracingService::InitOpts init_opts = {};
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+    // Wire the zlib compressor so TraceConfig.compression_type =
+    // COMPRESSION_TYPE_DEFLATE takes effect on the in-process backend's
+    // service, mirroring what src/traced/service/service.cc does for the
+    // system backend.
+    init_opts.compressor_fn = &ZlibCompressFn;
+#endif
+    service_ =
+        TracingService::CreateInstance(std::move(shm), task_runner, init_opts);
     service_->SetSMBScrapingEnabled(true);
   }
   return service_.get();
@@ -68668,6 +72029,7 @@ TracingService* InProcessTracingBackend::GetOrCreateService(
 // gen_amalgamated expanded: #include "protos/perfetto/config/priority_boost/priority_boost_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/data_source_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/qnx/qnx_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/linux/journald_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/chrome/histogram_samples.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/system_info/system_info_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/track_event/track_event_config.gen.h"
@@ -68677,6 +72039,7 @@ TracingService* InProcessTracingBackend::GetOrCreateService(
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/perf_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/perf_events.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/java_hprof_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/profiling/smaps_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/heapprofd_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/process_stats/process_stats_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/statsd/statsd_tracing_config.gen.h"
@@ -68699,8 +72062,8 @@ TracingService* InProcessTracingBackend::GetOrCreateService(
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/user_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_transactions_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_layers_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/display_video_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/protolog_config.gen.h"
-// gen_amalgamated expanded: #include "protos/perfetto/common/protolog_common.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/pixel_modem_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/packages_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/network_trace_config.gen.h"
@@ -68715,6 +72078,7 @@ TracingService* InProcessTracingBackend::GetOrCreateService(
 // gen_amalgamated expanded: #include "protos/perfetto/common/android_log_constants.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/trace_stats.gen.h"
@@ -70515,6 +73879,7 @@ void EnableTracingRequest::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/common/ftrace_descriptor.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/data_source_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/qnx/qnx_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/linux/journald_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/chrome/histogram_samples.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/system_info/system_info_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/track_event/track_event_config.gen.h"
@@ -70524,6 +73889,7 @@ void EnableTracingRequest::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/perf_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/perf_events.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/java_hprof_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/profiling/smaps_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/profiling/heapprofd_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/process_stats/process_stats_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/priority_boost/priority_boost_config.gen.h"
@@ -70547,8 +73913,8 @@ void EnableTracingRequest::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/user_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_transactions_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/surfaceflinger_layers_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/display_video_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/protolog_config.gen.h"
-// gen_amalgamated expanded: #include "protos/perfetto/common/protolog_common.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/pixel_modem_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/packages_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/network_trace_config.gen.h"
@@ -70563,6 +73929,7 @@ void EnableTracingRequest::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/common/android_log_constants.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/commit_data_request.gen.h"
 
 namespace perfetto {
@@ -73708,8 +77075,8 @@ std::unique_ptr<LinuxFileWatch> WatchUnixSocketCreation(
 
 #include <sys/socket.h>
 
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_QNX)
-// Requires the QNX Advanced Virtualization Framework
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_QNX) && __has_include(<vm_sockets.h>)
+// QNX with Advanced Virtualization Framework
 #include <vm_sockets.h>
 #elif defined(AF_VSOCK)
 // Use system vm_socket.h if available.
@@ -73980,11 +77347,13 @@ SockaddrAny MakeSockAddr(SockFamily family, const std::string& socket_name) {
       addr.svm_cid = *base::StringToUInt32(parts[0]);
       addr.svm_port = *base::StringToUInt32(parts[1]);
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID)
+#if defined(VMADDR_FLAG_TO_HOST)
       if (IsVirtualized()) {
         // VM-to-VM VSOCK communication requires messages to be
         // routed through the host.
         addr.svm_flags = VMADDR_FLAG_TO_HOST;
       }
+#endif
 #endif
       SockaddrAny res(&addr, sizeof(addr));
       return res;
@@ -82334,6 +85703,11 @@ struct ListenEndpoint {
   std::string sock_name;
   base::ScopedSocketHandle sock_handle;
   std::unique_ptr<ipc::Host> ipc_host;
+
+  // If true, the RelayPort IPC service is also exposed on this endpoint.
+  // Should only be set on endpoints reserved for cross-machine peers (e.g.
+  // vsock, TCP), not on local sockets shared with unprivileged producers.
+  bool expose_relay_endpoint = false;
 };
 
 // Creates an instance of the service (business logic + UNIX socket transport).
@@ -82444,7 +85818,13 @@ class ServiceIPCHostImpl : public ServiceIPCHost {
   // Note that there can be multiple producer sockets if it's specified in the
   // producer socket name (e.g. for listening both on vsock for VMs and AF_UNIX
   // for processes on the same machine).
-  std::vector<std::unique_ptr<ipc::Host>> producer_ipc_ports_;
+  // The `expose_relay_endpoint` bit gates whether the RelayIPCService is
+  // exposed on that specific port (see ListenEndpoint).
+  struct ProducerIPCPort {
+    std::unique_ptr<ipc::Host> host;
+    bool expose_relay_endpoint = false;
+  };
+  std::vector<ProducerIPCPort> producer_ipc_ports_;
 
   // As above, but for the Consumer port.
   std::unique_ptr<ipc::Host> consumer_ipc_port_;
@@ -82532,8 +85912,9 @@ bool ServiceIPCHostImpl::Start(std::list<ListenEndpoint> producer_sockets,
 
   // Initialize the IPC transport.
   for (auto& sock : producer_sockets) {
-    producer_ipc_ports_.emplace_back(
-        CreateIpcHost(task_runner_, std::move(sock)));
+    bool expose_relay = sock.expose_relay_endpoint;
+    producer_ipc_ports_.push_back(
+        {CreateIpcHost(task_runner_, std::move(sock)), expose_relay});
   }
   consumer_ipc_port_ = CreateIpcHost(task_runner_, std::move(consumer_socket));
 
@@ -82553,10 +85934,9 @@ bool ServiceIPCHostImpl::DoStart() {
                                         init_opts_);
 
   if (producer_ipc_ports_.empty() || !consumer_ipc_port_ ||
-      std::any_of(producer_ipc_ports_.begin(), producer_ipc_ports_.end(),
-                  [](const std::unique_ptr<ipc::Host>& port) {
-                    return port == nullptr;
-                  })) {
+      std::any_of(
+          producer_ipc_ports_.begin(), producer_ipc_ports_.end(),
+          [](const ProducerIPCPort& port) { return port.host == nullptr; })) {
     Shutdown();
     return false;
   }
@@ -82570,20 +85950,20 @@ bool ServiceIPCHostImpl::DoStart() {
   // consumer port ipcs might exhaust the send buffer under normal operation
   // due to large messages such as ReadBuffersResponse.
   for (auto& producer_ipc_port : producer_ipc_ports_)
-    producer_ipc_port->SetSocketSendTimeoutMs(kProducerSocketTxTimeoutMs);
+    producer_ipc_port.host->SetSocketSendTimeoutMs(kProducerSocketTxTimeoutMs);
 
   // TODO(fmayer): add a test that destroys the ServiceIPCHostImpl soon after
   // Start() and checks that no spurious callbacks are issued.
   for (auto& producer_ipc_port : producer_ipc_ports_) {
-    bool producer_service_exposed = producer_ipc_port->ExposeService(
+    bool producer_service_exposed = producer_ipc_port.host->ExposeService(
         std::unique_ptr<ipc::Service>(new ProducerIPCService(svc_.get())));
     PERFETTO_CHECK(producer_service_exposed);
 
-    if (!init_opts_.enable_relay_endpoint)
+    // Optionally also expose the RelayPort service on this port, when the
+    // caller has explicitly opted in for cross-machine relay traffic.
+    if (!producer_ipc_port.expose_relay_endpoint)
       continue;
-    // Expose a secondary service for sync with remote relay service
-    // if requested.
-    bool relay_service_exposed = producer_ipc_port->ExposeService(
+    bool relay_service_exposed = producer_ipc_port.host->ExposeService(
         std::unique_ptr<ipc::Service>(new RelayIPCService(svc_.get())));
     PERFETTO_CHECK(relay_service_exposed);
   }
diff --git a/deps/perfetto/sdk/perfetto.h b/deps/perfetto/sdk/perfetto.h
index 46a9d51a835a..e439c2084e3b 100644
--- a/deps/perfetto/sdk/perfetto.h
+++ b/deps/perfetto/sdk/perfetto.h
@@ -63,7 +63,7 @@
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TP_HTTPD() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TP_INSTRUMENTS() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_LOCAL_SYMBOLIZER() (0)
-#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() (0)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() (1)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TRACED_PERF() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_HEAPPROFD() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_STDERR_CRASH_DUMP() (0)
@@ -75,6 +75,9 @@
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ENABLE_RT_MUTEX() (1)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ENABLE_LOCKFREE_TASKRUNNER() (1)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ENABLE_SOCK_INOTIFY() (1)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_RE2() (1)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_PCRE2() (0)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_AMALGAMATED_SDK() (1)
 
 struct PerfettoBuildFlag {
   const char* name;
@@ -112,6 +115,9 @@ static const struct PerfettoBuildFlag kPerfettoBuildFlags[] = {
     {"PERFETTO_ENABLE_RT_MUTEX", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ENABLE_RT_MUTEX()},
     {"PERFETTO_ENABLE_LOCKFREE_TASKRUNNER", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ENABLE_LOCKFREE_TASKRUNNER()},
     {"PERFETTO_ENABLE_SOCK_INOTIFY", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ENABLE_SOCK_INOTIFY()},
+    {"PERFETTO_RE2", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_RE2()},
+    {"PERFETTO_PCRE2", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_PCRE2()},
+    {"PERFETTO_AMALGAMATED_SDK", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_AMALGAMATED_SDK()},
 };
 
 static const int kPerfettoBuildFlagsCount = sizeof(kPerfettoBuildFlags) / sizeof(struct PerfettoBuildFlag);
@@ -346,6 +352,45 @@ static const int kPerfettoBuildFlagsCount = sizeof(kPerfettoBuildFlags) / sizeof
 //   added to the amalgamated headers.
 // gen_amalgamated expanded: #include "perfetto_build_flags.h"  // no-include-violation-check
 
+// In the amalgamated SDK, optional features (zlib, re2) are opt-in. The
+// consumer drops a header named "perfetto_sdk_config.h" somewhere on their
+// include path; inside it they `#define PERFETTO_SDK_ENABLE_ZLIB 1` /
+// `#define PERFETTO_SDK_ENABLE_RE2 1` to opt in. Setting the macro to 0 (or
+// omitting the file entirely) keeps the feature off.
+#if PERFETTO_BUILDFLAG(PERFETTO_AMALGAMATED_SDK)
+
+#if defined(__has_include)
+#if __has_include("perfetto_sdk_config.h")
+#include "perfetto_sdk_config.h"  // no-include-violation-check gen_amalgamated:keep
+#endif
+#endif
+
+#undef PERFETTO_BUILDFLAG_DEFINE_PERFETTO_RE2
+#if defined(PERFETTO_SDK_ENABLE_RE2) && (PERFETTO_SDK_ENABLE_RE2 == 1)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_RE2() 1
+#else
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_RE2() 0
+#endif
+
+#undef PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB
+#if defined(PERFETTO_SDK_ENABLE_ZLIB) && (PERFETTO_SDK_ENABLE_ZLIB == 1)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() 1
+#else
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() 0
+#endif
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_AMALGAMATED_SDK)
+
+// Unlike PERFETTO_SDK_ENABLE_ZLIB above (amalgamated SDK opt-in), this is a
+// file-scope opt-out that applies to every build. Define it to compile out the
+// optional zlib compressor. Static libs like libperfetto_client_experimental
+// get linked into many binaries, so keeping the compressor out means those
+// binaries don't have to link libz. See tools/gen_android_bp.
+#if defined(PERFETTO_FORCE_DISABLE_ZLIB)
+#undef PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() 0
+#endif
+
 #endif  // INCLUDE_PERFETTO_BASE_BUILD_CONFIG_H_
 // gen_amalgamated begin header: include/perfetto/base/logging.h
 // gen_amalgamated begin header: include/perfetto/base/compiler.h
@@ -1008,6 +1053,7 @@ void InitializeTime();
 
 TimeNanos GetWallTimeNs();
 TimeNanos GetThreadCPUTimeNs();
+TimeNanos GetProcessCPUTimeNs();
 inline TimeNanos GetWallTimeRawNs() {
   return GetWallTimeNs();
 }
@@ -1085,12 +1131,51 @@ inline TimeNanos GetThreadCPUTimeNs() {
                    info.system_time.seconds * 1000000000LL +
                    info.system_time.microseconds * 1000LL);
 }
+
+inline TimeNanos GetProcessCPUTimeNs() {
+  // task_basic_info gives CPU time accumulated by terminated threads only.
+  // task_thread_times_info gives CPU time of currently-live threads. The sum
+  // of the two is the equivalent of CLOCK_PROCESS_CPUTIME_ID.
+  task_basic_info_data_t past_threads{};
+  mach_msg_type_number_t basic_count = TASK_BASIC_INFO_COUNT;
+  kern_return_t kr =
+      task_info(mach_task_self(), TASK_BASIC_INFO,
+                reinterpret_cast<task_info_t>(&past_threads), &basic_count);
+  if (kr != KERN_SUCCESS) {
+    PERFETTO_DFATAL("Failed to get process CPU time (basic).");
+    return TimeNanos(0);
+  }
+
+  task_thread_times_info_data_t cur_threads{};
+  mach_msg_type_number_t times_count = TASK_THREAD_TIMES_INFO_COUNT;
+  kr = task_info(mach_task_self(), TASK_THREAD_TIMES_INFO,
+                 reinterpret_cast<task_info_t>(&cur_threads), &times_count);
+  if (kr != KERN_SUCCESS) {
+    PERFETTO_DFATAL("Failed to get process CPU time (thread times).");
+    return TimeNanos(0);
+  }
+
+  return TimeNanos(past_threads.user_time.seconds * 1000000000LL +
+                   past_threads.user_time.microseconds * 1000LL +
+                   past_threads.system_time.seconds * 1000000000LL +
+                   past_threads.system_time.microseconds * 1000LL +
+                   cur_threads.user_time.seconds * 1000000000LL +
+                   cur_threads.user_time.microseconds * 1000LL +
+                   cur_threads.system_time.seconds * 1000000000LL +
+                   cur_threads.system_time.microseconds * 1000LL);
+}
 #else
 inline TimeNanos GetThreadCPUTimeNs() {
   struct timespec ts = {};
   PERFETTO_CHECK(clock_gettime(CLOCK_THREAD_CPUTIME_ID, &ts) == 0);
   return FromPosixTimespec(ts);
 }
+
+inline TimeNanos GetProcessCPUTimeNs() {
+  struct timespec ts = {};
+  PERFETTO_CHECK(clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &ts) == 0);
+  return FromPosixTimespec(ts);
+}
 #endif
 
 #elif PERFETTO_BUILDFLAG(PERFETTO_OS_WASM)
@@ -1107,6 +1192,10 @@ inline TimeNanos GetThreadCPUTimeNs() {
   return TimeNanos(0);
 }
 
+inline TimeNanos GetProcessCPUTimeNs() {
+  return TimeNanos(0);
+}
+
 // TODO: Clock that counts time during suspend is not implemented on WASM.
 inline TimeNanos GetBootTimeNs() {
   return GetWallTimeNs();
@@ -1130,6 +1219,10 @@ inline TimeNanos GetThreadCPUTimeNs() {
   return TimeNanos(0);
 }
 
+inline TimeNanos GetProcessCPUTimeNs() {
+  return TimeNanos(0);
+}
+
 inline TimeNanos GetBootTimeNs() {
   return TimeNanos(0);
 }
@@ -1156,6 +1249,10 @@ inline TimeNanos GetThreadCPUTimeNs() {
   return GetTimeInternalNs(CLOCK_THREAD_CPUTIME_ID);
 }
 
+inline TimeNanos GetProcessCPUTimeNs() {
+  return GetTimeInternalNs(CLOCK_PROCESS_CPUTIME_ID);
+}
+
 // TODO: Clock that counts time during suspend is not implemented on QNX.
 inline TimeNanos GetBootTimeNs() {
   return GetWallTimeNs();
@@ -1201,6 +1298,10 @@ inline TimeNanos GetWallTimeRawNs() {
 inline TimeNanos GetThreadCPUTimeNs() {
   return GetTimeInternalNs(CLOCK_THREAD_CPUTIME_ID);
 }
+
+inline TimeNanos GetProcessCPUTimeNs() {
+  return GetTimeInternalNs(CLOCK_PROCESS_CPUTIME_ID);
+}
 #endif
 
 inline TimeSeconds GetBootTimeS() {
@@ -1581,6 +1682,7 @@ static inline uint32_t PerfettoPbFloatToFixed32(float value) {
 #include <type_traits>
 
 // gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/public/compiler.h"
 // gen_amalgamated expanded: #include "perfetto/public/pb_utils.h"
 
 // Helper macro for the constexpr functions containing
@@ -1675,6 +1777,42 @@ inline const char* ProtoSchemaToString(ProtoSchemaType v) {
   return "";
 }
 
+// Returns the wire type used on the wire to encode a field of the given
+// schema type. This is the single source of truth for the proto-type ->
+// wire-type grouping. kGroup is a deprecated proto2-only feature that
+// protozero does not support and that ProtoWireType cannot represent; it,
+// like kUnknown, maps to kLengthDelimited as a safe opaque default.
+inline ProtoWireType ProtoSchemaToWireType(ProtoSchemaType v) {
+  switch (v) {
+    case ProtoSchemaType::kInt32:
+    case ProtoSchemaType::kInt64:
+    case ProtoSchemaType::kUint32:
+    case ProtoSchemaType::kUint64:
+    case ProtoSchemaType::kBool:
+    case ProtoSchemaType::kEnum:
+    case ProtoSchemaType::kSint32:
+    case ProtoSchemaType::kSint64:
+      return ProtoWireType::kVarInt;
+    case ProtoSchemaType::kDouble:
+    case ProtoSchemaType::kFixed64:
+    case ProtoSchemaType::kSfixed64:
+      return ProtoWireType::kFixed64;
+    case ProtoSchemaType::kFloat:
+    case ProtoSchemaType::kFixed32:
+    case ProtoSchemaType::kSfixed32:
+      return ProtoWireType::kFixed32;
+    case ProtoSchemaType::kString:
+    case ProtoSchemaType::kBytes:
+    case ProtoSchemaType::kMessage:
+    case ProtoSchemaType::kGroup:
+    case ProtoSchemaType::kUnknown:
+      return ProtoWireType::kLengthDelimited;
+  }
+  // For gcc:
+  PERFETTO_DCHECK(false);
+  return ProtoWireType::kLengthDelimited;
+}
+
 // Maximum message size supported: 256 MiB (4 x 7-bit due to varint encoding).
 constexpr size_t kMessageLengthFieldSize = 4;
 constexpr size_t kMaxMessageLength = (1u << (kMessageLengthFieldSize * 7)) - 1;
@@ -1831,6 +1969,58 @@ inline const uint8_t* ParseVarInt(const uint8_t* start,
   return PerfettoPbParseVarInt(start, end, out_value);
 }
 
+// Unrolled multi-byte varint decode. Avoids the per-byte bounds-check + loop
+// branch of ParseVarInt, which matters for long varints (e.g. ftrace
+// timestamps are 8-10 bytes). The caller must guarantee at least 10 readable
+// bytes at |p| and that p[0] has the continuation bit set. Returns nullptr on
+// an overlong (> 10 byte) varint. The 10th byte contributes only its low bit
+// (matching ParseVarInt).
+PERFETTO_ALWAYS_INLINE inline const uint8_t* ParseVarIntUnrolled(
+    const uint8_t* p,
+    uint64_t* out) {
+  uint64_t value = p[0] & 0x7Fu;
+  const uint8_t* res = nullptr;
+  // One decode step for byte |i|: accumulates the payload bits and, if the
+  // continuation bit is clear, finishes the decode. Returns true while more
+  // bytes are needed, so the chain below stops at the terminating byte.
+  auto step = [&](uint64_t i) PERFETTO_ALWAYS_INLINE {
+    value |= static_cast<uint64_t>(p[i] & 0x7Fu) << (7 * i);
+    if (PERFETTO_LIKELY(!(p[i] & 0x80))) {
+      *out = value;
+      res = p + i + 1;
+      return false;
+    }
+    return true;
+  };
+  if (step(1) && step(2) && step(3) && step(4) && step(5) && step(6) &&
+      step(7) && step(8) && step(9)) {
+    return nullptr;  // Overlong (> 10 byte) varint.
+  }
+  return res;
+}
+
+// Decodes a varint at |pos|: single-byte fastpath, then the unrolled decode
+// when there is enough headroom, then the bounded byte-loop near the end of the
+// buffer. Returns nullptr on a truncated/overlong varint (note: unlike
+// ParseVarInt, which returns |pos| on failure).
+//
+// Prefer ParseVarInt() in non-hot code. This is force-inlined and expands the
+// unrolled decoder at every call site (~415 vs ~80 bytes for a ParseVarInt call
+// in our measurements), so widespread use bloats the binary. Use it only inside
+// perf-critical decode loops.
+PERFETTO_ALWAYS_INLINE inline const uint8_t* ParseVarIntFast(const uint8_t* pos,
+                                                             const uint8_t* end,
+                                                             uint64_t* out) {
+  if (PERFETTO_LIKELY(pos < end && *pos < 0x80)) {
+    *out = *pos;
+    return pos + 1;
+  }
+  if (PERFETTO_LIKELY(end - pos >= 10))
+    return ParseVarIntUnrolled(pos, out);
+  const uint8_t* next = ParseVarInt(pos, end, out);
+  return next == pos ? nullptr : next;
+}
+
 enum class RepetitionType {
   kNotRepeated,
   kRepeatedPacked,
@@ -2023,6 +2213,7 @@ class Field {
   }
 
   uint64_t raw_int_value() const { return int_value_; }
+  uint32_t raw_size() const { return size_; }
 
   void initialize(uint32_t id,
                   uint8_t type,
@@ -2477,6 +2668,9 @@ class PERFETTO_EXPORT_COMPONENT DataSourceConfig : public ::protozero::CppMessag
     kCpuPerUidConfigFieldNumber = 137,
     kUserListConfigFieldNumber = 138,
     kInputmethodConfigFieldNumber = 139,
+    kAndroidAflagsConfigFieldNumber = 140,
+    kJournaldConfigFieldNumber = 141,
+    kDisplayVideoConfigFieldNumber = 142,
     kQnxConfigFieldNumber = 150,
     kLegacyConfigFieldNumber = 1000,
     kForTestingFieldNumber = 1001,
@@ -2664,6 +2858,15 @@ class PERFETTO_EXPORT_COMPONENT DataSourceConfig : public ::protozero::CppMessag
   const std::string& inputmethod_config_raw() const { return inputmethod_config_; }
   void set_inputmethod_config_raw(const std::string& raw) { inputmethod_config_ = raw; _has_field_.set(139); }
 
+  const std::string& android_aflags_config_raw() const { return android_aflags_config_; }
+  void set_android_aflags_config_raw(const std::string& raw) { android_aflags_config_ = raw; _has_field_.set(140); }
+
+  const std::string& journald_config_raw() const { return journald_config_; }
+  void set_journald_config_raw(const std::string& raw) { journald_config_ = raw; _has_field_.set(141); }
+
+  const std::string& display_video_config_raw() const { return display_video_config_; }
+  void set_display_video_config_raw(const std::string& raw) { display_video_config_ = raw; _has_field_.set(142); }
+
   const std::string& qnx_config_raw() const { return qnx_config_; }
   void set_qnx_config_raw(const std::string& raw) { qnx_config_ = raw; _has_field_.set(150); }
 
@@ -2727,6 +2930,9 @@ class PERFETTO_EXPORT_COMPONENT DataSourceConfig : public ::protozero::CppMessag
   std::string cpu_per_uid_config_;  // [lazy=true]
   std::string user_list_config_;  // [lazy=true]
   std::string inputmethod_config_;  // [lazy=true]
+  std::string android_aflags_config_;  // [lazy=true]
+  std::string journald_config_;  // [lazy=true]
+  std::string display_video_config_;  // [lazy=true]
   std::string qnx_config_;  // [lazy=true]
   std::string legacy_config_{};
   ::protozero::CopyablePtr<TestConfig> for_testing_;
@@ -4458,6 +4664,7 @@ class PackedFixedSizeInt : public PackedBufferBase {
 #include <cstdint>
 #include <cstring>
 #include <memory>
+#include <new>
 #include <string>
 #include <type_traits>
 #include <variant>
@@ -4753,6 +4960,48 @@ class UnifiedRepeatedFieldIterator {
   VariantType iter_;
 };
 
+// Allowlist for selective decoding, built at compile time from the field ids
+// given as template arguments and sized automatically to the highest of them.
+// The mask does not need to match the decoder's MAX_FIELD_ID: the selective
+// constructor caps the decoder's dense window at |kMaxFieldId|, so ids above
+// it simply spill and the mask is never read beyond its end.
+// Usage:
+//   static constexpr SelectiveDecodeMask<TracePacket::kTimestampFieldNumber,
+//                                        TracePacket::kInternedDataFieldNumber>
+//       kMask{};
+//   SelectiveTypedProtoDecoder<MAX_FIELD_ID> decoder(data, size, kMask);
+//   for (const Field& f : decoder.unknown_fields()) { ... }
+template <uint32_t... kFieldIds>
+class SelectiveDecodeMask {
+ public:
+  static_assert(sizeof...(kFieldIds) > 0, "Empty field id list");
+  static constexpr uint32_t kMaxFieldId = std::max({kFieldIds...});
+
+  constexpr SelectiveDecodeMask() {
+    for (uint32_t id : {kFieldIds...})
+      words_[id / 64] |= uint64_t(1) << (id % 64);
+  }
+  const uint64_t* data() const { return words_; }
+
+  // True if |id| is one of the whitelisted kFieldIds.
+  constexpr bool contains(uint32_t id) const {
+    return id <= kMaxFieldId && ((words_[id / 64] >> (id % 64)) & 1) != 0;
+  }
+
+ private:
+  uint64_t words_[kMaxFieldId / 64 + 1]{};
+};
+
+// A range of fields spilled by a SelectiveTypedProtoDecoder, in wire order.
+// Repeated fields appear once per occurrence. Returned by
+// SelectiveTypedProtoDecoder::unknown_fields().
+struct UnknownFieldRange {
+  const Field* begin() const { return begin_; }
+  const Field* end() const { return end_; }
+  const Field* begin_;
+  const Field* end_;
+};
+
 // This decoder loads all fields upfront, without recursing in nested messages.
 // It is used as a base class for typed decoders generated by the pbzero plugin.
 // The split between TypedProtoDecoderBase and TypedProtoDecoder<> is to have
@@ -4770,14 +5019,26 @@ class PERFETTO_EXPORT_COMPONENT TypedProtoDecoderBase : public ProtoDecoder {
   // If the field |id| is known at compile time, prefer the templated
   // specialization at<kFieldNumber>().
   const Field& Get(uint32_t id) const {
-    if (PERFETTO_LIKELY(id < num_fields_ && id < size_))
+    if (PERFETTO_LIKELY(id < num_fields_) && HasField(id))
       return fields_[id];
     // If id >= num_fields_, the field id is invalid (was not known in the
-    // .proto) and we return the 0th field, which is always !valid().
-    // If id >= size_ and <= num_fields, the id is valid but the field has not
-    // been seen while decoding (hence the stack storage has not been expanded)
-    // so we return the 0th invalid field.
-    return fields_[0];
+    // .proto). Otherwise the id is valid but the field has not been seen
+    // while decoding. Either way return a shared invalid field: the backing
+    // slot cannot stand in for it because the storage is uninitialized.
+    return kInvalidField;
+  }
+
+  // True if the field with the given id was seen while decoding: tests bit
+  // |id| of the presence bitmap. The caller must check that |id| is within
+  // the bitmap, i.e. <= the decoder's MAX_FIELD_ID. Note that |id| may
+  // exceed |num_fields_|: the selective decoding constructor shrinks
+  // num_fields_ to the mask's extent but clears the full bitmap, so that
+  // at<>() can keep testing the bit directly.
+  bool HasField(uint32_t id) const {
+    constexpr uint32_t kBitsPerWord = sizeof(*presence_) * 8;
+    const uint32_t word_idx = id / kBitsPerWord;
+    const uint32_t bit_off = id % kBitsPerWord;
+    return (presence_[word_idx] & (1ULL << bit_off)) != 0;
   }
 
   // Returns an object that allows to iterate over all instances of a repeated
@@ -4862,13 +5123,19 @@ class PERFETTO_EXPORT_COMPONENT TypedProtoDecoderBase : public ProtoDecoder {
   }
 
  protected:
+  // Returned by Get()/at() for fields that were not seen while decoding.
+  // Always !valid() (id == 0).
+  static const Field kInvalidField;
+
   TypedProtoDecoderBase(Field* storage,
+                        uint64_t* presence,
                         uint32_t num_fields,
                         uint32_t capacity,
                         const uint8_t* buffer,
                         size_t length)
       : ProtoDecoder(buffer, length),
         fields_(storage),
+        presence_(presence),
         num_fields_(num_fields),
         // The reason for "capacity -1" is to avoid hitting the expansion path
         // in TypedProtoDecoderBase::ParseAllFields() when we are just setting
@@ -4876,19 +5143,34 @@ class PERFETTO_EXPORT_COMPONENT TypedProtoDecoderBase : public ProtoDecoder {
         size_(std::min(num_fields, capacity - 1)),
         capacity_(capacity) {
     // The reason why Field needs to be trivially de/constructible is to avoid
-    // implicit initializers on all the ~1000 entries. We need it to initialize
-    // only on the first |max_field_id| fields, the remaining capacity doesn't
-    // require initialization.
+    // implicit initializers on all the ~1000 entries. The field storage is
+    // left uninitialized (reads are gated on HasField()); only the presence
+    // bitmap is cleared.
     static_assert(std::is_trivially_constructible<Field>::value &&
                       std::is_trivially_destructible<Field>::value &&
                       std::is_trivial<Field>::value,
                   "Field must be a trivial aggregate type");
-    memset(fields_, 0, sizeof(Field) * capacity_);
+    memset(presence_, 0, sizeof(uint64_t) * ((num_fields_ + 63) / 64));
     PERFETTO_DCHECK(capacity > 0);
   }
 
+  // Marks the field with the given id as seen: sets bit |id| of the presence
+  // bitmap. |id| must be < num_fields_.
+  void SetField(uint32_t id) { presence_[id / 64] |= 1ULL << (id % 64); }
+
   void ParseAllFields();
 
+  // Selective-decoding flavour, driven by SelectiveTypedProtoDecoder. The
+  // spill arguments are in/out and deliberately arguments rather than
+  // members: as members they would cost an initialization per decoder
+  // construction (decoders are constructed per nested message). |*spill| is
+  // repointed at |*heap_spill| if its capacity is exhausted.
+  void ParseAllFieldsSelective(const uint64_t* dense_mask,
+                               Field** spill,
+                               uint32_t* spill_capacity,
+                               uint32_t* spill_size,
+                               std::unique_ptr<Field[]>* heap_spill);
+
   // Called when the default on-stack storage is exhausted and new repeated
   // fields need to be pushed.
   void ExpandHeapStorage();
@@ -4902,6 +5184,10 @@ class PERFETTO_EXPORT_COMPONENT TypedProtoDecoderBase : public ProtoDecoder {
   // case of a large number of repeated fields.
   Field* fields_;
 
+  // Presence bitmap, 1 bit per field id, sized to cover [0, num_fields_).
+  // Provided by the template specialization (always on-stack). See HasField().
+  uint64_t* presence_;
+
   // Number of known fields, without accounting repeated storage. This is equal
   // to MAX_FIELD_ID + 1 (to account for the invalid 0th field). It never
   // changes after construction.
@@ -4926,6 +5212,18 @@ class PERFETTO_EXPORT_COMPONENT TypedProtoDecoderBase : public ProtoDecoder {
   // case it represents the size (#fields with each entry of a repeated field
   // counted individually) of the |heap_storage_| array.
   uint32_t capacity_;
+
+ private:
+  // Shared implementation of the two ParseAllFields() flavours above,
+  // instantiated twice (in the .cc) so that the plain decode path pays
+  // nothing for the mask support -- not even a null check on the mask, which
+  // is a per-field branch in the decode loop.
+  template <bool kSelective>
+  void ParseAllFieldsImpl(const uint64_t* dense_mask,
+                          Field** spill,
+                          uint32_t* spill_capacity,
+                          uint32_t* spill_size,
+                          std::unique_ptr<Field[]>* heap_spill);
 };
 
 // This constant is a tradeoff between having a larger stack frame and being
@@ -4943,11 +5241,10 @@ template <int MAX_FIELD_ID, bool = false>
 class TypedProtoDecoder : public TypedProtoDecoderBase {
  public:
   TypedProtoDecoder(const uint8_t* buffer, size_t length)
-      : TypedProtoDecoderBase(on_stack_storage_,
-                              /*num_fields=*/MAX_FIELD_ID + 1,
-                              PROTOZERO_DECODER_INITIAL_STACK_CAPACITY,
-                              buffer,
-                              length) {
+      : TypedProtoDecoder(SkipParseTag{},
+                          buffer,
+                          length,
+                          /*num_fields=*/MAX_FIELD_ID + 1) {
     TypedProtoDecoderBase::ParseAllFields();
   }
 
@@ -4959,7 +5256,7 @@ class TypedProtoDecoder : public TypedProtoDecoderBase {
     // back on the heap. Because both terms of the if () are known at compile
     // time, the compiler elides the branch for ids < INITIAL_STACK_CAPACITY.
     if (FIELD_ID < PROTOZERO_DECODER_INITIAL_STACK_CAPACITY) {
-      return fields_[FIELD_ID];
+      return HasField(FIELD_ID) ? fields_[FIELD_ID] : kInvalidField;
     } else {
       // Otherwise use the slowpath Get() which will do a runtime check.
       return Get(FIELD_ID);
@@ -4979,6 +5276,21 @@ class TypedProtoDecoder : public TypedProtoDecoderBase {
     return *this;
   }
 
+ protected:
+  // Sets up the storage but does not parse: for subclasses that drive
+  // ParseAllFields() themselves (see SelectiveTypedProtoDecoder).
+  struct SkipParseTag {};
+  TypedProtoDecoder(SkipParseTag,
+                    const uint8_t* buffer,
+                    size_t length,
+                    uint32_t num_fields)
+      : TypedProtoDecoderBase(on_stack_storage_,
+                              presence_storage_,
+                              num_fields,
+                              PROTOZERO_DECODER_INITIAL_STACK_CAPACITY,
+                              buffer,
+                              length) {}
+
  private:
   void MaybeCopyOnStackStorage(const TypedProtoDecoder& other) {
     // If the moved-from decoder was using on-stack storage, we need to update
@@ -4988,11 +5300,120 @@ class TypedProtoDecoder : public TypedProtoDecoderBase {
       memcpy(on_stack_storage_, other.on_stack_storage_,
              sizeof(on_stack_storage_));
     }
+    // The presence bitmap is always on-stack; repoint and copy it.
+    presence_ = presence_storage_;
+    memcpy(presence_storage_, other.presence_storage_,
+           sizeof(presence_storage_));
   }
 
+  // The presence bitmap is declared before the (much larger) field storage:
+  // it is touched on every Get()/at(), so keeping it at a small offset from
+  // |this| helps the dcache and lets arm compute the address in fewer
+  // instructions.
+  uint64_t presence_storage_[(MAX_FIELD_ID + 1 + 63) / 64];
   Field on_stack_storage_[PROTOZERO_DECODER_INITIAL_STACK_CAPACITY];
 };
 
+// TypedProtoDecoder with selective decoding. Ids allowlisted in the mask are
+// decoded into the O(1) dense storage as usual; every other field --
+// including ids beyond MAX_FIELD_ID, which TypedProtoDecoder drops -- is
+// appended, in wire order, to a spill area and can be iterated via
+// unknown_fields(). Spilled fields are not visible to Get()/at() (which
+// return an invalid field) or GetRepeated().
+//
+// This is a separate subclass rather than an extra TypedProtoDecoder
+// constructor so that the spill bookkeeping costs the plain decode path
+// nothing: decoders are constructed per nested message, and even
+// zero-initializing one extra pointer member per construction is measurable
+// end-to-end.
+// Usage:
+//   static constexpr SelectiveDecodeMask<TracePacket::kTimestampFieldNumber,
+//                                        TracePacket::kInternedDataFieldNumber>
+//       kMask{};
+//   SelectiveTypedProtoDecoder<MAX_FIELD_ID> decoder(data, size, kMask);
+//   for (const Field& f : decoder.unknown_fields()) { ... }
+template <int MAX_FIELD_ID>
+class SelectiveTypedProtoDecoder : public TypedProtoDecoder<MAX_FIELD_ID> {
+  using Base = TypedProtoDecoder<MAX_FIELD_ID>;
+
+ public:
+  // The dense window is capped at the mask's extent: |num_fields_| is the
+  // only id bound the decode loop checks, so capping it both bounds the mask
+  // read and makes every id above the mask spill, letting the mask be sized
+  // to the allowlisted ids only rather than to MAX_FIELD_ID.
+  // |mask| is only read during this call.
+  template <uint32_t... kFieldIds>
+  SelectiveTypedProtoDecoder(const uint8_t* buffer,
+                             size_t length,
+                             const SelectiveDecodeMask<kFieldIds...>& mask)
+      : Base(typename Base::SkipParseTag{},
+             buffer,
+             length,
+             /*num_fields=*/
+             std::min(static_cast<uint32_t>(MAX_FIELD_ID),
+                      SelectiveDecodeMask<kFieldIds...>::kMaxFieldId) +
+                 1) {
+    // The base constructor cleared the presence bitmap only up to the capped
+    // |num_fields_|. at<>() skips the range check for ids below the on-stack
+    // capacity and tests the presence bit directly, so the rest of the bitmap
+    // must be cleared too.
+    constexpr uint32_t kPresenceWords = (MAX_FIELD_ID + 1 + 63) / 64;
+    const uint32_t cleared_words = (this->num_fields_ + 63) / 64;
+    memset(this->presence_ + cleared_words, 0,
+           (kPresenceWords - cleared_words) * sizeof(uint64_t));
+    spill_ = spill_storage_;
+    uint32_t spill_capacity = kSpillStackCapacity;
+    this->ParseAllFieldsSelective(mask.data(), &spill_, &spill_capacity,
+                                  &spill_size_, &heap_spill_);
+  }
+
+  // The spilled fields, in wire order. Repeated fields appear once per
+  // occurrence.
+  UnknownFieldRange unknown_fields() const {
+    return {spill_, spill_ + spill_size_};
+  }
+
+  SelectiveTypedProtoDecoder(SelectiveTypedProtoDecoder&& other) noexcept
+      : Base(std::move(other)),
+        spill_(other.spill_),
+        spill_size_(other.spill_size_),
+        heap_spill_(std::move(other.heap_spill_)) {
+    MaybeCopyOnStackSpill(other);
+  }
+
+  SelectiveTypedProtoDecoder& operator=(
+      SelectiveTypedProtoDecoder&& other) noexcept {
+    if (this != &other) {
+      this->~SelectiveTypedProtoDecoder();
+      new (this) SelectiveTypedProtoDecoder(std::move(other));
+    }
+    return *this;
+  }
+
+ private:
+  // Number of spill slots stored inline. Spills are rare and small (typically
+  // the one data field of a TracePacket plus a few extensions), so a handful
+  // of slots avoids the heap in the common case; ParseAllFieldsSelective()'s
+  // heap fallback handles the rest.
+  static constexpr uint32_t kSpillStackCapacity = 16;
+
+  void MaybeCopyOnStackSpill(const SelectiveTypedProtoDecoder& other) {
+    // As MaybeCopyOnStackStorage(): if the moved-from decoder's spill was
+    // inline, repoint to this decoder's storage and copy it.
+    if (spill_ == other.spill_storage_) {
+      spill_ = spill_storage_;
+      memcpy(spill_storage_, other.spill_storage_, sizeof(spill_storage_));
+    }
+  }
+
+  // Spill area: the non-allowlisted fields, in wire order. |spill_| points at
+  // |spill_storage_| or at |heap_spill_| after an expansion.
+  Field* spill_ = nullptr;
+  uint32_t spill_size_ = 0;
+  std::unique_ptr<Field[]> heap_spill_;
+  Field spill_storage_[kSpillStackCapacity];
+};
+
 }  // namespace protozero
 
 #endif  // INCLUDE_PERFETTO_PROTOZERO_PROTO_DECODER_H_
@@ -5062,13 +5483,14 @@ enum Type : int32_t {
   TYPE_SLICE_END = 2,
   TYPE_INSTANT = 3,
   TYPE_COUNTER = 4,
+  TYPE_STATE = 5,
 };
 } // namespace perfetto_pbzero_enum_TrackEvent
 using TrackEvent_Type = perfetto_pbzero_enum_TrackEvent::Type;
 
 
 constexpr TrackEvent_Type TrackEvent_Type_MIN = TrackEvent_Type::TYPE_UNSPECIFIED;
-constexpr TrackEvent_Type TrackEvent_Type_MAX = TrackEvent_Type::TYPE_COUNTER;
+constexpr TrackEvent_Type TrackEvent_Type_MAX = TrackEvent_Type::TYPE_STATE;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
@@ -5088,6 +5510,9 @@ const char* TrackEvent_Type_Name(::perfetto::protos::pbzero::TrackEvent_Type val
 
   case ::perfetto::protos::pbzero::TrackEvent_Type::TYPE_COUNTER:
     return "TYPE_COUNTER";
+
+  case ::perfetto::protos::pbzero::TrackEvent_Type::TYPE_STATE:
+    return "TYPE_STATE";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
@@ -5535,6 +5960,7 @@ class TrackEvent : public ::protozero::Message {
   static inline const Type TYPE_SLICE_END = Type::TYPE_SLICE_END;
   static inline const Type TYPE_INSTANT = Type::TYPE_INSTANT;
   static inline const Type TYPE_COUNTER = Type::TYPE_COUNTER;
+  static inline const Type TYPE_STATE = Type::TYPE_STATE;
 
   using FieldMetadata_CategoryIids =
     ::protozero::proto_utils::FieldMetadata<
@@ -8449,6 +8875,7 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_BuiltinDataSource : public ::protoze
     kSnapshotIntervalMsFieldNumber = 6,
     kPreferSuspendClockForSnapshotFieldNumber = 7,
     kDisableChunkUsageHistogramsFieldNumber = 8,
+    kDisableExtensionDescriptorsFieldNumber = 9,
   };
 
   TraceConfig_BuiltinDataSource();
@@ -8497,6 +8924,10 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_BuiltinDataSource : public ::protoze
   bool disable_chunk_usage_histograms() const { return disable_chunk_usage_histograms_; }
   void set_disable_chunk_usage_histograms(bool value) { disable_chunk_usage_histograms_ = value; _has_field_.set(8); }
 
+  bool has_disable_extension_descriptors() const { return _has_field_[9]; }
+  bool disable_extension_descriptors() const { return disable_extension_descriptors_; }
+  void set_disable_extension_descriptors(bool value) { disable_extension_descriptors_ = value; _has_field_.set(9); }
+
  private:
   bool disable_clock_snapshotting_{};
   bool disable_trace_config_{};
@@ -8506,12 +8937,13 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_BuiltinDataSource : public ::protoze
   uint32_t snapshot_interval_ms_{};
   bool prefer_suspend_clock_for_snapshot_{};
   bool disable_chunk_usage_histograms_{};
+  bool disable_extension_descriptors_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<9> _has_field_{};
+  std::bitset<10> _has_field_{};
 };
 
 
@@ -9168,6 +9600,10 @@ class PERFETTO_EXPORT_COMPONENT TracingProducerBackend {
     uint32_t shmem_size_hint_bytes = 0;
     uint32_t shmem_page_size_hint_bytes = 0;
 
+    // Machine id propagated from TracingInitArgs; honored by the in-process
+    // backend only.
+    uint32_t machine_id = 0;
+
     // If true, the backend should allocate a shared memory buffer and provide
     // it to the service when connecting.
     // It's used in startup tracing.
@@ -9468,6 +9904,7 @@ class PERFETTO_EXPORT_COMPONENT TracingPolicy {
 // gen_amalgamated expanded: #include "perfetto/base/export.h"
 // gen_amalgamated expanded: #include "perfetto/base/logging.h"
 // gen_amalgamated expanded: #include "perfetto/tracing/backend_type.h"
+// gen_amalgamated expanded: #include "perfetto/tracing/buffer_exhausted_policy.h"
 // gen_amalgamated expanded: #include "perfetto/tracing/core/forward_decls.h"
 // gen_amalgamated expanded: #include "perfetto/tracing/internal/in_process_tracing_backend.h"
 // gen_amalgamated expanded: #include "perfetto/tracing/internal/system_tracing_backend.h"
@@ -9511,6 +9948,17 @@ struct TracingInitArgs {
   uint32_t backends = 0;                     // One or more BackendTypes.
   TracingBackend* custom_backend = nullptr;  // [Optional].
 
+  // [Optional] Machine id to attribute this process's trace data to. Only
+  // honored by the in-process backend; the system backend derives the machine
+  // id service-side and ignores this. Lets separate in-process traces be
+  // recorded under distinct machine ids. 0 means the default (host) machine.
+  //
+  // For a non-default (non-host) machine id, the tracing session's TraceConfig
+  // must opt into matching non-host machines (set trace_all_machines, or a
+  // machine_name_filter that matches); otherwise the data sources are filtered
+  // out and record no data.
+  uint32_t machine_id = 0;
+
   // [Optional] Platform implementation. It allows the embedder to take control
   // of platform-specific bits like thread creation and TLS slot handling. If
   // not set it will use Platform::GetDefaultPlatform().
@@ -9589,6 +10037,12 @@ struct TracingInitArgs {
   // event tracks for the same thread.
   bool disallow_merging_with_system_tracks = false;
 
+  // [Optional] Sets the default buffer exhausted policy for TrackEvent.
+  // Defaults to kDrop. When set to kStall, the calling thread will block
+  // when the shared memory buffer is full instead of dropping trace data.
+  BufferExhaustedPolicy track_event_buffer_exhausted_policy =
+      BufferExhaustedPolicy::kDrop;
+
   // If set, this function will be called by the producer client to create a
   // socket for connection to the system service. The function takes one
   // argument: a callback that takes an open file descriptor. The function
@@ -10716,6 +11170,7 @@ class PERFETTO_EXPORT_COMPONENT DataSourceType {
 namespace perfetto {
 namespace protos {
 namespace pbzero {
+class AndroidAflags;
 class AndroidCameraFrameEvent;
 class AndroidCameraSessionStats;
 class AndroidEnergyEstimationBreakdown;
@@ -10723,9 +11178,8 @@ class AndroidGameInterventionList;
 class AndroidLogPacket;
 class AndroidSystemProperty;
 class AndroidUserList;
-class AppWakelockBundle;
+class ArtProcessMetadata;
 class BatteryCounters;
-class BluetoothTraceEvent;
 class ChromeBenchmarkMetadata;
 class ChromeEventBundle;
 class ChromeMetadataPacket;
@@ -10736,30 +11190,28 @@ class CpuPerUidData;
 class DeobfuscationMapping;
 class EntityStateResidency;
 class EtwTraceEventBundle;
-class EvdevEvent;
 class ExtensionDescriptor;
 class FrameTimelineEvent;
 class FtraceEventBundle;
 class FtraceStats;
+class GenericGpuFrequencyEvent;
 class GenericKernelCpuFrequencyEvent;
 class GenericKernelProcessTree;
 class GenericKernelTaskRenameEvent;
 class GenericKernelTaskStateEvent;
 class GpuCounterEvent;
+class GpuInfo;
 class GpuLog;
 class GpuMemTotalEvent;
 class GpuRenderStageEvent;
 class GraphicsFrameEvent;
-class HeapGraph;
 class InitialDisplayState;
 class InodeFileMap;
 class InternedData;
+class InterruptInfo;
 class KernelWakelockData;
-class LayersSnapshotProto;
 class MemoryTrackerSnapshot;
 class ModuleSymbols;
-class NetworkPacketBundle;
-class NetworkPacketEvent;
 class PackagesList;
 class PerfSample;
 class PerfettoMetatrace;
@@ -10770,11 +11222,7 @@ class ProcessDescriptor;
 class ProcessStats;
 class ProcessTree;
 class ProfilePacket;
-class ProtoLogMessage;
-class ProtoLogViewerConfig;
 class RemoteClockSync;
-class ShellHandlerMappings;
-class ShellTransition;
 class SmapsPacket;
 class StatsdAtom;
 class StreamingAllocation;
@@ -10782,8 +11230,10 @@ class StreamingFree;
 class StreamingProfilePacket;
 class SysStats;
 class SystemInfo;
+class SystemdJournaldEvent;
 class TestEvent;
 class ThreadDescriptor;
+class TraceAttributes;
 class TraceConfig;
 class TracePacket;
 class TracePacket_ProtoVms;
@@ -10796,7 +11246,6 @@ class TracingServiceEvent;
 class TrackDescriptor;
 class TrackEvent;
 class TrackEventRangeOfInterest;
-class TransactionTraceEntry;
 class TranslationTable;
 class Trigger;
 class UiState;
@@ -10808,7 +11257,6 @@ class V8WasmCode;
 class VmProgram;
 class VulkanApiEvent;
 class VulkanMemoryEvent;
-class WinscopeExtensions;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -10846,6 +11294,63 @@ const char* TracePacket_SequenceFlags_Name(::perfetto::protos::pbzero::TracePack
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
+namespace perfetto_pbzero_enum_TracePacket {
+enum DataLossReason : int32_t {
+  DATA_LOSS_UNSPECIFIED = 0,
+  DATA_LOSS_PRESENT = 1,
+  DATA_LOSS_READ_GAP = 2,
+  DATA_LOSS_CHUNK_CORRUPTED = 4,
+  DATA_LOSS_ORPHAN_CONTINUATION = 8,
+  DATA_LOSS_REASSEMBLY_GAP = 16,
+  DATA_LOSS_REASSEMBLY_BROKEN_CHAIN = 32,
+  DATA_LOSS_OVERWRITE = 64,
+  DATA_LOSS_WRITER_ABORT = 128,
+  DATA_LOSS_SMB_FULL = 256,
+};
+} // namespace perfetto_pbzero_enum_TracePacket
+using TracePacket_DataLossReason = perfetto_pbzero_enum_TracePacket::DataLossReason;
+
+
+constexpr TracePacket_DataLossReason TracePacket_DataLossReason_MIN = TracePacket_DataLossReason::DATA_LOSS_UNSPECIFIED;
+constexpr TracePacket_DataLossReason TracePacket_DataLossReason_MAX = TracePacket_DataLossReason::DATA_LOSS_SMB_FULL;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* TracePacket_DataLossReason_Name(::perfetto::protos::pbzero::TracePacket_DataLossReason value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_UNSPECIFIED:
+    return "DATA_LOSS_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_PRESENT:
+    return "DATA_LOSS_PRESENT";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_READ_GAP:
+    return "DATA_LOSS_READ_GAP";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_CHUNK_CORRUPTED:
+    return "DATA_LOSS_CHUNK_CORRUPTED";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_ORPHAN_CONTINUATION:
+    return "DATA_LOSS_ORPHAN_CONTINUATION";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_REASSEMBLY_GAP:
+    return "DATA_LOSS_REASSEMBLY_GAP";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_REASSEMBLY_BROKEN_CHAIN:
+    return "DATA_LOSS_REASSEMBLY_BROKEN_CHAIN";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_OVERWRITE:
+    return "DATA_LOSS_OVERWRITE";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_WRITER_ABORT:
+    return "DATA_LOSS_WRITER_ABORT";
+
+  case ::perfetto::protos::pbzero::TracePacket_DataLossReason::DATA_LOSS_SMB_FULL:
+    return "DATA_LOSS_SMB_FULL";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
 class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/900> {
  public:
   TracePacket_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -10855,8 +11360,24 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   uint64_t timestamp() const { return at<8>().as_uint64(); }
   bool has_timestamp_clock_id() const { return at<58>().valid(); }
   uint32_t timestamp_clock_id() const { return at<58>().as_uint32(); }
+  bool has_track_event() const { return at<11>().valid(); }
+  ::protozero::ConstBytes track_event() const { return at<11>().as_bytes(); }
+  bool has_track_descriptor() const { return at<60>().valid(); }
+  ::protozero::ConstBytes track_descriptor() const { return at<60>().as_bytes(); }
+  bool has_generic_kernel_task_state_event() const { return at<117>().valid(); }
+  ::protozero::ConstBytes generic_kernel_task_state_event() const { return at<117>().as_bytes(); }
+  bool has_generic_kernel_cpu_freq_event() const { return at<118>().valid(); }
+  ::protozero::ConstBytes generic_kernel_cpu_freq_event() const { return at<118>().as_bytes(); }
+  bool has_generic_kernel_task_rename_event() const { return at<120>().valid(); }
+  ::protozero::ConstBytes generic_kernel_task_rename_event() const { return at<120>().as_bytes(); }
+  bool has_generic_kernel_process_tree() const { return at<122>().valid(); }
+  ::protozero::ConstBytes generic_kernel_process_tree() const { return at<122>().as_bytes(); }
+  bool has_generic_gpu_frequency_event() const { return at<129>().valid(); }
+  ::protozero::ConstBytes generic_gpu_frequency_event() const { return at<129>().as_bytes(); }
   bool has_process_tree() const { return at<2>().valid(); }
   ::protozero::ConstBytes process_tree() const { return at<2>().as_bytes(); }
+  bool has_track_event_range_of_interest() const { return at<90>().valid(); }
+  ::protozero::ConstBytes track_event_range_of_interest() const { return at<90>().as_bytes(); }
   bool has_process_stats() const { return at<9>().valid(); }
   ::protozero::ConstBytes process_stats() const { return at<9>().as_bytes(); }
   bool has_inode_file_map() const { return at<4>().valid(); }
@@ -10867,8 +11388,6 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes clock_snapshot() const { return at<6>().as_bytes(); }
   bool has_sys_stats() const { return at<7>().valid(); }
   ::protozero::ConstBytes sys_stats() const { return at<7>().as_bytes(); }
-  bool has_track_event() const { return at<11>().valid(); }
-  ::protozero::ConstBytes track_event() const { return at<11>().as_bytes(); }
   bool has_trace_uuid() const { return at<89>().valid(); }
   ::protozero::ConstBytes trace_uuid() const { return at<89>().as_bytes(); }
   bool has_trace_config() const { return at<33>().valid(); }
@@ -10909,8 +11428,8 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes gpu_render_stage_event() const { return at<53>().as_bytes(); }
   bool has_streaming_profile_packet() const { return at<54>().valid(); }
   ::protozero::ConstBytes streaming_profile_packet() const { return at<54>().as_bytes(); }
-  bool has_heap_graph() const { return at<56>().valid(); }
-  ::protozero::ConstBytes heap_graph() const { return at<56>().as_bytes(); }
+  bool has_art_process_metadata() const { return at<131>().valid(); }
+  ::protozero::ConstBytes art_process_metadata() const { return at<131>().as_bytes(); }
   bool has_graphics_frame_event() const { return at<57>().valid(); }
   ::protozero::ConstBytes graphics_frame_event() const { return at<57>().as_bytes(); }
   bool has_vulkan_memory_event() const { return at<62>().valid(); }
@@ -10957,12 +11476,18 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes trace_provenance() const { return at<124>().as_bytes(); }
   bool has_protovms() const { return at<125>().valid(); }
   ::protozero::ConstBytes protovms() const { return at<125>().as_bytes(); }
+  bool has_trace_attributes() const { return at<126>().valid(); }
+  ::protozero::ConstBytes trace_attributes() const { return at<126>().as_bytes(); }
+  bool has_android_aflags() const { return at<127>().valid(); }
+  ::protozero::ConstBytes android_aflags() const { return at<127>().as_bytes(); }
+  bool has_gpu_info() const { return at<128>().valid(); }
+  ::protozero::ConstBytes gpu_info() const { return at<128>().as_bytes(); }
+  bool has_interrupt_info() const { return at<130>().valid(); }
+  ::protozero::ConstBytes interrupt_info() const { return at<130>().as_bytes(); }
   bool has_module_symbols() const { return at<61>().valid(); }
   ::protozero::ConstBytes module_symbols() const { return at<61>().as_bytes(); }
   bool has_deobfuscation_mapping() const { return at<64>().valid(); }
   ::protozero::ConstBytes deobfuscation_mapping() const { return at<64>().as_bytes(); }
-  bool has_track_descriptor() const { return at<60>().valid(); }
-  ::protozero::ConstBytes track_descriptor() const { return at<60>().as_bytes(); }
   bool has_process_descriptor() const { return at<43>().valid(); }
   ::protozero::ConstBytes process_descriptor() const { return at<43>().as_bytes(); }
   bool has_thread_descriptor() const { return at<44>().valid(); }
@@ -10975,26 +11500,6 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes compressed_packets() const { return at<50>().as_bytes(); }
   bool has_extension_descriptor() const { return at<72>().valid(); }
   ::protozero::ConstBytes extension_descriptor() const { return at<72>().as_bytes(); }
-  bool has_network_packet() const { return at<88>().valid(); }
-  ::protozero::ConstBytes network_packet() const { return at<88>().as_bytes(); }
-  bool has_network_packet_bundle() const { return at<92>().valid(); }
-  ::protozero::ConstBytes network_packet_bundle() const { return at<92>().as_bytes(); }
-  bool has_track_event_range_of_interest() const { return at<90>().valid(); }
-  ::protozero::ConstBytes track_event_range_of_interest() const { return at<90>().as_bytes(); }
-  bool has_surfaceflinger_layers_snapshot() const { return at<93>().valid(); }
-  ::protozero::ConstBytes surfaceflinger_layers_snapshot() const { return at<93>().as_bytes(); }
-  bool has_surfaceflinger_transactions() const { return at<94>().valid(); }
-  ::protozero::ConstBytes surfaceflinger_transactions() const { return at<94>().as_bytes(); }
-  bool has_shell_transition() const { return at<96>().valid(); }
-  ::protozero::ConstBytes shell_transition() const { return at<96>().as_bytes(); }
-  bool has_shell_handler_mappings() const { return at<97>().valid(); }
-  ::protozero::ConstBytes shell_handler_mappings() const { return at<97>().as_bytes(); }
-  bool has_protolog_message() const { return at<104>().valid(); }
-  ::protozero::ConstBytes protolog_message() const { return at<104>().as_bytes(); }
-  bool has_protolog_viewer_config() const { return at<105>().valid(); }
-  ::protozero::ConstBytes protolog_viewer_config() const { return at<105>().as_bytes(); }
-  bool has_winscope_extensions() const { return at<112>().valid(); }
-  ::protozero::ConstBytes winscope_extensions() const { return at<112>().as_bytes(); }
   bool has_etw_events() const { return at<95>().valid(); }
   ::protozero::ConstBytes etw_events() const { return at<95>().as_bytes(); }
   bool has_v8_js_code() const { return at<99>().valid(); }
@@ -11015,26 +11520,14 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes pixel_modem_token_database() const { return at<111>().as_bytes(); }
   bool has_clone_snapshot_trigger() const { return at<113>().valid(); }
   ::protozero::ConstBytes clone_snapshot_trigger() const { return at<113>().as_bytes(); }
-  bool has_bluetooth_trace_event() const { return at<114>().valid(); }
-  ::protozero::ConstBytes bluetooth_trace_event() const { return at<114>().as_bytes(); }
   bool has_kernel_wakelock_data() const { return at<115>().valid(); }
   ::protozero::ConstBytes kernel_wakelock_data() const { return at<115>().as_bytes(); }
-  bool has_app_wakelock_bundle() const { return at<116>().valid(); }
-  ::protozero::ConstBytes app_wakelock_bundle() const { return at<116>().as_bytes(); }
-  bool has_generic_kernel_task_state_event() const { return at<117>().valid(); }
-  ::protozero::ConstBytes generic_kernel_task_state_event() const { return at<117>().as_bytes(); }
-  bool has_generic_kernel_cpu_freq_event() const { return at<118>().valid(); }
-  ::protozero::ConstBytes generic_kernel_cpu_freq_event() const { return at<118>().as_bytes(); }
-  bool has_generic_kernel_task_rename_event() const { return at<120>().valid(); }
-  ::protozero::ConstBytes generic_kernel_task_rename_event() const { return at<120>().as_bytes(); }
-  bool has_generic_kernel_process_tree() const { return at<122>().valid(); }
-  ::protozero::ConstBytes generic_kernel_process_tree() const { return at<122>().as_bytes(); }
   bool has_cpu_per_uid_data() const { return at<119>().valid(); }
   ::protozero::ConstBytes cpu_per_uid_data() const { return at<119>().as_bytes(); }
-  bool has_evdev_event() const { return at<121>().valid(); }
-  ::protozero::ConstBytes evdev_event() const { return at<121>().as_bytes(); }
   bool has_user_list() const { return at<123>().valid(); }
   ::protozero::ConstBytes user_list() const { return at<123>().as_bytes(); }
+  bool has_journald_event() const { return at<132>().valid(); }
+  ::protozero::ConstBytes journald_event() const { return at<132>().as_bytes(); }
   bool has_for_testing() const { return at<900>().valid(); }
   ::protozero::ConstBytes for_testing() const { return at<900>().as_bytes(); }
   bool has_trusted_uid() const { return at<3>().valid(); }
@@ -11052,7 +11545,7 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   bool has_trace_packet_defaults() const { return at<59>().valid(); }
   ::protozero::ConstBytes trace_packet_defaults() const { return at<59>().as_bytes(); }
   bool has_previous_packet_dropped() const { return at<42>().valid(); }
-  bool previous_packet_dropped() const { return at<42>().as_bool(); }
+  uint32_t previous_packet_dropped() const { return at<42>().as_uint32(); }
   bool has_first_packet_on_sequence() const { return at<87>().valid(); }
   bool first_packet_on_sequence() const { return at<87>().as_bool(); }
   bool has_machine_id() const { return at<98>().valid(); }
@@ -11065,13 +11558,20 @@ class TracePacket : public ::protozero::Message {
   enum : int32_t {
     kTimestampFieldNumber = 8,
     kTimestampClockIdFieldNumber = 58,
+    kTrackEventFieldNumber = 11,
+    kTrackDescriptorFieldNumber = 60,
+    kGenericKernelTaskStateEventFieldNumber = 117,
+    kGenericKernelCpuFreqEventFieldNumber = 118,
+    kGenericKernelTaskRenameEventFieldNumber = 120,
+    kGenericKernelProcessTreeFieldNumber = 122,
+    kGenericGpuFrequencyEventFieldNumber = 129,
     kProcessTreeFieldNumber = 2,
+    kTrackEventRangeOfInterestFieldNumber = 90,
     kProcessStatsFieldNumber = 9,
     kInodeFileMapFieldNumber = 4,
     kChromeEventsFieldNumber = 5,
     kClockSnapshotFieldNumber = 6,
     kSysStatsFieldNumber = 7,
-    kTrackEventFieldNumber = 11,
     kTraceUuidFieldNumber = 89,
     kTraceConfigFieldNumber = 33,
     kFtraceStatsFieldNumber = 34,
@@ -11092,7 +11592,7 @@ class TracePacket : public ::protozero::Message {
     kGpuCounterEventFieldNumber = 52,
     kGpuRenderStageEventFieldNumber = 53,
     kStreamingProfilePacketFieldNumber = 54,
-    kHeapGraphFieldNumber = 56,
+    kArtProcessMetadataFieldNumber = 131,
     kGraphicsFrameEventFieldNumber = 57,
     kVulkanMemoryEventFieldNumber = 62,
     kGpuLogFieldNumber = 63,
@@ -11116,25 +11616,18 @@ class TracePacket : public ::protozero::Message {
     kEntityStateResidencyFieldNumber = 91,
     kTraceProvenanceFieldNumber = 124,
     kProtovmsFieldNumber = 125,
+    kTraceAttributesFieldNumber = 126,
+    kAndroidAflagsFieldNumber = 127,
+    kGpuInfoFieldNumber = 128,
+    kInterruptInfoFieldNumber = 130,
     kModuleSymbolsFieldNumber = 61,
     kDeobfuscationMappingFieldNumber = 64,
-    kTrackDescriptorFieldNumber = 60,
     kProcessDescriptorFieldNumber = 43,
     kThreadDescriptorFieldNumber = 44,
     kFtraceEventsFieldNumber = 1,
     kSynchronizationMarkerFieldNumber = 36,
     kCompressedPacketsFieldNumber = 50,
     kExtensionDescriptorFieldNumber = 72,
-    kNetworkPacketFieldNumber = 88,
-    kNetworkPacketBundleFieldNumber = 92,
-    kTrackEventRangeOfInterestFieldNumber = 90,
-    kSurfaceflingerLayersSnapshotFieldNumber = 93,
-    kSurfaceflingerTransactionsFieldNumber = 94,
-    kShellTransitionFieldNumber = 96,
-    kShellHandlerMappingsFieldNumber = 97,
-    kProtologMessageFieldNumber = 104,
-    kProtologViewerConfigFieldNumber = 105,
-    kWinscopeExtensionsFieldNumber = 112,
     kEtwEventsFieldNumber = 95,
     kV8JsCodeFieldNumber = 99,
     kV8InternalCodeFieldNumber = 100,
@@ -11145,16 +11638,10 @@ class TracePacket : public ::protozero::Message {
     kPixelModemEventsFieldNumber = 110,
     kPixelModemTokenDatabaseFieldNumber = 111,
     kCloneSnapshotTriggerFieldNumber = 113,
-    kBluetoothTraceEventFieldNumber = 114,
     kKernelWakelockDataFieldNumber = 115,
-    kAppWakelockBundleFieldNumber = 116,
-    kGenericKernelTaskStateEventFieldNumber = 117,
-    kGenericKernelCpuFreqEventFieldNumber = 118,
-    kGenericKernelTaskRenameEventFieldNumber = 120,
-    kGenericKernelProcessTreeFieldNumber = 122,
     kCpuPerUidDataFieldNumber = 119,
-    kEvdevEventFieldNumber = 121,
     kUserListFieldNumber = 123,
+    kJournaldEventFieldNumber = 132,
     kForTestingFieldNumber = 900,
     kTrustedUidFieldNumber = 3,
     kTrustedPacketSequenceIdFieldNumber = 10,
@@ -11175,9 +11662,24 @@ class TracePacket : public ::protozero::Message {
   static inline const char* SequenceFlags_Name(SequenceFlags value) {
     return ::perfetto::protos::pbzero::TracePacket_SequenceFlags_Name(value);
   }
+
+  using DataLossReason = ::perfetto::protos::pbzero::TracePacket_DataLossReason;
+  static inline const char* DataLossReason_Name(DataLossReason value) {
+    return ::perfetto::protos::pbzero::TracePacket_DataLossReason_Name(value);
+  }
   static inline const SequenceFlags SEQ_UNSPECIFIED = SequenceFlags::SEQ_UNSPECIFIED;
   static inline const SequenceFlags SEQ_INCREMENTAL_STATE_CLEARED = SequenceFlags::SEQ_INCREMENTAL_STATE_CLEARED;
   static inline const SequenceFlags SEQ_NEEDS_INCREMENTAL_STATE = SequenceFlags::SEQ_NEEDS_INCREMENTAL_STATE;
+  static inline const DataLossReason DATA_LOSS_UNSPECIFIED = DataLossReason::DATA_LOSS_UNSPECIFIED;
+  static inline const DataLossReason DATA_LOSS_PRESENT = DataLossReason::DATA_LOSS_PRESENT;
+  static inline const DataLossReason DATA_LOSS_READ_GAP = DataLossReason::DATA_LOSS_READ_GAP;
+  static inline const DataLossReason DATA_LOSS_CHUNK_CORRUPTED = DataLossReason::DATA_LOSS_CHUNK_CORRUPTED;
+  static inline const DataLossReason DATA_LOSS_ORPHAN_CONTINUATION = DataLossReason::DATA_LOSS_ORPHAN_CONTINUATION;
+  static inline const DataLossReason DATA_LOSS_REASSEMBLY_GAP = DataLossReason::DATA_LOSS_REASSEMBLY_GAP;
+  static inline const DataLossReason DATA_LOSS_REASSEMBLY_BROKEN_CHAIN = DataLossReason::DATA_LOSS_REASSEMBLY_BROKEN_CHAIN;
+  static inline const DataLossReason DATA_LOSS_OVERWRITE = DataLossReason::DATA_LOSS_OVERWRITE;
+  static inline const DataLossReason DATA_LOSS_WRITER_ABORT = DataLossReason::DATA_LOSS_WRITER_ABORT;
+  static inline const DataLossReason DATA_LOSS_SMB_FULL = DataLossReason::DATA_LOSS_SMB_FULL;
 
   using FieldMetadata_Timestamp =
     ::protozero::proto_utils::FieldMetadata<
@@ -11215,6 +11717,104 @@ class TracePacket : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_TrackEvent =
+    ::protozero::proto_utils::FieldMetadata<
+      11,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TrackEvent,
+      TracePacket>;
+
+  static constexpr FieldMetadata_TrackEvent kTrackEvent{};
+  template <typename T = TrackEvent> T* set_track_event() {
+    return BeginNestedMessage<T>(11);
+  }
+
+
+  using FieldMetadata_TrackDescriptor =
+    ::protozero::proto_utils::FieldMetadata<
+      60,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TrackDescriptor,
+      TracePacket>;
+
+  static constexpr FieldMetadata_TrackDescriptor kTrackDescriptor{};
+  template <typename T = TrackDescriptor> T* set_track_descriptor() {
+    return BeginNestedMessage<T>(60);
+  }
+
+
+  using FieldMetadata_GenericKernelTaskStateEvent =
+    ::protozero::proto_utils::FieldMetadata<
+      117,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GenericKernelTaskStateEvent,
+      TracePacket>;
+
+  static constexpr FieldMetadata_GenericKernelTaskStateEvent kGenericKernelTaskStateEvent{};
+  template <typename T = GenericKernelTaskStateEvent> T* set_generic_kernel_task_state_event() {
+    return BeginNestedMessage<T>(117);
+  }
+
+
+  using FieldMetadata_GenericKernelCpuFreqEvent =
+    ::protozero::proto_utils::FieldMetadata<
+      118,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GenericKernelCpuFrequencyEvent,
+      TracePacket>;
+
+  static constexpr FieldMetadata_GenericKernelCpuFreqEvent kGenericKernelCpuFreqEvent{};
+  template <typename T = GenericKernelCpuFrequencyEvent> T* set_generic_kernel_cpu_freq_event() {
+    return BeginNestedMessage<T>(118);
+  }
+
+
+  using FieldMetadata_GenericKernelTaskRenameEvent =
+    ::protozero::proto_utils::FieldMetadata<
+      120,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GenericKernelTaskRenameEvent,
+      TracePacket>;
+
+  static constexpr FieldMetadata_GenericKernelTaskRenameEvent kGenericKernelTaskRenameEvent{};
+  template <typename T = GenericKernelTaskRenameEvent> T* set_generic_kernel_task_rename_event() {
+    return BeginNestedMessage<T>(120);
+  }
+
+
+  using FieldMetadata_GenericKernelProcessTree =
+    ::protozero::proto_utils::FieldMetadata<
+      122,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GenericKernelProcessTree,
+      TracePacket>;
+
+  static constexpr FieldMetadata_GenericKernelProcessTree kGenericKernelProcessTree{};
+  template <typename T = GenericKernelProcessTree> T* set_generic_kernel_process_tree() {
+    return BeginNestedMessage<T>(122);
+  }
+
+
+  using FieldMetadata_GenericGpuFrequencyEvent =
+    ::protozero::proto_utils::FieldMetadata<
+      129,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GenericGpuFrequencyEvent,
+      TracePacket>;
+
+  static constexpr FieldMetadata_GenericGpuFrequencyEvent kGenericGpuFrequencyEvent{};
+  template <typename T = GenericGpuFrequencyEvent> T* set_generic_gpu_frequency_event() {
+    return BeginNestedMessage<T>(129);
+  }
+
+
   using FieldMetadata_ProcessTree =
     ::protozero::proto_utils::FieldMetadata<
       2,
@@ -11229,6 +11829,20 @@ class TracePacket : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_TrackEventRangeOfInterest =
+    ::protozero::proto_utils::FieldMetadata<
+      90,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TrackEventRangeOfInterest,
+      TracePacket>;
+
+  static constexpr FieldMetadata_TrackEventRangeOfInterest kTrackEventRangeOfInterest{};
+  template <typename T = TrackEventRangeOfInterest> T* set_track_event_range_of_interest() {
+    return BeginNestedMessage<T>(90);
+  }
+
+
   using FieldMetadata_ProcessStats =
     ::protozero::proto_utils::FieldMetadata<
       9,
@@ -11299,20 +11913,6 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_TrackEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TrackEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_TrackEvent kTrackEvent{};
-  template <typename T = TrackEvent> T* set_track_event() {
-    return BeginNestedMessage<T>(11);
-  }
-
-
   using FieldMetadata_TraceUuid =
     ::protozero::proto_utils::FieldMetadata<
       89,
@@ -11593,17 +12193,17 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_HeapGraph =
+  using FieldMetadata_ArtProcessMetadata =
     ::protozero::proto_utils::FieldMetadata<
-      56,
+      131,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      HeapGraph,
+      ArtProcessMetadata,
       TracePacket>;
 
-  static constexpr FieldMetadata_HeapGraph kHeapGraph{};
-  template <typename T = HeapGraph> T* set_heap_graph() {
-    return BeginNestedMessage<T>(56);
+  static constexpr FieldMetadata_ArtProcessMetadata kArtProcessMetadata{};
+  template <typename T = ArtProcessMetadata> T* set_art_process_metadata() {
+    return BeginNestedMessage<T>(131);
   }
 
 
@@ -11929,6 +12529,62 @@ class TracePacket : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_TraceAttributes =
+    ::protozero::proto_utils::FieldMetadata<
+      126,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TraceAttributes,
+      TracePacket>;
+
+  static constexpr FieldMetadata_TraceAttributes kTraceAttributes{};
+  template <typename T = TraceAttributes> T* set_trace_attributes() {
+    return BeginNestedMessage<T>(126);
+  }
+
+
+  using FieldMetadata_AndroidAflags =
+    ::protozero::proto_utils::FieldMetadata<
+      127,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidAflags,
+      TracePacket>;
+
+  static constexpr FieldMetadata_AndroidAflags kAndroidAflags{};
+  template <typename T = AndroidAflags> T* set_android_aflags() {
+    return BeginNestedMessage<T>(127);
+  }
+
+
+  using FieldMetadata_GpuInfo =
+    ::protozero::proto_utils::FieldMetadata<
+      128,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuInfo,
+      TracePacket>;
+
+  static constexpr FieldMetadata_GpuInfo kGpuInfo{};
+  template <typename T = GpuInfo> T* set_gpu_info() {
+    return BeginNestedMessage<T>(128);
+  }
+
+
+  using FieldMetadata_InterruptInfo =
+    ::protozero::proto_utils::FieldMetadata<
+      130,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      InterruptInfo,
+      TracePacket>;
+
+  static constexpr FieldMetadata_InterruptInfo kInterruptInfo{};
+  template <typename T = InterruptInfo> T* set_interrupt_info() {
+    return BeginNestedMessage<T>(130);
+  }
+
+
   using FieldMetadata_ModuleSymbols =
     ::protozero::proto_utils::FieldMetadata<
       61,
@@ -11957,20 +12613,6 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_TrackDescriptor =
-    ::protozero::proto_utils::FieldMetadata<
-      60,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TrackDescriptor,
-      TracePacket>;
-
-  static constexpr FieldMetadata_TrackDescriptor kTrackDescriptor{};
-  template <typename T = TrackDescriptor> T* set_track_descriptor() {
-    return BeginNestedMessage<T>(60);
-  }
-
-
   using FieldMetadata_ProcessDescriptor =
     ::protozero::proto_utils::FieldMetadata<
       43,
@@ -12075,146 +12717,6 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_NetworkPacket =
-    ::protozero::proto_utils::FieldMetadata<
-      88,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      NetworkPacketEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_NetworkPacket kNetworkPacket{};
-  template <typename T = NetworkPacketEvent> T* set_network_packet() {
-    return BeginNestedMessage<T>(88);
-  }
-
-
-  using FieldMetadata_NetworkPacketBundle =
-    ::protozero::proto_utils::FieldMetadata<
-      92,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      NetworkPacketBundle,
-      TracePacket>;
-
-  static constexpr FieldMetadata_NetworkPacketBundle kNetworkPacketBundle{};
-  template <typename T = NetworkPacketBundle> T* set_network_packet_bundle() {
-    return BeginNestedMessage<T>(92);
-  }
-
-
-  using FieldMetadata_TrackEventRangeOfInterest =
-    ::protozero::proto_utils::FieldMetadata<
-      90,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TrackEventRangeOfInterest,
-      TracePacket>;
-
-  static constexpr FieldMetadata_TrackEventRangeOfInterest kTrackEventRangeOfInterest{};
-  template <typename T = TrackEventRangeOfInterest> T* set_track_event_range_of_interest() {
-    return BeginNestedMessage<T>(90);
-  }
-
-
-  using FieldMetadata_SurfaceflingerLayersSnapshot =
-    ::protozero::proto_utils::FieldMetadata<
-      93,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayersSnapshotProto,
-      TracePacket>;
-
-  static constexpr FieldMetadata_SurfaceflingerLayersSnapshot kSurfaceflingerLayersSnapshot{};
-  template <typename T = LayersSnapshotProto> T* set_surfaceflinger_layers_snapshot() {
-    return BeginNestedMessage<T>(93);
-  }
-
-
-  using FieldMetadata_SurfaceflingerTransactions =
-    ::protozero::proto_utils::FieldMetadata<
-      94,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransactionTraceEntry,
-      TracePacket>;
-
-  static constexpr FieldMetadata_SurfaceflingerTransactions kSurfaceflingerTransactions{};
-  template <typename T = TransactionTraceEntry> T* set_surfaceflinger_transactions() {
-    return BeginNestedMessage<T>(94);
-  }
-
-
-  using FieldMetadata_ShellTransition =
-    ::protozero::proto_utils::FieldMetadata<
-      96,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ShellTransition,
-      TracePacket>;
-
-  static constexpr FieldMetadata_ShellTransition kShellTransition{};
-  template <typename T = ShellTransition> T* set_shell_transition() {
-    return BeginNestedMessage<T>(96);
-  }
-
-
-  using FieldMetadata_ShellHandlerMappings =
-    ::protozero::proto_utils::FieldMetadata<
-      97,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ShellHandlerMappings,
-      TracePacket>;
-
-  static constexpr FieldMetadata_ShellHandlerMappings kShellHandlerMappings{};
-  template <typename T = ShellHandlerMappings> T* set_shell_handler_mappings() {
-    return BeginNestedMessage<T>(97);
-  }
-
-
-  using FieldMetadata_ProtologMessage =
-    ::protozero::proto_utils::FieldMetadata<
-      104,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ProtoLogMessage,
-      TracePacket>;
-
-  static constexpr FieldMetadata_ProtologMessage kProtologMessage{};
-  template <typename T = ProtoLogMessage> T* set_protolog_message() {
-    return BeginNestedMessage<T>(104);
-  }
-
-
-  using FieldMetadata_ProtologViewerConfig =
-    ::protozero::proto_utils::FieldMetadata<
-      105,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ProtoLogViewerConfig,
-      TracePacket>;
-
-  static constexpr FieldMetadata_ProtologViewerConfig kProtologViewerConfig{};
-  template <typename T = ProtoLogViewerConfig> T* set_protolog_viewer_config() {
-    return BeginNestedMessage<T>(105);
-  }
-
-
-  using FieldMetadata_WinscopeExtensions =
-    ::protozero::proto_utils::FieldMetadata<
-      112,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      WinscopeExtensions,
-      TracePacket>;
-
-  static constexpr FieldMetadata_WinscopeExtensions kWinscopeExtensions{};
-  template <typename T = WinscopeExtensions> T* set_winscope_extensions() {
-    return BeginNestedMessage<T>(112);
-  }
-
-
   using FieldMetadata_EtwEvents =
     ::protozero::proto_utils::FieldMetadata<
       95,
@@ -12355,20 +12857,6 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_BluetoothTraceEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      114,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BluetoothTraceEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_BluetoothTraceEvent kBluetoothTraceEvent{};
-  template <typename T = BluetoothTraceEvent> T* set_bluetooth_trace_event() {
-    return BeginNestedMessage<T>(114);
-  }
-
-
   using FieldMetadata_KernelWakelockData =
     ::protozero::proto_utils::FieldMetadata<
       115,
@@ -12383,76 +12871,6 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_AppWakelockBundle =
-    ::protozero::proto_utils::FieldMetadata<
-      116,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AppWakelockBundle,
-      TracePacket>;
-
-  static constexpr FieldMetadata_AppWakelockBundle kAppWakelockBundle{};
-  template <typename T = AppWakelockBundle> T* set_app_wakelock_bundle() {
-    return BeginNestedMessage<T>(116);
-  }
-
-
-  using FieldMetadata_GenericKernelTaskStateEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      117,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      GenericKernelTaskStateEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_GenericKernelTaskStateEvent kGenericKernelTaskStateEvent{};
-  template <typename T = GenericKernelTaskStateEvent> T* set_generic_kernel_task_state_event() {
-    return BeginNestedMessage<T>(117);
-  }
-
-
-  using FieldMetadata_GenericKernelCpuFreqEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      118,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      GenericKernelCpuFrequencyEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_GenericKernelCpuFreqEvent kGenericKernelCpuFreqEvent{};
-  template <typename T = GenericKernelCpuFrequencyEvent> T* set_generic_kernel_cpu_freq_event() {
-    return BeginNestedMessage<T>(118);
-  }
-
-
-  using FieldMetadata_GenericKernelTaskRenameEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      120,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      GenericKernelTaskRenameEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_GenericKernelTaskRenameEvent kGenericKernelTaskRenameEvent{};
-  template <typename T = GenericKernelTaskRenameEvent> T* set_generic_kernel_task_rename_event() {
-    return BeginNestedMessage<T>(120);
-  }
-
-
-  using FieldMetadata_GenericKernelProcessTree =
-    ::protozero::proto_utils::FieldMetadata<
-      122,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      GenericKernelProcessTree,
-      TracePacket>;
-
-  static constexpr FieldMetadata_GenericKernelProcessTree kGenericKernelProcessTree{};
-  template <typename T = GenericKernelProcessTree> T* set_generic_kernel_process_tree() {
-    return BeginNestedMessage<T>(122);
-  }
-
-
   using FieldMetadata_CpuPerUidData =
     ::protozero::proto_utils::FieldMetadata<
       119,
@@ -12467,31 +12885,31 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_EvdevEvent =
+  using FieldMetadata_UserList =
     ::protozero::proto_utils::FieldMetadata<
-      121,
+      123,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevEvent,
+      AndroidUserList,
       TracePacket>;
 
-  static constexpr FieldMetadata_EvdevEvent kEvdevEvent{};
-  template <typename T = EvdevEvent> T* set_evdev_event() {
-    return BeginNestedMessage<T>(121);
+  static constexpr FieldMetadata_UserList kUserList{};
+  template <typename T = AndroidUserList> T* set_user_list() {
+    return BeginNestedMessage<T>(123);
   }
 
 
-  using FieldMetadata_UserList =
+  using FieldMetadata_JournaldEvent =
     ::protozero::proto_utils::FieldMetadata<
-      123,
+      132,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidUserList,
+      SystemdJournaldEvent,
       TracePacket>;
 
-  static constexpr FieldMetadata_UserList kUserList{};
-  template <typename T = AndroidUserList> T* set_user_list() {
-    return BeginNestedMessage<T>(123);
+  static constexpr FieldMetadata_JournaldEvent kJournaldEvent{};
+  template <typename T = SystemdJournaldEvent> T* set_journald_event() {
+    return BeginNestedMessage<T>(132);
   }
 
 
@@ -12631,17 +13049,17 @@ class TracePacket : public ::protozero::Message {
     ::protozero::proto_utils::FieldMetadata<
       42,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
       TracePacket>;
 
   static constexpr FieldMetadata_PreviousPacketDropped kPreviousPacketDropped{};
-  void set_previous_packet_dropped(bool value) {
+  void set_previous_packet_dropped(uint32_t value) {
     static constexpr uint32_t field_id = FieldMetadata_PreviousPacketDropped::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
 
@@ -13051,22 +13469,30 @@ struct DefaultDataSourceTraits {
   static bool ClearIncrementalState(IncrementalStateType*) { return false; }
 };
 
-// Holds the type for a DataSource. Accessed by the static Trace() method
-// fastpaths. This allows redefinitions under a component where a component
-// specific export macro is used.
-// Due to C2086 (redefinition) error on MSVC/clang-cl, internal::DataSourceType
-// can't be a static data member. To avoid explicit specialization after
-// instantiation error, type() needs to be in a template helper class that's
-// instantiated independently from DataSource. See b/280777748.
+// Holds the DataSourceType for a DataSource, accessed by Trace()'s fastpaths.
+// Lives on a separate helper (not as a static member on DataSource) so
+// per-component export macros can redefine it, and because MSVC/clang-cl reject
+// the static-data-member design with a redefinition error (C2086) and an
+// explicit-specialization-after-instantiation error. See b/280777748.
+//
+// type() must be defined out-of-line: defining it in the class body makes it
+// implicitly inline ([dcl.inline]/4), which MSVC then propagates to every
+// explicit specialization from PERFETTO_DEFINE_DATA_SOURCE_STATIC_MEMBERS and
+// silently drops the body (C4506), so callers fail to link with an unresolved
+// external symbol (LNK2019). GCC/Clang are unaffected.
 template <typename DerivedDataSource,
           typename DataSourceTraits = DefaultDataSourceTraits>
 struct DataSourceHelper {
-  static internal::DataSourceType& type() {
-    static perfetto::internal::DataSourceType type_;
-    return type_;
-  }
+  static internal::DataSourceType& type();
 };
 
+template <typename DerivedDataSource, typename DataSourceTraits>
+internal::DataSourceType&
+DataSourceHelper<DerivedDataSource, DataSourceTraits>::type() {
+  static perfetto::internal::DataSourceType type_;
+  return type_;
+}
+
 // Templated base class meant to be derived by embedders to create a custom data
 // source. DerivedDataSource must be the type of the derived class itself, e.g.:
 // class MyDataSource : public DataSource<MyDataSource> {...}.
@@ -13086,6 +13512,12 @@ class DataSource : public DataSourceBase {
   constexpr static BufferExhaustedPolicy kBufferExhaustedPolicy =
       BufferExhaustedPolicy::kDrop;
 
+  // Returns the effective buffer exhausted policy. Derived classes can
+  // override this to provide a runtime value (e.g. from TracingInitArgs).
+  static BufferExhaustedPolicy GetDefaultBufferExhaustedPolicy() {
+    return DerivedDataSource::kBufferExhaustedPolicy;
+  }
+
   // Whether the kBufferExhaustedPolicy policy above is overridable via config.
   constexpr static bool kBufferExhaustedPolicyConfigurable = false;
 
@@ -13312,7 +13744,7 @@ class DataSource : public DataSourceBase {
     params.supports_multiple_instances =
         DerivedDataSource::kSupportsMultipleInstances;
     params.default_buffer_exhausted_policy =
-        DerivedDataSource::kBufferExhaustedPolicy;
+        DerivedDataSource::GetDefaultBufferExhaustedPolicy();
     params.buffer_exhausted_policy_configurable =
         DerivedDataSource::kBufferExhaustedPolicyConfigurable;
     return Helper::type().Register(
@@ -17143,8 +17575,8 @@ class PERFETTO_EXPORT_COMPONENT ThreadDescriptor : public ::protozero::CppMessag
   void set_pid(int32_t value) { pid_ = value; _has_field_.set(1); }
 
   bool has_tid() const { return _has_field_[2]; }
-  int32_t tid() const { return tid_; }
-  void set_tid(int32_t value) { tid_ = value; _has_field_.set(2); }
+  int64_t tid() const { return tid_; }
+  void set_tid(int64_t value) { tid_ = value; _has_field_.set(2); }
 
   bool has_thread_name() const { return _has_field_[5]; }
   const std::string& thread_name() const { return thread_name_; }
@@ -17172,7 +17604,7 @@ class PERFETTO_EXPORT_COMPONENT ThreadDescriptor : public ::protozero::CppMessag
 
  private:
   int32_t pid_{};
-  int32_t tid_{};
+  int64_t tid_{};
   std::string thread_name_{};
   ThreadDescriptor_ChromeThreadType chrome_thread_type_{};
   int64_t reference_timestamp_us_{};
@@ -17303,7 +17735,7 @@ class ThreadDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIE
   bool has_pid() const { return at<1>().valid(); }
   int32_t pid() const { return at<1>().as_int32(); }
   bool has_tid() const { return at<2>().valid(); }
-  int32_t tid() const { return at<2>().as_int32(); }
+  int64_t tid() const { return at<2>().as_int64(); }
   bool has_thread_name() const { return at<5>().valid(); }
   ::protozero::ConstChars thread_name() const { return at<5>().as_string(); }
   bool has_chrome_thread_type() const { return at<4>().valid(); }
@@ -17375,17 +17807,17 @@ class ThreadDescriptor : public ::protozero::Message {
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
       ThreadDescriptor>;
 
   static constexpr FieldMetadata_Tid kTid{};
-  void set_tid(int32_t value) {
+  void set_tid(int64_t value) {
     static constexpr uint32_t field_id = FieldMetadata_Tid::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
         ::Append(*this, field_id, value);
   }
 
@@ -17527,6 +17959,7 @@ namespace perfetto {
 namespace protos {
 namespace gen {
 class TrackDescriptor;
+class StateDescriptor;
 class CounterDescriptor;
 class ChromeThreadDescriptor;
 class ThreadDescriptor;
@@ -17534,6 +17967,8 @@ class ChromeProcessDescriptor;
 class ProcessDescriptor;
 enum TrackDescriptor_ChildTracksOrdering : int;
 enum TrackDescriptor_SiblingMergeBehavior : int;
+enum TrackDescriptor_ProcessOrdering : int;
+enum TrackDescriptor_ThreadOrdering : int;
 enum CounterDescriptor_BuiltinCounterType : int;
 enum CounterDescriptor_Unit : int;
 enum ThreadDescriptor_ChromeThreadType : int;
@@ -17561,6 +17996,14 @@ enum TrackDescriptor_SiblingMergeBehavior : int {
   TrackDescriptor_SiblingMergeBehavior_SIBLING_MERGE_BEHAVIOR_NONE = 2,
   TrackDescriptor_SiblingMergeBehavior_SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY = 3,
 };
+enum TrackDescriptor_ProcessOrdering : int {
+  TrackDescriptor_ProcessOrdering_PROCESS_ORDERING_UNSPECIFIED = 0,
+  TrackDescriptor_ProcessOrdering_PROCESS_ORDERING_EXPLICIT = 1,
+};
+enum TrackDescriptor_ThreadOrdering : int {
+  TrackDescriptor_ThreadOrdering_THREAD_ORDERING_UNSPECIFIED = 0,
+  TrackDescriptor_ThreadOrdering_THREAD_ORDERING_EXPLICIT = 1,
+};
 
 class PERFETTO_EXPORT_COMPONENT TrackDescriptor : public ::protozero::CppMessageObj {
  public:
@@ -17578,6 +18021,16 @@ class PERFETTO_EXPORT_COMPONENT TrackDescriptor : public ::protozero::CppMessage
   static constexpr auto SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY = TrackDescriptor_SiblingMergeBehavior_SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY;
   static constexpr auto SiblingMergeBehavior_MIN = TrackDescriptor_SiblingMergeBehavior_SIBLING_MERGE_BEHAVIOR_UNSPECIFIED;
   static constexpr auto SiblingMergeBehavior_MAX = TrackDescriptor_SiblingMergeBehavior_SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY;
+  using ProcessOrdering = TrackDescriptor_ProcessOrdering;
+  static constexpr auto PROCESS_ORDERING_UNSPECIFIED = TrackDescriptor_ProcessOrdering_PROCESS_ORDERING_UNSPECIFIED;
+  static constexpr auto PROCESS_ORDERING_EXPLICIT = TrackDescriptor_ProcessOrdering_PROCESS_ORDERING_EXPLICIT;
+  static constexpr auto ProcessOrdering_MIN = TrackDescriptor_ProcessOrdering_PROCESS_ORDERING_UNSPECIFIED;
+  static constexpr auto ProcessOrdering_MAX = TrackDescriptor_ProcessOrdering_PROCESS_ORDERING_EXPLICIT;
+  using ThreadOrdering = TrackDescriptor_ThreadOrdering;
+  static constexpr auto THREAD_ORDERING_UNSPECIFIED = TrackDescriptor_ThreadOrdering_THREAD_ORDERING_UNSPECIFIED;
+  static constexpr auto THREAD_ORDERING_EXPLICIT = TrackDescriptor_ThreadOrdering_THREAD_ORDERING_EXPLICIT;
+  static constexpr auto ThreadOrdering_MIN = TrackDescriptor_ThreadOrdering_THREAD_ORDERING_UNSPECIFIED;
+  static constexpr auto ThreadOrdering_MAX = TrackDescriptor_ThreadOrdering_THREAD_ORDERING_EXPLICIT;
   enum FieldNumbers {
     kUuidFieldNumber = 1,
     kParentUuidFieldNumber = 5,
@@ -17590,12 +18043,15 @@ class PERFETTO_EXPORT_COMPONENT TrackDescriptor : public ::protozero::CppMessage
     kThreadFieldNumber = 4,
     kChromeThreadFieldNumber = 7,
     kCounterFieldNumber = 8,
+    kStateFieldNumber = 18,
     kDisallowMergingWithSystemTracksFieldNumber = 9,
     kChildOrderingFieldNumber = 11,
     kSiblingOrderRankFieldNumber = 12,
     kSiblingMergeBehaviorFieldNumber = 15,
     kSiblingMergeKeyFieldNumber = 16,
     kSiblingMergeKeyIntFieldNumber = 17,
+    kProcessOrderingFieldNumber = 19,
+    kThreadOrderingFieldNumber = 20,
   };
 
   TrackDescriptor();
@@ -17656,6 +18112,10 @@ class PERFETTO_EXPORT_COMPONENT TrackDescriptor : public ::protozero::CppMessage
   const CounterDescriptor& counter() const { return *counter_; }
   CounterDescriptor* mutable_counter() { _has_field_.set(8); return counter_.get(); }
 
+  bool has_state() const { return _has_field_[18]; }
+  const StateDescriptor& state() const { return *state_; }
+  StateDescriptor* mutable_state() { _has_field_.set(18); return state_.get(); }
+
   bool has_disallow_merging_with_system_tracks() const { return _has_field_[9]; }
   bool disallow_merging_with_system_tracks() const { return disallow_merging_with_system_tracks_; }
   void set_disallow_merging_with_system_tracks(bool value) { disallow_merging_with_system_tracks_ = value; _has_field_.set(9); }
@@ -17680,6 +18140,14 @@ class PERFETTO_EXPORT_COMPONENT TrackDescriptor : public ::protozero::CppMessage
   uint64_t sibling_merge_key_int() const { return sibling_merge_key_int_; }
   void set_sibling_merge_key_int(uint64_t value) { sibling_merge_key_int_ = value; _has_field_.set(17); }
 
+  bool has_process_ordering() const { return _has_field_[19]; }
+  TrackDescriptor_ProcessOrdering process_ordering() const { return process_ordering_; }
+  void set_process_ordering(TrackDescriptor_ProcessOrdering value) { process_ordering_ = value; _has_field_.set(19); }
+
+  bool has_thread_ordering() const { return _has_field_[20]; }
+  TrackDescriptor_ThreadOrdering thread_ordering() const { return thread_ordering_; }
+  void set_thread_ordering(TrackDescriptor_ThreadOrdering value) { thread_ordering_ = value; _has_field_.set(20); }
+
  private:
   uint64_t uuid_{};
   uint64_t parent_uuid_{};
@@ -17692,18 +18160,21 @@ class PERFETTO_EXPORT_COMPONENT TrackDescriptor : public ::protozero::CppMessage
   ::protozero::CopyablePtr<ThreadDescriptor> thread_;
   ::protozero::CopyablePtr<ChromeThreadDescriptor> chrome_thread_;
   ::protozero::CopyablePtr<CounterDescriptor> counter_;
+  ::protozero::CopyablePtr<StateDescriptor> state_;
   bool disallow_merging_with_system_tracks_{};
   TrackDescriptor_ChildTracksOrdering child_ordering_{};
   int32_t sibling_order_rank_{};
   TrackDescriptor_SiblingMergeBehavior sibling_merge_behavior_{};
   std::string sibling_merge_key_{};
   uint64_t sibling_merge_key_int_{};
+  TrackDescriptor_ProcessOrdering process_ordering_{};
+  TrackDescriptor_ThreadOrdering thread_ordering_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<18> _has_field_{};
+  std::bitset<21> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -17733,15 +18204,24 @@ class ChromeProcessDescriptor;
 class ChromeThreadDescriptor;
 class CounterDescriptor;
 class ProcessDescriptor;
+class StateDescriptor;
 class ThreadDescriptor;
 namespace perfetto_pbzero_enum_TrackDescriptor {
 enum ChildTracksOrdering : int32_t;
 }  // namespace perfetto_pbzero_enum_TrackDescriptor
 using TrackDescriptor_ChildTracksOrdering = perfetto_pbzero_enum_TrackDescriptor::ChildTracksOrdering;
 namespace perfetto_pbzero_enum_TrackDescriptor {
+enum ProcessOrdering : int32_t;
+}  // namespace perfetto_pbzero_enum_TrackDescriptor
+using TrackDescriptor_ProcessOrdering = perfetto_pbzero_enum_TrackDescriptor::ProcessOrdering;
+namespace perfetto_pbzero_enum_TrackDescriptor {
 enum SiblingMergeBehavior : int32_t;
 }  // namespace perfetto_pbzero_enum_TrackDescriptor
 using TrackDescriptor_SiblingMergeBehavior = perfetto_pbzero_enum_TrackDescriptor::SiblingMergeBehavior;
+namespace perfetto_pbzero_enum_TrackDescriptor {
+enum ThreadOrdering : int32_t;
+}  // namespace perfetto_pbzero_enum_TrackDescriptor
+using TrackDescriptor_ThreadOrdering = perfetto_pbzero_enum_TrackDescriptor::ThreadOrdering;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -17816,7 +18296,57 @@ const char* TrackDescriptor_SiblingMergeBehavior_Name(::perfetto::protos::pbzero
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class TrackDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/17> {
+namespace perfetto_pbzero_enum_TrackDescriptor {
+enum ProcessOrdering : int32_t {
+  PROCESS_ORDERING_UNSPECIFIED = 0,
+  PROCESS_ORDERING_EXPLICIT = 1,
+};
+} // namespace perfetto_pbzero_enum_TrackDescriptor
+using TrackDescriptor_ProcessOrdering = perfetto_pbzero_enum_TrackDescriptor::ProcessOrdering;
+
+
+constexpr TrackDescriptor_ProcessOrdering TrackDescriptor_ProcessOrdering_MIN = TrackDescriptor_ProcessOrdering::PROCESS_ORDERING_UNSPECIFIED;
+constexpr TrackDescriptor_ProcessOrdering TrackDescriptor_ProcessOrdering_MAX = TrackDescriptor_ProcessOrdering::PROCESS_ORDERING_EXPLICIT;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* TrackDescriptor_ProcessOrdering_Name(::perfetto::protos::pbzero::TrackDescriptor_ProcessOrdering value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::TrackDescriptor_ProcessOrdering::PROCESS_ORDERING_UNSPECIFIED:
+    return "PROCESS_ORDERING_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::TrackDescriptor_ProcessOrdering::PROCESS_ORDERING_EXPLICIT:
+    return "PROCESS_ORDERING_EXPLICIT";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+namespace perfetto_pbzero_enum_TrackDescriptor {
+enum ThreadOrdering : int32_t {
+  THREAD_ORDERING_UNSPECIFIED = 0,
+  THREAD_ORDERING_EXPLICIT = 1,
+};
+} // namespace perfetto_pbzero_enum_TrackDescriptor
+using TrackDescriptor_ThreadOrdering = perfetto_pbzero_enum_TrackDescriptor::ThreadOrdering;
+
+
+constexpr TrackDescriptor_ThreadOrdering TrackDescriptor_ThreadOrdering_MIN = TrackDescriptor_ThreadOrdering::THREAD_ORDERING_UNSPECIFIED;
+constexpr TrackDescriptor_ThreadOrdering TrackDescriptor_ThreadOrdering_MAX = TrackDescriptor_ThreadOrdering::THREAD_ORDERING_EXPLICIT;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* TrackDescriptor_ThreadOrdering_Name(::perfetto::protos::pbzero::TrackDescriptor_ThreadOrdering value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::TrackDescriptor_ThreadOrdering::THREAD_ORDERING_UNSPECIFIED:
+    return "THREAD_ORDERING_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::TrackDescriptor_ThreadOrdering::THREAD_ORDERING_EXPLICIT:
+    return "THREAD_ORDERING_EXPLICIT";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class TrackDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/20> {
  public:
   TrackDescriptor_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TrackDescriptor_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -17843,6 +18373,8 @@ class TrackDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIEL
   ::protozero::ConstBytes chrome_thread() const { return at<7>().as_bytes(); }
   bool has_counter() const { return at<8>().valid(); }
   ::protozero::ConstBytes counter() const { return at<8>().as_bytes(); }
+  bool has_state() const { return at<18>().valid(); }
+  ::protozero::ConstBytes state() const { return at<18>().as_bytes(); }
   bool has_disallow_merging_with_system_tracks() const { return at<9>().valid(); }
   bool disallow_merging_with_system_tracks() const { return at<9>().as_bool(); }
   bool has_child_ordering() const { return at<11>().valid(); }
@@ -17855,6 +18387,10 @@ class TrackDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIEL
   ::protozero::ConstChars sibling_merge_key() const { return at<16>().as_string(); }
   bool has_sibling_merge_key_int() const { return at<17>().valid(); }
   uint64_t sibling_merge_key_int() const { return at<17>().as_uint64(); }
+  bool has_process_ordering() const { return at<19>().valid(); }
+  int32_t process_ordering() const { return at<19>().as_int32(); }
+  bool has_thread_ordering() const { return at<20>().valid(); }
+  int32_t thread_ordering() const { return at<20>().as_int32(); }
 };
 
 class TrackDescriptor : public ::protozero::Message {
@@ -17872,12 +18408,15 @@ class TrackDescriptor : public ::protozero::Message {
     kThreadFieldNumber = 4,
     kChromeThreadFieldNumber = 7,
     kCounterFieldNumber = 8,
+    kStateFieldNumber = 18,
     kDisallowMergingWithSystemTracksFieldNumber = 9,
     kChildOrderingFieldNumber = 11,
     kSiblingOrderRankFieldNumber = 12,
     kSiblingMergeBehaviorFieldNumber = 15,
     kSiblingMergeKeyFieldNumber = 16,
     kSiblingMergeKeyIntFieldNumber = 17,
+    kProcessOrderingFieldNumber = 19,
+    kThreadOrderingFieldNumber = 20,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TrackDescriptor"; }
 
@@ -17891,6 +18430,16 @@ class TrackDescriptor : public ::protozero::Message {
   static inline const char* SiblingMergeBehavior_Name(SiblingMergeBehavior value) {
     return ::perfetto::protos::pbzero::TrackDescriptor_SiblingMergeBehavior_Name(value);
   }
+
+  using ProcessOrdering = ::perfetto::protos::pbzero::TrackDescriptor_ProcessOrdering;
+  static inline const char* ProcessOrdering_Name(ProcessOrdering value) {
+    return ::perfetto::protos::pbzero::TrackDescriptor_ProcessOrdering_Name(value);
+  }
+
+  using ThreadOrdering = ::perfetto::protos::pbzero::TrackDescriptor_ThreadOrdering;
+  static inline const char* ThreadOrdering_Name(ThreadOrdering value) {
+    return ::perfetto::protos::pbzero::TrackDescriptor_ThreadOrdering_Name(value);
+  }
   static inline const ChildTracksOrdering UNKNOWN = ChildTracksOrdering::UNKNOWN;
   static inline const ChildTracksOrdering LEXICOGRAPHIC = ChildTracksOrdering::LEXICOGRAPHIC;
   static inline const ChildTracksOrdering CHRONOLOGICAL = ChildTracksOrdering::CHRONOLOGICAL;
@@ -17899,6 +18448,10 @@ class TrackDescriptor : public ::protozero::Message {
   static inline const SiblingMergeBehavior SIBLING_MERGE_BEHAVIOR_BY_TRACK_NAME = SiblingMergeBehavior::SIBLING_MERGE_BEHAVIOR_BY_TRACK_NAME;
   static inline const SiblingMergeBehavior SIBLING_MERGE_BEHAVIOR_NONE = SiblingMergeBehavior::SIBLING_MERGE_BEHAVIOR_NONE;
   static inline const SiblingMergeBehavior SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY = SiblingMergeBehavior::SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY;
+  static inline const ProcessOrdering PROCESS_ORDERING_UNSPECIFIED = ProcessOrdering::PROCESS_ORDERING_UNSPECIFIED;
+  static inline const ProcessOrdering PROCESS_ORDERING_EXPLICIT = ProcessOrdering::PROCESS_ORDERING_EXPLICIT;
+  static inline const ThreadOrdering THREAD_ORDERING_UNSPECIFIED = ThreadOrdering::THREAD_ORDERING_UNSPECIFIED;
+  static inline const ThreadOrdering THREAD_ORDERING_EXPLICIT = ThreadOrdering::THREAD_ORDERING_EXPLICIT;
 
   using FieldMetadata_Uuid =
     ::protozero::proto_utils::FieldMetadata<
@@ -18102,6 +18655,20 @@ class TrackDescriptor : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_State =
+    ::protozero::proto_utils::FieldMetadata<
+      18,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StateDescriptor,
+      TrackDescriptor>;
+
+  static constexpr FieldMetadata_State kState{};
+  template <typename T = StateDescriptor> T* set_state() {
+    return BeginNestedMessage<T>(18);
+  }
+
+
   using FieldMetadata_DisallowMergingWithSystemTracks =
     ::protozero::proto_utils::FieldMetadata<
       9,
@@ -18215,6 +18782,42 @@ class TrackDescriptor : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_ProcessOrdering =
+    ::protozero::proto_utils::FieldMetadata<
+      19,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      TrackDescriptor_ProcessOrdering,
+      TrackDescriptor>;
+
+  static constexpr FieldMetadata_ProcessOrdering kProcessOrdering{};
+  void set_process_ordering(TrackDescriptor_ProcessOrdering value) {
+    static constexpr uint32_t field_id = FieldMetadata_ProcessOrdering::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ThreadOrdering =
+    ::protozero::proto_utils::FieldMetadata<
+      20,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      TrackDescriptor_ThreadOrdering,
+      TrackDescriptor>;
+
+  static constexpr FieldMetadata_ThreadOrdering kThreadOrdering{};
+  void set_thread_ordering(TrackDescriptor_ThreadOrdering value) {
+    static constexpr uint32_t field_id = FieldMetadata_ThreadOrdering::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -18340,7 +18943,8 @@ struct PERFETTO_EXPORT_COMPONENT Track {
     // per-proccess and the same pointer value can be used in different
     // processes. If you hit this check but are providing no |parent| track,
     // verify that Tracing::Initialize() was called for the current process.
-    PERFETTO_DCHECK(parent.uuid != Track().uuid);
+    PERFETTO_DCHECK(parent.uuid != Track().uuid ||
+                    MakeProcessTrack().uuid == 0);
 
     return Track(static_cast<uint64_t>(reinterpret_cast<uintptr_t>(ptr)),
                  parent);
@@ -18416,44 +19020,42 @@ struct PERFETTO_EXPORT_COMPONENT ThreadTrack : public Track {
             disallow_merging_with_system_tracks_) {}
 };
 
-// A track that's identified by an explcit name, id and its parent.
-class PERFETTO_EXPORT_COMPONENT NamedTrack : public Track {
-  // A random value mixed into named track uuids to avoid collisions with
-  // other types of tracks.
-  static constexpr uint64_t kNamedTrackMagic = 0xCD571EC5EAD37024ul;
+namespace internal {
 
+// A helper to share functionality between NamedTrack and StateTrack.
+template <typename Derived, uint64_t Magic>
+class NamedTrackBase : public Track {
  public:
   // `name` is hashed to get a uuid identifying the track. Optionally specify
   // `id` to differentiate between multiple tracks with the same `name` and
   // `parent`.
-  NamedTrack(DynamicString name,
-             uint64_t id = 0,
-             Track parent = MakeProcessTrack())
-      : Track(id ^ internal::Fnv1a(name.value, name.length) ^ kNamedTrackMagic,
-              parent),
+  NamedTrackBase(DynamicString name,
+                 uint64_t id = 0,
+                 Track parent = MakeProcessTrack())
+      : Track(id ^ internal::Fnv1a(name.value, name.length) ^ Magic, parent),
         static_name_(nullptr),
         dynamic_name_(name) {}
 
-  constexpr NamedTrack(StaticString name,
-                       uint64_t id = 0,
-                       Track parent = MakeProcessTrack())
-      : Track(id ^ internal::Fnv1a(name.value) ^ kNamedTrackMagic, parent),
+  constexpr NamedTrackBase(StaticString name,
+                           uint64_t id = 0,
+                           Track parent = MakeProcessTrack())
+      : Track(id ^ internal::Fnv1a(name.value) ^ Magic, parent),
         static_name_(name) {}
 
   // Construct a track using `name` and `ptr` as identifier.
   template <class TrackEventName>
-  static NamedTrack FromPointer(TrackEventName&& name,
-                                const void* ptr,
-                                Track parent = MakeProcessTrack()) {
+  static Derived FromPointer(TrackEventName&& name,
+                             const void* ptr,
+                             Track parent = MakeProcessTrack()) {
     // Using pointers as global TrackIds isn't supported as pointers are
     // per-proccess and the same pointer value can be used in different
     // processes. If you hit this check but are providing no |parent| track,
     // verify that Tracing::Initialize() was called for the current process.
-    PERFETTO_DCHECK(parent.uuid != Track().uuid);
-
-    return NamedTrack(std::forward<TrackEventName>(name),
-                      static_cast<uint64_t>(reinterpret_cast<uintptr_t>(ptr)),
-                      parent);
+    PERFETTO_DCHECK(parent.uuid != Track().uuid ||
+                    MakeProcessTrack().uuid == 0);
+    return Derived(std::forward<TrackEventName>(name),
+                   static_cast<uint64_t>(reinterpret_cast<uintptr_t>(ptr)),
+                   parent);
   }
 
   // Construct a track using `name` and `id` as identifier within thread-scope.
@@ -18461,71 +19063,103 @@ class PERFETTO_EXPORT_COMPONENT NamedTrack : public Track {
   // Usage: TRACE_EVENT_BEGIN("...", "...",
   // perfetto::NamedTrack::ThreadScoped("rendering"))
   template <class TrackEventName>
-  static NamedTrack ThreadScoped(TrackEventName&& name,
-                                 uint64_t id = 0,
-                                 Track parent = Track()) {
+  static Derived ThreadScoped(TrackEventName&& name,
+                              uint64_t id = 0,
+                              Track parent = Track()) {
     if (parent.uuid == 0)
-      return NamedTrack(std::forward<TrackEventName>(name), id,
-                        ThreadTrack::Current());
-    return NamedTrack(std::forward<TrackEventName>(name), id, parent);
+      return Derived(std::forward<TrackEventName>(name), id,
+                     ThreadTrack::Current());
+    return Derived(std::forward<TrackEventName>(name), id, parent);
   }
 
   // Same as above using `name` and `ptr` as identifier within thread-scope.
   template <class TrackEventName>
-  static NamedTrack ThreadScoped(TrackEventName&& name,
-                                 const void* ptr,
-                                 Track parent = Track()) {
+  static Derived ThreadScoped(TrackEventName&& name,
+                              const void* ptr,
+                              Track parent = Track()) {
     if (parent.uuid == 0) {
-      return NamedTrack::FromPointer(std::forward<TrackEventName>(name), ptr,
-                                     ThreadTrack::Current());
+      return Derived::FromPointer(std::forward<TrackEventName>(name), ptr,
+                                  ThreadTrack::Current());
     }
-    return NamedTrack::FromPointer(std::forward<TrackEventName>(name), ptr,
-                                   parent);
+    return Derived::FromPointer(std::forward<TrackEventName>(name), ptr,
+                                parent);
   }
 
   template <class TrackEventName>
-  static NamedTrack Global(TrackEventName&& name, uint64_t id = 0) {
-    return NamedTrack(std::forward<TrackEventName>(name), id, Track());
+  static Derived Global(TrackEventName&& name, uint64_t id = 0) {
+    return Derived(std::forward<TrackEventName>(name), id, Track());
+  }
+
+  protos::gen::TrackDescriptor Serialize() const {
+    auto desc = Track::Serialize();
+    if (static_name_) {
+      desc.set_static_name(static_name_.value);
+    } else {
+      desc.set_name(dynamic_name_.value);
+    }
+    return desc;
+  }
+
+  void Serialize(protos::pbzero::TrackDescriptor* desc) const {
+    auto bytes =
+        static_cast<const Derived*>(this)->Serialize().SerializeAsString();
+    desc->AppendRawProtoBytes(bytes.data(), bytes.size());
   }
 
+ protected:
+  StaticString static_name_;
+  DynamicString dynamic_name_;
+};
+
+static constexpr uint64_t kNamedTrackMagic = 0xCD571EC5EAD37024ul;
+static constexpr uint64_t kStateTrackMagic = 0x2E2398EC92E89138ul;
+
+}  // namespace internal
+
+// A track that's identified by an explicit name, id and its parent.
+class PERFETTO_EXPORT_COMPONENT NamedTrack
+    : public internal::NamedTrackBase<NamedTrack, internal::kNamedTrackMagic> {
+ public:
+  using NamedTrackBase::NamedTrackBase;
+  using NamedTrackBase::Serialize;
+
   constexpr NamedTrack disable_sibling_merge() const {
     return NamedTrack(
         *this,
         perfetto::protos::gen::TrackDescriptor::SIBLING_MERGE_BEHAVIOR_NONE,
         nullptr, std::nullopt);
   }
-  constexpr NamedTrack set_sibling_merge_key(const char* key) {
+
+  constexpr NamedTrack set_sibling_merge_key(const char* key) const {
     return NamedTrack(*this,
                       perfetto::protos::gen::TrackDescriptor::
                           SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY,
                       key, std::nullopt);
   }
-  constexpr NamedTrack set_sibling_merge_key(uint64_t key) {
+
+  constexpr NamedTrack set_sibling_merge_key(uint64_t key) const {
     return NamedTrack(*this,
                       perfetto::protos::gen::TrackDescriptor::
                           SIBLING_MERGE_BEHAVIOR_BY_SIBLING_MERGE_KEY,
                       nullptr, key);
   }
 
-  void Serialize(protos::pbzero::TrackDescriptor*) const;
   protos::gen::TrackDescriptor Serialize() const;
 
  private:
+  friend class internal::NamedTrackBase<NamedTrack, internal::kNamedTrackMagic>;
+
   constexpr NamedTrack(
       const NamedTrack& other,
       perfetto::protos::gen::TrackDescriptor::SiblingMergeBehavior
           sibling_merge_behavior,
       const char* sibling_merge_key,
       std::optional<uint64_t> sibling_merge_key_int)
-      : Track(other),
-        static_name_(other.static_name_),
-        dynamic_name_(other.dynamic_name_),
+      : NamedTrackBase(other),
         sibling_merge_behavior_(sibling_merge_behavior),
         sibling_merge_key_(sibling_merge_key),
         sibling_merge_key_int_(std::move(sibling_merge_key_int)) {}
 
-  StaticString static_name_;
-  DynamicString dynamic_name_;
   perfetto::protos::gen::TrackDescriptor::SiblingMergeBehavior
       sibling_merge_behavior_{perfetto::protos::gen::TrackDescriptor::
                                   SIBLING_MERGE_BEHAVIOR_UNSPECIFIED};
@@ -18533,6 +19167,20 @@ class PERFETTO_EXPORT_COMPONENT NamedTrack : public Track {
   std::optional<uint64_t> sibling_merge_key_int_ = std::nullopt;
 };
 
+// A track for recording state values with the TRACE_STATE macro, with similar
+// API as NamedTrack.
+class PERFETTO_EXPORT_COMPONENT StateTrack
+    : public internal::NamedTrackBase<StateTrack, internal::kStateTrackMagic> {
+ public:
+  using NamedTrackBase::NamedTrackBase;
+  using NamedTrackBase::Serialize;
+
+  protos::gen::TrackDescriptor Serialize() const;
+
+ private:
+  friend class internal::NamedTrackBase<StateTrack, internal::kStateTrackMagic>;
+};
+
 // A track for recording counter values with the TRACE_COUNTER macro. Counter
 // tracks can optionally be given units and other metadata. See
 // /protos/perfetto/trace/track_event/counter_descriptor.proto for details.
@@ -18905,8 +19553,6 @@ const char* BuiltinClock_Name(::perfetto::protos::pbzero::BuiltinClock value) {
 namespace perfetto {
 namespace protos {
 namespace pbzero {
-class AndroidJobName;
-class AppWakelockInfo;
 class Callstack;
 class DebugAnnotationName;
 class DebugAnnotationValueTypeName;
@@ -18914,6 +19560,7 @@ class EventCategory;
 class EventName;
 class Frame;
 class HistogramName;
+class InternedGpuCounterDescriptor;
 class InternedGpuRenderStageSpecification;
 class InternedGraphicsContext;
 class InternedString;
@@ -18924,7 +19571,6 @@ class InternedV8String;
 class InternedV8WasmScript;
 class LogMessageBody;
 class Mapping;
-class NetworkPacketContext;
 class SourceLocation;
 class UnsymbolizedSourceLocation;
 } // Namespace pbzero.
@@ -18935,71 +19581,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class AndroidJobName_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  AndroidJobName_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidJobName_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidJobName_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_iid() const { return at<1>().valid(); }
-  uint64_t iid() const { return at<1>().as_uint64(); }
-  bool has_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars name() const { return at<2>().as_string(); }
-};
-
-class AndroidJobName : public ::protozero::Message {
- public:
-  using Decoder = AndroidJobName_Decoder;
-  enum : int32_t {
-    kIidFieldNumber = 1,
-    kNameFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidJobName"; }
-
-
-  using FieldMetadata_Iid =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidJobName>;
-
-  static constexpr FieldMetadata_Iid kIid{};
-  void set_iid(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidJobName>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/46> {
+class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/47> {
  public:
   InternedData_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit InternedData_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -19044,8 +19626,6 @@ class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_I
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> kernel_symbols() const { return GetRepeated<::protozero::ConstBytes>(26); }
   bool has_debug_annotation_string_values() const { return at<29>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> debug_annotation_string_values() const { return GetRepeated<::protozero::ConstBytes>(29); }
-  bool has_packet_context() const { return at<30>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> packet_context() const { return GetRepeated<::protozero::ConstBytes>(30); }
   bool has_v8_js_function_name() const { return at<31>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> v8_js_function_name() const { return GetRepeated<::protozero::ConstBytes>(31); }
   bool has_v8_js_function() const { return at<32>().valid(); }
@@ -19072,12 +19652,10 @@ class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_I
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_content_description() const { return GetRepeated<::protozero::ConstBytes>(45); }
   bool has_viewcapture_text() const { return at<46>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_text() const { return GetRepeated<::protozero::ConstBytes>(46); }
-  bool has_app_wakelock_info() const { return at<42>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> app_wakelock_info() const { return GetRepeated<::protozero::ConstBytes>(42); }
   bool has_correlation_id_str() const { return at<43>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> correlation_id_str() const { return GetRepeated<::protozero::ConstBytes>(43); }
-  bool has_android_job_name() const { return at<44>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> android_job_name() const { return GetRepeated<::protozero::ConstBytes>(44); }
+  bool has_gpu_counter_descriptors() const { return at<47>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> gpu_counter_descriptors() const { return GetRepeated<::protozero::ConstBytes>(47); }
 };
 
 class InternedData : public ::protozero::Message {
@@ -19104,7 +19682,6 @@ class InternedData : public ::protozero::Message {
     kGpuSpecificationsFieldNumber = 24,
     kKernelSymbolsFieldNumber = 26,
     kDebugAnnotationStringValuesFieldNumber = 29,
-    kPacketContextFieldNumber = 30,
     kV8JsFunctionNameFieldNumber = 31,
     kV8JsFunctionFieldNumber = 32,
     kV8JsScriptFieldNumber = 33,
@@ -19118,9 +19695,8 @@ class InternedData : public ::protozero::Message {
     kViewcaptureClassNameFieldNumber = 41,
     kViewcaptureContentDescriptionFieldNumber = 45,
     kViewcaptureTextFieldNumber = 46,
-    kAppWakelockInfoFieldNumber = 42,
     kCorrelationIdStrFieldNumber = 43,
-    kAndroidJobNameFieldNumber = 44,
+    kGpuCounterDescriptorsFieldNumber = 47,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.InternedData"; }
 
@@ -19405,20 +19981,6 @@ class InternedData : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_PacketContext =
-    ::protozero::proto_utils::FieldMetadata<
-      30,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      NetworkPacketContext,
-      InternedData>;
-
-  static constexpr FieldMetadata_PacketContext kPacketContext{};
-  template <typename T = NetworkPacketContext> T* add_packet_context() {
-    return BeginNestedMessage<T>(30);
-  }
-
-
   using FieldMetadata_V8JsFunctionName =
     ::protozero::proto_utils::FieldMetadata<
       31,
@@ -19601,20 +20163,6 @@ class InternedData : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_AppWakelockInfo =
-    ::protozero::proto_utils::FieldMetadata<
-      42,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AppWakelockInfo,
-      InternedData>;
-
-  static constexpr FieldMetadata_AppWakelockInfo kAppWakelockInfo{};
-  template <typename T = AppWakelockInfo> T* add_app_wakelock_info() {
-    return BeginNestedMessage<T>(42);
-  }
-
-
   using FieldMetadata_CorrelationIdStr =
     ::protozero::proto_utils::FieldMetadata<
       43,
@@ -19629,17 +20177,17 @@ class InternedData : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_AndroidJobName =
+  using FieldMetadata_GpuCounterDescriptors =
     ::protozero::proto_utils::FieldMetadata<
-      44,
+      47,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidJobName,
+      InternedGpuCounterDescriptor,
       InternedData>;
 
-  static constexpr FieldMetadata_AndroidJobName kAndroidJobName{};
-  template <typename T = AndroidJobName> T* add_android_job_name() {
-    return BeginNestedMessage<T>(44);
+  static constexpr FieldMetadata_GpuCounterDescriptors kGpuCounterDescriptors{};
+  template <typename T = InternedGpuCounterDescriptor> T* add_gpu_counter_descriptors() {
+    return BeginNestedMessage<T>(47);
   }
 
 };
@@ -20004,6 +20552,13 @@ class PERFETTO_EXPORT_COMPONENT TrackEventInternal {
     disallow_merging_with_system_tracks_ = disallow_merging_with_system_tracks;
   }
 
+  static inline BufferExhaustedPolicy GetBufferExhaustedPolicy() {
+    return buffer_exhausted_policy_;
+  }
+  static inline void SetBufferExhaustedPolicy(BufferExhaustedPolicy policy) {
+    buffer_exhausted_policy_ = policy;
+  }
+
   static int GetSessionCount();
 
   // Represents the default track for the calling thread.
@@ -20037,6 +20592,7 @@ class PERFETTO_EXPORT_COMPONENT TrackEventInternal {
 
   static protos::pbzero::BuiltinClock clock_;
   static bool disallow_merging_with_system_tracks_;
+  static BufferExhaustedPolicy buffer_exhausted_policy_;
 
   std::mutex mu_;
   std::vector<const TrackEventCategoryRegistry*> registries_;
@@ -20576,7 +21132,7 @@ class PERFETTO_EXPORT_COMPONENT EventContext {
   // event() is a template method to allow callers to specify a subclass of
   // TrackEvent instead. Those subclasses correspond to TrackEvent message with
   // application-specific extensions. More information in
-  // design-docs/extensions.md.
+  // docs/instrumentation/extensions.md.
   template <typename EventType = protos::pbzero::TrackEvent>
   EventType* event() const {
     // As the method does downcasting, we check that a target subclass does
@@ -22104,6 +22660,10 @@ class PERFETTO_EXPORT_COMPONENT TrackEventDataSource
  public:
   static constexpr bool kRequiresCallbacksUnderLock = false;
 
+  static BufferExhaustedPolicy GetDefaultBufferExhaustedPolicy() {
+    return TrackEventInternal::GetBufferExhaustedPolicy();
+  }
+
   // DataSource implementation.
   void OnSetup(const DataSourceBase::SetupArgs& args) override {
     auto config_raw = args.config->track_event_config_raw();
@@ -22220,6 +22780,8 @@ class PERFETTO_EXPORT_COMPONENT TrackEventDataSource
 
   static void ResetForTesting() {
     TrackEventInternal::GetInstance().ResetRegistriesForTesting();
+    TrackEventInternal::SetBufferExhaustedPolicy(
+        GetDefaultBufferExhaustedPolicy());
   }
 
  private:
@@ -22231,6 +22793,7 @@ template <const TrackEventCategoryRegistry* Registry>
 class TrackEvent {
  public:
   using TraceContext = TrackEventDataSource::TraceContext;
+
   static bool Register() { return TrackEventDataSource::AddRegistry(Registry); }
 
   // Add or remove a session observer for this track event data source. The
@@ -22328,11 +22891,32 @@ class TrackEvent {
             typename... Arguments>
   static void TraceForCategory(uint32_t instances,
                                const CategoryType& category,
-                               const EventNameType& name,
+                               EventNameType&& name,
                                perfetto::protos::pbzero::TrackEvent::Type type,
                                Arguments&&... args) PERFETTO_ALWAYS_INLINE {
-    TraceForCategoryBody(instances, DecayStrType(category), DecayStrType(name),
-                         type, DecayArgType(args)...);
+    internal::ValidateEventNameType<EventNameType>();
+    TraceForCategoryBody(
+        instances, DecayStrType(category),
+        internal::DecayEventNameType(std::forward<EventNameType>(name)), type,
+        DecayArgType(args)...);
+  }
+
+  // TraceState overloads
+  template <
+      typename CategoryType,
+      typename StateValueType,
+      typename... Args,
+      std::enable_if_t<internal::IsValidEventNameType<StateValueType>, int> = 0>
+  static void TraceState(uint32_t instances,
+                         const CategoryType& category,
+                         StateValueType&& state_value,
+                         const StateTrack& track,
+                         Args&&... args) PERFETTO_ALWAYS_INLINE {
+    TraceForCategoryImplNoTimestamp(
+        instances, DecayStrType(category),
+        DecayEventNameType(std::forward<StateValueType>(state_value)),
+        protos::pbzero::TrackEvent::TYPE_STATE, track,
+        std::forward<Args>(args)...);
   }
 
 #if PERFETTO_ENABLE_LEGACY_TRACE_EVENTS
@@ -22345,15 +22929,17 @@ class TrackEvent {
   static void TraceForCategoryLegacy(
       uint32_t instances,
       const CategoryType& category,
-      const EventNameType& event_name,
+      EventNameType&& event_name,
       perfetto::protos::pbzero::TrackEvent::Type type,
       TrackType&& track,
       char phase,
       uint32_t flags,
       Arguments&&... args) PERFETTO_ALWAYS_INLINE {
-    TraceForCategoryLegacyBody(instances, DecayStrType(category),
-                               DecayStrType(event_name), type, track, phase,
-                               flags, DecayArgType(args)...);
+    internal::ValidateEventNameType<EventNameType>();
+    TraceForCategoryLegacyBody(
+        instances, DecayStrType(category),
+        internal::DecayEventNameType(std::forward<EventNameType>(event_name)),
+        type, track, phase, flags, DecayArgType(args)...);
   }
 
   template <typename TrackType,
@@ -22368,16 +22954,18 @@ class TrackEvent {
   static void TraceForCategoryLegacy(
       uint32_t instances,
       const CategoryType& category,
-      const EventNameType& event_name,
+      EventNameType&& event_name,
       perfetto::protos::pbzero::TrackEvent::Type type,
       TrackType&& track,
       char phase,
       uint32_t flags,
       TimestampType&& timestamp,
       Arguments&&... args) PERFETTO_ALWAYS_INLINE {
-    TraceForCategoryLegacyBody(instances, DecayStrType(category),
-                               DecayStrType(event_name), type, track, phase,
-                               flags, timestamp, DecayArgType(args)...);
+    internal::ValidateEventNameType<EventNameType>();
+    TraceForCategoryLegacyBody(
+        instances, DecayStrType(category),
+        internal::DecayEventNameType(std::forward<EventNameType>(event_name)),
+        type, track, phase, flags, timestamp, DecayArgType(args)...);
   }
 
   template <typename TrackType,
@@ -22391,7 +22979,7 @@ class TrackEvent {
   static void TraceForCategoryLegacyWithId(
       uint32_t instances,
       const CategoryType& category,
-      const EventNameType& event_name,
+      EventNameType&& event_name,
       perfetto::protos::pbzero::TrackEvent::Type type,
       TrackType&& track,
       char phase,
@@ -22399,9 +22987,11 @@ class TrackEvent {
       ThreadIdType thread_id,
       LegacyIdType legacy_id,
       Arguments&&... args) PERFETTO_ALWAYS_INLINE {
+    internal::ValidateEventNameType<EventNameType>();
     TraceForCategoryLegacyWithIdBody(
-        instances, DecayStrType(category), DecayStrType(event_name), type,
-        track, phase, flags, thread_id, legacy_id, DecayArgType(args)...);
+        instances, DecayStrType(category),
+        internal::DecayEventNameType(std::forward<EventNameType>(event_name)),
+        type, track, phase, flags, thread_id, legacy_id, DecayArgType(args)...);
   }
 
   template <typename TrackType,
@@ -22418,7 +23008,7 @@ class TrackEvent {
   static void TraceForCategoryLegacyWithId(
       uint32_t instances,
       const CategoryType& category,
-      const EventNameType& event_name,
+      EventNameType&& event_name,
       perfetto::protos::pbzero::TrackEvent::Type type,
       TrackType&& track,
       char phase,
@@ -22427,10 +23017,12 @@ class TrackEvent {
       LegacyIdType legacy_id,
       TimestampType&& timestamp,
       Arguments&&... args) PERFETTO_ALWAYS_INLINE {
-    TraceForCategoryLegacyWithIdBody(instances, DecayStrType(category),
-                                     DecayStrType(event_name), type, track,
-                                     phase, flags, thread_id, legacy_id,
-                                     timestamp, DecayArgType(args)...);
+    internal::ValidateEventNameType<EventNameType>();
+    TraceForCategoryLegacyWithIdBody(
+        instances, DecayStrType(category),
+        internal::DecayEventNameType(std::forward<EventNameType>(event_name)),
+        type, track, phase, flags, thread_id, legacy_id, timestamp,
+        DecayArgType(args)...);
   }
 #endif
 
@@ -22440,8 +23032,14 @@ class TrackEvent {
     PERFETTO_DCHECK(track.uuid == desc.uuid());
     TrackRegistry::Get()->UpdateTrack(track, desc.SerializeAsString());
     Trace([&](TrackEventDataSource::TraceContext ctx) {
+      auto* incr_state = ctx.GetIncrementalState();
+      // Defer writing the track descriptor until the track actually emits its
+      // first event to avoid polluting the buffer with idle tracks.
+      if (incr_state->seen_tracks.count(track.uuid) == 0) {
+        return;
+      }
       TrackEventInternal::WriteTrackDescriptor(
-          track, ctx.tls_inst_->trace_writer.get(), ctx.GetIncrementalState(),
+          track, ctx.tls_inst_->trace_writer.get(), incr_state,
           *ctx.GetCustomTlsState(), TrackEventInternal::GetTraceTime());
     });
   }
@@ -23144,11 +23742,8 @@ PERFETTO_DECLARE_DATA_SOURCE_STATIC_MEMBERS_WITH_ATTRS(
 
 // Efficiently determines whether tracing is enabled for the given category, and
 // if so, emits one trace event with the given arguments.
-#define PERFETTO_INTERNAL_TRACK_EVENT_WITH_METHOD(method, category, name, ...) \
+#define PERFETTO_INTERNAL_TRACK_EVENT_WITH_METHOD(method, category, ...)       \
   do {                                                                         \
-    /* Double parentheses allow decltype to detect the value category, */      \
-    /* enabling the detection of variables (lvalues) vs temporaries. */        \
-    ::perfetto::internal::ValidateEventNameType<decltype((name))>();           \
     namespace tns = PERFETTO_TRACK_EVENT_NAMESPACE;                            \
     /* Compute the category index outside the lambda to work around a GCC 7 */ \
     /* bug. */                                                                 \
@@ -23163,10 +23758,7 @@ PERFETTO_DECLARE_DATA_SOURCE_STATIC_MEMBERS_WITH_ATTRS(
             category)) {                                                       \
       tns::TrackEvent::CallIfEnabled(                                          \
           [&](uint32_t instances) PERFETTO_NO_THREAD_SAFETY_ANALYSIS {         \
-            tns::TrackEvent::method(                                           \
-                instances, category,                                           \
-                ::perfetto::internal::DecayEventNameType(name),                \
-                ##__VA_ARGS__);                                                \
+            tns::TrackEvent::method(instances, category, ##__VA_ARGS__);       \
           });                                                                  \
     } else {                                                                   \
       tns::TrackEvent::CallIfCategoryEnabled(                                  \
@@ -23176,7 +23768,6 @@ PERFETTO_DECLARE_DATA_SOURCE_STATIC_MEMBERS_WITH_ATTRS(
                 instances,                                                     \
                 PERFETTO_UID(                                                  \
                     kCatIndex_ADD_TO_PERFETTO_DEFINE_CATEGORIES_IF_FAILS_),    \
-                ::perfetto::internal::DecayEventNameType(name),                \
                 ##__VA_ARGS__);                                                \
           });                                                                  \
     }                                                                          \
@@ -23664,6 +24255,13 @@ constexpr bool IsDynamicCategory(const ::perfetto::DynamicCategory&) {
       TraceForCategory, category, name,        \
       ::perfetto::protos::pbzero::TrackEvent::TYPE_SLICE_BEGIN, ##__VA_ARGS__)
 
+// Update the state of a StateTrack.
+// Signatures:
+//   TRACE_STATE(category, state_value, track, ...)
+//   TRACE_STATE(category, state_field, my_value, track, ...)
+#define TRACE_STATE(category, ...) \
+  PERFETTO_INTERNAL_TRACK_EVENT_WITH_METHOD(TraceState, category, ##__VA_ARGS__)
+
 // End a slice under |category|.
 #define TRACE_EVENT_END(category, ...)              \
   PERFETTO_INTERNAL_TRACK_EVENT_WITH_METHOD(        \
@@ -25265,6 +25863,8 @@ class PERFETTO_EXPORT_COMPONENT VmOpSet : public ::protozero::CppMessageObj {
 class PERFETTO_EXPORT_COMPONENT VmOpMerge : public ::protozero::CppMessageObj {
  public:
   enum FieldNumbers {
+    kSkipSubmessagesFieldNumber = 1,
+    kDelIfSrcEmptyFieldNumber = 2,
   };
 
   VmOpMerge();
@@ -25281,13 +25881,23 @@ class PERFETTO_EXPORT_COMPONENT VmOpMerge : public ::protozero::CppMessageObj {
   std::vector<uint8_t> SerializeAsArray() const override;
   void Serialize(::protozero::Message*) const;
 
+  bool has_skip_submessages() const { return _has_field_[1]; }
+  bool skip_submessages() const { return skip_submessages_; }
+  void set_skip_submessages(bool value) { skip_submessages_ = value; _has_field_.set(1); }
+
+  bool has_del_if_src_empty() const { return _has_field_[2]; }
+  bool del_if_src_empty() const { return del_if_src_empty_; }
+  void set_del_if_src_empty(bool value) { del_if_src_empty_ = value; _has_field_.set(2); }
+
  private:
+  bool skip_submessages_{};
+  bool del_if_src_empty_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<2> _has_field_{};
+  std::bitset<3> _has_field_{};
 };
 
 
@@ -26960,10 +27570,12 @@ namespace perfetto {
 namespace protos {
 namespace gen {
 class GpuCounterDescriptor;
+class GpuCounterDescriptor_GpuCounterGroupSpec;
 class GpuCounterDescriptor_GpuCounterBlock;
 class GpuCounterDescriptor_GpuCounterSpec;
 enum GpuCounterDescriptor_GpuCounterGroup : int;
 enum GpuCounterDescriptor_MeasureUnit : int;
+enum GpuCounterDescriptor_GpuCounterSpec_ValueDirection : int;
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -27028,11 +27640,17 @@ enum GpuCounterDescriptor_MeasureUnit : int {
   GpuCounterDescriptor_MeasureUnit_PERCENT = 37,
   GpuCounterDescriptor_MeasureUnit_INSTRUCTION = 40,
 };
+enum GpuCounterDescriptor_GpuCounterSpec_ValueDirection : int {
+  GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_UNSPECIFIED = 0,
+  GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_BACKWARDS_LOOKING = 1,
+  GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_FORWARDS_LOOKING = 2,
+};
 
 class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor : public ::protozero::CppMessageObj {
  public:
   using GpuCounterSpec = GpuCounterDescriptor_GpuCounterSpec;
   using GpuCounterBlock = GpuCounterDescriptor_GpuCounterBlock;
+  using GpuCounterGroupSpec = GpuCounterDescriptor_GpuCounterGroupSpec;
   using GpuCounterGroup = GpuCounterDescriptor_GpuCounterGroup;
   static constexpr auto UNCLASSIFIED = GpuCounterDescriptor_GpuCounterGroup_UNCLASSIFIED;
   static constexpr auto SYSTEM = GpuCounterDescriptor_GpuCounterGroup_SYSTEM;
@@ -27091,9 +27709,12 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor : public ::protozero::CppMe
   enum FieldNumbers {
     kSpecsFieldNumber = 1,
     kBlocksFieldNumber = 2,
+    kCounterGroupsFieldNumber = 6,
     kMinSamplingPeriodNsFieldNumber = 3,
     kMaxSamplingPeriodNsFieldNumber = 4,
     kSupportsInstrumentedSamplingFieldNumber = 5,
+    kSupportsCounterNamesFieldNumber = 7,
+    kSupportsCounterNameGlobsFieldNumber = 8,
   };
 
   GpuCounterDescriptor();
@@ -27122,6 +27743,12 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor : public ::protozero::CppMe
   void clear_blocks();
   GpuCounterDescriptor_GpuCounterBlock* add_blocks();
 
+  const std::vector<GpuCounterDescriptor_GpuCounterGroupSpec>& counter_groups() const { return counter_groups_; }
+  std::vector<GpuCounterDescriptor_GpuCounterGroupSpec>* mutable_counter_groups() { return &counter_groups_; }
+  int counter_groups_size() const;
+  void clear_counter_groups();
+  GpuCounterDescriptor_GpuCounterGroupSpec* add_counter_groups();
+
   bool has_min_sampling_period_ns() const { return _has_field_[3]; }
   uint64_t min_sampling_period_ns() const { return min_sampling_period_ns_; }
   void set_min_sampling_period_ns(uint64_t value) { min_sampling_period_ns_ = value; _has_field_.set(3); }
@@ -27134,18 +27761,85 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor : public ::protozero::CppMe
   bool supports_instrumented_sampling() const { return supports_instrumented_sampling_; }
   void set_supports_instrumented_sampling(bool value) { supports_instrumented_sampling_ = value; _has_field_.set(5); }
 
+  bool has_supports_counter_names() const { return _has_field_[7]; }
+  bool supports_counter_names() const { return supports_counter_names_; }
+  void set_supports_counter_names(bool value) { supports_counter_names_ = value; _has_field_.set(7); }
+
+  bool has_supports_counter_name_globs() const { return _has_field_[8]; }
+  bool supports_counter_name_globs() const { return supports_counter_name_globs_; }
+  void set_supports_counter_name_globs(bool value) { supports_counter_name_globs_ = value; _has_field_.set(8); }
+
  private:
   std::vector<GpuCounterDescriptor_GpuCounterSpec> specs_;
   std::vector<GpuCounterDescriptor_GpuCounterBlock> blocks_;
+  std::vector<GpuCounterDescriptor_GpuCounterGroupSpec> counter_groups_;
   uint64_t min_sampling_period_ns_{};
   uint64_t max_sampling_period_ns_{};
   bool supports_instrumented_sampling_{};
+  bool supports_counter_names_{};
+  bool supports_counter_name_globs_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<6> _has_field_{};
+  std::bitset<9> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor_GpuCounterGroupSpec : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+    kGroupIdFieldNumber = 1,
+    kNameFieldNumber = 2,
+    kDescriptionFieldNumber = 3,
+    kCounterIdsFieldNumber = 4,
+  };
+
+  GpuCounterDescriptor_GpuCounterGroupSpec();
+  ~GpuCounterDescriptor_GpuCounterGroupSpec() override;
+  GpuCounterDescriptor_GpuCounterGroupSpec(GpuCounterDescriptor_GpuCounterGroupSpec&&) noexcept;
+  GpuCounterDescriptor_GpuCounterGroupSpec& operator=(GpuCounterDescriptor_GpuCounterGroupSpec&&);
+  GpuCounterDescriptor_GpuCounterGroupSpec(const GpuCounterDescriptor_GpuCounterGroupSpec&);
+  GpuCounterDescriptor_GpuCounterGroupSpec& operator=(const GpuCounterDescriptor_GpuCounterGroupSpec&);
+  bool operator==(const GpuCounterDescriptor_GpuCounterGroupSpec&) const;
+  bool operator!=(const GpuCounterDescriptor_GpuCounterGroupSpec& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_group_id() const { return _has_field_[1]; }
+  uint32_t group_id() const { return group_id_; }
+  void set_group_id(uint32_t value) { group_id_ = value; _has_field_.set(1); }
+
+  bool has_name() const { return _has_field_[2]; }
+  const std::string& name() const { return name_; }
+  void set_name(const std::string& value) { name_ = value; _has_field_.set(2); }
+
+  bool has_description() const { return _has_field_[3]; }
+  const std::string& description() const { return description_; }
+  void set_description(const std::string& value) { description_ = value; _has_field_.set(3); }
+
+  const std::vector<uint32_t>& counter_ids() const { return counter_ids_; }
+  std::vector<uint32_t>* mutable_counter_ids() { return &counter_ids_; }
+  int counter_ids_size() const { return static_cast<int>(counter_ids_.size()); }
+  void clear_counter_ids() { counter_ids_.clear(); }
+  void add_counter_ids(uint32_t value) { counter_ids_.emplace_back(value); }
+  uint32_t* add_counter_ids() { counter_ids_.emplace_back(); return &counter_ids_.back(); }
+
+ private:
+  uint32_t group_id_{};
+  std::string name_{};
+  std::string description_{};
+  std::vector<uint32_t> counter_ids_;
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<5> _has_field_{};
 };
 
 
@@ -27213,6 +27907,12 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor_GpuCounterBlock : public ::
 
 class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor_GpuCounterSpec : public ::protozero::CppMessageObj {
  public:
+  using ValueDirection = GpuCounterDescriptor_GpuCounterSpec_ValueDirection;
+  static constexpr auto VALUE_DIRECTION_UNSPECIFIED = GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_UNSPECIFIED;
+  static constexpr auto VALUE_DIRECTION_BACKWARDS_LOOKING = GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_BACKWARDS_LOOKING;
+  static constexpr auto VALUE_DIRECTION_FORWARDS_LOOKING = GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_FORWARDS_LOOKING;
+  static constexpr auto ValueDirection_MIN = GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_UNSPECIFIED;
+  static constexpr auto ValueDirection_MAX = GpuCounterDescriptor_GpuCounterSpec_ValueDirection_VALUE_DIRECTION_FORWARDS_LOOKING;
   enum FieldNumbers {
     kCounterIdFieldNumber = 1,
     kNameFieldNumber = 2,
@@ -27223,6 +27923,7 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor_GpuCounterSpec : public ::p
     kDenominatorUnitsFieldNumber = 8,
     kSelectByDefaultFieldNumber = 9,
     kGroupsFieldNumber = 10,
+    kValueDirectionFieldNumber = 11,
   };
 
   GpuCounterDescriptor_GpuCounterSpec();
@@ -27284,6 +27985,10 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor_GpuCounterSpec : public ::p
   void add_groups(GpuCounterDescriptor_GpuCounterGroup value) { groups_.emplace_back(value); }
   GpuCounterDescriptor_GpuCounterGroup* add_groups() { groups_.emplace_back(); return &groups_.back(); }
 
+  bool has_value_direction() const { return _has_field_[11]; }
+  GpuCounterDescriptor_GpuCounterSpec_ValueDirection value_direction() const { return value_direction_; }
+  void set_value_direction(GpuCounterDescriptor_GpuCounterSpec_ValueDirection value) { value_direction_ = value; _has_field_.set(11); }
+
  private:
   uint32_t counter_id_{};
   std::string name_{};
@@ -27294,12 +27999,13 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterDescriptor_GpuCounterSpec : public ::p
   std::vector<GpuCounterDescriptor_MeasureUnit> denominator_units_;
   bool select_by_default_{};
   std::vector<GpuCounterDescriptor_GpuCounterGroup> groups_;
+  GpuCounterDescriptor_GpuCounterSpec_ValueDirection value_direction_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<11> _has_field_{};
+  std::bitset<12> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -27744,6 +28450,7 @@ class PERFETTO_EXPORT_COMPONENT PerfEvents_RawEvent : public ::protozero::CppMes
     kConfigFieldNumber = 2,
     kConfig1FieldNumber = 3,
     kConfig2FieldNumber = 4,
+    kPmuNameFieldNumber = 5,
   };
 
   PerfEvents_RawEvent();
@@ -27776,17 +28483,22 @@ class PERFETTO_EXPORT_COMPONENT PerfEvents_RawEvent : public ::protozero::CppMes
   uint64_t config2() const { return config2_; }
   void set_config2(uint64_t value) { config2_ = value; _has_field_.set(4); }
 
+  bool has_pmu_name() const { return _has_field_[5]; }
+  const std::string& pmu_name() const { return pmu_name_; }
+  void set_pmu_name(const std::string& value) { pmu_name_ = value; _has_field_.set(5); }
+
  private:
   uint32_t type_{};
   uint64_t config_{};
   uint64_t config1_{};
   uint64_t config2_{};
+  std::string pmu_name_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<5> _has_field_{};
+  std::bitset<6> _has_field_{};
 };
 
 
@@ -27992,50 +28704,6 @@ class PERFETTO_EXPORT_COMPONENT PerfEvents_Timebase : public ::protozero::CppMes
 }  // namespace gen
 
 #endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_PERF_EVENTS_PROTO_CPP_H_
-// gen_amalgamated begin header: gen/protos/perfetto/common/protolog_common.gen.h
-// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_PROTOLOG_COMMON_PROTO_CPP_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_PROTOLOG_COMMON_PROTO_CPP_H_
-
-#include <stdint.h>
-#include <bitset>
-#include <vector>
-#include <string>
-#include <type_traits>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/cpp_message_obj.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/copyable_ptr.h"
-// gen_amalgamated expanded: #include "perfetto/base/export.h"
-
-namespace perfetto {
-namespace protos {
-namespace gen {
-enum ProtoLogLevel : int;
-}  // namespace perfetto
-}  // namespace protos
-}  // namespace gen
-
-namespace protozero {
-class Message;
-}  // namespace protozero
-
-namespace perfetto {
-namespace protos {
-namespace gen {
-enum ProtoLogLevel : int {
-  PROTOLOG_LEVEL_UNDEFINED = 0,
-  PROTOLOG_LEVEL_DEBUG = 1,
-  PROTOLOG_LEVEL_VERBOSE = 2,
-  PROTOLOG_LEVEL_INFO = 3,
-  PROTOLOG_LEVEL_WARN = 4,
-  PROTOLOG_LEVEL_ERROR = 5,
-  PROTOLOG_LEVEL_WTF = 6,
-};
-}  // namespace perfetto
-}  // namespace protos
-}  // namespace gen
-
-#endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_PROTOLOG_COMMON_PROTO_CPP_H_
 // gen_amalgamated begin header: gen/protos/perfetto/common/sys_stats_counters.gen.h
 // DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
 #ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_SYS_STATS_COUNTERS_PROTO_CPP_H_
@@ -28355,6 +29023,7 @@ class PERFETTO_EXPORT_COMPONENT SystemInfo : public ::protozero::CppMessageObj {
     kTimezoneOffMinsFieldNumber = 7,
     kHzFieldNumber = 3,
     kSystemRamBytesFieldNumber = 16,
+    kMachineNameFieldNumber = 17,
   };
 
   SystemInfo();
@@ -28435,6 +29104,10 @@ class PERFETTO_EXPORT_COMPONENT SystemInfo : public ::protozero::CppMessageObj {
   uint64_t system_ram_bytes() const { return system_ram_bytes_; }
   void set_system_ram_bytes(uint64_t value) { system_ram_bytes_ = value; _has_field_.set(16); }
 
+  bool has_machine_name() const { return _has_field_[17]; }
+  const std::string& machine_name() const { return machine_name_; }
+  void set_machine_name(const std::string& value) { machine_name_ = value; _has_field_.set(17); }
+
  private:
   ::protozero::CopyablePtr<Utsname> utsname_;
   std::string android_build_fingerprint_{};
@@ -28452,12 +29125,13 @@ class PERFETTO_EXPORT_COMPONENT SystemInfo : public ::protozero::CppMessageObj {
   int32_t timezone_off_mins_{};
   int64_t hz_{};
   uint64_t system_ram_bytes_{};
+  std::string machine_name_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<17> _has_field_{};
+  std::bitset<18> _has_field_{};
 };
 
 
@@ -28518,6 +29192,127 @@ class PERFETTO_EXPORT_COMPONENT Utsname : public ::protozero::CppMessageObj {
 }  // namespace gen
 
 #endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_SYSTEM_INFO_PROTO_CPP_H_
+// gen_amalgamated begin header: gen/protos/perfetto/common/trace_attributes.gen.h
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_TRACE_ATTRIBUTES_PROTO_CPP_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_TRACE_ATTRIBUTES_PROTO_CPP_H_
+
+#include <stdint.h>
+#include <bitset>
+#include <vector>
+#include <string>
+#include <type_traits>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/cpp_message_obj.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/copyable_ptr.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+class TraceAttributes;
+class TraceAttributes_Attribute;
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+namespace protozero {
+class Message;
+}  // namespace protozero
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+class PERFETTO_EXPORT_COMPONENT TraceAttributes : public ::protozero::CppMessageObj {
+ public:
+  using Attribute = TraceAttributes_Attribute;
+  enum FieldNumbers {
+    kAttributeFieldNumber = 1,
+  };
+
+  TraceAttributes();
+  ~TraceAttributes() override;
+  TraceAttributes(TraceAttributes&&) noexcept;
+  TraceAttributes& operator=(TraceAttributes&&);
+  TraceAttributes(const TraceAttributes&);
+  TraceAttributes& operator=(const TraceAttributes&);
+  bool operator==(const TraceAttributes&) const;
+  bool operator!=(const TraceAttributes& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  const std::vector<TraceAttributes_Attribute>& attribute() const { return attribute_; }
+  std::vector<TraceAttributes_Attribute>* mutable_attribute() { return &attribute_; }
+  int attribute_size() const;
+  void clear_attribute();
+  TraceAttributes_Attribute* add_attribute();
+
+ private:
+  std::vector<TraceAttributes_Attribute> attribute_;
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<2> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT TraceAttributes_Attribute : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+    kKeyFieldNumber = 1,
+    kLongValueFieldNumber = 2,
+    kStringValueFieldNumber = 3,
+  };
+
+  TraceAttributes_Attribute();
+  ~TraceAttributes_Attribute() override;
+  TraceAttributes_Attribute(TraceAttributes_Attribute&&) noexcept;
+  TraceAttributes_Attribute& operator=(TraceAttributes_Attribute&&);
+  TraceAttributes_Attribute(const TraceAttributes_Attribute&);
+  TraceAttributes_Attribute& operator=(const TraceAttributes_Attribute&);
+  bool operator==(const TraceAttributes_Attribute&) const;
+  bool operator!=(const TraceAttributes_Attribute& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_key() const { return _has_field_[1]; }
+  const std::string& key() const { return key_; }
+  void set_key(const std::string& value) { key_ = value; _has_field_.set(1); }
+
+  bool has_long_value() const { return _has_field_[2]; }
+  int64_t long_value() const { return long_value_; }
+  void set_long_value(int64_t value) { long_value_ = value; _has_field_.set(2); }
+
+  bool has_string_value() const { return _has_field_[3]; }
+  const std::string& string_value() const { return string_value_; }
+  void set_string_value(const std::string& value) { string_value_ = value; _has_field_.set(3); }
+
+ private:
+  std::string key_{};
+  int64_t long_value_{};
+  std::string string_value_{};
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<4> _has_field_{};
+};
+
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+#endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_TRACE_ATTRIBUTES_PROTO_CPP_H_
 // gen_amalgamated begin header: gen/protos/perfetto/common/trace_stats.gen.h
 // DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
 #ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_TRACE_STATS_PROTO_CPP_H_
@@ -29429,6 +30224,8 @@ class PERFETTO_EXPORT_COMPONENT TracingServiceState_Producer : public ::protozer
     kUidFieldNumber = 3,
     kSdkVersionFieldNumber = 4,
     kFrozenFieldNumber = 6,
+    kMachineIdFieldNumber = 7,
+    kMachineNameFieldNumber = 8,
   };
 
   TracingServiceState_Producer();
@@ -29469,6 +30266,14 @@ class PERFETTO_EXPORT_COMPONENT TracingServiceState_Producer : public ::protozer
   bool frozen() const { return frozen_; }
   void set_frozen(bool value) { frozen_ = value; _has_field_.set(6); }
 
+  bool has_machine_id() const { return _has_field_[7]; }
+  uint32_t machine_id() const { return machine_id_; }
+  void set_machine_id(uint32_t value) { machine_id_ = value; _has_field_.set(7); }
+
+  bool has_machine_name() const { return _has_field_[8]; }
+  const std::string& machine_name() const { return machine_name_; }
+  void set_machine_name(const std::string& value) { machine_name_ = value; _has_field_.set(8); }
+
  private:
   int32_t id_{};
   std::string name_{};
@@ -29476,12 +30281,14 @@ class PERFETTO_EXPORT_COMPONENT TracingServiceState_Producer : public ::protozer
   int32_t uid_{};
   std::string sdk_version_{};
   bool frozen_{};
+  uint32_t machine_id_{};
+  std::string machine_name_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<7> _has_field_{};
+  std::bitset<9> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -29736,18 +30543,62 @@ class VmOpSet : public ::protozero::Message {
 
 };
 
-class VmOpMerge_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/0> {
+class VmOpMerge_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
   VmOpMerge_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit VmOpMerge_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
   explicit VmOpMerge_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_skip_submessages() const { return at<1>().valid(); }
+  bool skip_submessages() const { return at<1>().as_bool(); }
+  bool has_del_if_src_empty() const { return at<2>().valid(); }
+  bool del_if_src_empty() const { return at<2>().as_bool(); }
 };
 
 class VmOpMerge : public ::protozero::Message {
  public:
   using Decoder = VmOpMerge_Decoder;
+  enum : int32_t {
+    kSkipSubmessagesFieldNumber = 1,
+    kDelIfSrcEmptyFieldNumber = 2,
+  };
   static constexpr const char* GetName() { return ".perfetto.protos.VmOpMerge"; }
 
+
+  using FieldMetadata_SkipSubmessages =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      VmOpMerge>;
+
+  static constexpr FieldMetadata_SkipSubmessages kSkipSubmessages{};
+  void set_skip_submessages(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_SkipSubmessages::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_DelIfSrcEmpty =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      VmOpMerge>;
+
+  static constexpr FieldMetadata_DelIfSrcEmpty kDelIfSrcEmpty{};
+  void set_del_if_src_empty(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DelIfSrcEmpty::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class VmOpRegLoad_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
@@ -32750,11 +33601,16 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 class GpuCounterDescriptor_GpuCounterBlock;
+class GpuCounterDescriptor_GpuCounterGroupSpec;
 class GpuCounterDescriptor_GpuCounterSpec;
 namespace perfetto_pbzero_enum_GpuCounterDescriptor {
 enum GpuCounterGroup : int32_t;
 }  // namespace perfetto_pbzero_enum_GpuCounterDescriptor
 using GpuCounterDescriptor_GpuCounterGroup = perfetto_pbzero_enum_GpuCounterDescriptor::GpuCounterGroup;
+namespace perfetto_pbzero_enum_GpuCounterDescriptor_GpuCounterSpec {
+enum ValueDirection : int32_t;
+}  // namespace perfetto_pbzero_enum_GpuCounterDescriptor_GpuCounterSpec
+using GpuCounterDescriptor_GpuCounterSpec_ValueDirection = perfetto_pbzero_enum_GpuCounterDescriptor_GpuCounterSpec::ValueDirection;
 namespace perfetto_pbzero_enum_GpuCounterDescriptor {
 enum MeasureUnit : int32_t;
 }  // namespace perfetto_pbzero_enum_GpuCounterDescriptor
@@ -32997,7 +33853,36 @@ const char* GpuCounterDescriptor_MeasureUnit_Name(::perfetto::protos::pbzero::Gp
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class GpuCounterDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+namespace perfetto_pbzero_enum_GpuCounterDescriptor_GpuCounterSpec {
+enum ValueDirection : int32_t {
+  VALUE_DIRECTION_UNSPECIFIED = 0,
+  VALUE_DIRECTION_BACKWARDS_LOOKING = 1,
+  VALUE_DIRECTION_FORWARDS_LOOKING = 2,
+};
+} // namespace perfetto_pbzero_enum_GpuCounterDescriptor_GpuCounterSpec
+using GpuCounterDescriptor_GpuCounterSpec_ValueDirection = perfetto_pbzero_enum_GpuCounterDescriptor_GpuCounterSpec::ValueDirection;
+
+
+constexpr GpuCounterDescriptor_GpuCounterSpec_ValueDirection GpuCounterDescriptor_GpuCounterSpec_ValueDirection_MIN = GpuCounterDescriptor_GpuCounterSpec_ValueDirection::VALUE_DIRECTION_UNSPECIFIED;
+constexpr GpuCounterDescriptor_GpuCounterSpec_ValueDirection GpuCounterDescriptor_GpuCounterSpec_ValueDirection_MAX = GpuCounterDescriptor_GpuCounterSpec_ValueDirection::VALUE_DIRECTION_FORWARDS_LOOKING;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* GpuCounterDescriptor_GpuCounterSpec_ValueDirection_Name(::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterSpec_ValueDirection value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterSpec_ValueDirection::VALUE_DIRECTION_UNSPECIFIED:
+    return "VALUE_DIRECTION_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterSpec_ValueDirection::VALUE_DIRECTION_BACKWARDS_LOOKING:
+    return "VALUE_DIRECTION_BACKWARDS_LOOKING";
+
+  case ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterSpec_ValueDirection::VALUE_DIRECTION_FORWARDS_LOOKING:
+    return "VALUE_DIRECTION_FORWARDS_LOOKING";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class GpuCounterDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
  public:
   GpuCounterDescriptor_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit GpuCounterDescriptor_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -33006,12 +33891,18 @@ class GpuCounterDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> specs() const { return GetRepeated<::protozero::ConstBytes>(1); }
   bool has_blocks() const { return at<2>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> blocks() const { return GetRepeated<::protozero::ConstBytes>(2); }
+  bool has_counter_groups() const { return at<6>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> counter_groups() const { return GetRepeated<::protozero::ConstBytes>(6); }
   bool has_min_sampling_period_ns() const { return at<3>().valid(); }
   uint64_t min_sampling_period_ns() const { return at<3>().as_uint64(); }
   bool has_max_sampling_period_ns() const { return at<4>().valid(); }
   uint64_t max_sampling_period_ns() const { return at<4>().as_uint64(); }
   bool has_supports_instrumented_sampling() const { return at<5>().valid(); }
   bool supports_instrumented_sampling() const { return at<5>().as_bool(); }
+  bool has_supports_counter_names() const { return at<7>().valid(); }
+  bool supports_counter_names() const { return at<7>().as_bool(); }
+  bool has_supports_counter_name_globs() const { return at<8>().valid(); }
+  bool supports_counter_name_globs() const { return at<8>().as_bool(); }
 };
 
 class GpuCounterDescriptor : public ::protozero::Message {
@@ -33020,14 +33911,18 @@ class GpuCounterDescriptor : public ::protozero::Message {
   enum : int32_t {
     kSpecsFieldNumber = 1,
     kBlocksFieldNumber = 2,
+    kCounterGroupsFieldNumber = 6,
     kMinSamplingPeriodNsFieldNumber = 3,
     kMaxSamplingPeriodNsFieldNumber = 4,
     kSupportsInstrumentedSamplingFieldNumber = 5,
+    kSupportsCounterNamesFieldNumber = 7,
+    kSupportsCounterNameGlobsFieldNumber = 8,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.GpuCounterDescriptor"; }
 
   using GpuCounterSpec = ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterSpec;
   using GpuCounterBlock = ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterBlock;
+  using GpuCounterGroupSpec = ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterGroupSpec;
 
   using GpuCounterGroup = ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterGroup;
   static inline const char* GpuCounterGroup_Name(GpuCounterGroup value) {
@@ -33116,6 +34011,20 @@ class GpuCounterDescriptor : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_CounterGroups =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuCounterDescriptor_GpuCounterGroupSpec,
+      GpuCounterDescriptor>;
+
+  static constexpr FieldMetadata_CounterGroups kCounterGroups{};
+  template <typename T = GpuCounterDescriptor_GpuCounterGroupSpec> T* add_counter_groups() {
+    return BeginNestedMessage<T>(6);
+  }
+
+
   using FieldMetadata_MinSamplingPeriodNs =
     ::protozero::proto_utils::FieldMetadata<
       3,
@@ -33169,6 +34078,154 @@ class GpuCounterDescriptor : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_SupportsCounterNames =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      GpuCounterDescriptor>;
+
+  static constexpr FieldMetadata_SupportsCounterNames kSupportsCounterNames{};
+  void set_supports_counter_names(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_SupportsCounterNames::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SupportsCounterNameGlobs =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      GpuCounterDescriptor>;
+
+  static constexpr FieldMetadata_SupportsCounterNameGlobs kSupportsCounterNameGlobs{};
+  void set_supports_counter_name_globs(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_SupportsCounterNameGlobs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class GpuCounterDescriptor_GpuCounterGroupSpec_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  GpuCounterDescriptor_GpuCounterGroupSpec_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuCounterDescriptor_GpuCounterGroupSpec_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuCounterDescriptor_GpuCounterGroupSpec_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_group_id() const { return at<1>().valid(); }
+  uint32_t group_id() const { return at<1>().as_uint32(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+  bool has_description() const { return at<3>().valid(); }
+  ::protozero::ConstChars description() const { return at<3>().as_string(); }
+  bool has_counter_ids() const { return at<4>().valid(); }
+  ::protozero::RepeatedFieldIterator<uint32_t> counter_ids() const { return GetRepeated<uint32_t>(4); }
+};
+
+class GpuCounterDescriptor_GpuCounterGroupSpec : public ::protozero::Message {
+ public:
+  using Decoder = GpuCounterDescriptor_GpuCounterGroupSpec_Decoder;
+  enum : int32_t {
+    kGroupIdFieldNumber = 1,
+    kNameFieldNumber = 2,
+    kDescriptionFieldNumber = 3,
+    kCounterIdsFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuCounterDescriptor.GpuCounterGroupSpec"; }
+
+
+  using FieldMetadata_GroupId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuCounterDescriptor_GpuCounterGroupSpec>;
+
+  static constexpr FieldMetadata_GroupId kGroupId{};
+  void set_group_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_GroupId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuCounterDescriptor_GpuCounterGroupSpec>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Description =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuCounterDescriptor_GpuCounterGroupSpec>;
+
+  static constexpr FieldMetadata_Description kDescription{};
+  void set_description(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Description::kFieldId, data, size);
+  }
+  void set_description(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Description::kFieldId, chars.data, chars.size);
+  }
+  void set_description(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Description::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_CounterIds =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuCounterDescriptor_GpuCounterGroupSpec>;
+
+  static constexpr FieldMetadata_CounterIds kCounterIds{};
+  void add_counter_ids(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_CounterIds::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class GpuCounterDescriptor_GpuCounterBlock_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
@@ -33304,7 +34361,7 @@ class GpuCounterDescriptor_GpuCounterBlock : public ::protozero::Message {
   }
 };
 
-class GpuCounterDescriptor_GpuCounterSpec_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
+class GpuCounterDescriptor_GpuCounterSpec_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/11> {
  public:
   GpuCounterDescriptor_GpuCounterSpec_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit GpuCounterDescriptor_GpuCounterSpec_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -33327,6 +34384,8 @@ class GpuCounterDescriptor_GpuCounterSpec_Decoder : public ::protozero::TypedPro
   bool select_by_default() const { return at<9>().as_bool(); }
   bool has_groups() const { return at<10>().valid(); }
   ::protozero::RepeatedFieldIterator<int32_t> groups() const { return GetRepeated<int32_t>(10); }
+  bool has_value_direction() const { return at<11>().valid(); }
+  int32_t value_direction() const { return at<11>().as_int32(); }
 };
 
 class GpuCounterDescriptor_GpuCounterSpec : public ::protozero::Message {
@@ -33342,10 +34401,19 @@ class GpuCounterDescriptor_GpuCounterSpec : public ::protozero::Message {
     kDenominatorUnitsFieldNumber = 8,
     kSelectByDefaultFieldNumber = 9,
     kGroupsFieldNumber = 10,
+    kValueDirectionFieldNumber = 11,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.GpuCounterDescriptor.GpuCounterSpec"; }
 
 
+  using ValueDirection = ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterSpec_ValueDirection;
+  static inline const char* ValueDirection_Name(ValueDirection value) {
+    return ::perfetto::protos::pbzero::GpuCounterDescriptor_GpuCounterSpec_ValueDirection_Name(value);
+  }
+  static inline const ValueDirection VALUE_DIRECTION_UNSPECIFIED = ValueDirection::VALUE_DIRECTION_UNSPECIFIED;
+  static inline const ValueDirection VALUE_DIRECTION_BACKWARDS_LOOKING = ValueDirection::VALUE_DIRECTION_BACKWARDS_LOOKING;
+  static inline const ValueDirection VALUE_DIRECTION_FORWARDS_LOOKING = ValueDirection::VALUE_DIRECTION_FORWARDS_LOOKING;
+
   using FieldMetadata_CounterId =
     ::protozero::proto_utils::FieldMetadata<
       1,
@@ -33519,6 +34587,24 @@ class GpuCounterDescriptor_GpuCounterSpec : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_ValueDirection =
+    ::protozero::proto_utils::FieldMetadata<
+      11,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      GpuCounterDescriptor_GpuCounterSpec_ValueDirection,
+      GpuCounterDescriptor_GpuCounterSpec>;
+
+  static constexpr FieldMetadata_ValueDirection kValueDirection{};
+  void set_value_direction(GpuCounterDescriptor_GpuCounterSpec_ValueDirection value) {
+    static constexpr uint32_t field_id = FieldMetadata_ValueDirection::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -34413,7 +35499,7 @@ class PerfEvents : public ::protozero::Message {
   static inline const EventModifier EVENT_MODIFIER_COUNT_HYPERVISOR = EventModifier::EVENT_MODIFIER_COUNT_HYPERVISOR;
 };
 
-class PerfEvents_RawEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+class PerfEvents_RawEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
  public:
   PerfEvents_RawEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit PerfEvents_RawEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -34426,6 +35512,8 @@ class PerfEvents_RawEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_
   uint64_t config1() const { return at<3>().as_uint64(); }
   bool has_config2() const { return at<4>().valid(); }
   uint64_t config2() const { return at<4>().as_uint64(); }
+  bool has_pmu_name() const { return at<5>().valid(); }
+  ::protozero::ConstChars pmu_name() const { return at<5>().as_string(); }
 };
 
 class PerfEvents_RawEvent : public ::protozero::Message {
@@ -34436,6 +35524,7 @@ class PerfEvents_RawEvent : public ::protozero::Message {
     kConfigFieldNumber = 2,
     kConfig1FieldNumber = 3,
     kConfig2FieldNumber = 4,
+    kPmuNameFieldNumber = 5,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.PerfEvents.RawEvent"; }
 
@@ -34511,6 +35600,30 @@ class PerfEvents_RawEvent : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_PmuName =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      PerfEvents_RawEvent>;
+
+  static constexpr FieldMetadata_PmuName kPmuName{};
+  void set_pmu_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_PmuName::kFieldId, data, size);
+  }
+  void set_pmu_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_PmuName::kFieldId, chars.data, chars.size);
+  }
+  void set_pmu_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_PmuName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class PerfEvents_Tracepoint_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
@@ -34786,71 +35899,6 @@ class PerfEvents_Timebase : public ::protozero::Message {
   }
 };
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/common/protolog_common.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_PROTOLOG_COMMON_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_PROTOLOG_COMMON_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-enum ProtoLogLevel : int32_t {
-  PROTOLOG_LEVEL_UNDEFINED = 0,
-  PROTOLOG_LEVEL_DEBUG = 1,
-  PROTOLOG_LEVEL_VERBOSE = 2,
-  PROTOLOG_LEVEL_INFO = 3,
-  PROTOLOG_LEVEL_WARN = 4,
-  PROTOLOG_LEVEL_ERROR = 5,
-  PROTOLOG_LEVEL_WTF = 6,
-};
-
-constexpr ProtoLogLevel ProtoLogLevel_MIN = ProtoLogLevel::PROTOLOG_LEVEL_UNDEFINED;
-constexpr ProtoLogLevel ProtoLogLevel_MAX = ProtoLogLevel::PROTOLOG_LEVEL_WTF;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* ProtoLogLevel_Name(::perfetto::protos::pbzero::ProtoLogLevel value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_UNDEFINED:
-    return "PROTOLOG_LEVEL_UNDEFINED";
-
-  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_DEBUG:
-    return "PROTOLOG_LEVEL_DEBUG";
-
-  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_VERBOSE:
-    return "PROTOLOG_LEVEL_VERBOSE";
-
-  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_INFO:
-    return "PROTOLOG_LEVEL_INFO";
-
-  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_WARN:
-    return "PROTOLOG_LEVEL_WARN";
-
-  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_ERROR:
-    return "PROTOLOG_LEVEL_ERROR";
-
-  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_WTF:
-    return "PROTOLOG_LEVEL_WTF";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -35844,7 +36892,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class SystemInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/16> {
+class SystemInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/17> {
  public:
   SystemInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit SystemInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -35881,6 +36929,8 @@ class SystemInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=
   int64_t hz() const { return at<3>().as_int64(); }
   bool has_system_ram_bytes() const { return at<16>().valid(); }
   uint64_t system_ram_bytes() const { return at<16>().as_uint64(); }
+  bool has_machine_name() const { return at<17>().valid(); }
+  ::protozero::ConstChars machine_name() const { return at<17>().as_string(); }
 };
 
 class SystemInfo : public ::protozero::Message {
@@ -35903,6 +36953,7 @@ class SystemInfo : public ::protozero::Message {
     kTimezoneOffMinsFieldNumber = 7,
     kHzFieldNumber = 3,
     kSystemRamBytesFieldNumber = 16,
+    kMachineNameFieldNumber = 17,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.SystemInfo"; }
 
@@ -36244,6 +37295,30 @@ class SystemInfo : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_MachineName =
+    ::protozero::proto_utils::FieldMetadata<
+      17,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemInfo>;
+
+  static constexpr FieldMetadata_MachineName kMachineName{};
+  void set_machine_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_MachineName::kFieldId, data, size);
+  }
+  void set_machine_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_MachineName::kFieldId, chars.data, chars.size);
+  }
+  void set_machine_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_MachineName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class Utsname_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
@@ -36370,6 +37445,162 @@ class Utsname : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/common/trace_attributes.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_TRACE_ATTRIBUTES_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_TRACE_ATTRIBUTES_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class TraceAttributes_Attribute;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class TraceAttributes_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  TraceAttributes_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceAttributes_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceAttributes_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_attribute() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> attribute() const { return GetRepeated<::protozero::ConstBytes>(1); }
+};
+
+class TraceAttributes : public ::protozero::Message {
+ public:
+  using Decoder = TraceAttributes_Decoder;
+  enum : int32_t {
+    kAttributeFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceAttributes"; }
+
+  using Attribute = ::perfetto::protos::pbzero::TraceAttributes_Attribute;
+
+  using FieldMetadata_Attribute =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TraceAttributes_Attribute,
+      TraceAttributes>;
+
+  static constexpr FieldMetadata_Attribute kAttribute{};
+  template <typename T = TraceAttributes_Attribute> T* add_attribute() {
+    return BeginNestedMessage<T>(1);
+  }
+
+};
+
+class TraceAttributes_Attribute_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  TraceAttributes_Attribute_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceAttributes_Attribute_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceAttributes_Attribute_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_key() const { return at<1>().valid(); }
+  ::protozero::ConstChars key() const { return at<1>().as_string(); }
+  bool has_long_value() const { return at<2>().valid(); }
+  int64_t long_value() const { return at<2>().as_int64(); }
+  bool has_string_value() const { return at<3>().valid(); }
+  ::protozero::ConstChars string_value() const { return at<3>().as_string(); }
+};
+
+class TraceAttributes_Attribute : public ::protozero::Message {
+ public:
+  using Decoder = TraceAttributes_Attribute_Decoder;
+  enum : int32_t {
+    kKeyFieldNumber = 1,
+    kLongValueFieldNumber = 2,
+    kStringValueFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceAttributes.Attribute"; }
+
+
+  using FieldMetadata_Key =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceAttributes_Attribute>;
+
+  static constexpr FieldMetadata_Key kKey{};
+  void set_key(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Key::kFieldId, data, size);
+  }
+  void set_key(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Key::kFieldId, chars.data, chars.size);
+  }
+  void set_key(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_LongValue =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      TraceAttributes_Attribute>;
+
+  static constexpr FieldMetadata_LongValue kLongValue{};
+  void set_long_value(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_LongValue::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_StringValue =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceAttributes_Attribute>;
+
+  static constexpr FieldMetadata_StringValue kStringValue{};
+  void set_string_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_StringValue::kFieldId, data, size);
+  }
+  void set_string_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_StringValue::kFieldId, chars.data, chars.size);
+  }
+  void set_string_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_StringValue::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -38307,7 +39538,7 @@ class TracingServiceState_DataSource : public ::protozero::Message {
   }
 };
 
-class TracingServiceState_Producer_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
+class TracingServiceState_Producer_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
  public:
   TracingServiceState_Producer_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TracingServiceState_Producer_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -38324,6 +39555,10 @@ class TracingServiceState_Producer_Decoder : public ::protozero::TypedProtoDecod
   ::protozero::ConstChars sdk_version() const { return at<4>().as_string(); }
   bool has_frozen() const { return at<6>().valid(); }
   bool frozen() const { return at<6>().as_bool(); }
+  bool has_machine_id() const { return at<7>().valid(); }
+  uint32_t machine_id() const { return at<7>().as_uint32(); }
+  bool has_machine_name() const { return at<8>().valid(); }
+  ::protozero::ConstChars machine_name() const { return at<8>().as_string(); }
 };
 
 class TracingServiceState_Producer : public ::protozero::Message {
@@ -38336,6 +39571,8 @@ class TracingServiceState_Producer : public ::protozero::Message {
     kUidFieldNumber = 3,
     kSdkVersionFieldNumber = 4,
     kFrozenFieldNumber = 6,
+    kMachineIdFieldNumber = 7,
+    kMachineNameFieldNumber = 8,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TracingServiceState.Producer"; }
 
@@ -38459,6 +39696,48 @@ class TracingServiceState_Producer : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_MachineId =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TracingServiceState_Producer>;
+
+  static constexpr FieldMetadata_MachineId kMachineId{};
+  void set_machine_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MachineId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MachineName =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TracingServiceState_Producer>;
+
+  static constexpr FieldMetadata_MachineName kMachineName{};
+  void set_machine_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_MachineName::kFieldId, data, size);
+  }
+  void set_machine_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_MachineName::kFieldId, chars.data, chars.size);
+  }
+  void set_machine_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_MachineName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -38667,6 +39946,76 @@ enum SemanticType : int {
 }  // namespace gen
 
 #endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_COMMON_SEMANTIC_TYPE_PROTO_CPP_H_
+// gen_amalgamated begin header: gen/protos/perfetto/config/android/android_aflags_config.gen.h
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_ANDROID_AFLAGS_CONFIG_PROTO_CPP_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_ANDROID_AFLAGS_CONFIG_PROTO_CPP_H_
+
+#include <stdint.h>
+#include <bitset>
+#include <vector>
+#include <string>
+#include <type_traits>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/cpp_message_obj.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/copyable_ptr.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+class AndroidAflagsConfig;
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+namespace protozero {
+class Message;
+}  // namespace protozero
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+class PERFETTO_EXPORT_COMPONENT AndroidAflagsConfig : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+    kPollMsFieldNumber = 1,
+  };
+
+  AndroidAflagsConfig();
+  ~AndroidAflagsConfig() override;
+  AndroidAflagsConfig(AndroidAflagsConfig&&) noexcept;
+  AndroidAflagsConfig& operator=(AndroidAflagsConfig&&);
+  AndroidAflagsConfig(const AndroidAflagsConfig&);
+  AndroidAflagsConfig& operator=(const AndroidAflagsConfig&);
+  bool operator==(const AndroidAflagsConfig&) const;
+  bool operator!=(const AndroidAflagsConfig& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_poll_ms() const { return _has_field_[1]; }
+  uint32_t poll_ms() const { return poll_ms_; }
+  void set_poll_ms(uint32_t value) { poll_ms_ = value; _has_field_.set(1); }
+
+ private:
+  uint32_t poll_ms_{};
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<2> _has_field_{};
+};
+
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+#endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_ANDROID_AFLAGS_CONFIG_PROTO_CPP_H_
 // gen_amalgamated begin header: gen/protos/perfetto/config/android/android_game_intervention_list_config.gen.h
 // DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
 #ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_ANDROID_GAME_INTERVENTION_LIST_CONFIG_PROTO_CPP_H_
@@ -38802,6 +40151,7 @@ class PERFETTO_EXPORT_COMPONENT AndroidInputEventConfig : public ::protozero::Cp
     kRulesFieldNumber = 2,
     kTraceDispatcherInputEventsFieldNumber = 3,
     kTraceDispatcherWindowDispatchFieldNumber = 4,
+    kTraceEvdevEventsFieldNumber = 5,
   };
 
   AndroidInputEventConfig();
@@ -38836,17 +40186,22 @@ class PERFETTO_EXPORT_COMPONENT AndroidInputEventConfig : public ::protozero::Cp
   bool trace_dispatcher_window_dispatch() const { return trace_dispatcher_window_dispatch_; }
   void set_trace_dispatcher_window_dispatch(bool value) { trace_dispatcher_window_dispatch_ = value; _has_field_.set(4); }
 
+  bool has_trace_evdev_events() const { return _has_field_[5]; }
+  bool trace_evdev_events() const { return trace_evdev_events_; }
+  void set_trace_evdev_events(bool value) { trace_evdev_events_ = value; _has_field_.set(5); }
+
  private:
   AndroidInputEventConfig_TraceMode mode_{};
   std::vector<AndroidInputEventConfig_TraceRule> rules_;
   bool trace_dispatcher_input_events_{};
   bool trace_dispatcher_window_dispatch_{};
+  bool trace_evdev_events_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<5> _has_field_{};
+  std::bitset<6> _has_field_{};
 };
 
 
@@ -39401,6 +40756,106 @@ class PERFETTO_EXPORT_COMPONENT CpuPerUidConfig : public ::protozero::CppMessage
 }  // namespace gen
 
 #endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_CPU_PER_UID_CONFIG_PROTO_CPP_H_
+// gen_amalgamated begin header: gen/protos/perfetto/config/android/display_video_config.gen.h
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_DISPLAY_VIDEO_CONFIG_PROTO_CPP_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_DISPLAY_VIDEO_CONFIG_PROTO_CPP_H_
+
+#include <stdint.h>
+#include <bitset>
+#include <vector>
+#include <string>
+#include <type_traits>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/cpp_message_obj.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/copyable_ptr.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+class DisplayVideoConfig;
+enum DisplayVideoConfig_Format : int;
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+namespace protozero {
+class Message;
+}  // namespace protozero
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+enum DisplayVideoConfig_Format : int {
+  DisplayVideoConfig_Format_FORMAT_UNSPECIFIED = 0,
+  DisplayVideoConfig_Format_FORMAT_H264 = 1,
+  DisplayVideoConfig_Format_FORMAT_HEVC = 2,
+};
+
+class PERFETTO_EXPORT_COMPONENT DisplayVideoConfig : public ::protozero::CppMessageObj {
+ public:
+  using Format = DisplayVideoConfig_Format;
+  static constexpr auto FORMAT_UNSPECIFIED = DisplayVideoConfig_Format_FORMAT_UNSPECIFIED;
+  static constexpr auto FORMAT_H264 = DisplayVideoConfig_Format_FORMAT_H264;
+  static constexpr auto FORMAT_HEVC = DisplayVideoConfig_Format_FORMAT_HEVC;
+  static constexpr auto Format_MIN = DisplayVideoConfig_Format_FORMAT_UNSPECIFIED;
+  static constexpr auto Format_MAX = DisplayVideoConfig_Format_FORMAT_HEVC;
+  enum FieldNumbers {
+    kScaleFieldNumber = 1,
+    kFormatFieldNumber = 2,
+    kKeyFrameIntervalSecsFieldNumber = 3,
+    kMaxStreamSizeBytesFieldNumber = 4,
+  };
+
+  DisplayVideoConfig();
+  ~DisplayVideoConfig() override;
+  DisplayVideoConfig(DisplayVideoConfig&&) noexcept;
+  DisplayVideoConfig& operator=(DisplayVideoConfig&&);
+  DisplayVideoConfig(const DisplayVideoConfig&);
+  DisplayVideoConfig& operator=(const DisplayVideoConfig&);
+  bool operator==(const DisplayVideoConfig&) const;
+  bool operator!=(const DisplayVideoConfig& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_scale() const { return _has_field_[1]; }
+  float scale() const { return scale_; }
+  void set_scale(float value) { scale_ = value; _has_field_.set(1); }
+
+  bool has_format() const { return _has_field_[2]; }
+  DisplayVideoConfig_Format format() const { return format_; }
+  void set_format(DisplayVideoConfig_Format value) { format_ = value; _has_field_.set(2); }
+
+  bool has_key_frame_interval_secs() const { return _has_field_[3]; }
+  uint32_t key_frame_interval_secs() const { return key_frame_interval_secs_; }
+  void set_key_frame_interval_secs(uint32_t value) { key_frame_interval_secs_ = value; _has_field_.set(3); }
+
+  bool has_max_stream_size_bytes() const { return _has_field_[4]; }
+  uint64_t max_stream_size_bytes() const { return max_stream_size_bytes_; }
+  void set_max_stream_size_bytes(uint64_t value) { max_stream_size_bytes_ = value; _has_field_.set(4); }
+
+ private:
+  float scale_{};
+  DisplayVideoConfig_Format format_{};
+  uint32_t key_frame_interval_secs_{};
+  uint64_t max_stream_size_bytes_{};
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<5> _has_field_{};
+};
+
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+#endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_DISPLAY_VIDEO_CONFIG_PROTO_CPP_H_
 // gen_amalgamated begin header: gen/protos/perfetto/config/android/inputmethod_config.gen.h
 // DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
 #ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_INPUTMETHOD_CONFIG_PROTO_CPP_H_
@@ -39688,6 +41143,7 @@ class PERFETTO_EXPORT_COMPONENT PackagesListConfig : public ::protozero::CppMess
  public:
   enum FieldNumbers {
     kPackageNameFilterFieldNumber = 1,
+    kPackageNameRegexFilterFieldNumber = 3,
     kOnlyWriteOnCpuUseEveryMsFieldNumber = 2,
   };
 
@@ -39712,19 +41168,27 @@ class PERFETTO_EXPORT_COMPONENT PackagesListConfig : public ::protozero::CppMess
   void add_package_name_filter(std::string value) { package_name_filter_.emplace_back(value); }
   std::string* add_package_name_filter() { package_name_filter_.emplace_back(); return &package_name_filter_.back(); }
 
+  const std::vector<std::string>& package_name_regex_filter() const { return package_name_regex_filter_; }
+  std::vector<std::string>* mutable_package_name_regex_filter() { return &package_name_regex_filter_; }
+  int package_name_regex_filter_size() const { return static_cast<int>(package_name_regex_filter_.size()); }
+  void clear_package_name_regex_filter() { package_name_regex_filter_.clear(); }
+  void add_package_name_regex_filter(std::string value) { package_name_regex_filter_.emplace_back(value); }
+  std::string* add_package_name_regex_filter() { package_name_regex_filter_.emplace_back(); return &package_name_regex_filter_.back(); }
+
   bool has_only_write_on_cpu_use_every_ms() const { return _has_field_[2]; }
   uint32_t only_write_on_cpu_use_every_ms() const { return only_write_on_cpu_use_every_ms_; }
   void set_only_write_on_cpu_use_every_ms(uint32_t value) { only_write_on_cpu_use_every_ms_ = value; _has_field_.set(2); }
 
  private:
   std::vector<std::string> package_name_filter_;
+  std::vector<std::string> package_name_regex_filter_;
   uint32_t only_write_on_cpu_use_every_ms_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<3> _has_field_{};
+  std::bitset<4> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -39865,6 +41329,15 @@ class Message;
 namespace perfetto {
 namespace protos {
 namespace gen {
+enum ProtoLogLevel : int {
+  PROTOLOG_LEVEL_UNDEFINED = 0,
+  PROTOLOG_LEVEL_DEBUG = 1,
+  PROTOLOG_LEVEL_VERBOSE = 2,
+  PROTOLOG_LEVEL_INFO = 3,
+  PROTOLOG_LEVEL_WARN = 4,
+  PROTOLOG_LEVEL_ERROR = 5,
+  PROTOLOG_LEVEL_WTF = 6,
+};
 enum ProtoLogConfig_TracingMode : int {
   ProtoLogConfig_TracingMode_DEFAULT = 0,
   ProtoLogConfig_TracingMode_ENABLE_ALL = 1,
@@ -40013,6 +41486,7 @@ enum SurfaceFlingerLayersConfig_Mode : int {
   SurfaceFlingerLayersConfig_Mode_MODE_GENERATED = 2,
   SurfaceFlingerLayersConfig_Mode_MODE_DUMP = 3,
   SurfaceFlingerLayersConfig_Mode_MODE_GENERATED_BUGREPORT_ONLY = 4,
+  SurfaceFlingerLayersConfig_Mode_MODE_PROTOVM = 5,
 };
 enum SurfaceFlingerLayersConfig_TraceFlag : int {
   SurfaceFlingerLayersConfig_TraceFlag_TRACE_FLAG_UNSPECIFIED = 0,
@@ -40033,8 +41507,9 @@ class PERFETTO_EXPORT_COMPONENT SurfaceFlingerLayersConfig : public ::protozero:
   static constexpr auto MODE_GENERATED = SurfaceFlingerLayersConfig_Mode_MODE_GENERATED;
   static constexpr auto MODE_DUMP = SurfaceFlingerLayersConfig_Mode_MODE_DUMP;
   static constexpr auto MODE_GENERATED_BUGREPORT_ONLY = SurfaceFlingerLayersConfig_Mode_MODE_GENERATED_BUGREPORT_ONLY;
+  static constexpr auto MODE_PROTOVM = SurfaceFlingerLayersConfig_Mode_MODE_PROTOVM;
   static constexpr auto Mode_MIN = SurfaceFlingerLayersConfig_Mode_MODE_UNSPECIFIED;
-  static constexpr auto Mode_MAX = SurfaceFlingerLayersConfig_Mode_MODE_GENERATED_BUGREPORT_ONLY;
+  static constexpr auto Mode_MAX = SurfaceFlingerLayersConfig_Mode_MODE_PROTOVM;
   using TraceFlag = SurfaceFlingerLayersConfig_TraceFlag;
   static constexpr auto TRACE_FLAG_UNSPECIFIED = SurfaceFlingerLayersConfig_TraceFlag_TRACE_FLAG_UNSPECIFIED;
   static constexpr auto TRACE_FLAG_INPUT = SurfaceFlingerLayersConfig_TraceFlag_TRACE_FLAG_INPUT;
@@ -40268,6 +41743,7 @@ namespace gen {
 class WindowManagerConfig;
 enum WindowManagerConfig_LogFrequency : int;
 enum WindowManagerConfig_LogLevel : int;
+enum WindowManagerConfig_LogMode : int;
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -40291,6 +41767,11 @@ enum WindowManagerConfig_LogLevel : int {
   WindowManagerConfig_LogLevel_LOG_LEVEL_DEBUG = 2,
   WindowManagerConfig_LogLevel_LOG_LEVEL_CRITICAL = 3,
 };
+enum WindowManagerConfig_LogMode : int {
+  WindowManagerConfig_LogMode_LOG_MODE_UNSPECIFIED = 0,
+  WindowManagerConfig_LogMode_LOG_MODE_FULL_STATE = 1,
+  WindowManagerConfig_LogMode_LOG_MODE_INCREMENTAL = 2,
+};
 
 class PERFETTO_EXPORT_COMPONENT WindowManagerConfig : public ::protozero::CppMessageObj {
  public:
@@ -40308,9 +41789,16 @@ class PERFETTO_EXPORT_COMPONENT WindowManagerConfig : public ::protozero::CppMes
   static constexpr auto LOG_LEVEL_CRITICAL = WindowManagerConfig_LogLevel_LOG_LEVEL_CRITICAL;
   static constexpr auto LogLevel_MIN = WindowManagerConfig_LogLevel_LOG_LEVEL_UNSPECIFIED;
   static constexpr auto LogLevel_MAX = WindowManagerConfig_LogLevel_LOG_LEVEL_CRITICAL;
+  using LogMode = WindowManagerConfig_LogMode;
+  static constexpr auto LOG_MODE_UNSPECIFIED = WindowManagerConfig_LogMode_LOG_MODE_UNSPECIFIED;
+  static constexpr auto LOG_MODE_FULL_STATE = WindowManagerConfig_LogMode_LOG_MODE_FULL_STATE;
+  static constexpr auto LOG_MODE_INCREMENTAL = WindowManagerConfig_LogMode_LOG_MODE_INCREMENTAL;
+  static constexpr auto LogMode_MIN = WindowManagerConfig_LogMode_LOG_MODE_UNSPECIFIED;
+  static constexpr auto LogMode_MAX = WindowManagerConfig_LogMode_LOG_MODE_INCREMENTAL;
   enum FieldNumbers {
     kLogFrequencyFieldNumber = 1,
     kLogLevelFieldNumber = 2,
+    kLogModeFieldNumber = 3,
   };
 
   WindowManagerConfig();
@@ -40335,15 +41823,20 @@ class PERFETTO_EXPORT_COMPONENT WindowManagerConfig : public ::protozero::CppMes
   WindowManagerConfig_LogLevel log_level() const { return log_level_; }
   void set_log_level(WindowManagerConfig_LogLevel value) { log_level_ = value; _has_field_.set(2); }
 
+  bool has_log_mode() const { return _has_field_[3]; }
+  WindowManagerConfig_LogMode log_mode() const { return log_mode_; }
+  void set_log_mode(WindowManagerConfig_LogMode value) { log_mode_ = value; _has_field_.set(3); }
+
  private:
   WindowManagerConfig_LogFrequency log_frequency_{};
   WindowManagerConfig_LogLevel log_level_{};
+  WindowManagerConfig_LogMode log_mode_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<3> _has_field_{};
+  std::bitset<4> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -41004,6 +42497,10 @@ namespace perfetto {
 namespace protos {
 namespace gen {
 class GpuCounterConfig;
+class GpuCounterConfig_InstrumentedSamplingConfig;
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange;
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter;
+enum GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase : int;
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -41015,13 +42512,21 @@ class Message;
 namespace perfetto {
 namespace protos {
 namespace gen {
+enum GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase : int {
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_MANGLED_KERNEL_NAME = 0,
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_DEMANGLED_KERNEL_NAME = 1,
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_FUNCTION_NAME = 2,
+};
 
 class PERFETTO_EXPORT_COMPONENT GpuCounterConfig : public ::protozero::CppMessageObj {
  public:
+  using InstrumentedSamplingConfig = GpuCounterConfig_InstrumentedSamplingConfig;
   enum FieldNumbers {
     kCounterPeriodNsFieldNumber = 1,
     kCounterIdsFieldNumber = 2,
+    kCounterNamesFieldNumber = 6,
     kInstrumentedSamplingFieldNumber = 3,
+    kInstrumentedSamplingConfigFieldNumber = 5,
     kFixGpuClockFieldNumber = 4,
   };
 
@@ -41050,10 +42555,21 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterConfig : public ::protozero::CppMessag
   void add_counter_ids(uint32_t value) { counter_ids_.emplace_back(value); }
   uint32_t* add_counter_ids() { counter_ids_.emplace_back(); return &counter_ids_.back(); }
 
+  const std::vector<std::string>& counter_names() const { return counter_names_; }
+  std::vector<std::string>* mutable_counter_names() { return &counter_names_; }
+  int counter_names_size() const { return static_cast<int>(counter_names_.size()); }
+  void clear_counter_names() { counter_names_.clear(); }
+  void add_counter_names(std::string value) { counter_names_.emplace_back(value); }
+  std::string* add_counter_names() { counter_names_.emplace_back(); return &counter_names_.back(); }
+
   bool has_instrumented_sampling() const { return _has_field_[3]; }
   bool instrumented_sampling() const { return instrumented_sampling_; }
   void set_instrumented_sampling(bool value) { instrumented_sampling_ = value; _has_field_.set(3); }
 
+  bool has_instrumented_sampling_config() const { return _has_field_[5]; }
+  const GpuCounterConfig_InstrumentedSamplingConfig& instrumented_sampling_config() const { return *instrumented_sampling_config_; }
+  GpuCounterConfig_InstrumentedSamplingConfig* mutable_instrumented_sampling_config() { _has_field_.set(5); return instrumented_sampling_config_.get(); }
+
   bool has_fix_gpu_clock() const { return _has_field_[4]; }
   bool fix_gpu_clock() const { return fix_gpu_clock_; }
   void set_fix_gpu_clock(bool value) { fix_gpu_clock_ = value; _has_field_.set(4); }
@@ -41061,14 +42577,169 @@ class PERFETTO_EXPORT_COMPONENT GpuCounterConfig : public ::protozero::CppMessag
  private:
   uint64_t counter_period_ns_{};
   std::vector<uint32_t> counter_ids_;
+  std::vector<std::string> counter_names_;
   bool instrumented_sampling_{};
+  ::protozero::CopyablePtr<GpuCounterConfig_InstrumentedSamplingConfig> instrumented_sampling_config_;
   bool fix_gpu_clock_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<5> _has_field_{};
+  std::bitset<7> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT GpuCounterConfig_InstrumentedSamplingConfig : public ::protozero::CppMessageObj {
+ public:
+  using ActivityNameFilter = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter;
+  using ActivityRange = GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange;
+  enum FieldNumbers {
+    kActivityNameFiltersFieldNumber = 3,
+    kActivityTxIncludeGlobsFieldNumber = 6,
+    kActivityTxExcludeGlobsFieldNumber = 7,
+    kActivityRangesFieldNumber = 5,
+  };
+
+  GpuCounterConfig_InstrumentedSamplingConfig();
+  ~GpuCounterConfig_InstrumentedSamplingConfig() override;
+  GpuCounterConfig_InstrumentedSamplingConfig(GpuCounterConfig_InstrumentedSamplingConfig&&) noexcept;
+  GpuCounterConfig_InstrumentedSamplingConfig& operator=(GpuCounterConfig_InstrumentedSamplingConfig&&);
+  GpuCounterConfig_InstrumentedSamplingConfig(const GpuCounterConfig_InstrumentedSamplingConfig&);
+  GpuCounterConfig_InstrumentedSamplingConfig& operator=(const GpuCounterConfig_InstrumentedSamplingConfig&);
+  bool operator==(const GpuCounterConfig_InstrumentedSamplingConfig&) const;
+  bool operator!=(const GpuCounterConfig_InstrumentedSamplingConfig& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  const std::vector<GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter>& activity_name_filters() const { return activity_name_filters_; }
+  std::vector<GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter>* mutable_activity_name_filters() { return &activity_name_filters_; }
+  int activity_name_filters_size() const;
+  void clear_activity_name_filters();
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter* add_activity_name_filters();
+
+  const std::vector<std::string>& activity_tx_include_globs() const { return activity_tx_include_globs_; }
+  std::vector<std::string>* mutable_activity_tx_include_globs() { return &activity_tx_include_globs_; }
+  int activity_tx_include_globs_size() const { return static_cast<int>(activity_tx_include_globs_.size()); }
+  void clear_activity_tx_include_globs() { activity_tx_include_globs_.clear(); }
+  void add_activity_tx_include_globs(std::string value) { activity_tx_include_globs_.emplace_back(value); }
+  std::string* add_activity_tx_include_globs() { activity_tx_include_globs_.emplace_back(); return &activity_tx_include_globs_.back(); }
+
+  const std::vector<std::string>& activity_tx_exclude_globs() const { return activity_tx_exclude_globs_; }
+  std::vector<std::string>* mutable_activity_tx_exclude_globs() { return &activity_tx_exclude_globs_; }
+  int activity_tx_exclude_globs_size() const { return static_cast<int>(activity_tx_exclude_globs_.size()); }
+  void clear_activity_tx_exclude_globs() { activity_tx_exclude_globs_.clear(); }
+  void add_activity_tx_exclude_globs(std::string value) { activity_tx_exclude_globs_.emplace_back(value); }
+  std::string* add_activity_tx_exclude_globs() { activity_tx_exclude_globs_.emplace_back(); return &activity_tx_exclude_globs_.back(); }
+
+  const std::vector<GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange>& activity_ranges() const { return activity_ranges_; }
+  std::vector<GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange>* mutable_activity_ranges() { return &activity_ranges_; }
+  int activity_ranges_size() const;
+  void clear_activity_ranges();
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange* add_activity_ranges();
+
+ private:
+  std::vector<GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter> activity_name_filters_;
+  std::vector<std::string> activity_tx_include_globs_;
+  std::vector<std::string> activity_tx_exclude_globs_;
+  std::vector<GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange> activity_ranges_;
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<8> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+    kSkipFieldNumber = 1,
+    kCountFieldNumber = 2,
+  };
+
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange();
+  ~GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange() override;
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange(GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&&) noexcept;
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange& operator=(GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&&);
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&);
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange& operator=(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&);
+  bool operator==(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange&) const;
+  bool operator!=(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_skip() const { return _has_field_[1]; }
+  uint32_t skip() const { return skip_; }
+  void set_skip(uint32_t value) { skip_ = value; _has_field_.set(1); }
+
+  bool has_count() const { return _has_field_[2]; }
+  uint32_t count() const { return count_; }
+  void set_count(uint32_t value) { count_ = value; _has_field_.set(2); }
+
+ private:
+  uint32_t skip_{};
+  uint32_t count_{};
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<3> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter : public ::protozero::CppMessageObj {
+ public:
+  using NameBase = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase;
+  static constexpr auto MANGLED_KERNEL_NAME = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_MANGLED_KERNEL_NAME;
+  static constexpr auto DEMANGLED_KERNEL_NAME = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_DEMANGLED_KERNEL_NAME;
+  static constexpr auto FUNCTION_NAME = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_FUNCTION_NAME;
+  static constexpr auto NameBase_MIN = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_MANGLED_KERNEL_NAME;
+  static constexpr auto NameBase_MAX = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_FUNCTION_NAME;
+  enum FieldNumbers {
+    kNameGlobFieldNumber = 1,
+    kNameBaseFieldNumber = 2,
+  };
+
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter();
+  ~GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter() override;
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter(GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&&) noexcept;
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter& operator=(GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&&);
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&);
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter& operator=(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&);
+  bool operator==(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter&) const;
+  bool operator!=(const GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_name_glob() const { return _has_field_[1]; }
+  const std::string& name_glob() const { return name_glob_; }
+  void set_name_glob(const std::string& value) { name_glob_ = value; _has_field_.set(1); }
+
+  bool has_name_base() const { return _has_field_[2]; }
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase name_base() const { return name_base_; }
+  void set_name_base(GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase value) { name_base_ = value; _has_field_.set(2); }
+
+ private:
+  std::string name_glob_{};
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase name_base_{};
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<3> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -41476,6 +43147,94 @@ class PERFETTO_EXPORT_COMPONENT ConsoleConfig : public ::protozero::CppMessageOb
 }  // namespace gen
 
 #endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_INTERCEPTORS_CONSOLE_CONFIG_PROTO_CPP_H_
+// gen_amalgamated begin header: gen/protos/perfetto/config/linux/journald_config.gen.h
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_LINUX_JOURNALD_CONFIG_PROTO_CPP_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_LINUX_JOURNALD_CONFIG_PROTO_CPP_H_
+
+#include <stdint.h>
+#include <bitset>
+#include <vector>
+#include <string>
+#include <type_traits>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/cpp_message_obj.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/copyable_ptr.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+class SystemdJournaldConfig;
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+namespace protozero {
+class Message;
+}  // namespace protozero
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+class PERFETTO_EXPORT_COMPONENT SystemdJournaldConfig : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+    kMinPrioFieldNumber = 1,
+    kFilterIdentifiersFieldNumber = 2,
+    kFilterUnitsFieldNumber = 3,
+  };
+
+  SystemdJournaldConfig();
+  ~SystemdJournaldConfig() override;
+  SystemdJournaldConfig(SystemdJournaldConfig&&) noexcept;
+  SystemdJournaldConfig& operator=(SystemdJournaldConfig&&);
+  SystemdJournaldConfig(const SystemdJournaldConfig&);
+  SystemdJournaldConfig& operator=(const SystemdJournaldConfig&);
+  bool operator==(const SystemdJournaldConfig&) const;
+  bool operator!=(const SystemdJournaldConfig& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_min_prio() const { return _has_field_[1]; }
+  uint32_t min_prio() const { return min_prio_; }
+  void set_min_prio(uint32_t value) { min_prio_ = value; _has_field_.set(1); }
+
+  const std::vector<std::string>& filter_identifiers() const { return filter_identifiers_; }
+  std::vector<std::string>* mutable_filter_identifiers() { return &filter_identifiers_; }
+  int filter_identifiers_size() const { return static_cast<int>(filter_identifiers_.size()); }
+  void clear_filter_identifiers() { filter_identifiers_.clear(); }
+  void add_filter_identifiers(std::string value) { filter_identifiers_.emplace_back(value); }
+  std::string* add_filter_identifiers() { filter_identifiers_.emplace_back(); return &filter_identifiers_.back(); }
+
+  const std::vector<std::string>& filter_units() const { return filter_units_; }
+  std::vector<std::string>* mutable_filter_units() { return &filter_units_; }
+  int filter_units_size() const { return static_cast<int>(filter_units_.size()); }
+  void clear_filter_units() { filter_units_.clear(); }
+  void add_filter_units(std::string value) { filter_units_.emplace_back(value); }
+  std::string* add_filter_units() { filter_units_.emplace_back(); return &filter_units_.back(); }
+
+ private:
+  uint32_t min_prio_{};
+  std::vector<std::string> filter_identifiers_;
+  std::vector<std::string> filter_units_;
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<4> _has_field_{};
+};
+
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+#endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_LINUX_JOURNALD_CONFIG_PROTO_CPP_H_
 // gen_amalgamated begin header: gen/protos/perfetto/config/power/android_power_config.gen.h
 // DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
 #ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_POWER_ANDROID_POWER_CONFIG_PROTO_CPP_H_
@@ -42115,7 +43874,11 @@ namespace perfetto {
 namespace protos {
 namespace gen {
 class JavaHprofConfig;
+class SmapsConfig;
+class RedactionRule;
 class JavaHprofConfig_ContinuousDumpConfig;
+enum SmapsConfig_VmaField : int;
+enum RedactionRule_MatchMode : int;
 }  // namespace perfetto
 }  // namespace protos
 }  // namespace gen
@@ -42137,8 +43900,11 @@ class PERFETTO_EXPORT_COMPONENT JavaHprofConfig : public ::protozero::CppMessage
     kTargetInstalledByFieldNumber = 7,
     kContinuousDumpConfigFieldNumber = 3,
     kMinAnonymousMemoryKbFieldNumber = 4,
+    kMinJavaHeapSizeKbFieldNumber = 9,
     kDumpSmapsFieldNumber = 5,
+    kSmapsConfigFieldNumber = 8,
     kIgnoredTypesFieldNumber = 6,
+    kDumpOomeCallstackFieldNumber = 10,
   };
 
   JavaHprofConfig();
@@ -42184,10 +43950,18 @@ class PERFETTO_EXPORT_COMPONENT JavaHprofConfig : public ::protozero::CppMessage
   uint32_t min_anonymous_memory_kb() const { return min_anonymous_memory_kb_; }
   void set_min_anonymous_memory_kb(uint32_t value) { min_anonymous_memory_kb_ = value; _has_field_.set(4); }
 
+  bool has_min_java_heap_size_kb() const { return _has_field_[9]; }
+  uint32_t min_java_heap_size_kb() const { return min_java_heap_size_kb_; }
+  void set_min_java_heap_size_kb(uint32_t value) { min_java_heap_size_kb_ = value; _has_field_.set(9); }
+
   bool has_dump_smaps() const { return _has_field_[5]; }
   bool dump_smaps() const { return dump_smaps_; }
   void set_dump_smaps(bool value) { dump_smaps_ = value; _has_field_.set(5); }
 
+  bool has_smaps_config() const { return _has_field_[8]; }
+  const SmapsConfig& smaps_config() const { return *smaps_config_; }
+  SmapsConfig* mutable_smaps_config() { _has_field_.set(8); return smaps_config_.get(); }
+
   const std::vector<std::string>& ignored_types() const { return ignored_types_; }
   std::vector<std::string>* mutable_ignored_types() { return &ignored_types_; }
   int ignored_types_size() const { return static_cast<int>(ignored_types_.size()); }
@@ -42195,20 +43969,27 @@ class PERFETTO_EXPORT_COMPONENT JavaHprofConfig : public ::protozero::CppMessage
   void add_ignored_types(std::string value) { ignored_types_.emplace_back(value); }
   std::string* add_ignored_types() { ignored_types_.emplace_back(); return &ignored_types_.back(); }
 
+  bool has_dump_oome_callstack() const { return _has_field_[10]; }
+  bool dump_oome_callstack() const { return dump_oome_callstack_; }
+  void set_dump_oome_callstack(bool value) { dump_oome_callstack_ = value; _has_field_.set(10); }
+
  private:
   std::vector<std::string> process_cmdline_;
   std::vector<uint64_t> pid_;
   std::vector<std::string> target_installed_by_;
   ::protozero::CopyablePtr<JavaHprofConfig_ContinuousDumpConfig> continuous_dump_config_;
   uint32_t min_anonymous_memory_kb_{};
+  uint32_t min_java_heap_size_kb_{};
   bool dump_smaps_{};
+  ::protozero::CopyablePtr<SmapsConfig> smaps_config_;
   std::vector<std::string> ignored_types_;
+  bool dump_oome_callstack_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<8> _has_field_{};
+  std::bitset<11> _has_field_{};
 };
 
 
@@ -42308,6 +44089,7 @@ enum PerfEventConfig_UnwindMode : int {
   PerfEventConfig_UnwindMode_UNWIND_SKIP = 1,
   PerfEventConfig_UnwindMode_UNWIND_DWARF = 2,
   PerfEventConfig_UnwindMode_UNWIND_FRAME_POINTER = 3,
+  PerfEventConfig_UnwindMode_UNWIND_KERNEL_FRAME_POINTER = 4,
 };
 
 class PERFETTO_EXPORT_COMPONENT PerfEventConfig : public ::protozero::CppMessageObj {
@@ -42319,13 +44101,16 @@ class PERFETTO_EXPORT_COMPONENT PerfEventConfig : public ::protozero::CppMessage
   static constexpr auto UNWIND_SKIP = PerfEventConfig_UnwindMode_UNWIND_SKIP;
   static constexpr auto UNWIND_DWARF = PerfEventConfig_UnwindMode_UNWIND_DWARF;
   static constexpr auto UNWIND_FRAME_POINTER = PerfEventConfig_UnwindMode_UNWIND_FRAME_POINTER;
+  static constexpr auto UNWIND_KERNEL_FRAME_POINTER = PerfEventConfig_UnwindMode_UNWIND_KERNEL_FRAME_POINTER;
   static constexpr auto UnwindMode_MIN = PerfEventConfig_UnwindMode_UNWIND_UNKNOWN;
-  static constexpr auto UnwindMode_MAX = PerfEventConfig_UnwindMode_UNWIND_FRAME_POINTER;
+  static constexpr auto UnwindMode_MAX = PerfEventConfig_UnwindMode_UNWIND_KERNEL_FRAME_POINTER;
   enum FieldNumbers {
     kTimebaseFieldNumber = 15,
     kFollowersFieldNumber = 19,
     kCallstackSamplingFieldNumber = 16,
     kTargetCpuFieldNumber = 20,
+    kIgnoreOpenFailureFieldNumber = 21,
+    kCpuidFieldNumber = 22,
     kRingBufferReadPeriodMsFieldNumber = 8,
     kRingBufferPagesFieldNumber = 3,
     kMaxEnqueuedFootprintKbFieldNumber = 17,
@@ -42378,6 +44163,17 @@ class PERFETTO_EXPORT_COMPONENT PerfEventConfig : public ::protozero::CppMessage
   void add_target_cpu(uint32_t value) { target_cpu_.emplace_back(value); }
   uint32_t* add_target_cpu() { target_cpu_.emplace_back(); return &target_cpu_.back(); }
 
+  bool has_ignore_open_failure() const { return _has_field_[21]; }
+  bool ignore_open_failure() const { return ignore_open_failure_; }
+  void set_ignore_open_failure(bool value) { ignore_open_failure_ = value; _has_field_.set(21); }
+
+  const std::vector<std::string>& cpuid() const { return cpuid_; }
+  std::vector<std::string>* mutable_cpuid() { return &cpuid_; }
+  int cpuid_size() const { return static_cast<int>(cpuid_.size()); }
+  void clear_cpuid() { cpuid_.clear(); }
+  void add_cpuid(std::string value) { cpuid_.emplace_back(value); }
+  std::string* add_cpuid() { cpuid_.emplace_back(); return &cpuid_.back(); }
+
   bool has_ring_buffer_read_period_ms() const { return _has_field_[8]; }
   uint32_t ring_buffer_read_period_ms() const { return ring_buffer_read_period_ms_; }
   void set_ring_buffer_read_period_ms(uint32_t value) { ring_buffer_read_period_ms_ = value; _has_field_.set(8); }
@@ -42458,6 +44254,8 @@ class PERFETTO_EXPORT_COMPONENT PerfEventConfig : public ::protozero::CppMessage
   std::vector<FollowerEvent> followers_;
   ::protozero::CopyablePtr<PerfEventConfig_CallstackSampling> callstack_sampling_;
   std::vector<uint32_t> target_cpu_;
+  bool ignore_open_failure_{};
+  std::vector<std::string> cpuid_;
   uint32_t ring_buffer_read_period_ms_{};
   uint32_t ring_buffer_pages_{};
   uint64_t max_enqueued_footprint_kb_{};
@@ -42478,7 +44276,7 @@ class PERFETTO_EXPORT_COMPONENT PerfEventConfig : public ::protozero::CppMessage
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<21> _has_field_{};
+  std::bitset<23> _has_field_{};
 };
 
 
@@ -42610,6 +44408,205 @@ class PERFETTO_EXPORT_COMPONENT PerfEventConfig_Scope : public ::protozero::CppM
 }  // namespace gen
 
 #endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_PROFILING_PERF_EVENT_CONFIG_PROTO_CPP_H_
+// gen_amalgamated begin header: gen/protos/perfetto/config/profiling/smaps_config.gen.h
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_PROFILING_SMAPS_CONFIG_PROTO_CPP_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_PROFILING_SMAPS_CONFIG_PROTO_CPP_H_
+
+#include <stdint.h>
+#include <bitset>
+#include <vector>
+#include <string>
+#include <type_traits>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/cpp_message_obj.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/copyable_ptr.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+class RedactionRule;
+class SmapsConfig;
+enum RedactionRule_MatchMode : int;
+enum SmapsConfig_VmaField : int;
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+namespace protozero {
+class Message;
+}  // namespace protozero
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+enum RedactionRule_MatchMode : int {
+  RedactionRule_MatchMode_MATCH_MODE_UNKNOWN = 0,
+  RedactionRule_MatchMode_MATCH_MODE_PREFIX = 1,
+  RedactionRule_MatchMode_MATCH_MODE_GLOB_PATH = 2,
+  RedactionRule_MatchMode_MATCH_MODE_GLOB_STRING = 3,
+};
+enum SmapsConfig_VmaField : int {
+  SmapsConfig_VmaField_VMA_FIELD_UNKNOWN = 0,
+  SmapsConfig_VmaField_VMA_FIELD_SIZE = 1,
+  SmapsConfig_VmaField_VMA_FIELD_RSS = 2,
+  SmapsConfig_VmaField_VMA_FIELD_ANONYMOUS = 3,
+  SmapsConfig_VmaField_VMA_FIELD_SWAP = 4,
+  SmapsConfig_VmaField_VMA_FIELD_SHARED_CLEAN = 5,
+  SmapsConfig_VmaField_VMA_FIELD_SHARED_DIRTY = 6,
+  SmapsConfig_VmaField_VMA_FIELD_PRIVATE_CLEAN = 7,
+  SmapsConfig_VmaField_VMA_FIELD_PRIVATE_DIRTY = 8,
+  SmapsConfig_VmaField_VMA_FIELD_LOCKED = 9,
+  SmapsConfig_VmaField_VMA_FIELD_PSS = 10,
+  SmapsConfig_VmaField_VMA_FIELD_PSS_DIRTY = 11,
+  SmapsConfig_VmaField_VMA_FIELD_SWAP_PSS = 12,
+};
+
+class PERFETTO_EXPORT_COMPONENT RedactionRule : public ::protozero::CppMessageObj {
+ public:
+  using MatchMode = RedactionRule_MatchMode;
+  static constexpr auto MATCH_MODE_UNKNOWN = RedactionRule_MatchMode_MATCH_MODE_UNKNOWN;
+  static constexpr auto MATCH_MODE_PREFIX = RedactionRule_MatchMode_MATCH_MODE_PREFIX;
+  static constexpr auto MATCH_MODE_GLOB_PATH = RedactionRule_MatchMode_MATCH_MODE_GLOB_PATH;
+  static constexpr auto MATCH_MODE_GLOB_STRING = RedactionRule_MatchMode_MATCH_MODE_GLOB_STRING;
+  static constexpr auto MatchMode_MIN = RedactionRule_MatchMode_MATCH_MODE_UNKNOWN;
+  static constexpr auto MatchMode_MAX = RedactionRule_MatchMode_MATCH_MODE_GLOB_STRING;
+  enum FieldNumbers {
+    kPatternFieldNumber = 1,
+    kMatchModeFieldNumber = 2,
+    kKeepFullFieldNumber = 3,
+    kReplacementNameFieldNumber = 4,
+    kKeepFileExtensionFieldNumber = 5,
+    kKeepPathElementsFieldNumber = 6,
+  };
+
+  RedactionRule();
+  ~RedactionRule() override;
+  RedactionRule(RedactionRule&&) noexcept;
+  RedactionRule& operator=(RedactionRule&&);
+  RedactionRule(const RedactionRule&);
+  RedactionRule& operator=(const RedactionRule&);
+  bool operator==(const RedactionRule&) const;
+  bool operator!=(const RedactionRule& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_pattern() const { return _has_field_[1]; }
+  const std::string& pattern() const { return pattern_; }
+  void set_pattern(const std::string& value) { pattern_ = value; _has_field_.set(1); }
+
+  bool has_match_mode() const { return _has_field_[2]; }
+  RedactionRule_MatchMode match_mode() const { return match_mode_; }
+  void set_match_mode(RedactionRule_MatchMode value) { match_mode_ = value; _has_field_.set(2); }
+
+  bool has_keep_full() const { return _has_field_[3]; }
+  bool keep_full() const { return keep_full_; }
+  void set_keep_full(bool value) { keep_full_ = value; _has_field_.set(3); }
+
+  bool has_replacement_name() const { return _has_field_[4]; }
+  const std::string& replacement_name() const { return replacement_name_; }
+  void set_replacement_name(const std::string& value) { replacement_name_ = value; _has_field_.set(4); }
+
+  bool has_keep_file_extension() const { return _has_field_[5]; }
+  bool keep_file_extension() const { return keep_file_extension_; }
+  void set_keep_file_extension(bool value) { keep_file_extension_ = value; _has_field_.set(5); }
+
+  bool has_keep_path_elements() const { return _has_field_[6]; }
+  uint32_t keep_path_elements() const { return keep_path_elements_; }
+  void set_keep_path_elements(uint32_t value) { keep_path_elements_ = value; _has_field_.set(6); }
+
+ private:
+  std::string pattern_{};
+  RedactionRule_MatchMode match_mode_{};
+  bool keep_full_{};
+  std::string replacement_name_{};
+  bool keep_file_extension_{};
+  uint32_t keep_path_elements_{};
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<7> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT SmapsConfig : public ::protozero::CppMessageObj {
+ public:
+  using VmaField = SmapsConfig_VmaField;
+  static constexpr auto VMA_FIELD_UNKNOWN = SmapsConfig_VmaField_VMA_FIELD_UNKNOWN;
+  static constexpr auto VMA_FIELD_SIZE = SmapsConfig_VmaField_VMA_FIELD_SIZE;
+  static constexpr auto VMA_FIELD_RSS = SmapsConfig_VmaField_VMA_FIELD_RSS;
+  static constexpr auto VMA_FIELD_ANONYMOUS = SmapsConfig_VmaField_VMA_FIELD_ANONYMOUS;
+  static constexpr auto VMA_FIELD_SWAP = SmapsConfig_VmaField_VMA_FIELD_SWAP;
+  static constexpr auto VMA_FIELD_SHARED_CLEAN = SmapsConfig_VmaField_VMA_FIELD_SHARED_CLEAN;
+  static constexpr auto VMA_FIELD_SHARED_DIRTY = SmapsConfig_VmaField_VMA_FIELD_SHARED_DIRTY;
+  static constexpr auto VMA_FIELD_PRIVATE_CLEAN = SmapsConfig_VmaField_VMA_FIELD_PRIVATE_CLEAN;
+  static constexpr auto VMA_FIELD_PRIVATE_DIRTY = SmapsConfig_VmaField_VMA_FIELD_PRIVATE_DIRTY;
+  static constexpr auto VMA_FIELD_LOCKED = SmapsConfig_VmaField_VMA_FIELD_LOCKED;
+  static constexpr auto VMA_FIELD_PSS = SmapsConfig_VmaField_VMA_FIELD_PSS;
+  static constexpr auto VMA_FIELD_PSS_DIRTY = SmapsConfig_VmaField_VMA_FIELD_PSS_DIRTY;
+  static constexpr auto VMA_FIELD_SWAP_PSS = SmapsConfig_VmaField_VMA_FIELD_SWAP_PSS;
+  static constexpr auto VmaField_MIN = SmapsConfig_VmaField_VMA_FIELD_UNKNOWN;
+  static constexpr auto VmaField_MAX = SmapsConfig_VmaField_VMA_FIELD_SWAP_PSS;
+  enum FieldNumbers {
+    kVmaFieldsFieldNumber = 1,
+    kUnaggregatedFieldNumber = 2,
+    kNameRedactionRulesFieldNumber = 3,
+  };
+
+  SmapsConfig();
+  ~SmapsConfig() override;
+  SmapsConfig(SmapsConfig&&) noexcept;
+  SmapsConfig& operator=(SmapsConfig&&);
+  SmapsConfig(const SmapsConfig&);
+  SmapsConfig& operator=(const SmapsConfig&);
+  bool operator==(const SmapsConfig&) const;
+  bool operator!=(const SmapsConfig& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  const std::vector<SmapsConfig_VmaField>& vma_fields() const { return vma_fields_; }
+  std::vector<SmapsConfig_VmaField>* mutable_vma_fields() { return &vma_fields_; }
+  int vma_fields_size() const { return static_cast<int>(vma_fields_.size()); }
+  void clear_vma_fields() { vma_fields_.clear(); }
+  void add_vma_fields(SmapsConfig_VmaField value) { vma_fields_.emplace_back(value); }
+  SmapsConfig_VmaField* add_vma_fields() { vma_fields_.emplace_back(); return &vma_fields_.back(); }
+
+  bool has_unaggregated() const { return _has_field_[2]; }
+  bool unaggregated() const { return unaggregated_; }
+  void set_unaggregated(bool value) { unaggregated_ = value; _has_field_.set(2); }
+
+  const std::vector<RedactionRule>& name_redaction_rules() const { return name_redaction_rules_; }
+  std::vector<RedactionRule>* mutable_name_redaction_rules() { return &name_redaction_rules_; }
+  int name_redaction_rules_size() const;
+  void clear_name_redaction_rules();
+  RedactionRule* add_name_redaction_rules();
+
+ private:
+  std::vector<SmapsConfig_VmaField> vma_fields_;
+  bool unaggregated_{};
+  std::vector<RedactionRule> name_redaction_rules_;
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<4> _has_field_{};
+};
+
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+#endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_PROFILING_SMAPS_CONFIG_PROTO_CPP_H_
 // gen_amalgamated begin header: gen/protos/perfetto/config/protovm/protovm_config.gen.h
 // DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
 #ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_PROTOVM_PROTOVM_CONFIG_PROTO_CPP_H_
@@ -44190,6 +46187,7 @@ class PERFETTO_EXPORT_COMPONENT SysStatsConfig : public ::protozero::CppMessageO
     kThermalPeriodMsFieldNumber = 12,
     kCpuidlePeriodMsFieldNumber = 13,
     kGpufreqPeriodMsFieldNumber = 14,
+    kSlabPeriodMsFieldNumber = 15,
   };
 
   SysStatsConfig();
@@ -44271,6 +46269,10 @@ class PERFETTO_EXPORT_COMPONENT SysStatsConfig : public ::protozero::CppMessageO
   uint32_t gpufreq_period_ms() const { return gpufreq_period_ms_; }
   void set_gpufreq_period_ms(uint32_t value) { gpufreq_period_ms_ = value; _has_field_.set(14); }
 
+  bool has_slab_period_ms() const { return _has_field_[15]; }
+  uint32_t slab_period_ms() const { return slab_period_ms_; }
+  void set_slab_period_ms(uint32_t value) { slab_period_ms_ = value; _has_field_.set(15); }
+
  private:
   uint32_t meminfo_period_ms_{};
   std::vector<MeminfoCounters> meminfo_counters_;
@@ -44286,12 +46288,13 @@ class PERFETTO_EXPORT_COMPONENT SysStatsConfig : public ::protozero::CppMessageO
   uint32_t thermal_period_ms_{};
   uint32_t cpuidle_period_ms_{};
   uint32_t gpufreq_period_ms_{};
+  uint32_t slab_period_ms_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<15> _has_field_{};
+  std::bitset<16> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -44333,6 +46336,7 @@ namespace gen {
 class PERFETTO_EXPORT_COMPONENT SystemInfoConfig : public ::protozero::CppMessageObj {
  public:
   enum FieldNumbers {
+    kIrqNamesFieldNumber = 1,
   };
 
   SystemInfoConfig();
@@ -44349,7 +46353,12 @@ class PERFETTO_EXPORT_COMPONENT SystemInfoConfig : public ::protozero::CppMessag
   std::vector<uint8_t> SerializeAsArray() const override;
   void Serialize(::protozero::Message*) const;
 
+  bool has_irq_names() const { return _has_field_[1]; }
+  bool irq_names() const { return irq_names_; }
+  void set_irq_names(bool value) { irq_names_ = value; _has_field_.set(1); }
+
  private:
+  bool irq_names_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
@@ -45267,6 +47276,9 @@ class PERFETTO_EXPORT_COMPONENT EtwConfig : public ::protozero::CppMessageObj {
     kSchedulerProviderEventsFieldNumber = 2,
     kMemoryProviderEventsFieldNumber = 3,
     kFileProviderEventsFieldNumber = 4,
+    kStackSamplingEventsFieldNumber = 5,
+    kDiskProviderEventsFieldNumber = 6,
+    kSystemIoProviderEventsFieldNumber = 7,
   };
 
   EtwConfig();
@@ -45311,17 +47323,41 @@ class PERFETTO_EXPORT_COMPONENT EtwConfig : public ::protozero::CppMessageObj {
   void add_file_provider_events(std::string value) { file_provider_events_.emplace_back(value); }
   std::string* add_file_provider_events() { file_provider_events_.emplace_back(); return &file_provider_events_.back(); }
 
+  const std::vector<std::string>& stack_sampling_events() const { return stack_sampling_events_; }
+  std::vector<std::string>* mutable_stack_sampling_events() { return &stack_sampling_events_; }
+  int stack_sampling_events_size() const { return static_cast<int>(stack_sampling_events_.size()); }
+  void clear_stack_sampling_events() { stack_sampling_events_.clear(); }
+  void add_stack_sampling_events(std::string value) { stack_sampling_events_.emplace_back(value); }
+  std::string* add_stack_sampling_events() { stack_sampling_events_.emplace_back(); return &stack_sampling_events_.back(); }
+
+  const std::vector<std::string>& disk_provider_events() const { return disk_provider_events_; }
+  std::vector<std::string>* mutable_disk_provider_events() { return &disk_provider_events_; }
+  int disk_provider_events_size() const { return static_cast<int>(disk_provider_events_.size()); }
+  void clear_disk_provider_events() { disk_provider_events_.clear(); }
+  void add_disk_provider_events(std::string value) { disk_provider_events_.emplace_back(value); }
+  std::string* add_disk_provider_events() { disk_provider_events_.emplace_back(); return &disk_provider_events_.back(); }
+
+  const std::vector<std::string>& system_io_provider_events() const { return system_io_provider_events_; }
+  std::vector<std::string>* mutable_system_io_provider_events() { return &system_io_provider_events_; }
+  int system_io_provider_events_size() const { return static_cast<int>(system_io_provider_events_.size()); }
+  void clear_system_io_provider_events() { system_io_provider_events_.clear(); }
+  void add_system_io_provider_events(std::string value) { system_io_provider_events_.emplace_back(value); }
+  std::string* add_system_io_provider_events() { system_io_provider_events_.emplace_back(); return &system_io_provider_events_.back(); }
+
  private:
   std::vector<EtwConfig_KernelFlag> kernel_flags_;
   std::vector<std::string> scheduler_provider_events_;
   std::vector<std::string> memory_provider_events_;
   std::vector<std::string> file_provider_events_;
+  std::vector<std::string> stack_sampling_events_;
+  std::vector<std::string> disk_provider_events_;
+  std::vector<std::string> system_io_provider_events_;
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<5> _has_field_{};
+  std::bitset<8> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -45906,6 +47942,67 @@ const char* SemanticType_Name(::perfetto::protos::pbzero::SemanticType value) {
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/config/android/android_aflags_config.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_ANDROID_AFLAGS_CONFIG_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_ANDROID_AFLAGS_CONFIG_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class AndroidAflagsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  AndroidAflagsConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidAflagsConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidAflagsConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_poll_ms() const { return at<1>().valid(); }
+  uint32_t poll_ms() const { return at<1>().as_uint32(); }
+};
+
+class AndroidAflagsConfig : public ::protozero::Message {
+ public:
+  using Decoder = AndroidAflagsConfig_Decoder;
+  enum : int32_t {
+    kPollMsFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidAflagsConfig"; }
+
+
+  using FieldMetadata_PollMs =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      AndroidAflagsConfig>;
+
+  static constexpr FieldMetadata_PollMs kPollMs{};
+  void set_poll_ms(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PollMs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -46066,7 +48163,7 @@ const char* AndroidInputEventConfig_TraceLevel_Name(::perfetto::protos::pbzero::
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class AndroidInputEventConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+class AndroidInputEventConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
  public:
   AndroidInputEventConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit AndroidInputEventConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -46079,6 +48176,8 @@ class AndroidInputEventConfig_Decoder : public ::protozero::TypedProtoDecoder</*
   bool trace_dispatcher_input_events() const { return at<3>().as_bool(); }
   bool has_trace_dispatcher_window_dispatch() const { return at<4>().valid(); }
   bool trace_dispatcher_window_dispatch() const { return at<4>().as_bool(); }
+  bool has_trace_evdev_events() const { return at<5>().valid(); }
+  bool trace_evdev_events() const { return at<5>().as_bool(); }
 };
 
 class AndroidInputEventConfig : public ::protozero::Message {
@@ -46089,6 +48188,7 @@ class AndroidInputEventConfig : public ::protozero::Message {
     kRulesFieldNumber = 2,
     kTraceDispatcherInputEventsFieldNumber = 3,
     kTraceDispatcherWindowDispatchFieldNumber = 4,
+    kTraceEvdevEventsFieldNumber = 5,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.AndroidInputEventConfig"; }
 
@@ -46176,6 +48276,24 @@ class AndroidInputEventConfig : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_TraceEvdevEvents =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      AndroidInputEventConfig>;
+
+  static constexpr FieldMetadata_TraceEvdevEvents kTraceEvdevEvents{};
+  void set_trace_evdev_events(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_TraceEvdevEvents::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class AndroidInputEventConfig_TraceRule_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
@@ -46871,6 +48989,177 @@ class CpuPerUidConfig : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/config/android/display_video_config.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_DISPLAY_VIDEO_CONFIG_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_ANDROID_DISPLAY_VIDEO_CONFIG_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+namespace perfetto_pbzero_enum_DisplayVideoConfig {
+enum Format : int32_t;
+}  // namespace perfetto_pbzero_enum_DisplayVideoConfig
+using DisplayVideoConfig_Format = perfetto_pbzero_enum_DisplayVideoConfig::Format;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+namespace perfetto_pbzero_enum_DisplayVideoConfig {
+enum Format : int32_t {
+  FORMAT_UNSPECIFIED = 0,
+  FORMAT_H264 = 1,
+  FORMAT_HEVC = 2,
+};
+} // namespace perfetto_pbzero_enum_DisplayVideoConfig
+using DisplayVideoConfig_Format = perfetto_pbzero_enum_DisplayVideoConfig::Format;
+
+
+constexpr DisplayVideoConfig_Format DisplayVideoConfig_Format_MIN = DisplayVideoConfig_Format::FORMAT_UNSPECIFIED;
+constexpr DisplayVideoConfig_Format DisplayVideoConfig_Format_MAX = DisplayVideoConfig_Format::FORMAT_HEVC;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* DisplayVideoConfig_Format_Name(::perfetto::protos::pbzero::DisplayVideoConfig_Format value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::DisplayVideoConfig_Format::FORMAT_UNSPECIFIED:
+    return "FORMAT_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::DisplayVideoConfig_Format::FORMAT_H264:
+    return "FORMAT_H264";
+
+  case ::perfetto::protos::pbzero::DisplayVideoConfig_Format::FORMAT_HEVC:
+    return "FORMAT_HEVC";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class DisplayVideoConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  DisplayVideoConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DisplayVideoConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DisplayVideoConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_scale() const { return at<1>().valid(); }
+  float scale() const { return at<1>().as_float(); }
+  bool has_format() const { return at<2>().valid(); }
+  int32_t format() const { return at<2>().as_int32(); }
+  bool has_key_frame_interval_secs() const { return at<3>().valid(); }
+  uint32_t key_frame_interval_secs() const { return at<3>().as_uint32(); }
+  bool has_max_stream_size_bytes() const { return at<4>().valid(); }
+  uint64_t max_stream_size_bytes() const { return at<4>().as_uint64(); }
+};
+
+class DisplayVideoConfig : public ::protozero::Message {
+ public:
+  using Decoder = DisplayVideoConfig_Decoder;
+  enum : int32_t {
+    kScaleFieldNumber = 1,
+    kFormatFieldNumber = 2,
+    kKeyFrameIntervalSecsFieldNumber = 3,
+    kMaxStreamSizeBytesFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DisplayVideoConfig"; }
+
+
+  using Format = ::perfetto::protos::pbzero::DisplayVideoConfig_Format;
+  static inline const char* Format_Name(Format value) {
+    return ::perfetto::protos::pbzero::DisplayVideoConfig_Format_Name(value);
+  }
+  static inline const Format FORMAT_UNSPECIFIED = Format::FORMAT_UNSPECIFIED;
+  static inline const Format FORMAT_H264 = Format::FORMAT_H264;
+  static inline const Format FORMAT_HEVC = Format::FORMAT_HEVC;
+
+  using FieldMetadata_Scale =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kFloat,
+      float,
+      DisplayVideoConfig>;
+
+  static constexpr FieldMetadata_Scale kScale{};
+  void set_scale(float value) {
+    static constexpr uint32_t field_id = FieldMetadata_Scale::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Format =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      DisplayVideoConfig_Format,
+      DisplayVideoConfig>;
+
+  static constexpr FieldMetadata_Format kFormat{};
+  void set_format(DisplayVideoConfig_Format value) {
+    static constexpr uint32_t field_id = FieldMetadata_Format::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_KeyFrameIntervalSecs =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DisplayVideoConfig>;
+
+  static constexpr FieldMetadata_KeyFrameIntervalSecs kKeyFrameIntervalSecs{};
+  void set_key_frame_interval_secs(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_KeyFrameIntervalSecs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MaxStreamSizeBytes =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      DisplayVideoConfig>;
+
+  static constexpr FieldMetadata_MaxStreamSizeBytes kMaxStreamSizeBytes{};
+  void set_max_stream_size_bytes(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MaxStreamSizeBytes::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -47225,13 +49514,15 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class PackagesListConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class PackagesListConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
   PackagesListConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit PackagesListConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
   explicit PackagesListConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
   bool has_package_name_filter() const { return at<1>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstChars> package_name_filter() const { return GetRepeated<::protozero::ConstChars>(1); }
+  bool has_package_name_regex_filter() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> package_name_regex_filter() const { return GetRepeated<::protozero::ConstChars>(3); }
   bool has_only_write_on_cpu_use_every_ms() const { return at<2>().valid(); }
   uint32_t only_write_on_cpu_use_every_ms() const { return at<2>().as_uint32(); }
 };
@@ -47241,6 +49532,7 @@ class PackagesListConfig : public ::protozero::Message {
   using Decoder = PackagesListConfig_Decoder;
   enum : int32_t {
     kPackageNameFilterFieldNumber = 1,
+    kPackageNameRegexFilterFieldNumber = 3,
     kOnlyWriteOnCpuUseEveryMsFieldNumber = 2,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.PackagesListConfig"; }
@@ -47270,6 +49562,30 @@ class PackagesListConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_PackageNameRegexFilter =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      PackagesListConfig>;
+
+  static constexpr FieldMetadata_PackageNameRegexFilter kPackageNameRegexFilter{};
+  void add_package_name_regex_filter(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_PackageNameRegexFilter::kFieldId, data, size);
+  }
+  void add_package_name_regex_filter(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_PackageNameRegexFilter::kFieldId, chars.data, chars.size);
+  }
+  void add_package_name_regex_filter(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_PackageNameRegexFilter::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_OnlyWriteOnCpuUseEveryMs =
     ::protozero::proto_utils::FieldMetadata<
       2,
@@ -47475,6 +49791,47 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+enum ProtoLogLevel : int32_t {
+  PROTOLOG_LEVEL_UNDEFINED = 0,
+  PROTOLOG_LEVEL_DEBUG = 1,
+  PROTOLOG_LEVEL_VERBOSE = 2,
+  PROTOLOG_LEVEL_INFO = 3,
+  PROTOLOG_LEVEL_WARN = 4,
+  PROTOLOG_LEVEL_ERROR = 5,
+  PROTOLOG_LEVEL_WTF = 6,
+};
+
+constexpr ProtoLogLevel ProtoLogLevel_MIN = ProtoLogLevel::PROTOLOG_LEVEL_UNDEFINED;
+constexpr ProtoLogLevel ProtoLogLevel_MAX = ProtoLogLevel::PROTOLOG_LEVEL_WTF;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* ProtoLogLevel_Name(::perfetto::protos::pbzero::ProtoLogLevel value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_UNDEFINED:
+    return "PROTOLOG_LEVEL_UNDEFINED";
+
+  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_DEBUG:
+    return "PROTOLOG_LEVEL_DEBUG";
+
+  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_VERBOSE:
+    return "PROTOLOG_LEVEL_VERBOSE";
+
+  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_INFO:
+    return "PROTOLOG_LEVEL_INFO";
+
+  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_WARN:
+    return "PROTOLOG_LEVEL_WARN";
+
+  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_ERROR:
+    return "PROTOLOG_LEVEL_ERROR";
+
+  case ::perfetto::protos::pbzero::ProtoLogLevel::PROTOLOG_LEVEL_WTF:
+    return "PROTOLOG_LEVEL_WTF";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
 namespace perfetto_pbzero_enum_ProtoLogConfig {
 enum TracingMode : int32_t {
   DEFAULT = 0,
@@ -47712,13 +50069,14 @@ enum Mode : int32_t {
   MODE_GENERATED = 2,
   MODE_DUMP = 3,
   MODE_GENERATED_BUGREPORT_ONLY = 4,
+  MODE_PROTOVM = 5,
 };
 } // namespace perfetto_pbzero_enum_SurfaceFlingerLayersConfig
 using SurfaceFlingerLayersConfig_Mode = perfetto_pbzero_enum_SurfaceFlingerLayersConfig::Mode;
 
 
 constexpr SurfaceFlingerLayersConfig_Mode SurfaceFlingerLayersConfig_Mode_MIN = SurfaceFlingerLayersConfig_Mode::MODE_UNSPECIFIED;
-constexpr SurfaceFlingerLayersConfig_Mode SurfaceFlingerLayersConfig_Mode_MAX = SurfaceFlingerLayersConfig_Mode::MODE_GENERATED_BUGREPORT_ONLY;
+constexpr SurfaceFlingerLayersConfig_Mode SurfaceFlingerLayersConfig_Mode_MAX = SurfaceFlingerLayersConfig_Mode::MODE_PROTOVM;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
@@ -47738,6 +50096,9 @@ const char* SurfaceFlingerLayersConfig_Mode_Name(::perfetto::protos::pbzero::Sur
 
   case ::perfetto::protos::pbzero::SurfaceFlingerLayersConfig_Mode::MODE_GENERATED_BUGREPORT_ONLY:
     return "MODE_GENERATED_BUGREPORT_ONLY";
+
+  case ::perfetto::protos::pbzero::SurfaceFlingerLayersConfig_Mode::MODE_PROTOVM:
+    return "MODE_PROTOVM";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
@@ -47826,6 +50187,7 @@ class SurfaceFlingerLayersConfig : public ::protozero::Message {
   static inline const Mode MODE_GENERATED = Mode::MODE_GENERATED;
   static inline const Mode MODE_DUMP = Mode::MODE_DUMP;
   static inline const Mode MODE_GENERATED_BUGREPORT_ONLY = Mode::MODE_GENERATED_BUGREPORT_ONLY;
+  static inline const Mode MODE_PROTOVM = Mode::MODE_PROTOVM;
   static inline const TraceFlag TRACE_FLAG_UNSPECIFIED = TraceFlag::TRACE_FLAG_UNSPECIFIED;
   static inline const TraceFlag TRACE_FLAG_INPUT = TraceFlag::TRACE_FLAG_INPUT;
   static inline const TraceFlag TRACE_FLAG_COMPOSITION = TraceFlag::TRACE_FLAG_COMPOSITION;
@@ -48077,6 +50439,10 @@ namespace perfetto_pbzero_enum_WindowManagerConfig {
 enum LogLevel : int32_t;
 }  // namespace perfetto_pbzero_enum_WindowManagerConfig
 using WindowManagerConfig_LogLevel = perfetto_pbzero_enum_WindowManagerConfig::LogLevel;
+namespace perfetto_pbzero_enum_WindowManagerConfig {
+enum LogMode : int32_t;
+}  // namespace perfetto_pbzero_enum_WindowManagerConfig
+using WindowManagerConfig_LogMode = perfetto_pbzero_enum_WindowManagerConfig::LogMode;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -48151,7 +50517,36 @@ const char* WindowManagerConfig_LogLevel_Name(::perfetto::protos::pbzero::Window
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class WindowManagerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+namespace perfetto_pbzero_enum_WindowManagerConfig {
+enum LogMode : int32_t {
+  LOG_MODE_UNSPECIFIED = 0,
+  LOG_MODE_FULL_STATE = 1,
+  LOG_MODE_INCREMENTAL = 2,
+};
+} // namespace perfetto_pbzero_enum_WindowManagerConfig
+using WindowManagerConfig_LogMode = perfetto_pbzero_enum_WindowManagerConfig::LogMode;
+
+
+constexpr WindowManagerConfig_LogMode WindowManagerConfig_LogMode_MIN = WindowManagerConfig_LogMode::LOG_MODE_UNSPECIFIED;
+constexpr WindowManagerConfig_LogMode WindowManagerConfig_LogMode_MAX = WindowManagerConfig_LogMode::LOG_MODE_INCREMENTAL;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* WindowManagerConfig_LogMode_Name(::perfetto::protos::pbzero::WindowManagerConfig_LogMode value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::WindowManagerConfig_LogMode::LOG_MODE_UNSPECIFIED:
+    return "LOG_MODE_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::WindowManagerConfig_LogMode::LOG_MODE_FULL_STATE:
+    return "LOG_MODE_FULL_STATE";
+
+  case ::perfetto::protos::pbzero::WindowManagerConfig_LogMode::LOG_MODE_INCREMENTAL:
+    return "LOG_MODE_INCREMENTAL";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class WindowManagerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
   WindowManagerConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit WindowManagerConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -48160,6 +50555,8 @@ class WindowManagerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_
   int32_t log_frequency() const { return at<1>().as_int32(); }
   bool has_log_level() const { return at<2>().valid(); }
   int32_t log_level() const { return at<2>().as_int32(); }
+  bool has_log_mode() const { return at<3>().valid(); }
+  int32_t log_mode() const { return at<3>().as_int32(); }
 };
 
 class WindowManagerConfig : public ::protozero::Message {
@@ -48168,6 +50565,7 @@ class WindowManagerConfig : public ::protozero::Message {
   enum : int32_t {
     kLogFrequencyFieldNumber = 1,
     kLogLevelFieldNumber = 2,
+    kLogModeFieldNumber = 3,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.WindowManagerConfig"; }
 
@@ -48181,6 +50579,11 @@ class WindowManagerConfig : public ::protozero::Message {
   static inline const char* LogLevel_Name(LogLevel value) {
     return ::perfetto::protos::pbzero::WindowManagerConfig_LogLevel_Name(value);
   }
+
+  using LogMode = ::perfetto::protos::pbzero::WindowManagerConfig_LogMode;
+  static inline const char* LogMode_Name(LogMode value) {
+    return ::perfetto::protos::pbzero::WindowManagerConfig_LogMode_Name(value);
+  }
   static inline const LogFrequency LOG_FREQUENCY_UNSPECIFIED = LogFrequency::LOG_FREQUENCY_UNSPECIFIED;
   static inline const LogFrequency LOG_FREQUENCY_FRAME = LogFrequency::LOG_FREQUENCY_FRAME;
   static inline const LogFrequency LOG_FREQUENCY_TRANSACTION = LogFrequency::LOG_FREQUENCY_TRANSACTION;
@@ -48189,6 +50592,9 @@ class WindowManagerConfig : public ::protozero::Message {
   static inline const LogLevel LOG_LEVEL_VERBOSE = LogLevel::LOG_LEVEL_VERBOSE;
   static inline const LogLevel LOG_LEVEL_DEBUG = LogLevel::LOG_LEVEL_DEBUG;
   static inline const LogLevel LOG_LEVEL_CRITICAL = LogLevel::LOG_LEVEL_CRITICAL;
+  static inline const LogMode LOG_MODE_UNSPECIFIED = LogMode::LOG_MODE_UNSPECIFIED;
+  static inline const LogMode LOG_MODE_FULL_STATE = LogMode::LOG_MODE_FULL_STATE;
+  static inline const LogMode LOG_MODE_INCREMENTAL = LogMode::LOG_MODE_INCREMENTAL;
 
   using FieldMetadata_LogFrequency =
     ::protozero::proto_utils::FieldMetadata<
@@ -48225,6 +50631,24 @@ class WindowManagerConfig : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_LogMode =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      WindowManagerConfig_LogMode,
+      WindowManagerConfig>;
+
+  static constexpr FieldMetadata_LogMode kLogMode{};
+  void set_log_mode(WindowManagerConfig_LogMode value) {
+    static constexpr uint32_t field_id = FieldMetadata_LogMode::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -49516,12 +51940,54 @@ class FtraceConfig_CompactSchedConfig : public ::protozero::Message {
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
 
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class GpuCounterConfig_InstrumentedSamplingConfig;
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter;
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange;
+namespace perfetto_pbzero_enum_GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter {
+enum NameBase : int32_t;
+}  // namespace perfetto_pbzero_enum_GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter
+using GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase = perfetto_pbzero_enum_GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::NameBase;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
 
 namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class GpuCounterConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+namespace perfetto_pbzero_enum_GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter {
+enum NameBase : int32_t {
+  MANGLED_KERNEL_NAME = 0,
+  DEMANGLED_KERNEL_NAME = 1,
+  FUNCTION_NAME = 2,
+};
+} // namespace perfetto_pbzero_enum_GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter
+using GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase = perfetto_pbzero_enum_GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter::NameBase;
+
+
+constexpr GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_MIN = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase::MANGLED_KERNEL_NAME;
+constexpr GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_MAX = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase::FUNCTION_NAME;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_Name(::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase::MANGLED_KERNEL_NAME:
+    return "MANGLED_KERNEL_NAME";
+
+  case ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase::DEMANGLED_KERNEL_NAME:
+    return "DEMANGLED_KERNEL_NAME";
+
+  case ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase::FUNCTION_NAME:
+    return "FUNCTION_NAME";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class GpuCounterConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
  public:
   GpuCounterConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit GpuCounterConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -49530,8 +51996,12 @@ class GpuCounterConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIE
   uint64_t counter_period_ns() const { return at<1>().as_uint64(); }
   bool has_counter_ids() const { return at<2>().valid(); }
   ::protozero::RepeatedFieldIterator<uint32_t> counter_ids() const { return GetRepeated<uint32_t>(2); }
+  bool has_counter_names() const { return at<6>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> counter_names() const { return GetRepeated<::protozero::ConstChars>(6); }
   bool has_instrumented_sampling() const { return at<3>().valid(); }
   bool instrumented_sampling() const { return at<3>().as_bool(); }
+  bool has_instrumented_sampling_config() const { return at<5>().valid(); }
+  ::protozero::ConstBytes instrumented_sampling_config() const { return at<5>().as_bytes(); }
   bool has_fix_gpu_clock() const { return at<4>().valid(); }
   bool fix_gpu_clock() const { return at<4>().as_bool(); }
 };
@@ -49542,11 +52012,14 @@ class GpuCounterConfig : public ::protozero::Message {
   enum : int32_t {
     kCounterPeriodNsFieldNumber = 1,
     kCounterIdsFieldNumber = 2,
+    kCounterNamesFieldNumber = 6,
     kInstrumentedSamplingFieldNumber = 3,
+    kInstrumentedSamplingConfigFieldNumber = 5,
     kFixGpuClockFieldNumber = 4,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.GpuCounterConfig"; }
 
+  using InstrumentedSamplingConfig = ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig;
 
   using FieldMetadata_CounterPeriodNs =
     ::protozero::proto_utils::FieldMetadata<
@@ -49584,6 +52057,30 @@ class GpuCounterConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_CounterNames =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuCounterConfig>;
+
+  static constexpr FieldMetadata_CounterNames kCounterNames{};
+  void add_counter_names(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_CounterNames::kFieldId, data, size);
+  }
+  void add_counter_names(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_CounterNames::kFieldId, chars.data, chars.size);
+  }
+  void add_counter_names(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_CounterNames::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_InstrumentedSampling =
     ::protozero::proto_utils::FieldMetadata<
       3,
@@ -49602,6 +52099,20 @@ class GpuCounterConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_InstrumentedSamplingConfig =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuCounterConfig_InstrumentedSamplingConfig,
+      GpuCounterConfig>;
+
+  static constexpr FieldMetadata_InstrumentedSamplingConfig kInstrumentedSamplingConfig{};
+  template <typename T = GpuCounterConfig_InstrumentedSamplingConfig> T* set_instrumented_sampling_config() {
+    return BeginNestedMessage<T>(5);
+  }
+
+
   using FieldMetadata_FixGpuClock =
     ::protozero::proto_utils::FieldMetadata<
       4,
@@ -49621,6 +52132,242 @@ class GpuCounterConfig : public ::protozero::Message {
   }
 };
 
+class GpuCounterConfig_InstrumentedSamplingConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
+ public:
+  GpuCounterConfig_InstrumentedSamplingConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuCounterConfig_InstrumentedSamplingConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuCounterConfig_InstrumentedSamplingConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_activity_name_filters() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> activity_name_filters() const { return GetRepeated<::protozero::ConstBytes>(3); }
+  bool has_activity_tx_include_globs() const { return at<6>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> activity_tx_include_globs() const { return GetRepeated<::protozero::ConstChars>(6); }
+  bool has_activity_tx_exclude_globs() const { return at<7>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> activity_tx_exclude_globs() const { return GetRepeated<::protozero::ConstChars>(7); }
+  bool has_activity_ranges() const { return at<5>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> activity_ranges() const { return GetRepeated<::protozero::ConstBytes>(5); }
+};
+
+class GpuCounterConfig_InstrumentedSamplingConfig : public ::protozero::Message {
+ public:
+  using Decoder = GpuCounterConfig_InstrumentedSamplingConfig_Decoder;
+  enum : int32_t {
+    kActivityNameFiltersFieldNumber = 3,
+    kActivityTxIncludeGlobsFieldNumber = 6,
+    kActivityTxExcludeGlobsFieldNumber = 7,
+    kActivityRangesFieldNumber = 5,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuCounterConfig.InstrumentedSamplingConfig"; }
+
+  using ActivityNameFilter = ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter;
+  using ActivityRange = ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange;
+
+  using FieldMetadata_ActivityNameFilters =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter,
+      GpuCounterConfig_InstrumentedSamplingConfig>;
+
+  static constexpr FieldMetadata_ActivityNameFilters kActivityNameFilters{};
+  template <typename T = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter> T* add_activity_name_filters() {
+    return BeginNestedMessage<T>(3);
+  }
+
+
+  using FieldMetadata_ActivityTxIncludeGlobs =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuCounterConfig_InstrumentedSamplingConfig>;
+
+  static constexpr FieldMetadata_ActivityTxIncludeGlobs kActivityTxIncludeGlobs{};
+  void add_activity_tx_include_globs(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ActivityTxIncludeGlobs::kFieldId, data, size);
+  }
+  void add_activity_tx_include_globs(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ActivityTxIncludeGlobs::kFieldId, chars.data, chars.size);
+  }
+  void add_activity_tx_include_globs(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ActivityTxIncludeGlobs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ActivityTxExcludeGlobs =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuCounterConfig_InstrumentedSamplingConfig>;
+
+  static constexpr FieldMetadata_ActivityTxExcludeGlobs kActivityTxExcludeGlobs{};
+  void add_activity_tx_exclude_globs(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ActivityTxExcludeGlobs::kFieldId, data, size);
+  }
+  void add_activity_tx_exclude_globs(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ActivityTxExcludeGlobs::kFieldId, chars.data, chars.size);
+  }
+  void add_activity_tx_exclude_globs(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ActivityTxExcludeGlobs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ActivityRanges =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange,
+      GpuCounterConfig_InstrumentedSamplingConfig>;
+
+  static constexpr FieldMetadata_ActivityRanges kActivityRanges{};
+  template <typename T = GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange> T* add_activity_ranges() {
+    return BeginNestedMessage<T>(5);
+  }
+
+};
+
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_skip() const { return at<1>().valid(); }
+  uint32_t skip() const { return at<1>().as_uint32(); }
+  bool has_count() const { return at<2>().valid(); }
+  uint32_t count() const { return at<2>().as_uint32(); }
+};
+
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange : public ::protozero::Message {
+ public:
+  using Decoder = GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange_Decoder;
+  enum : int32_t {
+    kSkipFieldNumber = 1,
+    kCountFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuCounterConfig.InstrumentedSamplingConfig.ActivityRange"; }
+
+
+  using FieldMetadata_Skip =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange>;
+
+  static constexpr FieldMetadata_Skip kSkip{};
+  void set_skip(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Skip::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Count =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuCounterConfig_InstrumentedSamplingConfig_ActivityRange>;
+
+  static constexpr FieldMetadata_Count kCount{};
+  void set_count(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Count::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_name_glob() const { return at<1>().valid(); }
+  ::protozero::ConstChars name_glob() const { return at<1>().as_string(); }
+  bool has_name_base() const { return at<2>().valid(); }
+  int32_t name_base() const { return at<2>().as_int32(); }
+};
+
+class GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter : public ::protozero::Message {
+ public:
+  using Decoder = GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_Decoder;
+  enum : int32_t {
+    kNameGlobFieldNumber = 1,
+    kNameBaseFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuCounterConfig.InstrumentedSamplingConfig.ActivityNameFilter"; }
+
+
+  using NameBase = ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase;
+  static inline const char* NameBase_Name(NameBase value) {
+    return ::perfetto::protos::pbzero::GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase_Name(value);
+  }
+  static inline const NameBase MANGLED_KERNEL_NAME = NameBase::MANGLED_KERNEL_NAME;
+  static inline const NameBase DEMANGLED_KERNEL_NAME = NameBase::DEMANGLED_KERNEL_NAME;
+  static inline const NameBase FUNCTION_NAME = NameBase::FUNCTION_NAME;
+
+  using FieldMetadata_NameGlob =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter>;
+
+  static constexpr FieldMetadata_NameGlob kNameGlob{};
+  void set_name_glob(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_NameGlob::kFieldId, data, size);
+  }
+  void set_name_glob(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_NameGlob::kFieldId, chars.data, chars.size);
+  }
+  void set_name_glob(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_NameGlob::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NameBase =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase,
+      GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter>;
+
+  static constexpr FieldMetadata_NameBase kNameBase{};
+  void set_name_base(GpuCounterConfig_InstrumentedSamplingConfig_ActivityNameFilter_NameBase value) {
+    static constexpr uint32_t field_id = FieldMetadata_NameBase::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -50187,6 +52934,121 @@ class ConsoleConfig : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/config/linux/journald_config.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_LINUX_JOURNALD_CONFIG_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_LINUX_JOURNALD_CONFIG_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class SystemdJournaldConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  SystemdJournaldConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit SystemdJournaldConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit SystemdJournaldConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_min_prio() const { return at<1>().valid(); }
+  uint32_t min_prio() const { return at<1>().as_uint32(); }
+  bool has_filter_identifiers() const { return at<2>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> filter_identifiers() const { return GetRepeated<::protozero::ConstChars>(2); }
+  bool has_filter_units() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> filter_units() const { return GetRepeated<::protozero::ConstChars>(3); }
+};
+
+class SystemdJournaldConfig : public ::protozero::Message {
+ public:
+  using Decoder = SystemdJournaldConfig_Decoder;
+  enum : int32_t {
+    kMinPrioFieldNumber = 1,
+    kFilterIdentifiersFieldNumber = 2,
+    kFilterUnitsFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.SystemdJournaldConfig"; }
+
+
+  using FieldMetadata_MinPrio =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SystemdJournaldConfig>;
+
+  static constexpr FieldMetadata_MinPrio kMinPrio{};
+  void set_min_prio(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MinPrio::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FilterIdentifiers =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldConfig>;
+
+  static constexpr FieldMetadata_FilterIdentifiers kFilterIdentifiers{};
+  void add_filter_identifiers(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_FilterIdentifiers::kFieldId, data, size);
+  }
+  void add_filter_identifiers(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_FilterIdentifiers::kFieldId, chars.data, chars.size);
+  }
+  void add_filter_identifiers(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_FilterIdentifiers::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FilterUnits =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldConfig>;
+
+  static constexpr FieldMetadata_FilterUnits kFilterUnits{};
+  void add_filter_units(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_FilterUnits::kFieldId, data, size);
+  }
+  void add_filter_units(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_FilterUnits::kFieldId, chars.data, chars.size);
+  }
+  void add_filter_units(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_FilterUnits::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -51500,6 +54362,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 class JavaHprofConfig_ContinuousDumpConfig;
+class SmapsConfig;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -51508,7 +54371,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class JavaHprofConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
+class JavaHprofConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
  public:
   JavaHprofConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit JavaHprofConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -51523,10 +54386,16 @@ class JavaHprofConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIEL
   ::protozero::ConstBytes continuous_dump_config() const { return at<3>().as_bytes(); }
   bool has_min_anonymous_memory_kb() const { return at<4>().valid(); }
   uint32_t min_anonymous_memory_kb() const { return at<4>().as_uint32(); }
+  bool has_min_java_heap_size_kb() const { return at<9>().valid(); }
+  uint32_t min_java_heap_size_kb() const { return at<9>().as_uint32(); }
   bool has_dump_smaps() const { return at<5>().valid(); }
   bool dump_smaps() const { return at<5>().as_bool(); }
+  bool has_smaps_config() const { return at<8>().valid(); }
+  ::protozero::ConstBytes smaps_config() const { return at<8>().as_bytes(); }
   bool has_ignored_types() const { return at<6>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstChars> ignored_types() const { return GetRepeated<::protozero::ConstChars>(6); }
+  bool has_dump_oome_callstack() const { return at<10>().valid(); }
+  bool dump_oome_callstack() const { return at<10>().as_bool(); }
 };
 
 class JavaHprofConfig : public ::protozero::Message {
@@ -51538,8 +54407,11 @@ class JavaHprofConfig : public ::protozero::Message {
     kTargetInstalledByFieldNumber = 7,
     kContinuousDumpConfigFieldNumber = 3,
     kMinAnonymousMemoryKbFieldNumber = 4,
+    kMinJavaHeapSizeKbFieldNumber = 9,
     kDumpSmapsFieldNumber = 5,
+    kSmapsConfigFieldNumber = 8,
     kIgnoredTypesFieldNumber = 6,
+    kDumpOomeCallstackFieldNumber = 10,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.JavaHprofConfig"; }
 
@@ -51643,6 +54515,24 @@ class JavaHprofConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_MinJavaHeapSizeKb =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      JavaHprofConfig>;
+
+  static constexpr FieldMetadata_MinJavaHeapSizeKb kMinJavaHeapSizeKb{};
+  void set_min_java_heap_size_kb(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MinJavaHeapSizeKb::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_DumpSmaps =
     ::protozero::proto_utils::FieldMetadata<
       5,
@@ -51661,6 +54551,20 @@ class JavaHprofConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_SmapsConfig =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      SmapsConfig,
+      JavaHprofConfig>;
+
+  static constexpr FieldMetadata_SmapsConfig kSmapsConfig{};
+  template <typename T = SmapsConfig> T* set_smaps_config() {
+    return BeginNestedMessage<T>(8);
+  }
+
+
   using FieldMetadata_IgnoredTypes =
     ::protozero::proto_utils::FieldMetadata<
       6,
@@ -51684,6 +54588,24 @@ class JavaHprofConfig : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_DumpOomeCallstack =
+    ::protozero::proto_utils::FieldMetadata<
+      10,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      JavaHprofConfig>;
+
+  static constexpr FieldMetadata_DumpOomeCallstack kDumpOomeCallstack{};
+  void set_dump_oome_callstack(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DumpOomeCallstack::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class JavaHprofConfig_ContinuousDumpConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
@@ -51809,13 +54731,14 @@ enum UnwindMode : int32_t {
   UNWIND_SKIP = 1,
   UNWIND_DWARF = 2,
   UNWIND_FRAME_POINTER = 3,
+  UNWIND_KERNEL_FRAME_POINTER = 4,
 };
 } // namespace perfetto_pbzero_enum_PerfEventConfig
 using PerfEventConfig_UnwindMode = perfetto_pbzero_enum_PerfEventConfig::UnwindMode;
 
 
 constexpr PerfEventConfig_UnwindMode PerfEventConfig_UnwindMode_MIN = PerfEventConfig_UnwindMode::UNWIND_UNKNOWN;
-constexpr PerfEventConfig_UnwindMode PerfEventConfig_UnwindMode_MAX = PerfEventConfig_UnwindMode::UNWIND_FRAME_POINTER;
+constexpr PerfEventConfig_UnwindMode PerfEventConfig_UnwindMode_MAX = PerfEventConfig_UnwindMode::UNWIND_KERNEL_FRAME_POINTER;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
@@ -51832,11 +54755,14 @@ const char* PerfEventConfig_UnwindMode_Name(::perfetto::protos::pbzero::PerfEven
 
   case ::perfetto::protos::pbzero::PerfEventConfig_UnwindMode::UNWIND_FRAME_POINTER:
     return "UNWIND_FRAME_POINTER";
+
+  case ::perfetto::protos::pbzero::PerfEventConfig_UnwindMode::UNWIND_KERNEL_FRAME_POINTER:
+    return "UNWIND_KERNEL_FRAME_POINTER";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class PerfEventConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/20> {
+class PerfEventConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/22> {
  public:
   PerfEventConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit PerfEventConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -51849,6 +54775,10 @@ class PerfEventConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIEL
   ::protozero::ConstBytes callstack_sampling() const { return at<16>().as_bytes(); }
   bool has_target_cpu() const { return at<20>().valid(); }
   ::protozero::RepeatedFieldIterator<uint32_t> target_cpu() const { return GetRepeated<uint32_t>(20); }
+  bool has_ignore_open_failure() const { return at<21>().valid(); }
+  bool ignore_open_failure() const { return at<21>().as_bool(); }
+  bool has_cpuid() const { return at<22>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> cpuid() const { return GetRepeated<::protozero::ConstChars>(22); }
   bool has_ring_buffer_read_period_ms() const { return at<8>().valid(); }
   uint32_t ring_buffer_read_period_ms() const { return at<8>().as_uint32(); }
   bool has_ring_buffer_pages() const { return at<3>().valid(); }
@@ -51889,6 +54819,8 @@ class PerfEventConfig : public ::protozero::Message {
     kFollowersFieldNumber = 19,
     kCallstackSamplingFieldNumber = 16,
     kTargetCpuFieldNumber = 20,
+    kIgnoreOpenFailureFieldNumber = 21,
+    kCpuidFieldNumber = 22,
     kRingBufferReadPeriodMsFieldNumber = 8,
     kRingBufferPagesFieldNumber = 3,
     kMaxEnqueuedFootprintKbFieldNumber = 17,
@@ -51918,6 +54850,7 @@ class PerfEventConfig : public ::protozero::Message {
   static inline const UnwindMode UNWIND_SKIP = UnwindMode::UNWIND_SKIP;
   static inline const UnwindMode UNWIND_DWARF = UnwindMode::UNWIND_DWARF;
   static inline const UnwindMode UNWIND_FRAME_POINTER = UnwindMode::UNWIND_FRAME_POINTER;
+  static inline const UnwindMode UNWIND_KERNEL_FRAME_POINTER = UnwindMode::UNWIND_KERNEL_FRAME_POINTER;
 
   using FieldMetadata_Timebase =
     ::protozero::proto_utils::FieldMetadata<
@@ -51979,6 +54912,48 @@ class PerfEventConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_IgnoreOpenFailure =
+    ::protozero::proto_utils::FieldMetadata<
+      21,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      PerfEventConfig>;
+
+  static constexpr FieldMetadata_IgnoreOpenFailure kIgnoreOpenFailure{};
+  void set_ignore_open_failure(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_IgnoreOpenFailure::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Cpuid =
+    ::protozero::proto_utils::FieldMetadata<
+      22,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      PerfEventConfig>;
+
+  static constexpr FieldMetadata_Cpuid kCpuid{};
+  void add_cpuid(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Cpuid::kFieldId, data, size);
+  }
+  void add_cpuid(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Cpuid::kFieldId, chars.data, chars.size);
+  }
+  void add_cpuid(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Cpuid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_RingBufferReadPeriodMs =
     ::protozero::proto_utils::FieldMetadata<
       8,
@@ -52497,6 +55472,403 @@ class PerfEventConfig_CallstackSampling : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/config/profiling/smaps_config.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_PROFILING_SMAPS_CONFIG_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_CONFIG_PROFILING_SMAPS_CONFIG_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class RedactionRule;
+namespace perfetto_pbzero_enum_RedactionRule {
+enum MatchMode : int32_t;
+}  // namespace perfetto_pbzero_enum_RedactionRule
+using RedactionRule_MatchMode = perfetto_pbzero_enum_RedactionRule::MatchMode;
+namespace perfetto_pbzero_enum_SmapsConfig {
+enum VmaField : int32_t;
+}  // namespace perfetto_pbzero_enum_SmapsConfig
+using SmapsConfig_VmaField = perfetto_pbzero_enum_SmapsConfig::VmaField;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+namespace perfetto_pbzero_enum_RedactionRule {
+enum MatchMode : int32_t {
+  MATCH_MODE_UNKNOWN = 0,
+  MATCH_MODE_PREFIX = 1,
+  MATCH_MODE_GLOB_PATH = 2,
+  MATCH_MODE_GLOB_STRING = 3,
+};
+} // namespace perfetto_pbzero_enum_RedactionRule
+using RedactionRule_MatchMode = perfetto_pbzero_enum_RedactionRule::MatchMode;
+
+
+constexpr RedactionRule_MatchMode RedactionRule_MatchMode_MIN = RedactionRule_MatchMode::MATCH_MODE_UNKNOWN;
+constexpr RedactionRule_MatchMode RedactionRule_MatchMode_MAX = RedactionRule_MatchMode::MATCH_MODE_GLOB_STRING;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* RedactionRule_MatchMode_Name(::perfetto::protos::pbzero::RedactionRule_MatchMode value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::RedactionRule_MatchMode::MATCH_MODE_UNKNOWN:
+    return "MATCH_MODE_UNKNOWN";
+
+  case ::perfetto::protos::pbzero::RedactionRule_MatchMode::MATCH_MODE_PREFIX:
+    return "MATCH_MODE_PREFIX";
+
+  case ::perfetto::protos::pbzero::RedactionRule_MatchMode::MATCH_MODE_GLOB_PATH:
+    return "MATCH_MODE_GLOB_PATH";
+
+  case ::perfetto::protos::pbzero::RedactionRule_MatchMode::MATCH_MODE_GLOB_STRING:
+    return "MATCH_MODE_GLOB_STRING";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+namespace perfetto_pbzero_enum_SmapsConfig {
+enum VmaField : int32_t {
+  VMA_FIELD_UNKNOWN = 0,
+  VMA_FIELD_SIZE = 1,
+  VMA_FIELD_RSS = 2,
+  VMA_FIELD_ANONYMOUS = 3,
+  VMA_FIELD_SWAP = 4,
+  VMA_FIELD_SHARED_CLEAN = 5,
+  VMA_FIELD_SHARED_DIRTY = 6,
+  VMA_FIELD_PRIVATE_CLEAN = 7,
+  VMA_FIELD_PRIVATE_DIRTY = 8,
+  VMA_FIELD_LOCKED = 9,
+  VMA_FIELD_PSS = 10,
+  VMA_FIELD_PSS_DIRTY = 11,
+  VMA_FIELD_SWAP_PSS = 12,
+};
+} // namespace perfetto_pbzero_enum_SmapsConfig
+using SmapsConfig_VmaField = perfetto_pbzero_enum_SmapsConfig::VmaField;
+
+
+constexpr SmapsConfig_VmaField SmapsConfig_VmaField_MIN = SmapsConfig_VmaField::VMA_FIELD_UNKNOWN;
+constexpr SmapsConfig_VmaField SmapsConfig_VmaField_MAX = SmapsConfig_VmaField::VMA_FIELD_SWAP_PSS;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* SmapsConfig_VmaField_Name(::perfetto::protos::pbzero::SmapsConfig_VmaField value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_UNKNOWN:
+    return "VMA_FIELD_UNKNOWN";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_SIZE:
+    return "VMA_FIELD_SIZE";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_RSS:
+    return "VMA_FIELD_RSS";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_ANONYMOUS:
+    return "VMA_FIELD_ANONYMOUS";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_SWAP:
+    return "VMA_FIELD_SWAP";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_SHARED_CLEAN:
+    return "VMA_FIELD_SHARED_CLEAN";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_SHARED_DIRTY:
+    return "VMA_FIELD_SHARED_DIRTY";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_PRIVATE_CLEAN:
+    return "VMA_FIELD_PRIVATE_CLEAN";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_PRIVATE_DIRTY:
+    return "VMA_FIELD_PRIVATE_DIRTY";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_LOCKED:
+    return "VMA_FIELD_LOCKED";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_PSS:
+    return "VMA_FIELD_PSS";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_PSS_DIRTY:
+    return "VMA_FIELD_PSS_DIRTY";
+
+  case ::perfetto::protos::pbzero::SmapsConfig_VmaField::VMA_FIELD_SWAP_PSS:
+    return "VMA_FIELD_SWAP_PSS";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class RedactionRule_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
+ public:
+  RedactionRule_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit RedactionRule_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit RedactionRule_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_pattern() const { return at<1>().valid(); }
+  ::protozero::ConstChars pattern() const { return at<1>().as_string(); }
+  bool has_match_mode() const { return at<2>().valid(); }
+  int32_t match_mode() const { return at<2>().as_int32(); }
+  bool has_keep_full() const { return at<3>().valid(); }
+  bool keep_full() const { return at<3>().as_bool(); }
+  bool has_replacement_name() const { return at<4>().valid(); }
+  ::protozero::ConstChars replacement_name() const { return at<4>().as_string(); }
+  bool has_keep_file_extension() const { return at<5>().valid(); }
+  bool keep_file_extension() const { return at<5>().as_bool(); }
+  bool has_keep_path_elements() const { return at<6>().valid(); }
+  uint32_t keep_path_elements() const { return at<6>().as_uint32(); }
+};
+
+class RedactionRule : public ::protozero::Message {
+ public:
+  using Decoder = RedactionRule_Decoder;
+  enum : int32_t {
+    kPatternFieldNumber = 1,
+    kMatchModeFieldNumber = 2,
+    kKeepFullFieldNumber = 3,
+    kReplacementNameFieldNumber = 4,
+    kKeepFileExtensionFieldNumber = 5,
+    kKeepPathElementsFieldNumber = 6,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.RedactionRule"; }
+
+
+  using MatchMode = ::perfetto::protos::pbzero::RedactionRule_MatchMode;
+  static inline const char* MatchMode_Name(MatchMode value) {
+    return ::perfetto::protos::pbzero::RedactionRule_MatchMode_Name(value);
+  }
+  static inline const MatchMode MATCH_MODE_UNKNOWN = MatchMode::MATCH_MODE_UNKNOWN;
+  static inline const MatchMode MATCH_MODE_PREFIX = MatchMode::MATCH_MODE_PREFIX;
+  static inline const MatchMode MATCH_MODE_GLOB_PATH = MatchMode::MATCH_MODE_GLOB_PATH;
+  static inline const MatchMode MATCH_MODE_GLOB_STRING = MatchMode::MATCH_MODE_GLOB_STRING;
+
+  using FieldMetadata_Pattern =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      RedactionRule>;
+
+  static constexpr FieldMetadata_Pattern kPattern{};
+  void set_pattern(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Pattern::kFieldId, data, size);
+  }
+  void set_pattern(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Pattern::kFieldId, chars.data, chars.size);
+  }
+  void set_pattern(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pattern::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MatchMode =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      RedactionRule_MatchMode,
+      RedactionRule>;
+
+  static constexpr FieldMetadata_MatchMode kMatchMode{};
+  void set_match_mode(RedactionRule_MatchMode value) {
+    static constexpr uint32_t field_id = FieldMetadata_MatchMode::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_KeepFull =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      RedactionRule>;
+
+  static constexpr FieldMetadata_KeepFull kKeepFull{};
+  void set_keep_full(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_KeepFull::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ReplacementName =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      RedactionRule>;
+
+  static constexpr FieldMetadata_ReplacementName kReplacementName{};
+  void set_replacement_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ReplacementName::kFieldId, data, size);
+  }
+  void set_replacement_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ReplacementName::kFieldId, chars.data, chars.size);
+  }
+  void set_replacement_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ReplacementName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_KeepFileExtension =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      RedactionRule>;
+
+  static constexpr FieldMetadata_KeepFileExtension kKeepFileExtension{};
+  void set_keep_file_extension(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_KeepFileExtension::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_KeepPathElements =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      RedactionRule>;
+
+  static constexpr FieldMetadata_KeepPathElements kKeepPathElements{};
+  void set_keep_path_elements(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_KeepPathElements::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class SmapsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  SmapsConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit SmapsConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit SmapsConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_vma_fields() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<int32_t> vma_fields() const { return GetRepeated<int32_t>(1); }
+  bool has_unaggregated() const { return at<2>().valid(); }
+  bool unaggregated() const { return at<2>().as_bool(); }
+  bool has_name_redaction_rules() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> name_redaction_rules() const { return GetRepeated<::protozero::ConstBytes>(3); }
+};
+
+class SmapsConfig : public ::protozero::Message {
+ public:
+  using Decoder = SmapsConfig_Decoder;
+  enum : int32_t {
+    kVmaFieldsFieldNumber = 1,
+    kUnaggregatedFieldNumber = 2,
+    kNameRedactionRulesFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.SmapsConfig"; }
+
+
+  using VmaField = ::perfetto::protos::pbzero::SmapsConfig_VmaField;
+  static inline const char* VmaField_Name(VmaField value) {
+    return ::perfetto::protos::pbzero::SmapsConfig_VmaField_Name(value);
+  }
+  static inline const VmaField VMA_FIELD_UNKNOWN = VmaField::VMA_FIELD_UNKNOWN;
+  static inline const VmaField VMA_FIELD_SIZE = VmaField::VMA_FIELD_SIZE;
+  static inline const VmaField VMA_FIELD_RSS = VmaField::VMA_FIELD_RSS;
+  static inline const VmaField VMA_FIELD_ANONYMOUS = VmaField::VMA_FIELD_ANONYMOUS;
+  static inline const VmaField VMA_FIELD_SWAP = VmaField::VMA_FIELD_SWAP;
+  static inline const VmaField VMA_FIELD_SHARED_CLEAN = VmaField::VMA_FIELD_SHARED_CLEAN;
+  static inline const VmaField VMA_FIELD_SHARED_DIRTY = VmaField::VMA_FIELD_SHARED_DIRTY;
+  static inline const VmaField VMA_FIELD_PRIVATE_CLEAN = VmaField::VMA_FIELD_PRIVATE_CLEAN;
+  static inline const VmaField VMA_FIELD_PRIVATE_DIRTY = VmaField::VMA_FIELD_PRIVATE_DIRTY;
+  static inline const VmaField VMA_FIELD_LOCKED = VmaField::VMA_FIELD_LOCKED;
+  static inline const VmaField VMA_FIELD_PSS = VmaField::VMA_FIELD_PSS;
+  static inline const VmaField VMA_FIELD_PSS_DIRTY = VmaField::VMA_FIELD_PSS_DIRTY;
+  static inline const VmaField VMA_FIELD_SWAP_PSS = VmaField::VMA_FIELD_SWAP_PSS;
+
+  using FieldMetadata_VmaFields =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      SmapsConfig_VmaField,
+      SmapsConfig>;
+
+  static constexpr FieldMetadata_VmaFields kVmaFields{};
+  void add_vma_fields(SmapsConfig_VmaField value) {
+    static constexpr uint32_t field_id = FieldMetadata_VmaFields::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Unaggregated =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      SmapsConfig>;
+
+  static constexpr FieldMetadata_Unaggregated kUnaggregated{};
+  void set_unaggregated(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_Unaggregated::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NameRedactionRules =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      RedactionRule,
+      SmapsConfig>;
+
+  static constexpr FieldMetadata_NameRedactionRules kNameRedactionRules{};
+  template <typename T = RedactionRule> T* add_name_redaction_rules() {
+    return BeginNestedMessage<T>(3);
+  }
+
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -57659,7 +61031,7 @@ const char* SysStatsConfig_StatCounters_Name(::perfetto::protos::pbzero::SysStat
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class SysStatsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/14> {
+class SysStatsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/15> {
  public:
   SysStatsConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit SysStatsConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -57692,6 +61064,8 @@ class SysStatsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD
   uint32_t cpuidle_period_ms() const { return at<13>().as_uint32(); }
   bool has_gpufreq_period_ms() const { return at<14>().valid(); }
   uint32_t gpufreq_period_ms() const { return at<14>().as_uint32(); }
+  bool has_slab_period_ms() const { return at<15>().valid(); }
+  uint32_t slab_period_ms() const { return at<15>().as_uint32(); }
 };
 
 class SysStatsConfig : public ::protozero::Message {
@@ -57712,6 +61086,7 @@ class SysStatsConfig : public ::protozero::Message {
     kThermalPeriodMsFieldNumber = 12,
     kCpuidlePeriodMsFieldNumber = 13,
     kGpufreqPeriodMsFieldNumber = 14,
+    kSlabPeriodMsFieldNumber = 15,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.SysStatsConfig"; }
 
@@ -57977,6 +61352,24 @@ class SysStatsConfig : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_SlabPeriodMs =
+    ::protozero::proto_utils::FieldMetadata<
+      15,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SysStatsConfig>;
+
+  static constexpr FieldMetadata_SlabPeriodMs kSlabPeriodMs{};
+  void set_slab_period_ms(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_SlabPeriodMs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -58003,18 +61396,41 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class SystemInfoConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/0> {
+class SystemInfoConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
  public:
   SystemInfoConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit SystemInfoConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
   explicit SystemInfoConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_irq_names() const { return at<1>().valid(); }
+  bool irq_names() const { return at<1>().as_bool(); }
 };
 
 class SystemInfoConfig : public ::protozero::Message {
  public:
   using Decoder = SystemInfoConfig_Decoder;
+  enum : int32_t {
+    kIrqNamesFieldNumber = 1,
+  };
   static constexpr const char* GetName() { return ".perfetto.protos.SystemInfoConfig"; }
 
+
+  using FieldMetadata_IrqNames =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      SystemInfoConfig>;
+
+  static constexpr FieldMetadata_IrqNames kIrqNames{};
+  void set_irq_names(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_IrqNames::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -59553,6 +62969,7 @@ class V8Config : public ::protozero::Message {
 namespace perfetto {
 namespace protos {
 namespace pbzero {
+class AndroidAflagsConfig;
 class AndroidGameInterventionListConfig;
 class AndroidInputEventConfig;
 class AndroidLogConfig;
@@ -59566,6 +62983,7 @@ class ChromeConfig;
 class ChromiumHistogramSamplesConfig;
 class ChromiumSystemMetricsConfig;
 class CpuPerUidConfig;
+class DisplayVideoConfig;
 class EtwConfig;
 class FrozenFtraceConfig;
 class FtraceConfig;
@@ -59591,6 +63009,7 @@ class SurfaceFlingerLayersConfig;
 class SurfaceFlingerTransactionsConfig;
 class SysStatsConfig;
 class SystemInfoConfig;
+class SystemdJournaldConfig;
 class TestConfig;
 class TrackEventConfig;
 class V8Config;
@@ -59777,6 +63196,12 @@ class DataSourceConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIE
   ::protozero::ConstBytes user_list_config() const { return at<138>().as_bytes(); }
   bool has_inputmethod_config() const { return at<139>().valid(); }
   ::protozero::ConstBytes inputmethod_config() const { return at<139>().as_bytes(); }
+  bool has_android_aflags_config() const { return at<140>().valid(); }
+  ::protozero::ConstBytes android_aflags_config() const { return at<140>().as_bytes(); }
+  bool has_journald_config() const { return at<141>().valid(); }
+  ::protozero::ConstBytes journald_config() const { return at<141>().as_bytes(); }
+  bool has_display_video_config() const { return at<142>().valid(); }
+  ::protozero::ConstBytes display_video_config() const { return at<142>().as_bytes(); }
   bool has_qnx_config() const { return at<150>().valid(); }
   ::protozero::ConstBytes qnx_config() const { return at<150>().as_bytes(); }
   // field legacy_config omitted because its id is too high
@@ -59838,6 +63263,9 @@ class DataSourceConfig : public ::protozero::Message {
     kCpuPerUidConfigFieldNumber = 137,
     kUserListConfigFieldNumber = 138,
     kInputmethodConfigFieldNumber = 139,
+    kAndroidAflagsConfigFieldNumber = 140,
+    kJournaldConfigFieldNumber = 141,
+    kDisplayVideoConfigFieldNumber = 142,
     kQnxConfigFieldNumber = 150,
     kLegacyConfigFieldNumber = 1000,
     kForTestingFieldNumber = 1001,
@@ -60771,6 +64199,60 @@ class DataSourceConfig : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_AndroidAflagsConfig =
+    ::protozero::proto_utils::FieldMetadata<
+      140,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidAflagsConfig,
+      DataSourceConfig>;
+
+  static constexpr FieldMetadata_AndroidAflagsConfig kAndroidAflagsConfig{};
+  template <typename T = AndroidAflagsConfig> T* set_android_aflags_config() {
+    return BeginNestedMessage<T>(140);
+  }
+
+  void set_android_aflags_config_raw(const std::string& raw) {
+    return AppendBytes(140, raw.data(), raw.size());
+  }
+
+
+  using FieldMetadata_JournaldConfig =
+    ::protozero::proto_utils::FieldMetadata<
+      141,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      SystemdJournaldConfig,
+      DataSourceConfig>;
+
+  static constexpr FieldMetadata_JournaldConfig kJournaldConfig{};
+  template <typename T = SystemdJournaldConfig> T* set_journald_config() {
+    return BeginNestedMessage<T>(141);
+  }
+
+  void set_journald_config_raw(const std::string& raw) {
+    return AppendBytes(141, raw.data(), raw.size());
+  }
+
+
+  using FieldMetadata_DisplayVideoConfig =
+    ::protozero::proto_utils::FieldMetadata<
+      142,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DisplayVideoConfig,
+      DataSourceConfig>;
+
+  static constexpr FieldMetadata_DisplayVideoConfig kDisplayVideoConfig{};
+  template <typename T = DisplayVideoConfig> T* set_display_video_config() {
+    return BeginNestedMessage<T>(142);
+  }
+
+  void set_display_video_config_raw(const std::string& raw) {
+    return AppendBytes(142, raw.data(), raw.size());
+  }
+
+
   using FieldMetadata_QnxConfig =
     ::protozero::proto_utils::FieldMetadata<
       150,
@@ -60887,7 +64369,7 @@ const char* EtwConfig_KernelFlag_Name(::perfetto::protos::pbzero::EtwConfig_Kern
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class EtwConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+class EtwConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
  public:
   EtwConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit EtwConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -60900,6 +64382,12 @@ class EtwConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*
   ::protozero::RepeatedFieldIterator<::protozero::ConstChars> memory_provider_events() const { return GetRepeated<::protozero::ConstChars>(3); }
   bool has_file_provider_events() const { return at<4>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstChars> file_provider_events() const { return GetRepeated<::protozero::ConstChars>(4); }
+  bool has_stack_sampling_events() const { return at<5>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> stack_sampling_events() const { return GetRepeated<::protozero::ConstChars>(5); }
+  bool has_disk_provider_events() const { return at<6>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> disk_provider_events() const { return GetRepeated<::protozero::ConstChars>(6); }
+  bool has_system_io_provider_events() const { return at<7>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> system_io_provider_events() const { return GetRepeated<::protozero::ConstChars>(7); }
 };
 
 class EtwConfig : public ::protozero::Message {
@@ -60910,6 +64398,9 @@ class EtwConfig : public ::protozero::Message {
     kSchedulerProviderEventsFieldNumber = 2,
     kMemoryProviderEventsFieldNumber = 3,
     kFileProviderEventsFieldNumber = 4,
+    kStackSamplingEventsFieldNumber = 5,
+    kDiskProviderEventsFieldNumber = 6,
+    kSystemIoProviderEventsFieldNumber = 7,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.EtwConfig"; }
 
@@ -61010,6 +64501,78 @@ class EtwConfig : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_StackSamplingEvents =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      EtwConfig>;
+
+  static constexpr FieldMetadata_StackSamplingEvents kStackSamplingEvents{};
+  void add_stack_sampling_events(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_StackSamplingEvents::kFieldId, data, size);
+  }
+  void add_stack_sampling_events(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_StackSamplingEvents::kFieldId, chars.data, chars.size);
+  }
+  void add_stack_sampling_events(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_StackSamplingEvents::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_DiskProviderEvents =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      EtwConfig>;
+
+  static constexpr FieldMetadata_DiskProviderEvents kDiskProviderEvents{};
+  void add_disk_provider_events(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_DiskProviderEvents::kFieldId, data, size);
+  }
+  void add_disk_provider_events(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_DiskProviderEvents::kFieldId, chars.data, chars.size);
+  }
+  void add_disk_provider_events(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_DiskProviderEvents::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SystemIoProviderEvents =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      EtwConfig>;
+
+  static constexpr FieldMetadata_SystemIoProviderEvents kSystemIoProviderEvents{};
+  void add_system_io_provider_events(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_SystemIoProviderEvents::kFieldId, data, size);
+  }
+  void add_system_io_provider_events(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_SystemIoProviderEvents::kFieldId, chars.data, chars.size);
+  }
+  void add_system_io_provider_events(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_SystemIoProviderEvents::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -64515,7 +68078,7 @@ class TraceConfig_ProducerConfig : public ::protozero::Message {
   }
 };
 
-class TraceConfig_BuiltinDataSource_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
+class TraceConfig_BuiltinDataSource_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
  public:
   TraceConfig_BuiltinDataSource_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TraceConfig_BuiltinDataSource_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -64536,6 +68099,8 @@ class TraceConfig_BuiltinDataSource_Decoder : public ::protozero::TypedProtoDeco
   bool prefer_suspend_clock_for_snapshot() const { return at<7>().as_bool(); }
   bool has_disable_chunk_usage_histograms() const { return at<8>().valid(); }
   bool disable_chunk_usage_histograms() const { return at<8>().as_bool(); }
+  bool has_disable_extension_descriptors() const { return at<9>().valid(); }
+  bool disable_extension_descriptors() const { return at<9>().as_bool(); }
 };
 
 class TraceConfig_BuiltinDataSource : public ::protozero::Message {
@@ -64550,6 +68115,7 @@ class TraceConfig_BuiltinDataSource : public ::protozero::Message {
     kSnapshotIntervalMsFieldNumber = 6,
     kPreferSuspendClockForSnapshotFieldNumber = 7,
     kDisableChunkUsageHistogramsFieldNumber = 8,
+    kDisableExtensionDescriptorsFieldNumber = 9,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.BuiltinDataSource"; }
 
@@ -64697,6 +68263,24 @@ class TraceConfig_BuiltinDataSource : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_DisableExtensionDescriptors =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
+
+  static constexpr FieldMetadata_DisableExtensionDescriptors kDisableExtensionDescriptors{};
+  void set_disable_extension_descriptors(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisableExtensionDescriptors::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class TraceConfig_DataSource_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
@@ -65448,11 +69032,11 @@ class Trigger : public ::protozero::Message {
 } // Namespace.
 } // Namespace.
 #endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/graphics/insets.pbzero.h
+// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_aflags.pbzero.h
 // Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
 
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GRAPHICS_INSETS_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GRAPHICS_INSETS_PROTO_H_
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_AFLAGS_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_AFLAGS_PROTO_H_
 
 #include <stddef.h>
 #include <stdint.h>
@@ -65463,479 +69047,319 @@ class Trigger : public ::protozero::Message {
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
 
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class AndroidAflags_Flag;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagPermission : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagPermission = perfetto_pbzero_enum_AndroidAflags::FlagPermission;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagStorageBackend : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagStorageBackend = perfetto_pbzero_enum_AndroidAflags::FlagStorageBackend;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagType : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagType = perfetto_pbzero_enum_AndroidAflags::FlagType;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum ValuePickedFrom : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_ValuePickedFrom = perfetto_pbzero_enum_AndroidAflags::ValuePickedFrom;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
 
 namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class InsetsProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  InsetsProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit InsetsProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit InsetsProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_left() const { return at<1>().valid(); }
-  int32_t left() const { return at<1>().as_int32(); }
-  bool has_top() const { return at<2>().valid(); }
-  int32_t top() const { return at<2>().as_int32(); }
-  bool has_right() const { return at<3>().valid(); }
-  int32_t right() const { return at<3>().as_int32(); }
-  bool has_bottom() const { return at<4>().valid(); }
-  int32_t bottom() const { return at<4>().as_int32(); }
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagPermission : int32_t {
+  FLAG_PERMISSION_UNSPECIFIED = 0,
+  FLAG_PERMISSION_READ_ONLY = 1,
+  FLAG_PERMISSION_READ_WRITE = 2,
 };
-
-class InsetsProto : public ::protozero::Message {
- public:
-  using Decoder = InsetsProto_Decoder;
-  enum : int32_t {
-    kLeftFieldNumber = 1,
-    kTopFieldNumber = 2,
-    kRightFieldNumber = 3,
-    kBottomFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.InsetsProto"; }
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagPermission = perfetto_pbzero_enum_AndroidAflags::FlagPermission;
 
 
-  using FieldMetadata_Left =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      InsetsProto>;
-
-  static constexpr FieldMetadata_Left kLeft{};
-  void set_left(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Left::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
+constexpr AndroidAflags_FlagPermission AndroidAflags_FlagPermission_MIN = AndroidAflags_FlagPermission::FLAG_PERMISSION_UNSPECIFIED;
+constexpr AndroidAflags_FlagPermission AndroidAflags_FlagPermission_MAX = AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_WRITE;
 
-  using FieldMetadata_Top =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      InsetsProto>;
 
-  static constexpr FieldMetadata_Top kTop{};
-  void set_top(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Top::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* AndroidAflags_FlagPermission_Name(::perfetto::protos::pbzero::AndroidAflags_FlagPermission value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_UNSPECIFIED:
+    return "FLAG_PERMISSION_UNSPECIFIED";
 
-  using FieldMetadata_Right =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      InsetsProto>;
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_ONLY:
+    return "FLAG_PERMISSION_READ_ONLY";
 
-  static constexpr FieldMetadata_Right kRight{};
-  void set_right(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Right::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_WRITE:
+    return "FLAG_PERMISSION_READ_WRITE";
   }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
 
-  using FieldMetadata_Bottom =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      InsetsProto>;
-
-  static constexpr FieldMetadata_Bottom kBottom{};
-  void set_bottom(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Bottom::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum ValuePickedFrom : int32_t {
+  VALUE_PICKED_FROM_UNSPECIFIED = 0,
+  VALUE_PICKED_FROM_DEFAULT = 1,
+  VALUE_PICKED_FROM_SERVER = 2,
+  VALUE_PICKED_FROM_LOCAL = 3,
 };
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_ValuePickedFrom = perfetto_pbzero_enum_AndroidAflags::ValuePickedFrom;
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/graphics/point.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
 
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GRAPHICS_POINT_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GRAPHICS_POINT_PROTO_H_
+constexpr AndroidAflags_ValuePickedFrom AndroidAflags_ValuePickedFrom_MIN = AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED;
+constexpr AndroidAflags_ValuePickedFrom AndroidAflags_ValuePickedFrom_MAX = AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_LOCAL;
 
-#include <stddef.h>
-#include <stdint.h>
 
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* AndroidAflags_ValuePickedFrom_Name(::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED:
+    return "VALUE_PICKED_FROM_UNSPECIFIED";
 
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_DEFAULT:
+    return "VALUE_PICKED_FROM_DEFAULT";
 
-namespace perfetto {
-namespace protos {
-namespace pbzero {
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_SERVER:
+    return "VALUE_PICKED_FROM_SERVER";
 
-class PointProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  PointProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit PointProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit PointProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_x() const { return at<1>().valid(); }
-  int32_t x() const { return at<1>().as_int32(); }
-  bool has_y() const { return at<2>().valid(); }
-  int32_t y() const { return at<2>().as_int32(); }
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_LOCAL:
+    return "VALUE_PICKED_FROM_LOCAL";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagStorageBackend : int32_t {
+  FLAG_STORAGE_BACKEND_UNSPECIFIED = 0,
+  FLAG_STORAGE_BACKEND_NONE = 1,
+  FLAG_STORAGE_BACKEND_ACONFIGD = 2,
+  FLAG_STORAGE_BACKEND_DEVICE_CONFIG = 3,
 };
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagStorageBackend = perfetto_pbzero_enum_AndroidAflags::FlagStorageBackend;
 
-class PointProto : public ::protozero::Message {
- public:
-  using Decoder = PointProto_Decoder;
-  enum : int32_t {
-    kXFieldNumber = 1,
-    kYFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.PointProto"; }
 
+constexpr AndroidAflags_FlagStorageBackend AndroidAflags_FlagStorageBackend_MIN = AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED;
+constexpr AndroidAflags_FlagStorageBackend AndroidAflags_FlagStorageBackend_MAX = AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG;
 
-  using FieldMetadata_X =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      PointProto>;
 
-  static constexpr FieldMetadata_X kX{};
-  void set_x(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_X::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* AndroidAflags_FlagStorageBackend_Name(::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED:
+    return "FLAG_STORAGE_BACKEND_UNSPECIFIED";
 
-  using FieldMetadata_Y =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      PointProto>;
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_NONE:
+    return "FLAG_STORAGE_BACKEND_NONE";
 
-  static constexpr FieldMetadata_Y kY{};
-  void set_y(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Y::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_ACONFIGD:
+    return "FLAG_STORAGE_BACKEND_ACONFIGD";
+
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG:
+    return "FLAG_STORAGE_BACKEND_DEVICE_CONFIG";
   }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagType : int32_t {
+  FLAG_TYPE_UNSPECIFIED = 0,
+  FLAG_TYPE_BOOLEAN = 1,
+  FLAG_TYPE_INTEGER = 2,
 };
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagType = perfetto_pbzero_enum_AndroidAflags::FlagType;
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/graphics/rect.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
 
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GRAPHICS_RECT_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GRAPHICS_RECT_PROTO_H_
+constexpr AndroidAflags_FlagType AndroidAflags_FlagType_MIN = AndroidAflags_FlagType::FLAG_TYPE_UNSPECIFIED;
+constexpr AndroidAflags_FlagType AndroidAflags_FlagType_MAX = AndroidAflags_FlagType::FLAG_TYPE_INTEGER;
 
-#include <stddef.h>
-#include <stdint.h>
 
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* AndroidAflags_FlagType_Name(::perfetto::protos::pbzero::AndroidAflags_FlagType value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_UNSPECIFIED:
+    return "FLAG_TYPE_UNSPECIFIED";
 
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_BOOLEAN:
+    return "FLAG_TYPE_BOOLEAN";
 
-namespace perfetto {
-namespace protos {
-namespace pbzero {
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_INTEGER:
+    return "FLAG_TYPE_INTEGER";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
 
-class RectProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+class AndroidAflags_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
-  RectProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit RectProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit RectProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_left() const { return at<1>().valid(); }
-  int32_t left() const { return at<1>().as_int32(); }
-  bool has_top() const { return at<2>().valid(); }
-  int32_t top() const { return at<2>().as_int32(); }
-  bool has_right() const { return at<3>().valid(); }
-  int32_t right() const { return at<3>().as_int32(); }
-  bool has_bottom() const { return at<4>().valid(); }
-  int32_t bottom() const { return at<4>().as_int32(); }
+  AndroidAflags_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidAflags_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidAflags_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_flags() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> flags() const { return GetRepeated<::protozero::ConstBytes>(1); }
+  bool has_error() const { return at<2>().valid(); }
+  ::protozero::ConstChars error() const { return at<2>().as_string(); }
 };
 
-class RectProto : public ::protozero::Message {
+class AndroidAflags : public ::protozero::Message {
  public:
-  using Decoder = RectProto_Decoder;
+  using Decoder = AndroidAflags_Decoder;
   enum : int32_t {
-    kLeftFieldNumber = 1,
-    kTopFieldNumber = 2,
-    kRightFieldNumber = 3,
-    kBottomFieldNumber = 4,
+    kFlagsFieldNumber = 1,
+    kErrorFieldNumber = 2,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.RectProto"; }
-
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidAflags"; }
 
-  using FieldMetadata_Left =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      RectProto>;
+  using Flag = ::perfetto::protos::pbzero::AndroidAflags_Flag;
 
-  static constexpr FieldMetadata_Left kLeft{};
-  void set_left(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Left::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  using FlagPermission = ::perfetto::protos::pbzero::AndroidAflags_FlagPermission;
+  static inline const char* FlagPermission_Name(FlagPermission value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_FlagPermission_Name(value);
   }
 
-  using FieldMetadata_Top =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      RectProto>;
-
-  static constexpr FieldMetadata_Top kTop{};
-  void set_top(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Top::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  using ValuePickedFrom = ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom;
+  static inline const char* ValuePickedFrom_Name(ValuePickedFrom value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom_Name(value);
   }
 
-  using FieldMetadata_Right =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      RectProto>;
-
-  static constexpr FieldMetadata_Right kRight{};
-  void set_right(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Right::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  using FlagStorageBackend = ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend;
+  static inline const char* FlagStorageBackend_Name(FlagStorageBackend value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend_Name(value);
   }
 
-  using FieldMetadata_Bottom =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      RectProto>;
-
-  static constexpr FieldMetadata_Bottom kBottom{};
-  void set_bottom(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Bottom::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  using FlagType = ::perfetto::protos::pbzero::AndroidAflags_FlagType;
+  static inline const char* FlagType_Name(FlagType value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_FlagType_Name(value);
   }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/winscope_extensions.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_WINSCOPE_EXTENSIONS_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_WINSCOPE_EXTENSIONS_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class WinscopeExtensions_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
- public:
-  WinscopeExtensions_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit WinscopeExtensions_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit WinscopeExtensions_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-};
-
-class WinscopeExtensions : public ::protozero::Message {
- public:
-  using Decoder = WinscopeExtensions_Decoder;
-  static constexpr const char* GetName() { return ".perfetto.protos.WinscopeExtensions"; }
-
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/protolog.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_PROTOLOG_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_PROTOLOG_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class ProtoLogViewerConfig_Group;
-class ProtoLogViewerConfig_MessageData;
-enum ProtoLogLevel : int32_t;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
+  static inline const FlagPermission FLAG_PERMISSION_UNSPECIFIED = FlagPermission::FLAG_PERMISSION_UNSPECIFIED;
+  static inline const FlagPermission FLAG_PERMISSION_READ_ONLY = FlagPermission::FLAG_PERMISSION_READ_ONLY;
+  static inline const FlagPermission FLAG_PERMISSION_READ_WRITE = FlagPermission::FLAG_PERMISSION_READ_WRITE;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_UNSPECIFIED = ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_DEFAULT = ValuePickedFrom::VALUE_PICKED_FROM_DEFAULT;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_SERVER = ValuePickedFrom::VALUE_PICKED_FROM_SERVER;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_LOCAL = ValuePickedFrom::VALUE_PICKED_FROM_LOCAL;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_UNSPECIFIED = FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_NONE = FlagStorageBackend::FLAG_STORAGE_BACKEND_NONE;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_ACONFIGD = FlagStorageBackend::FLAG_STORAGE_BACKEND_ACONFIGD;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_DEVICE_CONFIG = FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG;
+  static inline const FlagType FLAG_TYPE_UNSPECIFIED = FlagType::FLAG_TYPE_UNSPECIFIED;
+  static inline const FlagType FLAG_TYPE_BOOLEAN = FlagType::FLAG_TYPE_BOOLEAN;
+  static inline const FlagType FLAG_TYPE_INTEGER = FlagType::FLAG_TYPE_INTEGER;
 
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class ProtoLogViewerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  ProtoLogViewerConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ProtoLogViewerConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ProtoLogViewerConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_messages() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> messages() const { return GetRepeated<::protozero::ConstBytes>(1); }
-  bool has_groups() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> groups() const { return GetRepeated<::protozero::ConstBytes>(2); }
-};
-
-class ProtoLogViewerConfig : public ::protozero::Message {
- public:
-  using Decoder = ProtoLogViewerConfig_Decoder;
-  enum : int32_t {
-    kMessagesFieldNumber = 1,
-    kGroupsFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ProtoLogViewerConfig"; }
-
-  using MessageData = ::perfetto::protos::pbzero::ProtoLogViewerConfig_MessageData;
-  using Group = ::perfetto::protos::pbzero::ProtoLogViewerConfig_Group;
-
-  using FieldMetadata_Messages =
+  using FieldMetadata_Flags =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ProtoLogViewerConfig_MessageData,
-      ProtoLogViewerConfig>;
+      AndroidAflags_Flag,
+      AndroidAflags>;
 
-  static constexpr FieldMetadata_Messages kMessages{};
-  template <typename T = ProtoLogViewerConfig_MessageData> T* add_messages() {
+  static constexpr FieldMetadata_Flags kFlags{};
+  template <typename T = AndroidAflags_Flag> T* add_flags() {
     return BeginNestedMessage<T>(1);
   }
 
 
-  using FieldMetadata_Groups =
+  using FieldMetadata_Error =
     ::protozero::proto_utils::FieldMetadata<
       2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ProtoLogViewerConfig_Group,
-      ProtoLogViewerConfig>;
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags>;
 
-  static constexpr FieldMetadata_Groups kGroups{};
-  template <typename T = ProtoLogViewerConfig_Group> T* add_groups() {
-    return BeginNestedMessage<T>(2);
+  static constexpr FieldMetadata_Error kError{};
+  void set_error(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Error::kFieldId, data, size);
+  }
+  void set_error(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Error::kFieldId, chars.data, chars.size);
+  }
+  void set_error(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Error::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
   }
-
 };
 
-class ProtoLogViewerConfig_Group_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+class AndroidAflags_Flag_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
  public:
-  ProtoLogViewerConfig_Group_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ProtoLogViewerConfig_Group_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ProtoLogViewerConfig_Group_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  uint32_t id() const { return at<1>().as_uint32(); }
+  AndroidAflags_Flag_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidAflags_Flag_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidAflags_Flag_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_flag_namespace() const { return at<1>().valid(); }
+  ::protozero::ConstChars flag_namespace() const { return at<1>().as_string(); }
   bool has_name() const { return at<2>().valid(); }
   ::protozero::ConstChars name() const { return at<2>().as_string(); }
-  bool has_tag() const { return at<3>().valid(); }
-  ::protozero::ConstChars tag() const { return at<3>().as_string(); }
+  bool has_pkg() const { return at<3>().valid(); }
+  ::protozero::ConstChars pkg() const { return at<3>().as_string(); }
+  bool has_container() const { return at<4>().valid(); }
+  ::protozero::ConstChars container() const { return at<4>().as_string(); }
+  bool has_value() const { return at<5>().valid(); }
+  ::protozero::ConstChars value() const { return at<5>().as_string(); }
+  bool has_staged_value() const { return at<6>().valid(); }
+  ::protozero::ConstChars staged_value() const { return at<6>().as_string(); }
+  bool has_permission() const { return at<7>().valid(); }
+  int32_t permission() const { return at<7>().as_int32(); }
+  bool has_value_picked_from() const { return at<8>().valid(); }
+  int32_t value_picked_from() const { return at<8>().as_int32(); }
+  bool has_storage_backend() const { return at<9>().valid(); }
+  int32_t storage_backend() const { return at<9>().as_int32(); }
+  bool has_type() const { return at<10>().valid(); }
+  int32_t type() const { return at<10>().as_int32(); }
 };
 
-class ProtoLogViewerConfig_Group : public ::protozero::Message {
+class AndroidAflags_Flag : public ::protozero::Message {
  public:
-  using Decoder = ProtoLogViewerConfig_Group_Decoder;
+  using Decoder = AndroidAflags_Flag_Decoder;
   enum : int32_t {
-    kIdFieldNumber = 1,
+    kFlagNamespaceFieldNumber = 1,
     kNameFieldNumber = 2,
-    kTagFieldNumber = 3,
+    kPkgFieldNumber = 3,
+    kContainerFieldNumber = 4,
+    kValueFieldNumber = 5,
+    kStagedValueFieldNumber = 6,
+    kPermissionFieldNumber = 7,
+    kValuePickedFromFieldNumber = 8,
+    kStorageBackendFieldNumber = 9,
+    kTypeFieldNumber = 10,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.ProtoLogViewerConfig.Group"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidAflags.Flag"; }
 
 
-  using FieldMetadata_Id =
+  using FieldMetadata_FlagNamespace =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ProtoLogViewerConfig_Group>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
+  static constexpr FieldMetadata_FlagNamespace kFlagNamespace{};
+  void set_flag_namespace(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_FlagNamespace::kFieldId, data, size);
+  }
+  void set_flag_namespace(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_FlagNamespace::kFieldId, chars.data, chars.size);
+  }
+  void set_flag_namespace(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_FlagNamespace::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
@@ -65945,7 +69369,7 @@ class ProtoLogViewerConfig_Group : public ::protozero::Message {
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      ProtoLogViewerConfig_Group>;
+      AndroidAflags_Flag>;
 
   static constexpr FieldMetadata_Name kName{};
   void set_name(const char* data, size_t size) {
@@ -65963,96 +69387,47 @@ class ProtoLogViewerConfig_Group : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Tag =
+  using FieldMetadata_Pkg =
     ::protozero::proto_utils::FieldMetadata<
       3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      ProtoLogViewerConfig_Group>;
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Tag kTag{};
-  void set_tag(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Tag::kFieldId, data, size);
+  static constexpr FieldMetadata_Pkg kPkg{};
+  void set_pkg(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Pkg::kFieldId, data, size);
   }
-  void set_tag(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Tag::kFieldId, chars.data, chars.size);
+  void set_pkg(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Pkg::kFieldId, chars.data, chars.size);
   }
-  void set_tag(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tag::kFieldId;
+  void set_pkg(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pkg::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
       ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
-};
-
-class ProtoLogViewerConfig_MessageData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  ProtoLogViewerConfig_MessageData_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ProtoLogViewerConfig_MessageData_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ProtoLogViewerConfig_MessageData_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_message_id() const { return at<1>().valid(); }
-  uint64_t message_id() const { return at<1>().as_uint64(); }
-  bool has_message() const { return at<2>().valid(); }
-  ::protozero::ConstChars message() const { return at<2>().as_string(); }
-  bool has_level() const { return at<3>().valid(); }
-  int32_t level() const { return at<3>().as_int32(); }
-  bool has_group_id() const { return at<4>().valid(); }
-  uint32_t group_id() const { return at<4>().as_uint32(); }
-  bool has_location() const { return at<5>().valid(); }
-  ::protozero::ConstChars location() const { return at<5>().as_string(); }
-};
-
-class ProtoLogViewerConfig_MessageData : public ::protozero::Message {
- public:
-  using Decoder = ProtoLogViewerConfig_MessageData_Decoder;
-  enum : int32_t {
-    kMessageIdFieldNumber = 1,
-    kMessageFieldNumber = 2,
-    kLevelFieldNumber = 3,
-    kGroupIdFieldNumber = 4,
-    kLocationFieldNumber = 5,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ProtoLogViewerConfig.MessageData"; }
-
-
-  using FieldMetadata_MessageId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64,
-      uint64_t,
-      ProtoLogViewerConfig_MessageData>;
-
-  static constexpr FieldMetadata_MessageId kMessageId{};
-  void set_message_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MessageId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64>
-        ::Append(*this, field_id, value);
-  }
 
-  using FieldMetadata_Message =
+  using FieldMetadata_Container =
     ::protozero::proto_utils::FieldMetadata<
-      2,
+      4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      ProtoLogViewerConfig_MessageData>;
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Message kMessage{};
-  void set_message(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Message::kFieldId, data, size);
+  static constexpr FieldMetadata_Container kContainer{};
+  void set_container(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Container::kFieldId, data, size);
   }
-  void set_message(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Message::kFieldId, chars.data, chars.size);
+  void set_container(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Container::kFieldId, chars.data, chars.size);
   }
-  void set_message(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Message::kFieldId;
+  void set_container(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Container::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -66060,8363 +69435,125 @@ class ProtoLogViewerConfig_MessageData : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Level =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      ProtoLogLevel,
-      ProtoLogViewerConfig_MessageData>;
-
-  static constexpr FieldMetadata_Level kLevel{};
-  void set_level(ProtoLogLevel value) {
-    static constexpr uint32_t field_id = FieldMetadata_Level::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_GroupId =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ProtoLogViewerConfig_MessageData>;
-
-  static constexpr FieldMetadata_GroupId kGroupId{};
-  void set_group_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_GroupId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Location =
+  using FieldMetadata_Value =
     ::protozero::proto_utils::FieldMetadata<
       5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      ProtoLogViewerConfig_MessageData>;
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Location kLocation{};
-  void set_location(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Location::kFieldId, data, size);
+  static constexpr FieldMetadata_Value kValue{};
+  void set_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
   }
-  void set_location(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Location::kFieldId, chars.data, chars.size);
+  void set_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Value::kFieldId, chars.data, chars.size);
   }
-  void set_location(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Location::kFieldId;
+  void set_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
       ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
-};
-
-class ProtoLogMessage_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
- public:
-  ProtoLogMessage_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ProtoLogMessage_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ProtoLogMessage_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_message_id() const { return at<1>().valid(); }
-  uint64_t message_id() const { return at<1>().as_uint64(); }
-  bool has_str_param_iids() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<uint32_t> str_param_iids() const { return GetRepeated<uint32_t>(2); }
-  bool has_sint64_params() const { return at<3>().valid(); }
-  ::protozero::RepeatedFieldIterator<int64_t> sint64_params() const { return GetRepeated<int64_t>(3); }
-  bool has_double_params() const { return at<4>().valid(); }
-  ::protozero::RepeatedFieldIterator<double> double_params() const { return GetRepeated<double>(4); }
-  bool has_boolean_params() const { return at<5>().valid(); }
-  ::protozero::RepeatedFieldIterator<int32_t> boolean_params() const { return GetRepeated<int32_t>(5); }
-  bool has_stacktrace_iid() const { return at<6>().valid(); }
-  uint32_t stacktrace_iid() const { return at<6>().as_uint32(); }
-};
-
-class ProtoLogMessage : public ::protozero::Message {
- public:
-  using Decoder = ProtoLogMessage_Decoder;
-  enum : int32_t {
-    kMessageIdFieldNumber = 1,
-    kStrParamIidsFieldNumber = 2,
-    kSint64ParamsFieldNumber = 3,
-    kDoubleParamsFieldNumber = 4,
-    kBooleanParamsFieldNumber = 5,
-    kStacktraceIidFieldNumber = 6,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ProtoLogMessage"; }
-
-
-  using FieldMetadata_MessageId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64,
-      uint64_t,
-      ProtoLogMessage>;
-
-  static constexpr FieldMetadata_MessageId kMessageId{};
-  void set_message_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MessageId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StrParamIids =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ProtoLogMessage>;
-
-  static constexpr FieldMetadata_StrParamIids kStrParamIids{};
-  void add_str_param_iids(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StrParamIids::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
 
-  using FieldMetadata_Sint64Params =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kSint64,
-      int64_t,
-      ProtoLogMessage>;
-
-  static constexpr FieldMetadata_Sint64Params kSint64Params{};
-  void add_sint64_params(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Sint64Params::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kSint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DoubleParams =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kDouble,
-      double,
-      ProtoLogMessage>;
-
-  static constexpr FieldMetadata_DoubleParams kDoubleParams{};
-  void add_double_params(double value) {
-    static constexpr uint32_t field_id = FieldMetadata_DoubleParams::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kDouble>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BooleanParams =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ProtoLogMessage>;
-
-  static constexpr FieldMetadata_BooleanParams kBooleanParams{};
-  void add_boolean_params(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_BooleanParams::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StacktraceIid =
+  using FieldMetadata_StagedValue =
     ::protozero::proto_utils::FieldMetadata<
       6,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ProtoLogMessage>;
-
-  static constexpr FieldMetadata_StacktraceIid kStacktraceIid{};
-  void set_stacktrace_iid(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StacktraceIid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/shell_transition.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SHELL_TRANSITION_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SHELL_TRANSITION_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class ShellHandlerMapping;
-class ShellTransition_Target;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class ShellHandlerMapping_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  ShellHandlerMapping_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ShellHandlerMapping_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ShellHandlerMapping_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  int32_t id() const { return at<1>().as_int32(); }
-  bool has_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars name() const { return at<2>().as_string(); }
-};
-
-class ShellHandlerMapping : public ::protozero::Message {
- public:
-  using Decoder = ShellHandlerMapping_Decoder;
-  enum : int32_t {
-    kIdFieldNumber = 1,
-    kNameFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ShellHandlerMapping"; }
-
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellHandlerMapping>;
-
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      ShellHandlerMapping>;
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  static constexpr FieldMetadata_StagedValue kStagedValue{};
+  void set_staged_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_StagedValue::kFieldId, data, size);
   }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  void set_staged_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_StagedValue::kFieldId, chars.data, chars.size);
   }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+  void set_staged_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_StagedValue::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
       ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
-};
-
-class ShellHandlerMappings_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  ShellHandlerMappings_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ShellHandlerMappings_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ShellHandlerMappings_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_mapping() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> mapping() const { return GetRepeated<::protozero::ConstBytes>(1); }
-};
-
-class ShellHandlerMappings : public ::protozero::Message {
- public:
-  using Decoder = ShellHandlerMappings_Decoder;
-  enum : int32_t {
-    kMappingFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ShellHandlerMappings"; }
-
-
-  using FieldMetadata_Mapping =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ShellHandlerMapping,
-      ShellHandlerMappings>;
-
-  static constexpr FieldMetadata_Mapping kMapping{};
-  template <typename T = ShellHandlerMapping> T* add_mapping() {
-    return BeginNestedMessage<T>(1);
-  }
-
-};
-
-class ShellTransition_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/17> {
- public:
-  ShellTransition_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ShellTransition_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ShellTransition_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  int32_t id() const { return at<1>().as_int32(); }
-  bool has_create_time_ns() const { return at<2>().valid(); }
-  int64_t create_time_ns() const { return at<2>().as_int64(); }
-  bool has_send_time_ns() const { return at<3>().valid(); }
-  int64_t send_time_ns() const { return at<3>().as_int64(); }
-  bool has_dispatch_time_ns() const { return at<4>().valid(); }
-  int64_t dispatch_time_ns() const { return at<4>().as_int64(); }
-  bool has_merge_time_ns() const { return at<5>().valid(); }
-  int64_t merge_time_ns() const { return at<5>().as_int64(); }
-  bool has_merge_request_time_ns() const { return at<6>().valid(); }
-  int64_t merge_request_time_ns() const { return at<6>().as_int64(); }
-  bool has_shell_abort_time_ns() const { return at<7>().valid(); }
-  int64_t shell_abort_time_ns() const { return at<7>().as_int64(); }
-  bool has_wm_abort_time_ns() const { return at<8>().valid(); }
-  int64_t wm_abort_time_ns() const { return at<8>().as_int64(); }
-  bool has_finish_time_ns() const { return at<9>().valid(); }
-  int64_t finish_time_ns() const { return at<9>().as_int64(); }
-  bool has_start_transaction_id() const { return at<10>().valid(); }
-  uint64_t start_transaction_id() const { return at<10>().as_uint64(); }
-  bool has_finish_transaction_id() const { return at<11>().valid(); }
-  uint64_t finish_transaction_id() const { return at<11>().as_uint64(); }
-  bool has_handler() const { return at<12>().valid(); }
-  int32_t handler() const { return at<12>().as_int32(); }
-  bool has_type() const { return at<13>().valid(); }
-  int32_t type() const { return at<13>().as_int32(); }
-  bool has_targets() const { return at<14>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> targets() const { return GetRepeated<::protozero::ConstBytes>(14); }
-  bool has_merge_target() const { return at<15>().valid(); }
-  int32_t merge_target() const { return at<15>().as_int32(); }
-  bool has_flags() const { return at<16>().valid(); }
-  int32_t flags() const { return at<16>().as_int32(); }
-  bool has_starting_window_remove_time_ns() const { return at<17>().valid(); }
-  int64_t starting_window_remove_time_ns() const { return at<17>().as_int64(); }
-};
-
-class ShellTransition : public ::protozero::Message {
- public:
-  using Decoder = ShellTransition_Decoder;
-  enum : int32_t {
-    kIdFieldNumber = 1,
-    kCreateTimeNsFieldNumber = 2,
-    kSendTimeNsFieldNumber = 3,
-    kDispatchTimeNsFieldNumber = 4,
-    kMergeTimeNsFieldNumber = 5,
-    kMergeRequestTimeNsFieldNumber = 6,
-    kShellAbortTimeNsFieldNumber = 7,
-    kWmAbortTimeNsFieldNumber = 8,
-    kFinishTimeNsFieldNumber = 9,
-    kStartTransactionIdFieldNumber = 10,
-    kFinishTransactionIdFieldNumber = 11,
-    kHandlerFieldNumber = 12,
-    kTypeFieldNumber = 13,
-    kTargetsFieldNumber = 14,
-    kMergeTargetFieldNumber = 15,
-    kFlagsFieldNumber = 16,
-    kStartingWindowRemoveTimeNsFieldNumber = 17,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ShellTransition"; }
-
-  using Target = ::perfetto::protos::pbzero::ShellTransition_Target;
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CreateTimeNs =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_CreateTimeNs kCreateTimeNs{};
-  void set_create_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CreateTimeNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SendTimeNs =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_SendTimeNs kSendTimeNs{};
-  void set_send_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SendTimeNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DispatchTimeNs =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_DispatchTimeNs kDispatchTimeNs{};
-  void set_dispatch_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DispatchTimeNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_MergeTimeNs =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_MergeTimeNs kMergeTimeNs{};
-  void set_merge_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MergeTimeNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_MergeRequestTimeNs =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_MergeRequestTimeNs kMergeRequestTimeNs{};
-  void set_merge_request_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MergeRequestTimeNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
 
-  using FieldMetadata_ShellAbortTimeNs =
+  using FieldMetadata_Permission =
     ::protozero::proto_utils::FieldMetadata<
       7,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      AndroidAflags_FlagPermission,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_ShellAbortTimeNs kShellAbortTimeNs{};
-  void set_shell_abort_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ShellAbortTimeNs::kFieldId;
+  static constexpr FieldMetadata_Permission kPermission{};
+  void set_permission(AndroidAflags_FlagPermission value) {
+    static constexpr uint32_t field_id = FieldMetadata_Permission::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_WmAbortTimeNs =
+  using FieldMetadata_ValuePickedFrom =
     ::protozero::proto_utils::FieldMetadata<
       8,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      AndroidAflags_ValuePickedFrom,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_WmAbortTimeNs kWmAbortTimeNs{};
-  void set_wm_abort_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_WmAbortTimeNs::kFieldId;
+  static constexpr FieldMetadata_ValuePickedFrom kValuePickedFrom{};
+  void set_value_picked_from(AndroidAflags_ValuePickedFrom value) {
+    static constexpr uint32_t field_id = FieldMetadata_ValuePickedFrom::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_FinishTimeNs =
+  using FieldMetadata_StorageBackend =
     ::protozero::proto_utils::FieldMetadata<
       9,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_FinishTimeNs kFinishTimeNs{};
-  void set_finish_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FinishTimeNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StartTransactionId =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_StartTransactionId kStartTransactionId{};
-  void set_start_transaction_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StartTransactionId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FinishTransactionId =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_FinishTransactionId kFinishTransactionId{};
-  void set_finish_transaction_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FinishTransactionId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Handler =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      AndroidAflags_FlagStorageBackend,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Handler kHandler{};
-  void set_handler(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Handler::kFieldId;
+  static constexpr FieldMetadata_StorageBackend kStorageBackend{};
+  void set_storage_backend(AndroidAflags_FlagStorageBackend value) {
+    static constexpr uint32_t field_id = FieldMetadata_StorageBackend::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
 
   using FieldMetadata_Type =
     ::protozero::proto_utils::FieldMetadata<
-      13,
+      10,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      AndroidAflags_FlagType,
+      AndroidAflags_Flag>;
 
   static constexpr FieldMetadata_Type kType{};
-  void set_type(int32_t value) {
+  void set_type(AndroidAflags_FlagType value) {
     static constexpr uint32_t field_id = FieldMetadata_Type::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Targets =
-    ::protozero::proto_utils::FieldMetadata<
-      14,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ShellTransition_Target,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_Targets kTargets{};
-  template <typename T = ShellTransition_Target> T* add_targets() {
-    return BeginNestedMessage<T>(14);
-  }
-
-
-  using FieldMetadata_MergeTarget =
-    ::protozero::proto_utils::FieldMetadata<
-      15,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_MergeTarget kMergeTarget{};
-  void set_merge_target(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MergeTarget::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      16,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StartingWindowRemoveTimeNs =
-    ::protozero::proto_utils::FieldMetadata<
-      17,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      ShellTransition>;
-
-  static constexpr FieldMetadata_StartingWindowRemoveTimeNs kStartingWindowRemoveTimeNs{};
-  void set_starting_window_remove_time_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StartingWindowRemoveTimeNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class ShellTransition_Target_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  ShellTransition_Target_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ShellTransition_Target_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ShellTransition_Target_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_mode() const { return at<1>().valid(); }
-  int32_t mode() const { return at<1>().as_int32(); }
-  bool has_layer_id() const { return at<2>().valid(); }
-  int32_t layer_id() const { return at<2>().as_int32(); }
-  bool has_window_id() const { return at<3>().valid(); }
-  int32_t window_id() const { return at<3>().as_int32(); }
-  bool has_flags() const { return at<4>().valid(); }
-  int32_t flags() const { return at<4>().as_int32(); }
-};
-
-class ShellTransition_Target : public ::protozero::Message {
- public:
-  using Decoder = ShellTransition_Target_Decoder;
-  enum : int32_t {
-    kModeFieldNumber = 1,
-    kLayerIdFieldNumber = 2,
-    kWindowIdFieldNumber = 3,
-    kFlagsFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ShellTransition.Target"; }
-
-
-  using FieldMetadata_Mode =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition_Target>;
-
-  static constexpr FieldMetadata_Mode kMode{};
-  void set_mode(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Mode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayerId =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition_Target>;
-
-  static constexpr FieldMetadata_LayerId kLayerId{};
-  void set_layer_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_WindowId =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition_Target>;
-
-  static constexpr FieldMetadata_WindowId kWindowId{};
-  void set_window_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_WindowId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ShellTransition_Target>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/surfaceflinger_common.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SURFACEFLINGER_COMMON_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SURFACEFLINGER_COMMON_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class BoxShadowSettings_BoxShadowParams;
-class RectProto;
-class RegionProto;
-class TransformProto;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-enum TrustedOverlay : int32_t {
-  UNSET = 0,
-  DISABLED = 1,
-  ENABLED = 2,
-};
-
-constexpr TrustedOverlay TrustedOverlay_MIN = TrustedOverlay::UNSET;
-constexpr TrustedOverlay TrustedOverlay_MAX = TrustedOverlay::ENABLED;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* TrustedOverlay_Name(::perfetto::protos::pbzero::TrustedOverlay value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::TrustedOverlay::UNSET:
-    return "UNSET";
-
-  case ::perfetto::protos::pbzero::TrustedOverlay::DISABLED:
-    return "DISABLED";
-
-  case ::perfetto::protos::pbzero::TrustedOverlay::ENABLED:
-    return "ENABLED";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class BorderSettings_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  BorderSettings_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit BorderSettings_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit BorderSettings_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_stroke_width() const { return at<1>().valid(); }
-  float stroke_width() const { return at<1>().as_float(); }
-  bool has_color() const { return at<2>().valid(); }
-  int32_t color() const { return at<2>().as_int32(); }
-};
-
-class BorderSettings : public ::protozero::Message {
- public:
-  using Decoder = BorderSettings_Decoder;
-  enum : int32_t {
-    kStrokeWidthFieldNumber = 1,
-    kColorFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.BorderSettings"; }
-
-
-  using FieldMetadata_StrokeWidth =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BorderSettings>;
-
-  static constexpr FieldMetadata_StrokeWidth kStrokeWidth{};
-  void set_stroke_width(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_StrokeWidth::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Color =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      BorderSettings>;
-
-  static constexpr FieldMetadata_Color kColor{};
-  void set_color(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Color::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class BoxShadowSettings_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  BoxShadowSettings_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit BoxShadowSettings_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit BoxShadowSettings_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_box_shadows() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> box_shadows() const { return GetRepeated<::protozero::ConstBytes>(1); }
-};
-
-class BoxShadowSettings : public ::protozero::Message {
- public:
-  using Decoder = BoxShadowSettings_Decoder;
-  enum : int32_t {
-    kBoxShadowsFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.BoxShadowSettings"; }
-
-  using BoxShadowParams = ::perfetto::protos::pbzero::BoxShadowSettings_BoxShadowParams;
-
-  using FieldMetadata_BoxShadows =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BoxShadowSettings_BoxShadowParams,
-      BoxShadowSettings>;
-
-  static constexpr FieldMetadata_BoxShadows kBoxShadows{};
-  template <typename T = BoxShadowSettings_BoxShadowParams> T* add_box_shadows() {
-    return BeginNestedMessage<T>(1);
-  }
-
-};
-
-class BoxShadowSettings_BoxShadowParams_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  BoxShadowSettings_BoxShadowParams_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit BoxShadowSettings_BoxShadowParams_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit BoxShadowSettings_BoxShadowParams_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_blur_radius() const { return at<1>().valid(); }
-  float blur_radius() const { return at<1>().as_float(); }
-  bool has_spread_radius() const { return at<2>().valid(); }
-  float spread_radius() const { return at<2>().as_float(); }
-  bool has_color() const { return at<3>().valid(); }
-  int32_t color() const { return at<3>().as_int32(); }
-  bool has_offset_x() const { return at<4>().valid(); }
-  float offset_x() const { return at<4>().as_float(); }
-  bool has_offset_y() const { return at<5>().valid(); }
-  float offset_y() const { return at<5>().as_float(); }
-};
-
-class BoxShadowSettings_BoxShadowParams : public ::protozero::Message {
- public:
-  using Decoder = BoxShadowSettings_BoxShadowParams_Decoder;
-  enum : int32_t {
-    kBlurRadiusFieldNumber = 1,
-    kSpreadRadiusFieldNumber = 2,
-    kColorFieldNumber = 3,
-    kOffsetXFieldNumber = 4,
-    kOffsetYFieldNumber = 5,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.BoxShadowSettings.BoxShadowParams"; }
-
-
-  using FieldMetadata_BlurRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BoxShadowSettings_BoxShadowParams>;
-
-  static constexpr FieldMetadata_BlurRadius kBlurRadius{};
-  void set_blur_radius(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_BlurRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SpreadRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BoxShadowSettings_BoxShadowParams>;
-
-  static constexpr FieldMetadata_SpreadRadius kSpreadRadius{};
-  void set_spread_radius(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_SpreadRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Color =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      BoxShadowSettings_BoxShadowParams>;
-
-  static constexpr FieldMetadata_Color kColor{};
-  void set_color(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Color::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_OffsetX =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BoxShadowSettings_BoxShadowParams>;
-
-  static constexpr FieldMetadata_OffsetX kOffsetX{};
-  void set_offset_x(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_OffsetX::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_OffsetY =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BoxShadowSettings_BoxShadowParams>;
-
-  static constexpr FieldMetadata_OffsetY kOffsetY{};
-  void set_offset_y(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_OffsetY::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class ColorTransformProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  ColorTransformProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ColorTransformProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ColorTransformProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_val() const { return at<1>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kFixed32, float> val(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kFixed32, float>(1, parse_error_ptr); }
-};
-
-class ColorTransformProto : public ::protozero::Message {
- public:
-  using Decoder = ColorTransformProto_Decoder;
-  enum : int32_t {
-    kValFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ColorTransformProto"; }
-
-
-  using FieldMetadata_Val =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      ColorTransformProto>;
-
-  static constexpr FieldMetadata_Val kVal{};
-  void set_val(const ::protozero::PackedFixedSizeInt<float>& packed_buffer) {
-    AppendBytes(FieldMetadata_Val::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-};
-
-class BlurRegion_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/18> {
- public:
-  BlurRegion_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit BlurRegion_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit BlurRegion_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_blur_radius() const { return at<1>().valid(); }
-  uint32_t blur_radius() const { return at<1>().as_uint32(); }
-  bool has_corner_radius_tl() const { return at<2>().valid(); }
-  uint32_t corner_radius_tl() const { return at<2>().as_uint32(); }
-  bool has_corner_radius_tr() const { return at<3>().valid(); }
-  uint32_t corner_radius_tr() const { return at<3>().as_uint32(); }
-  bool has_corner_radius_bl() const { return at<4>().valid(); }
-  uint32_t corner_radius_bl() const { return at<4>().as_uint32(); }
-  bool has_corner_radius_br() const { return at<5>().valid(); }
-  float corner_radius_br() const { return at<5>().as_float(); }
-  bool has_corner_radius_tlx() const { return at<11>().valid(); }
-  float corner_radius_tlx() const { return at<11>().as_float(); }
-  bool has_corner_radius_tly() const { return at<12>().valid(); }
-  float corner_radius_tly() const { return at<12>().as_float(); }
-  bool has_corner_radius_trx() const { return at<13>().valid(); }
-  float corner_radius_trx() const { return at<13>().as_float(); }
-  bool has_corner_radius_try() const { return at<14>().valid(); }
-  float corner_radius_try() const { return at<14>().as_float(); }
-  bool has_corner_radius_blx() const { return at<15>().valid(); }
-  float corner_radius_blx() const { return at<15>().as_float(); }
-  bool has_corner_radius_bly() const { return at<16>().valid(); }
-  float corner_radius_bly() const { return at<16>().as_float(); }
-  bool has_corner_radius_brx() const { return at<17>().valid(); }
-  float corner_radius_brx() const { return at<17>().as_float(); }
-  bool has_corner_radius_bry() const { return at<18>().valid(); }
-  float corner_radius_bry() const { return at<18>().as_float(); }
-  bool has_alpha() const { return at<6>().valid(); }
-  float alpha() const { return at<6>().as_float(); }
-  bool has_left() const { return at<7>().valid(); }
-  int32_t left() const { return at<7>().as_int32(); }
-  bool has_top() const { return at<8>().valid(); }
-  int32_t top() const { return at<8>().as_int32(); }
-  bool has_right() const { return at<9>().valid(); }
-  int32_t right() const { return at<9>().as_int32(); }
-  bool has_bottom() const { return at<10>().valid(); }
-  int32_t bottom() const { return at<10>().as_int32(); }
-};
-
-class BlurRegion : public ::protozero::Message {
- public:
-  using Decoder = BlurRegion_Decoder;
-  enum : int32_t {
-    kBlurRadiusFieldNumber = 1,
-    kCornerRadiusTlFieldNumber = 2,
-    kCornerRadiusTrFieldNumber = 3,
-    kCornerRadiusBlFieldNumber = 4,
-    kCornerRadiusBrFieldNumber = 5,
-    kCornerRadiusTlxFieldNumber = 11,
-    kCornerRadiusTlyFieldNumber = 12,
-    kCornerRadiusTrxFieldNumber = 13,
-    kCornerRadiusTryFieldNumber = 14,
-    kCornerRadiusBlxFieldNumber = 15,
-    kCornerRadiusBlyFieldNumber = 16,
-    kCornerRadiusBrxFieldNumber = 17,
-    kCornerRadiusBryFieldNumber = 18,
-    kAlphaFieldNumber = 6,
-    kLeftFieldNumber = 7,
-    kTopFieldNumber = 8,
-    kRightFieldNumber = 9,
-    kBottomFieldNumber = 10,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.BlurRegion"; }
-
-
-  using FieldMetadata_BlurRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_BlurRadius kBlurRadius{};
-  void set_blur_radius(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_BlurRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusTl =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusTl kCornerRadiusTl{};
-  void set_corner_radius_tl(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusTl::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusTr =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusTr kCornerRadiusTr{};
-  void set_corner_radius_tr(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusTr::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusBl =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusBl kCornerRadiusBl{};
-  void set_corner_radius_bl(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusBl::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusBr =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusBr kCornerRadiusBr{};
-  void set_corner_radius_br(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusBr::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusTlx =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusTlx kCornerRadiusTlx{};
-  void set_corner_radius_tlx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusTlx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusTly =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusTly kCornerRadiusTly{};
-  void set_corner_radius_tly(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusTly::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusTrx =
-    ::protozero::proto_utils::FieldMetadata<
-      13,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusTrx kCornerRadiusTrx{};
-  void set_corner_radius_trx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusTrx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusTry =
-    ::protozero::proto_utils::FieldMetadata<
-      14,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusTry kCornerRadiusTry{};
-  void set_corner_radius_try(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusTry::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusBlx =
-    ::protozero::proto_utils::FieldMetadata<
-      15,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusBlx kCornerRadiusBlx{};
-  void set_corner_radius_blx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusBlx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusBly =
-    ::protozero::proto_utils::FieldMetadata<
-      16,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusBly kCornerRadiusBly{};
-  void set_corner_radius_bly(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusBly::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusBrx =
-    ::protozero::proto_utils::FieldMetadata<
-      17,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusBrx kCornerRadiusBrx{};
-  void set_corner_radius_brx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusBrx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadiusBry =
-    ::protozero::proto_utils::FieldMetadata<
-      18,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_CornerRadiusBry kCornerRadiusBry{};
-  void set_corner_radius_bry(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadiusBry::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Alpha =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_Alpha kAlpha{};
-  void set_alpha(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Alpha::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Left =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_Left kLeft{};
-  void set_left(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Left::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Top =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_Top kTop{};
-  void set_top(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Top::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Right =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_Right kRight{};
-  void set_right(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Right::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Bottom =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      BlurRegion>;
-
-  static constexpr FieldMetadata_Bottom kBottom{};
-  void set_bottom(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Bottom::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class InputWindowInfoProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/17> {
- public:
-  InputWindowInfoProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit InputWindowInfoProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit InputWindowInfoProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_layout_params_flags() const { return at<1>().valid(); }
-  uint32_t layout_params_flags() const { return at<1>().as_uint32(); }
-  bool has_layout_params_type() const { return at<2>().valid(); }
-  int32_t layout_params_type() const { return at<2>().as_int32(); }
-  bool has_frame() const { return at<3>().valid(); }
-  ::protozero::ConstBytes frame() const { return at<3>().as_bytes(); }
-  bool has_touchable_region() const { return at<4>().valid(); }
-  ::protozero::ConstBytes touchable_region() const { return at<4>().as_bytes(); }
-  bool has_surface_inset() const { return at<5>().valid(); }
-  int32_t surface_inset() const { return at<5>().as_int32(); }
-  bool has_visible() const { return at<6>().valid(); }
-  bool visible() const { return at<6>().as_bool(); }
-  bool has_can_receive_keys() const { return at<7>().valid(); }
-  bool can_receive_keys() const { return at<7>().as_bool(); }
-  bool has_focusable() const { return at<8>().valid(); }
-  bool focusable() const { return at<8>().as_bool(); }
-  bool has_has_wallpaper() const { return at<9>().valid(); }
-  bool has_wallpaper() const { return at<9>().as_bool(); }
-  bool has_global_scale_factor() const { return at<10>().valid(); }
-  float global_scale_factor() const { return at<10>().as_float(); }
-  bool has_window_x_scale() const { return at<11>().valid(); }
-  float window_x_scale() const { return at<11>().as_float(); }
-  bool has_window_y_scale() const { return at<12>().valid(); }
-  float window_y_scale() const { return at<12>().as_float(); }
-  bool has_crop_layer_id() const { return at<13>().valid(); }
-  int32_t crop_layer_id() const { return at<13>().as_int32(); }
-  bool has_replace_touchable_region_with_crop() const { return at<14>().valid(); }
-  bool replace_touchable_region_with_crop() const { return at<14>().as_bool(); }
-  bool has_touchable_region_crop() const { return at<15>().valid(); }
-  ::protozero::ConstBytes touchable_region_crop() const { return at<15>().as_bytes(); }
-  bool has_transform() const { return at<16>().valid(); }
-  ::protozero::ConstBytes transform() const { return at<16>().as_bytes(); }
-  bool has_input_config() const { return at<17>().valid(); }
-  uint32_t input_config() const { return at<17>().as_uint32(); }
-};
-
-class InputWindowInfoProto : public ::protozero::Message {
- public:
-  using Decoder = InputWindowInfoProto_Decoder;
-  enum : int32_t {
-    kLayoutParamsFlagsFieldNumber = 1,
-    kLayoutParamsTypeFieldNumber = 2,
-    kFrameFieldNumber = 3,
-    kTouchableRegionFieldNumber = 4,
-    kSurfaceInsetFieldNumber = 5,
-    kVisibleFieldNumber = 6,
-    kCanReceiveKeysFieldNumber = 7,
-    kFocusableFieldNumber = 8,
-    kHasWallpaperFieldNumber = 9,
-    kGlobalScaleFactorFieldNumber = 10,
-    kWindowXScaleFieldNumber = 11,
-    kWindowYScaleFieldNumber = 12,
-    kCropLayerIdFieldNumber = 13,
-    kReplaceTouchableRegionWithCropFieldNumber = 14,
-    kTouchableRegionCropFieldNumber = 15,
-    kTransformFieldNumber = 16,
-    kInputConfigFieldNumber = 17,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.InputWindowInfoProto"; }
-
-
-  using FieldMetadata_LayoutParamsFlags =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_LayoutParamsFlags kLayoutParamsFlags{};
-  void set_layout_params_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayoutParamsFlags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayoutParamsType =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_LayoutParamsType kLayoutParamsType{};
-  void set_layout_params_type(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayoutParamsType::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Frame =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_Frame kFrame{};
-  template <typename T = RectProto> T* set_frame() {
-    return BeginNestedMessage<T>(3);
-  }
-
-
-  using FieldMetadata_TouchableRegion =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RegionProto,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_TouchableRegion kTouchableRegion{};
-  template <typename T = RegionProto> T* set_touchable_region() {
-    return BeginNestedMessage<T>(4);
-  }
-
-
-  using FieldMetadata_SurfaceInset =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_SurfaceInset kSurfaceInset{};
-  void set_surface_inset(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SurfaceInset::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Visible =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_Visible kVisible{};
-  void set_visible(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_Visible::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CanReceiveKeys =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_CanReceiveKeys kCanReceiveKeys{};
-  void set_can_receive_keys(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_CanReceiveKeys::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Focusable =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_Focusable kFocusable{};
-  void set_focusable(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_Focusable::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_HasWallpaper =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_HasWallpaper kHasWallpaper{};
-  void set_has_wallpaper(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_HasWallpaper::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_GlobalScaleFactor =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_GlobalScaleFactor kGlobalScaleFactor{};
-  void set_global_scale_factor(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_GlobalScaleFactor::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_WindowXScale =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_WindowXScale kWindowXScale{};
-  void set_window_x_scale(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_WindowXScale::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_WindowYScale =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_WindowYScale kWindowYScale{};
-  void set_window_y_scale(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_WindowYScale::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CropLayerId =
-    ::protozero::proto_utils::FieldMetadata<
-      13,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_CropLayerId kCropLayerId{};
-  void set_crop_layer_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CropLayerId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ReplaceTouchableRegionWithCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      14,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_ReplaceTouchableRegionWithCrop kReplaceTouchableRegionWithCrop{};
-  void set_replace_touchable_region_with_crop(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ReplaceTouchableRegionWithCrop::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TouchableRegionCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      15,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_TouchableRegionCrop kTouchableRegionCrop{};
-  template <typename T = RectProto> T* set_touchable_region_crop() {
-    return BeginNestedMessage<T>(15);
-  }
-
-
-  using FieldMetadata_Transform =
-    ::protozero::proto_utils::FieldMetadata<
-      16,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransformProto,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_Transform kTransform{};
-  template <typename T = TransformProto> T* set_transform() {
-    return BeginNestedMessage<T>(16);
-  }
-
-
-  using FieldMetadata_InputConfig =
-    ::protozero::proto_utils::FieldMetadata<
-      17,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      InputWindowInfoProto>;
-
-  static constexpr FieldMetadata_InputConfig kInputConfig{};
-  void set_input_config(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_InputConfig::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class ColorProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  ColorProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ColorProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ColorProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_r() const { return at<1>().valid(); }
-  float r() const { return at<1>().as_float(); }
-  bool has_g() const { return at<2>().valid(); }
-  float g() const { return at<2>().as_float(); }
-  bool has_b() const { return at<3>().valid(); }
-  float b() const { return at<3>().as_float(); }
-  bool has_a() const { return at<4>().valid(); }
-  float a() const { return at<4>().as_float(); }
-};
-
-class ColorProto : public ::protozero::Message {
- public:
-  using Decoder = ColorProto_Decoder;
-  enum : int32_t {
-    kRFieldNumber = 1,
-    kGFieldNumber = 2,
-    kBFieldNumber = 3,
-    kAFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ColorProto"; }
-
-
-  using FieldMetadata_R =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      ColorProto>;
-
-  static constexpr FieldMetadata_R kR{};
-  void set_r(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_R::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_G =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      ColorProto>;
-
-  static constexpr FieldMetadata_G kG{};
-  void set_g(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_G::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_B =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      ColorProto>;
-
-  static constexpr FieldMetadata_B kB{};
-  void set_b(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_B::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_A =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      ColorProto>;
-
-  static constexpr FieldMetadata_A kA{};
-  void set_a(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_A::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TransformProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  TransformProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TransformProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TransformProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_dsdx() const { return at<1>().valid(); }
-  float dsdx() const { return at<1>().as_float(); }
-  bool has_dtdx() const { return at<2>().valid(); }
-  float dtdx() const { return at<2>().as_float(); }
-  bool has_dsdy() const { return at<3>().valid(); }
-  float dsdy() const { return at<3>().as_float(); }
-  bool has_dtdy() const { return at<4>().valid(); }
-  float dtdy() const { return at<4>().as_float(); }
-  bool has_type() const { return at<5>().valid(); }
-  int32_t type() const { return at<5>().as_int32(); }
-};
-
-class TransformProto : public ::protozero::Message {
- public:
-  using Decoder = TransformProto_Decoder;
-  enum : int32_t {
-    kDsdxFieldNumber = 1,
-    kDtdxFieldNumber = 2,
-    kDsdyFieldNumber = 3,
-    kDtdyFieldNumber = 4,
-    kTypeFieldNumber = 5,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TransformProto"; }
-
-
-  using FieldMetadata_Dsdx =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      TransformProto>;
-
-  static constexpr FieldMetadata_Dsdx kDsdx{};
-  void set_dsdx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dsdx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dtdx =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      TransformProto>;
-
-  static constexpr FieldMetadata_Dtdx kDtdx{};
-  void set_dtdx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dtdx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dsdy =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      TransformProto>;
-
-  static constexpr FieldMetadata_Dsdy kDsdy{};
-  void set_dsdy(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dsdy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dtdy =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      TransformProto>;
-
-  static constexpr FieldMetadata_Dtdy kDtdy{};
-  void set_dtdy(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dtdy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Type =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      TransformProto>;
-
-  static constexpr FieldMetadata_Type kType{};
-  void set_type(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Type::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class SizeProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  SizeProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit SizeProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit SizeProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_w() const { return at<1>().valid(); }
-  int32_t w() const { return at<1>().as_int32(); }
-  bool has_h() const { return at<2>().valid(); }
-  int32_t h() const { return at<2>().as_int32(); }
-};
-
-class SizeProto : public ::protozero::Message {
- public:
-  using Decoder = SizeProto_Decoder;
-  enum : int32_t {
-    kWFieldNumber = 1,
-    kHFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.SizeProto"; }
-
-
-  using FieldMetadata_W =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      SizeProto>;
-
-  static constexpr FieldMetadata_W kW{};
-  void set_w(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_W::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_H =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      SizeProto>;
-
-  static constexpr FieldMetadata_H kH{};
-  void set_h(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_H::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class RegionProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  RegionProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit RegionProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit RegionProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_rect() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> rect() const { return GetRepeated<::protozero::ConstBytes>(2); }
-};
-
-class RegionProto : public ::protozero::Message {
- public:
-  using Decoder = RegionProto_Decoder;
-  enum : int32_t {
-    kRectFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.RegionProto"; }
-
-
-  using FieldMetadata_Rect =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      RegionProto>;
-
-  static constexpr FieldMetadata_Rect kRect{};
-  template <typename T = RectProto> T* add_rect() {
-    return BeginNestedMessage<T>(2);
-  }
-
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/surfaceflinger_layers.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SURFACEFLINGER_LAYERS_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SURFACEFLINGER_LAYERS_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class ActiveBufferProto;
-class BarrierLayerProto;
-class BlurRegion;
-class BorderSettings;
-class BoxShadowSettings;
-class ColorProto;
-class ColorTransformProto;
-class CornerRadiiProto;
-class DisplayProto;
-class FloatRectProto;
-class InputWindowInfoProto;
-class LayerProto;
-class LayerProto_MetadataEntry;
-class LayersProto;
-class LayersSnapshotProto;
-class PositionProto;
-class RectProto;
-class RegionProto;
-class SizeProto;
-class TransformProto;
-enum HwcCompositionType : int32_t;
-enum TrustedOverlay : int32_t;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-enum HwcCompositionType : int32_t {
-  HWC_TYPE_UNSPECIFIED = 0,
-  HWC_TYPE_CLIENT = 1,
-  HWC_TYPE_DEVICE = 2,
-  HWC_TYPE_SOLID_COLOR = 3,
-  HWC_TYPE_CURSOR = 4,
-  HWC_TYPE_SIDEBAND = 5,
-  HWC_TYPE_DISPLAY_DECORATION = 6,
-};
-
-constexpr HwcCompositionType HwcCompositionType_MIN = HwcCompositionType::HWC_TYPE_UNSPECIFIED;
-constexpr HwcCompositionType HwcCompositionType_MAX = HwcCompositionType::HWC_TYPE_DISPLAY_DECORATION;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* HwcCompositionType_Name(::perfetto::protos::pbzero::HwcCompositionType value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::HwcCompositionType::HWC_TYPE_UNSPECIFIED:
-    return "HWC_TYPE_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::HwcCompositionType::HWC_TYPE_CLIENT:
-    return "HWC_TYPE_CLIENT";
-
-  case ::perfetto::protos::pbzero::HwcCompositionType::HWC_TYPE_DEVICE:
-    return "HWC_TYPE_DEVICE";
-
-  case ::perfetto::protos::pbzero::HwcCompositionType::HWC_TYPE_SOLID_COLOR:
-    return "HWC_TYPE_SOLID_COLOR";
-
-  case ::perfetto::protos::pbzero::HwcCompositionType::HWC_TYPE_CURSOR:
-    return "HWC_TYPE_CURSOR";
-
-  case ::perfetto::protos::pbzero::HwcCompositionType::HWC_TYPE_SIDEBAND:
-    return "HWC_TYPE_SIDEBAND";
-
-  case ::perfetto::protos::pbzero::HwcCompositionType::HWC_TYPE_DISPLAY_DECORATION:
-    return "HWC_TYPE_DISPLAY_DECORATION";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_LayersTraceFileProto {
-enum MagicNumber : int32_t {
-  INVALID = 0,
-  MAGIC_NUMBER_L = 1414682956,
-  MAGIC_NUMBER_H = 1162035538,
-};
-} // namespace perfetto_pbzero_enum_LayersTraceFileProto
-using LayersTraceFileProto_MagicNumber = perfetto_pbzero_enum_LayersTraceFileProto::MagicNumber;
-
-
-constexpr LayersTraceFileProto_MagicNumber LayersTraceFileProto_MagicNumber_MIN = LayersTraceFileProto_MagicNumber::INVALID;
-constexpr LayersTraceFileProto_MagicNumber LayersTraceFileProto_MagicNumber_MAX = LayersTraceFileProto_MagicNumber::MAGIC_NUMBER_L;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* LayersTraceFileProto_MagicNumber_Name(::perfetto::protos::pbzero::LayersTraceFileProto_MagicNumber value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::LayersTraceFileProto_MagicNumber::INVALID:
-    return "INVALID";
-
-  case ::perfetto::protos::pbzero::LayersTraceFileProto_MagicNumber::MAGIC_NUMBER_L:
-    return "MAGIC_NUMBER_L";
-
-  case ::perfetto::protos::pbzero::LayersTraceFileProto_MagicNumber::MAGIC_NUMBER_H:
-    return "MAGIC_NUMBER_H";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class BarrierLayerProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  BarrierLayerProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit BarrierLayerProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit BarrierLayerProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  int32_t id() const { return at<1>().as_int32(); }
-  bool has_frame_number() const { return at<2>().valid(); }
-  uint64_t frame_number() const { return at<2>().as_uint64(); }
-};
-
-class BarrierLayerProto : public ::protozero::Message {
- public:
-  using Decoder = BarrierLayerProto_Decoder;
-  enum : int32_t {
-    kIdFieldNumber = 1,
-    kFrameNumberFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.BarrierLayerProto"; }
-
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      BarrierLayerProto>;
-
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FrameNumber =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      BarrierLayerProto>;
-
-  static constexpr FieldMetadata_FrameNumber kFrameNumber{};
-  void set_frame_number(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FrameNumber::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class ActiveBufferProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  ActiveBufferProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ActiveBufferProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ActiveBufferProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_width() const { return at<1>().valid(); }
-  uint32_t width() const { return at<1>().as_uint32(); }
-  bool has_height() const { return at<2>().valid(); }
-  uint32_t height() const { return at<2>().as_uint32(); }
-  bool has_stride() const { return at<3>().valid(); }
-  uint32_t stride() const { return at<3>().as_uint32(); }
-  bool has_format() const { return at<4>().valid(); }
-  int32_t format() const { return at<4>().as_int32(); }
-  bool has_usage() const { return at<5>().valid(); }
-  uint64_t usage() const { return at<5>().as_uint64(); }
-};
-
-class ActiveBufferProto : public ::protozero::Message {
- public:
-  using Decoder = ActiveBufferProto_Decoder;
-  enum : int32_t {
-    kWidthFieldNumber = 1,
-    kHeightFieldNumber = 2,
-    kStrideFieldNumber = 3,
-    kFormatFieldNumber = 4,
-    kUsageFieldNumber = 5,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ActiveBufferProto"; }
-
-
-  using FieldMetadata_Width =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ActiveBufferProto>;
-
-  static constexpr FieldMetadata_Width kWidth{};
-  void set_width(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Width::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Height =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ActiveBufferProto>;
-
-  static constexpr FieldMetadata_Height kHeight{};
-  void set_height(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Height::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Stride =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ActiveBufferProto>;
-
-  static constexpr FieldMetadata_Stride kStride{};
-  void set_stride(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Stride::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Format =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      ActiveBufferProto>;
-
-  static constexpr FieldMetadata_Format kFormat{};
-  void set_format(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Format::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Usage =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      ActiveBufferProto>;
-
-  static constexpr FieldMetadata_Usage kUsage{};
-  void set_usage(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Usage::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class CornerRadiiProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  CornerRadiiProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit CornerRadiiProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit CornerRadiiProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_tl() const { return at<1>().valid(); }
-  float tl() const { return at<1>().as_float(); }
-  bool has_tr() const { return at<2>().valid(); }
-  float tr() const { return at<2>().as_float(); }
-  bool has_bl() const { return at<3>().valid(); }
-  float bl() const { return at<3>().as_float(); }
-  bool has_br() const { return at<4>().valid(); }
-  float br() const { return at<4>().as_float(); }
-};
-
-class CornerRadiiProto : public ::protozero::Message {
- public:
-  using Decoder = CornerRadiiProto_Decoder;
-  enum : int32_t {
-    kTlFieldNumber = 1,
-    kTrFieldNumber = 2,
-    kBlFieldNumber = 3,
-    kBrFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.CornerRadiiProto"; }
-
-
-  using FieldMetadata_Tl =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      CornerRadiiProto>;
-
-  static constexpr FieldMetadata_Tl kTl{};
-  void set_tl(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tl::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Tr =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      CornerRadiiProto>;
-
-  static constexpr FieldMetadata_Tr kTr{};
-  void set_tr(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tr::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Bl =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      CornerRadiiProto>;
-
-  static constexpr FieldMetadata_Bl kBl{};
-  void set_bl(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Bl::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Br =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      CornerRadiiProto>;
-
-  static constexpr FieldMetadata_Br kBr{};
-  void set_br(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Br::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class FloatRectProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  FloatRectProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit FloatRectProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit FloatRectProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_left() const { return at<1>().valid(); }
-  float left() const { return at<1>().as_float(); }
-  bool has_top() const { return at<2>().valid(); }
-  float top() const { return at<2>().as_float(); }
-  bool has_right() const { return at<3>().valid(); }
-  float right() const { return at<3>().as_float(); }
-  bool has_bottom() const { return at<4>().valid(); }
-  float bottom() const { return at<4>().as_float(); }
-};
-
-class FloatRectProto : public ::protozero::Message {
- public:
-  using Decoder = FloatRectProto_Decoder;
-  enum : int32_t {
-    kLeftFieldNumber = 1,
-    kTopFieldNumber = 2,
-    kRightFieldNumber = 3,
-    kBottomFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.FloatRectProto"; }
-
-
-  using FieldMetadata_Left =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FloatRectProto>;
-
-  static constexpr FieldMetadata_Left kLeft{};
-  void set_left(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Left::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Top =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FloatRectProto>;
-
-  static constexpr FieldMetadata_Top kTop{};
-  void set_top(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Top::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Right =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FloatRectProto>;
-
-  static constexpr FieldMetadata_Right kRight{};
-  void set_right(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Right::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Bottom =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FloatRectProto>;
-
-  static constexpr FieldMetadata_Bottom kBottom{};
-  void set_bottom(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Bottom::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class PositionProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  PositionProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit PositionProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit PositionProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_x() const { return at<1>().valid(); }
-  float x() const { return at<1>().as_float(); }
-  bool has_y() const { return at<2>().valid(); }
-  float y() const { return at<2>().as_float(); }
-};
-
-class PositionProto : public ::protozero::Message {
- public:
-  using Decoder = PositionProto_Decoder;
-  enum : int32_t {
-    kXFieldNumber = 1,
-    kYFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.PositionProto"; }
-
-
-  using FieldMetadata_X =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      PositionProto>;
-
-  static constexpr FieldMetadata_X kX{};
-  void set_x(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_X::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Y =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      PositionProto>;
-
-  static constexpr FieldMetadata_Y kY{};
-  void set_y(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Y::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayerProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/67> {
- public:
-  LayerProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  int32_t id() const { return at<1>().as_int32(); }
-  bool has_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars name() const { return at<2>().as_string(); }
-  bool has_children() const { return at<3>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, int32_t> children(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, int32_t>(3, parse_error_ptr); }
-  bool has_relatives() const { return at<4>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, int32_t> relatives(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, int32_t>(4, parse_error_ptr); }
-  bool has_type() const { return at<5>().valid(); }
-  ::protozero::ConstChars type() const { return at<5>().as_string(); }
-  bool has_transparent_region() const { return at<6>().valid(); }
-  ::protozero::ConstBytes transparent_region() const { return at<6>().as_bytes(); }
-  bool has_visible_region() const { return at<7>().valid(); }
-  ::protozero::ConstBytes visible_region() const { return at<7>().as_bytes(); }
-  bool has_damage_region() const { return at<8>().valid(); }
-  ::protozero::ConstBytes damage_region() const { return at<8>().as_bytes(); }
-  bool has_layer_stack() const { return at<9>().valid(); }
-  uint32_t layer_stack() const { return at<9>().as_uint32(); }
-  bool has_z() const { return at<10>().valid(); }
-  int32_t z() const { return at<10>().as_int32(); }
-  bool has_position() const { return at<11>().valid(); }
-  ::protozero::ConstBytes position() const { return at<11>().as_bytes(); }
-  bool has_requested_position() const { return at<12>().valid(); }
-  ::protozero::ConstBytes requested_position() const { return at<12>().as_bytes(); }
-  bool has_size() const { return at<13>().valid(); }
-  ::protozero::ConstBytes size() const { return at<13>().as_bytes(); }
-  bool has_crop() const { return at<14>().valid(); }
-  ::protozero::ConstBytes crop() const { return at<14>().as_bytes(); }
-  bool has_final_crop() const { return at<15>().valid(); }
-  ::protozero::ConstBytes final_crop() const { return at<15>().as_bytes(); }
-  bool has_is_opaque() const { return at<16>().valid(); }
-  bool is_opaque() const { return at<16>().as_bool(); }
-  bool has_invalidate() const { return at<17>().valid(); }
-  bool invalidate() const { return at<17>().as_bool(); }
-  bool has_dataspace() const { return at<18>().valid(); }
-  ::protozero::ConstChars dataspace() const { return at<18>().as_string(); }
-  bool has_pixel_format() const { return at<19>().valid(); }
-  ::protozero::ConstChars pixel_format() const { return at<19>().as_string(); }
-  bool has_color() const { return at<20>().valid(); }
-  ::protozero::ConstBytes color() const { return at<20>().as_bytes(); }
-  bool has_requested_color() const { return at<21>().valid(); }
-  ::protozero::ConstBytes requested_color() const { return at<21>().as_bytes(); }
-  bool has_flags() const { return at<22>().valid(); }
-  uint32_t flags() const { return at<22>().as_uint32(); }
-  bool has_transform() const { return at<23>().valid(); }
-  ::protozero::ConstBytes transform() const { return at<23>().as_bytes(); }
-  bool has_requested_transform() const { return at<24>().valid(); }
-  ::protozero::ConstBytes requested_transform() const { return at<24>().as_bytes(); }
-  bool has_parent() const { return at<25>().valid(); }
-  int32_t parent() const { return at<25>().as_int32(); }
-  bool has_z_order_relative_of() const { return at<26>().valid(); }
-  int32_t z_order_relative_of() const { return at<26>().as_int32(); }
-  bool has_active_buffer() const { return at<27>().valid(); }
-  ::protozero::ConstBytes active_buffer() const { return at<27>().as_bytes(); }
-  bool has_queued_frames() const { return at<28>().valid(); }
-  int32_t queued_frames() const { return at<28>().as_int32(); }
-  bool has_refresh_pending() const { return at<29>().valid(); }
-  bool refresh_pending() const { return at<29>().as_bool(); }
-  bool has_hwc_frame() const { return at<30>().valid(); }
-  ::protozero::ConstBytes hwc_frame() const { return at<30>().as_bytes(); }
-  bool has_hwc_crop() const { return at<31>().valid(); }
-  ::protozero::ConstBytes hwc_crop() const { return at<31>().as_bytes(); }
-  bool has_hwc_transform() const { return at<32>().valid(); }
-  int32_t hwc_transform() const { return at<32>().as_int32(); }
-  bool has_window_type() const { return at<33>().valid(); }
-  int32_t window_type() const { return at<33>().as_int32(); }
-  bool has_app_id() const { return at<34>().valid(); }
-  int32_t app_id() const { return at<34>().as_int32(); }
-  bool has_hwc_composition_type() const { return at<35>().valid(); }
-  int32_t hwc_composition_type() const { return at<35>().as_int32(); }
-  bool has_is_protected() const { return at<36>().valid(); }
-  bool is_protected() const { return at<36>().as_bool(); }
-  bool has_curr_frame() const { return at<37>().valid(); }
-  uint64_t curr_frame() const { return at<37>().as_uint64(); }
-  bool has_barrier_layer() const { return at<38>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> barrier_layer() const { return GetRepeated<::protozero::ConstBytes>(38); }
-  bool has_buffer_transform() const { return at<39>().valid(); }
-  ::protozero::ConstBytes buffer_transform() const { return at<39>().as_bytes(); }
-  bool has_effective_scaling_mode() const { return at<40>().valid(); }
-  int32_t effective_scaling_mode() const { return at<40>().as_int32(); }
-  bool has_corner_radius() const { return at<41>().valid(); }
-  float corner_radius() const { return at<41>().as_float(); }
-  bool has_metadata() const { return at<42>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> metadata() const { return GetRepeated<::protozero::ConstBytes>(42); }
-  bool has_effective_transform() const { return at<43>().valid(); }
-  ::protozero::ConstBytes effective_transform() const { return at<43>().as_bytes(); }
-  bool has_source_bounds() const { return at<44>().valid(); }
-  ::protozero::ConstBytes source_bounds() const { return at<44>().as_bytes(); }
-  bool has_bounds() const { return at<45>().valid(); }
-  ::protozero::ConstBytes bounds() const { return at<45>().as_bytes(); }
-  bool has_screen_bounds() const { return at<46>().valid(); }
-  ::protozero::ConstBytes screen_bounds() const { return at<46>().as_bytes(); }
-  bool has_input_window_info() const { return at<47>().valid(); }
-  ::protozero::ConstBytes input_window_info() const { return at<47>().as_bytes(); }
-  bool has_corner_radius_crop() const { return at<48>().valid(); }
-  ::protozero::ConstBytes corner_radius_crop() const { return at<48>().as_bytes(); }
-  bool has_shadow_radius() const { return at<49>().valid(); }
-  float shadow_radius() const { return at<49>().as_float(); }
-  bool has_color_transform() const { return at<50>().valid(); }
-  ::protozero::ConstBytes color_transform() const { return at<50>().as_bytes(); }
-  bool has_is_relative_of() const { return at<51>().valid(); }
-  bool is_relative_of() const { return at<51>().as_bool(); }
-  bool has_background_blur_radius() const { return at<52>().valid(); }
-  int32_t background_blur_radius() const { return at<52>().as_int32(); }
-  bool has_owner_uid() const { return at<53>().valid(); }
-  uint32_t owner_uid() const { return at<53>().as_uint32(); }
-  bool has_blur_regions() const { return at<54>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> blur_regions() const { return GetRepeated<::protozero::ConstBytes>(54); }
-  bool has_is_trusted_overlay() const { return at<55>().valid(); }
-  bool is_trusted_overlay() const { return at<55>().as_bool(); }
-  bool has_requested_corner_radius() const { return at<56>().valid(); }
-  float requested_corner_radius() const { return at<56>().as_float(); }
-  bool has_destination_frame() const { return at<57>().valid(); }
-  ::protozero::ConstBytes destination_frame() const { return at<57>().as_bytes(); }
-  bool has_original_id() const { return at<58>().valid(); }
-  uint32_t original_id() const { return at<58>().as_uint32(); }
-  bool has_trusted_overlay() const { return at<59>().valid(); }
-  int32_t trusted_overlay() const { return at<59>().as_int32(); }
-  bool has_background_blur_scale() const { return at<60>().valid(); }
-  float background_blur_scale() const { return at<60>().as_float(); }
-  bool has_corner_radii() const { return at<61>().valid(); }
-  ::protozero::ConstBytes corner_radii() const { return at<61>().as_bytes(); }
-  bool has_requested_corner_radii() const { return at<62>().valid(); }
-  ::protozero::ConstBytes requested_corner_radii() const { return at<62>().as_bytes(); }
-  bool has_client_drawn_corner_radii() const { return at<63>().valid(); }
-  ::protozero::ConstBytes client_drawn_corner_radii() const { return at<63>().as_bytes(); }
-  bool has_system_content_priority() const { return at<64>().valid(); }
-  int32_t system_content_priority() const { return at<64>().as_int32(); }
-  bool has_box_shadow_settings() const { return at<65>().valid(); }
-  ::protozero::ConstBytes box_shadow_settings() const { return at<65>().as_bytes(); }
-  bool has_border_settings() const { return at<66>().valid(); }
-  ::protozero::ConstBytes border_settings() const { return at<66>().as_bytes(); }
-  bool has_effective_radii() const { return at<67>().valid(); }
-  ::protozero::ConstBytes effective_radii() const { return at<67>().as_bytes(); }
-};
-
-class LayerProto : public ::protozero::Message {
- public:
-  using Decoder = LayerProto_Decoder;
-  enum : int32_t {
-    kIdFieldNumber = 1,
-    kNameFieldNumber = 2,
-    kChildrenFieldNumber = 3,
-    kRelativesFieldNumber = 4,
-    kTypeFieldNumber = 5,
-    kTransparentRegionFieldNumber = 6,
-    kVisibleRegionFieldNumber = 7,
-    kDamageRegionFieldNumber = 8,
-    kLayerStackFieldNumber = 9,
-    kZFieldNumber = 10,
-    kPositionFieldNumber = 11,
-    kRequestedPositionFieldNumber = 12,
-    kSizeFieldNumber = 13,
-    kCropFieldNumber = 14,
-    kFinalCropFieldNumber = 15,
-    kIsOpaqueFieldNumber = 16,
-    kInvalidateFieldNumber = 17,
-    kDataspaceFieldNumber = 18,
-    kPixelFormatFieldNumber = 19,
-    kColorFieldNumber = 20,
-    kRequestedColorFieldNumber = 21,
-    kFlagsFieldNumber = 22,
-    kTransformFieldNumber = 23,
-    kRequestedTransformFieldNumber = 24,
-    kParentFieldNumber = 25,
-    kZOrderRelativeOfFieldNumber = 26,
-    kActiveBufferFieldNumber = 27,
-    kQueuedFramesFieldNumber = 28,
-    kRefreshPendingFieldNumber = 29,
-    kHwcFrameFieldNumber = 30,
-    kHwcCropFieldNumber = 31,
-    kHwcTransformFieldNumber = 32,
-    kWindowTypeFieldNumber = 33,
-    kAppIdFieldNumber = 34,
-    kHwcCompositionTypeFieldNumber = 35,
-    kIsProtectedFieldNumber = 36,
-    kCurrFrameFieldNumber = 37,
-    kBarrierLayerFieldNumber = 38,
-    kBufferTransformFieldNumber = 39,
-    kEffectiveScalingModeFieldNumber = 40,
-    kCornerRadiusFieldNumber = 41,
-    kMetadataFieldNumber = 42,
-    kEffectiveTransformFieldNumber = 43,
-    kSourceBoundsFieldNumber = 44,
-    kBoundsFieldNumber = 45,
-    kScreenBoundsFieldNumber = 46,
-    kInputWindowInfoFieldNumber = 47,
-    kCornerRadiusCropFieldNumber = 48,
-    kShadowRadiusFieldNumber = 49,
-    kColorTransformFieldNumber = 50,
-    kIsRelativeOfFieldNumber = 51,
-    kBackgroundBlurRadiusFieldNumber = 52,
-    kOwnerUidFieldNumber = 53,
-    kBlurRegionsFieldNumber = 54,
-    kIsTrustedOverlayFieldNumber = 55,
-    kRequestedCornerRadiusFieldNumber = 56,
-    kDestinationFrameFieldNumber = 57,
-    kOriginalIdFieldNumber = 58,
-    kTrustedOverlayFieldNumber = 59,
-    kBackgroundBlurScaleFieldNumber = 60,
-    kCornerRadiiFieldNumber = 61,
-    kRequestedCornerRadiiFieldNumber = 62,
-    kClientDrawnCornerRadiiFieldNumber = 63,
-    kSystemContentPriorityFieldNumber = 64,
-    kBoxShadowSettingsFieldNumber = 65,
-    kBorderSettingsFieldNumber = 66,
-    kEffectiveRadiiFieldNumber = 67,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerProto"; }
-
-  using MetadataEntry = ::perfetto::protos::pbzero::LayerProto_MetadataEntry;
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Children =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Children kChildren{};
-  void set_children(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_Children::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-
-  using FieldMetadata_Relatives =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Relatives kRelatives{};
-  void set_relatives(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_Relatives::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-
-  using FieldMetadata_Type =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Type kType{};
-  void set_type(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Type::kFieldId, data, size);
-  }
-  void set_type(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Type::kFieldId, chars.data, chars.size);
-  }
-  void set_type(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Type::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TransparentRegion =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RegionProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_TransparentRegion kTransparentRegion{};
-  template <typename T = RegionProto> T* set_transparent_region() {
-    return BeginNestedMessage<T>(6);
-  }
-
-
-  using FieldMetadata_VisibleRegion =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RegionProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_VisibleRegion kVisibleRegion{};
-  template <typename T = RegionProto> T* set_visible_region() {
-    return BeginNestedMessage<T>(7);
-  }
-
-
-  using FieldMetadata_DamageRegion =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RegionProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_DamageRegion kDamageRegion{};
-  template <typename T = RegionProto> T* set_damage_region() {
-    return BeginNestedMessage<T>(8);
-  }
-
-
-  using FieldMetadata_LayerStack =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_LayerStack kLayerStack{};
-  void set_layer_stack(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerStack::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Z =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Z kZ{};
-  void set_z(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Z::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Position =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      PositionProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Position kPosition{};
-  template <typename T = PositionProto> T* set_position() {
-    return BeginNestedMessage<T>(11);
-  }
-
-
-  using FieldMetadata_RequestedPosition =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      PositionProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_RequestedPosition kRequestedPosition{};
-  template <typename T = PositionProto> T* set_requested_position() {
-    return BeginNestedMessage<T>(12);
-  }
-
-
-  using FieldMetadata_Size =
-    ::protozero::proto_utils::FieldMetadata<
-      13,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      SizeProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Size kSize{};
-  template <typename T = SizeProto> T* set_size() {
-    return BeginNestedMessage<T>(13);
-  }
-
-
-  using FieldMetadata_Crop =
-    ::protozero::proto_utils::FieldMetadata<
-      14,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Crop kCrop{};
-  template <typename T = RectProto> T* set_crop() {
-    return BeginNestedMessage<T>(14);
-  }
-
-
-  using FieldMetadata_FinalCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      15,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_FinalCrop kFinalCrop{};
-  template <typename T = RectProto> T* set_final_crop() {
-    return BeginNestedMessage<T>(15);
-  }
-
-
-  using FieldMetadata_IsOpaque =
-    ::protozero::proto_utils::FieldMetadata<
-      16,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerProto>;
-
-  static constexpr FieldMetadata_IsOpaque kIsOpaque{};
-  void set_is_opaque(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsOpaque::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Invalidate =
-    ::protozero::proto_utils::FieldMetadata<
-      17,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Invalidate kInvalidate{};
-  void set_invalidate(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_Invalidate::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dataspace =
-    ::protozero::proto_utils::FieldMetadata<
-      18,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Dataspace kDataspace{};
-  void set_dataspace(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Dataspace::kFieldId, data, size);
-  }
-  void set_dataspace(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Dataspace::kFieldId, chars.data, chars.size);
-  }
-  void set_dataspace(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dataspace::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PixelFormat =
-    ::protozero::proto_utils::FieldMetadata<
-      19,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      LayerProto>;
-
-  static constexpr FieldMetadata_PixelFormat kPixelFormat{};
-  void set_pixel_format(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_PixelFormat::kFieldId, data, size);
-  }
-  void set_pixel_format(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_PixelFormat::kFieldId, chars.data, chars.size);
-  }
-  void set_pixel_format(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_PixelFormat::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Color =
-    ::protozero::proto_utils::FieldMetadata<
-      20,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ColorProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Color kColor{};
-  template <typename T = ColorProto> T* set_color() {
-    return BeginNestedMessage<T>(20);
-  }
-
-
-  using FieldMetadata_RequestedColor =
-    ::protozero::proto_utils::FieldMetadata<
-      21,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ColorProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_RequestedColor kRequestedColor{};
-  template <typename T = ColorProto> T* set_requested_color() {
-    return BeginNestedMessage<T>(21);
-  }
-
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      22,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Transform =
-    ::protozero::proto_utils::FieldMetadata<
-      23,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransformProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Transform kTransform{};
-  template <typename T = TransformProto> T* set_transform() {
-    return BeginNestedMessage<T>(23);
-  }
-
-
-  using FieldMetadata_RequestedTransform =
-    ::protozero::proto_utils::FieldMetadata<
-      24,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransformProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_RequestedTransform kRequestedTransform{};
-  template <typename T = TransformProto> T* set_requested_transform() {
-    return BeginNestedMessage<T>(24);
-  }
-
-
-  using FieldMetadata_Parent =
-    ::protozero::proto_utils::FieldMetadata<
-      25,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Parent kParent{};
-  void set_parent(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Parent::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ZOrderRelativeOf =
-    ::protozero::proto_utils::FieldMetadata<
-      26,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_ZOrderRelativeOf kZOrderRelativeOf{};
-  void set_z_order_relative_of(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ZOrderRelativeOf::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ActiveBuffer =
-    ::protozero::proto_utils::FieldMetadata<
-      27,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ActiveBufferProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_ActiveBuffer kActiveBuffer{};
-  template <typename T = ActiveBufferProto> T* set_active_buffer() {
-    return BeginNestedMessage<T>(27);
-  }
-
-
-  using FieldMetadata_QueuedFrames =
-    ::protozero::proto_utils::FieldMetadata<
-      28,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_QueuedFrames kQueuedFrames{};
-  void set_queued_frames(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_QueuedFrames::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_RefreshPending =
-    ::protozero::proto_utils::FieldMetadata<
-      29,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerProto>;
-
-  static constexpr FieldMetadata_RefreshPending kRefreshPending{};
-  void set_refresh_pending(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_RefreshPending::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_HwcFrame =
-    ::protozero::proto_utils::FieldMetadata<
-      30,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_HwcFrame kHwcFrame{};
-  template <typename T = RectProto> T* set_hwc_frame() {
-    return BeginNestedMessage<T>(30);
-  }
-
-
-  using FieldMetadata_HwcCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      31,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FloatRectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_HwcCrop kHwcCrop{};
-  template <typename T = FloatRectProto> T* set_hwc_crop() {
-    return BeginNestedMessage<T>(31);
-  }
-
-
-  using FieldMetadata_HwcTransform =
-    ::protozero::proto_utils::FieldMetadata<
-      32,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_HwcTransform kHwcTransform{};
-  void set_hwc_transform(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_HwcTransform::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_WindowType =
-    ::protozero::proto_utils::FieldMetadata<
-      33,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_WindowType kWindowType{};
-  void set_window_type(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_WindowType::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_AppId =
-    ::protozero::proto_utils::FieldMetadata<
-      34,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_AppId kAppId{};
-  void set_app_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_AppId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_HwcCompositionType =
-    ::protozero::proto_utils::FieldMetadata<
-      35,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      HwcCompositionType,
-      LayerProto>;
-
-  static constexpr FieldMetadata_HwcCompositionType kHwcCompositionType{};
-  void set_hwc_composition_type(HwcCompositionType value) {
-    static constexpr uint32_t field_id = FieldMetadata_HwcCompositionType::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IsProtected =
-    ::protozero::proto_utils::FieldMetadata<
-      36,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerProto>;
-
-  static constexpr FieldMetadata_IsProtected kIsProtected{};
-  void set_is_protected(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsProtected::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CurrFrame =
-    ::protozero::proto_utils::FieldMetadata<
-      37,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_CurrFrame kCurrFrame{};
-  void set_curr_frame(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CurrFrame::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BarrierLayer =
-    ::protozero::proto_utils::FieldMetadata<
-      38,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BarrierLayerProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_BarrierLayer kBarrierLayer{};
-  template <typename T = BarrierLayerProto> T* add_barrier_layer() {
-    return BeginNestedMessage<T>(38);
-  }
-
-
-  using FieldMetadata_BufferTransform =
-    ::protozero::proto_utils::FieldMetadata<
-      39,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransformProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_BufferTransform kBufferTransform{};
-  template <typename T = TransformProto> T* set_buffer_transform() {
-    return BeginNestedMessage<T>(39);
-  }
-
-
-  using FieldMetadata_EffectiveScalingMode =
-    ::protozero::proto_utils::FieldMetadata<
-      40,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_EffectiveScalingMode kEffectiveScalingMode{};
-  void set_effective_scaling_mode(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_EffectiveScalingMode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      41,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerProto>;
-
-  static constexpr FieldMetadata_CornerRadius kCornerRadius{};
-  void set_corner_radius(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Metadata =
-    ::protozero::proto_utils::FieldMetadata<
-      42,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerProto_MetadataEntry,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Metadata kMetadata{};
-  template <typename T = LayerProto_MetadataEntry> T* add_metadata() {
-    return BeginNestedMessage<T>(42);
-  }
-
-
-  using FieldMetadata_EffectiveTransform =
-    ::protozero::proto_utils::FieldMetadata<
-      43,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransformProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_EffectiveTransform kEffectiveTransform{};
-  template <typename T = TransformProto> T* set_effective_transform() {
-    return BeginNestedMessage<T>(43);
-  }
-
-
-  using FieldMetadata_SourceBounds =
-    ::protozero::proto_utils::FieldMetadata<
-      44,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FloatRectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_SourceBounds kSourceBounds{};
-  template <typename T = FloatRectProto> T* set_source_bounds() {
-    return BeginNestedMessage<T>(44);
-  }
-
-
-  using FieldMetadata_Bounds =
-    ::protozero::proto_utils::FieldMetadata<
-      45,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FloatRectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_Bounds kBounds{};
-  template <typename T = FloatRectProto> T* set_bounds() {
-    return BeginNestedMessage<T>(45);
-  }
-
-
-  using FieldMetadata_ScreenBounds =
-    ::protozero::proto_utils::FieldMetadata<
-      46,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FloatRectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_ScreenBounds kScreenBounds{};
-  template <typename T = FloatRectProto> T* set_screen_bounds() {
-    return BeginNestedMessage<T>(46);
-  }
-
-
-  using FieldMetadata_InputWindowInfo =
-    ::protozero::proto_utils::FieldMetadata<
-      47,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InputWindowInfoProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_InputWindowInfo kInputWindowInfo{};
-  template <typename T = InputWindowInfoProto> T* set_input_window_info() {
-    return BeginNestedMessage<T>(47);
-  }
-
-
-  using FieldMetadata_CornerRadiusCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      48,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FloatRectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_CornerRadiusCrop kCornerRadiusCrop{};
-  template <typename T = FloatRectProto> T* set_corner_radius_crop() {
-    return BeginNestedMessage<T>(48);
-  }
-
-
-  using FieldMetadata_ShadowRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      49,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerProto>;
-
-  static constexpr FieldMetadata_ShadowRadius kShadowRadius{};
-  void set_shadow_radius(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_ShadowRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ColorTransform =
-    ::protozero::proto_utils::FieldMetadata<
-      50,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ColorTransformProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_ColorTransform kColorTransform{};
-  template <typename T = ColorTransformProto> T* set_color_transform() {
-    return BeginNestedMessage<T>(50);
-  }
-
-
-  using FieldMetadata_IsRelativeOf =
-    ::protozero::proto_utils::FieldMetadata<
-      51,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerProto>;
-
-  static constexpr FieldMetadata_IsRelativeOf kIsRelativeOf{};
-  void set_is_relative_of(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsRelativeOf::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BackgroundBlurRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      52,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_BackgroundBlurRadius kBackgroundBlurRadius{};
-  void set_background_blur_radius(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_BackgroundBlurRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_OwnerUid =
-    ::protozero::proto_utils::FieldMetadata<
-      53,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_OwnerUid kOwnerUid{};
-  void set_owner_uid(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OwnerUid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BlurRegions =
-    ::protozero::proto_utils::FieldMetadata<
-      54,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BlurRegion,
-      LayerProto>;
-
-  static constexpr FieldMetadata_BlurRegions kBlurRegions{};
-  template <typename T = BlurRegion> T* add_blur_regions() {
-    return BeginNestedMessage<T>(54);
-  }
-
-
-  using FieldMetadata_IsTrustedOverlay =
-    ::protozero::proto_utils::FieldMetadata<
-      55,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerProto>;
-
-  static constexpr FieldMetadata_IsTrustedOverlay kIsTrustedOverlay{};
-  void set_is_trusted_overlay(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsTrustedOverlay::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_RequestedCornerRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      56,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerProto>;
-
-  static constexpr FieldMetadata_RequestedCornerRadius kRequestedCornerRadius{};
-  void set_requested_corner_radius(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_RequestedCornerRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DestinationFrame =
-    ::protozero::proto_utils::FieldMetadata<
-      57,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_DestinationFrame kDestinationFrame{};
-  template <typename T = RectProto> T* set_destination_frame() {
-    return BeginNestedMessage<T>(57);
-  }
-
-
-  using FieldMetadata_OriginalId =
-    ::protozero::proto_utils::FieldMetadata<
-      58,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_OriginalId kOriginalId{};
-  void set_original_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OriginalId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TrustedOverlay =
-    ::protozero::proto_utils::FieldMetadata<
-      59,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      TrustedOverlay,
-      LayerProto>;
-
-  static constexpr FieldMetadata_TrustedOverlay kTrustedOverlay{};
-  void set_trusted_overlay(TrustedOverlay value) {
-    static constexpr uint32_t field_id = FieldMetadata_TrustedOverlay::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BackgroundBlurScale =
-    ::protozero::proto_utils::FieldMetadata<
-      60,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerProto>;
-
-  static constexpr FieldMetadata_BackgroundBlurScale kBackgroundBlurScale{};
-  void set_background_blur_scale(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_BackgroundBlurScale::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadii =
-    ::protozero::proto_utils::FieldMetadata<
-      61,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      CornerRadiiProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_CornerRadii kCornerRadii{};
-  template <typename T = CornerRadiiProto> T* set_corner_radii() {
-    return BeginNestedMessage<T>(61);
-  }
-
-
-  using FieldMetadata_RequestedCornerRadii =
-    ::protozero::proto_utils::FieldMetadata<
-      62,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      CornerRadiiProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_RequestedCornerRadii kRequestedCornerRadii{};
-  template <typename T = CornerRadiiProto> T* set_requested_corner_radii() {
-    return BeginNestedMessage<T>(62);
-  }
-
-
-  using FieldMetadata_ClientDrawnCornerRadii =
-    ::protozero::proto_utils::FieldMetadata<
-      63,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      CornerRadiiProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_ClientDrawnCornerRadii kClientDrawnCornerRadii{};
-  template <typename T = CornerRadiiProto> T* set_client_drawn_corner_radii() {
-    return BeginNestedMessage<T>(63);
-  }
-
-
-  using FieldMetadata_SystemContentPriority =
-    ::protozero::proto_utils::FieldMetadata<
-      64,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto>;
-
-  static constexpr FieldMetadata_SystemContentPriority kSystemContentPriority{};
-  void set_system_content_priority(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SystemContentPriority::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BoxShadowSettings =
-    ::protozero::proto_utils::FieldMetadata<
-      65,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BoxShadowSettings,
-      LayerProto>;
-
-  static constexpr FieldMetadata_BoxShadowSettings kBoxShadowSettings{};
-  template <typename T = BoxShadowSettings> T* set_box_shadow_settings() {
-    return BeginNestedMessage<T>(65);
-  }
-
-
-  using FieldMetadata_BorderSettings =
-    ::protozero::proto_utils::FieldMetadata<
-      66,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BorderSettings,
-      LayerProto>;
-
-  static constexpr FieldMetadata_BorderSettings kBorderSettings{};
-  template <typename T = BorderSettings> T* set_border_settings() {
-    return BeginNestedMessage<T>(66);
-  }
-
-
-  using FieldMetadata_EffectiveRadii =
-    ::protozero::proto_utils::FieldMetadata<
-      67,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      CornerRadiiProto,
-      LayerProto>;
-
-  static constexpr FieldMetadata_EffectiveRadii kEffectiveRadii{};
-  template <typename T = CornerRadiiProto> T* set_effective_radii() {
-    return BeginNestedMessage<T>(67);
-  }
-
-};
-
-class LayerProto_MetadataEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  LayerProto_MetadataEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerProto_MetadataEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerProto_MetadataEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  int32_t key() const { return at<1>().as_int32(); }
-  bool has_value() const { return at<2>().valid(); }
-  ::protozero::ConstBytes value() const { return at<2>().as_bytes(); }
-};
-
-class LayerProto_MetadataEntry : public ::protozero::Message {
- public:
-  using Decoder = LayerProto_MetadataEntry_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerProto.MetadataEntry"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerProto_MetadataEntry>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBytes,
-      std::string,
-      LayerProto_MetadataEntry>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(const uint8_t* data, size_t size) {
-    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
-  }
-  void set_value(::protozero::ConstBytes bytes) {
-    AppendBytes(FieldMetadata_Value::kFieldId, bytes.data, bytes.size);
-  }
-  void set_value(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBytes>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class DisplayProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
- public:
-  DisplayProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit DisplayProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit DisplayProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  uint64_t id() const { return at<1>().as_uint64(); }
-  bool has_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars name() const { return at<2>().as_string(); }
-  bool has_layer_stack() const { return at<3>().valid(); }
-  uint32_t layer_stack() const { return at<3>().as_uint32(); }
-  bool has_size() const { return at<4>().valid(); }
-  ::protozero::ConstBytes size() const { return at<4>().as_bytes(); }
-  bool has_layer_stack_space_rect() const { return at<5>().valid(); }
-  ::protozero::ConstBytes layer_stack_space_rect() const { return at<5>().as_bytes(); }
-  bool has_transform() const { return at<6>().valid(); }
-  ::protozero::ConstBytes transform() const { return at<6>().as_bytes(); }
-  bool has_is_virtual() const { return at<7>().valid(); }
-  bool is_virtual() const { return at<7>().as_bool(); }
-  bool has_dpi_x() const { return at<8>().valid(); }
-  double dpi_x() const { return at<8>().as_double(); }
-  bool has_dpi_y() const { return at<9>().valid(); }
-  double dpi_y() const { return at<9>().as_double(); }
-};
-
-class DisplayProto : public ::protozero::Message {
- public:
-  using Decoder = DisplayProto_Decoder;
-  enum : int32_t {
-    kIdFieldNumber = 1,
-    kNameFieldNumber = 2,
-    kLayerStackFieldNumber = 3,
-    kSizeFieldNumber = 4,
-    kLayerStackSpaceRectFieldNumber = 5,
-    kTransformFieldNumber = 6,
-    kIsVirtualFieldNumber = 7,
-    kDpiXFieldNumber = 8,
-    kDpiYFieldNumber = 9,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.DisplayProto"; }
-
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayerStack =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_LayerStack kLayerStack{};
-  void set_layer_stack(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerStack::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Size =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      SizeProto,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_Size kSize{};
-  template <typename T = SizeProto> T* set_size() {
-    return BeginNestedMessage<T>(4);
-  }
-
-
-  using FieldMetadata_LayerStackSpaceRect =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_LayerStackSpaceRect kLayerStackSpaceRect{};
-  template <typename T = RectProto> T* set_layer_stack_space_rect() {
-    return BeginNestedMessage<T>(5);
-  }
-
-
-  using FieldMetadata_Transform =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransformProto,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_Transform kTransform{};
-  template <typename T = TransformProto> T* set_transform() {
-    return BeginNestedMessage<T>(6);
-  }
-
-
-  using FieldMetadata_IsVirtual =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_IsVirtual kIsVirtual{};
-  void set_is_virtual(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsVirtual::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DpiX =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kDouble,
-      double,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_DpiX kDpiX{};
-  void set_dpi_x(double value) {
-    static constexpr uint32_t field_id = FieldMetadata_DpiX::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kDouble>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DpiY =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kDouble,
-      double,
-      DisplayProto>;
-
-  static constexpr FieldMetadata_DpiY kDpiY{};
-  void set_dpi_y(double value) {
-    static constexpr uint32_t field_id = FieldMetadata_DpiY::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kDouble>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayersProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  LayersProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayersProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayersProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_layers() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> layers() const { return GetRepeated<::protozero::ConstBytes>(1); }
-};
-
-class LayersProto : public ::protozero::Message {
- public:
-  using Decoder = LayersProto_Decoder;
-  enum : int32_t {
-    kLayersFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayersProto"; }
-
-
-  using FieldMetadata_Layers =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerProto,
-      LayersProto>;
-
-  static constexpr FieldMetadata_Layers kLayers{};
-  template <typename T = LayerProto> T* add_layers() {
-    return BeginNestedMessage<T>(1);
-  }
-
-};
-
-class LayersSnapshotProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
- public:
-  LayersSnapshotProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayersSnapshotProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayersSnapshotProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_elapsed_realtime_nanos() const { return at<1>().valid(); }
-  int64_t elapsed_realtime_nanos() const { return at<1>().as_int64(); }
-  bool has_where() const { return at<2>().valid(); }
-  ::protozero::ConstChars where() const { return at<2>().as_string(); }
-  bool has_layers() const { return at<3>().valid(); }
-  ::protozero::ConstBytes layers() const { return at<3>().as_bytes(); }
-  bool has_hwc_blob() const { return at<4>().valid(); }
-  ::protozero::ConstChars hwc_blob() const { return at<4>().as_string(); }
-  bool has_excludes_composition_state() const { return at<5>().valid(); }
-  bool excludes_composition_state() const { return at<5>().as_bool(); }
-  bool has_missed_entries() const { return at<6>().valid(); }
-  uint32_t missed_entries() const { return at<6>().as_uint32(); }
-  bool has_displays() const { return at<7>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> displays() const { return GetRepeated<::protozero::ConstBytes>(7); }
-  bool has_vsync_id() const { return at<8>().valid(); }
-  int64_t vsync_id() const { return at<8>().as_int64(); }
-};
-
-class LayersSnapshotProto : public ::protozero::Message {
- public:
-  using Decoder = LayersSnapshotProto_Decoder;
-  enum : int32_t {
-    kElapsedRealtimeNanosFieldNumber = 1,
-    kWhereFieldNumber = 2,
-    kLayersFieldNumber = 3,
-    kHwcBlobFieldNumber = 4,
-    kExcludesCompositionStateFieldNumber = 5,
-    kMissedEntriesFieldNumber = 6,
-    kDisplaysFieldNumber = 7,
-    kVsyncIdFieldNumber = 8,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayersSnapshotProto"; }
-
-
-  using FieldMetadata_ElapsedRealtimeNanos =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kSfixed64,
-      int64_t,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_ElapsedRealtimeNanos kElapsedRealtimeNanos{};
-  void set_elapsed_realtime_nanos(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ElapsedRealtimeNanos::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kSfixed64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Where =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_Where kWhere{};
-  void set_where(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Where::kFieldId, data, size);
-  }
-  void set_where(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Where::kFieldId, chars.data, chars.size);
-  }
-  void set_where(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Where::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Layers =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayersProto,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_Layers kLayers{};
-  template <typename T = LayersProto> T* set_layers() {
-    return BeginNestedMessage<T>(3);
-  }
-
-
-  using FieldMetadata_HwcBlob =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_HwcBlob kHwcBlob{};
-  void set_hwc_blob(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_HwcBlob::kFieldId, data, size);
-  }
-  void set_hwc_blob(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_HwcBlob::kFieldId, chars.data, chars.size);
-  }
-  void set_hwc_blob(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_HwcBlob::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ExcludesCompositionState =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_ExcludesCompositionState kExcludesCompositionState{};
-  void set_excludes_composition_state(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ExcludesCompositionState::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_MissedEntries =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_MissedEntries kMissedEntries{};
-  void set_missed_entries(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MissedEntries::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Displays =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      DisplayProto,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_Displays kDisplays{};
-  template <typename T = DisplayProto> T* add_displays() {
-    return BeginNestedMessage<T>(7);
-  }
-
-
-  using FieldMetadata_VsyncId =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      LayersSnapshotProto>;
-
-  static constexpr FieldMetadata_VsyncId kVsyncId{};
-  void set_vsync_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_VsyncId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayersTraceFileProto_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
- public:
-  LayersTraceFileProto_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayersTraceFileProto_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayersTraceFileProto_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_magic_number() const { return at<1>().valid(); }
-  uint64_t magic_number() const { return at<1>().as_uint64(); }
-  bool has_entry() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> entry() const { return GetRepeated<::protozero::ConstBytes>(2); }
-  bool has_real_to_elapsed_time_offset_nanos() const { return at<3>().valid(); }
-  uint64_t real_to_elapsed_time_offset_nanos() const { return at<3>().as_uint64(); }
-};
-
-class LayersTraceFileProto : public ::protozero::Message {
- public:
-  using Decoder = LayersTraceFileProto_Decoder;
-  enum : int32_t {
-    kMagicNumberFieldNumber = 1,
-    kEntryFieldNumber = 2,
-    kRealToElapsedTimeOffsetNanosFieldNumber = 3,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayersTraceFileProto"; }
-
-
-  using MagicNumber = ::perfetto::protos::pbzero::LayersTraceFileProto_MagicNumber;
-  static inline const char* MagicNumber_Name(MagicNumber value) {
-    return ::perfetto::protos::pbzero::LayersTraceFileProto_MagicNumber_Name(value);
-  }
-  static inline const MagicNumber INVALID = MagicNumber::INVALID;
-  static inline const MagicNumber MAGIC_NUMBER_L = MagicNumber::MAGIC_NUMBER_L;
-  static inline const MagicNumber MAGIC_NUMBER_H = MagicNumber::MAGIC_NUMBER_H;
-
-  using FieldMetadata_MagicNumber =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64,
-      uint64_t,
-      LayersTraceFileProto>;
-
-  static constexpr FieldMetadata_MagicNumber kMagicNumber{};
-  void set_magic_number(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MagicNumber::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Entry =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayersSnapshotProto,
-      LayersTraceFileProto>;
-
-  static constexpr FieldMetadata_Entry kEntry{};
-  template <typename T = LayersSnapshotProto> T* add_entry() {
-    return BeginNestedMessage<T>(2);
-  }
-
-
-  using FieldMetadata_RealToElapsedTimeOffsetNanos =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64,
-      uint64_t,
-      LayersTraceFileProto>;
-
-  static constexpr FieldMetadata_RealToElapsedTimeOffsetNanos kRealToElapsedTimeOffsetNanos{};
-  void set_real_to_elapsed_time_offset_nanos(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RealToElapsedTimeOffsetNanos::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/surfaceflinger_transactions.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SURFACEFLINGER_TRANSACTIONS_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_SURFACEFLINGER_TRANSACTIONS_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class BlurRegion;
-class BorderSettings;
-class BoxShadowSettings;
-class ColorTransformProto;
-class DisplayInfo;
-class DisplayState;
-class LayerCreationArgs;
-class LayerState;
-class LayerState_BufferData;
-class LayerState_Color3;
-class LayerState_CornerRadii;
-class LayerState_Matrix22;
-class LayerState_WindowInfo;
-class RectProto;
-class RegionProto;
-class TransactionBarrier;
-class TransactionState;
-class TransactionTraceEntry;
-class Transform;
-namespace perfetto_pbzero_enum_LayerState_BufferData {
-enum PixelFormat : int32_t;
-}  // namespace perfetto_pbzero_enum_LayerState_BufferData
-using LayerState_BufferData_PixelFormat = perfetto_pbzero_enum_LayerState_BufferData::PixelFormat;
-namespace perfetto_pbzero_enum_LayerState {
-enum DropInputMode : int32_t;
-}  // namespace perfetto_pbzero_enum_LayerState
-using LayerState_DropInputMode = perfetto_pbzero_enum_LayerState::DropInputMode;
-enum TrustedOverlay : int32_t;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-namespace perfetto_pbzero_enum_DisplayState {
-enum Changes : int32_t {
-  eChangesNone = 0,
-  eSurfaceChanged = 1,
-  eLayerStackChanged = 2,
-  eDisplayProjectionChanged = 4,
-  eDisplaySizeChanged = 8,
-  eFlagsChanged = 16,
-};
-} // namespace perfetto_pbzero_enum_DisplayState
-using DisplayState_Changes = perfetto_pbzero_enum_DisplayState::Changes;
-
-
-constexpr DisplayState_Changes DisplayState_Changes_MIN = DisplayState_Changes::eChangesNone;
-constexpr DisplayState_Changes DisplayState_Changes_MAX = DisplayState_Changes::eFlagsChanged;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* DisplayState_Changes_Name(::perfetto::protos::pbzero::DisplayState_Changes value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::DisplayState_Changes::eChangesNone:
-    return "eChangesNone";
-
-  case ::perfetto::protos::pbzero::DisplayState_Changes::eSurfaceChanged:
-    return "eSurfaceChanged";
-
-  case ::perfetto::protos::pbzero::DisplayState_Changes::eLayerStackChanged:
-    return "eLayerStackChanged";
-
-  case ::perfetto::protos::pbzero::DisplayState_Changes::eDisplayProjectionChanged:
-    return "eDisplayProjectionChanged";
-
-  case ::perfetto::protos::pbzero::DisplayState_Changes::eDisplaySizeChanged:
-    return "eDisplaySizeChanged";
-
-  case ::perfetto::protos::pbzero::DisplayState_Changes::eFlagsChanged:
-    return "eFlagsChanged";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_LayerState {
-enum ChangesLsb : int32_t {
-  eChangesLsbNone = 0,
-  ePositionChanged = 1,
-  eLayerChanged = 2,
-  eAlphaChanged = 8,
-  eMatrixChanged = 16,
-  eTransparentRegionChanged = 32,
-  eFlagsChanged = 64,
-  eLayerStackChanged = 128,
-  eReleaseBufferListenerChanged = 1024,
-  eShadowRadiusChanged = 2048,
-  eBufferCropChanged = 8192,
-  eRelativeLayerChanged = 16384,
-  eReparent = 32768,
-  eColorChanged = 65536,
-  eBufferTransformChanged = 262144,
-  eTransformToDisplayInverseChanged = 524288,
-  eCropChanged = 1048576,
-  eBufferChanged = 2097152,
-  eAcquireFenceChanged = 4194304,
-  eDataspaceChanged = 8388608,
-  eHdrMetadataChanged = 16777216,
-  eSurfaceDamageRegionChanged = 33554432,
-  eApiChanged = 67108864,
-  eSidebandStreamChanged = 134217728,
-  eColorTransformChanged = 268435456,
-  eHasListenerCallbacksChanged = 536870912,
-  eInputInfoChanged = 1073741824,
-  eCornerRadiusChanged = -2147483647 - 1,
-};
-} // namespace perfetto_pbzero_enum_LayerState
-using LayerState_ChangesLsb = perfetto_pbzero_enum_LayerState::ChangesLsb;
-
-
-constexpr LayerState_ChangesLsb LayerState_ChangesLsb_MIN = LayerState_ChangesLsb::eCornerRadiusChanged;
-constexpr LayerState_ChangesLsb LayerState_ChangesLsb_MAX = LayerState_ChangesLsb::eInputInfoChanged;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* LayerState_ChangesLsb_Name(::perfetto::protos::pbzero::LayerState_ChangesLsb value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eChangesLsbNone:
-    return "eChangesLsbNone";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::ePositionChanged:
-    return "ePositionChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eLayerChanged:
-    return "eLayerChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eAlphaChanged:
-    return "eAlphaChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eMatrixChanged:
-    return "eMatrixChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eTransparentRegionChanged:
-    return "eTransparentRegionChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eFlagsChanged:
-    return "eFlagsChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eLayerStackChanged:
-    return "eLayerStackChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eReleaseBufferListenerChanged:
-    return "eReleaseBufferListenerChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eShadowRadiusChanged:
-    return "eShadowRadiusChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eBufferCropChanged:
-    return "eBufferCropChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eRelativeLayerChanged:
-    return "eRelativeLayerChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eReparent:
-    return "eReparent";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eColorChanged:
-    return "eColorChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eBufferTransformChanged:
-    return "eBufferTransformChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eTransformToDisplayInverseChanged:
-    return "eTransformToDisplayInverseChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eCropChanged:
-    return "eCropChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eBufferChanged:
-    return "eBufferChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eAcquireFenceChanged:
-    return "eAcquireFenceChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eDataspaceChanged:
-    return "eDataspaceChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eHdrMetadataChanged:
-    return "eHdrMetadataChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eSurfaceDamageRegionChanged:
-    return "eSurfaceDamageRegionChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eApiChanged:
-    return "eApiChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eSidebandStreamChanged:
-    return "eSidebandStreamChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eColorTransformChanged:
-    return "eColorTransformChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eHasListenerCallbacksChanged:
-    return "eHasListenerCallbacksChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eInputInfoChanged:
-    return "eInputInfoChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesLsb::eCornerRadiusChanged:
-    return "eCornerRadiusChanged";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_LayerState {
-enum ChangesMsb : int32_t {
-  eChangesMsbNone = 0,
-  eDestinationFrameChanged = 1,
-  eCachedBufferChanged = 2,
-  eBackgroundColorChanged = 4,
-  eMetadataChanged = 8,
-  eColorSpaceAgnosticChanged = 16,
-  eFrameRateSelectionPriority = 32,
-  eFrameRateChanged = 64,
-  eBackgroundBlurRadiusChanged = 128,
-  eProducerDisconnect = 256,
-  eFixedTransformHintChanged = 512,
-  eFrameNumberChanged = 1024,
-  eBlurRegionsChanged = 2048,
-  eAutoRefreshChanged = 4096,
-  eStretchChanged = 8192,
-  eTrustedOverlayChanged = 16384,
-  eDropInputModeChanged = 32768,
-  eClientDrawnCornerRadiusChanged = 65536,
-  eSystemContentPriorityChanged = 131072,
-  eBoxShadowSettingsChanged = 262144,
-  eBorderSettingsChanged = 524288,
-};
-} // namespace perfetto_pbzero_enum_LayerState
-using LayerState_ChangesMsb = perfetto_pbzero_enum_LayerState::ChangesMsb;
-
-
-constexpr LayerState_ChangesMsb LayerState_ChangesMsb_MIN = LayerState_ChangesMsb::eChangesMsbNone;
-constexpr LayerState_ChangesMsb LayerState_ChangesMsb_MAX = LayerState_ChangesMsb::eBorderSettingsChanged;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* LayerState_ChangesMsb_Name(::perfetto::protos::pbzero::LayerState_ChangesMsb value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eChangesMsbNone:
-    return "eChangesMsbNone";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eDestinationFrameChanged:
-    return "eDestinationFrameChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eCachedBufferChanged:
-    return "eCachedBufferChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eBackgroundColorChanged:
-    return "eBackgroundColorChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eMetadataChanged:
-    return "eMetadataChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eColorSpaceAgnosticChanged:
-    return "eColorSpaceAgnosticChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eFrameRateSelectionPriority:
-    return "eFrameRateSelectionPriority";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eFrameRateChanged:
-    return "eFrameRateChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eBackgroundBlurRadiusChanged:
-    return "eBackgroundBlurRadiusChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eProducerDisconnect:
-    return "eProducerDisconnect";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eFixedTransformHintChanged:
-    return "eFixedTransformHintChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eFrameNumberChanged:
-    return "eFrameNumberChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eBlurRegionsChanged:
-    return "eBlurRegionsChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eAutoRefreshChanged:
-    return "eAutoRefreshChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eStretchChanged:
-    return "eStretchChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eTrustedOverlayChanged:
-    return "eTrustedOverlayChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eDropInputModeChanged:
-    return "eDropInputModeChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eClientDrawnCornerRadiusChanged:
-    return "eClientDrawnCornerRadiusChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eSystemContentPriorityChanged:
-    return "eSystemContentPriorityChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eBoxShadowSettingsChanged:
-    return "eBoxShadowSettingsChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_ChangesMsb::eBorderSettingsChanged:
-    return "eBorderSettingsChanged";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_LayerState {
-enum Flags : int32_t {
-  eFlagsNone = 0,
-  eLayerHidden = 1,
-  eLayerOpaque = 2,
-  eLayerSkipScreenshot = 64,
-  eLayerSecure = 128,
-  eEnableBackpressure = 256,
-  eLayerIsDisplayDecoration = 512,
-};
-} // namespace perfetto_pbzero_enum_LayerState
-using LayerState_Flags = perfetto_pbzero_enum_LayerState::Flags;
-
-
-constexpr LayerState_Flags LayerState_Flags_MIN = LayerState_Flags::eFlagsNone;
-constexpr LayerState_Flags LayerState_Flags_MAX = LayerState_Flags::eLayerIsDisplayDecoration;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* LayerState_Flags_Name(::perfetto::protos::pbzero::LayerState_Flags value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::LayerState_Flags::eFlagsNone:
-    return "eFlagsNone";
-
-  case ::perfetto::protos::pbzero::LayerState_Flags::eLayerHidden:
-    return "eLayerHidden";
-
-  case ::perfetto::protos::pbzero::LayerState_Flags::eLayerOpaque:
-    return "eLayerOpaque";
-
-  case ::perfetto::protos::pbzero::LayerState_Flags::eLayerSkipScreenshot:
-    return "eLayerSkipScreenshot";
-
-  case ::perfetto::protos::pbzero::LayerState_Flags::eLayerSecure:
-    return "eLayerSecure";
-
-  case ::perfetto::protos::pbzero::LayerState_Flags::eEnableBackpressure:
-    return "eEnableBackpressure";
-
-  case ::perfetto::protos::pbzero::LayerState_Flags::eLayerIsDisplayDecoration:
-    return "eLayerIsDisplayDecoration";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_LayerState {
-enum DropInputMode : int32_t {
-  NONE = 0,
-  ALL = 1,
-  OBSCURED = 2,
-};
-} // namespace perfetto_pbzero_enum_LayerState
-using LayerState_DropInputMode = perfetto_pbzero_enum_LayerState::DropInputMode;
-
-
-constexpr LayerState_DropInputMode LayerState_DropInputMode_MIN = LayerState_DropInputMode::NONE;
-constexpr LayerState_DropInputMode LayerState_DropInputMode_MAX = LayerState_DropInputMode::OBSCURED;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* LayerState_DropInputMode_Name(::perfetto::protos::pbzero::LayerState_DropInputMode value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::LayerState_DropInputMode::NONE:
-    return "NONE";
-
-  case ::perfetto::protos::pbzero::LayerState_DropInputMode::ALL:
-    return "ALL";
-
-  case ::perfetto::protos::pbzero::LayerState_DropInputMode::OBSCURED:
-    return "OBSCURED";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_LayerState_BufferData {
-enum BufferDataChange : int32_t {
-  BufferDataChangeNone = 0,
-  fenceChanged = 1,
-  frameNumberChanged = 2,
-  cachedBufferChanged = 4,
-};
-} // namespace perfetto_pbzero_enum_LayerState_BufferData
-using LayerState_BufferData_BufferDataChange = perfetto_pbzero_enum_LayerState_BufferData::BufferDataChange;
-
-
-constexpr LayerState_BufferData_BufferDataChange LayerState_BufferData_BufferDataChange_MIN = LayerState_BufferData_BufferDataChange::BufferDataChangeNone;
-constexpr LayerState_BufferData_BufferDataChange LayerState_BufferData_BufferDataChange_MAX = LayerState_BufferData_BufferDataChange::cachedBufferChanged;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* LayerState_BufferData_BufferDataChange_Name(::perfetto::protos::pbzero::LayerState_BufferData_BufferDataChange value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::LayerState_BufferData_BufferDataChange::BufferDataChangeNone:
-    return "BufferDataChangeNone";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_BufferDataChange::fenceChanged:
-    return "fenceChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_BufferDataChange::frameNumberChanged:
-    return "frameNumberChanged";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_BufferDataChange::cachedBufferChanged:
-    return "cachedBufferChanged";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_LayerState_BufferData {
-enum PixelFormat : int32_t {
-  PIXEL_FORMAT_UNKNOWN = 0,
-  PIXEL_FORMAT_CUSTOM = -4,
-  PIXEL_FORMAT_TRANSLUCENT = -3,
-  PIXEL_FORMAT_TRANSPARENT = -2,
-  PIXEL_FORMAT_OPAQUE = -1,
-  PIXEL_FORMAT_RGBA_8888 = 1,
-  PIXEL_FORMAT_RGBX_8888 = 2,
-  PIXEL_FORMAT_RGB_888 = 3,
-  PIXEL_FORMAT_RGB_565 = 4,
-  PIXEL_FORMAT_BGRA_8888 = 5,
-  PIXEL_FORMAT_RGBA_5551 = 6,
-  PIXEL_FORMAT_RGBA_4444 = 7,
-  PIXEL_FORMAT_RGBA_FP16 = 22,
-  PIXEL_FORMAT_RGBA_1010102 = 43,
-  PIXEL_FORMAT_R_8 = 56,
-};
-} // namespace perfetto_pbzero_enum_LayerState_BufferData
-using LayerState_BufferData_PixelFormat = perfetto_pbzero_enum_LayerState_BufferData::PixelFormat;
-
-
-constexpr LayerState_BufferData_PixelFormat LayerState_BufferData_PixelFormat_MIN = LayerState_BufferData_PixelFormat::PIXEL_FORMAT_CUSTOM;
-constexpr LayerState_BufferData_PixelFormat LayerState_BufferData_PixelFormat_MAX = LayerState_BufferData_PixelFormat::PIXEL_FORMAT_R_8;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* LayerState_BufferData_PixelFormat_Name(::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_UNKNOWN:
-    return "PIXEL_FORMAT_UNKNOWN";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_CUSTOM:
-    return "PIXEL_FORMAT_CUSTOM";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_TRANSLUCENT:
-    return "PIXEL_FORMAT_TRANSLUCENT";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_TRANSPARENT:
-    return "PIXEL_FORMAT_TRANSPARENT";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_OPAQUE:
-    return "PIXEL_FORMAT_OPAQUE";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGBA_8888:
-    return "PIXEL_FORMAT_RGBA_8888";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGBX_8888:
-    return "PIXEL_FORMAT_RGBX_8888";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGB_888:
-    return "PIXEL_FORMAT_RGB_888";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGB_565:
-    return "PIXEL_FORMAT_RGB_565";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_BGRA_8888:
-    return "PIXEL_FORMAT_BGRA_8888";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGBA_5551:
-    return "PIXEL_FORMAT_RGBA_5551";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGBA_4444:
-    return "PIXEL_FORMAT_RGBA_4444";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGBA_FP16:
-    return "PIXEL_FORMAT_RGBA_FP16";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_RGBA_1010102:
-    return "PIXEL_FORMAT_RGBA_1010102";
-
-  case ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat::PIXEL_FORMAT_R_8:
-    return "PIXEL_FORMAT_R_8";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_TransactionTraceFile {
-enum MagicNumber : int32_t {
-  INVALID = 0,
-  MAGIC_NUMBER_L = 1415073364,
-  MAGIC_NUMBER_H = 1162035538,
-};
-} // namespace perfetto_pbzero_enum_TransactionTraceFile
-using TransactionTraceFile_MagicNumber = perfetto_pbzero_enum_TransactionTraceFile::MagicNumber;
-
-
-constexpr TransactionTraceFile_MagicNumber TransactionTraceFile_MagicNumber_MIN = TransactionTraceFile_MagicNumber::INVALID;
-constexpr TransactionTraceFile_MagicNumber TransactionTraceFile_MagicNumber_MAX = TransactionTraceFile_MagicNumber::MAGIC_NUMBER_L;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* TransactionTraceFile_MagicNumber_Name(::perfetto::protos::pbzero::TransactionTraceFile_MagicNumber value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::TransactionTraceFile_MagicNumber::INVALID:
-    return "INVALID";
-
-  case ::perfetto::protos::pbzero::TransactionTraceFile_MagicNumber::MAGIC_NUMBER_L:
-    return "MAGIC_NUMBER_L";
-
-  case ::perfetto::protos::pbzero::TransactionTraceFile_MagicNumber::MAGIC_NUMBER_H:
-    return "MAGIC_NUMBER_H";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class DisplayState_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
- public:
-  DisplayState_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit DisplayState_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit DisplayState_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  int32_t id() const { return at<1>().as_int32(); }
-  bool has_what() const { return at<2>().valid(); }
-  uint32_t what() const { return at<2>().as_uint32(); }
-  bool has_flags() const { return at<3>().valid(); }
-  uint32_t flags() const { return at<3>().as_uint32(); }
-  bool has_layer_stack() const { return at<4>().valid(); }
-  uint32_t layer_stack() const { return at<4>().as_uint32(); }
-  bool has_orientation() const { return at<5>().valid(); }
-  uint32_t orientation() const { return at<5>().as_uint32(); }
-  bool has_layer_stack_space_rect() const { return at<6>().valid(); }
-  ::protozero::ConstBytes layer_stack_space_rect() const { return at<6>().as_bytes(); }
-  bool has_oriented_display_space_rect() const { return at<7>().valid(); }
-  ::protozero::ConstBytes oriented_display_space_rect() const { return at<7>().as_bytes(); }
-  bool has_width() const { return at<8>().valid(); }
-  uint32_t width() const { return at<8>().as_uint32(); }
-  bool has_height() const { return at<9>().valid(); }
-  uint32_t height() const { return at<9>().as_uint32(); }
-};
-
-class DisplayState : public ::protozero::Message {
- public:
-  using Decoder = DisplayState_Decoder;
-  enum : int32_t {
-    kIdFieldNumber = 1,
-    kWhatFieldNumber = 2,
-    kFlagsFieldNumber = 3,
-    kLayerStackFieldNumber = 4,
-    kOrientationFieldNumber = 5,
-    kLayerStackSpaceRectFieldNumber = 6,
-    kOrientedDisplaySpaceRectFieldNumber = 7,
-    kWidthFieldNumber = 8,
-    kHeightFieldNumber = 9,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.DisplayState"; }
-
-
-  using Changes = ::perfetto::protos::pbzero::DisplayState_Changes;
-  static inline const char* Changes_Name(Changes value) {
-    return ::perfetto::protos::pbzero::DisplayState_Changes_Name(value);
-  }
-  static inline const Changes eChangesNone = Changes::eChangesNone;
-  static inline const Changes eSurfaceChanged = Changes::eSurfaceChanged;
-  static inline const Changes eLayerStackChanged = Changes::eLayerStackChanged;
-  static inline const Changes eDisplayProjectionChanged = Changes::eDisplayProjectionChanged;
-  static inline const Changes eDisplaySizeChanged = Changes::eDisplaySizeChanged;
-  static inline const Changes eFlagsChanged = Changes::eFlagsChanged;
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      DisplayState>;
-
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_What =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayState>;
-
-  static constexpr FieldMetadata_What kWhat{};
-  void set_what(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_What::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayState>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayerStack =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayState>;
-
-  static constexpr FieldMetadata_LayerStack kLayerStack{};
-  void set_layer_stack(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerStack::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Orientation =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayState>;
-
-  static constexpr FieldMetadata_Orientation kOrientation{};
-  void set_orientation(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Orientation::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayerStackSpaceRect =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      DisplayState>;
-
-  static constexpr FieldMetadata_LayerStackSpaceRect kLayerStackSpaceRect{};
-  template <typename T = RectProto> T* set_layer_stack_space_rect() {
-    return BeginNestedMessage<T>(6);
-  }
-
-
-  using FieldMetadata_OrientedDisplaySpaceRect =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      DisplayState>;
-
-  static constexpr FieldMetadata_OrientedDisplaySpaceRect kOrientedDisplaySpaceRect{};
-  template <typename T = RectProto> T* set_oriented_display_space_rect() {
-    return BeginNestedMessage<T>(7);
-  }
-
-
-  using FieldMetadata_Width =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayState>;
-
-  static constexpr FieldMetadata_Width kWidth{};
-  void set_width(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Width::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Height =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayState>;
-
-  static constexpr FieldMetadata_Height kHeight{};
-  void set_height(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Height::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayerState_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/49> {
- public:
-  LayerState_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerState_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerState_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_layer_id() const { return at<1>().valid(); }
-  uint32_t layer_id() const { return at<1>().as_uint32(); }
-  bool has_what() const { return at<2>().valid(); }
-  uint64_t what() const { return at<2>().as_uint64(); }
-  bool has_x() const { return at<3>().valid(); }
-  float x() const { return at<3>().as_float(); }
-  bool has_y() const { return at<4>().valid(); }
-  float y() const { return at<4>().as_float(); }
-  bool has_z() const { return at<5>().valid(); }
-  int32_t z() const { return at<5>().as_int32(); }
-  bool has_w() const { return at<6>().valid(); }
-  uint32_t w() const { return at<6>().as_uint32(); }
-  bool has_h() const { return at<7>().valid(); }
-  uint32_t h() const { return at<7>().as_uint32(); }
-  bool has_layer_stack() const { return at<8>().valid(); }
-  uint32_t layer_stack() const { return at<8>().as_uint32(); }
-  bool has_flags() const { return at<9>().valid(); }
-  uint32_t flags() const { return at<9>().as_uint32(); }
-  bool has_mask() const { return at<10>().valid(); }
-  uint32_t mask() const { return at<10>().as_uint32(); }
-  bool has_matrix() const { return at<11>().valid(); }
-  ::protozero::ConstBytes matrix() const { return at<11>().as_bytes(); }
-  bool has_corner_radius() const { return at<12>().valid(); }
-  float corner_radius() const { return at<12>().as_float(); }
-  bool has_background_blur_radius() const { return at<13>().valid(); }
-  uint32_t background_blur_radius() const { return at<13>().as_uint32(); }
-  bool has_parent_id() const { return at<14>().valid(); }
-  uint32_t parent_id() const { return at<14>().as_uint32(); }
-  bool has_relative_parent_id() const { return at<15>().valid(); }
-  uint32_t relative_parent_id() const { return at<15>().as_uint32(); }
-  bool has_alpha() const { return at<16>().valid(); }
-  float alpha() const { return at<16>().as_float(); }
-  bool has_color() const { return at<17>().valid(); }
-  ::protozero::ConstBytes color() const { return at<17>().as_bytes(); }
-  bool has_transparent_region() const { return at<18>().valid(); }
-  ::protozero::ConstBytes transparent_region() const { return at<18>().as_bytes(); }
-  bool has_transform() const { return at<19>().valid(); }
-  uint32_t transform() const { return at<19>().as_uint32(); }
-  bool has_transform_to_display_inverse() const { return at<20>().valid(); }
-  bool transform_to_display_inverse() const { return at<20>().as_bool(); }
-  bool has_crop() const { return at<21>().valid(); }
-  ::protozero::ConstBytes crop() const { return at<21>().as_bytes(); }
-  bool has_buffer_data() const { return at<22>().valid(); }
-  ::protozero::ConstBytes buffer_data() const { return at<22>().as_bytes(); }
-  bool has_api() const { return at<23>().valid(); }
-  int32_t api() const { return at<23>().as_int32(); }
-  bool has_has_sideband_stream() const { return at<24>().valid(); }
-  bool has_sideband_stream() const { return at<24>().as_bool(); }
-  bool has_color_transform() const { return at<25>().valid(); }
-  ::protozero::ConstBytes color_transform() const { return at<25>().as_bytes(); }
-  bool has_blur_regions() const { return at<26>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> blur_regions() const { return GetRepeated<::protozero::ConstBytes>(26); }
-  bool has_window_info_handle() const { return at<27>().valid(); }
-  ::protozero::ConstBytes window_info_handle() const { return at<27>().as_bytes(); }
-  bool has_bg_color_alpha() const { return at<28>().valid(); }
-  float bg_color_alpha() const { return at<28>().as_float(); }
-  bool has_bg_color_dataspace() const { return at<29>().valid(); }
-  int32_t bg_color_dataspace() const { return at<29>().as_int32(); }
-  bool has_color_space_agnostic() const { return at<30>().valid(); }
-  bool color_space_agnostic() const { return at<30>().as_bool(); }
-  bool has_shadow_radius() const { return at<31>().valid(); }
-  float shadow_radius() const { return at<31>().as_float(); }
-  bool has_frame_rate_selection_priority() const { return at<32>().valid(); }
-  int32_t frame_rate_selection_priority() const { return at<32>().as_int32(); }
-  bool has_frame_rate() const { return at<33>().valid(); }
-  float frame_rate() const { return at<33>().as_float(); }
-  bool has_frame_rate_compatibility() const { return at<34>().valid(); }
-  int32_t frame_rate_compatibility() const { return at<34>().as_int32(); }
-  bool has_change_frame_rate_strategy() const { return at<35>().valid(); }
-  int32_t change_frame_rate_strategy() const { return at<35>().as_int32(); }
-  bool has_fixed_transform_hint() const { return at<36>().valid(); }
-  uint32_t fixed_transform_hint() const { return at<36>().as_uint32(); }
-  bool has_frame_number() const { return at<37>().valid(); }
-  uint64_t frame_number() const { return at<37>().as_uint64(); }
-  bool has_auto_refresh() const { return at<38>().valid(); }
-  bool auto_refresh() const { return at<38>().as_bool(); }
-  bool has_is_trusted_overlay() const { return at<39>().valid(); }
-  bool is_trusted_overlay() const { return at<39>().as_bool(); }
-  bool has_buffer_crop() const { return at<40>().valid(); }
-  ::protozero::ConstBytes buffer_crop() const { return at<40>().as_bytes(); }
-  bool has_destination_frame() const { return at<41>().valid(); }
-  ::protozero::ConstBytes destination_frame() const { return at<41>().as_bytes(); }
-  bool has_drop_input_mode() const { return at<42>().valid(); }
-  int32_t drop_input_mode() const { return at<42>().as_int32(); }
-  bool has_trusted_overlay() const { return at<43>().valid(); }
-  int32_t trusted_overlay() const { return at<43>().as_int32(); }
-  bool has_background_blur_scale() const { return at<44>().valid(); }
-  float background_blur_scale() const { return at<44>().as_float(); }
-  bool has_corner_radii() const { return at<45>().valid(); }
-  ::protozero::ConstBytes corner_radii() const { return at<45>().as_bytes(); }
-  bool has_client_drawn_corner_radii() const { return at<46>().valid(); }
-  ::protozero::ConstBytes client_drawn_corner_radii() const { return at<46>().as_bytes(); }
-  bool has_system_content_priority() const { return at<47>().valid(); }
-  int32_t system_content_priority() const { return at<47>().as_int32(); }
-  bool has_box_shadow_settings() const { return at<48>().valid(); }
-  ::protozero::ConstBytes box_shadow_settings() const { return at<48>().as_bytes(); }
-  bool has_border_settings() const { return at<49>().valid(); }
-  ::protozero::ConstBytes border_settings() const { return at<49>().as_bytes(); }
-};
-
-class LayerState : public ::protozero::Message {
- public:
-  using Decoder = LayerState_Decoder;
-  enum : int32_t {
-    kLayerIdFieldNumber = 1,
-    kWhatFieldNumber = 2,
-    kXFieldNumber = 3,
-    kYFieldNumber = 4,
-    kZFieldNumber = 5,
-    kWFieldNumber = 6,
-    kHFieldNumber = 7,
-    kLayerStackFieldNumber = 8,
-    kFlagsFieldNumber = 9,
-    kMaskFieldNumber = 10,
-    kMatrixFieldNumber = 11,
-    kCornerRadiusFieldNumber = 12,
-    kBackgroundBlurRadiusFieldNumber = 13,
-    kParentIdFieldNumber = 14,
-    kRelativeParentIdFieldNumber = 15,
-    kAlphaFieldNumber = 16,
-    kColorFieldNumber = 17,
-    kTransparentRegionFieldNumber = 18,
-    kTransformFieldNumber = 19,
-    kTransformToDisplayInverseFieldNumber = 20,
-    kCropFieldNumber = 21,
-    kBufferDataFieldNumber = 22,
-    kApiFieldNumber = 23,
-    kHasSidebandStreamFieldNumber = 24,
-    kColorTransformFieldNumber = 25,
-    kBlurRegionsFieldNumber = 26,
-    kWindowInfoHandleFieldNumber = 27,
-    kBgColorAlphaFieldNumber = 28,
-    kBgColorDataspaceFieldNumber = 29,
-    kColorSpaceAgnosticFieldNumber = 30,
-    kShadowRadiusFieldNumber = 31,
-    kFrameRateSelectionPriorityFieldNumber = 32,
-    kFrameRateFieldNumber = 33,
-    kFrameRateCompatibilityFieldNumber = 34,
-    kChangeFrameRateStrategyFieldNumber = 35,
-    kFixedTransformHintFieldNumber = 36,
-    kFrameNumberFieldNumber = 37,
-    kAutoRefreshFieldNumber = 38,
-    kIsTrustedOverlayFieldNumber = 39,
-    kBufferCropFieldNumber = 40,
-    kDestinationFrameFieldNumber = 41,
-    kDropInputModeFieldNumber = 42,
-    kTrustedOverlayFieldNumber = 43,
-    kBackgroundBlurScaleFieldNumber = 44,
-    kCornerRadiiFieldNumber = 45,
-    kClientDrawnCornerRadiiFieldNumber = 46,
-    kSystemContentPriorityFieldNumber = 47,
-    kBoxShadowSettingsFieldNumber = 48,
-    kBorderSettingsFieldNumber = 49,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerState"; }
-
-  using Matrix22 = ::perfetto::protos::pbzero::LayerState_Matrix22;
-  using CornerRadii = ::perfetto::protos::pbzero::LayerState_CornerRadii;
-  using Color3 = ::perfetto::protos::pbzero::LayerState_Color3;
-  using BufferData = ::perfetto::protos::pbzero::LayerState_BufferData;
-  using WindowInfo = ::perfetto::protos::pbzero::LayerState_WindowInfo;
-
-  using ChangesLsb = ::perfetto::protos::pbzero::LayerState_ChangesLsb;
-  static inline const char* ChangesLsb_Name(ChangesLsb value) {
-    return ::perfetto::protos::pbzero::LayerState_ChangesLsb_Name(value);
-  }
-
-  using ChangesMsb = ::perfetto::protos::pbzero::LayerState_ChangesMsb;
-  static inline const char* ChangesMsb_Name(ChangesMsb value) {
-    return ::perfetto::protos::pbzero::LayerState_ChangesMsb_Name(value);
-  }
-
-  using Flags = ::perfetto::protos::pbzero::LayerState_Flags;
-  static inline const char* Flags_Name(Flags value) {
-    return ::perfetto::protos::pbzero::LayerState_Flags_Name(value);
-  }
-
-  using DropInputMode = ::perfetto::protos::pbzero::LayerState_DropInputMode;
-  static inline const char* DropInputMode_Name(DropInputMode value) {
-    return ::perfetto::protos::pbzero::LayerState_DropInputMode_Name(value);
-  }
-  static inline const ChangesLsb eChangesLsbNone = ChangesLsb::eChangesLsbNone;
-  static inline const ChangesLsb ePositionChanged = ChangesLsb::ePositionChanged;
-  static inline const ChangesLsb eLayerChanged = ChangesLsb::eLayerChanged;
-  static inline const ChangesLsb eAlphaChanged = ChangesLsb::eAlphaChanged;
-  static inline const ChangesLsb eMatrixChanged = ChangesLsb::eMatrixChanged;
-  static inline const ChangesLsb eTransparentRegionChanged = ChangesLsb::eTransparentRegionChanged;
-  static inline const ChangesLsb eFlagsChanged = ChangesLsb::eFlagsChanged;
-  static inline const ChangesLsb eLayerStackChanged = ChangesLsb::eLayerStackChanged;
-  static inline const ChangesLsb eReleaseBufferListenerChanged = ChangesLsb::eReleaseBufferListenerChanged;
-  static inline const ChangesLsb eShadowRadiusChanged = ChangesLsb::eShadowRadiusChanged;
-  static inline const ChangesLsb eBufferCropChanged = ChangesLsb::eBufferCropChanged;
-  static inline const ChangesLsb eRelativeLayerChanged = ChangesLsb::eRelativeLayerChanged;
-  static inline const ChangesLsb eReparent = ChangesLsb::eReparent;
-  static inline const ChangesLsb eColorChanged = ChangesLsb::eColorChanged;
-  static inline const ChangesLsb eBufferTransformChanged = ChangesLsb::eBufferTransformChanged;
-  static inline const ChangesLsb eTransformToDisplayInverseChanged = ChangesLsb::eTransformToDisplayInverseChanged;
-  static inline const ChangesLsb eCropChanged = ChangesLsb::eCropChanged;
-  static inline const ChangesLsb eBufferChanged = ChangesLsb::eBufferChanged;
-  static inline const ChangesLsb eAcquireFenceChanged = ChangesLsb::eAcquireFenceChanged;
-  static inline const ChangesLsb eDataspaceChanged = ChangesLsb::eDataspaceChanged;
-  static inline const ChangesLsb eHdrMetadataChanged = ChangesLsb::eHdrMetadataChanged;
-  static inline const ChangesLsb eSurfaceDamageRegionChanged = ChangesLsb::eSurfaceDamageRegionChanged;
-  static inline const ChangesLsb eApiChanged = ChangesLsb::eApiChanged;
-  static inline const ChangesLsb eSidebandStreamChanged = ChangesLsb::eSidebandStreamChanged;
-  static inline const ChangesLsb eColorTransformChanged = ChangesLsb::eColorTransformChanged;
-  static inline const ChangesLsb eHasListenerCallbacksChanged = ChangesLsb::eHasListenerCallbacksChanged;
-  static inline const ChangesLsb eInputInfoChanged = ChangesLsb::eInputInfoChanged;
-  static inline const ChangesLsb eCornerRadiusChanged = ChangesLsb::eCornerRadiusChanged;
-  static inline const ChangesMsb eChangesMsbNone = ChangesMsb::eChangesMsbNone;
-  static inline const ChangesMsb eDestinationFrameChanged = ChangesMsb::eDestinationFrameChanged;
-  static inline const ChangesMsb eCachedBufferChanged = ChangesMsb::eCachedBufferChanged;
-  static inline const ChangesMsb eBackgroundColorChanged = ChangesMsb::eBackgroundColorChanged;
-  static inline const ChangesMsb eMetadataChanged = ChangesMsb::eMetadataChanged;
-  static inline const ChangesMsb eColorSpaceAgnosticChanged = ChangesMsb::eColorSpaceAgnosticChanged;
-  static inline const ChangesMsb eFrameRateSelectionPriority = ChangesMsb::eFrameRateSelectionPriority;
-  static inline const ChangesMsb eFrameRateChanged = ChangesMsb::eFrameRateChanged;
-  static inline const ChangesMsb eBackgroundBlurRadiusChanged = ChangesMsb::eBackgroundBlurRadiusChanged;
-  static inline const ChangesMsb eProducerDisconnect = ChangesMsb::eProducerDisconnect;
-  static inline const ChangesMsb eFixedTransformHintChanged = ChangesMsb::eFixedTransformHintChanged;
-  static inline const ChangesMsb eFrameNumberChanged = ChangesMsb::eFrameNumberChanged;
-  static inline const ChangesMsb eBlurRegionsChanged = ChangesMsb::eBlurRegionsChanged;
-  static inline const ChangesMsb eAutoRefreshChanged = ChangesMsb::eAutoRefreshChanged;
-  static inline const ChangesMsb eStretchChanged = ChangesMsb::eStretchChanged;
-  static inline const ChangesMsb eTrustedOverlayChanged = ChangesMsb::eTrustedOverlayChanged;
-  static inline const ChangesMsb eDropInputModeChanged = ChangesMsb::eDropInputModeChanged;
-  static inline const ChangesMsb eClientDrawnCornerRadiusChanged = ChangesMsb::eClientDrawnCornerRadiusChanged;
-  static inline const ChangesMsb eSystemContentPriorityChanged = ChangesMsb::eSystemContentPriorityChanged;
-  static inline const ChangesMsb eBoxShadowSettingsChanged = ChangesMsb::eBoxShadowSettingsChanged;
-  static inline const ChangesMsb eBorderSettingsChanged = ChangesMsb::eBorderSettingsChanged;
-  static inline const Flags eFlagsNone = Flags::eFlagsNone;
-  static inline const Flags eLayerHidden = Flags::eLayerHidden;
-  static inline const Flags eLayerOpaque = Flags::eLayerOpaque;
-  static inline const Flags eLayerSkipScreenshot = Flags::eLayerSkipScreenshot;
-  static inline const Flags eLayerSecure = Flags::eLayerSecure;
-  static inline const Flags eEnableBackpressure = Flags::eEnableBackpressure;
-  static inline const Flags eLayerIsDisplayDecoration = Flags::eLayerIsDisplayDecoration;
-  static inline const DropInputMode NONE = DropInputMode::NONE;
-  static inline const DropInputMode ALL = DropInputMode::ALL;
-  static inline const DropInputMode OBSCURED = DropInputMode::OBSCURED;
-
-  using FieldMetadata_LayerId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_LayerId kLayerId{};
-  void set_layer_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_What =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_What kWhat{};
-  void set_what(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_What::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_X =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_X kX{};
-  void set_x(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_X::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Y =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_Y kY{};
-  void set_y(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Y::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Z =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_Z kZ{};
-  void set_z(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Z::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_W =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_W kW{};
-  void set_w(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_W::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_H =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_H kH{};
-  void set_h(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_H::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayerStack =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_LayerStack kLayerStack{};
-  void set_layer_stack(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerStack::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Mask =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_Mask kMask{};
-  void set_mask(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Mask::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Matrix =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerState_Matrix22,
-      LayerState>;
-
-  static constexpr FieldMetadata_Matrix kMatrix{};
-  template <typename T = LayerState_Matrix22> T* set_matrix() {
-    return BeginNestedMessage<T>(11);
-  }
-
-
-  using FieldMetadata_CornerRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_CornerRadius kCornerRadius{};
-  void set_corner_radius(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_CornerRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BackgroundBlurRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      13,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_BackgroundBlurRadius kBackgroundBlurRadius{};
-  void set_background_blur_radius(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_BackgroundBlurRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ParentId =
-    ::protozero::proto_utils::FieldMetadata<
-      14,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_ParentId kParentId{};
-  void set_parent_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ParentId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_RelativeParentId =
-    ::protozero::proto_utils::FieldMetadata<
-      15,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_RelativeParentId kRelativeParentId{};
-  void set_relative_parent_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RelativeParentId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Alpha =
-    ::protozero::proto_utils::FieldMetadata<
-      16,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_Alpha kAlpha{};
-  void set_alpha(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Alpha::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Color =
-    ::protozero::proto_utils::FieldMetadata<
-      17,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerState_Color3,
-      LayerState>;
-
-  static constexpr FieldMetadata_Color kColor{};
-  template <typename T = LayerState_Color3> T* set_color() {
-    return BeginNestedMessage<T>(17);
-  }
-
-
-  using FieldMetadata_TransparentRegion =
-    ::protozero::proto_utils::FieldMetadata<
-      18,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RegionProto,
-      LayerState>;
-
-  static constexpr FieldMetadata_TransparentRegion kTransparentRegion{};
-  template <typename T = RegionProto> T* set_transparent_region() {
-    return BeginNestedMessage<T>(18);
-  }
-
-
-  using FieldMetadata_Transform =
-    ::protozero::proto_utils::FieldMetadata<
-      19,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_Transform kTransform{};
-  void set_transform(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Transform::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TransformToDisplayInverse =
-    ::protozero::proto_utils::FieldMetadata<
-      20,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState>;
-
-  static constexpr FieldMetadata_TransformToDisplayInverse kTransformToDisplayInverse{};
-  void set_transform_to_display_inverse(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_TransformToDisplayInverse::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Crop =
-    ::protozero::proto_utils::FieldMetadata<
-      21,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerState>;
-
-  static constexpr FieldMetadata_Crop kCrop{};
-  template <typename T = RectProto> T* set_crop() {
-    return BeginNestedMessage<T>(21);
-  }
-
-
-  using FieldMetadata_BufferData =
-    ::protozero::proto_utils::FieldMetadata<
-      22,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerState_BufferData,
-      LayerState>;
-
-  static constexpr FieldMetadata_BufferData kBufferData{};
-  template <typename T = LayerState_BufferData> T* set_buffer_data() {
-    return BeginNestedMessage<T>(22);
-  }
-
-
-  using FieldMetadata_Api =
-    ::protozero::proto_utils::FieldMetadata<
-      23,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_Api kApi{};
-  void set_api(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Api::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_HasSidebandStream =
-    ::protozero::proto_utils::FieldMetadata<
-      24,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState>;
-
-  static constexpr FieldMetadata_HasSidebandStream kHasSidebandStream{};
-  void set_has_sideband_stream(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_HasSidebandStream::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ColorTransform =
-    ::protozero::proto_utils::FieldMetadata<
-      25,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ColorTransformProto,
-      LayerState>;
-
-  static constexpr FieldMetadata_ColorTransform kColorTransform{};
-  template <typename T = ColorTransformProto> T* set_color_transform() {
-    return BeginNestedMessage<T>(25);
-  }
-
-
-  using FieldMetadata_BlurRegions =
-    ::protozero::proto_utils::FieldMetadata<
-      26,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BlurRegion,
-      LayerState>;
-
-  static constexpr FieldMetadata_BlurRegions kBlurRegions{};
-  template <typename T = BlurRegion> T* add_blur_regions() {
-    return BeginNestedMessage<T>(26);
-  }
-
-
-  using FieldMetadata_WindowInfoHandle =
-    ::protozero::proto_utils::FieldMetadata<
-      27,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerState_WindowInfo,
-      LayerState>;
-
-  static constexpr FieldMetadata_WindowInfoHandle kWindowInfoHandle{};
-  template <typename T = LayerState_WindowInfo> T* set_window_info_handle() {
-    return BeginNestedMessage<T>(27);
-  }
-
-
-  using FieldMetadata_BgColorAlpha =
-    ::protozero::proto_utils::FieldMetadata<
-      28,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_BgColorAlpha kBgColorAlpha{};
-  void set_bg_color_alpha(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_BgColorAlpha::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BgColorDataspace =
-    ::protozero::proto_utils::FieldMetadata<
-      29,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_BgColorDataspace kBgColorDataspace{};
-  void set_bg_color_dataspace(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_BgColorDataspace::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ColorSpaceAgnostic =
-    ::protozero::proto_utils::FieldMetadata<
-      30,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState>;
-
-  static constexpr FieldMetadata_ColorSpaceAgnostic kColorSpaceAgnostic{};
-  void set_color_space_agnostic(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ColorSpaceAgnostic::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ShadowRadius =
-    ::protozero::proto_utils::FieldMetadata<
-      31,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_ShadowRadius kShadowRadius{};
-  void set_shadow_radius(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_ShadowRadius::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FrameRateSelectionPriority =
-    ::protozero::proto_utils::FieldMetadata<
-      32,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_FrameRateSelectionPriority kFrameRateSelectionPriority{};
-  void set_frame_rate_selection_priority(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FrameRateSelectionPriority::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FrameRate =
-    ::protozero::proto_utils::FieldMetadata<
-      33,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_FrameRate kFrameRate{};
-  void set_frame_rate(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_FrameRate::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FrameRateCompatibility =
-    ::protozero::proto_utils::FieldMetadata<
-      34,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_FrameRateCompatibility kFrameRateCompatibility{};
-  void set_frame_rate_compatibility(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FrameRateCompatibility::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ChangeFrameRateStrategy =
-    ::protozero::proto_utils::FieldMetadata<
-      35,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_ChangeFrameRateStrategy kChangeFrameRateStrategy{};
-  void set_change_frame_rate_strategy(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ChangeFrameRateStrategy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FixedTransformHint =
-    ::protozero::proto_utils::FieldMetadata<
-      36,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_FixedTransformHint kFixedTransformHint{};
-  void set_fixed_transform_hint(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FixedTransformHint::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FrameNumber =
-    ::protozero::proto_utils::FieldMetadata<
-      37,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_FrameNumber kFrameNumber{};
-  void set_frame_number(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FrameNumber::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_AutoRefresh =
-    ::protozero::proto_utils::FieldMetadata<
-      38,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState>;
-
-  static constexpr FieldMetadata_AutoRefresh kAutoRefresh{};
-  void set_auto_refresh(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_AutoRefresh::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IsTrustedOverlay =
-    ::protozero::proto_utils::FieldMetadata<
-      39,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState>;
-
-  static constexpr FieldMetadata_IsTrustedOverlay kIsTrustedOverlay{};
-  void set_is_trusted_overlay(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsTrustedOverlay::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BufferCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      40,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerState>;
-
-  static constexpr FieldMetadata_BufferCrop kBufferCrop{};
-  template <typename T = RectProto> T* set_buffer_crop() {
-    return BeginNestedMessage<T>(40);
-  }
-
-
-  using FieldMetadata_DestinationFrame =
-    ::protozero::proto_utils::FieldMetadata<
-      41,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerState>;
-
-  static constexpr FieldMetadata_DestinationFrame kDestinationFrame{};
-  template <typename T = RectProto> T* set_destination_frame() {
-    return BeginNestedMessage<T>(41);
-  }
-
-
-  using FieldMetadata_DropInputMode =
-    ::protozero::proto_utils::FieldMetadata<
-      42,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      LayerState_DropInputMode,
-      LayerState>;
-
-  static constexpr FieldMetadata_DropInputMode kDropInputMode{};
-  void set_drop_input_mode(LayerState_DropInputMode value) {
-    static constexpr uint32_t field_id = FieldMetadata_DropInputMode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TrustedOverlay =
-    ::protozero::proto_utils::FieldMetadata<
-      43,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      TrustedOverlay,
-      LayerState>;
-
-  static constexpr FieldMetadata_TrustedOverlay kTrustedOverlay{};
-  void set_trusted_overlay(TrustedOverlay value) {
-    static constexpr uint32_t field_id = FieldMetadata_TrustedOverlay::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BackgroundBlurScale =
-    ::protozero::proto_utils::FieldMetadata<
-      44,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState>;
-
-  static constexpr FieldMetadata_BackgroundBlurScale kBackgroundBlurScale{};
-  void set_background_blur_scale(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_BackgroundBlurScale::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CornerRadii =
-    ::protozero::proto_utils::FieldMetadata<
-      45,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerState_CornerRadii,
-      LayerState>;
-
-  static constexpr FieldMetadata_CornerRadii kCornerRadii{};
-  template <typename T = LayerState_CornerRadii> T* set_corner_radii() {
-    return BeginNestedMessage<T>(45);
-  }
-
-
-  using FieldMetadata_ClientDrawnCornerRadii =
-    ::protozero::proto_utils::FieldMetadata<
-      46,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerState_CornerRadii,
-      LayerState>;
-
-  static constexpr FieldMetadata_ClientDrawnCornerRadii kClientDrawnCornerRadii{};
-  template <typename T = LayerState_CornerRadii> T* set_client_drawn_corner_radii() {
-    return BeginNestedMessage<T>(46);
-  }
-
-
-  using FieldMetadata_SystemContentPriority =
-    ::protozero::proto_utils::FieldMetadata<
-      47,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState>;
-
-  static constexpr FieldMetadata_SystemContentPriority kSystemContentPriority{};
-  void set_system_content_priority(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SystemContentPriority::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_BoxShadowSettings =
-    ::protozero::proto_utils::FieldMetadata<
-      48,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BoxShadowSettings,
-      LayerState>;
-
-  static constexpr FieldMetadata_BoxShadowSettings kBoxShadowSettings{};
-  template <typename T = BoxShadowSettings> T* set_box_shadow_settings() {
-    return BeginNestedMessage<T>(48);
-  }
-
-
-  using FieldMetadata_BorderSettings =
-    ::protozero::proto_utils::FieldMetadata<
-      49,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      BorderSettings,
-      LayerState>;
-
-  static constexpr FieldMetadata_BorderSettings kBorderSettings{};
-  template <typename T = BorderSettings> T* set_border_settings() {
-    return BeginNestedMessage<T>(49);
-  }
-
-};
-
-class LayerState_WindowInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/12> {
- public:
-  LayerState_WindowInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerState_WindowInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerState_WindowInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_layout_params_flags() const { return at<1>().valid(); }
-  uint32_t layout_params_flags() const { return at<1>().as_uint32(); }
-  bool has_layout_params_type() const { return at<2>().valid(); }
-  int32_t layout_params_type() const { return at<2>().as_int32(); }
-  bool has_touchable_region() const { return at<3>().valid(); }
-  ::protozero::ConstBytes touchable_region() const { return at<3>().as_bytes(); }
-  bool has_surface_inset() const { return at<4>().valid(); }
-  int32_t surface_inset() const { return at<4>().as_int32(); }
-  bool has_focusable() const { return at<5>().valid(); }
-  bool focusable() const { return at<5>().as_bool(); }
-  bool has_has_wallpaper() const { return at<6>().valid(); }
-  bool has_wallpaper() const { return at<6>().as_bool(); }
-  bool has_global_scale_factor() const { return at<7>().valid(); }
-  float global_scale_factor() const { return at<7>().as_float(); }
-  bool has_crop_layer_id() const { return at<8>().valid(); }
-  uint32_t crop_layer_id() const { return at<8>().as_uint32(); }
-  bool has_replace_touchable_region_with_crop() const { return at<9>().valid(); }
-  bool replace_touchable_region_with_crop() const { return at<9>().as_bool(); }
-  bool has_touchable_region_crop() const { return at<10>().valid(); }
-  ::protozero::ConstBytes touchable_region_crop() const { return at<10>().as_bytes(); }
-  bool has_transform() const { return at<11>().valid(); }
-  ::protozero::ConstBytes transform() const { return at<11>().as_bytes(); }
-  bool has_input_config() const { return at<12>().valid(); }
-  uint32_t input_config() const { return at<12>().as_uint32(); }
-};
-
-class LayerState_WindowInfo : public ::protozero::Message {
- public:
-  using Decoder = LayerState_WindowInfo_Decoder;
-  enum : int32_t {
-    kLayoutParamsFlagsFieldNumber = 1,
-    kLayoutParamsTypeFieldNumber = 2,
-    kTouchableRegionFieldNumber = 3,
-    kSurfaceInsetFieldNumber = 4,
-    kFocusableFieldNumber = 5,
-    kHasWallpaperFieldNumber = 6,
-    kGlobalScaleFactorFieldNumber = 7,
-    kCropLayerIdFieldNumber = 8,
-    kReplaceTouchableRegionWithCropFieldNumber = 9,
-    kTouchableRegionCropFieldNumber = 10,
-    kTransformFieldNumber = 11,
-    kInputConfigFieldNumber = 12,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerState.WindowInfo"; }
-
-
-  using FieldMetadata_LayoutParamsFlags =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_LayoutParamsFlags kLayoutParamsFlags{};
-  void set_layout_params_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayoutParamsFlags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayoutParamsType =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_LayoutParamsType kLayoutParamsType{};
-  void set_layout_params_type(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayoutParamsType::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TouchableRegion =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RegionProto,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_TouchableRegion kTouchableRegion{};
-  template <typename T = RegionProto> T* set_touchable_region() {
-    return BeginNestedMessage<T>(3);
-  }
-
-
-  using FieldMetadata_SurfaceInset =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_SurfaceInset kSurfaceInset{};
-  void set_surface_inset(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SurfaceInset::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Focusable =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_Focusable kFocusable{};
-  void set_focusable(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_Focusable::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_HasWallpaper =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_HasWallpaper kHasWallpaper{};
-  void set_has_wallpaper(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_HasWallpaper::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_GlobalScaleFactor =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_GlobalScaleFactor kGlobalScaleFactor{};
-  void set_global_scale_factor(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_GlobalScaleFactor::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CropLayerId =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_CropLayerId kCropLayerId{};
-  void set_crop_layer_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CropLayerId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ReplaceTouchableRegionWithCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_ReplaceTouchableRegionWithCrop kReplaceTouchableRegionWithCrop{};
-  void set_replace_touchable_region_with_crop(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ReplaceTouchableRegionWithCrop::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TouchableRegionCrop =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      RectProto,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_TouchableRegionCrop kTouchableRegionCrop{};
-  template <typename T = RectProto> T* set_touchable_region_crop() {
-    return BeginNestedMessage<T>(10);
-  }
-
-
-  using FieldMetadata_Transform =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      Transform,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_Transform kTransform{};
-  template <typename T = Transform> T* set_transform() {
-    return BeginNestedMessage<T>(11);
-  }
-
-
-  using FieldMetadata_InputConfig =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState_WindowInfo>;
-
-  static constexpr FieldMetadata_InputConfig kInputConfig{};
-  void set_input_config(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_InputConfig::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayerState_BufferData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
- public:
-  LayerState_BufferData_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerState_BufferData_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerState_BufferData_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_buffer_id() const { return at<1>().valid(); }
-  uint64_t buffer_id() const { return at<1>().as_uint64(); }
-  bool has_width() const { return at<2>().valid(); }
-  uint32_t width() const { return at<2>().as_uint32(); }
-  bool has_height() const { return at<3>().valid(); }
-  uint32_t height() const { return at<3>().as_uint32(); }
-  bool has_frame_number() const { return at<4>().valid(); }
-  uint64_t frame_number() const { return at<4>().as_uint64(); }
-  bool has_flags() const { return at<5>().valid(); }
-  uint32_t flags() const { return at<5>().as_uint32(); }
-  bool has_cached_buffer_id() const { return at<6>().valid(); }
-  uint64_t cached_buffer_id() const { return at<6>().as_uint64(); }
-  bool has_pixel_format() const { return at<7>().valid(); }
-  int32_t pixel_format() const { return at<7>().as_int32(); }
-  bool has_usage() const { return at<8>().valid(); }
-  uint64_t usage() const { return at<8>().as_uint64(); }
-};
-
-class LayerState_BufferData : public ::protozero::Message {
- public:
-  using Decoder = LayerState_BufferData_Decoder;
-  enum : int32_t {
-    kBufferIdFieldNumber = 1,
-    kWidthFieldNumber = 2,
-    kHeightFieldNumber = 3,
-    kFrameNumberFieldNumber = 4,
-    kFlagsFieldNumber = 5,
-    kCachedBufferIdFieldNumber = 6,
-    kPixelFormatFieldNumber = 7,
-    kUsageFieldNumber = 8,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerState.BufferData"; }
-
-
-  using BufferDataChange = ::perfetto::protos::pbzero::LayerState_BufferData_BufferDataChange;
-  static inline const char* BufferDataChange_Name(BufferDataChange value) {
-    return ::perfetto::protos::pbzero::LayerState_BufferData_BufferDataChange_Name(value);
-  }
-
-  using PixelFormat = ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat;
-  static inline const char* PixelFormat_Name(PixelFormat value) {
-    return ::perfetto::protos::pbzero::LayerState_BufferData_PixelFormat_Name(value);
-  }
-  static inline const BufferDataChange BufferDataChangeNone = BufferDataChange::BufferDataChangeNone;
-  static inline const BufferDataChange fenceChanged = BufferDataChange::fenceChanged;
-  static inline const BufferDataChange frameNumberChanged = BufferDataChange::frameNumberChanged;
-  static inline const BufferDataChange cachedBufferChanged = BufferDataChange::cachedBufferChanged;
-  static inline const PixelFormat PIXEL_FORMAT_UNKNOWN = PixelFormat::PIXEL_FORMAT_UNKNOWN;
-  static inline const PixelFormat PIXEL_FORMAT_CUSTOM = PixelFormat::PIXEL_FORMAT_CUSTOM;
-  static inline const PixelFormat PIXEL_FORMAT_TRANSLUCENT = PixelFormat::PIXEL_FORMAT_TRANSLUCENT;
-  static inline const PixelFormat PIXEL_FORMAT_TRANSPARENT = PixelFormat::PIXEL_FORMAT_TRANSPARENT;
-  static inline const PixelFormat PIXEL_FORMAT_OPAQUE = PixelFormat::PIXEL_FORMAT_OPAQUE;
-  static inline const PixelFormat PIXEL_FORMAT_RGBA_8888 = PixelFormat::PIXEL_FORMAT_RGBA_8888;
-  static inline const PixelFormat PIXEL_FORMAT_RGBX_8888 = PixelFormat::PIXEL_FORMAT_RGBX_8888;
-  static inline const PixelFormat PIXEL_FORMAT_RGB_888 = PixelFormat::PIXEL_FORMAT_RGB_888;
-  static inline const PixelFormat PIXEL_FORMAT_RGB_565 = PixelFormat::PIXEL_FORMAT_RGB_565;
-  static inline const PixelFormat PIXEL_FORMAT_BGRA_8888 = PixelFormat::PIXEL_FORMAT_BGRA_8888;
-  static inline const PixelFormat PIXEL_FORMAT_RGBA_5551 = PixelFormat::PIXEL_FORMAT_RGBA_5551;
-  static inline const PixelFormat PIXEL_FORMAT_RGBA_4444 = PixelFormat::PIXEL_FORMAT_RGBA_4444;
-  static inline const PixelFormat PIXEL_FORMAT_RGBA_FP16 = PixelFormat::PIXEL_FORMAT_RGBA_FP16;
-  static inline const PixelFormat PIXEL_FORMAT_RGBA_1010102 = PixelFormat::PIXEL_FORMAT_RGBA_1010102;
-  static inline const PixelFormat PIXEL_FORMAT_R_8 = PixelFormat::PIXEL_FORMAT_R_8;
-
-  using FieldMetadata_BufferId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_BufferId kBufferId{};
-  void set_buffer_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_BufferId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Width =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_Width kWidth{};
-  void set_width(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Width::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Height =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_Height kHeight{};
-  void set_height(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Height::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FrameNumber =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_FrameNumber kFrameNumber{};
-  void set_frame_number(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FrameNumber::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CachedBufferId =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_CachedBufferId kCachedBufferId{};
-  void set_cached_buffer_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CachedBufferId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PixelFormat =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      LayerState_BufferData_PixelFormat,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_PixelFormat kPixelFormat{};
-  void set_pixel_format(LayerState_BufferData_PixelFormat value) {
-    static constexpr uint32_t field_id = FieldMetadata_PixelFormat::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
     ::protozero::internal::FieldWriter<
       ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
-
-  using FieldMetadata_Usage =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      LayerState_BufferData>;
-
-  static constexpr FieldMetadata_Usage kUsage{};
-  void set_usage(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Usage::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayerState_Color3_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
- public:
-  LayerState_Color3_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerState_Color3_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerState_Color3_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_r() const { return at<1>().valid(); }
-  float r() const { return at<1>().as_float(); }
-  bool has_g() const { return at<2>().valid(); }
-  float g() const { return at<2>().as_float(); }
-  bool has_b() const { return at<3>().valid(); }
-  float b() const { return at<3>().as_float(); }
-};
-
-class LayerState_Color3 : public ::protozero::Message {
- public:
-  using Decoder = LayerState_Color3_Decoder;
-  enum : int32_t {
-    kRFieldNumber = 1,
-    kGFieldNumber = 2,
-    kBFieldNumber = 3,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerState.Color3"; }
-
-
-  using FieldMetadata_R =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_Color3>;
-
-  static constexpr FieldMetadata_R kR{};
-  void set_r(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_R::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_G =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_Color3>;
-
-  static constexpr FieldMetadata_G kG{};
-  void set_g(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_G::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_B =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_Color3>;
-
-  static constexpr FieldMetadata_B kB{};
-  void set_b(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_B::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayerState_CornerRadii_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  LayerState_CornerRadii_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerState_CornerRadii_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerState_CornerRadii_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_tl() const { return at<1>().valid(); }
-  float tl() const { return at<1>().as_float(); }
-  bool has_tr() const { return at<2>().valid(); }
-  float tr() const { return at<2>().as_float(); }
-  bool has_bl() const { return at<3>().valid(); }
-  float bl() const { return at<3>().as_float(); }
-  bool has_br() const { return at<4>().valid(); }
-  float br() const { return at<4>().as_float(); }
-};
-
-class LayerState_CornerRadii : public ::protozero::Message {
- public:
-  using Decoder = LayerState_CornerRadii_Decoder;
-  enum : int32_t {
-    kTlFieldNumber = 1,
-    kTrFieldNumber = 2,
-    kBlFieldNumber = 3,
-    kBrFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerState.CornerRadii"; }
-
-
-  using FieldMetadata_Tl =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_CornerRadii>;
-
-  static constexpr FieldMetadata_Tl kTl{};
-  void set_tl(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tl::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Tr =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_CornerRadii>;
-
-  static constexpr FieldMetadata_Tr kTr{};
-  void set_tr(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tr::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Bl =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_CornerRadii>;
-
-  static constexpr FieldMetadata_Bl kBl{};
-  void set_bl(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Bl::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Br =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_CornerRadii>;
-
-  static constexpr FieldMetadata_Br kBr{};
-  void set_br(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Br::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayerState_Matrix22_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  LayerState_Matrix22_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerState_Matrix22_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerState_Matrix22_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_dsdx() const { return at<1>().valid(); }
-  float dsdx() const { return at<1>().as_float(); }
-  bool has_dtdx() const { return at<2>().valid(); }
-  float dtdx() const { return at<2>().as_float(); }
-  bool has_dtdy() const { return at<3>().valid(); }
-  float dtdy() const { return at<3>().as_float(); }
-  bool has_dsdy() const { return at<4>().valid(); }
-  float dsdy() const { return at<4>().as_float(); }
-};
-
-class LayerState_Matrix22 : public ::protozero::Message {
- public:
-  using Decoder = LayerState_Matrix22_Decoder;
-  enum : int32_t {
-    kDsdxFieldNumber = 1,
-    kDtdxFieldNumber = 2,
-    kDtdyFieldNumber = 3,
-    kDsdyFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerState.Matrix22"; }
-
-
-  using FieldMetadata_Dsdx =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_Matrix22>;
-
-  static constexpr FieldMetadata_Dsdx kDsdx{};
-  void set_dsdx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dsdx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dtdx =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_Matrix22>;
-
-  static constexpr FieldMetadata_Dtdx kDtdx{};
-  void set_dtdx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dtdx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dtdy =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_Matrix22>;
-
-  static constexpr FieldMetadata_Dtdy kDtdy{};
-  void set_dtdy(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dtdy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dsdy =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      LayerState_Matrix22>;
-
-  static constexpr FieldMetadata_Dsdy kDsdy{};
-  void set_dsdy(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dsdy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TransactionState_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/11> {
- public:
-  TransactionState_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TransactionState_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TransactionState_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_pid() const { return at<1>().valid(); }
-  int32_t pid() const { return at<1>().as_int32(); }
-  bool has_uid() const { return at<2>().valid(); }
-  int32_t uid() const { return at<2>().as_int32(); }
-  bool has_vsync_id() const { return at<3>().valid(); }
-  int64_t vsync_id() const { return at<3>().as_int64(); }
-  bool has_input_event_id() const { return at<4>().valid(); }
-  int32_t input_event_id() const { return at<4>().as_int32(); }
-  bool has_post_time() const { return at<5>().valid(); }
-  int64_t post_time() const { return at<5>().as_int64(); }
-  bool has_transaction_id() const { return at<6>().valid(); }
-  uint64_t transaction_id() const { return at<6>().as_uint64(); }
-  bool has_layer_changes() const { return at<7>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> layer_changes() const { return GetRepeated<::protozero::ConstBytes>(7); }
-  bool has_display_changes() const { return at<8>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> display_changes() const { return GetRepeated<::protozero::ConstBytes>(8); }
-  bool has_merged_transaction_ids() const { return at<9>().valid(); }
-  ::protozero::RepeatedFieldIterator<uint64_t> merged_transaction_ids() const { return GetRepeated<uint64_t>(9); }
-  bool has_apply_token() const { return at<10>().valid(); }
-  uint64_t apply_token() const { return at<10>().as_uint64(); }
-  bool has_transaction_barriers() const { return at<11>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> transaction_barriers() const { return GetRepeated<::protozero::ConstBytes>(11); }
-};
-
-class TransactionState : public ::protozero::Message {
- public:
-  using Decoder = TransactionState_Decoder;
-  enum : int32_t {
-    kPidFieldNumber = 1,
-    kUidFieldNumber = 2,
-    kVsyncIdFieldNumber = 3,
-    kInputEventIdFieldNumber = 4,
-    kPostTimeFieldNumber = 5,
-    kTransactionIdFieldNumber = 6,
-    kLayerChangesFieldNumber = 7,
-    kDisplayChangesFieldNumber = 8,
-    kMergedTransactionIdsFieldNumber = 9,
-    kApplyTokenFieldNumber = 10,
-    kTransactionBarriersFieldNumber = 11,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TransactionState"; }
-
-
-  using FieldMetadata_Pid =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_Pid kPid{};
-  void set_pid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Uid =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_Uid kUid{};
-  void set_uid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_VsyncId =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_VsyncId kVsyncId{};
-  void set_vsync_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_VsyncId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_InputEventId =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_InputEventId kInputEventId{};
-  void set_input_event_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_InputEventId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PostTime =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_PostTime kPostTime{};
-  void set_post_time(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PostTime::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TransactionId =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_TransactionId kTransactionId{};
-  void set_transaction_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TransactionId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayerChanges =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerState,
-      TransactionState>;
-
-  static constexpr FieldMetadata_LayerChanges kLayerChanges{};
-  template <typename T = LayerState> T* add_layer_changes() {
-    return BeginNestedMessage<T>(7);
-  }
-
-
-  using FieldMetadata_DisplayChanges =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      DisplayState,
-      TransactionState>;
-
-  static constexpr FieldMetadata_DisplayChanges kDisplayChanges{};
-  template <typename T = DisplayState> T* add_display_changes() {
-    return BeginNestedMessage<T>(8);
-  }
-
-
-  using FieldMetadata_MergedTransactionIds =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_MergedTransactionIds kMergedTransactionIds{};
-  void add_merged_transaction_ids(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MergedTransactionIds::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ApplyToken =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TransactionState>;
-
-  static constexpr FieldMetadata_ApplyToken kApplyToken{};
-  void set_apply_token(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ApplyToken::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TransactionBarriers =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransactionBarrier,
-      TransactionState>;
-
-  static constexpr FieldMetadata_TransactionBarriers kTransactionBarriers{};
-  template <typename T = TransactionBarrier> T* add_transaction_barriers() {
-    return BeginNestedMessage<T>(11);
-  }
-
-};
-
-class TransactionBarrier_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  TransactionBarrier_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TransactionBarrier_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TransactionBarrier_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_barrier_token() const { return at<1>().valid(); }
-  ::protozero::ConstChars barrier_token() const { return at<1>().as_string(); }
-  bool has_kind() const { return at<2>().valid(); }
-  uint32_t kind() const { return at<2>().as_uint32(); }
-};
-
-class TransactionBarrier : public ::protozero::Message {
- public:
-  using Decoder = TransactionBarrier_Decoder;
-  enum : int32_t {
-    kBarrierTokenFieldNumber = 1,
-    kKindFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TransactionBarrier"; }
-
-
-  using FieldMetadata_BarrierToken =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TransactionBarrier>;
-
-  static constexpr FieldMetadata_BarrierToken kBarrierToken{};
-  void set_barrier_token(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_BarrierToken::kFieldId, data, size);
-  }
-  void set_barrier_token(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_BarrierToken::kFieldId, chars.data, chars.size);
-  }
-  void set_barrier_token(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_BarrierToken::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Kind =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TransactionBarrier>;
-
-  static constexpr FieldMetadata_Kind kKind{};
-  void set_kind(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Kind::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class Transform_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
- public:
-  Transform_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit Transform_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit Transform_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_dsdx() const { return at<1>().valid(); }
-  float dsdx() const { return at<1>().as_float(); }
-  bool has_dtdx() const { return at<2>().valid(); }
-  float dtdx() const { return at<2>().as_float(); }
-  bool has_dtdy() const { return at<3>().valid(); }
-  float dtdy() const { return at<3>().as_float(); }
-  bool has_dsdy() const { return at<4>().valid(); }
-  float dsdy() const { return at<4>().as_float(); }
-  bool has_tx() const { return at<5>().valid(); }
-  float tx() const { return at<5>().as_float(); }
-  bool has_ty() const { return at<6>().valid(); }
-  float ty() const { return at<6>().as_float(); }
-};
-
-class Transform : public ::protozero::Message {
- public:
-  using Decoder = Transform_Decoder;
-  enum : int32_t {
-    kDsdxFieldNumber = 1,
-    kDtdxFieldNumber = 2,
-    kDtdyFieldNumber = 3,
-    kDsdyFieldNumber = 4,
-    kTxFieldNumber = 5,
-    kTyFieldNumber = 6,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.Transform"; }
-
-
-  using FieldMetadata_Dsdx =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      Transform>;
-
-  static constexpr FieldMetadata_Dsdx kDsdx{};
-  void set_dsdx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dsdx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dtdx =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      Transform>;
-
-  static constexpr FieldMetadata_Dtdx kDtdx{};
-  void set_dtdx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dtdx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dtdy =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      Transform>;
-
-  static constexpr FieldMetadata_Dtdy kDtdy{};
-  void set_dtdy(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dtdy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Dsdy =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      Transform>;
-
-  static constexpr FieldMetadata_Dsdy kDsdy{};
-  void set_dsdy(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Dsdy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Tx =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      Transform>;
-
-  static constexpr FieldMetadata_Tx kTx{};
-  void set_tx(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tx::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Ty =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      Transform>;
-
-  static constexpr FieldMetadata_Ty kTy{};
-  void set_ty(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Ty::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class LayerCreationArgs_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
- public:
-  LayerCreationArgs_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit LayerCreationArgs_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit LayerCreationArgs_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_layer_id() const { return at<1>().valid(); }
-  uint32_t layer_id() const { return at<1>().as_uint32(); }
-  bool has_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars name() const { return at<2>().as_string(); }
-  bool has_flags() const { return at<3>().valid(); }
-  uint32_t flags() const { return at<3>().as_uint32(); }
-  bool has_parent_id() const { return at<4>().valid(); }
-  uint32_t parent_id() const { return at<4>().as_uint32(); }
-  bool has_mirror_from_id() const { return at<5>().valid(); }
-  uint32_t mirror_from_id() const { return at<5>().as_uint32(); }
-  bool has_add_to_root() const { return at<6>().valid(); }
-  bool add_to_root() const { return at<6>().as_bool(); }
-  bool has_layer_stack_to_mirror() const { return at<7>().valid(); }
-  uint32_t layer_stack_to_mirror() const { return at<7>().as_uint32(); }
-};
-
-class LayerCreationArgs : public ::protozero::Message {
- public:
-  using Decoder = LayerCreationArgs_Decoder;
-  enum : int32_t {
-    kLayerIdFieldNumber = 1,
-    kNameFieldNumber = 2,
-    kFlagsFieldNumber = 3,
-    kParentIdFieldNumber = 4,
-    kMirrorFromIdFieldNumber = 5,
-    kAddToRootFieldNumber = 6,
-    kLayerStackToMirrorFieldNumber = 7,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.LayerCreationArgs"; }
-
-
-  using FieldMetadata_LayerId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerCreationArgs>;
-
-  static constexpr FieldMetadata_LayerId kLayerId{};
-  void set_layer_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      LayerCreationArgs>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerCreationArgs>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ParentId =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerCreationArgs>;
-
-  static constexpr FieldMetadata_ParentId kParentId{};
-  void set_parent_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ParentId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_MirrorFromId =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerCreationArgs>;
-
-  static constexpr FieldMetadata_MirrorFromId kMirrorFromId{};
-  void set_mirror_from_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MirrorFromId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_AddToRoot =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      LayerCreationArgs>;
-
-  static constexpr FieldMetadata_AddToRoot kAddToRoot{};
-  void set_add_to_root(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_AddToRoot::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LayerStackToMirror =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      LayerCreationArgs>;
-
-  static constexpr FieldMetadata_LayerStackToMirror kLayerStackToMirror{};
-  void set_layer_stack_to_mirror(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerStackToMirror::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class DisplayInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/12> {
- public:
-  DisplayInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit DisplayInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit DisplayInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_layer_stack() const { return at<1>().valid(); }
-  uint32_t layer_stack() const { return at<1>().as_uint32(); }
-  bool has_display_id() const { return at<2>().valid(); }
-  int32_t display_id() const { return at<2>().as_int32(); }
-  bool has_logical_width() const { return at<3>().valid(); }
-  int32_t logical_width() const { return at<3>().as_int32(); }
-  bool has_logical_height() const { return at<4>().valid(); }
-  int32_t logical_height() const { return at<4>().as_int32(); }
-  bool has_transform_inverse() const { return at<5>().valid(); }
-  ::protozero::ConstBytes transform_inverse() const { return at<5>().as_bytes(); }
-  bool has_transform() const { return at<6>().valid(); }
-  ::protozero::ConstBytes transform() const { return at<6>().as_bytes(); }
-  bool has_receives_input() const { return at<7>().valid(); }
-  bool receives_input() const { return at<7>().as_bool(); }
-  bool has_is_secure() const { return at<8>().valid(); }
-  bool is_secure() const { return at<8>().as_bool(); }
-  bool has_is_primary() const { return at<9>().valid(); }
-  bool is_primary() const { return at<9>().as_bool(); }
-  bool has_is_virtual() const { return at<10>().valid(); }
-  bool is_virtual() const { return at<10>().as_bool(); }
-  bool has_rotation_flags() const { return at<11>().valid(); }
-  int32_t rotation_flags() const { return at<11>().as_int32(); }
-  bool has_transform_hint() const { return at<12>().valid(); }
-  int32_t transform_hint() const { return at<12>().as_int32(); }
-};
-
-class DisplayInfo : public ::protozero::Message {
- public:
-  using Decoder = DisplayInfo_Decoder;
-  enum : int32_t {
-    kLayerStackFieldNumber = 1,
-    kDisplayIdFieldNumber = 2,
-    kLogicalWidthFieldNumber = 3,
-    kLogicalHeightFieldNumber = 4,
-    kTransformInverseFieldNumber = 5,
-    kTransformFieldNumber = 6,
-    kReceivesInputFieldNumber = 7,
-    kIsSecureFieldNumber = 8,
-    kIsPrimaryFieldNumber = 9,
-    kIsVirtualFieldNumber = 10,
-    kRotationFlagsFieldNumber = 11,
-    kTransformHintFieldNumber = 12,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.DisplayInfo"; }
-
-
-  using FieldMetadata_LayerStack =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_LayerStack kLayerStack{};
-  void set_layer_stack(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerStack::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DisplayId =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_DisplayId kDisplayId{};
-  void set_display_id(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisplayId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LogicalWidth =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_LogicalWidth kLogicalWidth{};
-  void set_logical_width(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LogicalWidth::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LogicalHeight =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_LogicalHeight kLogicalHeight{};
-  void set_logical_height(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LogicalHeight::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TransformInverse =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      Transform,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_TransformInverse kTransformInverse{};
-  template <typename T = Transform> T* set_transform_inverse() {
-    return BeginNestedMessage<T>(5);
-  }
-
-
-  using FieldMetadata_Transform =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      Transform,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_Transform kTransform{};
-  template <typename T = Transform> T* set_transform() {
-    return BeginNestedMessage<T>(6);
-  }
-
-
-  using FieldMetadata_ReceivesInput =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_ReceivesInput kReceivesInput{};
-  void set_receives_input(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ReceivesInput::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IsSecure =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_IsSecure kIsSecure{};
-  void set_is_secure(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsSecure::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IsPrimary =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_IsPrimary kIsPrimary{};
-  void set_is_primary(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsPrimary::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IsVirtual =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_IsVirtual kIsVirtual{};
-  void set_is_virtual(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsVirtual::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_RotationFlags =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_RotationFlags kRotationFlags{};
-  void set_rotation_flags(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RotationFlags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TransformHint =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      DisplayInfo>;
-
-  static constexpr FieldMetadata_TransformHint kTransformHint{};
-  void set_transform_hint(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TransformHint::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TransactionTraceEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
- public:
-  TransactionTraceEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TransactionTraceEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TransactionTraceEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_elapsed_realtime_nanos() const { return at<1>().valid(); }
-  int64_t elapsed_realtime_nanos() const { return at<1>().as_int64(); }
-  bool has_vsync_id() const { return at<2>().valid(); }
-  int64_t vsync_id() const { return at<2>().as_int64(); }
-  bool has_transactions() const { return at<3>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> transactions() const { return GetRepeated<::protozero::ConstBytes>(3); }
-  bool has_added_layers() const { return at<4>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> added_layers() const { return GetRepeated<::protozero::ConstBytes>(4); }
-  bool has_destroyed_layers() const { return at<5>().valid(); }
-  ::protozero::RepeatedFieldIterator<uint32_t> destroyed_layers() const { return GetRepeated<uint32_t>(5); }
-  bool has_added_displays() const { return at<6>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> added_displays() const { return GetRepeated<::protozero::ConstBytes>(6); }
-  bool has_removed_displays() const { return at<7>().valid(); }
-  ::protozero::RepeatedFieldIterator<int32_t> removed_displays() const { return GetRepeated<int32_t>(7); }
-  bool has_destroyed_layer_handles() const { return at<8>().valid(); }
-  ::protozero::RepeatedFieldIterator<uint32_t> destroyed_layer_handles() const { return GetRepeated<uint32_t>(8); }
-  bool has_displays_changed() const { return at<9>().valid(); }
-  bool displays_changed() const { return at<9>().as_bool(); }
-  bool has_displays() const { return at<10>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> displays() const { return GetRepeated<::protozero::ConstBytes>(10); }
-};
-
-class TransactionTraceEntry : public ::protozero::Message {
- public:
-  using Decoder = TransactionTraceEntry_Decoder;
-  enum : int32_t {
-    kElapsedRealtimeNanosFieldNumber = 1,
-    kVsyncIdFieldNumber = 2,
-    kTransactionsFieldNumber = 3,
-    kAddedLayersFieldNumber = 4,
-    kDestroyedLayersFieldNumber = 5,
-    kAddedDisplaysFieldNumber = 6,
-    kRemovedDisplaysFieldNumber = 7,
-    kDestroyedLayerHandlesFieldNumber = 8,
-    kDisplaysChangedFieldNumber = 9,
-    kDisplaysFieldNumber = 10,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TransactionTraceEntry"; }
-
-
-  using FieldMetadata_ElapsedRealtimeNanos =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_ElapsedRealtimeNanos kElapsedRealtimeNanos{};
-  void set_elapsed_realtime_nanos(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ElapsedRealtimeNanos::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_VsyncId =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_VsyncId kVsyncId{};
-  void set_vsync_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_VsyncId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Transactions =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransactionState,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_Transactions kTransactions{};
-  template <typename T = TransactionState> T* add_transactions() {
-    return BeginNestedMessage<T>(3);
-  }
-
-
-  using FieldMetadata_AddedLayers =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LayerCreationArgs,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_AddedLayers kAddedLayers{};
-  template <typename T = LayerCreationArgs> T* add_added_layers() {
-    return BeginNestedMessage<T>(4);
-  }
-
-
-  using FieldMetadata_DestroyedLayers =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_DestroyedLayers kDestroyedLayers{};
-  void add_destroyed_layers(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DestroyedLayers::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_AddedDisplays =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      DisplayState,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_AddedDisplays kAddedDisplays{};
-  template <typename T = DisplayState> T* add_added_displays() {
-    return BeginNestedMessage<T>(6);
-  }
-
-
-  using FieldMetadata_RemovedDisplays =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_RemovedDisplays kRemovedDisplays{};
-  void add_removed_displays(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RemovedDisplays::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DestroyedLayerHandles =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_DestroyedLayerHandles kDestroyedLayerHandles{};
-  void add_destroyed_layer_handles(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DestroyedLayerHandles::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DisplaysChanged =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_DisplaysChanged kDisplaysChanged{};
-  void set_displays_changed(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisplaysChanged::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Displays =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      DisplayInfo,
-      TransactionTraceEntry>;
-
-  static constexpr FieldMetadata_Displays kDisplays{};
-  template <typename T = DisplayInfo> T* add_displays() {
-    return BeginNestedMessage<T>(10);
-  }
-
-};
-
-class TransactionTraceFile_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  TransactionTraceFile_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TransactionTraceFile_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TransactionTraceFile_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_magic_number() const { return at<1>().valid(); }
-  uint64_t magic_number() const { return at<1>().as_uint64(); }
-  bool has_entry() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> entry() const { return GetRepeated<::protozero::ConstBytes>(2); }
-  bool has_real_to_elapsed_time_offset_nanos() const { return at<3>().valid(); }
-  uint64_t real_to_elapsed_time_offset_nanos() const { return at<3>().as_uint64(); }
-  bool has_version() const { return at<4>().valid(); }
-  uint32_t version() const { return at<4>().as_uint32(); }
-};
-
-class TransactionTraceFile : public ::protozero::Message {
- public:
-  using Decoder = TransactionTraceFile_Decoder;
-  enum : int32_t {
-    kMagicNumberFieldNumber = 1,
-    kEntryFieldNumber = 2,
-    kRealToElapsedTimeOffsetNanosFieldNumber = 3,
-    kVersionFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TransactionTraceFile"; }
-
-
-  using MagicNumber = ::perfetto::protos::pbzero::TransactionTraceFile_MagicNumber;
-  static inline const char* MagicNumber_Name(MagicNumber value) {
-    return ::perfetto::protos::pbzero::TransactionTraceFile_MagicNumber_Name(value);
-  }
-  static inline const MagicNumber INVALID = MagicNumber::INVALID;
-  static inline const MagicNumber MAGIC_NUMBER_L = MagicNumber::MAGIC_NUMBER_L;
-  static inline const MagicNumber MAGIC_NUMBER_H = MagicNumber::MAGIC_NUMBER_H;
-
-  using FieldMetadata_MagicNumber =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64,
-      uint64_t,
-      TransactionTraceFile>;
-
-  static constexpr FieldMetadata_MagicNumber kMagicNumber{};
-  void set_magic_number(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MagicNumber::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Entry =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TransactionTraceEntry,
-      TransactionTraceFile>;
-
-  static constexpr FieldMetadata_Entry kEntry{};
-  template <typename T = TransactionTraceEntry> T* add_entry() {
-    return BeginNestedMessage<T>(2);
-  }
-
-
-  using FieldMetadata_RealToElapsedTimeOffsetNanos =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64,
-      uint64_t,
-      TransactionTraceFile>;
-
-  static constexpr FieldMetadata_RealToElapsedTimeOffsetNanos kRealToElapsedTimeOffsetNanos{};
-  void set_real_to_elapsed_time_offset_nanos(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RealToElapsedTimeOffsetNanos::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFixed64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Version =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TransactionTraceFile>;
-
-  static constexpr FieldMetadata_Version kVersion{};
-  void set_version(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Version::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
 };
 
 } // Namespace.
@@ -75357,533 +70494,6 @@ class AndroidSystemProperty_PropertyValue : public ::protozero::Message {
   }
 };
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/app_wakelock_data.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_APP_WAKELOCK_DATA_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_APP_WAKELOCK_DATA_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class AppWakelockInfo;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class AppWakelockBundle_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  AppWakelockBundle_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AppWakelockBundle_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AppWakelockBundle_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_intern_id() const { return at<1>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t> intern_id(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t>(1, parse_error_ptr); }
-  bool has_encoded_ts() const { return at<2>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> encoded_ts(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(2, parse_error_ptr); }
-  bool has_info() const { return at<3>().valid(); }
-  ::protozero::ConstBytes info() const { return at<3>().as_bytes(); }
-  bool has_acquired() const { return at<4>().valid(); }
-  bool acquired() const { return at<4>().as_bool(); }
-};
-
-class AppWakelockBundle : public ::protozero::Message {
- public:
-  using Decoder = AppWakelockBundle_Decoder;
-  enum : int32_t {
-    kInternIdFieldNumber = 1,
-    kEncodedTsFieldNumber = 2,
-    kInfoFieldNumber = 3,
-    kAcquiredFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AppWakelockBundle"; }
-
-
-  using FieldMetadata_InternId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      AppWakelockBundle>;
-
-  static constexpr FieldMetadata_InternId kInternId{};
-  void set_intern_id(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_InternId::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-
-  using FieldMetadata_EncodedTs =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AppWakelockBundle>;
-
-  static constexpr FieldMetadata_EncodedTs kEncodedTs{};
-  void set_encoded_ts(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_EncodedTs::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-
-  using FieldMetadata_Info =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AppWakelockInfo,
-      AppWakelockBundle>;
-
-  static constexpr FieldMetadata_Info kInfo{};
-  template <typename T = AppWakelockInfo> T* set_info() {
-    return BeginNestedMessage<T>(3);
-  }
-
-
-  using FieldMetadata_Acquired =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      AppWakelockBundle>;
-
-  static constexpr FieldMetadata_Acquired kAcquired{};
-  void set_acquired(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_Acquired::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class AppWakelockInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
- public:
-  AppWakelockInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AppWakelockInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AppWakelockInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_iid() const { return at<1>().valid(); }
-  int32_t iid() const { return at<1>().as_int32(); }
-  bool has_tag() const { return at<2>().valid(); }
-  ::protozero::ConstChars tag() const { return at<2>().as_string(); }
-  bool has_flags() const { return at<3>().valid(); }
-  int32_t flags() const { return at<3>().as_int32(); }
-  bool has_owner_pid() const { return at<4>().valid(); }
-  int32_t owner_pid() const { return at<4>().as_int32(); }
-  bool has_owner_uid() const { return at<5>().valid(); }
-  int32_t owner_uid() const { return at<5>().as_int32(); }
-  bool has_work_uid() const { return at<6>().valid(); }
-  int32_t work_uid() const { return at<6>().as_int32(); }
-};
-
-class AppWakelockInfo : public ::protozero::Message {
- public:
-  using Decoder = AppWakelockInfo_Decoder;
-  enum : int32_t {
-    kIidFieldNumber = 1,
-    kTagFieldNumber = 2,
-    kFlagsFieldNumber = 3,
-    kOwnerPidFieldNumber = 4,
-    kOwnerUidFieldNumber = 5,
-    kWorkUidFieldNumber = 6,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AppWakelockInfo"; }
-
-
-  using FieldMetadata_Iid =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AppWakelockInfo>;
-
-  static constexpr FieldMetadata_Iid kIid{};
-  void set_iid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Tag =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AppWakelockInfo>;
-
-  static constexpr FieldMetadata_Tag kTag{};
-  void set_tag(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Tag::kFieldId, data, size);
-  }
-  void set_tag(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Tag::kFieldId, chars.data, chars.size);
-  }
-  void set_tag(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tag::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AppWakelockInfo>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  void set_flags(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_OwnerPid =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AppWakelockInfo>;
-
-  static constexpr FieldMetadata_OwnerPid kOwnerPid{};
-  void set_owner_pid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OwnerPid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_OwnerUid =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AppWakelockInfo>;
-
-  static constexpr FieldMetadata_OwnerUid kOwnerUid{};
-  void set_owner_uid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OwnerUid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_WorkUid =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AppWakelockInfo>;
-
-  static constexpr FieldMetadata_WorkUid kWorkUid{};
-  void set_work_uid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_WorkUid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/bluetooth_trace.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_BLUETOOTH_TRACE_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_BLUETOOTH_TRACE_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-enum BluetoothTracePacketType : int32_t;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-enum BluetoothTracePacketType : int32_t {
-  HCI_CMD = 1,
-  HCI_EVT = 2,
-  HCI_ACL_RX = 3,
-  HCI_ACL_TX = 4,
-  HCI_SCO_RX = 5,
-  HCI_SCO_TX = 6,
-  HCI_ISO_RX = 7,
-  HCI_ISO_TX = 8,
-};
-
-constexpr BluetoothTracePacketType BluetoothTracePacketType_MIN = BluetoothTracePacketType::HCI_CMD;
-constexpr BluetoothTracePacketType BluetoothTracePacketType_MAX = BluetoothTracePacketType::HCI_ISO_TX;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* BluetoothTracePacketType_Name(::perfetto::protos::pbzero::BluetoothTracePacketType value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_CMD:
-    return "HCI_CMD";
-
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_EVT:
-    return "HCI_EVT";
-
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_ACL_RX:
-    return "HCI_ACL_RX";
-
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_ACL_TX:
-    return "HCI_ACL_TX";
-
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_SCO_RX:
-    return "HCI_SCO_RX";
-
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_SCO_TX:
-    return "HCI_SCO_TX";
-
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_ISO_RX:
-    return "HCI_ISO_RX";
-
-  case ::perfetto::protos::pbzero::BluetoothTracePacketType::HCI_ISO_TX:
-    return "HCI_ISO_TX";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class BluetoothTraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
- public:
-  BluetoothTraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit BluetoothTraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit BluetoothTraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_packet_type() const { return at<1>().valid(); }
-  int32_t packet_type() const { return at<1>().as_int32(); }
-  bool has_count() const { return at<2>().valid(); }
-  uint32_t count() const { return at<2>().as_uint32(); }
-  bool has_length() const { return at<3>().valid(); }
-  uint32_t length() const { return at<3>().as_uint32(); }
-  bool has_duration() const { return at<4>().valid(); }
-  uint32_t duration() const { return at<4>().as_uint32(); }
-  bool has_op_code() const { return at<5>().valid(); }
-  uint32_t op_code() const { return at<5>().as_uint32(); }
-  bool has_event_code() const { return at<6>().valid(); }
-  uint32_t event_code() const { return at<6>().as_uint32(); }
-  bool has_subevent_code() const { return at<7>().valid(); }
-  uint32_t subevent_code() const { return at<7>().as_uint32(); }
-  bool has_connection_handle() const { return at<8>().valid(); }
-  uint32_t connection_handle() const { return at<8>().as_uint32(); }
-};
-
-class BluetoothTraceEvent : public ::protozero::Message {
- public:
-  using Decoder = BluetoothTraceEvent_Decoder;
-  enum : int32_t {
-    kPacketTypeFieldNumber = 1,
-    kCountFieldNumber = 2,
-    kLengthFieldNumber = 3,
-    kDurationFieldNumber = 4,
-    kOpCodeFieldNumber = 5,
-    kEventCodeFieldNumber = 6,
-    kSubeventCodeFieldNumber = 7,
-    kConnectionHandleFieldNumber = 8,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.BluetoothTraceEvent"; }
-
-
-  using FieldMetadata_PacketType =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      BluetoothTracePacketType,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_PacketType kPacketType{};
-  void set_packet_type(BluetoothTracePacketType value) {
-    static constexpr uint32_t field_id = FieldMetadata_PacketType::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Count =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_Count kCount{};
-  void set_count(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Count::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Length =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_Length kLength{};
-  void set_length(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Length::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Duration =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_Duration kDuration{};
-  void set_duration(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Duration::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_OpCode =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_OpCode kOpCode{};
-  void set_op_code(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OpCode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_EventCode =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_EventCode kEventCode{};
-  void set_event_code(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_EventCode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SubeventCode =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_SubeventCode kSubeventCode{};
-  void set_subevent_code(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SubeventCode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ConnectionHandle =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      BluetoothTraceEvent>;
-
-  static constexpr FieldMetadata_ConnectionHandle kConnectionHandle{};
-  void set_connection_handle(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ConnectionHandle::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -76933,6 +71543,10 @@ class FrameTimelineEvent_ActualSurfaceFrameStart;
 class FrameTimelineEvent_ExpectedDisplayFrameStart;
 class FrameTimelineEvent_ExpectedSurfaceFrameStart;
 class FrameTimelineEvent_FrameEnd;
+namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart {
+enum LatchedFenceState : int32_t;
+}  // namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart
+using FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState = perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart::LatchedFenceState;
 namespace perfetto_pbzero_enum_FrameTimelineEvent {
 enum JankSeverityType : int32_t;
 }  // namespace perfetto_pbzero_enum_FrameTimelineEvent
@@ -77145,6 +71759,39 @@ const char* FrameTimelineEvent_PredictionType_Name(::perfetto::protos::pbzero::F
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
+namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart {
+enum LatchedFenceState : int32_t {
+  LATCHED_UNKNOWN = 0,
+  LATCHED_SIGNALED = 1,
+  LATCHED_UNSIGNALED = 2,
+  LATCHED_DELAYED_LATCH_UNSIGNALED = 3,
+};
+} // namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart
+using FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState = perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart::LatchedFenceState;
+
+
+constexpr FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_MIN = FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_UNKNOWN;
+constexpr FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_MAX = FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_DELAYED_LATCH_UNSIGNALED;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_Name(::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_UNKNOWN:
+    return "LATCHED_UNKNOWN";
+
+  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_SIGNALED:
+    return "LATCHED_SIGNALED";
+
+  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_UNSIGNALED:
+    return "LATCHED_UNSIGNALED";
+
+  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_DELAYED_LATCH_UNSIGNALED:
+    return "LATCHED_DELAYED_LATCH_UNSIGNALED";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
 class FrameTimelineEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
  public:
   FrameTimelineEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -77339,7 +71986,7 @@ class FrameTimelineEvent_FrameEnd : public ::protozero::Message {
   }
 };
 
-class FrameTimelineEvent_ActualDisplayFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/14> {
+class FrameTimelineEvent_ActualDisplayFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/16> {
  public:
   FrameTimelineEvent_ActualDisplayFrameStart_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit FrameTimelineEvent_ActualDisplayFrameStart_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -77372,6 +72019,10 @@ class FrameTimelineEvent_ActualDisplayFrameStart_Decoder : public ::protozero::T
   int32_t present_type_experimental() const { return at<13>().as_int32(); }
   bool has_jank_debug_metadata() const { return at<14>().valid(); }
   float jank_debug_metadata() const { return at<14>().as_float(); }
+  bool has_latched_unsignaled_count() const { return at<15>().valid(); }
+  int64_t latched_unsignaled_count() const { return at<15>().as_int64(); }
+  bool has_addressable_unsignaled_latch_count() const { return at<16>().valid(); }
+  int64_t addressable_unsignaled_latch_count() const { return at<16>().as_int64(); }
 };
 
 class FrameTimelineEvent_ActualDisplayFrameStart : public ::protozero::Message {
@@ -77392,6 +72043,8 @@ class FrameTimelineEvent_ActualDisplayFrameStart : public ::protozero::Message {
     kJankTypeExperimentalFieldNumber = 12,
     kPresentTypeExperimentalFieldNumber = 13,
     kJankDebugMetadataFieldNumber = 14,
+    kLatchedUnsignaledCountFieldNumber = 15,
+    kAddressableUnsignaledLatchCountFieldNumber = 16,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent.ActualDisplayFrameStart"; }
 
@@ -77647,6 +72300,42 @@ class FrameTimelineEvent_ActualDisplayFrameStart : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kFloat>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_LatchedUnsignaledCount =
+    ::protozero::proto_utils::FieldMetadata<
+      15,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      FrameTimelineEvent_ActualDisplayFrameStart>;
+
+  static constexpr FieldMetadata_LatchedUnsignaledCount kLatchedUnsignaledCount{};
+  void set_latched_unsignaled_count(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_LatchedUnsignaledCount::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_AddressableUnsignaledLatchCount =
+    ::protozero::proto_utils::FieldMetadata<
+      16,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      FrameTimelineEvent_ActualDisplayFrameStart>;
+
+  static constexpr FieldMetadata_AddressableUnsignaledLatchCount kAddressableUnsignaledLatchCount{};
+  void set_addressable_unsignaled_latch_count(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_AddressableUnsignaledLatchCount::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class FrameTimelineEvent_ExpectedDisplayFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
@@ -77728,7 +72417,7 @@ class FrameTimelineEvent_ExpectedDisplayFrameStart : public ::protozero::Message
   }
 };
 
-class FrameTimelineEvent_ActualSurfaceFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/18> {
+class FrameTimelineEvent_ActualSurfaceFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/20> {
  public:
   FrameTimelineEvent_ActualSurfaceFrameStart_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit FrameTimelineEvent_ActualSurfaceFrameStart_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -77769,6 +72458,10 @@ class FrameTimelineEvent_ActualSurfaceFrameStart_Decoder : public ::protozero::T
   int32_t present_type_experimental() const { return at<17>().as_int32(); }
   bool has_jank_debug_metadata() const { return at<18>().valid(); }
   float jank_debug_metadata() const { return at<18>().as_float(); }
+  bool has_latched_fence_state() const { return at<19>().valid(); }
+  int32_t latched_fence_state() const { return at<19>().as_int32(); }
+  bool has_animation_time_millis() const { return at<20>().valid(); }
+  float animation_time_millis() const { return at<20>().as_float(); }
 };
 
 class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
@@ -77793,10 +72486,21 @@ class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
     kJankTypeExperimentalFieldNumber = 16,
     kPresentTypeExperimentalFieldNumber = 17,
     kJankDebugMetadataFieldNumber = 18,
+    kLatchedFenceStateFieldNumber = 19,
+    kAnimationTimeMillisFieldNumber = 20,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent.ActualSurfaceFrameStart"; }
 
 
+  using LatchedFenceState = ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState;
+  static inline const char* LatchedFenceState_Name(LatchedFenceState value) {
+    return ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_Name(value);
+  }
+  static inline const LatchedFenceState LATCHED_UNKNOWN = LatchedFenceState::LATCHED_UNKNOWN;
+  static inline const LatchedFenceState LATCHED_SIGNALED = LatchedFenceState::LATCHED_SIGNALED;
+  static inline const LatchedFenceState LATCHED_UNSIGNALED = LatchedFenceState::LATCHED_UNSIGNALED;
+  static inline const LatchedFenceState LATCHED_DELAYED_LATCH_UNSIGNALED = LatchedFenceState::LATCHED_DELAYED_LATCH_UNSIGNALED;
+
   using FieldMetadata_Cookie =
     ::protozero::proto_utils::FieldMetadata<
       1,
@@ -78126,6 +72830,42 @@ class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kFloat>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_LatchedFenceState =
+    ::protozero::proto_utils::FieldMetadata<
+      19,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState,
+      FrameTimelineEvent_ActualSurfaceFrameStart>;
+
+  static constexpr FieldMetadata_LatchedFenceState kLatchedFenceState{};
+  void set_latched_fence_state(FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState value) {
+    static constexpr uint32_t field_id = FieldMetadata_LatchedFenceState::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_AnimationTimeMillis =
+    ::protozero::proto_utils::FieldMetadata<
+      20,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kFloat,
+      float,
+      FrameTimelineEvent_ActualSurfaceFrameStart>;
+
+  static constexpr FieldMetadata_AnimationTimeMillis kAnimationTimeMillis{};
+  void set_animation_time_millis(float value) {
+    static constexpr uint32_t field_id = FieldMetadata_AnimationTimeMillis::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class FrameTimelineEvent_ExpectedSurfaceFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
@@ -78255,109 +72995,6 @@ class FrameTimelineEvent_ExpectedSurfaceFrameStart : public ::protozero::Message
   }
 };
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/gpu_mem_event.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GPU_MEM_EVENT_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_GPU_MEM_EVENT_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class GpuMemTotalEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
- public:
-  GpuMemTotalEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit GpuMemTotalEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit GpuMemTotalEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_gpu_id() const { return at<1>().valid(); }
-  uint32_t gpu_id() const { return at<1>().as_uint32(); }
-  bool has_pid() const { return at<2>().valid(); }
-  uint32_t pid() const { return at<2>().as_uint32(); }
-  bool has_size() const { return at<3>().valid(); }
-  uint64_t size() const { return at<3>().as_uint64(); }
-};
-
-class GpuMemTotalEvent : public ::protozero::Message {
- public:
-  using Decoder = GpuMemTotalEvent_Decoder;
-  enum : int32_t {
-    kGpuIdFieldNumber = 1,
-    kPidFieldNumber = 2,
-    kSizeFieldNumber = 3,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.GpuMemTotalEvent"; }
-
-
-  using FieldMetadata_GpuId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      GpuMemTotalEvent>;
-
-  static constexpr FieldMetadata_GpuId kGpuId{};
-  void set_gpu_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_GpuId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Pid =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      GpuMemTotalEvent>;
-
-  static constexpr FieldMetadata_Pid kPid{};
-  void set_pid(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Size =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      GpuMemTotalEvent>;
-
-  static constexpr FieldMetadata_Size kSize{};
-  void set_size(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Size::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-};
-
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -78974,521 +73611,6 @@ class KernelWakelockData_Wakelock : public ::protozero::Message {
   }
 };
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/network_trace.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_NETWORK_TRACE_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_NETWORK_TRACE_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class NetworkPacketEvent;
-enum TrafficDirection : int32_t;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-enum TrafficDirection : int32_t {
-  DIR_UNSPECIFIED = 0,
-  DIR_INGRESS = 1,
-  DIR_EGRESS = 2,
-};
-
-constexpr TrafficDirection TrafficDirection_MIN = TrafficDirection::DIR_UNSPECIFIED;
-constexpr TrafficDirection TrafficDirection_MAX = TrafficDirection::DIR_EGRESS;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* TrafficDirection_Name(::perfetto::protos::pbzero::TrafficDirection value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::TrafficDirection::DIR_UNSPECIFIED:
-    return "DIR_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::TrafficDirection::DIR_INGRESS:
-    return "DIR_INGRESS";
-
-  case ::perfetto::protos::pbzero::TrafficDirection::DIR_EGRESS:
-    return "DIR_EGRESS";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class NetworkPacketContext_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  NetworkPacketContext_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit NetworkPacketContext_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit NetworkPacketContext_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_iid() const { return at<1>().valid(); }
-  uint64_t iid() const { return at<1>().as_uint64(); }
-  bool has_ctx() const { return at<2>().valid(); }
-  ::protozero::ConstBytes ctx() const { return at<2>().as_bytes(); }
-};
-
-class NetworkPacketContext : public ::protozero::Message {
- public:
-  using Decoder = NetworkPacketContext_Decoder;
-  enum : int32_t {
-    kIidFieldNumber = 1,
-    kCtxFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.NetworkPacketContext"; }
-
-
-  using FieldMetadata_Iid =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      NetworkPacketContext>;
-
-  static constexpr FieldMetadata_Iid kIid{};
-  void set_iid(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Ctx =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      NetworkPacketEvent,
-      NetworkPacketContext>;
-
-  static constexpr FieldMetadata_Ctx kCtx{};
-  template <typename T = NetworkPacketEvent> T* set_ctx() {
-    return BeginNestedMessage<T>(2);
-  }
-
-};
-
-class NetworkPacketBundle_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
- public:
-  NetworkPacketBundle_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit NetworkPacketBundle_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit NetworkPacketBundle_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_iid() const { return at<1>().valid(); }
-  uint64_t iid() const { return at<1>().as_uint64(); }
-  bool has_ctx() const { return at<2>().valid(); }
-  ::protozero::ConstBytes ctx() const { return at<2>().as_bytes(); }
-  bool has_packet_timestamps() const { return at<3>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> packet_timestamps(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(3, parse_error_ptr); }
-  bool has_packet_lengths() const { return at<4>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t> packet_lengths(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t>(4, parse_error_ptr); }
-  bool has_total_packets() const { return at<5>().valid(); }
-  uint32_t total_packets() const { return at<5>().as_uint32(); }
-  bool has_total_duration() const { return at<6>().valid(); }
-  uint64_t total_duration() const { return at<6>().as_uint64(); }
-  bool has_total_length() const { return at<7>().valid(); }
-  uint64_t total_length() const { return at<7>().as_uint64(); }
-};
-
-class NetworkPacketBundle : public ::protozero::Message {
- public:
-  using Decoder = NetworkPacketBundle_Decoder;
-  enum : int32_t {
-    kIidFieldNumber = 1,
-    kCtxFieldNumber = 2,
-    kPacketTimestampsFieldNumber = 3,
-    kPacketLengthsFieldNumber = 4,
-    kTotalPacketsFieldNumber = 5,
-    kTotalDurationFieldNumber = 6,
-    kTotalLengthFieldNumber = 7,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.NetworkPacketBundle"; }
-
-
-  using FieldMetadata_Iid =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      NetworkPacketBundle>;
-
-  static constexpr FieldMetadata_Iid kIid{};
-  void set_iid(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Ctx =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      NetworkPacketEvent,
-      NetworkPacketBundle>;
-
-  static constexpr FieldMetadata_Ctx kCtx{};
-  template <typename T = NetworkPacketEvent> T* set_ctx() {
-    return BeginNestedMessage<T>(2);
-  }
-
-
-  using FieldMetadata_PacketTimestamps =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      NetworkPacketBundle>;
-
-  static constexpr FieldMetadata_PacketTimestamps kPacketTimestamps{};
-  void set_packet_timestamps(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_PacketTimestamps::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-
-  using FieldMetadata_PacketLengths =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketBundle>;
-
-  static constexpr FieldMetadata_PacketLengths kPacketLengths{};
-  void set_packet_lengths(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_PacketLengths::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-
-  using FieldMetadata_TotalPackets =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketBundle>;
-
-  static constexpr FieldMetadata_TotalPackets kTotalPackets{};
-  void set_total_packets(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TotalPackets::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TotalDuration =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      NetworkPacketBundle>;
-
-  static constexpr FieldMetadata_TotalDuration kTotalDuration{};
-  void set_total_duration(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TotalDuration::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TotalLength =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      NetworkPacketBundle>;
-
-  static constexpr FieldMetadata_TotalLength kTotalLength{};
-  void set_total_length(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TotalLength::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class NetworkPacketEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/11> {
- public:
-  NetworkPacketEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit NetworkPacketEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit NetworkPacketEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_direction() const { return at<1>().valid(); }
-  int32_t direction() const { return at<1>().as_int32(); }
-  bool has_network_interface() const { return at<2>().valid(); }
-  ::protozero::ConstChars network_interface() const { return at<2>().as_string(); }
-  bool has_length() const { return at<3>().valid(); }
-  uint32_t length() const { return at<3>().as_uint32(); }
-  bool has_uid() const { return at<4>().valid(); }
-  uint32_t uid() const { return at<4>().as_uint32(); }
-  bool has_tag() const { return at<5>().valid(); }
-  uint32_t tag() const { return at<5>().as_uint32(); }
-  bool has_ip_proto() const { return at<6>().valid(); }
-  uint32_t ip_proto() const { return at<6>().as_uint32(); }
-  bool has_tcp_flags() const { return at<7>().valid(); }
-  uint32_t tcp_flags() const { return at<7>().as_uint32(); }
-  bool has_local_port() const { return at<8>().valid(); }
-  uint32_t local_port() const { return at<8>().as_uint32(); }
-  bool has_remote_port() const { return at<9>().valid(); }
-  uint32_t remote_port() const { return at<9>().as_uint32(); }
-  bool has_icmp_type() const { return at<10>().valid(); }
-  uint32_t icmp_type() const { return at<10>().as_uint32(); }
-  bool has_icmp_code() const { return at<11>().valid(); }
-  uint32_t icmp_code() const { return at<11>().as_uint32(); }
-};
-
-class NetworkPacketEvent : public ::protozero::Message {
- public:
-  using Decoder = NetworkPacketEvent_Decoder;
-  enum : int32_t {
-    kDirectionFieldNumber = 1,
-    kNetworkInterfaceFieldNumber = 2,
-    kLengthFieldNumber = 3,
-    kUidFieldNumber = 4,
-    kTagFieldNumber = 5,
-    kIpProtoFieldNumber = 6,
-    kTcpFlagsFieldNumber = 7,
-    kLocalPortFieldNumber = 8,
-    kRemotePortFieldNumber = 9,
-    kIcmpTypeFieldNumber = 10,
-    kIcmpCodeFieldNumber = 11,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.NetworkPacketEvent"; }
-
-
-  using FieldMetadata_Direction =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      TrafficDirection,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_Direction kDirection{};
-  void set_direction(TrafficDirection value) {
-    static constexpr uint32_t field_id = FieldMetadata_Direction::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_NetworkInterface =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_NetworkInterface kNetworkInterface{};
-  void set_network_interface(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_NetworkInterface::kFieldId, data, size);
-  }
-  void set_network_interface(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_NetworkInterface::kFieldId, chars.data, chars.size);
-  }
-  void set_network_interface(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_NetworkInterface::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Length =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_Length kLength{};
-  void set_length(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Length::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Uid =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_Uid kUid{};
-  void set_uid(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Tag =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_Tag kTag{};
-  void set_tag(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tag::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IpProto =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_IpProto kIpProto{};
-  void set_ip_proto(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_IpProto::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TcpFlags =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_TcpFlags kTcpFlags{};
-  void set_tcp_flags(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TcpFlags::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_LocalPort =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_LocalPort kLocalPort{};
-  void set_local_port(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LocalPort::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_RemotePort =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_RemotePort kRemotePort{};
-  void set_remote_port(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RemotePort::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IcmpType =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_IcmpType kIcmpType{};
-  void set_icmp_type(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_IcmpType::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IcmpCode =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      NetworkPacketEvent>;
-
-  static constexpr FieldMetadata_IcmpCode kIcmpCode{};
-  void set_icmp_code(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_IcmpCode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -80703,7 +74825,7 @@ class BackgroundTracingMetadata_TriggerRule_HistogramRule : public ::protozero::
   }
 };
 
-class ChromeMetadataPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+class ChromeMetadataPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
  public:
   ChromeMetadataPacket_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit ChromeMetadataPacket_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -80718,6 +74840,12 @@ class ChromeMetadataPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> field_trial_hashes() const { return GetRepeated<::protozero::ConstBytes>(4); }
   bool has_app_package_name() const { return at<5>().valid(); }
   ::protozero::ConstChars app_package_name() const { return at<5>().as_string(); }
+  bool has_app_version() const { return at<6>().valid(); }
+  ::protozero::ConstChars app_version() const { return at<6>().as_string(); }
+  bool has_channel() const { return at<7>().valid(); }
+  uint32_t channel() const { return at<7>().as_uint32(); }
+  bool has_os_name() const { return at<8>().valid(); }
+  ::protozero::ConstChars os_name() const { return at<8>().as_string(); }
 };
 
 class ChromeMetadataPacket : public ::protozero::Message {
@@ -80729,6 +74857,9 @@ class ChromeMetadataPacket : public ::protozero::Message {
     kEnabledCategoriesFieldNumber = 3,
     kFieldTrialHashesFieldNumber = 4,
     kAppPackageNameFieldNumber = 5,
+    kAppVersionFieldNumber = 6,
+    kChannelFieldNumber = 7,
+    kOsNameFieldNumber = 8,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.ChromeMetadataPacket"; }
 
@@ -80827,6 +74958,72 @@ class ChromeMetadataPacket : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_AppVersion =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ChromeMetadataPacket>;
+
+  static constexpr FieldMetadata_AppVersion kAppVersion{};
+  void set_app_version(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_AppVersion::kFieldId, data, size);
+  }
+  void set_app_version(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_AppVersion::kFieldId, chars.data, chars.size);
+  }
+  void set_app_version(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_AppVersion::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Channel =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      ChromeMetadataPacket>;
+
+  static constexpr FieldMetadata_Channel kChannel{};
+  void set_channel(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Channel::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_OsName =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ChromeMetadataPacket>;
+
+  static constexpr FieldMetadata_OsName kOsName{};
+  void set_os_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_OsName::kFieldId, data, size);
+  }
+  void set_os_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_OsName::kFieldId, chars.data, chars.size);
+  }
+  void set_os_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_OsName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class ChromeMetadataPacket_FinchHash_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
@@ -84973,6 +79170,465 @@ const char* CSwitchEtwEvent_OldThreadState_Name(::perfetto::protos::pbzero::CSwi
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
+class DiskIoEtwEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
+ public:
+  DiskIoEtwEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DiskIoEtwEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DiskIoEtwEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_disk_number() const { return at<1>().valid(); }
+  uint32_t disk_number() const { return at<1>().as_uint32(); }
+  bool has_irp_flags() const { return at<2>().valid(); }
+  uint32_t irp_flags() const { return at<2>().as_uint32(); }
+  bool has_transfer_size() const { return at<3>().valid(); }
+  uint32_t transfer_size() const { return at<3>().as_uint32(); }
+  bool has_byte_offset() const { return at<4>().valid(); }
+  int64_t byte_offset() const { return at<4>().as_int64(); }
+  bool has_file_object() const { return at<5>().valid(); }
+  uint64_t file_object() const { return at<5>().as_uint64(); }
+  bool has_irp_ptr() const { return at<6>().valid(); }
+  uint64_t irp_ptr() const { return at<6>().as_uint64(); }
+  bool has_response_time() const { return at<7>().valid(); }
+  int64_t response_time() const { return at<7>().as_int64(); }
+  bool has_issuing_thread_id() const { return at<8>().valid(); }
+  uint32_t issuing_thread_id() const { return at<8>().as_uint32(); }
+  bool has_opcode() const { return at<9>().valid(); }
+  uint32_t opcode() const { return at<9>().as_uint32(); }
+};
+
+class DiskIoEtwEvent : public ::protozero::Message {
+ public:
+  using Decoder = DiskIoEtwEvent_Decoder;
+  enum : int32_t {
+    kDiskNumberFieldNumber = 1,
+    kIrpFlagsFieldNumber = 2,
+    kTransferSizeFieldNumber = 3,
+    kByteOffsetFieldNumber = 4,
+    kFileObjectFieldNumber = 5,
+    kIrpPtrFieldNumber = 6,
+    kResponseTimeFieldNumber = 7,
+    kIssuingThreadIdFieldNumber = 8,
+    kOpcodeFieldNumber = 9,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DiskIoEtwEvent"; }
+
+
+  using FieldMetadata_DiskNumber =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_DiskNumber kDiskNumber{};
+  void set_disk_number(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_DiskNumber::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IrpFlags =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_IrpFlags kIrpFlags{};
+  void set_irp_flags(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IrpFlags::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TransferSize =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_TransferSize kTransferSize{};
+  void set_transfer_size(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TransferSize::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ByteOffset =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_ByteOffset kByteOffset{};
+  void set_byte_offset(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ByteOffset::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FileObject =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_FileObject kFileObject{};
+  void set_file_object(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FileObject::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IrpPtr =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_IrpPtr kIrpPtr{};
+  void set_irp_ptr(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IrpPtr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ResponseTime =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_ResponseTime kResponseTime{};
+  void set_response_time(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ResponseTime::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IssuingThreadId =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_IssuingThreadId kIssuingThreadId{};
+  void set_issuing_thread_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IssuingThreadId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Opcode =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DiskIoEtwEvent>;
+
+  static constexpr FieldMetadata_Opcode kOpcode{};
+  void set_opcode(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Opcode::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class StackWalkEtwEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  StackWalkEtwEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StackWalkEtwEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StackWalkEtwEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_trigger() const { return at<1>().valid(); }
+  ::protozero::ConstChars trigger() const { return at<1>().as_string(); }
+  bool has_callstack_iid() const { return at<2>().valid(); }
+  uint64_t callstack_iid() const { return at<2>().as_uint64(); }
+};
+
+class StackWalkEtwEvent : public ::protozero::Message {
+ public:
+  using Decoder = StackWalkEtwEvent_Decoder;
+  enum : int32_t {
+    kTriggerFieldNumber = 1,
+    kCallstackIidFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.StackWalkEtwEvent"; }
+
+
+  using FieldMetadata_Trigger =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackWalkEtwEvent>;
+
+  static constexpr FieldMetadata_Trigger kTrigger{};
+  void set_trigger(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Trigger::kFieldId, data, size);
+  }
+  void set_trigger(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Trigger::kFieldId, chars.data, chars.size);
+  }
+  void set_trigger(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Trigger::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_CallstackIid =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackWalkEtwEvent>;
+
+  static constexpr FieldMetadata_CallstackIid kCallstackIid{};
+  void set_callstack_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_CallstackIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class FileIoPathOperationEtwEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
+ public:
+  FileIoPathOperationEtwEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit FileIoPathOperationEtwEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit FileIoPathOperationEtwEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_irp_ptr() const { return at<1>().valid(); }
+  uint64_t irp_ptr() const { return at<1>().as_uint64(); }
+  bool has_file_object() const { return at<2>().valid(); }
+  uint64_t file_object() const { return at<2>().as_uint64(); }
+  bool has_file_key() const { return at<3>().valid(); }
+  uint64_t file_key() const { return at<3>().as_uint64(); }
+  bool has_extra_info() const { return at<4>().valid(); }
+  uint64_t extra_info() const { return at<4>().as_uint64(); }
+  bool has_ttid() const { return at<5>().valid(); }
+  uint32_t ttid() const { return at<5>().as_uint32(); }
+  bool has_info_class() const { return at<6>().valid(); }
+  uint32_t info_class() const { return at<6>().as_uint32(); }
+  bool has_file_name() const { return at<7>().valid(); }
+  ::protozero::ConstChars file_name() const { return at<7>().as_string(); }
+  bool has_opcode() const { return at<8>().valid(); }
+  uint32_t opcode() const { return at<8>().as_uint32(); }
+};
+
+class FileIoPathOperationEtwEvent : public ::protozero::Message {
+ public:
+  using Decoder = FileIoPathOperationEtwEvent_Decoder;
+  enum : int32_t {
+    kIrpPtrFieldNumber = 1,
+    kFileObjectFieldNumber = 2,
+    kFileKeyFieldNumber = 3,
+    kExtraInfoFieldNumber = 4,
+    kTtidFieldNumber = 5,
+    kInfoClassFieldNumber = 6,
+    kFileNameFieldNumber = 7,
+    kOpcodeFieldNumber = 8,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.FileIoPathOperationEtwEvent"; }
+
+
+  using FieldMetadata_IrpPtr =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_IrpPtr kIrpPtr{};
+  void set_irp_ptr(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IrpPtr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FileObject =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_FileObject kFileObject{};
+  void set_file_object(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FileObject::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FileKey =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_FileKey kFileKey{};
+  void set_file_key(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FileKey::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ExtraInfo =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_ExtraInfo kExtraInfo{};
+  void set_extra_info(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ExtraInfo::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Ttid =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_Ttid kTtid{};
+  void set_ttid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Ttid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_InfoClass =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_InfoClass kInfoClass{};
+  void set_info_class(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_InfoClass::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FileName =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_FileName kFileName{};
+  void set_file_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_FileName::kFieldId, data, size);
+  }
+  void set_file_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_FileName::kFieldId, chars.data, chars.size);
+  }
+  void set_file_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_FileName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Opcode =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      FileIoPathOperationEtwEvent>;
+
+  static constexpr FieldMetadata_Opcode kOpcode{};
+  void set_opcode(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Opcode::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class FileIoOpEndEtwEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
   FileIoOpEndEtwEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -86723,14 +81379,17 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 class CSwitchEtwEvent;
+class DiskIoEtwEvent;
 class FileIoCreateEtwEvent;
 class FileIoDirEnumEtwEvent;
 class FileIoInfoEtwEvent;
 class FileIoOpEndEtwEvent;
+class FileIoPathOperationEtwEvent;
 class FileIoReadWriteEtwEvent;
 class FileIoSimpleOpEtwEvent;
 class MemInfoEtwEvent;
 class ReadyThreadEtwEvent;
+class StackWalkEtwEvent;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -86739,7 +81398,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class EtwTraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/12> {
+class EtwTraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/15> {
  public:
   EtwTraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit EtwTraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -86768,6 +81427,12 @@ class EtwTraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_
   ::protozero::ConstBytes file_io_simple_op() const { return at<11>().as_bytes(); }
   bool has_file_io_op_end() const { return at<12>().valid(); }
   ::protozero::ConstBytes file_io_op_end() const { return at<12>().as_bytes(); }
+  bool has_stack_walk() const { return at<13>().valid(); }
+  ::protozero::ConstBytes stack_walk() const { return at<13>().as_bytes(); }
+  bool has_file_io_path_operation() const { return at<14>().valid(); }
+  ::protozero::ConstBytes file_io_path_operation() const { return at<14>().as_bytes(); }
+  bool has_disk_io() const { return at<15>().valid(); }
+  ::protozero::ConstBytes disk_io() const { return at<15>().as_bytes(); }
 };
 
 class EtwTraceEvent : public ::protozero::Message {
@@ -86786,6 +81451,9 @@ class EtwTraceEvent : public ::protozero::Message {
     kFileIoReadWriteFieldNumber = 10,
     kFileIoSimpleOpFieldNumber = 11,
     kFileIoOpEndFieldNumber = 12,
+    kStackWalkFieldNumber = 13,
+    kFileIoPathOperationFieldNumber = 14,
+    kDiskIoFieldNumber = 15,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.EtwTraceEvent"; }
 
@@ -86969,6 +81637,48 @@ class EtwTraceEvent : public ::protozero::Message {
     return BeginNestedMessage<T>(12);
   }
 
+
+  using FieldMetadata_StackWalk =
+    ::protozero::proto_utils::FieldMetadata<
+      13,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackWalkEtwEvent,
+      EtwTraceEvent>;
+
+  static constexpr FieldMetadata_StackWalk kStackWalk{};
+  template <typename T = StackWalkEtwEvent> T* set_stack_walk() {
+    return BeginNestedMessage<T>(13);
+  }
+
+
+  using FieldMetadata_FileIoPathOperation =
+    ::protozero::proto_utils::FieldMetadata<
+      14,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      FileIoPathOperationEtwEvent,
+      EtwTraceEvent>;
+
+  static constexpr FieldMetadata_FileIoPathOperation kFileIoPathOperation{};
+  template <typename T = FileIoPathOperationEtwEvent> T* set_file_io_path_operation() {
+    return BeginNestedMessage<T>(14);
+  }
+
+
+  using FieldMetadata_DiskIo =
+    ::protozero::proto_utils::FieldMetadata<
+      15,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DiskIoEtwEvent,
+      EtwTraceEvent>;
+
+  static constexpr FieldMetadata_DiskIo kDiskIo{};
+  template <typename T = DiskIoEtwEvent> T* set_disk_io() {
+    return BeginNestedMessage<T>(15);
+  }
+
 };
 
 } // Namespace.
@@ -87402,7 +82112,12 @@ class DmaFenceWaitStartFtraceEvent;
 class DmaHeapStatFtraceEvent;
 class DmabufRssStatFtraceEvent;
 class DoSysOpenFtraceEvent;
+class DpuDispDpuLineUnderrunFtraceEvent;
 class DpuDispDpuUnderrunFtraceEvent;
+class DpuDispFrameDoneMissingFtraceEvent;
+class DpuDispFrameDoneTimeoutFtraceEvent;
+class DpuDispFrameStartMissingFtraceEvent;
+class DpuDispFrameStartTimeoutFtraceEvent;
 class DpuDispVblankIrqEnableFtraceEvent;
 class DpuDsiCmdFifoStatusFtraceEvent;
 class DpuDsiRxFtraceEvent;
@@ -87543,6 +82258,7 @@ class F2fsIgetExitFtraceEvent;
 class F2fsIgetFtraceEvent;
 class F2fsIostatFtraceEvent;
 class F2fsIostatLatencyFtraceEvent;
+class F2fsLockElapsedTimeFtraceEvent;
 class F2fsNewInodeFtraceEvent;
 class F2fsReadpageFtraceEvent;
 class F2fsReserveNewBlockFtraceEvent;
@@ -87778,17 +82494,23 @@ class MmVmscanDirectReclaimBeginFtraceEvent;
 class MmVmscanDirectReclaimEndFtraceEvent;
 class MmVmscanKswapdSleepFtraceEvent;
 class MmVmscanKswapdWakeFtraceEvent;
+class MmVmscanMemcgReclaimBeginFtraceEvent;
+class MmVmscanMemcgReclaimEndFtraceEvent;
 class NapiGroReceiveEntryFtraceEvent;
 class NapiGroReceiveExitFtraceEvent;
 class NetDevXmitFtraceEvent;
 class NetifReceiveSkbFtraceEvent;
 class OomScoreAdjUpdateFtraceEvent;
 class OpenExecFtraceEvent;
+class PanelSettingsFullFtraceEvent;
+class PanelSettingsLiteFtraceEvent;
 class PanelWriteGenericFtraceEvent;
 class ParamSetValueCpmFtraceEvent;
 class PixelMmKswapdDoneFtraceEvent;
 class PixelMmKswapdWakeFtraceEvent;
 class PrintFtraceEvent;
+class PsciDomainIdleEnterFtraceEvent;
+class PsciDomainIdleExitFtraceEvent;
 class PsciMemProtectFtraceEvent;
 class RegulatorDisableCompleteFtraceEvent;
 class RegulatorDisableFtraceEvent;
@@ -87805,6 +82527,7 @@ class SamsungTracingMarkWriteFtraceEvent;
 class SchedBlockedReasonFtraceEvent;
 class SchedCpuHotplugFtraceEvent;
 class SchedCpuUtilCfsFtraceEvent;
+class SchedGroupTrackerFtraceEvent;
 class SchedMigrateTaskFtraceEvent;
 class SchedPiSetprioFtraceEvent;
 class SchedProcessExecFtraceEvent;
@@ -87906,7 +82629,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class FtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/602> {
+class FtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/615> {
  public:
   FtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit FtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -89079,6 +83802,32 @@ class FtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes gpu_power_state() const { return at<601>().as_bytes(); }
   bool has_gram_collision() const { return at<602>().valid(); }
   ::protozero::ConstBytes gram_collision() const { return at<602>().as_bytes(); }
+  bool has_f2fs_lock_elapsed_time() const { return at<603>().valid(); }
+  ::protozero::ConstBytes f2fs_lock_elapsed_time() const { return at<603>().as_bytes(); }
+  bool has_sched_group_tracker() const { return at<604>().valid(); }
+  ::protozero::ConstBytes sched_group_tracker() const { return at<604>().as_bytes(); }
+  bool has_dpu_disp_frame_done_timeout() const { return at<605>().valid(); }
+  ::protozero::ConstBytes dpu_disp_frame_done_timeout() const { return at<605>().as_bytes(); }
+  bool has_dpu_disp_frame_start_timeout() const { return at<606>().valid(); }
+  ::protozero::ConstBytes dpu_disp_frame_start_timeout() const { return at<606>().as_bytes(); }
+  bool has_mm_vmscan_memcg_reclaim_begin() const { return at<607>().valid(); }
+  ::protozero::ConstBytes mm_vmscan_memcg_reclaim_begin() const { return at<607>().as_bytes(); }
+  bool has_mm_vmscan_memcg_reclaim_end() const { return at<608>().valid(); }
+  ::protozero::ConstBytes mm_vmscan_memcg_reclaim_end() const { return at<608>().as_bytes(); }
+  bool has_dpu_disp_frame_done_missing() const { return at<609>().valid(); }
+  ::protozero::ConstBytes dpu_disp_frame_done_missing() const { return at<609>().as_bytes(); }
+  bool has_dpu_disp_frame_start_missing() const { return at<610>().valid(); }
+  ::protozero::ConstBytes dpu_disp_frame_start_missing() const { return at<610>().as_bytes(); }
+  bool has_panel_settings_full() const { return at<611>().valid(); }
+  ::protozero::ConstBytes panel_settings_full() const { return at<611>().as_bytes(); }
+  bool has_panel_settings_lite() const { return at<612>().valid(); }
+  ::protozero::ConstBytes panel_settings_lite() const { return at<612>().as_bytes(); }
+  bool has_dpu_disp_dpu_line_underrun() const { return at<613>().valid(); }
+  ::protozero::ConstBytes dpu_disp_dpu_line_underrun() const { return at<613>().as_bytes(); }
+  bool has_psci_domain_idle_exit() const { return at<614>().valid(); }
+  ::protozero::ConstBytes psci_domain_idle_exit() const { return at<614>().as_bytes(); }
+  bool has_psci_domain_idle_enter() const { return at<615>().valid(); }
+  ::protozero::ConstBytes psci_domain_idle_enter() const { return at<615>().as_bytes(); }
 };
 
 class FtraceEvent : public ::protozero::Message {
@@ -89669,6 +84418,19 @@ class FtraceEvent : public ::protozero::Message {
     kFwtpPerfettoSliceFieldNumber = 600,
     kGpuPowerStateFieldNumber = 601,
     kGramCollisionFieldNumber = 602,
+    kF2fsLockElapsedTimeFieldNumber = 603,
+    kSchedGroupTrackerFieldNumber = 604,
+    kDpuDispFrameDoneTimeoutFieldNumber = 605,
+    kDpuDispFrameStartTimeoutFieldNumber = 606,
+    kMmVmscanMemcgReclaimBeginFieldNumber = 607,
+    kMmVmscanMemcgReclaimEndFieldNumber = 608,
+    kDpuDispFrameDoneMissingFieldNumber = 609,
+    kDpuDispFrameStartMissingFieldNumber = 610,
+    kPanelSettingsFullFieldNumber = 611,
+    kPanelSettingsLiteFieldNumber = 612,
+    kDpuDispDpuLineUnderrunFieldNumber = 613,
+    kPsciDomainIdleExitFieldNumber = 614,
+    kPsciDomainIdleEnterFieldNumber = 615,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.FtraceEvent"; }
 
@@ -97860,6 +92622,188 @@ class FtraceEvent : public ::protozero::Message {
     return BeginNestedMessage<T>(602);
   }
 
+
+  using FieldMetadata_F2fsLockElapsedTime =
+    ::protozero::proto_utils::FieldMetadata<
+      603,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      F2fsLockElapsedTimeFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_F2fsLockElapsedTime kF2fsLockElapsedTime{};
+  template <typename T = F2fsLockElapsedTimeFtraceEvent> T* set_f2fs_lock_elapsed_time() {
+    return BeginNestedMessage<T>(603);
+  }
+
+
+  using FieldMetadata_SchedGroupTracker =
+    ::protozero::proto_utils::FieldMetadata<
+      604,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      SchedGroupTrackerFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_SchedGroupTracker kSchedGroupTracker{};
+  template <typename T = SchedGroupTrackerFtraceEvent> T* set_sched_group_tracker() {
+    return BeginNestedMessage<T>(604);
+  }
+
+
+  using FieldMetadata_DpuDispFrameDoneTimeout =
+    ::protozero::proto_utils::FieldMetadata<
+      605,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DpuDispFrameDoneTimeoutFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_DpuDispFrameDoneTimeout kDpuDispFrameDoneTimeout{};
+  template <typename T = DpuDispFrameDoneTimeoutFtraceEvent> T* set_dpu_disp_frame_done_timeout() {
+    return BeginNestedMessage<T>(605);
+  }
+
+
+  using FieldMetadata_DpuDispFrameStartTimeout =
+    ::protozero::proto_utils::FieldMetadata<
+      606,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DpuDispFrameStartTimeoutFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_DpuDispFrameStartTimeout kDpuDispFrameStartTimeout{};
+  template <typename T = DpuDispFrameStartTimeoutFtraceEvent> T* set_dpu_disp_frame_start_timeout() {
+    return BeginNestedMessage<T>(606);
+  }
+
+
+  using FieldMetadata_MmVmscanMemcgReclaimBegin =
+    ::protozero::proto_utils::FieldMetadata<
+      607,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      MmVmscanMemcgReclaimBeginFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_MmVmscanMemcgReclaimBegin kMmVmscanMemcgReclaimBegin{};
+  template <typename T = MmVmscanMemcgReclaimBeginFtraceEvent> T* set_mm_vmscan_memcg_reclaim_begin() {
+    return BeginNestedMessage<T>(607);
+  }
+
+
+  using FieldMetadata_MmVmscanMemcgReclaimEnd =
+    ::protozero::proto_utils::FieldMetadata<
+      608,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      MmVmscanMemcgReclaimEndFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_MmVmscanMemcgReclaimEnd kMmVmscanMemcgReclaimEnd{};
+  template <typename T = MmVmscanMemcgReclaimEndFtraceEvent> T* set_mm_vmscan_memcg_reclaim_end() {
+    return BeginNestedMessage<T>(608);
+  }
+
+
+  using FieldMetadata_DpuDispFrameDoneMissing =
+    ::protozero::proto_utils::FieldMetadata<
+      609,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DpuDispFrameDoneMissingFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_DpuDispFrameDoneMissing kDpuDispFrameDoneMissing{};
+  template <typename T = DpuDispFrameDoneMissingFtraceEvent> T* set_dpu_disp_frame_done_missing() {
+    return BeginNestedMessage<T>(609);
+  }
+
+
+  using FieldMetadata_DpuDispFrameStartMissing =
+    ::protozero::proto_utils::FieldMetadata<
+      610,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DpuDispFrameStartMissingFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_DpuDispFrameStartMissing kDpuDispFrameStartMissing{};
+  template <typename T = DpuDispFrameStartMissingFtraceEvent> T* set_dpu_disp_frame_start_missing() {
+    return BeginNestedMessage<T>(610);
+  }
+
+
+  using FieldMetadata_PanelSettingsFull =
+    ::protozero::proto_utils::FieldMetadata<
+      611,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      PanelSettingsFullFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_PanelSettingsFull kPanelSettingsFull{};
+  template <typename T = PanelSettingsFullFtraceEvent> T* set_panel_settings_full() {
+    return BeginNestedMessage<T>(611);
+  }
+
+
+  using FieldMetadata_PanelSettingsLite =
+    ::protozero::proto_utils::FieldMetadata<
+      612,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      PanelSettingsLiteFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_PanelSettingsLite kPanelSettingsLite{};
+  template <typename T = PanelSettingsLiteFtraceEvent> T* set_panel_settings_lite() {
+    return BeginNestedMessage<T>(612);
+  }
+
+
+  using FieldMetadata_DpuDispDpuLineUnderrun =
+    ::protozero::proto_utils::FieldMetadata<
+      613,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DpuDispDpuLineUnderrunFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_DpuDispDpuLineUnderrun kDpuDispDpuLineUnderrun{};
+  template <typename T = DpuDispDpuLineUnderrunFtraceEvent> T* set_dpu_disp_dpu_line_underrun() {
+    return BeginNestedMessage<T>(613);
+  }
+
+
+  using FieldMetadata_PsciDomainIdleExit =
+    ::protozero::proto_utils::FieldMetadata<
+      614,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      PsciDomainIdleExitFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_PsciDomainIdleExit kPsciDomainIdleExit{};
+  template <typename T = PsciDomainIdleExitFtraceEvent> T* set_psci_domain_idle_exit() {
+    return BeginNestedMessage<T>(614);
+  }
+
+
+  using FieldMetadata_PsciDomainIdleEnter =
+    ::protozero::proto_utils::FieldMetadata<
+      615,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      PsciDomainIdleEnterFtraceEvent,
+      FtraceEvent>;
+
+  static constexpr FieldMetadata_PsciDomainIdleEnter kPsciDomainIdleEnter{};
+  template <typename T = PsciDomainIdleEnterFtraceEvent> T* set_psci_domain_idle_enter() {
+    return BeginNestedMessage<T>(615);
+  }
+
 };
 
 } // Namespace.
@@ -109351,6 +104295,506 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+class DpuDispDpuLineUnderrunFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  DpuDispDpuLineUnderrunFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DpuDispDpuLineUnderrunFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DpuDispDpuLineUnderrunFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_id() const { return at<1>().valid(); }
+  int32_t id() const { return at<1>().as_int32(); }
+  bool has_frames_pending() const { return at<2>().valid(); }
+  int32_t frames_pending() const { return at<2>().as_int32(); }
+  bool has_vsync_count() const { return at<3>().valid(); }
+  int32_t vsync_count() const { return at<3>().as_int32(); }
+};
+
+class DpuDispDpuLineUnderrunFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = DpuDispDpuLineUnderrunFtraceEvent_Decoder;
+  enum : int32_t {
+    kIdFieldNumber = 1,
+    kFramesPendingFieldNumber = 2,
+    kVsyncCountFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DpuDispDpuLineUnderrunFtraceEvent"; }
+
+
+  using FieldMetadata_Id =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispDpuLineUnderrunFtraceEvent>;
+
+  static constexpr FieldMetadata_Id kId{};
+  void set_id(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FramesPending =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispDpuLineUnderrunFtraceEvent>;
+
+  static constexpr FieldMetadata_FramesPending kFramesPending{};
+  void set_frames_pending(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FramesPending::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_VsyncCount =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispDpuLineUnderrunFtraceEvent>;
+
+  static constexpr FieldMetadata_VsyncCount kVsyncCount{};
+  void set_vsync_count(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_VsyncCount::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class DpuDispFrameStartMissingFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  DpuDispFrameStartMissingFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DpuDispFrameStartMissingFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DpuDispFrameStartMissingFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_display_id() const { return at<1>().valid(); }
+  int32_t display_id() const { return at<1>().as_int32(); }
+  bool has_output_id() const { return at<2>().valid(); }
+  uint32_t output_id() const { return at<2>().as_uint32(); }
+  bool has_frames_pending() const { return at<3>().valid(); }
+  int32_t frames_pending() const { return at<3>().as_int32(); }
+  bool has_te_count() const { return at<4>().valid(); }
+  int32_t te_count() const { return at<4>().as_int32(); }
+};
+
+class DpuDispFrameStartMissingFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = DpuDispFrameStartMissingFtraceEvent_Decoder;
+  enum : int32_t {
+    kDisplayIdFieldNumber = 1,
+    kOutputIdFieldNumber = 2,
+    kFramesPendingFieldNumber = 3,
+    kTeCountFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DpuDispFrameStartMissingFtraceEvent"; }
+
+
+  using FieldMetadata_DisplayId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameStartMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_DisplayId kDisplayId{};
+  void set_display_id(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisplayId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_OutputId =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DpuDispFrameStartMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_OutputId kOutputId{};
+  void set_output_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OutputId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FramesPending =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameStartMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_FramesPending kFramesPending{};
+  void set_frames_pending(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FramesPending::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TeCount =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameStartMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_TeCount kTeCount{};
+  void set_te_count(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TeCount::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class DpuDispFrameDoneMissingFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  DpuDispFrameDoneMissingFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DpuDispFrameDoneMissingFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DpuDispFrameDoneMissingFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_display_id() const { return at<1>().valid(); }
+  int32_t display_id() const { return at<1>().as_int32(); }
+  bool has_output_id() const { return at<2>().valid(); }
+  uint32_t output_id() const { return at<2>().as_uint32(); }
+  bool has_frames_pending() const { return at<3>().valid(); }
+  int32_t frames_pending() const { return at<3>().as_int32(); }
+  bool has_te_count() const { return at<4>().valid(); }
+  int32_t te_count() const { return at<4>().as_int32(); }
+};
+
+class DpuDispFrameDoneMissingFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = DpuDispFrameDoneMissingFtraceEvent_Decoder;
+  enum : int32_t {
+    kDisplayIdFieldNumber = 1,
+    kOutputIdFieldNumber = 2,
+    kFramesPendingFieldNumber = 3,
+    kTeCountFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DpuDispFrameDoneMissingFtraceEvent"; }
+
+
+  using FieldMetadata_DisplayId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameDoneMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_DisplayId kDisplayId{};
+  void set_display_id(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisplayId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_OutputId =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DpuDispFrameDoneMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_OutputId kOutputId{};
+  void set_output_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OutputId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FramesPending =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameDoneMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_FramesPending kFramesPending{};
+  void set_frames_pending(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FramesPending::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TeCount =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameDoneMissingFtraceEvent>;
+
+  static constexpr FieldMetadata_TeCount kTeCount{};
+  void set_te_count(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TeCount::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class DpuDispFrameStartTimeoutFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  DpuDispFrameStartTimeoutFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DpuDispFrameStartTimeoutFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DpuDispFrameStartTimeoutFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_display_id() const { return at<1>().valid(); }
+  int32_t display_id() const { return at<1>().as_int32(); }
+  bool has_output_id() const { return at<2>().valid(); }
+  uint32_t output_id() const { return at<2>().as_uint32(); }
+  bool has_frames_pending() const { return at<3>().valid(); }
+  int32_t frames_pending() const { return at<3>().as_int32(); }
+  bool has_te_count() const { return at<4>().valid(); }
+  int32_t te_count() const { return at<4>().as_int32(); }
+};
+
+class DpuDispFrameStartTimeoutFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = DpuDispFrameStartTimeoutFtraceEvent_Decoder;
+  enum : int32_t {
+    kDisplayIdFieldNumber = 1,
+    kOutputIdFieldNumber = 2,
+    kFramesPendingFieldNumber = 3,
+    kTeCountFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DpuDispFrameStartTimeoutFtraceEvent"; }
+
+
+  using FieldMetadata_DisplayId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameStartTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_DisplayId kDisplayId{};
+  void set_display_id(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisplayId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_OutputId =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DpuDispFrameStartTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_OutputId kOutputId{};
+  void set_output_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OutputId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FramesPending =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameStartTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_FramesPending kFramesPending{};
+  void set_frames_pending(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FramesPending::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TeCount =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameStartTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_TeCount kTeCount{};
+  void set_te_count(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TeCount::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class DpuDispFrameDoneTimeoutFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+ public:
+  DpuDispFrameDoneTimeoutFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DpuDispFrameDoneTimeoutFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DpuDispFrameDoneTimeoutFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_display_id() const { return at<1>().valid(); }
+  int32_t display_id() const { return at<1>().as_int32(); }
+  bool has_output_id() const { return at<2>().valid(); }
+  uint32_t output_id() const { return at<2>().as_uint32(); }
+  bool has_frames_pending() const { return at<3>().valid(); }
+  int32_t frames_pending() const { return at<3>().as_int32(); }
+  bool has_te_count() const { return at<4>().valid(); }
+  int32_t te_count() const { return at<4>().as_int32(); }
+  bool has_during_disable() const { return at<5>().valid(); }
+  uint32_t during_disable() const { return at<5>().as_uint32(); }
+};
+
+class DpuDispFrameDoneTimeoutFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = DpuDispFrameDoneTimeoutFtraceEvent_Decoder;
+  enum : int32_t {
+    kDisplayIdFieldNumber = 1,
+    kOutputIdFieldNumber = 2,
+    kFramesPendingFieldNumber = 3,
+    kTeCountFieldNumber = 4,
+    kDuringDisableFieldNumber = 5,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DpuDispFrameDoneTimeoutFtraceEvent"; }
+
+
+  using FieldMetadata_DisplayId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameDoneTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_DisplayId kDisplayId{};
+  void set_display_id(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisplayId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_OutputId =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DpuDispFrameDoneTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_OutputId kOutputId{};
+  void set_output_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OutputId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FramesPending =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameDoneTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_FramesPending kFramesPending{};
+  void set_frames_pending(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FramesPending::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TeCount =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      DpuDispFrameDoneTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_TeCount kTeCount{};
+  void set_te_count(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TeCount::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_DuringDisable =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DpuDispFrameDoneTimeoutFtraceEvent>;
+
+  static constexpr FieldMetadata_DuringDisable kDuringDisable{};
+  void set_during_disable(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_DuringDisable::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class DpuDispVblankIrqEnableFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
   DpuDispVblankIrqEnableFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -124715,6 +120159,301 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+class F2fsLockElapsedTimeFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/13> {
+ public:
+  F2fsLockElapsedTimeFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit F2fsLockElapsedTimeFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit F2fsLockElapsedTimeFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_dev() const { return at<1>().valid(); }
+  uint64_t dev() const { return at<1>().as_uint64(); }
+  bool has_comm() const { return at<2>().valid(); }
+  ::protozero::ConstChars comm() const { return at<2>().as_string(); }
+  bool has_pid() const { return at<3>().valid(); }
+  int32_t pid() const { return at<3>().as_int32(); }
+  bool has_prio() const { return at<4>().valid(); }
+  int32_t prio() const { return at<4>().as_int32(); }
+  bool has_ioprio_class() const { return at<5>().valid(); }
+  int32_t ioprio_class() const { return at<5>().as_int32(); }
+  bool has_ioprio_data() const { return at<6>().valid(); }
+  int32_t ioprio_data() const { return at<6>().as_int32(); }
+  bool has_lock_name() const { return at<7>().valid(); }
+  uint32_t lock_name() const { return at<7>().as_uint32(); }
+  bool has_is_write() const { return at<8>().valid(); }
+  uint32_t is_write() const { return at<8>().as_uint32(); }
+  bool has_total_time() const { return at<9>().valid(); }
+  uint64_t total_time() const { return at<9>().as_uint64(); }
+  bool has_running_time() const { return at<10>().valid(); }
+  uint64_t running_time() const { return at<10>().as_uint64(); }
+  bool has_runnable_time() const { return at<11>().valid(); }
+  uint64_t runnable_time() const { return at<11>().as_uint64(); }
+  bool has_io_sleep_time() const { return at<12>().valid(); }
+  uint64_t io_sleep_time() const { return at<12>().as_uint64(); }
+  bool has_other_time() const { return at<13>().valid(); }
+  uint64_t other_time() const { return at<13>().as_uint64(); }
+};
+
+class F2fsLockElapsedTimeFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = F2fsLockElapsedTimeFtraceEvent_Decoder;
+  enum : int32_t {
+    kDevFieldNumber = 1,
+    kCommFieldNumber = 2,
+    kPidFieldNumber = 3,
+    kPrioFieldNumber = 4,
+    kIoprioClassFieldNumber = 5,
+    kIoprioDataFieldNumber = 6,
+    kLockNameFieldNumber = 7,
+    kIsWriteFieldNumber = 8,
+    kTotalTimeFieldNumber = 9,
+    kRunningTimeFieldNumber = 10,
+    kRunnableTimeFieldNumber = 11,
+    kIoSleepTimeFieldNumber = 12,
+    kOtherTimeFieldNumber = 13,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.F2fsLockElapsedTimeFtraceEvent"; }
+
+
+  using FieldMetadata_Dev =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_Dev kDev{};
+  void set_dev(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Dev::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Comm =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_Comm kComm{};
+  void set_comm(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Comm::kFieldId, data, size);
+  }
+  void set_comm(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Comm::kFieldId, chars.data, chars.size);
+  }
+  void set_comm(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Comm::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Pid =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_Pid kPid{};
+  void set_pid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Prio =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_Prio kPrio{};
+  void set_prio(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Prio::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IoprioClass =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_IoprioClass kIoprioClass{};
+  void set_ioprio_class(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IoprioClass::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IoprioData =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_IoprioData kIoprioData{};
+  void set_ioprio_data(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IoprioData::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_LockName =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_LockName kLockName{};
+  void set_lock_name(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_LockName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IsWrite =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_IsWrite kIsWrite{};
+  void set_is_write(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IsWrite::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TotalTime =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_TotalTime kTotalTime{};
+  void set_total_time(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TotalTime::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_RunningTime =
+    ::protozero::proto_utils::FieldMetadata<
+      10,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_RunningTime kRunningTime{};
+  void set_running_time(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_RunningTime::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_RunnableTime =
+    ::protozero::proto_utils::FieldMetadata<
+      11,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_RunnableTime kRunnableTime{};
+  void set_runnable_time(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_RunnableTime::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IoSleepTime =
+    ::protozero::proto_utils::FieldMetadata<
+      12,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_IoSleepTime kIoSleepTime{};
+  void set_io_sleep_time(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IoSleepTime::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_OtherTime =
+    ::protozero::proto_utils::FieldMetadata<
+      13,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      F2fsLockElapsedTimeFtraceEvent>;
+
+  static constexpr FieldMetadata_OtherTime kOtherTime{};
+  void set_other_time(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OtherTime::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class F2fsGcEndFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/11> {
  public:
   F2fsGcEndFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -150900,6 +146639,353 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+class PanelSettingsLiteFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+ public:
+  PanelSettingsLiteFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit PanelSettingsLiteFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit PanelSettingsLiteFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_panel_index() const { return at<1>().valid(); }
+  int32_t panel_index() const { return at<1>().as_int32(); }
+  bool has_vrr() const { return at<2>().valid(); }
+  uint32_t vrr() const { return at<2>().as_uint32(); }
+  bool has_min_rr() const { return at<3>().valid(); }
+  uint32_t min_rr() const { return at<3>().as_uint32(); }
+  bool has_max_rr() const { return at<4>().valid(); }
+  uint32_t max_rr() const { return at<4>().as_uint32(); }
+  bool has_te_freq() const { return at<5>().valid(); }
+  uint32_t te_freq() const { return at<5>().as_uint32(); }
+};
+
+class PanelSettingsLiteFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = PanelSettingsLiteFtraceEvent_Decoder;
+  enum : int32_t {
+    kPanelIndexFieldNumber = 1,
+    kVrrFieldNumber = 2,
+    kMinRrFieldNumber = 3,
+    kMaxRrFieldNumber = 4,
+    kTeFreqFieldNumber = 5,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.PanelSettingsLiteFtraceEvent"; }
+
+
+  using FieldMetadata_PanelIndex =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      PanelSettingsLiteFtraceEvent>;
+
+  static constexpr FieldMetadata_PanelIndex kPanelIndex{};
+  void set_panel_index(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PanelIndex::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Vrr =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsLiteFtraceEvent>;
+
+  static constexpr FieldMetadata_Vrr kVrr{};
+  void set_vrr(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Vrr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MinRr =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsLiteFtraceEvent>;
+
+  static constexpr FieldMetadata_MinRr kMinRr{};
+  void set_min_rr(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MinRr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MaxRr =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsLiteFtraceEvent>;
+
+  static constexpr FieldMetadata_MaxRr kMaxRr{};
+  void set_max_rr(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MaxRr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TeFreq =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsLiteFtraceEvent>;
+
+  static constexpr FieldMetadata_TeFreq kTeFreq{};
+  void set_te_freq(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TeFreq::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class PanelSettingsFullFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
+ public:
+  PanelSettingsFullFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit PanelSettingsFullFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit PanelSettingsFullFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_panel_index() const { return at<1>().valid(); }
+  int32_t panel_index() const { return at<1>().as_int32(); }
+  bool has_hbm() const { return at<2>().valid(); }
+  uint32_t hbm() const { return at<2>().as_uint32(); }
+  bool has_irc() const { return at<3>().valid(); }
+  uint32_t irc() const { return at<3>().as_uint32(); }
+  bool has_h_pwm() const { return at<4>().valid(); }
+  uint32_t h_pwm() const { return at<4>().as_uint32(); }
+  bool has_fi_auto() const { return at<5>().valid(); }
+  uint32_t fi_auto() const { return at<5>().as_uint32(); }
+  bool has_fi_manual() const { return at<6>().valid(); }
+  uint32_t fi_manual() const { return at<6>().as_uint32(); }
+  bool has_early_exit() const { return at<7>().valid(); }
+  uint32_t early_exit() const { return at<7>().as_uint32(); }
+  bool has_min_rr() const { return at<8>().valid(); }
+  uint32_t min_rr() const { return at<8>().as_uint32(); }
+  bool has_max_rr() const { return at<9>().valid(); }
+  uint32_t max_rr() const { return at<9>().as_uint32(); }
+  bool has_te_freq() const { return at<10>().valid(); }
+  uint32_t te_freq() const { return at<10>().as_uint32(); }
+};
+
+class PanelSettingsFullFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = PanelSettingsFullFtraceEvent_Decoder;
+  enum : int32_t {
+    kPanelIndexFieldNumber = 1,
+    kHbmFieldNumber = 2,
+    kIrcFieldNumber = 3,
+    kHPwmFieldNumber = 4,
+    kFiAutoFieldNumber = 5,
+    kFiManualFieldNumber = 6,
+    kEarlyExitFieldNumber = 7,
+    kMinRrFieldNumber = 8,
+    kMaxRrFieldNumber = 9,
+    kTeFreqFieldNumber = 10,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.PanelSettingsFullFtraceEvent"; }
+
+
+  using FieldMetadata_PanelIndex =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_PanelIndex kPanelIndex{};
+  void set_panel_index(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PanelIndex::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Hbm =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_Hbm kHbm{};
+  void set_hbm(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Hbm::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Irc =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_Irc kIrc{};
+  void set_irc(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Irc::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_HPwm =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_HPwm kHPwm{};
+  void set_h_pwm(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_HPwm::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FiAuto =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_FiAuto kFiAuto{};
+  void set_fi_auto(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FiAuto::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FiManual =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_FiManual kFiManual{};
+  void set_fi_manual(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FiManual::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_EarlyExit =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_EarlyExit kEarlyExit{};
+  void set_early_exit(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_EarlyExit::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MinRr =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_MinRr kMinRr{};
+  void set_min_rr(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MinRr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MaxRr =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_MaxRr kMaxRr{};
+  void set_max_rr(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MaxRr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_TeFreq =
+    ::protozero::proto_utils::FieldMetadata<
+      10,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PanelSettingsFullFtraceEvent>;
+
+  static constexpr FieldMetadata_TeFreq kTeFreq{};
+  void set_te_freq(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TeFreq::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class GramCollisionFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
   GramCollisionFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -152039,6 +148125,164 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+class PsciDomainIdleEnterFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  PsciDomainIdleEnterFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit PsciDomainIdleEnterFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit PsciDomainIdleEnterFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_cpu_id() const { return at<1>().valid(); }
+  uint32_t cpu_id() const { return at<1>().as_uint32(); }
+  bool has_state() const { return at<2>().valid(); }
+  uint32_t state() const { return at<2>().as_uint32(); }
+  bool has_s2idle() const { return at<3>().valid(); }
+  uint32_t s2idle() const { return at<3>().as_uint32(); }
+};
+
+class PsciDomainIdleEnterFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = PsciDomainIdleEnterFtraceEvent_Decoder;
+  enum : int32_t {
+    kCpuIdFieldNumber = 1,
+    kStateFieldNumber = 2,
+    kS2idleFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.PsciDomainIdleEnterFtraceEvent"; }
+
+
+  using FieldMetadata_CpuId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PsciDomainIdleEnterFtraceEvent>;
+
+  static constexpr FieldMetadata_CpuId kCpuId{};
+  void set_cpu_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_CpuId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_State =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PsciDomainIdleEnterFtraceEvent>;
+
+  static constexpr FieldMetadata_State kState{};
+  void set_state(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_State::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_S2idle =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PsciDomainIdleEnterFtraceEvent>;
+
+  static constexpr FieldMetadata_S2idle kS2idle{};
+  void set_s2idle(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_S2idle::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class PsciDomainIdleExitFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  PsciDomainIdleExitFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit PsciDomainIdleExitFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit PsciDomainIdleExitFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_cpu_id() const { return at<1>().valid(); }
+  uint32_t cpu_id() const { return at<1>().as_uint32(); }
+  bool has_state() const { return at<2>().valid(); }
+  uint32_t state() const { return at<2>().as_uint32(); }
+  bool has_s2idle() const { return at<3>().valid(); }
+  uint32_t s2idle() const { return at<3>().as_uint32(); }
+};
+
+class PsciDomainIdleExitFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = PsciDomainIdleExitFtraceEvent_Decoder;
+  enum : int32_t {
+    kCpuIdFieldNumber = 1,
+    kStateFieldNumber = 2,
+    kS2idleFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.PsciDomainIdleExitFtraceEvent"; }
+
+
+  using FieldMetadata_CpuId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PsciDomainIdleExitFtraceEvent>;
+
+  static constexpr FieldMetadata_CpuId kCpuId{};
+  void set_cpu_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_CpuId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_State =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PsciDomainIdleExitFtraceEvent>;
+
+  static constexpr FieldMetadata_State kState{};
+  void set_state(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_State::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_S2idle =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PsciDomainIdleExitFtraceEvent>;
+
+  static constexpr FieldMetadata_S2idle kS2idle{};
+  void set_s2idle(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_S2idle::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class GpuPowerStateFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
   GpuPowerStateFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -154033,6 +150277,118 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+class SchedGroupTrackerFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  SchedGroupTrackerFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit SchedGroupTrackerFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit SchedGroupTrackerFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_comm() const { return at<1>().valid(); }
+  ::protozero::ConstChars comm() const { return at<1>().as_string(); }
+  bool has_pid() const { return at<2>().valid(); }
+  int32_t pid() const { return at<2>().as_int32(); }
+  bool has_group() const { return at<3>().valid(); }
+  ::protozero::ConstChars group() const { return at<3>().as_string(); }
+  bool has_group_num() const { return at<4>().valid(); }
+  int32_t group_num() const { return at<4>().as_int32(); }
+};
+
+class SchedGroupTrackerFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = SchedGroupTrackerFtraceEvent_Decoder;
+  enum : int32_t {
+    kCommFieldNumber = 1,
+    kPidFieldNumber = 2,
+    kGroupFieldNumber = 3,
+    kGroupNumFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.SchedGroupTrackerFtraceEvent"; }
+
+
+  using FieldMetadata_Comm =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SchedGroupTrackerFtraceEvent>;
+
+  static constexpr FieldMetadata_Comm kComm{};
+  void set_comm(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Comm::kFieldId, data, size);
+  }
+  void set_comm(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Comm::kFieldId, chars.data, chars.size);
+  }
+  void set_comm(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Comm::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Pid =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      SchedGroupTrackerFtraceEvent>;
+
+  static constexpr FieldMetadata_Pid kPid{};
+  void set_pid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Group =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SchedGroupTrackerFtraceEvent>;
+
+  static constexpr FieldMetadata_Group kGroup{};
+  void set_group(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Group::kFieldId, data, size);
+  }
+  void set_group(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Group::kFieldId, chars.data, chars.size);
+  }
+  void set_group(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Group::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_GroupNum =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      SchedGroupTrackerFtraceEvent>;
+
+  static constexpr FieldMetadata_GroupNum kGroupNum{};
+  void set_group_num(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_GroupNum::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class SchedWakeupTaskAttrFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
  public:
   SchedWakeupTaskAttrFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -165494,6 +161850,122 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+class MmVmscanMemcgReclaimEndFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  MmVmscanMemcgReclaimEndFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit MmVmscanMemcgReclaimEndFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit MmVmscanMemcgReclaimEndFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_nr_reclaimed() const { return at<1>().valid(); }
+  uint64_t nr_reclaimed() const { return at<1>().as_uint64(); }
+};
+
+class MmVmscanMemcgReclaimEndFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = MmVmscanMemcgReclaimEndFtraceEvent_Decoder;
+  enum : int32_t {
+    kNrReclaimedFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.MmVmscanMemcgReclaimEndFtraceEvent"; }
+
+
+  using FieldMetadata_NrReclaimed =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      MmVmscanMemcgReclaimEndFtraceEvent>;
+
+  static constexpr FieldMetadata_NrReclaimed kNrReclaimed{};
+  void set_nr_reclaimed(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NrReclaimed::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class MmVmscanMemcgReclaimBeginFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  MmVmscanMemcgReclaimBeginFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit MmVmscanMemcgReclaimBeginFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit MmVmscanMemcgReclaimBeginFtraceEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_order() const { return at<1>().valid(); }
+  int32_t order() const { return at<1>().as_int32(); }
+  bool has_may_writepage() const { return at<2>().valid(); }
+  int32_t may_writepage() const { return at<2>().as_int32(); }
+  bool has_gfp_flags() const { return at<3>().valid(); }
+  uint64_t gfp_flags() const { return at<3>().as_uint64(); }
+};
+
+class MmVmscanMemcgReclaimBeginFtraceEvent : public ::protozero::Message {
+ public:
+  using Decoder = MmVmscanMemcgReclaimBeginFtraceEvent_Decoder;
+  enum : int32_t {
+    kOrderFieldNumber = 1,
+    kMayWritepageFieldNumber = 2,
+    kGfpFlagsFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.MmVmscanMemcgReclaimBeginFtraceEvent"; }
+
+
+  using FieldMetadata_Order =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      MmVmscanMemcgReclaimBeginFtraceEvent>;
+
+  static constexpr FieldMetadata_Order kOrder{};
+  void set_order(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Order::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_MayWritepage =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      MmVmscanMemcgReclaimBeginFtraceEvent>;
+
+  static constexpr FieldMetadata_MayWritepage kMayWritepage{};
+  void set_may_writepage(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MayWritepage::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_GfpFlags =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      MmVmscanMemcgReclaimBeginFtraceEvent>;
+
+  static constexpr FieldMetadata_GfpFlags kGfpFlags{};
+  void set_gfp_flags(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_GfpFlags::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class MmShrinkSlabEndFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
  public:
   MmShrinkSlabEndFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -166461,6 +162933,88 @@ class WorkqueueActivateWorkFtraceEvent : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/generic_kernel/generic_gpu_frequency.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_GENERIC_KERNEL_GENERIC_GPU_FREQUENCY_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_GENERIC_KERNEL_GENERIC_GPU_FREQUENCY_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class GenericGpuFrequencyEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  GenericGpuFrequencyEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GenericGpuFrequencyEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GenericGpuFrequencyEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_gpu_id() const { return at<1>().valid(); }
+  uint32_t gpu_id() const { return at<1>().as_uint32(); }
+  bool has_frequency_khz() const { return at<2>().valid(); }
+  uint32_t frequency_khz() const { return at<2>().as_uint32(); }
+};
+
+class GenericGpuFrequencyEvent : public ::protozero::Message {
+ public:
+  using Decoder = GenericGpuFrequencyEvent_Decoder;
+  enum : int32_t {
+    kGpuIdFieldNumber = 1,
+    kFrequencyKhzFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GenericGpuFrequencyEvent"; }
+
+
+  using FieldMetadata_GpuId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GenericGpuFrequencyEvent>;
+
+  static constexpr FieldMetadata_GpuId kGpuId{};
+  void set_gpu_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_GpuId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FrequencyKhz =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GenericGpuFrequencyEvent>;
+
+  static constexpr FieldMetadata_FrequencyKhz kFrequencyKhz{};
+  void set_frequency_khz(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_FrequencyKhz::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -167133,13 +163687,90 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class GpuCounterEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+class InternedGpuCounterDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  InternedGpuCounterDescriptor_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit InternedGpuCounterDescriptor_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit InternedGpuCounterDescriptor_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_iid() const { return at<1>().valid(); }
+  uint64_t iid() const { return at<1>().as_uint64(); }
+  bool has_counter_descriptor() const { return at<2>().valid(); }
+  ::protozero::ConstBytes counter_descriptor() const { return at<2>().as_bytes(); }
+  bool has_gpu_id() const { return at<3>().valid(); }
+  int32_t gpu_id() const { return at<3>().as_int32(); }
+};
+
+class InternedGpuCounterDescriptor : public ::protozero::Message {
+ public:
+  using Decoder = InternedGpuCounterDescriptor_Decoder;
+  enum : int32_t {
+    kIidFieldNumber = 1,
+    kCounterDescriptorFieldNumber = 2,
+    kGpuIdFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.InternedGpuCounterDescriptor"; }
+
+
+  using FieldMetadata_Iid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      InternedGpuCounterDescriptor>;
+
+  static constexpr FieldMetadata_Iid kIid{};
+  void set_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_CounterDescriptor =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuCounterDescriptor,
+      InternedGpuCounterDescriptor>;
+
+  static constexpr FieldMetadata_CounterDescriptor kCounterDescriptor{};
+  template <typename T = GpuCounterDescriptor> T* set_counter_descriptor() {
+    return BeginNestedMessage<T>(2);
+  }
+
+
+  using FieldMetadata_GpuId =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      InternedGpuCounterDescriptor>;
+
+  static constexpr FieldMetadata_GpuId kGpuId{};
+  void set_gpu_id(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_GpuId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class GpuCounterEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
   GpuCounterEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit GpuCounterEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
   explicit GpuCounterEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
   bool has_counter_descriptor() const { return at<1>().valid(); }
   ::protozero::ConstBytes counter_descriptor() const { return at<1>().as_bytes(); }
+  bool has_counter_descriptor_iid() const { return at<4>().valid(); }
+  uint64_t counter_descriptor_iid() const { return at<4>().as_uint64(); }
   bool has_counters() const { return at<2>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> counters() const { return GetRepeated<::protozero::ConstBytes>(2); }
   bool has_gpu_id() const { return at<3>().valid(); }
@@ -167151,6 +163782,7 @@ class GpuCounterEvent : public ::protozero::Message {
   using Decoder = GpuCounterEvent_Decoder;
   enum : int32_t {
     kCounterDescriptorFieldNumber = 1,
+    kCounterDescriptorIidFieldNumber = 4,
     kCountersFieldNumber = 2,
     kGpuIdFieldNumber = 3,
   };
@@ -167172,6 +163804,24 @@ class GpuCounterEvent : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_CounterDescriptorIid =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuCounterEvent>;
+
+  static constexpr FieldMetadata_CounterDescriptorIid kCounterDescriptorIid{};
+  void set_counter_descriptor_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_CounterDescriptorIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_Counters =
     ::protozero::proto_utils::FieldMetadata<
       2,
@@ -167461,6 +164111,109 @@ class GpuLog : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/gpu/gpu_mem_event.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_GPU_GPU_MEM_EVENT_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_GPU_GPU_MEM_EVENT_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class GpuMemTotalEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  GpuMemTotalEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuMemTotalEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuMemTotalEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_gpu_id() const { return at<1>().valid(); }
+  uint32_t gpu_id() const { return at<1>().as_uint32(); }
+  bool has_pid() const { return at<2>().valid(); }
+  uint32_t pid() const { return at<2>().as_uint32(); }
+  bool has_size() const { return at<3>().valid(); }
+  uint64_t size() const { return at<3>().as_uint64(); }
+};
+
+class GpuMemTotalEvent : public ::protozero::Message {
+ public:
+  using Decoder = GpuMemTotalEvent_Decoder;
+  enum : int32_t {
+    kGpuIdFieldNumber = 1,
+    kPidFieldNumber = 2,
+    kSizeFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuMemTotalEvent"; }
+
+
+  using FieldMetadata_GpuId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuMemTotalEvent>;
+
+  static constexpr FieldMetadata_GpuId kGpuId{};
+  void set_gpu_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_GpuId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Pid =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuMemTotalEvent>;
+
+  static constexpr FieldMetadata_Pid kPid{};
+  void set_pid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Size =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuMemTotalEvent>;
+
+  static constexpr FieldMetadata_Size kSize{};
+  void set_size(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Size::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -167483,6 +164236,9 @@ class GpuLog : public ::protozero::Message {
 namespace perfetto {
 namespace protos {
 namespace pbzero {
+class GpuRenderStageEvent_ComputeKernelLaunch;
+class GpuRenderStageEvent_Dim3;
+class GpuRenderStageEvent_ExtraComputeArg;
 class GpuRenderStageEvent_ExtraData;
 class GpuRenderStageEvent_Specifications;
 class GpuRenderStageEvent_Specifications_ContextSpec;
@@ -167538,13 +164294,15 @@ enum Api : int32_t {
   OPEN_GL = 1,
   VULKAN = 2,
   OPEN_CL = 3,
+  CUDA = 4,
+  HIP = 5,
 };
 } // namespace perfetto_pbzero_enum_InternedGraphicsContext
 using InternedGraphicsContext_Api = perfetto_pbzero_enum_InternedGraphicsContext::Api;
 
 
 constexpr InternedGraphicsContext_Api InternedGraphicsContext_Api_MIN = InternedGraphicsContext_Api::UNDEFINED;
-constexpr InternedGraphicsContext_Api InternedGraphicsContext_Api_MAX = InternedGraphicsContext_Api::OPEN_CL;
+constexpr InternedGraphicsContext_Api InternedGraphicsContext_Api_MAX = InternedGraphicsContext_Api::HIP;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
@@ -167561,10 +164319,215 @@ const char* InternedGraphicsContext_Api_Name(::perfetto::protos::pbzero::Interne
 
   case ::perfetto::protos::pbzero::InternedGraphicsContext_Api::OPEN_CL:
     return "OPEN_CL";
+
+  case ::perfetto::protos::pbzero::InternedGraphicsContext_Api::CUDA:
+    return "CUDA";
+
+  case ::perfetto::protos::pbzero::InternedGraphicsContext_Api::HIP:
+    return "HIP";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
+class InternedComputeArgName_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  InternedComputeArgName_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit InternedComputeArgName_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit InternedComputeArgName_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_iid() const { return at<1>().valid(); }
+  uint64_t iid() const { return at<1>().as_uint64(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+};
+
+class InternedComputeArgName : public ::protozero::Message {
+ public:
+  using Decoder = InternedComputeArgName_Decoder;
+  enum : int32_t {
+    kIidFieldNumber = 1,
+    kNameFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.InternedComputeArgName"; }
+
+
+  using FieldMetadata_Iid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      InternedComputeArgName>;
+
+  static constexpr FieldMetadata_Iid kIid{};
+  void set_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      InternedComputeArgName>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class InternedComputeKernel_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+ public:
+  InternedComputeKernel_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit InternedComputeKernel_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit InternedComputeKernel_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_iid() const { return at<1>().valid(); }
+  uint64_t iid() const { return at<1>().as_uint64(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+  bool has_demangled_name() const { return at<3>().valid(); }
+  ::protozero::ConstChars demangled_name() const { return at<3>().as_string(); }
+  bool has_arch() const { return at<4>().valid(); }
+  ::protozero::ConstChars arch() const { return at<4>().as_string(); }
+  bool has_args() const { return at<5>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> args() const { return GetRepeated<::protozero::ConstBytes>(5); }
+};
+
+class InternedComputeKernel : public ::protozero::Message {
+ public:
+  using Decoder = InternedComputeKernel_Decoder;
+  enum : int32_t {
+    kIidFieldNumber = 1,
+    kNameFieldNumber = 2,
+    kDemangledNameFieldNumber = 3,
+    kArchFieldNumber = 4,
+    kArgsFieldNumber = 5,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.InternedComputeKernel"; }
+
+
+  using FieldMetadata_Iid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      InternedComputeKernel>;
+
+  static constexpr FieldMetadata_Iid kIid{};
+  void set_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      InternedComputeKernel>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_DemangledName =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      InternedComputeKernel>;
+
+  static constexpr FieldMetadata_DemangledName kDemangledName{};
+  void set_demangled_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_DemangledName::kFieldId, data, size);
+  }
+  void set_demangled_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_DemangledName::kFieldId, chars.data, chars.size);
+  }
+  void set_demangled_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_DemangledName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Arch =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      InternedComputeKernel>;
+
+  static constexpr FieldMetadata_Arch kArch{};
+  void set_arch(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Arch::kFieldId, data, size);
+  }
+  void set_arch(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Arch::kFieldId, chars.data, chars.size);
+  }
+  void set_arch(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Arch::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Args =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuRenderStageEvent_ExtraComputeArg,
+      InternedComputeKernel>;
+
+  static constexpr FieldMetadata_Args kArgs{};
+  template <typename T = GpuRenderStageEvent_ExtraComputeArg> T* add_args() {
+    return BeginNestedMessage<T>(5);
+  }
+
+};
+
 class InternedGpuRenderStageSpecification_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
   InternedGpuRenderStageSpecification_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -167717,6 +164680,8 @@ class InternedGraphicsContext : public ::protozero::Message {
   static inline const Api OPEN_GL = Api::OPEN_GL;
   static inline const Api VULKAN = Api::VULKAN;
   static inline const Api OPEN_CL = Api::OPEN_CL;
+  static inline const Api CUDA = Api::CUDA;
+  static inline const Api HIP = Api::HIP;
 
   using FieldMetadata_Iid =
     ::protozero::proto_utils::FieldMetadata<
@@ -167804,6 +164769,16 @@ class GpuRenderStageEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_
   ::protozero::RepeatedFieldIterator<uint64_t> render_subpass_index_mask() const { return GetRepeated<uint64_t>(15); }
   bool has_command_buffer_handle() const { return at<12>().valid(); }
   uint64_t command_buffer_handle() const { return at<12>().as_uint64(); }
+  bool has_name() const { return at<17>().valid(); }
+  ::protozero::ConstChars name() const { return at<17>().as_string(); }
+  bool has_name_iid() const { return at<20>().valid(); }
+  uint64_t name_iid() const { return at<20>().as_uint64(); }
+  bool has_event_wait_ids() const { return at<18>().valid(); }
+  ::protozero::RepeatedFieldIterator<uint64_t> event_wait_ids() const { return GetRepeated<uint64_t>(18); }
+  bool has_kernel_iid() const { return at<19>().valid(); }
+  uint64_t kernel_iid() const { return at<19>().as_uint64(); }
+  bool has_launch() const { return at<21>().valid(); }
+  ::protozero::ConstBytes launch() const { return at<21>().as_bytes(); }
   bool has_specifications() const { return at<7>().valid(); }
   ::protozero::ConstBytes specifications() const { return at<7>().as_bytes(); }
   bool has_hw_queue_id() const { return at<3>().valid(); }
@@ -167829,6 +164804,11 @@ class GpuRenderStageEvent : public ::protozero::Message {
     kRenderPassInstanceIdFieldNumber = 16,
     kRenderSubpassIndexMaskFieldNumber = 15,
     kCommandBufferHandleFieldNumber = 12,
+    kNameFieldNumber = 17,
+    kNameIidFieldNumber = 20,
+    kEventWaitIdsFieldNumber = 18,
+    kKernelIidFieldNumber = 19,
+    kLaunchFieldNumber = 21,
     kSpecificationsFieldNumber = 7,
     kHwQueueIdFieldNumber = 3,
     kStageIdFieldNumber = 4,
@@ -167836,6 +164816,9 @@ class GpuRenderStageEvent : public ::protozero::Message {
   static constexpr const char* GetName() { return ".perfetto.protos.GpuRenderStageEvent"; }
 
   using ExtraData = ::perfetto::protos::pbzero::GpuRenderStageEvent_ExtraData;
+  using Dim3 = ::perfetto::protos::pbzero::GpuRenderStageEvent_Dim3;
+  using ExtraComputeArg = ::perfetto::protos::pbzero::GpuRenderStageEvent_ExtraComputeArg;
+  using ComputeKernelLaunch = ::perfetto::protos::pbzero::GpuRenderStageEvent_ComputeKernelLaunch;
   using Specifications = ::perfetto::protos::pbzero::GpuRenderStageEvent_Specifications;
 
   using FieldMetadata_EventId =
@@ -168068,6 +165051,98 @@ class GpuRenderStageEvent : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      17,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuRenderStageEvent>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NameIid =
+    ::protozero::proto_utils::FieldMetadata<
+      20,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuRenderStageEvent>;
+
+  static constexpr FieldMetadata_NameIid kNameIid{};
+  void set_name_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NameIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_EventWaitIds =
+    ::protozero::proto_utils::FieldMetadata<
+      18,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuRenderStageEvent>;
+
+  static constexpr FieldMetadata_EventWaitIds kEventWaitIds{};
+  void add_event_wait_ids(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_EventWaitIds::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_KernelIid =
+    ::protozero::proto_utils::FieldMetadata<
+      19,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuRenderStageEvent>;
+
+  static constexpr FieldMetadata_KernelIid kKernelIid{};
+  void set_kernel_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_KernelIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Launch =
+    ::protozero::proto_utils::FieldMetadata<
+      21,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuRenderStageEvent_ComputeKernelLaunch,
+      GpuRenderStageEvent>;
+
+  static constexpr FieldMetadata_Launch kLaunch{};
+  template <typename T = GpuRenderStageEvent_ComputeKernelLaunch> T* set_launch() {
+    return BeginNestedMessage<T>(21);
+  }
+
+
   using FieldMetadata_Specifications =
     ::protozero::proto_utils::FieldMetadata<
       7,
@@ -168316,6 +165391,327 @@ class GpuRenderStageEvent_Specifications_ContextSpec : public ::protozero::Messa
   }
 };
 
+class GpuRenderStageEvent_ComputeKernelLaunch_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  GpuRenderStageEvent_ComputeKernelLaunch_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuRenderStageEvent_ComputeKernelLaunch_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuRenderStageEvent_ComputeKernelLaunch_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_grid_size() const { return at<1>().valid(); }
+  ::protozero::ConstBytes grid_size() const { return at<1>().as_bytes(); }
+  bool has_workgroup_size() const { return at<2>().valid(); }
+  ::protozero::ConstBytes workgroup_size() const { return at<2>().as_bytes(); }
+  bool has_args() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> args() const { return GetRepeated<::protozero::ConstBytes>(3); }
+};
+
+class GpuRenderStageEvent_ComputeKernelLaunch : public ::protozero::Message {
+ public:
+  using Decoder = GpuRenderStageEvent_ComputeKernelLaunch_Decoder;
+  enum : int32_t {
+    kGridSizeFieldNumber = 1,
+    kWorkgroupSizeFieldNumber = 2,
+    kArgsFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuRenderStageEvent.ComputeKernelLaunch"; }
+
+
+  using FieldMetadata_GridSize =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuRenderStageEvent_Dim3,
+      GpuRenderStageEvent_ComputeKernelLaunch>;
+
+  static constexpr FieldMetadata_GridSize kGridSize{};
+  template <typename T = GpuRenderStageEvent_Dim3> T* set_grid_size() {
+    return BeginNestedMessage<T>(1);
+  }
+
+
+  using FieldMetadata_WorkgroupSize =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuRenderStageEvent_Dim3,
+      GpuRenderStageEvent_ComputeKernelLaunch>;
+
+  static constexpr FieldMetadata_WorkgroupSize kWorkgroupSize{};
+  template <typename T = GpuRenderStageEvent_Dim3> T* set_workgroup_size() {
+    return BeginNestedMessage<T>(2);
+  }
+
+
+  using FieldMetadata_Args =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuRenderStageEvent_ExtraComputeArg,
+      GpuRenderStageEvent_ComputeKernelLaunch>;
+
+  static constexpr FieldMetadata_Args kArgs{};
+  template <typename T = GpuRenderStageEvent_ExtraComputeArg> T* add_args() {
+    return BeginNestedMessage<T>(3);
+  }
+
+};
+
+class GpuRenderStageEvent_ExtraComputeArg_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
+ public:
+  GpuRenderStageEvent_ExtraComputeArg_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuRenderStageEvent_ExtraComputeArg_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuRenderStageEvent_ExtraComputeArg_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_name_iid() const { return at<1>().valid(); }
+  uint64_t name_iid() const { return at<1>().as_uint64(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+  bool has_int_value() const { return at<3>().valid(); }
+  int64_t int_value() const { return at<3>().as_int64(); }
+  bool has_uint_value() const { return at<4>().valid(); }
+  uint64_t uint_value() const { return at<4>().as_uint64(); }
+  bool has_double_value() const { return at<5>().valid(); }
+  double double_value() const { return at<5>().as_double(); }
+  bool has_string_value() const { return at<6>().valid(); }
+  ::protozero::ConstChars string_value() const { return at<6>().as_string(); }
+  bool has_string_value_iid() const { return at<7>().valid(); }
+  uint64_t string_value_iid() const { return at<7>().as_uint64(); }
+};
+
+class GpuRenderStageEvent_ExtraComputeArg : public ::protozero::Message {
+ public:
+  using Decoder = GpuRenderStageEvent_ExtraComputeArg_Decoder;
+  enum : int32_t {
+    kNameIidFieldNumber = 1,
+    kNameFieldNumber = 2,
+    kIntValueFieldNumber = 3,
+    kUintValueFieldNumber = 4,
+    kDoubleValueFieldNumber = 5,
+    kStringValueFieldNumber = 6,
+    kStringValueIidFieldNumber = 7,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuRenderStageEvent.ExtraComputeArg"; }
+
+
+  using FieldMetadata_NameIid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuRenderStageEvent_ExtraComputeArg>;
+
+  static constexpr FieldMetadata_NameIid kNameIid{};
+  void set_name_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NameIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuRenderStageEvent_ExtraComputeArg>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_IntValue =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      GpuRenderStageEvent_ExtraComputeArg>;
+
+  static constexpr FieldMetadata_IntValue kIntValue{};
+  void set_int_value(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IntValue::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_UintValue =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuRenderStageEvent_ExtraComputeArg>;
+
+  static constexpr FieldMetadata_UintValue kUintValue{};
+  void set_uint_value(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_UintValue::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_DoubleValue =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kDouble,
+      double,
+      GpuRenderStageEvent_ExtraComputeArg>;
+
+  static constexpr FieldMetadata_DoubleValue kDoubleValue{};
+  void set_double_value(double value) {
+    static constexpr uint32_t field_id = FieldMetadata_DoubleValue::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kDouble>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_StringValue =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuRenderStageEvent_ExtraComputeArg>;
+
+  static constexpr FieldMetadata_StringValue kStringValue{};
+  void set_string_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_StringValue::kFieldId, data, size);
+  }
+  void set_string_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_StringValue::kFieldId, chars.data, chars.size);
+  }
+  void set_string_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_StringValue::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_StringValueIid =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      GpuRenderStageEvent_ExtraComputeArg>;
+
+  static constexpr FieldMetadata_StringValueIid kStringValueIid{};
+  void set_string_value_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_StringValueIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class GpuRenderStageEvent_Dim3_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  GpuRenderStageEvent_Dim3_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuRenderStageEvent_Dim3_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuRenderStageEvent_Dim3_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_x() const { return at<1>().valid(); }
+  uint32_t x() const { return at<1>().as_uint32(); }
+  bool has_y() const { return at<2>().valid(); }
+  uint32_t y() const { return at<2>().as_uint32(); }
+  bool has_z() const { return at<3>().valid(); }
+  uint32_t z() const { return at<3>().as_uint32(); }
+};
+
+class GpuRenderStageEvent_Dim3 : public ::protozero::Message {
+ public:
+  using Decoder = GpuRenderStageEvent_Dim3_Decoder;
+  enum : int32_t {
+    kXFieldNumber = 1,
+    kYFieldNumber = 2,
+    kZFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuRenderStageEvent.Dim3"; }
+
+
+  using FieldMetadata_X =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuRenderStageEvent_Dim3>;
+
+  static constexpr FieldMetadata_X kX{};
+  void set_x(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_X::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Y =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuRenderStageEvent_Dim3>;
+
+  static constexpr FieldMetadata_Y kY{};
+  void set_y(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Y::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Z =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      GpuRenderStageEvent_Dim3>;
+
+  static constexpr FieldMetadata_Z kZ{};
+  void set_z(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Z::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 class GpuRenderStageEvent_ExtraData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
   GpuRenderStageEvent_ExtraData_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -169348,382 +166744,11 @@ class VulkanMemoryEventAnnotation : public ::protozero::Message {
 } // Namespace.
 } // Namespace.
 #endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/profiling/deobfuscation.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_DEOBFUSCATION_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_DEOBFUSCATION_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class ObfuscatedClass;
-class ObfuscatedMember;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class DeobfuscationMapping_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
- public:
-  DeobfuscationMapping_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit DeobfuscationMapping_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit DeobfuscationMapping_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_package_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars package_name() const { return at<1>().as_string(); }
-  bool has_version_code() const { return at<2>().valid(); }
-  int64_t version_code() const { return at<2>().as_int64(); }
-  bool has_obfuscated_classes() const { return at<3>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> obfuscated_classes() const { return GetRepeated<::protozero::ConstBytes>(3); }
-};
-
-class DeobfuscationMapping : public ::protozero::Message {
- public:
-  using Decoder = DeobfuscationMapping_Decoder;
-  enum : int32_t {
-    kPackageNameFieldNumber = 1,
-    kVersionCodeFieldNumber = 2,
-    kObfuscatedClassesFieldNumber = 3,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.DeobfuscationMapping"; }
-
-
-  using FieldMetadata_PackageName =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      DeobfuscationMapping>;
-
-  static constexpr FieldMetadata_PackageName kPackageName{};
-  void set_package_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_PackageName::kFieldId, data, size);
-  }
-  void set_package_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_PackageName::kFieldId, chars.data, chars.size);
-  }
-  void set_package_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_PackageName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_VersionCode =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      DeobfuscationMapping>;
-
-  static constexpr FieldMetadata_VersionCode kVersionCode{};
-  void set_version_code(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_VersionCode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ObfuscatedClasses =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ObfuscatedClass,
-      DeobfuscationMapping>;
-
-  static constexpr FieldMetadata_ObfuscatedClasses kObfuscatedClasses{};
-  template <typename T = ObfuscatedClass> T* add_obfuscated_classes() {
-    return BeginNestedMessage<T>(3);
-  }
-
-};
-
-class ObfuscatedClass_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  ObfuscatedClass_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ObfuscatedClass_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ObfuscatedClass_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_obfuscated_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars obfuscated_name() const { return at<1>().as_string(); }
-  bool has_deobfuscated_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars deobfuscated_name() const { return at<2>().as_string(); }
-  bool has_obfuscated_members() const { return at<3>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> obfuscated_members() const { return GetRepeated<::protozero::ConstBytes>(3); }
-  bool has_obfuscated_methods() const { return at<4>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> obfuscated_methods() const { return GetRepeated<::protozero::ConstBytes>(4); }
-};
-
-class ObfuscatedClass : public ::protozero::Message {
- public:
-  using Decoder = ObfuscatedClass_Decoder;
-  enum : int32_t {
-    kObfuscatedNameFieldNumber = 1,
-    kDeobfuscatedNameFieldNumber = 2,
-    kObfuscatedMembersFieldNumber = 3,
-    kObfuscatedMethodsFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ObfuscatedClass"; }
-
-
-  using FieldMetadata_ObfuscatedName =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      ObfuscatedClass>;
-
-  static constexpr FieldMetadata_ObfuscatedName kObfuscatedName{};
-  void set_obfuscated_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, data, size);
-  }
-  void set_obfuscated_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, chars.data, chars.size);
-  }
-  void set_obfuscated_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DeobfuscatedName =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      ObfuscatedClass>;
-
-  static constexpr FieldMetadata_DeobfuscatedName kDeobfuscatedName{};
-  void set_deobfuscated_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, data, size);
-  }
-  void set_deobfuscated_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, chars.data, chars.size);
-  }
-  void set_deobfuscated_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_DeobfuscatedName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ObfuscatedMembers =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ObfuscatedMember,
-      ObfuscatedClass>;
-
-  static constexpr FieldMetadata_ObfuscatedMembers kObfuscatedMembers{};
-  template <typename T = ObfuscatedMember> T* add_obfuscated_members() {
-    return BeginNestedMessage<T>(3);
-  }
-
-
-  using FieldMetadata_ObfuscatedMethods =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ObfuscatedMember,
-      ObfuscatedClass>;
-
-  static constexpr FieldMetadata_ObfuscatedMethods kObfuscatedMethods{};
-  template <typename T = ObfuscatedMember> T* add_obfuscated_methods() {
-    return BeginNestedMessage<T>(4);
-  }
-
-};
-
-class ObfuscatedMember_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
- public:
-  ObfuscatedMember_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ObfuscatedMember_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ObfuscatedMember_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_obfuscated_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars obfuscated_name() const { return at<1>().as_string(); }
-  bool has_deobfuscated_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars deobfuscated_name() const { return at<2>().as_string(); }
-  bool has_obfuscated_line_start() const { return at<3>().valid(); }
-  uint32_t obfuscated_line_start() const { return at<3>().as_uint32(); }
-  bool has_obfuscated_line_end() const { return at<4>().valid(); }
-  uint32_t obfuscated_line_end() const { return at<4>().as_uint32(); }
-  bool has_source_line_start() const { return at<5>().valid(); }
-  uint32_t source_line_start() const { return at<5>().as_uint32(); }
-  bool has_source_line_end() const { return at<6>().valid(); }
-  uint32_t source_line_end() const { return at<6>().as_uint32(); }
-};
-
-class ObfuscatedMember : public ::protozero::Message {
- public:
-  using Decoder = ObfuscatedMember_Decoder;
-  enum : int32_t {
-    kObfuscatedNameFieldNumber = 1,
-    kDeobfuscatedNameFieldNumber = 2,
-    kObfuscatedLineStartFieldNumber = 3,
-    kObfuscatedLineEndFieldNumber = 4,
-    kSourceLineStartFieldNumber = 5,
-    kSourceLineEndFieldNumber = 6,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ObfuscatedMember"; }
-
-
-  using FieldMetadata_ObfuscatedName =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      ObfuscatedMember>;
-
-  static constexpr FieldMetadata_ObfuscatedName kObfuscatedName{};
-  void set_obfuscated_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, data, size);
-  }
-  void set_obfuscated_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, chars.data, chars.size);
-  }
-  void set_obfuscated_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DeobfuscatedName =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      ObfuscatedMember>;
-
-  static constexpr FieldMetadata_DeobfuscatedName kDeobfuscatedName{};
-  void set_deobfuscated_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, data, size);
-  }
-  void set_deobfuscated_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, chars.data, chars.size);
-  }
-  void set_deobfuscated_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_DeobfuscatedName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ObfuscatedLineStart =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ObfuscatedMember>;
-
-  static constexpr FieldMetadata_ObfuscatedLineStart kObfuscatedLineStart{};
-  void set_obfuscated_line_start(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedLineStart::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ObfuscatedLineEnd =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ObfuscatedMember>;
-
-  static constexpr FieldMetadata_ObfuscatedLineEnd kObfuscatedLineEnd{};
-  void set_obfuscated_line_end(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedLineEnd::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SourceLineStart =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ObfuscatedMember>;
-
-  static constexpr FieldMetadata_SourceLineStart kSourceLineStart{};
-  void set_source_line_start(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SourceLineStart::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SourceLineEnd =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ObfuscatedMember>;
-
-  static constexpr FieldMetadata_SourceLineEnd kSourceLineEnd{};
-  void set_source_line_end(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SourceLineEnd::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/profiling/heap_graph.pbzero.h
+// gen_amalgamated begin header: gen/protos/perfetto/trace/profiling/art_process_metadata.pbzero.h
 // Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
 
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_HEAP_GRAPH_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_HEAP_GRAPH_PROTO_H_
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_ART_PROCESS_METADATA_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_ART_PROCESS_METADATA_PROTO_H_
 
 #include <stddef.h>
 #include <stdint.h>
@@ -169733,27 +166758,12 @@ class ObfuscatedMember : public ::protozero::Message {
 // gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
 // gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-// gen_amalgamated expanded: #include "protos/perfetto/trace/profiling/deobfuscation.pbzero.h"
 
 namespace perfetto {
 namespace protos {
 namespace pbzero {
-class HeapGraphObject;
-class HeapGraphRoot;
-class HeapGraphType;
-class InternedString;
-namespace perfetto_pbzero_enum_HeapGraphObject {
-enum HeapType : int32_t;
-}  // namespace perfetto_pbzero_enum_HeapGraphObject
-using HeapGraphObject_HeapType = perfetto_pbzero_enum_HeapGraphObject::HeapType;
-namespace perfetto_pbzero_enum_HeapGraphRoot {
-enum Type : int32_t;
-}  // namespace perfetto_pbzero_enum_HeapGraphRoot
-using HeapGraphRoot_Type = perfetto_pbzero_enum_HeapGraphRoot::Type;
-namespace perfetto_pbzero_enum_HeapGraphType {
-enum Kind : int32_t;
-}  // namespace perfetto_pbzero_enum_HeapGraphType
-using HeapGraphType_Kind = perfetto_pbzero_enum_HeapGraphType::Kind;
+class JavaFrame;
+class JavaStack;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -169762,218 +166772,46 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-namespace perfetto_pbzero_enum_HeapGraphObject {
-enum HeapType : int32_t {
-  HEAP_TYPE_UNKNOWN = 0,
-  HEAP_TYPE_APP = 1,
-  HEAP_TYPE_ZYGOTE = 2,
-  HEAP_TYPE_BOOT_IMAGE = 3,
-};
-} // namespace perfetto_pbzero_enum_HeapGraphObject
-using HeapGraphObject_HeapType = perfetto_pbzero_enum_HeapGraphObject::HeapType;
-
-
-constexpr HeapGraphObject_HeapType HeapGraphObject_HeapType_MIN = HeapGraphObject_HeapType::HEAP_TYPE_UNKNOWN;
-constexpr HeapGraphObject_HeapType HeapGraphObject_HeapType_MAX = HeapGraphObject_HeapType::HEAP_TYPE_BOOT_IMAGE;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* HeapGraphObject_HeapType_Name(::perfetto::protos::pbzero::HeapGraphObject_HeapType value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::HeapGraphObject_HeapType::HEAP_TYPE_UNKNOWN:
-    return "HEAP_TYPE_UNKNOWN";
-
-  case ::perfetto::protos::pbzero::HeapGraphObject_HeapType::HEAP_TYPE_APP:
-    return "HEAP_TYPE_APP";
-
-  case ::perfetto::protos::pbzero::HeapGraphObject_HeapType::HEAP_TYPE_ZYGOTE:
-    return "HEAP_TYPE_ZYGOTE";
-
-  case ::perfetto::protos::pbzero::HeapGraphObject_HeapType::HEAP_TYPE_BOOT_IMAGE:
-    return "HEAP_TYPE_BOOT_IMAGE";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_HeapGraphType {
-enum Kind : int32_t {
-  KIND_UNKNOWN = 0,
-  KIND_NORMAL = 1,
-  KIND_NOREFERENCES = 2,
-  KIND_STRING = 3,
-  KIND_ARRAY = 4,
-  KIND_CLASS = 5,
-  KIND_CLASSLOADER = 6,
-  KIND_DEXCACHE = 7,
-  KIND_SOFT_REFERENCE = 8,
-  KIND_WEAK_REFERENCE = 9,
-  KIND_FINALIZER_REFERENCE = 10,
-  KIND_PHANTOM_REFERENCE = 11,
-};
-} // namespace perfetto_pbzero_enum_HeapGraphType
-using HeapGraphType_Kind = perfetto_pbzero_enum_HeapGraphType::Kind;
-
-
-constexpr HeapGraphType_Kind HeapGraphType_Kind_MIN = HeapGraphType_Kind::KIND_UNKNOWN;
-constexpr HeapGraphType_Kind HeapGraphType_Kind_MAX = HeapGraphType_Kind::KIND_PHANTOM_REFERENCE;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* HeapGraphType_Kind_Name(::perfetto::protos::pbzero::HeapGraphType_Kind value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_UNKNOWN:
-    return "KIND_UNKNOWN";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_NORMAL:
-    return "KIND_NORMAL";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_NOREFERENCES:
-    return "KIND_NOREFERENCES";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_STRING:
-    return "KIND_STRING";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_ARRAY:
-    return "KIND_ARRAY";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_CLASS:
-    return "KIND_CLASS";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_CLASSLOADER:
-    return "KIND_CLASSLOADER";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_DEXCACHE:
-    return "KIND_DEXCACHE";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_SOFT_REFERENCE:
-    return "KIND_SOFT_REFERENCE";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_WEAK_REFERENCE:
-    return "KIND_WEAK_REFERENCE";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_FINALIZER_REFERENCE:
-    return "KIND_FINALIZER_REFERENCE";
-
-  case ::perfetto::protos::pbzero::HeapGraphType_Kind::KIND_PHANTOM_REFERENCE:
-    return "KIND_PHANTOM_REFERENCE";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_HeapGraphRoot {
-enum Type : int32_t {
-  ROOT_UNKNOWN = 0,
-  ROOT_JNI_GLOBAL = 1,
-  ROOT_JNI_LOCAL = 2,
-  ROOT_JAVA_FRAME = 3,
-  ROOT_NATIVE_STACK = 4,
-  ROOT_STICKY_CLASS = 5,
-  ROOT_THREAD_BLOCK = 6,
-  ROOT_MONITOR_USED = 7,
-  ROOT_THREAD_OBJECT = 8,
-  ROOT_INTERNED_STRING = 9,
-  ROOT_FINALIZING = 10,
-  ROOT_DEBUGGER = 11,
-  ROOT_REFERENCE_CLEANUP = 12,
-  ROOT_VM_INTERNAL = 13,
-  ROOT_JNI_MONITOR = 14,
-};
-} // namespace perfetto_pbzero_enum_HeapGraphRoot
-using HeapGraphRoot_Type = perfetto_pbzero_enum_HeapGraphRoot::Type;
-
-
-constexpr HeapGraphRoot_Type HeapGraphRoot_Type_MIN = HeapGraphRoot_Type::ROOT_UNKNOWN;
-constexpr HeapGraphRoot_Type HeapGraphRoot_Type_MAX = HeapGraphRoot_Type::ROOT_JNI_MONITOR;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* HeapGraphRoot_Type_Name(::perfetto::protos::pbzero::HeapGraphRoot_Type value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_UNKNOWN:
-    return "ROOT_UNKNOWN";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_JNI_GLOBAL:
-    return "ROOT_JNI_GLOBAL";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_JNI_LOCAL:
-    return "ROOT_JNI_LOCAL";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_JAVA_FRAME:
-    return "ROOT_JAVA_FRAME";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_NATIVE_STACK:
-    return "ROOT_NATIVE_STACK";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_STICKY_CLASS:
-    return "ROOT_STICKY_CLASS";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_THREAD_BLOCK:
-    return "ROOT_THREAD_BLOCK";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_MONITOR_USED:
-    return "ROOT_MONITOR_USED";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_THREAD_OBJECT:
-    return "ROOT_THREAD_OBJECT";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_INTERNED_STRING:
-    return "ROOT_INTERNED_STRING";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_FINALIZING:
-    return "ROOT_FINALIZING";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_DEBUGGER:
-    return "ROOT_DEBUGGER";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_REFERENCE_CLEANUP:
-    return "ROOT_REFERENCE_CLEANUP";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_VM_INTERNAL:
-    return "ROOT_VM_INTERNAL";
-
-  case ::perfetto::protos::pbzero::HeapGraphRoot_Type::ROOT_JNI_MONITOR:
-    return "ROOT_JNI_MONITOR";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class HeapGraph_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
+class ArtProcessMetadata_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
  public:
-  HeapGraph_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit HeapGraph_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit HeapGraph_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  ArtProcessMetadata_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit ArtProcessMetadata_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit ArtProcessMetadata_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
   bool has_pid() const { return at<1>().valid(); }
   int32_t pid() const { return at<1>().as_int32(); }
-  bool has_objects() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> objects() const { return GetRepeated<::protozero::ConstBytes>(2); }
-  bool has_roots() const { return at<7>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> roots() const { return GetRepeated<::protozero::ConstBytes>(7); }
-  bool has_types() const { return at<9>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> types() const { return GetRepeated<::protozero::ConstBytes>(9); }
-  bool has_field_names() const { return at<4>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> field_names() const { return GetRepeated<::protozero::ConstBytes>(4); }
-  bool has_location_names() const { return at<8>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> location_names() const { return GetRepeated<::protozero::ConstBytes>(8); }
-  bool has_continued() const { return at<5>().valid(); }
-  bool continued() const { return at<5>().as_bool(); }
-  bool has_index() const { return at<6>().valid(); }
-  uint64_t index() const { return at<6>().as_uint64(); }
-};
-
-class HeapGraph : public ::protozero::Message {
- public:
-  using Decoder = HeapGraph_Decoder;
+  bool has_uid() const { return at<2>().valid(); }
+  int32_t uid() const { return at<2>().as_int32(); }
+  bool has_process_name() const { return at<3>().valid(); }
+  ::protozero::ConstChars process_name() const { return at<3>().as_string(); }
+  bool has_package_name() const { return at<4>().valid(); }
+  ::protozero::ConstChars package_name() const { return at<4>().as_string(); }
+  bool has_oom_allocation_size() const { return at<5>().valid(); }
+  uint64_t oom_allocation_size() const { return at<5>().as_uint64(); }
+  bool has_oom_total_bytes_free() const { return at<6>().valid(); }
+  uint64_t oom_total_bytes_free() const { return at<6>().as_uint64(); }
+  bool has_oom_free_bytes_until_oom() const { return at<7>().valid(); }
+  uint64_t oom_free_bytes_until_oom() const { return at<7>().as_uint64(); }
+  bool has_oom_thread_java_stack() const { return at<8>().valid(); }
+  ::protozero::ConstBytes oom_thread_java_stack() const { return at<8>().as_bytes(); }
+  bool has_oom_error_msg() const { return at<9>().valid(); }
+  ::protozero::ConstChars oom_error_msg() const { return at<9>().as_string(); }
+};
+
+class ArtProcessMetadata : public ::protozero::Message {
+ public:
+  using Decoder = ArtProcessMetadata_Decoder;
   enum : int32_t {
     kPidFieldNumber = 1,
-    kObjectsFieldNumber = 2,
-    kRootsFieldNumber = 7,
-    kTypesFieldNumber = 9,
-    kFieldNamesFieldNumber = 4,
-    kLocationNamesFieldNumber = 8,
-    kContinuedFieldNumber = 5,
-    kIndexFieldNumber = 6,
+    kUidFieldNumber = 2,
+    kProcessNameFieldNumber = 3,
+    kPackageNameFieldNumber = 4,
+    kOomAllocationSizeFieldNumber = 5,
+    kOomTotalBytesFreeFieldNumber = 6,
+    kOomFreeBytesUntilOomFieldNumber = 7,
+    kOomThreadJavaStackFieldNumber = 8,
+    kOomErrorMsgFieldNumber = 9,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.HeapGraph"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.ArtProcessMetadata"; }
 
 
   using FieldMetadata_Pid =
@@ -169982,7 +166820,7 @@ class HeapGraph : public ::protozero::Message {
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kInt32,
       int32_t,
-      HeapGraph>;
+      ArtProcessMetadata>;
 
   static constexpr FieldMetadata_Pid kPid{};
   void set_pid(int32_t value) {
@@ -169994,232 +166832,83 @@ class HeapGraph : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Objects =
+  using FieldMetadata_Uid =
     ::protozero::proto_utils::FieldMetadata<
       2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      HeapGraphObject,
-      HeapGraph>;
-
-  static constexpr FieldMetadata_Objects kObjects{};
-  template <typename T = HeapGraphObject> T* add_objects() {
-    return BeginNestedMessage<T>(2);
-  }
-
-
-  using FieldMetadata_Roots =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      HeapGraphRoot,
-      HeapGraph>;
-
-  static constexpr FieldMetadata_Roots kRoots{};
-  template <typename T = HeapGraphRoot> T* add_roots() {
-    return BeginNestedMessage<T>(7);
-  }
-
-
-  using FieldMetadata_Types =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      HeapGraphType,
-      HeapGraph>;
-
-  static constexpr FieldMetadata_Types kTypes{};
-  template <typename T = HeapGraphType> T* add_types() {
-    return BeginNestedMessage<T>(9);
-  }
-
-
-  using FieldMetadata_FieldNames =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
-      HeapGraph>;
-
-  static constexpr FieldMetadata_FieldNames kFieldNames{};
-  template <typename T = InternedString> T* add_field_names() {
-    return BeginNestedMessage<T>(4);
-  }
-
-
-  using FieldMetadata_LocationNames =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
-      HeapGraph>;
-
-  static constexpr FieldMetadata_LocationNames kLocationNames{};
-  template <typename T = InternedString> T* add_location_names() {
-    return BeginNestedMessage<T>(8);
-  }
-
-
-  using FieldMetadata_Continued =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      HeapGraph>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_Continued kContinued{};
-  void set_continued(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_Continued::kFieldId;
+  static constexpr FieldMetadata_Uid kUid{};
+  void set_uid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Index =
+  using FieldMetadata_ProcessName =
     ::protozero::proto_utils::FieldMetadata<
-      6,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraph>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_Index kIndex{};
-  void set_index(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Index::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_ProcessName kProcessName{};
+  void set_process_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ProcessName::kFieldId, data, size);
   }
-};
-
-class HeapGraphObject_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
- public:
-  HeapGraphObject_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit HeapGraphObject_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit HeapGraphObject_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  uint64_t id() const { return at<1>().as_uint64(); }
-  bool has_id_delta() const { return at<7>().valid(); }
-  uint64_t id_delta() const { return at<7>().as_uint64(); }
-  bool has_type_id() const { return at<2>().valid(); }
-  uint64_t type_id() const { return at<2>().as_uint64(); }
-  bool has_self_size() const { return at<3>().valid(); }
-  uint64_t self_size() const { return at<3>().as_uint64(); }
-  bool has_reference_field_id_base() const { return at<6>().valid(); }
-  uint64_t reference_field_id_base() const { return at<6>().as_uint64(); }
-  bool has_reference_field_id() const { return at<4>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> reference_field_id(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(4, parse_error_ptr); }
-  bool has_reference_object_id() const { return at<5>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> reference_object_id(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(5, parse_error_ptr); }
-  bool has_native_allocation_registry_size_field() const { return at<8>().valid(); }
-  int64_t native_allocation_registry_size_field() const { return at<8>().as_int64(); }
-  bool has_heap_type_delta() const { return at<9>().valid(); }
-  int32_t heap_type_delta() const { return at<9>().as_int32(); }
-  bool has_runtime_internal_object_id() const { return at<10>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> runtime_internal_object_id(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(10, parse_error_ptr); }
-};
-
-class HeapGraphObject : public ::protozero::Message {
- public:
-  using Decoder = HeapGraphObject_Decoder;
-  enum : int32_t {
-    kIdFieldNumber = 1,
-    kIdDeltaFieldNumber = 7,
-    kTypeIdFieldNumber = 2,
-    kSelfSizeFieldNumber = 3,
-    kReferenceFieldIdBaseFieldNumber = 6,
-    kReferenceFieldIdFieldNumber = 4,
-    kReferenceObjectIdFieldNumber = 5,
-    kNativeAllocationRegistrySizeFieldFieldNumber = 8,
-    kHeapTypeDeltaFieldNumber = 9,
-    kRuntimeInternalObjectIdFieldNumber = 10,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.HeapGraphObject"; }
-
-
-  using HeapType = ::perfetto::protos::pbzero::HeapGraphObject_HeapType;
-  static inline const char* HeapType_Name(HeapType value) {
-    return ::perfetto::protos::pbzero::HeapGraphObject_HeapType_Name(value);
+  void set_process_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ProcessName::kFieldId, chars.data, chars.size);
   }
-  static inline const HeapType HEAP_TYPE_UNKNOWN = HeapType::HEAP_TYPE_UNKNOWN;
-  static inline const HeapType HEAP_TYPE_APP = HeapType::HEAP_TYPE_APP;
-  static inline const HeapType HEAP_TYPE_ZYGOTE = HeapType::HEAP_TYPE_ZYGOTE;
-  static inline const HeapType HEAP_TYPE_BOOT_IMAGE = HeapType::HEAP_TYPE_BOOT_IMAGE;
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphObject>;
-
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
+  void set_process_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ProcessName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_IdDelta =
+  using FieldMetadata_PackageName =
     ::protozero::proto_utils::FieldMetadata<
-      7,
+      4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphObject>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_IdDelta kIdDelta{};
-  void set_id_delta(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_IdDelta::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_PackageName kPackageName{};
+  void set_package_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_PackageName::kFieldId, data, size);
   }
-
-  using FieldMetadata_TypeId =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphObject>;
-
-  static constexpr FieldMetadata_TypeId kTypeId{};
-  void set_type_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TypeId::kFieldId;
+  void set_package_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_PackageName::kFieldId, chars.data, chars.size);
+  }
+  void set_package_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_PackageName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_SelfSize =
+  using FieldMetadata_OomAllocationSize =
     ::protozero::proto_utils::FieldMetadata<
-      3,
+      5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kUint64,
       uint64_t,
-      HeapGraphObject>;
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_SelfSize kSelfSize{};
-  void set_self_size(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SelfSize::kFieldId;
+  static constexpr FieldMetadata_OomAllocationSize kOomAllocationSize{};
+  void set_oom_allocation_size(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OomAllocationSize::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -170227,17 +166916,17 @@ class HeapGraphObject : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_ReferenceFieldIdBase =
+  using FieldMetadata_OomTotalBytesFree =
     ::protozero::proto_utils::FieldMetadata<
       6,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kUint64,
       uint64_t,
-      HeapGraphObject>;
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_ReferenceFieldIdBase kReferenceFieldIdBase{};
-  void set_reference_field_id_base(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ReferenceFieldIdBase::kFieldId;
+  static constexpr FieldMetadata_OomTotalBytesFree kOomTotalBytesFree{};
+  void set_oom_total_bytes_free(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OomTotalBytesFree::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -170245,358 +166934,554 @@ class HeapGraphObject : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_ReferenceFieldId =
+  using FieldMetadata_OomFreeBytesUntilOom =
     ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphObject>;
-
-  static constexpr FieldMetadata_ReferenceFieldId kReferenceFieldId{};
-  void set_reference_field_id(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_ReferenceFieldId::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
-  }
-
-  using FieldMetadata_ReferenceObjectId =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kUint64,
       uint64_t,
-      HeapGraphObject>;
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_ReferenceObjectId kReferenceObjectId{};
-  void set_reference_object_id(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_ReferenceObjectId::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
+  static constexpr FieldMetadata_OomFreeBytesUntilOom kOomFreeBytesUntilOom{};
+  void set_oom_free_bytes_until_oom(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_OomFreeBytesUntilOom::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_NativeAllocationRegistrySizeField =
+  using FieldMetadata_OomThreadJavaStack =
     ::protozero::proto_utils::FieldMetadata<
       8,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      HeapGraphObject>;
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      JavaStack,
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_NativeAllocationRegistrySizeField kNativeAllocationRegistrySizeField{};
-  void set_native_allocation_registry_size_field(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_NativeAllocationRegistrySizeField::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_OomThreadJavaStack kOomThreadJavaStack{};
+  template <typename T = JavaStack> T* set_oom_thread_java_stack() {
+    return BeginNestedMessage<T>(8);
   }
 
-  using FieldMetadata_HeapTypeDelta =
+
+  using FieldMetadata_OomErrorMsg =
     ::protozero::proto_utils::FieldMetadata<
       9,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      HeapGraphObject_HeapType,
-      HeapGraphObject>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ArtProcessMetadata>;
 
-  static constexpr FieldMetadata_HeapTypeDelta kHeapTypeDelta{};
-  void set_heap_type_delta(HeapGraphObject_HeapType value) {
-    static constexpr uint32_t field_id = FieldMetadata_HeapTypeDelta::kFieldId;
+  static constexpr FieldMetadata_OomErrorMsg kOomErrorMsg{};
+  void set_oom_error_msg(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_OomErrorMsg::kFieldId, data, size);
+  }
+  void set_oom_error_msg(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_OomErrorMsg::kFieldId, chars.data, chars.size);
+  }
+  void set_oom_error_msg(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_OomErrorMsg::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
+};
+
+class JavaStack_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  JavaStack_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit JavaStack_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit JavaStack_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_frames() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> frames() const { return GetRepeated<::protozero::ConstBytes>(1); }
+};
+
+class JavaStack : public ::protozero::Message {
+ public:
+  using Decoder = JavaStack_Decoder;
+  enum : int32_t {
+    kFramesFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.JavaStack"; }
 
-  using FieldMetadata_RuntimeInternalObjectId =
+
+  using FieldMetadata_Frames =
     ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphObject>;
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      JavaFrame,
+      JavaStack>;
 
-  static constexpr FieldMetadata_RuntimeInternalObjectId kRuntimeInternalObjectId{};
-  void set_runtime_internal_object_id(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_RuntimeInternalObjectId::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
+  static constexpr FieldMetadata_Frames kFrames{};
+  template <typename T = JavaFrame> T* add_frames() {
+    return BeginNestedMessage<T>(1);
   }
+
 };
 
-class HeapGraphType_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
+class JavaFrame_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
-  HeapGraphType_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit HeapGraphType_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit HeapGraphType_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_id() const { return at<1>().valid(); }
-  uint64_t id() const { return at<1>().as_uint64(); }
-  bool has_location_id() const { return at<2>().valid(); }
-  uint64_t location_id() const { return at<2>().as_uint64(); }
-  bool has_class_name() const { return at<3>().valid(); }
-  ::protozero::ConstChars class_name() const { return at<3>().as_string(); }
-  bool has_object_size() const { return at<4>().valid(); }
-  uint64_t object_size() const { return at<4>().as_uint64(); }
-  bool has_superclass_id() const { return at<5>().valid(); }
-  uint64_t superclass_id() const { return at<5>().as_uint64(); }
-  bool has_reference_field_id() const { return at<6>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> reference_field_id(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(6, parse_error_ptr); }
-  bool has_kind() const { return at<7>().valid(); }
-  int32_t kind() const { return at<7>().as_int32(); }
-  bool has_classloader_id() const { return at<8>().valid(); }
-  uint64_t classloader_id() const { return at<8>().as_uint64(); }
-};
-
-class HeapGraphType : public ::protozero::Message {
- public:
-  using Decoder = HeapGraphType_Decoder;
+  JavaFrame_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit JavaFrame_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit JavaFrame_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_method_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars method_name() const { return at<1>().as_string(); }
+  bool has_source_file() const { return at<2>().valid(); }
+  ::protozero::ConstChars source_file() const { return at<2>().as_string(); }
+  bool has_line_number() const { return at<3>().valid(); }
+  int32_t line_number() const { return at<3>().as_int32(); }
+};
+
+class JavaFrame : public ::protozero::Message {
+ public:
+  using Decoder = JavaFrame_Decoder;
   enum : int32_t {
-    kIdFieldNumber = 1,
-    kLocationIdFieldNumber = 2,
-    kClassNameFieldNumber = 3,
-    kObjectSizeFieldNumber = 4,
-    kSuperclassIdFieldNumber = 5,
-    kReferenceFieldIdFieldNumber = 6,
-    kKindFieldNumber = 7,
-    kClassloaderIdFieldNumber = 8,
+    kMethodNameFieldNumber = 1,
+    kSourceFileFieldNumber = 2,
+    kLineNumberFieldNumber = 3,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.HeapGraphType"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.JavaFrame"; }
 
 
-  using Kind = ::perfetto::protos::pbzero::HeapGraphType_Kind;
-  static inline const char* Kind_Name(Kind value) {
-    return ::perfetto::protos::pbzero::HeapGraphType_Kind_Name(value);
-  }
-  static inline const Kind KIND_UNKNOWN = Kind::KIND_UNKNOWN;
-  static inline const Kind KIND_NORMAL = Kind::KIND_NORMAL;
-  static inline const Kind KIND_NOREFERENCES = Kind::KIND_NOREFERENCES;
-  static inline const Kind KIND_STRING = Kind::KIND_STRING;
-  static inline const Kind KIND_ARRAY = Kind::KIND_ARRAY;
-  static inline const Kind KIND_CLASS = Kind::KIND_CLASS;
-  static inline const Kind KIND_CLASSLOADER = Kind::KIND_CLASSLOADER;
-  static inline const Kind KIND_DEXCACHE = Kind::KIND_DEXCACHE;
-  static inline const Kind KIND_SOFT_REFERENCE = Kind::KIND_SOFT_REFERENCE;
-  static inline const Kind KIND_WEAK_REFERENCE = Kind::KIND_WEAK_REFERENCE;
-  static inline const Kind KIND_FINALIZER_REFERENCE = Kind::KIND_FINALIZER_REFERENCE;
-  static inline const Kind KIND_PHANTOM_REFERENCE = Kind::KIND_PHANTOM_REFERENCE;
-
-  using FieldMetadata_Id =
+  using FieldMetadata_MethodName =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphType>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      JavaFrame>;
 
-  static constexpr FieldMetadata_Id kId{};
-  void set_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
+  static constexpr FieldMetadata_MethodName kMethodName{};
+  void set_method_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_MethodName::kFieldId, data, size);
+  }
+  void set_method_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_MethodName::kFieldId, chars.data, chars.size);
+  }
+  void set_method_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_MethodName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_LocationId =
+  using FieldMetadata_SourceFile =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphType>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      JavaFrame>;
 
-  static constexpr FieldMetadata_LocationId kLocationId{};
-  void set_location_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LocationId::kFieldId;
+  static constexpr FieldMetadata_SourceFile kSourceFile{};
+  void set_source_file(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_SourceFile::kFieldId, data, size);
+  }
+  void set_source_file(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_SourceFile::kFieldId, chars.data, chars.size);
+  }
+  void set_source_file(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_SourceFile::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_ClassName =
+  using FieldMetadata_LineNumber =
     ::protozero::proto_utils::FieldMetadata<
       3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      HeapGraphType>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      JavaFrame>;
 
-  static constexpr FieldMetadata_ClassName kClassName{};
-  void set_class_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ClassName::kFieldId, data, size);
-  }
-  void set_class_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ClassName::kFieldId, chars.data, chars.size);
-  }
-  void set_class_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ClassName::kFieldId;
+  static constexpr FieldMetadata_LineNumber kLineNumber{};
+  void set_line_number(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_LineNumber::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
+};
+
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/profiling/deobfuscation.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_DEOBFUSCATION_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_DEOBFUSCATION_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class ObfuscatedClass;
+class ObfuscatedMember;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class DeobfuscationMapping_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  DeobfuscationMapping_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit DeobfuscationMapping_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit DeobfuscationMapping_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_package_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars package_name() const { return at<1>().as_string(); }
+  bool has_version_code() const { return at<2>().valid(); }
+  int64_t version_code() const { return at<2>().as_int64(); }
+  bool has_obfuscated_classes() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> obfuscated_classes() const { return GetRepeated<::protozero::ConstBytes>(3); }
+};
+
+class DeobfuscationMapping : public ::protozero::Message {
+ public:
+  using Decoder = DeobfuscationMapping_Decoder;
+  enum : int32_t {
+    kPackageNameFieldNumber = 1,
+    kVersionCodeFieldNumber = 2,
+    kObfuscatedClassesFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.DeobfuscationMapping"; }
+
 
-  using FieldMetadata_ObjectSize =
+  using FieldMetadata_PackageName =
     ::protozero::proto_utils::FieldMetadata<
-      4,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphType>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      DeobfuscationMapping>;
 
-  static constexpr FieldMetadata_ObjectSize kObjectSize{};
-  void set_object_size(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ObjectSize::kFieldId;
+  static constexpr FieldMetadata_PackageName kPackageName{};
+  void set_package_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_PackageName::kFieldId, data, size);
+  }
+  void set_package_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_PackageName::kFieldId, chars.data, chars.size);
+  }
+  void set_package_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_PackageName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_SuperclassId =
+  using FieldMetadata_VersionCode =
     ::protozero::proto_utils::FieldMetadata<
-      5,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphType>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      DeobfuscationMapping>;
 
-  static constexpr FieldMetadata_SuperclassId kSuperclassId{};
-  void set_superclass_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SuperclassId::kFieldId;
+  static constexpr FieldMetadata_VersionCode kVersionCode{};
+  void set_version_code(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_VersionCode::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_ReferenceFieldId =
+  using FieldMetadata_ObfuscatedClasses =
     ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphType>;
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      ObfuscatedClass,
+      DeobfuscationMapping>;
 
-  static constexpr FieldMetadata_ReferenceFieldId kReferenceFieldId{};
-  void set_reference_field_id(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_ReferenceFieldId::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
+  static constexpr FieldMetadata_ObfuscatedClasses kObfuscatedClasses{};
+  template <typename T = ObfuscatedClass> T* add_obfuscated_classes() {
+    return BeginNestedMessage<T>(3);
   }
 
-  using FieldMetadata_Kind =
+};
+
+class ObfuscatedClass_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  ObfuscatedClass_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit ObfuscatedClass_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit ObfuscatedClass_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_obfuscated_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars obfuscated_name() const { return at<1>().as_string(); }
+  bool has_deobfuscated_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars deobfuscated_name() const { return at<2>().as_string(); }
+  bool has_obfuscated_members() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> obfuscated_members() const { return GetRepeated<::protozero::ConstBytes>(3); }
+  bool has_obfuscated_methods() const { return at<4>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> obfuscated_methods() const { return GetRepeated<::protozero::ConstBytes>(4); }
+};
+
+class ObfuscatedClass : public ::protozero::Message {
+ public:
+  using Decoder = ObfuscatedClass_Decoder;
+  enum : int32_t {
+    kObfuscatedNameFieldNumber = 1,
+    kDeobfuscatedNameFieldNumber = 2,
+    kObfuscatedMembersFieldNumber = 3,
+    kObfuscatedMethodsFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.ObfuscatedClass"; }
+
+
+  using FieldMetadata_ObfuscatedName =
     ::protozero::proto_utils::FieldMetadata<
-      7,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      HeapGraphType_Kind,
-      HeapGraphType>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ObfuscatedClass>;
 
-  static constexpr FieldMetadata_Kind kKind{};
-  void set_kind(HeapGraphType_Kind value) {
-    static constexpr uint32_t field_id = FieldMetadata_Kind::kFieldId;
+  static constexpr FieldMetadata_ObfuscatedName kObfuscatedName{};
+  void set_obfuscated_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, data, size);
+  }
+  void set_obfuscated_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, chars.data, chars.size);
+  }
+  void set_obfuscated_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_ClassloaderId =
+  using FieldMetadata_DeobfuscatedName =
     ::protozero::proto_utils::FieldMetadata<
-      8,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphType>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ObfuscatedClass>;
 
-  static constexpr FieldMetadata_ClassloaderId kClassloaderId{};
-  void set_classloader_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ClassloaderId::kFieldId;
+  static constexpr FieldMetadata_DeobfuscatedName kDeobfuscatedName{};
+  void set_deobfuscated_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, data, size);
+  }
+  void set_deobfuscated_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, chars.data, chars.size);
+  }
+  void set_deobfuscated_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_DeobfuscatedName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_ObfuscatedMembers =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      ObfuscatedMember,
+      ObfuscatedClass>;
+
+  static constexpr FieldMetadata_ObfuscatedMembers kObfuscatedMembers{};
+  template <typename T = ObfuscatedMember> T* add_obfuscated_members() {
+    return BeginNestedMessage<T>(3);
+  }
+
+
+  using FieldMetadata_ObfuscatedMethods =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      ObfuscatedMember,
+      ObfuscatedClass>;
+
+  static constexpr FieldMetadata_ObfuscatedMethods kObfuscatedMethods{};
+  template <typename T = ObfuscatedMember> T* add_obfuscated_methods() {
+    return BeginNestedMessage<T>(4);
+  }
+
 };
 
-class HeapGraphRoot_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class ObfuscatedMember_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
  public:
-  HeapGraphRoot_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit HeapGraphRoot_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit HeapGraphRoot_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_object_ids() const { return at<1>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> object_ids(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(1, parse_error_ptr); }
-  bool has_root_type() const { return at<2>().valid(); }
-  int32_t root_type() const { return at<2>().as_int32(); }
+  ObfuscatedMember_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit ObfuscatedMember_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit ObfuscatedMember_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_obfuscated_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars obfuscated_name() const { return at<1>().as_string(); }
+  bool has_deobfuscated_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars deobfuscated_name() const { return at<2>().as_string(); }
+  bool has_obfuscated_line_start() const { return at<3>().valid(); }
+  uint32_t obfuscated_line_start() const { return at<3>().as_uint32(); }
+  bool has_obfuscated_line_end() const { return at<4>().valid(); }
+  uint32_t obfuscated_line_end() const { return at<4>().as_uint32(); }
+  bool has_source_line_start() const { return at<5>().valid(); }
+  uint32_t source_line_start() const { return at<5>().as_uint32(); }
+  bool has_source_line_end() const { return at<6>().valid(); }
+  uint32_t source_line_end() const { return at<6>().as_uint32(); }
 };
 
-class HeapGraphRoot : public ::protozero::Message {
+class ObfuscatedMember : public ::protozero::Message {
  public:
-  using Decoder = HeapGraphRoot_Decoder;
+  using Decoder = ObfuscatedMember_Decoder;
   enum : int32_t {
-    kObjectIdsFieldNumber = 1,
-    kRootTypeFieldNumber = 2,
+    kObfuscatedNameFieldNumber = 1,
+    kDeobfuscatedNameFieldNumber = 2,
+    kObfuscatedLineStartFieldNumber = 3,
+    kObfuscatedLineEndFieldNumber = 4,
+    kSourceLineStartFieldNumber = 5,
+    kSourceLineEndFieldNumber = 6,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.HeapGraphRoot"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.ObfuscatedMember"; }
 
 
-  using Type = ::perfetto::protos::pbzero::HeapGraphRoot_Type;
-  static inline const char* Type_Name(Type value) {
-    return ::perfetto::protos::pbzero::HeapGraphRoot_Type_Name(value);
-  }
-  static inline const Type ROOT_UNKNOWN = Type::ROOT_UNKNOWN;
-  static inline const Type ROOT_JNI_GLOBAL = Type::ROOT_JNI_GLOBAL;
-  static inline const Type ROOT_JNI_LOCAL = Type::ROOT_JNI_LOCAL;
-  static inline const Type ROOT_JAVA_FRAME = Type::ROOT_JAVA_FRAME;
-  static inline const Type ROOT_NATIVE_STACK = Type::ROOT_NATIVE_STACK;
-  static inline const Type ROOT_STICKY_CLASS = Type::ROOT_STICKY_CLASS;
-  static inline const Type ROOT_THREAD_BLOCK = Type::ROOT_THREAD_BLOCK;
-  static inline const Type ROOT_MONITOR_USED = Type::ROOT_MONITOR_USED;
-  static inline const Type ROOT_THREAD_OBJECT = Type::ROOT_THREAD_OBJECT;
-  static inline const Type ROOT_INTERNED_STRING = Type::ROOT_INTERNED_STRING;
-  static inline const Type ROOT_FINALIZING = Type::ROOT_FINALIZING;
-  static inline const Type ROOT_DEBUGGER = Type::ROOT_DEBUGGER;
-  static inline const Type ROOT_REFERENCE_CLEANUP = Type::ROOT_REFERENCE_CLEANUP;
-  static inline const Type ROOT_VM_INTERNAL = Type::ROOT_VM_INTERNAL;
-  static inline const Type ROOT_JNI_MONITOR = Type::ROOT_JNI_MONITOR;
-
-  using FieldMetadata_ObjectIds =
+  using FieldMetadata_ObfuscatedName =
     ::protozero::proto_utils::FieldMetadata<
       1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      HeapGraphRoot>;
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ObfuscatedMember>;
 
-  static constexpr FieldMetadata_ObjectIds kObjectIds{};
-  void set_object_ids(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_ObjectIds::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
+  static constexpr FieldMetadata_ObfuscatedName kObfuscatedName{};
+  void set_obfuscated_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, data, size);
+  }
+  void set_obfuscated_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ObfuscatedName::kFieldId, chars.data, chars.size);
+  }
+  void set_obfuscated_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_RootType =
+  using FieldMetadata_DeobfuscatedName =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      HeapGraphRoot_Type,
-      HeapGraphRoot>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ObfuscatedMember>;
+
+  static constexpr FieldMetadata_DeobfuscatedName kDeobfuscatedName{};
+  void set_deobfuscated_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, data, size);
+  }
+  void set_deobfuscated_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_DeobfuscatedName::kFieldId, chars.data, chars.size);
+  }
+  void set_deobfuscated_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_DeobfuscatedName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ObfuscatedLineStart =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      ObfuscatedMember>;
 
-  static constexpr FieldMetadata_RootType kRootType{};
-  void set_root_type(HeapGraphRoot_Type value) {
-    static constexpr uint32_t field_id = FieldMetadata_RootType::kFieldId;
+  static constexpr FieldMetadata_ObfuscatedLineStart kObfuscatedLineStart{};
+  void set_obfuscated_line_start(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedLineStart::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ObfuscatedLineEnd =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      ObfuscatedMember>;
+
+  static constexpr FieldMetadata_ObfuscatedLineEnd kObfuscatedLineEnd{};
+  void set_obfuscated_line_end(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ObfuscatedLineEnd::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SourceLineStart =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      ObfuscatedMember>;
+
+  static constexpr FieldMetadata_SourceLineStart kSourceLineStart{};
+  void set_source_line_start(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_SourceLineStart::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SourceLineEnd =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      ObfuscatedMember>;
+
+  static constexpr FieldMetadata_SourceLineEnd kSourceLineEnd{};
+  void set_source_line_end(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_SourceLineEnd::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
 };
@@ -173244,7 +170129,12 @@ class ProfilePacket_HeapSample : public ::protozero::Message {
 namespace perfetto {
 namespace protos {
 namespace pbzero {
+class PackedSmaps;
 class SmapsEntry;
+namespace perfetto_pbzero_enum_SmapsPacket {
+enum RecordingType : int32_t;
+}  // namespace perfetto_pbzero_enum_SmapsPacket
+using SmapsPacket_RecordingType = perfetto_pbzero_enum_SmapsPacket::RecordingType;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -173253,7 +170143,40 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class SmapsPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+namespace perfetto_pbzero_enum_SmapsPacket {
+enum RecordingType : int32_t {
+  RECORDING_TYPE_UNKNOWN = 0,
+  RECORDING_TYPE_STANDALONE = 1,
+  RECORDING_TYPE_ART_HPROF_POSTFORK = 2,
+  RECORDING_TYPE_ART_HPROF_PREFORK = 3,
+};
+} // namespace perfetto_pbzero_enum_SmapsPacket
+using SmapsPacket_RecordingType = perfetto_pbzero_enum_SmapsPacket::RecordingType;
+
+
+constexpr SmapsPacket_RecordingType SmapsPacket_RecordingType_MIN = SmapsPacket_RecordingType::RECORDING_TYPE_UNKNOWN;
+constexpr SmapsPacket_RecordingType SmapsPacket_RecordingType_MAX = SmapsPacket_RecordingType::RECORDING_TYPE_ART_HPROF_PREFORK;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* SmapsPacket_RecordingType_Name(::perfetto::protos::pbzero::SmapsPacket_RecordingType value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::SmapsPacket_RecordingType::RECORDING_TYPE_UNKNOWN:
+    return "RECORDING_TYPE_UNKNOWN";
+
+  case ::perfetto::protos::pbzero::SmapsPacket_RecordingType::RECORDING_TYPE_STANDALONE:
+    return "RECORDING_TYPE_STANDALONE";
+
+  case ::perfetto::protos::pbzero::SmapsPacket_RecordingType::RECORDING_TYPE_ART_HPROF_POSTFORK:
+    return "RECORDING_TYPE_ART_HPROF_POSTFORK";
+
+  case ::perfetto::protos::pbzero::SmapsPacket_RecordingType::RECORDING_TYPE_ART_HPROF_PREFORK:
+    return "RECORDING_TYPE_ART_HPROF_PREFORK";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class SmapsPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
   SmapsPacket_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit SmapsPacket_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -173262,6 +170185,10 @@ class SmapsPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   uint32_t pid() const { return at<1>().as_uint32(); }
   bool has_entries() const { return at<2>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> entries() const { return GetRepeated<::protozero::ConstBytes>(2); }
+  bool has_packed_entries() const { return at<3>().valid(); }
+  ::protozero::ConstBytes packed_entries() const { return at<3>().as_bytes(); }
+  bool has_recording_type() const { return at<4>().valid(); }
+  int32_t recording_type() const { return at<4>().as_int32(); }
 };
 
 class SmapsPacket : public ::protozero::Message {
@@ -173270,10 +170197,21 @@ class SmapsPacket : public ::protozero::Message {
   enum : int32_t {
     kPidFieldNumber = 1,
     kEntriesFieldNumber = 2,
+    kPackedEntriesFieldNumber = 3,
+    kRecordingTypeFieldNumber = 4,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.SmapsPacket"; }
 
 
+  using RecordingType = ::perfetto::protos::pbzero::SmapsPacket_RecordingType;
+  static inline const char* RecordingType_Name(RecordingType value) {
+    return ::perfetto::protos::pbzero::SmapsPacket_RecordingType_Name(value);
+  }
+  static inline const RecordingType RECORDING_TYPE_UNKNOWN = RecordingType::RECORDING_TYPE_UNKNOWN;
+  static inline const RecordingType RECORDING_TYPE_STANDALONE = RecordingType::RECORDING_TYPE_STANDALONE;
+  static inline const RecordingType RECORDING_TYPE_ART_HPROF_POSTFORK = RecordingType::RECORDING_TYPE_ART_HPROF_POSTFORK;
+  static inline const RecordingType RECORDING_TYPE_ART_HPROF_PREFORK = RecordingType::RECORDING_TYPE_ART_HPROF_PREFORK;
+
   using FieldMetadata_Pid =
     ::protozero::proto_utils::FieldMetadata<
       1,
@@ -173305,6 +170243,319 @@ class SmapsPacket : public ::protozero::Message {
     return BeginNestedMessage<T>(2);
   }
 
+
+  using FieldMetadata_PackedEntries =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      PackedSmaps,
+      SmapsPacket>;
+
+  static constexpr FieldMetadata_PackedEntries kPackedEntries{};
+  template <typename T = PackedSmaps> T* set_packed_entries() {
+    return BeginNestedMessage<T>(3);
+  }
+
+
+  using FieldMetadata_RecordingType =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      SmapsPacket_RecordingType,
+      SmapsPacket>;
+
+  static constexpr FieldMetadata_RecordingType kRecordingType{};
+  void set_recording_type(SmapsPacket_RecordingType value) {
+    static constexpr uint32_t field_id = FieldMetadata_RecordingType::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class PackedSmaps_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/15> {
+ public:
+  PackedSmaps_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit PackedSmaps_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit PackedSmaps_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_string_table() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> string_table() const { return GetRepeated<::protozero::ConstChars>(1); }
+  bool has_name_id() const { return at<2>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t> name_id(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t>(2, parse_error_ptr); }
+  bool has_aggregate_count() const { return at<3>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t> aggregate_count(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t>(3, parse_error_ptr); }
+  bool has_size_kb() const { return at<4>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> size_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(4, parse_error_ptr); }
+  bool has_rss_kb() const { return at<5>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> rss_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(5, parse_error_ptr); }
+  bool has_anonymous_kb() const { return at<6>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> anonymous_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(6, parse_error_ptr); }
+  bool has_swap_kb() const { return at<7>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> swap_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(7, parse_error_ptr); }
+  bool has_shared_clean_kb() const { return at<8>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> shared_clean_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(8, parse_error_ptr); }
+  bool has_shared_dirty_kb() const { return at<9>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> shared_dirty_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(9, parse_error_ptr); }
+  bool has_private_clean_kb() const { return at<10>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> private_clean_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(10, parse_error_ptr); }
+  bool has_private_dirty_kb() const { return at<11>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> private_dirty_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(11, parse_error_ptr); }
+  bool has_locked_kb() const { return at<12>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> locked_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(12, parse_error_ptr); }
+  bool has_pss_kb() const { return at<13>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> pss_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(13, parse_error_ptr); }
+  bool has_pss_dirty_kb() const { return at<14>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> pss_dirty_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(14, parse_error_ptr); }
+  bool has_swap_pss_kb() const { return at<15>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> swap_pss_kb(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(15, parse_error_ptr); }
+};
+
+class PackedSmaps : public ::protozero::Message {
+ public:
+  using Decoder = PackedSmaps_Decoder;
+  enum : int32_t {
+    kStringTableFieldNumber = 1,
+    kNameIdFieldNumber = 2,
+    kAggregateCountFieldNumber = 3,
+    kSizeKbFieldNumber = 4,
+    kRssKbFieldNumber = 5,
+    kAnonymousKbFieldNumber = 6,
+    kSwapKbFieldNumber = 7,
+    kSharedCleanKbFieldNumber = 8,
+    kSharedDirtyKbFieldNumber = 9,
+    kPrivateCleanKbFieldNumber = 10,
+    kPrivateDirtyKbFieldNumber = 11,
+    kLockedKbFieldNumber = 12,
+    kPssKbFieldNumber = 13,
+    kPssDirtyKbFieldNumber = 14,
+    kSwapPssKbFieldNumber = 15,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.PackedSmaps"; }
+
+
+  using FieldMetadata_StringTable =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_StringTable kStringTable{};
+  void add_string_table(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_StringTable::kFieldId, data, size);
+  }
+  void add_string_table(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_StringTable::kFieldId, chars.data, chars.size);
+  }
+  void add_string_table(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_StringTable::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NameId =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_NameId kNameId{};
+  void set_name_id(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_NameId::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_AggregateCount =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_AggregateCount kAggregateCount{};
+  void set_aggregate_count(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_AggregateCount::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_SizeKb =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_SizeKb kSizeKb{};
+  void set_size_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_SizeKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_RssKb =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_RssKb kRssKb{};
+  void set_rss_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_RssKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_AnonymousKb =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_AnonymousKb kAnonymousKb{};
+  void set_anonymous_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_AnonymousKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_SwapKb =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_SwapKb kSwapKb{};
+  void set_swap_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_SwapKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_SharedCleanKb =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_SharedCleanKb kSharedCleanKb{};
+  void set_shared_clean_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_SharedCleanKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_SharedDirtyKb =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_SharedDirtyKb kSharedDirtyKb{};
+  void set_shared_dirty_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_SharedDirtyKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_PrivateCleanKb =
+    ::protozero::proto_utils::FieldMetadata<
+      10,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_PrivateCleanKb kPrivateCleanKb{};
+  void set_private_clean_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_PrivateCleanKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_PrivateDirtyKb =
+    ::protozero::proto_utils::FieldMetadata<
+      11,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_PrivateDirtyKb kPrivateDirtyKb{};
+  void set_private_dirty_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_PrivateDirtyKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_LockedKb =
+    ::protozero::proto_utils::FieldMetadata<
+      12,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_LockedKb kLockedKb{};
+  void set_locked_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_LockedKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_PssKb =
+    ::protozero::proto_utils::FieldMetadata<
+      13,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_PssKb kPssKb{};
+  void set_pss_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_PssKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_PssDirtyKb =
+    ::protozero::proto_utils::FieldMetadata<
+      14,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_PssDirtyKb kPssDirtyKb{};
+  void set_pss_dirty_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_PssDirtyKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_SwapPssKb =
+    ::protozero::proto_utils::FieldMetadata<
+      15,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      PackedSmaps>;
+
+  static constexpr FieldMetadata_SwapPssKb kSwapPssKb{};
+  void set_swap_pss_kb(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_SwapPssKb::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
 };
 
 class SmapsEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/15> {
@@ -179637,13 +176888,17 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class Screenshot_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+class Screenshot_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
   Screenshot_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit Screenshot_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
   explicit Screenshot_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
   bool has_jpg_image() const { return at<1>().valid(); }
   ::protozero::ConstBytes jpg_image() const { return at<1>().as_bytes(); }
+  bool has_pam_image() const { return at<2>().valid(); }
+  ::protozero::ConstBytes pam_image() const { return at<2>().as_bytes(); }
+  bool has_ppm_image() const { return at<3>().valid(); }
+  ::protozero::ConstBytes ppm_image() const { return at<3>().as_bytes(); }
 };
 
 class Screenshot : public ::protozero::Message {
@@ -179651,6 +176906,8 @@ class Screenshot : public ::protozero::Message {
   using Decoder = Screenshot_Decoder;
   enum : int32_t {
     kJpgImageFieldNumber = 1,
+    kPamImageFieldNumber = 2,
+    kPpmImageFieldNumber = 3,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.Screenshot"; }
 
@@ -179678,6 +176935,54 @@ class Screenshot : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kBytes>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_PamImage =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBytes,
+      std::string,
+      Screenshot>;
+
+  static constexpr FieldMetadata_PamImage kPamImage{};
+  void set_pam_image(const uint8_t* data, size_t size) {
+    AppendBytes(FieldMetadata_PamImage::kFieldId, data, size);
+  }
+  void set_pam_image(::protozero::ConstBytes bytes) {
+    AppendBytes(FieldMetadata_PamImage::kFieldId, bytes.data, bytes.size);
+  }
+  void set_pam_image(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_PamImage::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBytes>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_PpmImage =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBytes,
+      std::string,
+      Screenshot>;
+
+  static constexpr FieldMetadata_PpmImage kPpmImage{};
+  void set_ppm_image(const uint8_t* data, size_t size) {
+    AppendBytes(FieldMetadata_PpmImage::kFieldId, data, size);
+  }
+  void set_ppm_image(::protozero::ConstBytes bytes) {
+    AppendBytes(FieldMetadata_PpmImage::kFieldId, bytes.data, bytes.size);
+  }
+  void set_ppm_image(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_PpmImage::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBytes>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -179895,6 +177200,44 @@ class UnsymbolizedSourceLocation : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/track_event/state_descriptor.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACK_EVENT_STATE_DESCRIPTOR_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACK_EVENT_STATE_DESCRIPTOR_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class StateDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/0> {
+ public:
+  StateDescriptor_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StateDescriptor_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StateDescriptor_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+};
+
+class StateDescriptor : public ::protozero::Message {
+ public:
+  using Decoder = StateDescriptor_Decoder;
+  static constexpr const char* GetName() { return ".perfetto.protos.StateDescriptor"; }
+
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -179956,6 +177299,382 @@ class TaskExecution : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/linux/journald_event.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_LINUX_JOURNALD_EVENT_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_LINUX_JOURNALD_EVENT_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class SystemdJournaldEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/21> {
+ public:
+  SystemdJournaldEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit SystemdJournaldEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit SystemdJournaldEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_pid() const { return at<1>().valid(); }
+  uint32_t pid() const { return at<1>().as_uint32(); }
+  bool has_tid() const { return at<2>().valid(); }
+  uint32_t tid() const { return at<2>().as_uint32(); }
+  bool has_uid() const { return at<3>().valid(); }
+  uint32_t uid() const { return at<3>().as_uint32(); }
+  bool has_gid() const { return at<4>().valid(); }
+  uint32_t gid() const { return at<4>().as_uint32(); }
+  bool has_prio() const { return at<5>().valid(); }
+  uint32_t prio() const { return at<5>().as_uint32(); }
+  bool has_tag() const { return at<6>().valid(); }
+  ::protozero::ConstChars tag() const { return at<6>().as_string(); }
+  bool has_message() const { return at<7>().valid(); }
+  ::protozero::ConstChars message() const { return at<7>().as_string(); }
+  bool has_comm() const { return at<8>().valid(); }
+  ::protozero::ConstChars comm() const { return at<8>().as_string(); }
+  bool has_exe() const { return at<9>().valid(); }
+  ::protozero::ConstChars exe() const { return at<9>().as_string(); }
+  bool has_systemd_unit() const { return at<10>().valid(); }
+  ::protozero::ConstChars systemd_unit() const { return at<10>().as_string(); }
+  bool has_hostname() const { return at<11>().valid(); }
+  ::protozero::ConstChars hostname() const { return at<11>().as_string(); }
+  bool has_transport() const { return at<12>().valid(); }
+  ::protozero::ConstChars transport() const { return at<12>().as_string(); }
+  bool has_num_total() const { return at<20>().valid(); }
+  uint64_t num_total() const { return at<20>().as_uint64(); }
+  bool has_num_failed() const { return at<21>().valid(); }
+  uint64_t num_failed() const { return at<21>().as_uint64(); }
+};
+
+class SystemdJournaldEvent : public ::protozero::Message {
+ public:
+  using Decoder = SystemdJournaldEvent_Decoder;
+  enum : int32_t {
+    kPidFieldNumber = 1,
+    kTidFieldNumber = 2,
+    kUidFieldNumber = 3,
+    kGidFieldNumber = 4,
+    kPrioFieldNumber = 5,
+    kTagFieldNumber = 6,
+    kMessageFieldNumber = 7,
+    kCommFieldNumber = 8,
+    kExeFieldNumber = 9,
+    kSystemdUnitFieldNumber = 10,
+    kHostnameFieldNumber = 11,
+    kTransportFieldNumber = 12,
+    kNumTotalFieldNumber = 20,
+    kNumFailedFieldNumber = 21,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.SystemdJournaldEvent"; }
+
+
+  using FieldMetadata_Pid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Pid kPid{};
+  void set_pid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Tid =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Tid kTid{};
+  void set_tid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Tid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Uid =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Uid kUid{};
+  void set_uid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Gid =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Gid kGid{};
+  void set_gid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Gid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Prio =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Prio kPrio{};
+  void set_prio(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Prio::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Tag =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Tag kTag{};
+  void set_tag(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Tag::kFieldId, data, size);
+  }
+  void set_tag(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Tag::kFieldId, chars.data, chars.size);
+  }
+  void set_tag(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Tag::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Message =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Message kMessage{};
+  void set_message(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Message::kFieldId, data, size);
+  }
+  void set_message(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Message::kFieldId, chars.data, chars.size);
+  }
+  void set_message(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Message::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Comm =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Comm kComm{};
+  void set_comm(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Comm::kFieldId, data, size);
+  }
+  void set_comm(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Comm::kFieldId, chars.data, chars.size);
+  }
+  void set_comm(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Comm::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Exe =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Exe kExe{};
+  void set_exe(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Exe::kFieldId, data, size);
+  }
+  void set_exe(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Exe::kFieldId, chars.data, chars.size);
+  }
+  void set_exe(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Exe::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SystemdUnit =
+    ::protozero::proto_utils::FieldMetadata<
+      10,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_SystemdUnit kSystemdUnit{};
+  void set_systemd_unit(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_SystemdUnit::kFieldId, data, size);
+  }
+  void set_systemd_unit(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_SystemdUnit::kFieldId, chars.data, chars.size);
+  }
+  void set_systemd_unit(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_SystemdUnit::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Hostname =
+    ::protozero::proto_utils::FieldMetadata<
+      11,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Hostname kHostname{};
+  void set_hostname(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Hostname::kFieldId, data, size);
+  }
+  void set_hostname(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Hostname::kFieldId, chars.data, chars.size);
+  }
+  void set_hostname(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Hostname::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Transport =
+    ::protozero::proto_utils::FieldMetadata<
+      12,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_Transport kTransport{};
+  void set_transport(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Transport::kFieldId, data, size);
+  }
+  void set_transport(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Transport::kFieldId, chars.data, chars.size);
+  }
+  void set_transport(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Transport::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NumTotal =
+    ::protozero::proto_utils::FieldMetadata<
+      20,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_NumTotal kNumTotal{};
+  void set_num_total(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NumTotal::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NumFailed =
+    ::protozero::proto_utils::FieldMetadata<
+      21,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      SystemdJournaldEvent>;
+
+  static constexpr FieldMetadata_NumFailed kNumFailed{};
+  void set_num_failed(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NumFailed::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -183174,6 +180893,7 @@ class SysStats_DiskStat;
 class SysStats_InterruptCount;
 class SysStats_MeminfoValue;
 class SysStats_PsiSample;
+class SysStats_SlabInfo;
 class SysStats_ThermalZone;
 class SysStats_VmstatValue;
 enum MeminfoCounters : int32_t;
@@ -183235,7 +180955,7 @@ const char* SysStats_PsiSample_PsiResource_Name(::perfetto::protos::pbzero::SysS
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class SysStats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/17> {
+class SysStats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/18> {
  public:
   SysStats_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit SysStats_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -183274,6 +180994,8 @@ class SysStats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> cpuidle_state() const { return GetRepeated<::protozero::ConstBytes>(16); }
   bool has_gpufreq_mhz() const { return at<17>().valid(); }
   ::protozero::RepeatedFieldIterator<uint64_t> gpufreq_mhz() const { return GetRepeated<uint64_t>(17); }
+  bool has_slab_info() const { return at<18>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> slab_info() const { return GetRepeated<::protozero::ConstBytes>(18); }
 };
 
 class SysStats : public ::protozero::Message {
@@ -183297,6 +181019,7 @@ class SysStats : public ::protozero::Message {
     kThermalZoneFieldNumber = 15,
     kCpuidleStateFieldNumber = 16,
     kGpufreqMhzFieldNumber = 17,
+    kSlabInfoFieldNumber = 18,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.SysStats"; }
 
@@ -183311,6 +181034,7 @@ class SysStats : public ::protozero::Message {
   using ThermalZone = ::perfetto::protos::pbzero::SysStats_ThermalZone;
   using CpuIdleStateEntry = ::perfetto::protos::pbzero::SysStats_CpuIdleStateEntry;
   using CpuIdleState = ::perfetto::protos::pbzero::SysStats_CpuIdleState;
+  using SlabInfo = ::perfetto::protos::pbzero::SysStats_SlabInfo;
 
   using FieldMetadata_Meminfo =
     ::protozero::proto_utils::FieldMetadata<
@@ -183573,6 +181297,105 @@ class SysStats : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_SlabInfo =
+    ::protozero::proto_utils::FieldMetadata<
+      18,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      SysStats_SlabInfo,
+      SysStats>;
+
+  static constexpr FieldMetadata_SlabInfo kSlabInfo{};
+  template <typename T = SysStats_SlabInfo> T* add_slab_info() {
+    return BeginNestedMessage<T>(18);
+  }
+
+};
+
+class SysStats_SlabInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  SysStats_SlabInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit SysStats_SlabInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit SysStats_SlabInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars name() const { return at<1>().as_string(); }
+  bool has_pages_per_slab() const { return at<2>().valid(); }
+  uint32_t pages_per_slab() const { return at<2>().as_uint32(); }
+  bool has_num_slabs() const { return at<3>().valid(); }
+  uint32_t num_slabs() const { return at<3>().as_uint32(); }
+};
+
+class SysStats_SlabInfo : public ::protozero::Message {
+ public:
+  using Decoder = SysStats_SlabInfo_Decoder;
+  enum : int32_t {
+    kNameFieldNumber = 1,
+    kPagesPerSlabFieldNumber = 2,
+    kNumSlabsFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.SysStats.SlabInfo"; }
+
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      SysStats_SlabInfo>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_PagesPerSlab =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SysStats_SlabInfo>;
+
+  static constexpr FieldMetadata_PagesPerSlab kPagesPerSlab{};
+  void set_pages_per_slab(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PagesPerSlab::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NumSlabs =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SysStats_SlabInfo>;
+
+  static constexpr FieldMetadata_NumSlabs kNumSlabs{};
+  void set_num_slabs(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NumSlabs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class SysStats_CpuIdleState_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
@@ -184910,6 +182733,467 @@ class CpuInfo_ArmCpuIdentifier : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/system_info/gpu_info.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_SYSTEM_INFO_GPU_INFO_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_SYSTEM_INFO_GPU_INFO_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class GpuInfo_Gpu;
+class GpuInfo_Gpu_KeyValue;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class GpuInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  GpuInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_gpus() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> gpus() const { return GetRepeated<::protozero::ConstBytes>(1); }
+};
+
+class GpuInfo : public ::protozero::Message {
+ public:
+  using Decoder = GpuInfo_Decoder;
+  enum : int32_t {
+    kGpusFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuInfo"; }
+
+  using Gpu = ::perfetto::protos::pbzero::GpuInfo_Gpu;
+
+  using FieldMetadata_Gpus =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuInfo_Gpu,
+      GpuInfo>;
+
+  static constexpr FieldMetadata_Gpus kGpus{};
+  template <typename T = GpuInfo_Gpu> T* add_gpus() {
+    return BeginNestedMessage<T>(1);
+  }
+
+};
+
+class GpuInfo_Gpu_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
+ public:
+  GpuInfo_Gpu_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuInfo_Gpu_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuInfo_Gpu_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars name() const { return at<1>().as_string(); }
+  bool has_vendor() const { return at<2>().valid(); }
+  ::protozero::ConstChars vendor() const { return at<2>().as_string(); }
+  bool has_model() const { return at<3>().valid(); }
+  ::protozero::ConstChars model() const { return at<3>().as_string(); }
+  bool has_architecture() const { return at<4>().valid(); }
+  ::protozero::ConstChars architecture() const { return at<4>().as_string(); }
+  bool has_uuid() const { return at<5>().valid(); }
+  ::protozero::ConstBytes uuid() const { return at<5>().as_bytes(); }
+  bool has_pci_bdf() const { return at<7>().valid(); }
+  ::protozero::ConstChars pci_bdf() const { return at<7>().as_string(); }
+  bool has_extra_info() const { return at<6>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> extra_info() const { return GetRepeated<::protozero::ConstBytes>(6); }
+};
+
+class GpuInfo_Gpu : public ::protozero::Message {
+ public:
+  using Decoder = GpuInfo_Gpu_Decoder;
+  enum : int32_t {
+    kNameFieldNumber = 1,
+    kVendorFieldNumber = 2,
+    kModelFieldNumber = 3,
+    kArchitectureFieldNumber = 4,
+    kUuidFieldNumber = 5,
+    kPciBdfFieldNumber = 7,
+    kExtraInfoFieldNumber = 6,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuInfo.Gpu"; }
+
+  using KeyValue = ::perfetto::protos::pbzero::GpuInfo_Gpu_KeyValue;
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuInfo_Gpu>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Vendor =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuInfo_Gpu>;
+
+  static constexpr FieldMetadata_Vendor kVendor{};
+  void set_vendor(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Vendor::kFieldId, data, size);
+  }
+  void set_vendor(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Vendor::kFieldId, chars.data, chars.size);
+  }
+  void set_vendor(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Vendor::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Model =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuInfo_Gpu>;
+
+  static constexpr FieldMetadata_Model kModel{};
+  void set_model(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Model::kFieldId, data, size);
+  }
+  void set_model(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Model::kFieldId, chars.data, chars.size);
+  }
+  void set_model(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Model::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Architecture =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuInfo_Gpu>;
+
+  static constexpr FieldMetadata_Architecture kArchitecture{};
+  void set_architecture(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Architecture::kFieldId, data, size);
+  }
+  void set_architecture(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Architecture::kFieldId, chars.data, chars.size);
+  }
+  void set_architecture(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Architecture::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Uuid =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBytes,
+      std::string,
+      GpuInfo_Gpu>;
+
+  static constexpr FieldMetadata_Uuid kUuid{};
+  void set_uuid(const uint8_t* data, size_t size) {
+    AppendBytes(FieldMetadata_Uuid::kFieldId, data, size);
+  }
+  void set_uuid(::protozero::ConstBytes bytes) {
+    AppendBytes(FieldMetadata_Uuid::kFieldId, bytes.data, bytes.size);
+  }
+  void set_uuid(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Uuid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBytes>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_PciBdf =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuInfo_Gpu>;
+
+  static constexpr FieldMetadata_PciBdf kPciBdf{};
+  void set_pci_bdf(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_PciBdf::kFieldId, data, size);
+  }
+  void set_pci_bdf(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_PciBdf::kFieldId, chars.data, chars.size);
+  }
+  void set_pci_bdf(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_PciBdf::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ExtraInfo =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      GpuInfo_Gpu_KeyValue,
+      GpuInfo_Gpu>;
+
+  static constexpr FieldMetadata_ExtraInfo kExtraInfo{};
+  template <typename T = GpuInfo_Gpu_KeyValue> T* add_extra_info() {
+    return BeginNestedMessage<T>(6);
+  }
+
+};
+
+class GpuInfo_Gpu_KeyValue_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  GpuInfo_Gpu_KeyValue_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit GpuInfo_Gpu_KeyValue_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit GpuInfo_Gpu_KeyValue_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_key() const { return at<1>().valid(); }
+  ::protozero::ConstChars key() const { return at<1>().as_string(); }
+  bool has_value() const { return at<2>().valid(); }
+  ::protozero::ConstChars value() const { return at<2>().as_string(); }
+};
+
+class GpuInfo_Gpu_KeyValue : public ::protozero::Message {
+ public:
+  using Decoder = GpuInfo_Gpu_KeyValue_Decoder;
+  enum : int32_t {
+    kKeyFieldNumber = 1,
+    kValueFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.GpuInfo.Gpu.KeyValue"; }
+
+
+  using FieldMetadata_Key =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuInfo_Gpu_KeyValue>;
+
+  static constexpr FieldMetadata_Key kKey{};
+  void set_key(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Key::kFieldId, data, size);
+  }
+  void set_key(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Key::kFieldId, chars.data, chars.size);
+  }
+  void set_key(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Value =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      GpuInfo_Gpu_KeyValue>;
+
+  static constexpr FieldMetadata_Value kValue{};
+  void set_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
+  }
+  void set_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Value::kFieldId, chars.data, chars.size);
+  }
+  void set_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+};
+
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/system_info/interrupt_info.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_SYSTEM_INFO_INTERRUPT_INFO_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_SYSTEM_INFO_INTERRUPT_INFO_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class InterruptInfo_InterruptMapping;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class InterruptInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  InterruptInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit InterruptInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit InterruptInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_irq_mapping() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> irq_mapping() const { return GetRepeated<::protozero::ConstBytes>(1); }
+};
+
+class InterruptInfo : public ::protozero::Message {
+ public:
+  using Decoder = InterruptInfo_Decoder;
+  enum : int32_t {
+    kIrqMappingFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.InterruptInfo"; }
+
+  using InterruptMapping = ::perfetto::protos::pbzero::InterruptInfo_InterruptMapping;
+
+  using FieldMetadata_IrqMapping =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      InterruptInfo_InterruptMapping,
+      InterruptInfo>;
+
+  static constexpr FieldMetadata_IrqMapping kIrqMapping{};
+  template <typename T = InterruptInfo_InterruptMapping> T* add_irq_mapping() {
+    return BeginNestedMessage<T>(1);
+  }
+
+};
+
+class InterruptInfo_InterruptMapping_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  InterruptInfo_InterruptMapping_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit InterruptInfo_InterruptMapping_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit InterruptInfo_InterruptMapping_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_irq_id() const { return at<1>().valid(); }
+  uint32_t irq_id() const { return at<1>().as_uint32(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+};
+
+class InterruptInfo_InterruptMapping : public ::protozero::Message {
+ public:
+  using Decoder = InterruptInfo_InterruptMapping_Decoder;
+  enum : int32_t {
+    kIrqIdFieldNumber = 1,
+    kNameFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.InterruptInfo.InterruptMapping"; }
+
+
+  using FieldMetadata_IrqId =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      InterruptInfo_InterruptMapping>;
+
+  static constexpr FieldMetadata_IrqId kIrqId{};
+  void set_irq_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IrqId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      InterruptInfo_InterruptMapping>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -186014,6 +184298,8 @@ namespace protos {
 namespace pbzero {
 class DebugAnnotation;
 class TestEvent_ProtoVmIncrementalState;
+class TestEvent_ProtoVmMessage;
+class TestEvent_ProtoVmMessage_ProtoVmSubmessage;
 class TestEvent_ProtoVmPatch;
 class TestEvent_TestPayload;
 } // Namespace pbzero.
@@ -186060,6 +184346,7 @@ class TestEvent : public ::protozero::Message {
   static constexpr const char* GetName() { return ".perfetto.protos.TestEvent"; }
 
   using TestPayload = ::perfetto::protos::pbzero::TestEvent_TestPayload;
+  using ProtoVmMessage = ::perfetto::protos::pbzero::TestEvent_ProtoVmMessage;
   using ProtoVmPatch = ::perfetto::protos::pbzero::TestEvent_ProtoVmPatch;
   using ProtoVmIncrementalState = ::perfetto::protos::pbzero::TestEvent_ProtoVmIncrementalState;
 
@@ -186184,7 +184471,7 @@ class TestEvent : public ::protozero::Message {
 
 };
 
-class TestEvent_ProtoVmIncrementalState_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class TestEvent_ProtoVmIncrementalState_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
   TestEvent_ProtoVmIncrementalState_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TestEvent_ProtoVmIncrementalState_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -186193,6 +184480,10 @@ class TestEvent_ProtoVmIncrementalState_Decoder : public ::protozero::TypedProto
   ::protozero::ConstChars string_merged() const { return at<1>().as_string(); }
   bool has_int_merged() const { return at<2>().valid(); }
   int32_t int_merged() const { return at<2>().as_int32(); }
+  bool has_single_message() const { return at<3>().valid(); }
+  ::protozero::ConstBytes single_message() const { return at<3>().as_bytes(); }
+  bool has_messages() const { return at<4>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> messages() const { return GetRepeated<::protozero::ConstBytes>(4); }
 };
 
 class TestEvent_ProtoVmIncrementalState : public ::protozero::Message {
@@ -186201,6 +184492,8 @@ class TestEvent_ProtoVmIncrementalState : public ::protozero::Message {
   enum : int32_t {
     kStringMergedFieldNumber = 1,
     kIntMergedFieldNumber = 2,
+    kSingleMessageFieldNumber = 3,
+    kMessagesFieldNumber = 4,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TestEvent.ProtoVmIncrementalState"; }
 
@@ -186246,9 +184539,37 @@ class TestEvent_ProtoVmIncrementalState : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_SingleMessage =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TestEvent_ProtoVmMessage,
+      TestEvent_ProtoVmIncrementalState>;
+
+  static constexpr FieldMetadata_SingleMessage kSingleMessage{};
+  template <typename T = TestEvent_ProtoVmMessage> T* set_single_message() {
+    return BeginNestedMessage<T>(3);
+  }
+
+
+  using FieldMetadata_Messages =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TestEvent_ProtoVmMessage,
+      TestEvent_ProtoVmIncrementalState>;
+
+  static constexpr FieldMetadata_Messages kMessages{};
+  template <typename T = TestEvent_ProtoVmMessage> T* add_messages() {
+    return BeginNestedMessage<T>(4);
+  }
+
 };
 
-class TestEvent_ProtoVmPatch_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class TestEvent_ProtoVmPatch_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
  public:
   TestEvent_ProtoVmPatch_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TestEvent_ProtoVmPatch_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -186257,6 +184578,12 @@ class TestEvent_ProtoVmPatch_Decoder : public ::protozero::TypedProtoDecoder</*M
   ::protozero::ConstChars string_to_merge() const { return at<1>().as_string(); }
   bool has_int_to_merge() const { return at<2>().valid(); }
   int32_t int_to_merge() const { return at<2>().as_int32(); }
+  bool has_single_message() const { return at<3>().valid(); }
+  ::protozero::ConstBytes single_message() const { return at<3>().as_bytes(); }
+  bool has_messages() const { return at<4>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> messages() const { return GetRepeated<::protozero::ConstBytes>(4); }
+  bool has_delete_message_ids() const { return at<5>().valid(); }
+  ::protozero::RepeatedFieldIterator<uint32_t> delete_message_ids() const { return GetRepeated<uint32_t>(5); }
 };
 
 class TestEvent_ProtoVmPatch : public ::protozero::Message {
@@ -186265,6 +184592,9 @@ class TestEvent_ProtoVmPatch : public ::protozero::Message {
   enum : int32_t {
     kStringToMergeFieldNumber = 1,
     kIntToMergeFieldNumber = 2,
+    kSingleMessageFieldNumber = 3,
+    kMessagesFieldNumber = 4,
+    kDeleteMessageIdsFieldNumber = 5,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TestEvent.ProtoVmPatch"; }
 
@@ -186310,6 +184640,144 @@ class TestEvent_ProtoVmPatch : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_SingleMessage =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TestEvent_ProtoVmMessage,
+      TestEvent_ProtoVmPatch>;
+
+  static constexpr FieldMetadata_SingleMessage kSingleMessage{};
+  template <typename T = TestEvent_ProtoVmMessage> T* set_single_message() {
+    return BeginNestedMessage<T>(3);
+  }
+
+
+  using FieldMetadata_Messages =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TestEvent_ProtoVmMessage,
+      TestEvent_ProtoVmPatch>;
+
+  static constexpr FieldMetadata_Messages kMessages{};
+  template <typename T = TestEvent_ProtoVmMessage> T* add_messages() {
+    return BeginNestedMessage<T>(4);
+  }
+
+
+  using FieldMetadata_DeleteMessageIds =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TestEvent_ProtoVmPatch>;
+
+  static constexpr FieldMetadata_DeleteMessageIds kDeleteMessageIds{};
+  void add_delete_message_ids(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_DeleteMessageIds::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class TestEvent_ProtoVmMessage_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  TestEvent_ProtoVmMessage_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TestEvent_ProtoVmMessage_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TestEvent_ProtoVmMessage_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_id() const { return at<1>().valid(); }
+  uint32_t id() const { return at<1>().as_uint32(); }
+  bool has_submessage() const { return at<2>().valid(); }
+  ::protozero::ConstBytes submessage() const { return at<2>().as_bytes(); }
+};
+
+class TestEvent_ProtoVmMessage : public ::protozero::Message {
+ public:
+  using Decoder = TestEvent_ProtoVmMessage_Decoder;
+  enum : int32_t {
+    kIdFieldNumber = 1,
+    kSubmessageFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.TestEvent.ProtoVmMessage"; }
+
+  using ProtoVmSubmessage = ::perfetto::protos::pbzero::TestEvent_ProtoVmMessage_ProtoVmSubmessage;
+
+  using FieldMetadata_Id =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TestEvent_ProtoVmMessage>;
+
+  static constexpr FieldMetadata_Id kId{};
+  void set_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Id::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Submessage =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TestEvent_ProtoVmMessage_ProtoVmSubmessage,
+      TestEvent_ProtoVmMessage>;
+
+  static constexpr FieldMetadata_Submessage kSubmessage{};
+  template <typename T = TestEvent_ProtoVmMessage_ProtoVmSubmessage> T* set_submessage() {
+    return BeginNestedMessage<T>(2);
+  }
+
+};
+
+class TestEvent_ProtoVmMessage_ProtoVmSubmessage_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  TestEvent_ProtoVmMessage_ProtoVmSubmessage_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TestEvent_ProtoVmMessage_ProtoVmSubmessage_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TestEvent_ProtoVmMessage_ProtoVmSubmessage_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_single_int() const { return at<1>().valid(); }
+  uint32_t single_int() const { return at<1>().as_uint32(); }
+};
+
+class TestEvent_ProtoVmMessage_ProtoVmSubmessage : public ::protozero::Message {
+ public:
+  using Decoder = TestEvent_ProtoVmMessage_ProtoVmSubmessage_Decoder;
+  enum : int32_t {
+    kSingleIntFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.TestEvent.ProtoVmMessage.ProtoVmSubmessage"; }
+
+
+  using FieldMetadata_SingleInt =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TestEvent_ProtoVmMessage_ProtoVmSubmessage>;
+
+  static constexpr FieldMetadata_SingleInt kSingleInt{};
+  void set_single_int(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_SingleInt::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class TestEvent_TestPayload_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
@@ -187659,1205 +186127,6 @@ class UiState_HighlightProcess : public ::protozero::Message {
   }
 };
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/evdev.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_EVDEV_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_EVDEV_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class EvdevDevice;
-class EvdevDevice_AbsInfo;
-class EvdevDevice_AbsMtStatesEntry;
-class EvdevDevice_AbsoluteAxisInfosEntry;
-class EvdevDevice_AxisMap;
-class EvdevDevice_AxisMap_AxisStatesEntry;
-class EvdevDevice_AxisStatesEntry;
-class EvdevDevice_EventTypeBitmasksEntry;
-class EvdevDevice_Identifier;
-class EvdevDevice_SlotValuesMap;
-class EvdevDevice_SlotValuesMap_SlotValuesEntry;
-class EvdevEvent_DeviceAddition;
-class EvdevEvent_DeviceRemoval;
-class EvdevEvent_InputEvent;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class EvdevDevice_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/12> {
- public:
-  EvdevDevice_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_device_id() const { return at<1>().valid(); }
-  uint32_t device_id() const { return at<1>().as_uint32(); }
-  bool has_device_num() const { return at<2>().valid(); }
-  uint32_t device_num() const { return at<2>().as_uint32(); }
-  bool has_name() const { return at<3>().valid(); }
-  ::protozero::ConstChars name() const { return at<3>().as_string(); }
-  bool has_phys() const { return at<4>().valid(); }
-  ::protozero::ConstChars phys() const { return at<4>().as_string(); }
-  bool has_uniq() const { return at<5>().valid(); }
-  ::protozero::ConstChars uniq() const { return at<5>().as_string(); }
-  bool has_id() const { return at<6>().valid(); }
-  ::protozero::ConstBytes id() const { return at<6>().as_bytes(); }
-  bool has_absolute_axis_infos() const { return at<7>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> absolute_axis_infos() const { return GetRepeated<::protozero::ConstBytes>(7); }
-  bool has_ev_bitmask() const { return at<8>().valid(); }
-  ::protozero::ConstBytes ev_bitmask() const { return at<8>().as_bytes(); }
-  bool has_event_type_bitmasks() const { return at<9>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> event_type_bitmasks() const { return GetRepeated<::protozero::ConstBytes>(9); }
-  bool has_prop_bitmask() const { return at<10>().valid(); }
-  ::protozero::ConstBytes prop_bitmask() const { return at<10>().as_bytes(); }
-  bool has_axis_states() const { return at<11>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> axis_states() const { return GetRepeated<::protozero::ConstBytes>(11); }
-  bool has_abs_mt_states() const { return at<12>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> abs_mt_states() const { return GetRepeated<::protozero::ConstBytes>(12); }
-};
-
-class EvdevDevice : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_Decoder;
-  enum : int32_t {
-    kDeviceIdFieldNumber = 1,
-    kDeviceNumFieldNumber = 2,
-    kNameFieldNumber = 3,
-    kPhysFieldNumber = 4,
-    kUniqFieldNumber = 5,
-    kIdFieldNumber = 6,
-    kAbsoluteAxisInfosFieldNumber = 7,
-    kEvBitmaskFieldNumber = 8,
-    kEventTypeBitmasksFieldNumber = 9,
-    kPropBitmaskFieldNumber = 10,
-    kAxisStatesFieldNumber = 11,
-    kAbsMtStatesFieldNumber = 12,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice"; }
-
-  using Identifier = ::perfetto::protos::pbzero::EvdevDevice_Identifier;
-  using AbsInfo = ::perfetto::protos::pbzero::EvdevDevice_AbsInfo;
-  using AbsoluteAxisInfosEntry = ::perfetto::protos::pbzero::EvdevDevice_AbsoluteAxisInfosEntry;
-  using EventTypeBitmasksEntry = ::perfetto::protos::pbzero::EvdevDevice_EventTypeBitmasksEntry;
-  using AxisMap = ::perfetto::protos::pbzero::EvdevDevice_AxisMap;
-  using AxisStatesEntry = ::perfetto::protos::pbzero::EvdevDevice_AxisStatesEntry;
-  using SlotValuesMap = ::perfetto::protos::pbzero::EvdevDevice_SlotValuesMap;
-  using AbsMtStatesEntry = ::perfetto::protos::pbzero::EvdevDevice_AbsMtStatesEntry;
-
-  using FieldMetadata_DeviceId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_DeviceId kDeviceId{};
-  void set_device_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DeviceId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DeviceNum =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_DeviceNum kDeviceNum{};
-  void set_device_num(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DeviceNum::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Phys =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_Phys kPhys{};
-  void set_phys(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Phys::kFieldId, data, size);
-  }
-  void set_phys(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Phys::kFieldId, chars.data, chars.size);
-  }
-  void set_phys(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Phys::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Uniq =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_Uniq kUniq{};
-  void set_uniq(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Uniq::kFieldId, data, size);
-  }
-  void set_uniq(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Uniq::kFieldId, chars.data, chars.size);
-  }
-  void set_uniq(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Uniq::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Id =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_Identifier,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_Id kId{};
-  template <typename T = EvdevDevice_Identifier> T* set_id() {
-    return BeginNestedMessage<T>(6);
-  }
-
-
-  using FieldMetadata_AbsoluteAxisInfos =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_AbsoluteAxisInfosEntry,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_AbsoluteAxisInfos kAbsoluteAxisInfos{};
-  template <typename T = EvdevDevice_AbsoluteAxisInfosEntry> T* add_absolute_axis_infos() {
-    return BeginNestedMessage<T>(7);
-  }
-
-
-  using FieldMetadata_EvBitmask =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBytes,
-      std::string,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_EvBitmask kEvBitmask{};
-  void set_ev_bitmask(const uint8_t* data, size_t size) {
-    AppendBytes(FieldMetadata_EvBitmask::kFieldId, data, size);
-  }
-  void set_ev_bitmask(::protozero::ConstBytes bytes) {
-    AppendBytes(FieldMetadata_EvBitmask::kFieldId, bytes.data, bytes.size);
-  }
-  void set_ev_bitmask(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_EvBitmask::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBytes>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_EventTypeBitmasks =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_EventTypeBitmasksEntry,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_EventTypeBitmasks kEventTypeBitmasks{};
-  template <typename T = EvdevDevice_EventTypeBitmasksEntry> T* add_event_type_bitmasks() {
-    return BeginNestedMessage<T>(9);
-  }
-
-
-  using FieldMetadata_PropBitmask =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBytes,
-      std::string,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_PropBitmask kPropBitmask{};
-  void set_prop_bitmask(const uint8_t* data, size_t size) {
-    AppendBytes(FieldMetadata_PropBitmask::kFieldId, data, size);
-  }
-  void set_prop_bitmask(::protozero::ConstBytes bytes) {
-    AppendBytes(FieldMetadata_PropBitmask::kFieldId, bytes.data, bytes.size);
-  }
-  void set_prop_bitmask(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_PropBitmask::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBytes>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_AxisStates =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_AxisStatesEntry,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_AxisStates kAxisStates{};
-  template <typename T = EvdevDevice_AxisStatesEntry> T* add_axis_states() {
-    return BeginNestedMessage<T>(11);
-  }
-
-
-  using FieldMetadata_AbsMtStates =
-    ::protozero::proto_utils::FieldMetadata<
-      12,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_AbsMtStatesEntry,
-      EvdevDevice>;
-
-  static constexpr FieldMetadata_AbsMtStates kAbsMtStates{};
-  template <typename T = EvdevDevice_AbsMtStatesEntry> T* add_abs_mt_states() {
-    return BeginNestedMessage<T>(12);
-  }
-
-};
-
-class EvdevDevice_AbsMtStatesEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  EvdevDevice_AbsMtStatesEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_AbsMtStatesEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_AbsMtStatesEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  uint32_t key() const { return at<1>().as_uint32(); }
-  bool has_value() const { return at<2>().valid(); }
-  ::protozero::ConstBytes value() const { return at<2>().as_bytes(); }
-};
-
-class EvdevDevice_AbsMtStatesEntry : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_AbsMtStatesEntry_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.AbsMtStatesEntry"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_AbsMtStatesEntry>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_SlotValuesMap,
-      EvdevDevice_AbsMtStatesEntry>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  template <typename T = EvdevDevice_SlotValuesMap> T* set_value() {
-    return BeginNestedMessage<T>(2);
-  }
-
-};
-
-class EvdevDevice_SlotValuesMap_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  EvdevDevice_SlotValuesMap_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_SlotValuesMap_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_SlotValuesMap_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_slot_values() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> slot_values() const { return GetRepeated<::protozero::ConstBytes>(1); }
-};
-
-class EvdevDevice_SlotValuesMap : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_SlotValuesMap_Decoder;
-  enum : int32_t {
-    kSlotValuesFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.SlotValuesMap"; }
-
-  using SlotValuesEntry = ::perfetto::protos::pbzero::EvdevDevice_SlotValuesMap_SlotValuesEntry;
-
-  using FieldMetadata_SlotValues =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_SlotValuesMap_SlotValuesEntry,
-      EvdevDevice_SlotValuesMap>;
-
-  static constexpr FieldMetadata_SlotValues kSlotValues{};
-  template <typename T = EvdevDevice_SlotValuesMap_SlotValuesEntry> T* add_slot_values() {
-    return BeginNestedMessage<T>(1);
-  }
-
-};
-
-class EvdevDevice_SlotValuesMap_SlotValuesEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  EvdevDevice_SlotValuesMap_SlotValuesEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_SlotValuesMap_SlotValuesEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_SlotValuesMap_SlotValuesEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  uint32_t key() const { return at<1>().as_uint32(); }
-  bool has_value() const { return at<2>().valid(); }
-  int32_t value() const { return at<2>().as_sint32(); }
-};
-
-class EvdevDevice_SlotValuesMap_SlotValuesEntry : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_SlotValuesMap_SlotValuesEntry_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.SlotValuesMap.SlotValuesEntry"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_SlotValuesMap_SlotValuesEntry>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kSint32,
-      int32_t,
-      EvdevDevice_SlotValuesMap_SlotValuesEntry>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kSint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class EvdevDevice_AxisStatesEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  EvdevDevice_AxisStatesEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_AxisStatesEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_AxisStatesEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  uint32_t key() const { return at<1>().as_uint32(); }
-  bool has_value() const { return at<2>().valid(); }
-  ::protozero::ConstBytes value() const { return at<2>().as_bytes(); }
-};
-
-class EvdevDevice_AxisStatesEntry : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_AxisStatesEntry_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.AxisStatesEntry"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_AxisStatesEntry>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_AxisMap,
-      EvdevDevice_AxisStatesEntry>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  template <typename T = EvdevDevice_AxisMap> T* set_value() {
-    return BeginNestedMessage<T>(2);
-  }
-
-};
-
-class EvdevDevice_AxisMap_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  EvdevDevice_AxisMap_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_AxisMap_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_AxisMap_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_axis_states() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> axis_states() const { return GetRepeated<::protozero::ConstBytes>(1); }
-};
-
-class EvdevDevice_AxisMap : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_AxisMap_Decoder;
-  enum : int32_t {
-    kAxisStatesFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.AxisMap"; }
-
-  using AxisStatesEntry = ::perfetto::protos::pbzero::EvdevDevice_AxisMap_AxisStatesEntry;
-
-  using FieldMetadata_AxisStates =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_AxisMap_AxisStatesEntry,
-      EvdevDevice_AxisMap>;
-
-  static constexpr FieldMetadata_AxisStates kAxisStates{};
-  template <typename T = EvdevDevice_AxisMap_AxisStatesEntry> T* add_axis_states() {
-    return BeginNestedMessage<T>(1);
-  }
-
-};
-
-class EvdevDevice_AxisMap_AxisStatesEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  EvdevDevice_AxisMap_AxisStatesEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_AxisMap_AxisStatesEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_AxisMap_AxisStatesEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  uint32_t key() const { return at<1>().as_uint32(); }
-  bool has_value() const { return at<2>().valid(); }
-  int32_t value() const { return at<2>().as_sint32(); }
-};
-
-class EvdevDevice_AxisMap_AxisStatesEntry : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_AxisMap_AxisStatesEntry_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.AxisMap.AxisStatesEntry"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_AxisMap_AxisStatesEntry>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kSint32,
-      int32_t,
-      EvdevDevice_AxisMap_AxisStatesEntry>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kSint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class EvdevDevice_EventTypeBitmasksEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  EvdevDevice_EventTypeBitmasksEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_EventTypeBitmasksEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_EventTypeBitmasksEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  uint32_t key() const { return at<1>().as_uint32(); }
-  bool has_value() const { return at<2>().valid(); }
-  ::protozero::ConstBytes value() const { return at<2>().as_bytes(); }
-};
-
-class EvdevDevice_EventTypeBitmasksEntry : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_EventTypeBitmasksEntry_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.EventTypeBitmasksEntry"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_EventTypeBitmasksEntry>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBytes,
-      std::string,
-      EvdevDevice_EventTypeBitmasksEntry>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(const uint8_t* data, size_t size) {
-    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
-  }
-  void set_value(::protozero::ConstBytes bytes) {
-    AppendBytes(FieldMetadata_Value::kFieldId, bytes.data, bytes.size);
-  }
-  void set_value(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBytes>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class EvdevDevice_AbsoluteAxisInfosEntry_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  EvdevDevice_AbsoluteAxisInfosEntry_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_AbsoluteAxisInfosEntry_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_AbsoluteAxisInfosEntry_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  uint32_t key() const { return at<1>().as_uint32(); }
-  bool has_value() const { return at<2>().valid(); }
-  ::protozero::ConstBytes value() const { return at<2>().as_bytes(); }
-};
-
-class EvdevDevice_AbsoluteAxisInfosEntry : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_AbsoluteAxisInfosEntry_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.AbsoluteAxisInfosEntry"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_AbsoluteAxisInfosEntry>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice_AbsInfo,
-      EvdevDevice_AbsoluteAxisInfosEntry>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  template <typename T = EvdevDevice_AbsInfo> T* set_value() {
-    return BeginNestedMessage<T>(2);
-  }
-
-};
-
-class EvdevDevice_AbsInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  EvdevDevice_AbsInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_AbsInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_AbsInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_minimum() const { return at<1>().valid(); }
-  int32_t minimum() const { return at<1>().as_sint32(); }
-  bool has_maximum() const { return at<2>().valid(); }
-  int32_t maximum() const { return at<2>().as_sint32(); }
-  bool has_fuzz() const { return at<3>().valid(); }
-  int32_t fuzz() const { return at<3>().as_int32(); }
-  bool has_flat() const { return at<4>().valid(); }
-  int32_t flat() const { return at<4>().as_int32(); }
-  bool has_resolution() const { return at<5>().valid(); }
-  int32_t resolution() const { return at<5>().as_int32(); }
-};
-
-class EvdevDevice_AbsInfo : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_AbsInfo_Decoder;
-  enum : int32_t {
-    kMinimumFieldNumber = 1,
-    kMaximumFieldNumber = 2,
-    kFuzzFieldNumber = 3,
-    kFlatFieldNumber = 4,
-    kResolutionFieldNumber = 5,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.AbsInfo"; }
-
-
-  using FieldMetadata_Minimum =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kSint32,
-      int32_t,
-      EvdevDevice_AbsInfo>;
-
-  static constexpr FieldMetadata_Minimum kMinimum{};
-  void set_minimum(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Minimum::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kSint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Maximum =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kSint32,
-      int32_t,
-      EvdevDevice_AbsInfo>;
-
-  static constexpr FieldMetadata_Maximum kMaximum{};
-  void set_maximum(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Maximum::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kSint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Fuzz =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      EvdevDevice_AbsInfo>;
-
-  static constexpr FieldMetadata_Fuzz kFuzz{};
-  void set_fuzz(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Fuzz::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Flat =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      EvdevDevice_AbsInfo>;
-
-  static constexpr FieldMetadata_Flat kFlat{};
-  void set_flat(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Flat::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Resolution =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      EvdevDevice_AbsInfo>;
-
-  static constexpr FieldMetadata_Resolution kResolution{};
-  void set_resolution(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Resolution::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class EvdevDevice_Identifier_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  EvdevDevice_Identifier_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevDevice_Identifier_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevDevice_Identifier_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_bustype() const { return at<1>().valid(); }
-  uint32_t bustype() const { return at<1>().as_uint32(); }
-  bool has_vendor() const { return at<2>().valid(); }
-  uint32_t vendor() const { return at<2>().as_uint32(); }
-  bool has_product() const { return at<3>().valid(); }
-  uint32_t product() const { return at<3>().as_uint32(); }
-  bool has_version() const { return at<4>().valid(); }
-  uint32_t version() const { return at<4>().as_uint32(); }
-};
-
-class EvdevDevice_Identifier : public ::protozero::Message {
- public:
-  using Decoder = EvdevDevice_Identifier_Decoder;
-  enum : int32_t {
-    kBustypeFieldNumber = 1,
-    kVendorFieldNumber = 2,
-    kProductFieldNumber = 3,
-    kVersionFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevDevice.Identifier"; }
-
-
-  using FieldMetadata_Bustype =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_Identifier>;
-
-  static constexpr FieldMetadata_Bustype kBustype{};
-  void set_bustype(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Bustype::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Vendor =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_Identifier>;
-
-  static constexpr FieldMetadata_Vendor kVendor{};
-  void set_vendor(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Vendor::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Product =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_Identifier>;
-
-  static constexpr FieldMetadata_Product kProduct{};
-  void set_product(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Product::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Version =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevDevice_Identifier>;
-
-  static constexpr FieldMetadata_Version kVersion{};
-  void set_version(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Version::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class EvdevEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  EvdevEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_device_id() const { return at<1>().valid(); }
-  uint32_t device_id() const { return at<1>().as_uint32(); }
-  bool has_input_event() const { return at<2>().valid(); }
-  ::protozero::ConstBytes input_event() const { return at<2>().as_bytes(); }
-  bool has_add_event() const { return at<3>().valid(); }
-  ::protozero::ConstBytes add_event() const { return at<3>().as_bytes(); }
-  bool has_remove_event() const { return at<4>().valid(); }
-  ::protozero::ConstBytes remove_event() const { return at<4>().as_bytes(); }
-};
-
-class EvdevEvent : public ::protozero::Message {
- public:
-  using Decoder = EvdevEvent_Decoder;
-  enum : int32_t {
-    kDeviceIdFieldNumber = 1,
-    kInputEventFieldNumber = 2,
-    kAddEventFieldNumber = 3,
-    kRemoveEventFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevEvent"; }
-
-  using InputEvent = ::perfetto::protos::pbzero::EvdevEvent_InputEvent;
-  using DeviceAddition = ::perfetto::protos::pbzero::EvdevEvent_DeviceAddition;
-  using DeviceRemoval = ::perfetto::protos::pbzero::EvdevEvent_DeviceRemoval;
-
-  using FieldMetadata_DeviceId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevEvent>;
-
-  static constexpr FieldMetadata_DeviceId kDeviceId{};
-  void set_device_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DeviceId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_InputEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevEvent_InputEvent,
-      EvdevEvent>;
-
-  static constexpr FieldMetadata_InputEvent kInputEvent{};
-  template <typename T = EvdevEvent_InputEvent> T* set_input_event() {
-    return BeginNestedMessage<T>(2);
-  }
-
-
-  using FieldMetadata_AddEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevEvent_DeviceAddition,
-      EvdevEvent>;
-
-  static constexpr FieldMetadata_AddEvent kAddEvent{};
-  template <typename T = EvdevEvent_DeviceAddition> T* set_add_event() {
-    return BeginNestedMessage<T>(3);
-  }
-
-
-  using FieldMetadata_RemoveEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevEvent_DeviceRemoval,
-      EvdevEvent>;
-
-  static constexpr FieldMetadata_RemoveEvent kRemoveEvent{};
-  template <typename T = EvdevEvent_DeviceRemoval> T* set_remove_event() {
-    return BeginNestedMessage<T>(4);
-  }
-
-};
-
-class EvdevEvent_DeviceRemoval_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/0> {
- public:
-  EvdevEvent_DeviceRemoval_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevEvent_DeviceRemoval_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevEvent_DeviceRemoval_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-};
-
-class EvdevEvent_DeviceRemoval : public ::protozero::Message {
- public:
-  using Decoder = EvdevEvent_DeviceRemoval_Decoder;
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevEvent.DeviceRemoval"; }
-
-};
-
-class EvdevEvent_DeviceAddition_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  EvdevEvent_DeviceAddition_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevEvent_DeviceAddition_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevEvent_DeviceAddition_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_device() const { return at<1>().valid(); }
-  ::protozero::ConstBytes device() const { return at<1>().as_bytes(); }
-};
-
-class EvdevEvent_DeviceAddition : public ::protozero::Message {
- public:
-  using Decoder = EvdevEvent_DeviceAddition_Decoder;
-  enum : int32_t {
-    kDeviceFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevEvent.DeviceAddition"; }
-
-
-  using FieldMetadata_Device =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      EvdevDevice,
-      EvdevEvent_DeviceAddition>;
-
-  static constexpr FieldMetadata_Device kDevice{};
-  template <typename T = EvdevDevice> T* set_device() {
-    return BeginNestedMessage<T>(1);
-  }
-
-};
-
-class EvdevEvent_InputEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  EvdevEvent_InputEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit EvdevEvent_InputEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit EvdevEvent_InputEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_kernel_timestamp() const { return at<1>().valid(); }
-  uint64_t kernel_timestamp() const { return at<1>().as_uint64(); }
-  bool has_type() const { return at<2>().valid(); }
-  uint32_t type() const { return at<2>().as_uint32(); }
-  bool has_code() const { return at<3>().valid(); }
-  uint32_t code() const { return at<3>().as_uint32(); }
-  bool has_value() const { return at<4>().valid(); }
-  int32_t value() const { return at<4>().as_sint32(); }
-};
-
-class EvdevEvent_InputEvent : public ::protozero::Message {
- public:
-  using Decoder = EvdevEvent_InputEvent_Decoder;
-  enum : int32_t {
-    kKernelTimestampFieldNumber = 1,
-    kTypeFieldNumber = 2,
-    kCodeFieldNumber = 3,
-    kValueFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.EvdevEvent.InputEvent"; }
-
-
-  using FieldMetadata_KernelTimestamp =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      EvdevEvent_InputEvent>;
-
-  static constexpr FieldMetadata_KernelTimestamp kKernelTimestamp{};
-  void set_kernel_timestamp(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_KernelTimestamp::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Type =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevEvent_InputEvent>;
-
-  static constexpr FieldMetadata_Type kType{};
-  void set_type(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Type::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Code =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      EvdevEvent_InputEvent>;
-
-  static constexpr FieldMetadata_Code kCode{};
-  void set_code(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Code::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kSint32,
-      int32_t,
-      EvdevEvent_InputEvent>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kSint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -192240,6 +189509,8 @@ class PERFETTO_EXPORT_COMPONENT Screenshot : public ::protozero::CppMessageObj {
  public:
   enum FieldNumbers {
     kJpgImageFieldNumber = 1,
+    kPamImageFieldNumber = 2,
+    kPpmImageFieldNumber = 3,
   };
 
   Screenshot();
@@ -192261,14 +189532,26 @@ class PERFETTO_EXPORT_COMPONENT Screenshot : public ::protozero::CppMessageObj {
   void set_jpg_image(const std::string& value) { jpg_image_ = value; _has_field_.set(1); }
   void set_jpg_image(const void* p, size_t s) { jpg_image_.assign(reinterpret_cast<const char*>(p), s); _has_field_.set(1); }
 
+  bool has_pam_image() const { return _has_field_[2]; }
+  const std::string& pam_image() const { return pam_image_; }
+  void set_pam_image(const std::string& value) { pam_image_ = value; _has_field_.set(2); }
+  void set_pam_image(const void* p, size_t s) { pam_image_.assign(reinterpret_cast<const char*>(p), s); _has_field_.set(2); }
+
+  bool has_ppm_image() const { return _has_field_[3]; }
+  const std::string& ppm_image() const { return ppm_image_; }
+  void set_ppm_image(const std::string& value) { ppm_image_ = value; _has_field_.set(3); }
+  void set_ppm_image(const void* p, size_t s) { ppm_image_.assign(reinterpret_cast<const char*>(p), s); _has_field_.set(3); }
+
  private:
   std::string jpg_image_{};
+  std::string pam_image_{};
+  std::string ppm_image_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<2> _has_field_{};
+  std::bitset<4> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -192412,6 +189695,70 @@ class PERFETTO_EXPORT_COMPONENT UnsymbolizedSourceLocation : public ::protozero:
 }  // namespace gen
 
 #endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACK_EVENT_SOURCE_LOCATION_PROTO_CPP_H_
+// gen_amalgamated begin header: gen/protos/perfetto/trace/track_event/state_descriptor.gen.h
+// DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACK_EVENT_STATE_DESCRIPTOR_PROTO_CPP_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACK_EVENT_STATE_DESCRIPTOR_PROTO_CPP_H_
+
+#include <stdint.h>
+#include <bitset>
+#include <vector>
+#include <string>
+#include <type_traits>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/cpp_message_obj.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/copyable_ptr.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+class StateDescriptor;
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+namespace protozero {
+class Message;
+}  // namespace protozero
+
+namespace perfetto {
+namespace protos {
+namespace gen {
+
+class PERFETTO_EXPORT_COMPONENT StateDescriptor : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+  };
+
+  StateDescriptor();
+  ~StateDescriptor() override;
+  StateDescriptor(StateDescriptor&&) noexcept;
+  StateDescriptor& operator=(StateDescriptor&&);
+  StateDescriptor(const StateDescriptor&);
+  StateDescriptor& operator=(const StateDescriptor&);
+  bool operator==(const StateDescriptor&) const;
+  bool operator!=(const StateDescriptor& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+ private:
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<2> _has_field_{};
+};
+
+}  // namespace perfetto
+}  // namespace protos
+}  // namespace gen
+
+#endif  // PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACK_EVENT_STATE_DESCRIPTOR_PROTO_CPP_H_
 // gen_amalgamated begin header: gen/protos/perfetto/trace/track_event/task_execution.gen.h
 // DO NOT EDIT. Autogenerated by Perfetto cppgen_plugin
 #ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACK_EVENT_TASK_EXECUTION_PROTO_CPP_H_
@@ -192579,6 +189926,7 @@ enum TrackEvent_Type : int {
   TrackEvent_Type_TYPE_SLICE_END = 2,
   TrackEvent_Type_TYPE_INSTANT = 3,
   TrackEvent_Type_TYPE_COUNTER = 4,
+  TrackEvent_Type_TYPE_STATE = 5,
 };
 enum TrackEvent_LegacyEvent_FlowDirection : int {
   TrackEvent_LegacyEvent_FlowDirection_FLOW_UNSPECIFIED = 0,
@@ -192738,8 +190086,9 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent : public ::protozero::CppMessageObj {
   static constexpr auto TYPE_SLICE_END = TrackEvent_Type_TYPE_SLICE_END;
   static constexpr auto TYPE_INSTANT = TrackEvent_Type_TYPE_INSTANT;
   static constexpr auto TYPE_COUNTER = TrackEvent_Type_TYPE_COUNTER;
+  static constexpr auto TYPE_STATE = TrackEvent_Type_TYPE_STATE;
   static constexpr auto Type_MIN = TrackEvent_Type_TYPE_UNSPECIFIED;
-  static constexpr auto Type_MAX = TrackEvent_Type_TYPE_COUNTER;
+  static constexpr auto Type_MAX = TrackEvent_Type_TYPE_STATE;
   enum FieldNumbers {
     kCategoryIidsFieldNumber = 3,
     kCategoriesFieldNumber = 22,

From 46762dad579bb4cd2759180f328d7c1f5ce4512d Mon Sep 17 00:00:00 2001
From: ulofiai <monsterking@tutamail.com>
Date: Sat, 15 Aug 2026 04:02:08 +0800
Subject: [PATCH 180/344] deps: cherry-pick libuv/libuv@e640dc9

Signed-off-by: ulofiai <monsterking@tutamail.com>
PR-URL: https://github.com/nodejs/node/pull/65118
Fixes: https://github.com/nodejs/node/issues/63638
Refs: https://github.com/libuv/libuv/pull/5152
Refs: https://github.com/libuv/libuv/commit/e640dc93c79e1b930e320853a5f9f65fa489158d
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 deps/uv/src/win/fs-event.c   |  34 +++++++----
 deps/uv/test/test-fs-event.c | 108 +++++++++++++++++++++++++++++------
 2 files changed, 115 insertions(+), 27 deletions(-)

diff --git a/deps/uv/src/win/fs-event.c b/deps/uv/src/win/fs-event.c
index fd77f2a49784..5cb7caea9ac8 100644
--- a/deps/uv/src/win/fs-event.c
+++ b/deps/uv/src/win/fs-event.c
@@ -63,13 +63,17 @@ static void uv__fs_event_queue_readdirchanges(uv_loop_t* loop,
   handle->req_pending = 1;
 }
 
-static void uv__relative_path(const WCHAR* filename,
-                              const WCHAR* dir,
-                              WCHAR** relpath) {
+/* Compute the path of `filename` relative to the watched directory `dir`.
+ * Returns 0 on success, -1 if `filename` is not actually prefixed by `dir`,
+ * which can happen if the directory is a short path. */
+static int uv__relative_path(const WCHAR* filename,
+                             const WCHAR* dir,
+                             WCHAR** relpath) {
   size_t relpathlen;
   size_t filenamelen = wcslen(filename);
   size_t dirlen = wcslen(dir);
-  assert(!_wcsnicmp(filename, dir, dirlen));
+  if (filenamelen <= dirlen || _wcsnicmp(filename, dir, dirlen) != 0)
+    return -1;
   if (dirlen > 0 && dir[dirlen - 1] == '\\')
     dirlen--;
   relpathlen = filenamelen - dirlen - 1;
@@ -78,6 +82,7 @@ static void uv__relative_path(const WCHAR* filename,
     uv_fatal_error(ERROR_OUTOFMEMORY, "uv__malloc");
   wcsncpy(*relpath, filename + dirlen + 1, relpathlen);
   (*relpath)[relpathlen] = L'\0';
+  return 0;
 }
 
 static int uv__split_path(const WCHAR* filename, WCHAR** dir,
@@ -517,12 +522,21 @@ void uv__process_fs_event_req(uv_loop_t* loop, uv_req_t* req,
 
               if (long_filenamew) {
                 /* Get the file name out of the long path. */
-                uv__relative_path(long_filenamew,
-                                  handle->dirw,
-                                  &filenamew);
-                uv__free(long_filenamew);
-                long_filenamew = filenamew;
-                sizew = -1;
+                if (uv__relative_path(long_filenamew,
+                                      handle->dirw,
+                                      &filenamew) == 0) {
+                  uv__free(long_filenamew);
+                  long_filenamew = filenamew;
+                  sizew = -1;
+                } else {
+                  /* The resolved long path was not prefixed by the watched
+                   * directory (e.g. short name vs long name mismatch),
+                   * fall back to the name given by ReadDirectoryChangesW. */
+                  uv__free(long_filenamew);
+                  long_filenamew = NULL;
+                  filenamew = file_info->FileName;
+                  sizew = file_info->FileNameLength / sizeof(WCHAR);
+                }
               } else {
                 /* We couldn't get the long filename, use the one reported. */
                 filenamew = file_info->FileName;
diff --git a/deps/uv/test/test-fs-event.c b/deps/uv/test/test-fs-event.c
index f224181fc368..103e74aed967 100644
--- a/deps/uv/test/test-fs-event.c
+++ b/deps/uv/test/test-fs-event.c
@@ -587,32 +587,107 @@ TEST_IMPL(fs_event_watch_dir_recursive) {
 }
 
 #ifdef _WIN32
+static char short_path_file[MAX_PATH];
+
+static void short_path_timer_cb(uv_timer_t* handle) {
+  ++timer_cb_called;
+  touch_file(short_path_file);
+}
+
+/* Try to create a unique watch directory that has a 8.3 short component
+   under `parent` ("" means the cwd). If it's successful, fills `watch_dir`
+   and `short_dir` with the long and short forms of the created directory
+   respectively, and returns 1. Otherwise removes the directory created
+   and returns 0. */
+static int short_path_make(const char* parent,
+                           char* watch_dir, size_t watch_n,
+                           char* short_dir, size_t short_n) {
+  uv_fs_t req;
+  char tmpl[MAX_PATH];
+  WCHAR watch_dirw[MAX_PATH];
+  WCHAR short_dirw[MAX_PATH];
+  WCHAR long_dirw[MAX_PATH];
+  size_t pathlen;
+  int r;
+
+  if (parent[0] != '\0')
+    r = snprintf(tmpl, sizeof(tmpl), "%s\\watch_dirXXXXXX", parent);
+  else
+    r = snprintf(tmpl, sizeof(tmpl), "watch_dirXXXXXX");
+  if (r < 0 || (size_t) r >= sizeof(tmpl))
+    return 0;
+
+  r = uv_fs_mkdtemp(NULL, &req, tmpl, NULL);
+  if (r != 0) {
+    uv_fs_req_cleanup(&req);
+    return 0;
+  }
+
+  /* Copy the created path out before cleaning up the request that owns it. */
+  pathlen = strlen(req.path);
+  memcpy(watch_dir, req.path, pathlen + 1);
+  uv_fs_req_cleanup(&req);
+
+  /* The caller appends "\\file1" to both watch_dir and short_dir. If there is
+     no room for that suffix, skip this location. */
+  if (pathlen + sizeof("\\file1") <= watch_n &&
+      MultiByteToWideChar(CP_UTF8, 0, watch_dir, -1,
+                          watch_dirw, ARRAY_SIZE(watch_dirw)) != 0 &&
+      GetShortPathNameW(watch_dirw, short_dirw, ARRAY_SIZE(short_dirw)) != 0 &&
+      GetLongPathNameW(watch_dirw, long_dirw, ARRAY_SIZE(long_dirw)) != 0 &&
+      _wcsicmp(short_dirw, long_dirw) != 0 &&
+      WideCharToMultiByte(CP_UTF8, 0, short_dirw, -1,
+                          short_dir, (int) short_n, NULL, NULL) != 0)
+    return 1;
+
+  uv_fs_rmdir(NULL, &req, watch_dir, NULL);
+  uv_fs_req_cleanup(&req);
+  return 0;
+}
+
 TEST_IMPL(fs_event_watch_dir_short_path) {
   uv_loop_t* loop;
-  uv_fs_t req;
+  char temp_path[MAX_PATH];
+  char watch_dir[MAX_PATH];
+  char watch_file[MAX_PATH];
+  char short_dir[MAX_PATH];
+  size_t temp_len;
   int has_shortnames;
   int r;
 
-  /* Setup */
   loop = uv_default_loop();
-  delete_file("watch_dir/file1");
-  delete_dir("watch_dir/");
-  create_dir("watch_dir");
-  create_file("watch_dir/file1");
 
-  /* Newer version of Windows ship with
-     HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation
-     not equal to 0. So we verify the files we created are addressable by a 8.3
-     short name */
-  has_shortnames = uv_fs_stat(NULL, &req, "watch_~1", NULL) != UV_ENOENT;
+  /* This test needs the watched directory to have an 8.3 short component. The
+     generated "watch_dirXXXXXX" name is > 8 chars, so it gets a short alias on
+     volumes where 8.3 name creation is enabled. For non-system volumes on
+     newer Windows it's disabled by default (NtfsDisable8dot3NameCreation=3).
+     The temp dir and the cwd may be on different volumes, so try each and use
+     whichever has a short alias, and skip if neither does. */
+  has_shortnames = 0;
+  temp_len = sizeof(temp_path);
+  if (uv_os_tmpdir(temp_path, &temp_len) == 0)
+    has_shortnames = short_path_make(temp_path,
+                                     watch_dir, sizeof(watch_dir),
+                                     short_dir, sizeof(short_dir));
+  if (!has_shortnames)
+    has_shortnames = short_path_make("",
+                                     watch_dir, sizeof(watch_dir),
+                                     short_dir, sizeof(short_dir));
+
   if (has_shortnames) {
+    snprintf(watch_file, sizeof(watch_file), "%s\\file1", watch_dir);
+    /* short_path_file is used in the timer callback to touch the file. */
+    snprintf(short_path_file, sizeof(short_path_file), "%s\\file1", short_dir);
+    /* The directory was just created, so file1 cannot exist yet. */
+    create_file(watch_file);
+
     r = uv_fs_event_init(loop, &fs_event);
     ASSERT_OK(r);
-    r = uv_fs_event_start(&fs_event, fs_event_cb_dir, "watch_~1", 0);
+    r = uv_fs_event_start(&fs_event, fs_event_cb_dir, short_dir, 0);
     ASSERT_OK(r);
     r = uv_timer_init(loop, &timer);
     ASSERT_OK(r);
-    r = uv_timer_start(&timer, timer_cb_file, 100, 0);
+    r = uv_timer_start(&timer, short_path_timer_cb, 100, 0);
     ASSERT_OK(r);
 
     uv_run(loop, UV_RUN_DEFAULT);
@@ -620,12 +695,11 @@ TEST_IMPL(fs_event_watch_dir_short_path) {
     ASSERT_EQ(1, fs_event_cb_called);
     ASSERT_EQ(1, timer_cb_called);
     ASSERT_EQ(1, close_cb_called);
+    /* Cleanup */
+    delete_file(watch_file);
+    delete_dir(watch_dir);
   }
 
-  /* Cleanup */
-  delete_file("watch_dir/file1");
-  delete_dir("watch_dir/");
-
   MAKE_VALGRIND_HAPPY(loop);
 
   if (!has_shortnames)

From ab50ae60e40742c071128c215b95365f5114aa2b Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Fri, 14 Aug 2026 16:50:00 -0400
Subject: [PATCH 181/344] doc: document open pull request limit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65250
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
---
 CONTRIBUTING.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 90a8a1d50f4f..cfc1bf72b47f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -47,6 +47,8 @@ See [details on our policy on Code of Conduct](./doc/contributing/code-of-conduc
 
 Pull Requests are the way concrete changes are made to the code, documentation,
 dependencies, and tools contained in the `nodejs/node` repository.
+Contributors who are not Collaborators may have no more than 10 pull requests
+open at a time.
 
 * [Dependencies](./doc/contributing/pull-requests.md#dependencies)
 * [Setting up your local environment](./doc/contributing/pull-requests.md#setting-up-your-local-environment)

From 0876a29bb60b1cfe0c826b1fdfbf81fcf1122c05 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Fri, 14 Aug 2026 13:50:14 -0700
Subject: [PATCH 182/344] stream: preserve falsy cancellation reasons

Use undefined as the no-error sentinel when cancelling broadcast and
share consumers. This ensures that 0, an empty string, false, and null
are propagated instead of being converted to clean completion.

Make sync share surface cancellation reasons before handling detached
consumers, and add regression coverage for async and sync consumers.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/64705
Fixes: https://github.com/nodejs/node/issues/64704
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/streams/iter/broadcast.js        | 10 +++---
 lib/internal/streams/iter/share.js            | 26 +++++++-------
 .../test-stream-iter-broadcast-basic.js       | 16 ++++-----
 test/parallel/test-stream-iter-share-async.js | 12 +++++++
 test/parallel/test-stream-iter-share-sync.js  | 36 +++++++++----------
 5 files changed, 56 insertions(+), 44 deletions(-)

diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 4799554b4f50..a1384c9e4d51 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -88,7 +88,7 @@ class BroadcastImpl {
   #consumers = new SafeSet();
   #waiters = [];  // Consumers with pending resolve (subset of #consumers)
   #ended = false;
-  #error = null;
+  #error;
   #cancelled = false;
   #options;
   #writer = null;
@@ -177,7 +177,9 @@ class BroadcastImpl {
           __proto__: null,
           next() {
             if (state.detached) {
-              if (self.#error) return PromiseReject(self.#error);
+              if (self.#error !== undefined) {
+                return PromiseReject(self.#error);
+              }
               return kDone;
             }
 
@@ -194,7 +196,7 @@ class BroadcastImpl {
                 { __proto__: null, done: false, value: chunk });
             }
 
-            if (self.#error) {
+            if (self.#error !== undefined) {
               state.detached = true;
               self.#deleteConsumer(state);
               return PromiseReject(self.#error);
@@ -344,7 +346,7 @@ class BroadcastImpl {
   }
 
   [kAbort](reason) {
-    if (this.#ended || this.#error) return;
+    if (this.#ended || this.#error !== undefined) return;
     this.#error = reason;
     this.#ended = true;
 
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index e4a312fdb41c..97efe7f3065b 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -73,7 +73,7 @@ class ShareImpl {
   #consumers = new SafeSet();
   #sourceIterator = null;
   #sourceExhausted = false;
-  #sourceError = null;
+  #sourceError;
   #cancelled = false;
   #pulling = false;
   #pullWaiters = [];
@@ -129,7 +129,7 @@ class ShareImpl {
       __proto__: null,
       [SymbolAsyncIterator]() {
         const getNext = async () => {
-          if (self.#sourceError) {
+          if (self.#sourceError !== undefined) {
             state.detached = true;
             self.#consumers.delete(state);
             throw self.#sourceError;
@@ -141,7 +141,7 @@ class ShareImpl {
           // cursor must re-pull rather than terminating prematurely.
           for (;;) {
             if (state.detached) {
-              if (self.#sourceError) throw self.#sourceError;
+              if (self.#sourceError !== undefined) throw self.#sourceError;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -167,7 +167,7 @@ class ShareImpl {
             if (self.#sourceExhausted) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError) throw self.#sourceError;
+              if (self.#sourceError !== undefined) throw self.#sourceError;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -176,7 +176,7 @@ class ShareImpl {
             if (shouldBuffer === null) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError) throw self.#sourceError;
+              if (self.#sourceError !== undefined) throw self.#sourceError;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -260,7 +260,9 @@ class ShareImpl {
 
   async #waitForBufferSpace() {
     while (this.#bufferedBytes >= this.#options.budget) {
-      if (this.#cancelled || this.#sourceError || this.#sourceExhausted) {
+      if (this.#cancelled ||
+          this.#sourceError !== undefined ||
+          this.#sourceExhausted) {
         return this.#cancelled ? null : true;
       }
 
@@ -418,7 +420,7 @@ class SyncShareImpl {
   #consumers = new SafeSet();
   #sourceIterator = null;
   #sourceExhausted = false;
-  #sourceError = null;
+  #sourceError;
   #cancelled = false;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
@@ -467,14 +469,14 @@ class SyncShareImpl {
         return {
           __proto__: null,
           next() {
-            if (state.detached) {
-              return { __proto__: null, done: true, value: undefined };
-            }
-            if (self.#sourceError) {
+            if (self.#sourceError !== undefined) {
               state.detached = true;
               self.#deleteConsumer(state);
               throw self.#sourceError;
             }
+            if (state.detached) {
+              return { __proto__: null, done: true, value: undefined };
+            }
             if (self.#cancelled) {
               state.detached = true;
               self.#deleteConsumer(state);
@@ -535,7 +537,7 @@ class SyncShareImpl {
 
             self.#pullFromSource();
 
-            if (self.#sourceError) {
+            if (self.#sourceError !== undefined) {
               state.detached = true;
               self.#deleteConsumer(state);
               throw self.#sourceError;
diff --git a/test/parallel/test-stream-iter-broadcast-basic.js b/test/parallel/test-stream-iter-broadcast-basic.js
index 0644a28a462d..125f386210c9 100644
--- a/test/parallel/test-stream-iter-broadcast-basic.js
+++ b/test/parallel/test-stream-iter-broadcast-basic.js
@@ -260,15 +260,15 @@ async function testWriterFailIdempotent() {
   }, { message: 'fail!' });
 }
 
-// cancel() with falsy reason (0, "", false) should still treat as error
 async function testCancelWithFalsyReason() {
-  const { broadcast: bc } = broadcast();
-  const consumer = bc.push();
-  const resultPromise = text(consumer).catch((err) => err);
-  await new Promise((resolve) => setImmediate(resolve));
-  bc.cancel(0);
-  const result = await resultPromise;
-  assert.strictEqual(result, 0);
+  for (const reason of [0, '', false, null]) {
+    const { broadcast: bc } = broadcast();
+    const iterator = bc.push()[Symbol.asyncIterator]();
+
+    bc.cancel(reason);
+
+    await assert.rejects(iterator.next(), (error) => error === reason);
+  }
 }
 
 // Late-joining consumer should read from oldest buffered entry
diff --git a/test/parallel/test-stream-iter-share-async.js b/test/parallel/test-stream-iter-share-async.js
index f55ca35f6977..314e7bfcf01c 100644
--- a/test/parallel/test-stream-iter-share-async.js
+++ b/test/parallel/test-stream-iter-share-async.js
@@ -132,6 +132,17 @@ async function testShareCancelWithReason() {
   );
 }
 
+async function testShareCancelWithFalsyReason() {
+  for (const reason of [0, '', false, null]) {
+    const shared = share(from('data'));
+    const iterator = shared.pull()[Symbol.asyncIterator]();
+
+    shared.cancel(reason);
+
+    await assert.rejects(iterator.next(), (error) => error === reason);
+  }
+}
+
 async function testShareAbortSignal() {
   const ac = new AbortController();
   const reason = new Error('share aborted');
@@ -357,6 +368,7 @@ Promise.all([
   testShareCancel(),
   testShareCancelMidIteration(),
   testShareCancelWithReason(),
+  testShareCancelWithFalsyReason(),
   testShareAbortSignal(),
   testShareAbortSignalWhileSourcePullPending(),
   testSharePullAbortSignalRejectsPendingNext(),
diff --git a/test/parallel/test-stream-iter-share-sync.js b/test/parallel/test-stream-iter-share-sync.js
index 2b0b1944a7ff..20c98d134206 100644
--- a/test/parallel/test-stream-iter-share-sync.js
+++ b/test/parallel/test-stream-iter-share-sync.js
@@ -87,37 +87,32 @@ function testShareSyncCancelMidIteration() {
 }
 
 function testShareSyncCancelWithReason() {
-  // When cancel(reason) is called, a consumer that hasn't started
-  // iterating is already detached, so it sees done:true (not the error).
-  // But a consumer that is mid-iteration when another consumer cancels
-  // with a reason will see the error on the next pull after cancel.
   const enc = new TextEncoder();
   function* gen() {
     yield [enc.encode('a')];
     yield [enc.encode('b')];
-    yield [enc.encode('c')];
   }
   const shared = shareSync(gen(), { budget: 16384 });
-  const c1 = shared.pull();
-  const c2 = shared.pull();
+  const iterator1 = shared.pull()[Symbol.iterator]();
+  const iterator2 = shared.pull()[Symbol.iterator]();
+  const reason = new Error('sync cancel reason');
+
+  iterator1.next();
+  shared.cancel(reason);
 
-  // c1 reads one item, then c2 cancels with a reason
-  const iter1 = c1[Symbol.iterator]();
-  const first = iter1.next();
-  assert.strictEqual(first.done, false);
+  assert.throws(() => iterator1.next(), (error) => error === reason);
+  assert.throws(() => iterator2.next(), (error) => error === reason);
+}
 
-  shared.cancel(new Error('sync cancel reason'));
+function testShareSyncCancelWithFalsyReason() {
+  for (const reason of [0, '', false, null]) {
+    const shared = shareSync(fromSync('data'));
+    const iterator = shared.pull()[Symbol.iterator]();
 
-  // c1 was already iterating, it's now detached → done
-  const next = iter1.next();
-  assert.strictEqual(next.done, true);
+    shared.cancel(reason);
 
-  // c2 never started, also detached → done (not error)
-  const batches = [];
-  for (const batch of c2) {
-    batches.push(batch);
+    assert.throws(() => iterator.next(), (error) => error === reason);
   }
-  assert.strictEqual(batches.length, 0);
 }
 
 // =============================================================================
@@ -157,6 +152,7 @@ Promise.all([
   testShareSyncCancel(),
   testShareSyncCancelMidIteration(),
   testShareSyncCancelWithReason(),
+  testShareSyncCancelWithFalsyReason(),
   testShareSyncSourceError(),
   testShareSyncStringSource(),
 ]).then(common.mustCall());

From 2989311d81a3d3e5c75e6d105d1e305a10741135 Mon Sep 17 00:00:00 2001
From: Trevor Burnham <trevorburnham@gmail.com>
Date: Fri, 14 Aug 2026 17:43:35 -0400
Subject: [PATCH 183/344] sqlite: reject connection access from authorizer
 callbacks

SQLite requires that an authorizer callback not modify the connection
that invoked it, and counts sqlite3_prepare_v2() and sqlite3_step() as
modifications. node:sqlite let the callback call prepare(), exec(), the
statement execution methods, and other connection-mutating APIs on the
same DatabaseSync. Track authorizer depth on DatabaseSync with an RAII
guard around the callback and throw ERR_INVALID_STATE from the affected
entry points while it is on the stack. Covering every authorizer
invocation, including the re-prepare that SQLite can run during
sqlite3_step(), exposed a second and distinct hazard: reentering a
statement that is currently being stepped is a use-after-free rather
than a contract violation, since finalizing it frees the virtual machine
under sqlite3_step() and re-running it resets that machine
mid-execution. Any callback SQLite invokes during execution can reach
it, so a user-defined function is enough. Track the statements currently
being stepped and reject reentry into only those, which leaves a
user-defined function free to prepare, run, and finalize its own helper
statements.

Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
Fixes: https://github.com/nodejs/node/issues/63207
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/65156
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/sqlite.md                      |  30 +++
 src/node_sqlite.cc                     | 106 +++++++-
 src/node_sqlite.h                      |  49 ++++
 test/parallel/test-sqlite-authz.js     | 330 ++++++++++++++++++++++++-
 test/parallel/test-sqlite-udf-close.js | 203 +++++++++++++++
 5 files changed, 711 insertions(+), 7 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 804b765e59ac..76522062ca2c 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -440,6 +440,11 @@ wrapper around [`sqlite3_create_function_v2()`][].
 
 <!-- YAML
 added: v24.10.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65156
+    description: Accessing the invoking database connection from the authorizer
+                 callback now throws.
 -->
 
 * `callback` {Function|null} The authorizer function to set, or `null` to
@@ -465,6 +470,31 @@ The callback must return one of the following constants:
 * `SQLITE_DENY` - Deny the operation (causes an error).
 * `SQLITE_IGNORE` - Ignore the operation (silently skip).
 
+SQLite requires that the authorizer callback not modify the database connection
+that invoked it, which includes preparing and stepping statements. Methods that
+would do so throw an error with code `ERR_INVALID_STATE` while the callback is
+on the stack, including `database.prepare()`, `database.exec()`, the execution
+methods of that connection's statements, iterators, and tag stores, and
+`database.setAuthorizer()` itself. Other connections remain usable.
+
+The callback can also be invoked from within `statement.run()`,
+`statement.get()`, and similar methods, because SQLite may re-prepare a
+statement during execution after a schema change.
+
+Separately, a statement that is currently being executed cannot be reentered.
+Calling `statement.close()` on it would free the virtual machine that is
+running, and re-running it through `statement.run()`, `statement.get()`,
+`statement.all()`, `statement.iterate()`, `iterator.next()`,
+`iterator.return()`, or the equivalent tag store methods would reset that
+virtual machine mid-execution. All of these throw an `ERR_INVALID_STATE` error
+instead. This applies to any callback SQLite invokes during execution, such as a
+user-defined function. Other statements on the connection remain usable.
+
+Operations that touch no SQLite state stay available from the callback:
+`sqlTagStore.clear()`, which only drops cached statements, and `next()` and
+`return()` on an already-drained iterator, which keep returning
+`{ done: true }`.
+
 ```cjs
 const { DatabaseSync, constants } = require('node:sqlite');
 const db = new DatabaseSync(':memory:');
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 156d4f2e5f5c..df7de0b619d1 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -107,6 +107,27 @@ inline MaybeLocal<String> Utf8StringMaybeOneByte(Isolate* isolate,
     }                                                                          \
   } while (0)
 
+// SQLite requires that an authorizer callback not modify the connection that
+// invoked it. Preparing and stepping statements both count as modifying it.
+// See https://www.sqlite.org/c3ref/set_authorizer.html.
+#define THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db)                             \
+  THROW_AND_RETURN_ON_BAD_STATE(                                               \
+      (env),                                                                   \
+      (db)->IsInAuthorizerCallback(),                                          \
+      "database cannot be accessed from an authorizer callback")
+
+// A statement's virtual machine cannot be reentered while sqlite3_step() is
+// running it. Finalizing it frees the VM outright, and re-running it resets the
+// VM mid-execution; both are use-after-free rather than merely a contract
+// violation. Callbacks that SQLite invokes during execution are therefore
+// barred from reaching the statement being stepped, though other statements on
+// the connection stay usable.
+#define THROW_AND_RETURN_IF_STEPPING(env, stmt)                                \
+  THROW_AND_RETURN_ON_BAD_STATE(                                               \
+      (env),                                                                   \
+      (stmt)->db_->IsSteppingStatement((stmt)->statement_.get()),              \
+      "statement is already being executed")
+
 #define SQLITE_VALUE_TO_JS(from, isolate, use_big_int_args, result, ...)       \
   do {                                                                         \
     switch (sqlite3_##from##_type(__VA_ARGS__)) {                              \
@@ -840,6 +861,12 @@ Intercepted DatabaseSyncLimits::LimitsSetter(
     return Intercepted::kYes;
   }
 
+  if (limits->database_->IsInAuthorizerCallback()) {
+    THROW_ERR_INVALID_STATE(
+        env, "database cannot be accessed from an authorizer callback");
+    return Intercepted::kYes;
+  }
+
   if (!value->IsNumber()) {
     THROW_ERR_INVALID_ARG_TYPE(
         isolate, "Limit value must be a non-negative integer or Infinity.");
@@ -1097,6 +1124,7 @@ void DatabaseSync::CreateTagStore(const FunctionCallbackInfo<Value>& args) {
     THROW_ERR_INVALID_STATE(env, "database is not open");
     return;
   }
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
   int capacity = 1000;
   if (args.Length() > 0 && !args[0]->IsUndefined()) {
     if (!args[0]->IsNumber()) {
@@ -1499,6 +1527,7 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -1636,6 +1665,7 @@ void DatabaseSync::Exec(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -1660,6 +1690,7 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -1833,6 +1864,7 @@ void DatabaseSync::Serialize(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   std::string db_name = "main";
   if (!args[0]->IsUndefined()) {
@@ -1967,6 +1999,7 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
   Utf8Value name(env->isolate(), args[0].As<String>());
   Local<Object> options = args[1].As<Object>();
   Local<Value> start_v;
@@ -2178,6 +2211,7 @@ void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
   DatabaseSync* db;
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   sqlite3_session* pSession;
   int r = sqlite3session_create(db->connection_, db_name.c_str(), &pSession);
@@ -2347,6 +2381,7 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsUint8Array()) {
     THROW_ERR_INVALID_ARG_TYPE(
@@ -2482,6 +2517,7 @@ void DatabaseSync::EnableLoadExtension(
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   Isolate* isolate = env->isolate();
   if (!args[0]->IsBoolean()) {
@@ -2510,6 +2546,7 @@ void DatabaseSync::EnableDefensive(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   Isolate* isolate = env->isolate();
   if (!args[0]->IsBoolean()) {
@@ -2535,6 +2572,7 @@ void DatabaseSync::LoadExtension(const FunctionCallbackInfo<Value>& args) {
       env, !db->allow_load_extension_, "extension loading is not allowed");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !db->enable_load_extension_, "extension loading is not allowed");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2563,6 +2601,7 @@ void DatabaseSync::SetAuthorizer(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   Isolate* isolate = env->isolate();
 
@@ -2599,6 +2638,7 @@ int DatabaseSync::AuthorizerCallback(void* user_data,
                                      const char* param4) {
   DatabaseSync* db = static_cast<DatabaseSync*>(user_data);
   CallbackDepthGuard guard(db);
+  AuthorizerDepthGuard authorizer_guard(db);
   Environment* env = db->env();
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
@@ -2712,12 +2752,20 @@ void StatementSync::Close(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   stmt->Close();
 }
 
 void StatementSync::Dispose(const FunctionCallbackInfo<Value>& args) {
   StatementSync* stmt;
   ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  // Disposal is idempotent, so an already-finalized statement is a no-op even
+  // inside a callback.
+  if (stmt->IsFinalized()) {
+    return;
+  }
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   stmt->Close();
 }
 
@@ -2999,6 +3047,7 @@ MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
   LocalVector<Value> row_values(isolate);
   LocalVector<Name> row_keys(isolate);
 
+  SteppingStatementGuard stepping(db, stmt);
   while ((r = sqlite3_step(stmt)) == SQLITE_ROW) {
     if (num_cols == 0) {
       num_cols = sqlite3_column_count(stmt);
@@ -3041,6 +3090,9 @@ MaybeLocal<Object> StatementExecutionHelper::Run(Environment* env,
                                                  bool use_big_ints) {
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
+  // Declared before the reset below so that it outlives it: sqlite3_reset()
+  // can run JavaScript through an aggregate's xFinal.
+  SteppingStatementGuard stepping(db, stmt);
   bool needs_reset = true;
   auto reset = OnScopeLeave([&]() {
     if (needs_reset) sqlite3_reset(stmt);
@@ -3128,6 +3180,9 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
                                                 bool use_big_ints) {
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
+  // Declared before the reset below so that it outlives it: sqlite3_reset()
+  // can run JavaScript through an aggregate's xFinal.
+  SteppingStatementGuard stepping(db, stmt);
   bool needs_reset = true;
   auto reset = OnScopeLeave([&]() {
     if (needs_reset) sqlite3_reset(stmt);
@@ -3184,6 +3239,8 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   Isolate* isolate = env->isolate();
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
@@ -3215,6 +3272,8 @@ void StatementSync::Iterate(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3238,6 +3297,8 @@ void StatementSync::Get(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3262,6 +3323,8 @@ void StatementSync::Run(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3598,6 +3661,7 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3605,6 +3669,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3624,6 +3690,7 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3631,6 +3698,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3652,6 +3721,7 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3659,6 +3729,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3681,6 +3753,7 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3688,6 +3761,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3713,6 +3788,10 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 void SQLTagStore::Clear(const FunctionCallbackInfo<Value>& args) {
   SQLTagStore* store;
   ASSIGN_OR_RETURN_UNWRAP(&store, args.This());
+  // Clearing the cache drops strong references to the cached statements but
+  // never finalizes one synchronously, so it touches no SQLite state and stays
+  // available from a callback. Invalidating the cache after a schema change is
+  // a legitimate use of an authorizer.
   store->sql_tags_.Clear();
 }
 
@@ -3922,6 +4001,8 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
 
   auto iter_template = getLazyIterTemplate(env);
 
+  // A drained iterator touches no SQLite state, so it stays usable from a
+  // callback and is checked before the guards below.
   if (iter->done_) {
     MaybeLocal<Value> values[]{
         Boolean::New(isolate, true),
@@ -3935,11 +4016,18 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, iter->stmt_->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, iter->stmt_.get());
+
   THROW_AND_RETURN_ON_BAD_STATE(
       env,
       iter->statement_reset_generation_ != iter->stmt_->reset_generation_,
       "iterator was invalidated");
 
+  // sqlite3_reset() can run JavaScript through an aggregate's xFinal, so it
+  // stays inside the guard.
+  SteppingStatementGuard stepping(iter->stmt_->db_.get(),
+                                  iter->stmt_->statement_.get());
   int r = sqlite3_step(iter->stmt_->statement_.get());
   if (r != SQLITE_ROW) {
     CHECK_ERROR_OR_THROW(
@@ -4000,11 +4088,18 @@ void StatementSyncIterator::Return(const FunctionCallbackInfo<Value>& args) {
       env, iter->stmt_->IsFinalized(), "statement has been finalized");
   Isolate* isolate = env->isolate();
 
-  // Unlike Next(), the reset result is intentionally ignored here: Return()
-  // is invoked by the language during abrupt completion (e.g. a `throw`
-  // inside a `for...of` body), and throwing on a deferred SQLite error
-  // would discard the caller's already-pending exception.
-  sqlite3_reset(iter->stmt_->statement_.get());
+  if (!iter->done_) {
+    // A language-invoked return() cannot be reached mid-step, since the loop
+    // body only runs after next() has returned, so these guards only reject an
+    // explicit call from inside a callback.
+    THROW_AND_RETURN_IF_IN_AUTHORIZER(env, iter->stmt_->db_.get());
+    THROW_AND_RETURN_IF_STEPPING(env, iter->stmt_.get());
+    // Unlike Next(), the reset result is intentionally ignored here: Return()
+    // is invoked by the language during abrupt completion (e.g. a `throw`
+    // inside a `for...of` body), and throwing on a deferred SQLite error
+    // would discard the caller's already-pending exception.
+    sqlite3_reset(iter->stmt_->statement_.get());
+  }
   iter->done_ = true;
 
   auto iter_template = getLazyIterTemplate(env);
@@ -4080,6 +4175,7 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
       env, !session->database_->IsOpen(), "database is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, session->session_ == nullptr, "session is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   int nChangeset;
   void* pChangeset;
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 5f51a48fe1cc..daa8d5b8a37e 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -9,6 +9,7 @@
 #include "sqlite3.h"
 #include "util.h"
 
+#include <algorithm>
 #include <array>
 #include <list>
 #include <map>
@@ -265,6 +266,26 @@ class DatabaseSync : public BaseObject {
   void DecrementCallbackDepth() { --callback_depth_; }
   bool IsInCallback() const { return callback_depth_ > 0; }
 
+  // SQLite forbids an authorizer callback from doing anything that modifies
+  // the database connection that invoked it, which includes preparing and
+  // stepping statements. See https://www.sqlite.org/c3ref/set_authorizer.html.
+  void IncrementAuthorizerDepth() { ++authorizer_depth_; }
+  void DecrementAuthorizerDepth() { --authorizer_depth_; }
+  bool IsInAuthorizerCallback() const { return authorizer_depth_ > 0; }
+
+  // Finalizing a statement frees its virtual machine, so a callback that
+  // SQLite invokes from inside sqlite3_step() must not finalize the statement
+  // being stepped. Other statements on the connection are safe to finalize.
+  void PushSteppingStatement(sqlite3_stmt* stmt) {
+    stepping_statements_.push_back(stmt);
+  }
+  void PopSteppingStatement() { stepping_statements_.pop_back(); }
+  bool IsSteppingStatement(sqlite3_stmt* stmt) const {
+    return std::find(stepping_statements_.begin(),
+                     stepping_statements_.end(),
+                     stmt) != stepping_statements_.end();
+  }
+
   SET_MEMORY_INFO_NAME(DatabaseSync)
   SET_SELF_SIZE(DatabaseSync)
 
@@ -279,6 +300,8 @@ class DatabaseSync : public BaseObject {
   sqlite3* connection_;
   bool ignore_next_sqlite_error_;
   int callback_depth_ = 0;
+  int authorizer_depth_ = 0;
+  std::vector<sqlite3_stmt*> stepping_statements_;
 
   std::set<BackupJob*> backups_;
   std::unordered_set<Session*> sessions_;
@@ -460,6 +483,32 @@ class CallbackDepthGuard {
   DatabaseSync* db_;
 };
 
+class SteppingStatementGuard {
+ public:
+  SteppingStatementGuard(DatabaseSync* db, sqlite3_stmt* stmt) : db_(db) {
+    db_->PushSteppingStatement(stmt);
+  }
+  ~SteppingStatementGuard() { db_->PopSteppingStatement(); }
+  SteppingStatementGuard(const SteppingStatementGuard&) = delete;
+  SteppingStatementGuard& operator=(const SteppingStatementGuard&) = delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
+class AuthorizerDepthGuard {
+ public:
+  explicit AuthorizerDepthGuard(DatabaseSync* db) : db_(db) {
+    db_->IncrementAuthorizerDepth();
+  }
+  ~AuthorizerDepthGuard() { db_->DecrementAuthorizerDepth(); }
+  AuthorizerDepthGuard(const AuthorizerDepthGuard&) = delete;
+  AuthorizerDepthGuard& operator=(const AuthorizerDepthGuard&) = delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
 class UserDefinedFunction {
  public:
   UserDefinedFunction(Environment* env,
diff --git a/test/parallel/test-sqlite-authz.js b/test/parallel/test-sqlite-authz.js
index 69c075a57e2e..f6020ce9047e 100644
--- a/test/parallel/test-sqlite-authz.js
+++ b/test/parallel/test-sqlite-authz.js
@@ -1,7 +1,7 @@
 'use strict';
 
-const { skipIfSQLiteMissing } = require('../common');
-skipIfSQLiteMissing();
+const common = require('../common');
+common.skipIfSQLiteMissing();
 
 const assert = require('node:assert');
 const { DatabaseSync, constants } = require('node:sqlite');
@@ -288,3 +288,329 @@ suite('DatabaseSync.prototype.setAuthorizer()', () => {
     });
   });
 });
+
+// SQLite forbids an authorizer callback from modifying the connection that
+// invoked it, which includes preparing and stepping statements.
+// See https://www.sqlite.org/c3ref/set_authorizer.html.
+suite('authorizer callback reentrancy', () => {
+  const expectedError = 'ERR_INVALID_STATE: database cannot be accessed ' +
+    'from an authorizer callback';
+  const steppingError =
+    'ERR_INVALID_STATE: statement is already being executed';
+
+  // Calls each of `cases` from inside an authorizer callback, and returns a
+  // `name -> outcome` map of what each one threw.
+  const runInAuthorizer = (db, cases) => {
+    const outcomes = {};
+    for (const [name, fn] of Object.entries(cases)) {
+      let ran = false;
+      db.setAuthorizer(() => {
+        if (!ran) {
+          ran = true;
+          try {
+            fn();
+            outcomes[name] = 'did not throw';
+          } catch (err) {
+            outcomes[name] = `${err.code}: ${err.message}`;
+          }
+        }
+        return constants.SQLITE_OK;
+      });
+      db.exec('SELECT 1');
+      db.setAuthorizer(null);
+      if (!ran) {
+        outcomes[name] = 'authorizer callback did not run';
+      }
+    }
+    return outcomes;
+  };
+
+  // Builds the expected `name -> outcome` map for the given case names.
+  const allRejected = (cases) => Object.fromEntries(
+    Object.keys(cases).map((name) => [name, expectedError]),
+  );
+
+  it('rejects database methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const cases = {
+      prepare: () => db.prepare('SELECT 1'),
+      exec: () => db.exec('SELECT 1'),
+      setAuthorizer: () => db.setAuthorizer(null),
+      createSession: () => db.createSession(),
+      applyChangeset: () => db.applyChangeset(new Uint8Array([1])),
+      createTagStore: () => db.createTagStore(),
+      serialize: () => db.serialize(),
+      function: () => db.function('noop', () => 1),
+      aggregate: () => db.aggregate('agg', { start: 0, step: (acc) => acc }),
+      enableLoadExtension: () => db.enableLoadExtension(false),
+      enableDefensive: () => db.enableDefensive(true),
+      limits: () => { db.limits.length = 100; },
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // loadExtension() checks that extension loading is enabled before reaching
+  // the authorizer guard, so it needs a database opened with allowExtension.
+  it('rejects loadExtension', () => {
+    const db = new DatabaseSync(':memory:', { allowExtension: true });
+    db.enableLoadExtension(true);
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const cases = {
+      loadExtension: () => db.loadExtension('/nonexistent/extension'),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // close() and deserialize() tear down the connection, so the pre-existing
+  // callback depth guard already rejects them with its own message.
+  it('rejects methods the callback depth guard already covers', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const snapshot = db.serialize();
+    const cases = {
+      close: () => db.close(),
+      deserialize: () => db.deserialize(snapshot),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      close: 'ERR_INVALID_STATE: database cannot be closed while in a callback',
+      deserialize: 'ERR_INVALID_STATE: database cannot be deserialized ' +
+        'while in a callback',
+    });
+  });
+
+  it('rejects statement methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    const cases = {
+      run: () => stmt.run(),
+      get: () => stmt.get(),
+      all: () => stmt.all(),
+      iterate: () => stmt.iterate(),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // Only the statement being stepped is unsafe to finalize. Other statements
+  // on the connection have their own virtual machines, so finalizing them from
+  // a callback is allowed.
+  it('allows finalizing a statement that is not being executed', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const closeStmt = db.prepare('SELECT x FROM t');
+    const disposeStmt = db.prepare('SELECT x FROM t');
+    const cases = {
+      close: () => closeStmt.close(),
+      dispose: () => disposeStmt[Symbol.dispose](),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      close: 'did not throw',
+      dispose: 'did not throw',
+    });
+  });
+
+  // Disposal is idempotent, so a statement that is already finalized must stay
+  // a no-op even inside a callback. Throwing here would turn a `using` scope's
+  // real exception into a SuppressedError.
+  it('allows disposing an already-finalized statement', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.close();
+    const cases = { dispose: () => stmt[Symbol.dispose]() };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      dispose: 'did not throw',
+    });
+  });
+
+  it('rejects session changeset methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER PRIMARY KEY, y TEXT)');
+    const session = db.createSession({ table: 't' });
+    db.exec("INSERT INTO t VALUES (1, 'a')");
+    const cases = {
+      changeset: () => session.changeset(),
+      patchset: () => session.patchset(),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // A statement being re-prepared inside sqlite3_step() is the case that
+  // actually crashes, because that statement's VM is mid-execution.
+  it('rejects finalizing the statement being stepped', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.get();
+    db.exec('ALTER TABLE t ADD COLUMN y INTEGER');
+
+    let outcome = 'authorizer callback did not run';
+    let ran = false;
+    db.setAuthorizer(() => {
+      if (!ran) {
+        ran = true;
+        try {
+          stmt.close();
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+      }
+      return constants.SQLITE_OK;
+    });
+
+    stmt.get();
+
+    assert.strictEqual(outcome, steppingError);
+  });
+
+  // Unlike an already-finalized statement, disposing the one being stepped
+  // would free the running virtual machine, so it throws.
+  it('rejects disposing the statement being stepped', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.get();
+    db.exec('ALTER TABLE t ADD COLUMN y INTEGER');
+
+    let outcome = 'authorizer callback did not run';
+    let ran = false;
+    db.setAuthorizer(() => {
+      if (!ran) {
+        ran = true;
+        try {
+          stmt[Symbol.dispose]();
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+      }
+      return constants.SQLITE_OK;
+    });
+
+    stmt.get();
+
+    assert.strictEqual(outcome, steppingError);
+  });
+
+  it('rejects iterator methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1), (2)');
+    const iter = db.prepare('SELECT x FROM t').iterate();
+    const cases = {
+      next: () => iter.next(),
+      return: () => iter.return(),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+    iter.return();
+  });
+
+  // A drained iterator holds no SQLite state, so next() and return() stay
+  // available and remain idempotent inside a callback.
+  it('allows iterator methods on a drained iterator', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const iter = db.prepare('SELECT x FROM t').iterate();
+    for (const row of iter) {
+      assert.ok(row);
+    }
+    const done = {};
+    const cases = {
+      next: () => { done.next = iter.next().done; },
+      return: () => { done.return = iter.return().done; },
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      next: 'did not throw',
+      return: 'did not throw',
+    });
+    assert.deepStrictEqual(done, { next: true, return: true });
+  });
+
+  it('rejects tag store methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const sql = db.createTagStore(10);
+    const cases = {
+      run: () => sql.run`SELECT 1`,
+      get: () => sql.get`SELECT 1`,
+      all: () => sql.all`SELECT 1`,
+      iterate: () => sql.iterate`SELECT 1`,
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // clear() only drops cached statements, so invalidating the cache after a
+  // schema change is allowed from the callback.
+  it('allows clearing a tag store', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const sql = db.createTagStore(10);
+    assert.strictEqual(sql.all`SELECT x FROM t`.length, 1);
+    assert.strictEqual(sql.size, 1);
+    const cases = { clear: () => sql.clear() };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      clear: 'did not throw',
+    });
+    assert.strictEqual(sql.size, 0);
+  });
+
+  // A statement may be re-prepared during sqlite3_step() after a schema
+  // change, which invokes the authorizer without an explicit prepare() call.
+  it('rejects reentry when the authorizer runs during a re-prepare', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.get();
+    db.exec('ALTER TABLE t ADD COLUMN y INTEGER');
+
+    let outcome = 'authorizer callback did not run';
+    let ran = false;
+    db.setAuthorizer(() => {
+      if (!ran) {
+        ran = true;
+        try {
+          db.prepare('SELECT 1');
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+      }
+      return constants.SQLITE_OK;
+    });
+
+    stmt.get();
+
+    assert.strictEqual(outcome, expectedError);
+  });
+
+  it('allows access again after the authorizer returns', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const cases = { prepare: () => db.prepare('SELECT 1') };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+
+    db.setAuthorizer(() => constants.SQLITE_OK);
+    assert.deepStrictEqual(db.prepare('SELECT 1 AS v').get(), { __proto__: null, v: 1 });
+  });
+});
diff --git a/test/parallel/test-sqlite-udf-close.js b/test/parallel/test-sqlite-udf-close.js
index 86794029b457..cb11e50a7f7a 100644
--- a/test/parallel/test-sqlite-udf-close.js
+++ b/test/parallel/test-sqlite-udf-close.js
@@ -36,4 +36,207 @@ for (const method of ['all', 'get', 'run', 'iterate']) {
     assert.strictEqual(db.isOpen, true);
     db.close();
   });
+
+  // Finalizing the statement being stepped frees the virtual machine that
+  // sqlite3_step() is still running, so this must throw rather than crash.
+  test(`statement.close() from a UDF during statement.${method}()`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER);
+      INSERT INTO data VALUES (1), (2), (3);
+    `);
+
+    let statement;
+    db.function('close_stmt', (value) => {
+      statement.close();
+      return value;
+    });
+
+    statement = db.prepare('SELECT close_stmt(value) FROM data');
+    assert.throws(() => {
+      if (method === 'iterate') {
+        for (const row of statement.iterate()) {
+          assert.ok(row);
+        }
+      } else {
+        statement[method]();
+      }
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: 'statement is already being executed',
+    });
+
+    db.close();
+  });
+
+  // Re-running the statement being stepped resets its virtual machine
+  // mid-execution, which is the same use-after-free as finalizing it.
+  for (const reentrant of ['run', 'get', 'all', 'iterate']) {
+    test(`statement.${reentrant}() from a UDF during ` +
+         `statement.${method}()`, () => {
+      const db = new DatabaseSync(':memory:');
+      db.exec(`
+        CREATE TABLE data (value INTEGER, padding TEXT);
+        INSERT INTO data VALUES (1, '${'x'.repeat(400)}'),
+                                (2, '${'y'.repeat(400)}'),
+                                (3, '${'z'.repeat(400)}');
+      `);
+
+      let statement;
+      let thrown;
+      db.function('reenter', (value) => {
+        if (thrown === undefined) {
+          try {
+            statement[reentrant]();
+            thrown = null;
+          } catch (err) {
+            thrown = err;
+          }
+        }
+        return value;
+      });
+
+      statement = db.prepare('SELECT reenter(value), padding FROM data');
+      if (method === 'iterate') {
+        for (const row of statement.iterate()) {
+          assert.ok(row);
+        }
+      } else {
+        statement[method]();
+      }
+
+      assert.ok(thrown, `${reentrant}() was not rejected`);
+      assert.strictEqual(thrown.code, 'ERR_INVALID_STATE');
+      assert.strictEqual(thrown.message, 'statement is already being executed');
+
+      db.close();
+    });
+  }
+
+  // Tag store methods resolve to a cached statement, which may be the one
+  // currently being stepped. Each reentrant method has its own guard, so all
+  // four are exercised.
+  for (const reentrant of ['run', 'get', 'all', 'iterate']) {
+    test(`tag store ${reentrant} reentry during statement.${method}()`, () => {
+      const db = new DatabaseSync(':memory:');
+      const sql = db.createTagStore(10);
+      db.exec(`
+        CREATE TABLE data (value INTEGER, padding TEXT);
+        INSERT INTO data VALUES (1, '${'x'.repeat(400)}'),
+                                (2, '${'y'.repeat(400)}');
+      `);
+
+      let thrown;
+      db.function('reenter_tag', (value) => {
+        if (thrown === undefined) {
+          try {
+            // The identical tagged literal resolves to the same cached
+            // statement that is mid-execution.
+            // All four reject at call time, iterate() included, so the
+            // result is never consumed.
+            // eslint-disable-next-line no-unused-expressions
+            sql[reentrant]`SELECT reenter_tag(value), padding FROM data`;
+            thrown = null;
+          } catch (err) {
+            thrown = err;
+          }
+        }
+        return value;
+      });
+
+      if (method === 'iterate') {
+        for (const row of sql.iterate`SELECT reenter_tag(value), padding FROM data`) {
+          assert.ok(row);
+        }
+      } else {
+        // eslint-disable-next-line no-unused-expressions
+        sql[method]`SELECT reenter_tag(value), padding FROM data`;
+      }
+
+      assert.ok(thrown, `tag store ${reentrant} reentry was not rejected`);
+      assert.strictEqual(thrown.code, 'ERR_INVALID_STATE');
+      assert.strictEqual(thrown.message,
+                         'statement is already being executed');
+
+      db.close();
+    });
+  }
+
+  // A UDF may prepare and finalize its own helper statements. Only the
+  // statement being stepped is off limits.
+  test(`UDF finalizes its own statement during statement.${method}()`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER);
+      INSERT INTO data VALUES (1), (2), (3);
+      CREATE TABLE lookup (key INTEGER, label TEXT);
+      INSERT INTO lookup VALUES (1, 'one'), (2, 'two'), (3, 'three');
+    `);
+
+    db.function('lookup_label', (value) => {
+      const helper = db.prepare('SELECT label FROM lookup WHERE key = ?');
+      const label = helper.get(value).label;
+      helper.close();
+      return label;
+    });
+
+    const statement = db.prepare('SELECT lookup_label(value) AS l FROM data');
+    if (method === 'iterate') {
+      const labels = [];
+      for (const row of statement.iterate()) {
+        labels.push(row.l);
+      }
+      assert.deepStrictEqual(labels, ['one', 'two', 'three']);
+    } else if (method === 'all') {
+      assert.deepStrictEqual(statement.all().map((r) => r.l),
+                             ['one', 'two', 'three']);
+    } else if (method === 'get') {
+      assert.strictEqual(statement.get().l, 'one');
+    } else {
+      statement.run();
+    }
+
+    db.close();
+  });
+}
+
+// iterator.return() resets the statement it is iterating, and next() steps it
+// again, so both reach the virtual machine that is mid-execution.
+for (const op of ['next', 'return']) {
+  test(`iterator.${op}() from a UDF during iteration`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER, padding TEXT);
+      INSERT INTO data VALUES (1, '${'x'.repeat(400)}'),
+                              (2, '${'y'.repeat(400)}'),
+                              (3, '${'z'.repeat(400)}');
+    `);
+
+    let iterator;
+    let thrown;
+    db.function('reenter_iter', (value) => {
+      if (thrown === undefined && iterator !== undefined) {
+        try {
+          iterator[op]();
+          thrown = null;
+        } catch (err) {
+          thrown = err;
+        }
+      }
+      return value;
+    });
+
+    const statement = db.prepare(
+      'SELECT reenter_iter(value) AS v, padding FROM data');
+    iterator = statement.iterate();
+    for (const row of iterator) {
+      assert.ok(row);
+    }
+
+    assert.ok(thrown, `iterator.${op}() was not rejected`);
+    assert.strictEqual(thrown.code, 'ERR_INVALID_STATE');
+    assert.strictEqual(thrown.message, 'statement is already being executed');
+
+    db.close();
+  });
 }

From 6302168de8d4e4375f7ec3b2b7d812b68aaba47e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Fri, 14 Aug 2026 18:57:31 -0300
Subject: [PATCH 184/344] sqlite: add stmt persistent flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62757
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
---
 doc/api/sqlite.md                           |  12 +-
 src/node_sqlite.cc                          |  34 ++++-
 test/parallel/test-sqlite-statement-sync.js | 156 ++++++++++----------
 3 files changed, 119 insertions(+), 83 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 76522062ca2c..33e1ef57fca3 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -696,6 +696,9 @@ console.log(query.get());
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62757
+    description: Add the `persistent` option.
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65157
     description: Throw `ERR_INVALID_ARG_VALUE` if `sql` contains no statements.
@@ -712,10 +715,14 @@ changes:
     database options or `true`.
   * `allowUnknownNamedParameters` {boolean} If `true`, unknown named parameters
     are ignored. **Default:** inherited from database options or `false`.
+  * `persistent` {boolean} If `true`, hints to SQLite that this statement will
+    be retained for a long time and likely reused many times. SQLite currently
+    responds to this hint by avoiding lookaside memory. Corresponds to the
+    [`SQLITE_PREPARE_PERSISTENT`][] flag. **Default:** `false`.
 * Returns: {StatementSync} The prepared statement.
 
 Compiles a SQL statement into a [prepared statement][]. This method is a wrapper
-around [`sqlite3_prepare_v2()`][].
+around [`sqlite3_prepare_v3()`][].
 
 ### `database.createTagStore([maxSize])`
 
@@ -1882,6 +1889,7 @@ callback function to indicate what type of operation is being authorized.
 [`SQLITE_DETERMINISTIC`]: https://www.sqlite.org/c3ref/c_deterministic.html
 [`SQLITE_DIRECTONLY`]: https://www.sqlite.org/c3ref/c_deterministic.html
 [`SQLITE_MAX_FUNCTION_ARG`]: https://www.sqlite.org/limits.html#max_function_arg
+[`SQLITE_PREPARE_PERSISTENT`]: https://sqlite.org/c3ref/c_prepare_dont_log.html#sqlitepreparepersistent
 [`SQLTagStore`]: #class-sqltagstore
 [`database.applyChangeset()`]: #databaseapplychangesetchangeset-options
 [`database.createTagStore()`]: #databasecreatetagstoremaxsize
@@ -1907,7 +1915,7 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3_get_autocommit()`]: https://sqlite.org/c3ref/get_autocommit.html
 [`sqlite3_last_insert_rowid()`]: https://www.sqlite.org/c3ref/last_insert_rowid.html
 [`sqlite3_load_extension()`]: https://www.sqlite.org/c3ref/load_extension.html
-[`sqlite3_prepare_v2()`]: https://www.sqlite.org/c3ref/prepare.html
+[`sqlite3_prepare_v3()`]: https://www.sqlite.org/c3ref/prepare.html
 [`sqlite3_serialize()`]: https://sqlite.org/c3ref/serialize.html
 [`sqlite3_set_authorizer()`]: https://sqlite.org/c3ref/set_authorizer.html
 [`sqlite3_sql()`]: https://www.sqlite.org/c3ref/expanded_sql.html
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index df7de0b619d1..1b7c11cb69e7 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1539,6 +1539,7 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
   std::optional<bool> use_big_ints;
   std::optional<bool> allow_bare_named_params;
   std::optional<bool> allow_unknown_named_params;
+  std::optional<bool> persistent;
 
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
     if (!args[1]->IsObject()) {
@@ -1619,11 +1620,34 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
       }
       allow_unknown_named_params = allow_unknown_named_params_v->IsTrue();
     }
+
+    Local<Value> persistent_v;
+    if (!options
+             ->Get(env->context(),
+                   FIXED_ONE_BYTE_STRING(env->isolate(), "persistent"))
+             .ToLocal(&persistent_v)) {
+      return;
+    }
+    if (!persistent_v->IsUndefined()) {
+      if (!persistent_v->IsBoolean()) {
+        THROW_ERR_INVALID_ARG_TYPE(
+            env->isolate(),
+            "The \"options.persistent\" argument must be a boolean.");
+        return;
+      }
+      persistent = persistent_v->IsTrue();
+    }
   }
 
   Utf8Value sql(env->isolate(), args[0].As<String>());
   sqlite3_stmt* s = nullptr;
-  int r = sqlite3_prepare_v2(db->connection_, *sql, -1, &s, nullptr);
+
+  unsigned int prep_flags =
+      persistent.value_or(false) ? SQLITE_PREPARE_PERSISTENT : 0;
+
+  int r =
+      sqlite3_prepare_v3(db->connection_, *sql, -1, prep_flags, &s, nullptr);
+
   StatementPtr stmt_ptr(s);
 
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
@@ -3845,8 +3869,12 @@ BaseObjectPtr<StatementSync> SQLTagStore::PrepareStatement(
 
   if (stmt == nullptr) {
     sqlite3_stmt* s = nullptr;
-    int r = sqlite3_prepare_v2(
-        session->database_->connection_, sql.data(), sql.size(), &s, nullptr);
+    int r = sqlite3_prepare_v3(session->database_->connection_,
+                               sql.data(),
+                               sql.size(),
+                               SQLITE_PREPARE_PERSISTENT,
+                               &s,
+                               nullptr);
     StatementPtr stmt_ptr(s);
 
     if (r != SQLITE_OK) {
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index a52634f59ac6..b13da41e9d71 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -18,8 +18,7 @@ suite('StatementSync() constructor', () => {
 
 suite('StatementSync.prototype.get()', () => {
   test('executes a query and returns undefined on no results', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.strictEqual(stmt.get(), undefined);
     stmt = db.prepare('SELECT * FROM storage');
@@ -27,8 +26,7 @@ suite('StatementSync.prototype.get()', () => {
   });
 
   test('executes a query and returns the first result', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.strictEqual(stmt.get(), undefined);
     stmt = db.prepare('INSERT INTO storage (key, val) VALUES (?, ?)');
@@ -39,8 +37,7 @@ suite('StatementSync.prototype.get()', () => {
   });
 
   test('executes a query that returns special columns', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const stmt = db.prepare('SELECT 1 as __proto__, 2 as constructor, 3 as toString');
     t.assert.deepStrictEqual(stmt.get(), { __proto__: null, ['__proto__']: 1, constructor: 2, toString: 3 });
   });
@@ -105,15 +102,13 @@ suite('StatementSync.prototype.get()', () => {
 
 suite('StatementSync.prototype.all()', () => {
   test('executes a query and returns an empty array on no results', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.all(), []);
   });
 
   test('executes a query and returns all results', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.run(), { changes: 0, lastInsertRowid: 0 });
     stmt = db.prepare('INSERT INTO storage (key, val) VALUES (?, ?)');
@@ -189,8 +184,7 @@ suite('StatementSync.prototype.all()', () => {
 
 suite('StatementSync.prototype.iterate()', () => {
   test('executes a query and returns an empty iterator on no results', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     const iter = stmt.iterate();
     t.assert.strictEqual(iter instanceof globalThis.Iterator, true);
@@ -199,8 +193,7 @@ suite('StatementSync.prototype.iterate()', () => {
   });
 
   test('executes a query and returns all results', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.run(), { changes: 0, lastInsertRowid: 0 });
     stmt = db.prepare('INSERT INTO storage (key, val) VALUES (?, ?)');
@@ -402,8 +395,7 @@ suite('StatementSync.prototype.iterate()', () => {
 
 suite('StatementSync.prototype.run()', () => {
   test('executes a query and returns change metadata', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE storage(key TEXT, val TEXT);
       INSERT INTO storage (key, val) VALUES ('foo', 'bar');
@@ -414,8 +406,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite throws when trying to bind too many parameters', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -432,8 +423,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite defaults to NULL for unbound parameters', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
     );
@@ -469,8 +459,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite defaults unbound ?NNN parameters', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
     );
@@ -488,8 +477,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('binds ?NNN params by position', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
     );
@@ -513,8 +501,7 @@ suite('StatementSync.prototype.run()', () => {
 
 suite('StatementSync.prototype.sourceSQL', () => {
   test('equals input SQL', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -537,8 +524,7 @@ suite('StatementSync.prototype.sourceSQL', () => {
 
 suite('StatementSync.prototype.expandedSQL', () => {
   test('equals expanded SQL', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -772,8 +758,7 @@ suite('StatementSync.prototype.resetStats()', () => {
 
 suite('StatementSync.prototype.setReadBigInts()', () => {
   test('BigInts support can be toggled', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
       INSERT INTO data (key, val) VALUES (1, 42);
@@ -805,8 +790,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -821,8 +805,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
   });
 
   test('BigInt is required for reading large integers', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const bad = db.prepare(`SELECT ${Number.MAX_SAFE_INTEGER} + 1`);
     t.assert.throws(() => {
       bad.get();
@@ -853,8 +836,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
 
 suite('StatementSync.prototype.setReturnArrays()', () => {
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -883,8 +865,7 @@ suite('StatementSync.prototype.setReturnArrays()', () => {
 
 suite('StatementSync.prototype.get() with array output', () => {
   test('returns array row when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -903,8 +884,7 @@ suite('StatementSync.prototype.get() with array output', () => {
 
   test('returns array rows with BigInts when both flags are set', (t) => {
     const expected = [1n, 9007199254740992n];
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE big_data(id INTEGER, big_num INTEGER);
       INSERT INTO big_data VALUES (1, 9007199254740992);
@@ -922,8 +902,7 @@ suite('StatementSync.prototype.get() with array output', () => {
 
 suite('StatementSync.prototype.all() with array output', () => {
   test('returns array rows when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -963,8 +942,7 @@ suite('StatementSync.prototype.all() with array output', () => {
       9,
       'text3',
     ];
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE wide_table(
         col1 INTEGER, col2 TEXT, col3 REAL, col4 BLOB, col5 INTEGER,
@@ -988,8 +966,7 @@ suite('StatementSync.prototype.all() with array output', () => {
 
 suite('StatementSync.prototype.iterate() with array output', () => {
   test('iterates array rows when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -1057,8 +1034,7 @@ suite('StatementSync.prototype.iterate() with array output', () => {
 
 suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
   test('bare named parameter support can be toggled', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -1083,8 +1059,7 @@ suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -1113,8 +1088,7 @@ suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
 
 suite('options.readBigInts', () => {
   test('BigInts are returned when input is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
       INSERT INTO data (key, val) VALUES (1, 42);
@@ -1126,8 +1100,7 @@ suite('options.readBigInts', () => {
   });
 
   test('numbers are returned when input is false', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
       INSERT INTO data (key, val) VALUES (1, 42);
@@ -1139,8 +1112,7 @@ suite('options.readBigInts', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -1154,8 +1126,7 @@ suite('options.readBigInts', () => {
   });
 
   test('setReadBigInts can override prepare option', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
       INSERT INTO data (key, val) VALUES (1, 42);
@@ -1171,8 +1142,7 @@ suite('options.readBigInts', () => {
 
 suite('options.returnArrays', () => {
   test('arrays are returned when input is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -1187,8 +1157,7 @@ suite('options.returnArrays', () => {
   });
 
   test('objects are returned when input is false', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -1203,8 +1172,7 @@ suite('options.returnArrays', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;'
     );
@@ -1218,8 +1186,7 @@ suite('options.returnArrays', () => {
   });
 
   test('setReturnArrays can override prepare option', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -1236,8 +1203,7 @@ suite('options.returnArrays', () => {
   });
 
   test('all() returns arrays when input is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -1256,8 +1222,7 @@ suite('options.returnArrays', () => {
   });
 
   test('iterate() returns arrays when input is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
       INSERT INTO data (key, val) VALUES (1, 'one');
@@ -1278,8 +1243,7 @@ suite('options.returnArrays', () => {
 
 suite('options.allowBareNamedParameters', () => {
   test('bare named parameters are allowed when input is true', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -1295,8 +1259,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('bare named parameters throw when input is false', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -1314,8 +1277,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -1332,8 +1294,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('setAllowBareNamedParameters can override prepare option', (t) => {
-    const db = new DatabaseSync(':memory:');
-    t.after(() => { db.close(); });
+    using db = new DatabaseSync(':memory:');
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
     );
@@ -1423,3 +1384,42 @@ suite('StatementSync.prototype[Symbol.dispose]()', () => {
     db.close();
   });
 });
+
+suite('options.persistent', () => {
+  test('statement executes correctly when persistent is true', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;');
+    db.exec('INSERT INTO data (key, val) VALUES (1, 42);');
+    using stmt = db.prepare('SELECT val FROM data', { persistent: true });
+    t.assert.deepStrictEqual(stmt.get(), { __proto__: null, val: 42 });
+  });
+
+  test('statement executes correctly when persistent is false', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;');
+    db.exec('INSERT INTO data (key, val) VALUES (1, 42);');
+    using stmt = db.prepare('SELECT val FROM data', { persistent: false });
+    t.assert.deepStrictEqual(stmt.get(), { __proto__: null, val: 42 });
+  });
+
+  test('throws when input is not a boolean', (t) => {
+    using db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.prepare('SELECT 1', { persistent: 'yes' });
+    }, {
+      code: 'ERR_INVALID_ARG_TYPE',
+      message: /The "options\.persistent" argument must be a boolean/,
+    });
+  });
+
+  test('can be combined with other options', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;');
+    db.exec('INSERT INTO data (key, val) VALUES (1, 42);');
+    using stmt = db.prepare(
+      'SELECT val FROM data',
+      { persistent: true, readBigInts: true }
+    );
+    t.assert.deepStrictEqual(stmt.get(), { __proto__: null, val: 42n });
+  });
+});

From 5edffb544f2381ea3d9eb1613db82609b2d6d011 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Fri, 14 Aug 2026 18:44:35 -0400
Subject: [PATCH 185/344] stream: speed up async iteration of Readable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the async generator backing Symbol.asyncIterator with a
hand-rolled iterator. The generator machinery costs several extra
promise allocations and microtask hops per chunk: yield awaits the
yielded value and resolves the pending request through separate
promises. Buffered chunks are now delivered as an already-resolved
promise, one microtask sooner than before.

Thenable chunks are still awaited before delivery, requests received
while a next() is outstanding are queued, and return()/throw() before
the first next() complete the iterator without touching the stream.

The earlier delivery is observable by code racing an abort against
the first chunk. The flatMap AbortSignal test relied on such a race;
it is reworked to abort deterministically while two mappers are in
flight, asserting the concurrency limit, in-flight cancellation and
rejection, without depending on delivery timing or timers.

streams/readable-async-iterator.js sync='yes': +32.59% (***)
streams/readable-async-iterator.js sync='no': +9.84% (***)

Assisted-by: Claude Fable 5
Signed-off-by: Matteo Collina <matteo.collina@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64447
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
---
 lib/internal/streams/readable.js              | 243 ++++++++++++++++--
 test/parallel/test-stream-flatMap.js          |  23 +-
 .../test-stream-readable-async-iterators.js   | 120 +++++++++
 3 files changed, 351 insertions(+), 35 deletions(-)

diff --git a/lib/internal/streams/readable.js b/lib/internal/streams/readable.js
index 25819d14b7e8..2b87b7952bf9 100644
--- a/lib/internal/streams/readable.js
+++ b/lib/internal/streams/readable.js
@@ -23,6 +23,8 @@
 
 const {
   ArrayPrototypeIndexOf,
+  AsyncIteratorPrototype,
+  FunctionPrototypeCall,
   NumberIsInteger,
   NumberIsNaN,
   NumberParseInt,
@@ -30,6 +32,9 @@ const {
   ObjectKeys,
   ObjectSetPrototypeOf,
   Promise,
+  PromisePrototypeThen,
+  PromiseReject,
+  PromiseResolve,
   ReflectApply,
   SafeSet,
   Symbol,
@@ -100,6 +105,7 @@ const FastBuffer = Buffer[SymbolSpecies];
 
 const { StringDecoder } = require('string_decoder');
 const from = require('internal/streams/from');
+const FixedQueue = require('internal/fixed_queue');
 
 ObjectSetPrototypeOf(Readable.prototype, Stream.prototype);
 ObjectSetPrototypeOf(Readable, Stream);
@@ -1386,10 +1392,22 @@ function streamToAsyncIterator(stream, options) {
   return iter;
 }
 
-async function* createAsyncIterator(stream, options) {
+// Async iterator over a Readable. Requests received while another is
+// outstanding are queued and processed in order.
+function createAsyncIterator(stream, options) {
   let callback = nop;
-
-  function next(resolve) {
+  let error;            // undefined: active, null: ended cleanly, else: Error
+  let started = false;
+  let completed = false;
+  let inFlight = false; // An asynchronous request is outstanding
+  let queue = null;     // Requests received while inFlight
+  let draining = false;
+  let cleanup;
+
+  // Used both as the 'readable' listener (where `this === stream`) and
+  // as a promise executor storing the resolver that wakes up a pending
+  // pump().
+  function wakeup(resolve) {
     if (this === stream) {
       callback();
       callback = nop;
@@ -1398,32 +1416,23 @@ async function* createAsyncIterator(stream, options) {
     }
   }
 
-  stream.on('readable', next);
+  function start() {
+    started = true;
 
-  let error;
-  const cleanup = eos(stream, { writable: false }, (err) => {
-    error = err ? aggregateTwoErrors(error, err) : null;
-    callback();
-    callback = nop;
-  });
+    stream.on('readable', wakeup);
+
+    cleanup = eos(stream, { writable: false }, (err) => {
+      error = err ? aggregateTwoErrors(error, err) : null;
+      callback();
+      callback = nop;
+    });
+  }
+
+  // Complete the iterator and either destroy the stream or detach
+  // from it.
+  function finalize() {
+    completed = true;
 
-  try {
-    while (true) {
-      const chunk = stream.destroyed ? null : stream.read();
-      if (chunk !== null) {
-        yield chunk;
-      } else if (error) {
-        throw error;
-      } else if (error === null) {
-        return;
-      } else {
-        await new Promise(next);
-      }
-    }
-  } catch (err) {
-    error = aggregateTwoErrors(error, err);
-    throw error;
-  } finally {
     const preserveHalfOpenDuplex =
       error === null &&
       stream.allowHalfOpen === true &&
@@ -1437,10 +1446,188 @@ async function* createAsyncIterator(stream, options) {
     ) {
       destroyImpl.destroyer(stream, null);
     } else {
-      stream.off('readable', next);
+      stream.off('readable', wakeup);
       cleanup();
     }
   }
+
+  function settleError(err, reject) {
+    error = aggregateTwoErrors(error, err);
+    finalize();
+    reject(error);
+  }
+
+  function drain() {
+    // Requests settled synchronously call back into drain(); the guard
+    // keeps a single loop going instead of recursing once per request.
+    if (draining) {
+      return;
+    }
+    draining = true;
+    try {
+      while (!inFlight && !queue.isEmpty()) {
+        const req = queue.shift();
+        if (req.type === 'next') {
+          processNext(req.resolve, req.reject);
+        } else if (req.type === 'return') {
+          processReturn(req.value, req.resolve);
+        } else {
+          processThrow(req.value, req.reject);
+        }
+      }
+    } finally {
+      draining = false;
+    }
+  }
+
+  // Thenable chunks are unwrapped before delivery; a rejection tears
+  // down the iterator and the stream.
+  function onChunkFulfilled(value) {
+    inFlight = false;
+    if (queue !== null) drain();
+    return { done: false, value };
+  }
+
+  function onChunkRejected(err) {
+    inFlight = false;
+    error = aggregateTwoErrors(error, err);
+    finalize();
+    if (queue !== null) drain();
+    throw error;
+  }
+
+  // Runs with inFlight === true; settles the request and hands over to
+  // any requests that queued up behind it.
+  function pump(resolve, reject) {
+    const chunk = stream.destroyed ? null : stream.read();
+    if (chunk !== null) {
+      // Read `then` only once so that a getter cannot observe (or throw
+      // on) a second access.
+      const then = chunk.then;
+      if (typeof then === 'function') {
+        FunctionPrototypeCall(then, chunk, (value) => {
+          inFlight = false;
+          resolve({ done: false, value });
+          if (queue !== null) drain();
+        }, (err) => {
+          inFlight = false;
+          settleError(err, reject);
+          if (queue !== null) drain();
+        });
+        return;
+      }
+      inFlight = false;
+      resolve({ done: false, value: chunk });
+      if (queue !== null) drain();
+    } else if (error) {
+      inFlight = false;
+      settleError(error, reject);
+      if (queue !== null) drain();
+    } else if (error === null) {
+      inFlight = false;
+      finalize();
+      resolve({ done: true, value: undefined });
+      if (queue !== null) drain();
+    } else {
+      // No data buffered yet; wait for 'readable' or end-of-stream and
+      // retry.
+      PromisePrototypeThen(new Promise(wakeup), () => pump(resolve, reject));
+    }
+  }
+
+  function processNext(resolve, reject) {
+    if (completed) {
+      resolve({ done: true, value: undefined });
+      return;
+    }
+    if (!started) start();
+    inFlight = true;
+    pump(resolve, reject);
+  }
+
+  function processReturn(value, resolve) {
+    if (!completed) {
+      if (started) {
+        finalize();
+      } else {
+        // Never started: complete without touching the stream.
+        completed = true;
+      }
+    }
+    resolve({ done: true, value });
+  }
+
+  function processThrow(err, reject) {
+    if (completed || !started) {
+      completed = true;
+      reject(err);
+      return;
+    }
+    settleError(err, reject);
+  }
+
+  return {
+    __proto__: AsyncIteratorPrototype,
+    next() {
+      if (!inFlight && !completed) {
+        if (!started) start();
+        // Fast path: a chunk is already buffered.
+        const chunk = stream.destroyed ? null : stream.read();
+        if (chunk !== null) {
+          // Read `then` only once so that a getter cannot observe (or
+          // throw on) a second access.
+          const then = chunk.then;
+          if (typeof then === 'function') {
+            inFlight = true;
+            return FunctionPrototypeCall(
+              then, chunk, onChunkFulfilled, onChunkRejected);
+          }
+          return PromiseResolve({ done: false, value: chunk });
+        }
+        if (error) {
+          finalize();
+          return PromiseReject(error);
+        }
+        if (error === null) {
+          finalize();
+          return PromiseResolve({ done: true, value: undefined });
+        }
+        // No data buffered yet; wait for 'readable' or end-of-stream.
+        inFlight = true;
+        return new Promise((resolve, reject) => {
+          PromisePrototypeThen(new Promise(wakeup), () => pump(resolve, reject));
+        });
+      }
+      return new Promise((resolve, reject) => {
+        if (inFlight) {
+          queue ??= new FixedQueue();
+          queue.push({ __proto__: null, type: 'next', value: undefined, resolve, reject });
+        } else {
+          resolve({ done: true, value: undefined });
+        }
+      });
+    },
+    return(value) {
+      return new Promise((resolve, reject) => {
+        if (inFlight) {
+          queue ??= new FixedQueue();
+          queue.push({ __proto__: null, type: 'return', value, resolve, reject });
+        } else {
+          processReturn(value, resolve);
+        }
+      });
+    },
+    throw(err) {
+      return new Promise((resolve, reject) => {
+        if (inFlight) {
+          queue ??= new FixedQueue();
+          queue.push({ __proto__: null, type: 'throw', value: err, resolve, reject });
+        } else {
+          processThrow(err, reject);
+        }
+      });
+    },
+  };
 }
 
 let composeImpl;
diff --git a/test/parallel/test-stream-flatMap.js b/test/parallel/test-stream-flatMap.js
index 0e55119f7a76..a75672e73c8d 100644
--- a/test/parallel/test-stream-flatMap.js
+++ b/test/parallel/test-stream-flatMap.js
@@ -72,10 +72,23 @@ function oneTo5() {
 
 {
   // Concurrency + AbortSignal
+  // Two mappers are started concurrently and block until their signal
+  // is aborted. Aborting while both are in flight must cancel them and
+  // reject the iteration, without ever starting a third mapper.
   const ac = new AbortController();
-  const stream = oneTo5().flatMap(common.mustNotCall(async (_, { signal }) => {
-    await setTimeout(100, { signal });
-  }), { signal: ac.signal, concurrency: 2 });
+  const stream = oneTo5().flatMap(common.mustCall(async (x, { signal }) => {
+    if (x === 2) {
+      // Both mappers allowed by `concurrency` are now in flight.
+      ac.abort();
+    }
+    const { promise, reject } = Promise.withResolvers();
+    if (signal.aborted) {
+      reject(signal.reason);
+    }
+    signal.addEventListener('abort', () => reject(signal.reason), { once: true });
+    // Promise is expected to reject.
+    await promise;
+  }, 2), { signal: ac.signal, concurrency: 2 });
   // pump
   assert.rejects(async () => {
     for await (const item of stream) {
@@ -85,10 +98,6 @@ function oneTo5() {
   }, {
     name: 'AbortError',
   }).then(common.mustCall());
-
-  queueMicrotask(() => {
-    ac.abort();
-  });
 }
 
 {
diff --git a/test/parallel/test-stream-readable-async-iterators.js b/test/parallel/test-stream-readable-async-iterators.js
index 8081b35191a1..f9bcaea6057b 100644
--- a/test/parallel/test-stream-readable-async-iterators.js
+++ b/test/parallel/test-stream-readable-async-iterators.js
@@ -869,5 +869,125 @@ async function tests() {
   }));
 }
 
+{
+  // Thenable chunks are awaited before delivery.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    r.push(Promise.resolve('unwrapped'));
+    r.push(null);
+
+    const it = r[Symbol.asyncIterator]();
+    const { value, done } = await it.next();
+    assert.strictEqual(done, false);
+    assert.strictEqual(value, 'unwrapped');
+  })().then(common.mustCall());
+}
+
+{
+  // A rejected thenable chunk tears down the iterator and the stream.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    const rejected = Promise.reject(new Error('kaboom'));
+    rejected.catch(() => {});
+    r.push(rejected);
+    r.push(null);
+
+    const it = r[Symbol.asyncIterator]();
+    await assert.rejects(it.next(), { message: 'kaboom' });
+    assert.strictEqual((await it.next()).done, true);
+    assert.strictEqual(r.destroyed, true);
+  })().then(common.mustCall());
+}
+
+{
+  // throw() rejects with the passed error, destroys the stream and
+  // completes the iterator.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    r.push('a');
+
+    const it = r[Symbol.asyncIterator]();
+    assert.strictEqual((await it.next()).value, 'a');
+    await assert.rejects(it.throw(new Error('kaboom')), { message: 'kaboom' });
+    assert.strictEqual(r.destroyed, true);
+    assert.strictEqual((await it.next()).done, true);
+  })().then(common.mustCall());
+}
+
+{
+  // throw() before the first next() completes the iterator without
+  // touching the stream.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    const it = r[Symbol.asyncIterator]();
+    await assert.rejects(it.throw(new Error('kaboom')), { message: 'kaboom' });
+    assert.strictEqual(r.destroyed, false);
+    assert.strictEqual(r.listenerCount('readable'), 0);
+    assert.strictEqual((await it.next()).done, true);
+    r.destroy();
+  })().then(common.mustCall());
+}
+
+{
+  // Concurrent next() calls while waiting for data are served in order.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    const it = r[Symbol.asyncIterator]();
+
+    const p1 = it.next();
+    const p2 = it.next();
+    r.push('a');
+    r.push('b');
+    r.push(null);
+
+    assert.strictEqual((await p1).value, 'a');
+    assert.strictEqual((await p2).value, 'b');
+    assert.strictEqual((await it.next()).done, true);
+  })().then(common.mustCall());
+}
+
+{
+  // return() while a next() is pending is processed after the pending
+  // next() settles, and destroys the stream.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    const it = r[Symbol.asyncIterator]();
+
+    const p1 = it.next();
+    const p2 = it.return();
+    r.push('a');
+
+    assert.strictEqual((await p1).value, 'a');
+    assert.deepStrictEqual(await p2, { done: true, value: undefined });
+    assert.strictEqual(r.destroyed, true);
+  })().then(common.mustCall());
+}
+
+{
+  // Draining a large number of queued next() calls must not overflow
+  // the call stack.
+  // Refs: https://github.com/nodejs/node/pull/64447#discussion_r3566240419
+  (async () => {
+    const count = 20_000;
+    const r = new Readable({ objectMode: true, read() {} });
+    const it = r[Symbol.asyncIterator]();
+
+    const requests = [];
+    for (let i = 0; i < count; i++) {
+      requests.push(it.next());
+    }
+    for (let i = 0; i < count; i++) {
+      r.push(i);
+    }
+    r.push(null);
+
+    const results = await Promise.all(requests);
+    for (let i = 0; i < count; i++) {
+      assert.deepStrictEqual(results[i], { done: false, value: i });
+    }
+    assert.strictEqual((await it.next()).done, true);
+  })().then(common.mustCall());
+}
+
 // To avoid missing some tests if a promise does not resolve
 tests().then(common.mustCall());

From 562168f93fd9b3b9fad71f5380d8ae344d04f310 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sat, 8 Aug 2026 17:00:33 +0200
Subject: [PATCH 186/344] benchmark: apply `highWaterMark` in webstreams
 `pipe-to`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The highWaterMark values were passed as properties of the underlying
source and sink dictionaries, where they are ignored: a queuing
strategy's highWaterMark is read from the constructors' second argument.
Every configuration therefore measured the identical workload at the
default highWaterMark of 1, which also explains the historically high
run-to-run variance of this benchmark family.

Pass the strategies as the constructors' second argument and cover the
default (1) alongside buffered (1024, 4096) configurations.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65138
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 benchmark/webstreams/pipe-to.js | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/benchmark/webstreams/pipe-to.js b/benchmark/webstreams/pipe-to.js
index 38324cd20822..e902f67a9887 100644
--- a/benchmark/webstreams/pipe-to.js
+++ b/benchmark/webstreams/pipe-to.js
@@ -7,8 +7,8 @@ const {
 
 const bench = common.createBenchmark(main, {
   n: [5e5],
-  highWaterMarkR: [512, 1024, 2048, 4096],
-  highWaterMarkW: [512, 1024, 2048, 4096],
+  highWaterMarkR: [1, 1024, 4096],
+  highWaterMarkW: [1, 1024, 4096],
 });
 
 
@@ -16,7 +16,6 @@ async function main({ n, highWaterMarkR, highWaterMarkW }) {
   const b = Buffer.alloc(1024);
   let i = 0;
   const rs = new ReadableStream({
-    highWaterMark: highWaterMarkR,
     pull: function(controller) {
       if (i++ < n) {
         controller.enqueue(b);
@@ -24,12 +23,11 @@ async function main({ n, highWaterMarkR, highWaterMarkW }) {
         controller.close();
       }
     },
-  });
+  }, { highWaterMark: highWaterMarkR });
   const ws = new WritableStream({
-    highWaterMark: highWaterMarkW,
     write(chunk, controller) {},
     close() { bench.end(n); },
-  });
+  }, { highWaterMark: highWaterMarkW });
 
   bench.start();
   rs.pipeTo(ws);

From f7e0c81be4c73ea0045e8788db4aa05f6b6e23fd Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sat, 8 Aug 2026 17:00:48 +0200
Subject: [PATCH 187/344] stream: cut promise churn in webstreams hot paths
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three related reductions on the per-chunk paths:

Wrap user sink.write and source.pull callbacks without coercing their
result into a promise. When the callback returns a non-thenable (the
common synchronous case), fulfillment is guaranteed and no then() lookup
is observable, so the fulfilled reaction is enqueued through a single
shared resolved promise at the exact microtask position the coerced
promise's reaction would have had, skipping the implicit async-wrapper
promise per chunk. Thenable results go through PromiseResolve(), which
matches the spec's "a promise resolved with" conversion (identity for
native promises).

Park pipeTo's pump on backpressure by installing a record that
duck-types the writer's lazily-materialized [[readyPromise]] record and
whose resolve function is the pump continuation itself. Backpressure
clearing then resumes the pump directly instead of materializing a fresh
promise record plus reaction per flip, and the pump no longer schedules
a microtask per batch. writableStreamUpdateBackpressure publishes the
new backpressure state before resolving the ready record so the pump
observes the updated value.

Replace queueMicrotask() on the pipeTo and tee chunk-forwarding paths
with a reaction on the shared resolved promise, which enqueues the
continuation at the same position without the per-call scheduling
overhead.

pipe-to improves by 8-14% across all benchmark configurations, with
readable-read and tee also improving in spot runs.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65138
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/internal/webstreams/readablestream.js | 79 ++++++++++++++++++-----
 lib/internal/webstreams/util.js           | 45 ++++++++++++-
 lib/internal/webstreams/writablestream.js | 27 ++++++--
 3 files changed, 126 insertions(+), 25 deletions(-)

diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index b05cb7c257eb..ed7b8fd87761 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -101,6 +101,7 @@ const {
   cloneAsUint8Array,
   copyArrayBuffer,
   createPromiseCallback1Param,
+  createRawCallback1Param,
   customInspect,
   defaultSizeAlgorithm,
   dequeueValue,
@@ -110,6 +111,7 @@ const {
   getNonWritablePropertyDescriptor,
   isBrandCheck,
   kEmptyQueue,
+  kResolvedPromise,
   kState,
   kType,
   lazyTransfer,
@@ -121,6 +123,7 @@ const {
   resetQueue,
   resolvedRecord,
   setPromiseHandled,
+  thenAlgorithmResult,
 } = require('internal/webstreams/util');
 
 const {
@@ -137,7 +140,6 @@ const {
   writableStreamDefaultWriterRelease,
   writableStreamDefaultWriterWriteWithRequest,
   writerClosedPromise,
-  writerReadyPromise,
 } = require('internal/webstreams/writablestream');
 
 const { Buffer } = require('buffer');
@@ -1664,11 +1666,31 @@ function readableStreamPipeTo(
   // the chunk travels through `pendingChunk`.
   let pendingChunk;
   let readRequest;
+  let readyHook;
 
   // Ready promise rejection is handled by the destination-errored
   // watcher.
   function ignoreReadyRejection() {}
 
+  // Parks the pump on the destination's backpressure by installing a
+  // record that duck-types the writer's lazily-materialized
+  // [[readyPromise]] record: writableStreamUpdateBackpressure resolves it
+  // when backpressure clears (after publishing the new backpressure
+  // state), which re-enters the pump directly instead of rotating a
+  // fresh promise record plus reaction per flip. The pipe holds the only
+  // reference to the writer, so the record is never observable as a real
+  // ready promise; the erroring/release paths probe `promise` via
+  // isPromisePending() and call `reject`, so it carries a real
+  // forever-pending promise and a no-op reject.
+  function parkOnReady() {
+    readyHook ??= {
+      promise: new Promise(nonOpCallback),
+      resolve: pump,
+      reject: ignoreReadyRejection,
+    };
+    writer[kState].ready = readyHook;
+  }
+
   function forwardChunk() {
     const chunk = pendingChunk;
     pendingChunk = undefined;
@@ -1680,10 +1702,7 @@ function readableStreamPipeTo(
     if (shuttingDown) return;
 
     if (dest[kState].backpressure) {
-      PromisePrototypeThen(
-        writerReadyPromise(writer).promise,
-        pump,
-        ignoreReadyRejection);
+      parkOnReady();
       return;
     }
 
@@ -1728,9 +1747,18 @@ function readableStreamPipeTo(
         return;
       }
 
-      // Yield to microtask queue between batches to allow events/signals
-      // to fire
-      queueMicrotask(pump);
+      // Park on backpressure directly: the ready hook resumes the pump
+      // when a completed write clears it.
+      if (dest[kState].backpressure) {
+        parkOnReady();
+        return;
+      }
+
+      // Yield to the microtask queue between batches so completed-write
+      // reactions and events/signals fire; a shared resolved promise
+      // enqueues the continuation at the same position as queueMicrotask
+      // without the per-batch scheduling overhead.
+      PromisePrototypeThen(kResolvedPromise, pump);
       return;
     }
 
@@ -1742,7 +1770,7 @@ function readableStreamPipeTo(
         // synchronous write during enqueue(). See WHATWG Streams spec
         // "ReadableStreamPipeTo" step 15's "chunk steps".
         pendingChunk = chunk;
-        queueMicrotask(forwardChunk);
+        PromisePrototypeThen(kResolvedPromise, forwardChunk);
       },
       [kClose]() {},
       [kError]() {},
@@ -1857,7 +1885,7 @@ function readableStreamDefaultTee(stream, cloneForBranch2) {
         // The microtask is required by the spec (ReadableStreamTee's
         // "chunk steps" queue one).
         pendingChunk = value;
-        queueMicrotask(forwardChunk);
+        PromisePrototypeThen(kResolvedPromise, forwardChunk);
       },
       [kClose]() {
         // The `process.nextTick()` is not part of the spec.
@@ -2010,7 +2038,7 @@ function readableByteStreamTee(stream) {
     defaultReadRequest ??= {
       [kChunk](chunk) {
         pendingChunk = chunk;
-        queueMicrotask(forwardChunk);
+        PromisePrototypeThen(kResolvedPromise, forwardChunk);
       },
       [kClose]() {
         reading = false;
@@ -2699,8 +2727,18 @@ function readableStreamDefaultControllerPull(controller) {
     controller[kState].pullRejected =
       (error) => readableStreamDefaultControllerError(controller, error);
   }
-  PromisePrototypeThen(
-    controller[kState].pullAlgorithm(controller),
+  // The pull algorithm may be a raw callback (a wrapped user source.pull
+  // returns its result uncoerced; a synchronous throw surfaces here) or an
+  // internal algorithm that always returns a promise; thenAlgorithmResult
+  // handles both.
+  let result;
+  try {
+    result = controller[kState].pullAlgorithm(controller);
+  } catch (error) {
+    result = PromiseReject(error);
+  }
+  thenAlgorithmResult(
+    result,
     controller[kState].pullFulfilled,
     controller[kState].pullRejected);
 }
@@ -2826,7 +2864,7 @@ function setupReadableStreamDefaultControllerFromSource(
     FunctionPrototypeBind(start, source, controller) :
     nonOpStart;
   const pullAlgorithm = pull ?
-    createPromiseCallback1Param('source.pull', pull, source) :
+    createRawCallback1Param('source.pull', pull, source) :
     nonOpPull;
   const cancelAlgorithm = cancel ?
     createPromiseCallback1Param('source.cancel', cancel, source) :
@@ -3519,8 +3557,15 @@ function readableByteStreamControllerCallPullIfNeeded(controller) {
     controller[kState].pullRejected =
       (error) => readableByteStreamControllerError(controller, error);
   }
-  PromisePrototypeThen(
-    controller[kState].pullAlgorithm(controller),
+  // See readableStreamDefaultControllerPull for the raw-callback contract.
+  let result;
+  try {
+    result = controller[kState].pullAlgorithm(controller);
+  } catch (error) {
+    result = PromiseReject(error);
+  }
+  thenAlgorithmResult(
+    result,
     controller[kState].pullFulfilled,
     controller[kState].pullRejected);
 }
@@ -3700,7 +3745,7 @@ function setupReadableByteStreamControllerFromSource(
     FunctionPrototypeBind(start, source, controller) :
     nonOpStart;
   const pullAlgorithm = pull ?
-    createPromiseCallback1Param('source.pull', pull, source) :
+    createRawCallback1Param('source.pull', pull, source) :
     nonOpPull;
   const cancelAlgorithm = cancel ?
     createPromiseCallback1Param('source.cancel', cancel, source) :
diff --git a/lib/internal/webstreams/util.js b/lib/internal/webstreams/util.js
index 8bc4c02be31e..b3a8e7827e38 100644
--- a/lib/internal/webstreams/util.js
+++ b/lib/internal/webstreams/util.js
@@ -338,6 +338,40 @@ function createPromiseCallbackNoParams(name, fn, thisArg) {
   return async () => FunctionPrototypeCall(fn, thisArg);
 }
 
+// Raw variants that skip the async wrapper's implicit result promise.
+// Consumers of a raw callback invoke it inside try/catch and route the
+// result through thenAlgorithmResult() below.
+function createRawCallback1Param(name, fn, thisArg) {
+  validateFunction(fn, name);
+  return (arg) => FunctionPrototypeCall(fn, thisArg, arg);
+}
+
+function createRawCallback2Params(name, fn, thisArg) {
+  validateFunction(fn, name);
+  return (arg1, arg2) => FunctionPrototypeCall(fn, thisArg, arg1, arg2);
+}
+
+// A single shared, forever-resolved promise used to enqueue a reaction at
+// the next microtask checkpoint without allocating a fresh promise.
+const kResolvedPromise = PromiseResolve();
+
+// Wires the (possibly non-thenable) result of an underlying algorithm
+// callback to its fulfilled/rejected continuations. A non-thenable result
+// means fulfillment is guaranteed and no then() lookup is observable, so
+// the fulfillment step is enqueued directly at the exact microtask
+// position the coerced promise's reaction would have had, skipping the
+// per-chunk promise allocation. For thenable results PromiseResolve()
+// matches the spec's "a promise resolved with" conversion (identity for
+// native promises).
+function thenAlgorithmResult(result, onFulfilled, onRejected) {
+  if (result === null ||
+      (typeof result !== 'object' && typeof result !== 'function')) {
+    PromisePrototypeThen(kResolvedPromise, onFulfilled);
+  } else {
+    PromisePrototypeThen(PromiseResolve(result), onFulfilled, onRejected);
+  }
+}
+
 function createPromiseCallback1Param(name, fn, thisArg) {
   validateFunction(fn, name);
   return async (arg) => FunctionPrototypeCall(fn, thisArg, arg);
@@ -386,11 +420,14 @@ async function nonOpFlush() {}
 
 function nonOpStart() {}
 
-async function nonOpPull() {}
+// nonOpPull and nonOpWrite are raw callbacks (see createRawCallback*):
+// their non-thenable return takes the allocation-free fast path in
+// thenAlgorithmResult().
+function nonOpPull() {}
 
 async function nonOpCancel() {}
 
-async function nonOpWrite() {}
+function nonOpWrite() {}
 
 let transfer;
 function lazyTransfer() {
@@ -411,6 +448,8 @@ module.exports = {
   createPromiseCallbackNoParams,
   createPromiseCallback1Param,
   createPromiseCallback2Params,
+  createRawCallback1Param,
+  createRawCallback2Params,
   customInspect,
   defaultSizeAlgorithm,
   dequeueValue,
@@ -421,6 +460,7 @@ module.exports = {
   isBrandCheck,
   isPromisePending,
   kEmptyQueue,
+  kResolvedPromise,
   kState,
   kType,
   lazyTransfer,
@@ -435,4 +475,5 @@ module.exports = {
   resetQueue,
   resolvedRecord,
   setPromiseHandled,
+  thenAlgorithmResult,
 };
diff --git a/lib/internal/webstreams/writablestream.js b/lib/internal/webstreams/writablestream.js
index 10b7dbcf277c..5c73f0fe757e 100644
--- a/lib/internal/webstreams/writablestream.js
+++ b/lib/internal/webstreams/writablestream.js
@@ -56,7 +56,7 @@ const {
   Queue,
   createPromiseCallbackNoParams,
   createPromiseCallback1Param,
-  createPromiseCallback2Params,
+  createRawCallback2Params,
   customInspect,
   defaultSizeAlgorithm,
   dequeueValue,
@@ -78,6 +78,7 @@ const {
   resetQueue,
   resolvedRecord,
   setPromiseHandled,
+  thenAlgorithmResult,
 } = require('internal/webstreams/util');
 
 const {
@@ -769,7 +770,12 @@ function writableStreamUpdateBackpressure(controller, streamState) {
   const backpressure =
     controllerState.highWaterMark - controllerState.queueTotalSize <= 0;
   const writer = streamState.writer;
-  if (writer !== undefined && streamState.backpressure !== backpressure) {
+  const changed = streamState.backpressure !== backpressure;
+  // The state field is published before the ready record is resolved so
+  // that a ready resolve hook (pipeTo's pump continuation) observes the
+  // new value.
+  streamState.backpressure = backpressure;
+  if (writer !== undefined && changed) {
     if (backpressure) {
       // The spec replaces [[readyPromise]] with a fresh pending promise;
       // dropping the cache lets the next observation derive it.
@@ -778,7 +784,6 @@ function writableStreamUpdateBackpressure(controller, streamState) {
       writer[kState].ready?.resolve();
     }
   }
-  streamState.backpressure = backpressure;
 }
 
 function writableStreamStartErroring(stream, reason) {
@@ -1197,8 +1202,18 @@ function writableStreamDefaultControllerProcessWrite(controller, chunk) {
     };
   }
 
-  PromisePrototypeThen(
-    writeAlgorithm(chunk, controller),
+  // The write algorithm may be a raw callback (a wrapped user sink.write
+  // returns its result uncoerced; a synchronous throw surfaces here) or an
+  // internal algorithm that always returns a promise; thenAlgorithmResult
+  // handles both.
+  let result;
+  try {
+    result = writeAlgorithm(chunk, controller);
+  } catch (error) {
+    result = PromiseReject(error);
+  }
+  thenAlgorithmResult(
+    result,
     controller[kState].writeFulfilled,
     controller[kState].writeRejected);
 }
@@ -1323,7 +1338,7 @@ function setupWritableStreamDefaultControllerFromSink(
     FunctionPrototypeBind(start, sink, controller) :
     nonOpStart;
   const writeAlgorithm = write ?
-    createPromiseCallback2Params('sink.write', write, sink) :
+    createRawCallback2Params('sink.write', write, sink) :
     nonOpWrite;
   const closeAlgorithm = close ?
     createPromiseCallbackNoParams('sink.close', close, sink) :

From 4d297428e6cb27fb630183b5a12143c09b76f9a4 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sat, 8 Aug 2026 19:32:35 +0200
Subject: [PATCH 188/344] stream: consolidate non-op algorithm callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The start, pull, and write non-op algorithms are all raw callbacks with
an identical empty body now, so a single shared nonOpCallback replaces
nonOpStart, nonOpPull, and nonOpWrite.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65138
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/internal/webstreams/readablestream.js | 21 ++++++++++-----------
 lib/internal/webstreams/util.js           | 16 ++++++----------
 lib/internal/webstreams/writablestream.js |  7 +++----
 3 files changed, 19 insertions(+), 25 deletions(-)

diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index ed7b8fd87761..1a9287bc817e 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -116,9 +116,8 @@ const {
   kType,
   lazyTransfer,
   materializeQueue,
+  nonOpCallback,
   nonOpCancel,
-  nonOpPull,
-  nonOpStart,
   rejectedHandledRecord,
   resetQueue,
   resolvedRecord,
@@ -1447,7 +1446,7 @@ function readableStreamFromIterable(iterable) {
   if (iterator === null || (typeof iterator !== 'object' && typeof iterator !== 'function')) {
     throw new ERR_INVALID_STATE.TypeError('The iterator method must return an object');
   }
-  const startAlgorithm = nonOpStart;
+  const startAlgorithm = nonOpCallback;
 
   async function pullAlgorithm() {
     const iterResult = await iterator.next();
@@ -1929,9 +1928,9 @@ function readableStreamDefaultTee(stream, cloneForBranch2) {
   }
 
   branch1 =
-    createReadableStream(nonOpStart, pullAlgorithm, cancel1Algorithm);
+    createReadableStream(nonOpCallback, pullAlgorithm, cancel1Algorithm);
   branch2 =
-    createReadableStream(nonOpStart, pullAlgorithm, cancel2Algorithm);
+    createReadableStream(nonOpCallback, pullAlgorithm, cancel2Algorithm);
 
   PromisePrototypeThen(
     readerClosedPromise(reader).promise,
@@ -2217,9 +2216,9 @@ function readableByteStreamTee(stream) {
   }
 
   branch1 =
-    createReadableByteStream(nonOpStart, pull1Algorithm, cancel1Algorithm);
+    createReadableByteStream(nonOpCallback, pull1Algorithm, cancel1Algorithm);
   branch2 =
-    createReadableByteStream(nonOpStart, pull2Algorithm, cancel2Algorithm);
+    createReadableByteStream(nonOpCallback, pull2Algorithm, cancel2Algorithm);
 
   forwardReaderError(reader);
 
@@ -2862,10 +2861,10 @@ function setupReadableStreamDefaultControllerFromSource(
   const cancel = source?.cancel;
   const startAlgorithm = start ?
     FunctionPrototypeBind(start, source, controller) :
-    nonOpStart;
+    nonOpCallback;
   const pullAlgorithm = pull ?
     createRawCallback1Param('source.pull', pull, source) :
-    nonOpPull;
+    nonOpCallback;
   const cancelAlgorithm = cancel ?
     createPromiseCallback1Param('source.cancel', cancel, source) :
     nonOpCancel;
@@ -3743,10 +3742,10 @@ function setupReadableByteStreamControllerFromSource(
   const autoAllocateChunkSize = source?.autoAllocateChunkSize;
   const startAlgorithm = start ?
     FunctionPrototypeBind(start, source, controller) :
-    nonOpStart;
+    nonOpCallback;
   const pullAlgorithm = pull ?
     createRawCallback1Param('source.pull', pull, source) :
-    nonOpPull;
+    nonOpCallback;
   const cancelAlgorithm = cancel ?
     createPromiseCallback1Param('source.cancel', cancel, source) :
     nonOpCancel;
diff --git a/lib/internal/webstreams/util.js b/lib/internal/webstreams/util.js
index b3a8e7827e38..05439a25dcb5 100644
--- a/lib/internal/webstreams/util.js
+++ b/lib/internal/webstreams/util.js
@@ -418,17 +418,14 @@ function setPromiseHandled(promise) {
 
 async function nonOpFlush() {}
 
-function nonOpStart() {}
-
-// nonOpPull and nonOpWrite are raw callbacks (see createRawCallback*):
-// their non-thenable return takes the allocation-free fast path in
+// Shared non-op for the start/pull/write algorithm callbacks, which all
+// follow the raw-callback contract (see createRawCallback*): the
+// non-thenable return takes the allocation-free fast path in
 // thenAlgorithmResult().
-function nonOpPull() {}
+function nonOpCallback() {}
 
 async function nonOpCancel() {}
 
-function nonOpWrite() {}
-
 let transfer;
 function lazyTransfer() {
   if (transfer === undefined)
@@ -465,11 +462,10 @@ module.exports = {
   kType,
   lazyTransfer,
   materializeQueue,
+  nonOpCallback,
   nonOpCancel,
   nonOpFlush,
-  nonOpPull,
-  nonOpStart,
-  nonOpWrite,
+
   peekQueueValue,
   rejectedHandledRecord,
   resetQueue,
diff --git a/lib/internal/webstreams/writablestream.js b/lib/internal/webstreams/writablestream.js
index 5c73f0fe757e..1e9ca02cfe96 100644
--- a/lib/internal/webstreams/writablestream.js
+++ b/lib/internal/webstreams/writablestream.js
@@ -70,9 +70,8 @@ const {
   kState,
   kType,
   lazyTransfer,
+  nonOpCallback,
   nonOpCancel,
-  nonOpStart,
-  nonOpWrite,
   peekQueueValue,
   rejectedHandledRecord,
   resetQueue,
@@ -1336,10 +1335,10 @@ function setupWritableStreamDefaultControllerFromSink(
   const abort = sink?.abort;
   const startAlgorithm = start ?
     FunctionPrototypeBind(start, sink, controller) :
-    nonOpStart;
+    nonOpCallback;
   const writeAlgorithm = write ?
     createRawCallback2Params('sink.write', write, sink) :
-    nonOpWrite;
+    nonOpCallback;
   const closeAlgorithm = close ?
     createPromiseCallbackNoParams('sink.close', close, sink) :
     nonOpCancel;

From a77b1e61dff1f04506a89e70c97c0fbd030cf25b Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Sat, 15 Aug 2026 23:41:37 +0900
Subject: [PATCH 189/344] doc: fix SQLite changeset constant descriptions

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65265
Refs: https://www.sqlite.org/session/c_changeset_abort.html
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/sqlite.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 33e1ef57fca3..63b542a7c86e 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -1667,11 +1667,11 @@ conflict resolution handler passed to [`database.applyChangeset()`][]. See also
   </tr>
   <tr>
     <td><code>SQLITE_CHANGESET_CONSTRAINT</code></td>
-    <td>If foreign key handling is enabled, and applying a changeset leaves the database in a state containing foreign key violations, the conflict handler is invoked with this constant exactly once before the changeset is committed. If the conflict handler returns <code>SQLITE_CHANGESET_OMIT</code>, the changes, including those that caused the foreign key constraint violation, are committed. Or, if it returns <code>SQLITE_CHANGESET_ABORT</code>, the changeset is rolled back.</td>
+    <td>If any other constraint violation occurs while applying a change (i.e. a UNIQUE, CHECK or NOT NULL constraint), the conflict handler is invoked with this constant.</td>
   </tr>
   <tr>
     <td><code>SQLITE_CHANGESET_FOREIGN_KEY</code></td>
-    <td>If any other constraint violation occurs while applying a change (i.e. a UNIQUE, CHECK or NOT NULL constraint), the conflict handler is invoked with this constant.</td>
+    <td>If foreign key handling is enabled, and applying a changeset leaves the database in a state containing foreign key violations, the conflict handler is invoked with this constant exactly once before the changeset is committed. If the conflict handler returns <code>SQLITE_CHANGESET_OMIT</code>, the changes, including those that caused the foreign key constraint violation, are committed. Or, if it returns <code>SQLITE_CHANGESET_ABORT</code>, the changeset is rolled back.</td>
   </tr>
 </table>
 

From 63e6f2edc3ee1a883d1450727e8a1c62aa2e3f8f Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sat, 15 Aug 2026 11:20:33 -0700
Subject: [PATCH 190/344] test: wait for FFI background optimization
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pointer range test creates multiple closures from the same function
literals and explicitly requests synchronous optimization. V8 can also
schedule concurrent recompilation for those closures.

Wait for background optimization before closing the dynamic library so
compiler jobs cannot outlive the fast FFI metadata they reference.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65300
Refs: https://github.com/nodejs/reliability/issues?q=sort%3Aupdated-desc%20%22test-ffi-fast-integer-validation%22
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 test/ffi/test-ffi-fast-integer-validation.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/ffi/test-ffi-fast-integer-validation.js b/test/ffi/test-ffi-fast-integer-validation.js
index 1243391ac87c..66b6866b4e47 100644
--- a/test/ffi/test-ffi-fast-integer-validation.js
+++ b/test/ffi/test-ffi-fast-integer-validation.js
@@ -65,6 +65,7 @@ test('fast FFI validates integer argument ranges', () => {
     assert.throws(() => callI64(2n ** 63n), expect);
     assert.throws(() => callU64(2n ** 64n), expect);
   } finally {
+    eval('%WaitForBackgroundOptimization()');
     lib.close();
   }
 });
@@ -96,6 +97,7 @@ test('fast FFI validates pointer BigInt ranges', () => {
       }
     }
   } finally {
+    eval('%WaitForBackgroundOptimization()');
     lib.close();
   }
 });

From 009e376581f6e12b2e422000006bcd853a27c075 Mon Sep 17 00:00:00 2001
From: Marten Richter <marten.richter@tu-berlin.de>
Date: Sat, 15 Aug 2026 20:20:50 +0200
Subject: [PATCH 191/344] quic: fix wake up blob

The quic implementation calls setWakeUp with
the assumption, that it is only executed once
per event loop cycle.
This assumption is wrong.
Only setImmediate will guarantee, that the
execution is delayed to later in the event loop
and happening once in the event loop.

Fixes: https://github.com/nodejs/node/issues/64035
Signed-off-by: Marten Richter <marten.richter@freenet.de>
PR-URL: https://github.com/nodejs/node/pull/64044
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/blob.js | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/lib/internal/blob.js b/lib/internal/blob.js
index 8636fe6088be..25626f0ed906 100644
--- a/lib/internal/blob.js
+++ b/lib/internal/blob.js
@@ -469,9 +469,13 @@ function createBlobReaderStream(reader) {
       this.pendingPulls = [];
       // Lazily register a wakeup callback that the C++ side can invoke
       // when new data is available after a STATUS_BLOCK.
+      let immediate;
       this.wakeup = () => {
         if (this.pendingPulls.length > 0) {
-          this.readNext(c);
+          immediate ??= setImmediate(() => {
+            immediate = undefined;
+            this.readNext(c);
+          });
         }
       };
     },
@@ -571,7 +575,15 @@ const kMaxBatchChunks = 16;
 async function* createBlobReaderIterable(reader, options = kEmptyObject) {
   const { getReadError } = options;
   let wakeup = PromiseWithResolvers();
-  reader.setWakeup(wakeup.resolve);
+  let immediate;
+  let fin = false;
+  reader.setWakeup((setfin) => {
+    fin ||= setfin;
+    immediate ??= setImmediate(() => {
+      immediate = undefined;
+      wakeup.resolve?.();
+    });
+  });
 
   try {
     while (true) {
@@ -616,9 +628,8 @@ async function* createBlobReaderIterable(reader, options = kEmptyObject) {
       if (error) throw error;
 
       if (blocked) {
-        const fin = await wakeup.promise;
+        await wakeup.promise;
         wakeup = PromiseWithResolvers();
-        reader.setWakeup(wakeup.resolve);
         // If the wakeup was triggered by FIN (EndReadable), the DataQueue
         // is capped. Continue the loop to pull again -- the next pull will
         // return EOS. Without this, a race between the data notification

From 7af0a9609043e3c8c8f04b8d24cbb780fd1dd0e5 Mon Sep 17 00:00:00 2001
From: "Felix P." <90649300+devfep@users.noreply.github.com>
Date: Sat, 15 Aug 2026 15:05:36 -0400
Subject: [PATCH 192/344] test: use for-of instead of forEach

Signed-off-by: Felix P. <devfep@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65268
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
---
 test/parallel/test-arm-math-illegal-instruction.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/parallel/test-arm-math-illegal-instruction.js b/test/parallel/test-arm-math-illegal-instruction.js
index c4a6ec01ba88..0e53a22c5244 100644
--- a/test/parallel/test-arm-math-illegal-instruction.js
+++ b/test/parallel/test-arm-math-illegal-instruction.js
@@ -9,10 +9,10 @@ const { test } = require('node:test');
 
 // Iterate over all Math functions
 test('Iterate over all Math functions', () => {
-  Object.getOwnPropertyNames(Math).forEach((functionName) => {
+  for (const functionName of Object.getOwnPropertyNames(Math)) {
     if (!/[A-Z]/.test(functionName)) {
       // The function names don't have capital letters.
       Math[functionName](-0.5);
     }
-  });
+  }
 });

From bbb1226dbe07f6c91564e7ef25f2aa932148795a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Sat, 15 Aug 2026 16:42:37 -0300
Subject: [PATCH 193/344] sqlite: add diagnostic channel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62241
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 benchmark/sqlite/sqlite-diagnostic-channel.js |  42 ++++
 doc/api/diagnostics_channel.md                |  39 +++
 doc/api/sqlite.md                             |  22 +-
 lib/diagnostics_channel.js                    |   8 +
 src/base_object_types.h                       |   3 +-
 src/env_properties.h                          |   2 +
 src/node_diagnostics_channel.cc               |  30 +++
 src/node_diagnostics_channel.h                |  10 +
 src/node_sqlite.cc                            | 138 ++++++++++
 src/node_sqlite.h                             |  54 ++++
 .../test-sqlite-diagnostic-channel.js         | 237 ++++++++++++++++++
 11 files changed, 579 insertions(+), 6 deletions(-)
 create mode 100644 benchmark/sqlite/sqlite-diagnostic-channel.js
 create mode 100644 test/parallel/test-sqlite-diagnostic-channel.js

diff --git a/benchmark/sqlite/sqlite-diagnostic-channel.js b/benchmark/sqlite/sqlite-diagnostic-channel.js
new file mode 100644
index 000000000000..0610839653df
--- /dev/null
+++ b/benchmark/sqlite/sqlite-diagnostic-channel.js
@@ -0,0 +1,42 @@
+'use strict';
+const common = require('../common.js');
+const sqlite = require('node:sqlite');
+const dc = require('node:diagnostics_channel');
+const assert = require('node:assert');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  mode: ['none', 'subscribed', 'unsubscribed'],
+});
+
+function main(conf) {
+  const { n, mode } = conf;
+
+  const db = new sqlite.DatabaseSync(':memory:');
+  db.exec('CREATE TABLE t (x INTEGER)');
+  const insert = db.prepare('INSERT INTO t VALUES (?)');
+
+  let subscriber;
+  if (mode === 'subscribed') {
+    subscriber = () => {};
+    dc.subscribe('sqlite.db.query', subscriber);
+  } else if (mode === 'unsubscribed') {
+    subscriber = () => {};
+    dc.subscribe('sqlite.db.query', subscriber);
+    dc.unsubscribe('sqlite.db.query', subscriber);
+  }
+  // mode === 'none': no subscription ever made
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    result = insert.run(i);
+  }
+  bench.end(n);
+
+  if (mode === 'subscribed') {
+    dc.unsubscribe('sqlite.db.query', subscriber);
+  }
+
+  assert.ok(result !== undefined);
+}
diff --git a/doc/api/diagnostics_channel.md b/doc/api/diagnostics_channel.md
index e3a6a5e3fa98..9f9fb53d4636 100644
--- a/doc/api/diagnostics_channel.md
+++ b/doc/api/diagnostics_channel.md
@@ -1922,10 +1922,47 @@ added: v16.18.0
 
 Emitted when a new thread is created.
 
+#### SQLite
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+##### Event: `'sqlite.db.query'`
+
+* `sql` {string} The expanded SQL with bound parameter values substituted.
+  If expansion fails, the source SQL with unsubstituted placeholders is used
+  instead.
+* `database` {DatabaseSync} The [`DatabaseSync`][] instance that executed the
+  statement.
+* `duration` {number} SQLite's internal estimate of the statement run time in
+  nanoseconds. This reflects C-layer execution time only and does not include
+  JavaScript binding overhead such as argument marshaling or result-row
+  construction.
+
+Emitted after a SQL statement finishes executing against a [`DatabaseSync`][]
+instance. This is a **profiling** event: it fires once per statement upon
+completion and reports an estimated duration from SQLite's internal profiler.
+It is not a distributed-tracing span. There is no corresponding start event,
+no async context propagation, and no parent-span linkage. If you need
+OpenTelemetry-compatible spans or async context propagation, wrap your SQLite
+calls with a [`TracingChannel`][] at the JavaScript layer instead.
+
+Publishing is zero-overhead when there are no subscribers.
+
+No event is emitted for a statement that is abandoned mid-iteration and later
+finalized, either explicitly through [`statement.close()`][] or when the
+statement is garbage collected. Subscribers must not close the database or the
+statement, since both are still in use while the event is being delivered; see
+[`database.close()`][] and [`statement.close()`][].
+
 [BoundedChannel Channels]: #boundedchannel-channels
 [TracingChannel Channels]: #tracingchannel-channels
 [`'uncaughtException'`]: process.md#event-uncaughtexception
 [`BoundedChannel`]: #class-boundedchannel
+[`DatabaseSync`]: sqlite.md#class-databasesync
 [`TracingChannel`]: #class-tracingchannel
 [`asyncEnd` event]: #asyncendevent
 [`asyncStart` event]: #asyncstartevent
@@ -1936,6 +1973,7 @@ Emitted when a new thread is created.
 [`channel.unsubscribe(onMessage)`]: #channelunsubscribeonmessage
 [`channel.withStoreScope(data)`]: #channelwithstorescopedata
 [`child_process.spawn()`]: child_process.md#child_processspawncommand-args-options
+[`database.close()`]: sqlite.md#databaseclose
 [`diagnostics_channel.channel(name)`]: #diagnostics_channelchannelname
 [`diagnostics_channel.subscribe(name, onMessage)`]: #diagnostics_channelsubscribename-onmessage
 [`diagnostics_channel.tracingChannel()`]: #diagnostics_channeltracingchannelnameorchannels
@@ -1945,6 +1983,7 @@ Emitted when a new thread is created.
 [`net.Server.listen()`]: net.md#serverlisten
 [`process.execve()`]: process.md#processexecvefile-args-env
 [`start` event]: #startevent
+[`statement.close()`]: sqlite.md#statementclose
 [`worker_threads.locks`]: worker_threads.md#worker_threadslocks
 [context loss]: async_context.md#troubleshooting-context-loss
 [thenable object]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise#thenables
diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 63b542a7c86e..37755f90aa08 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -30,7 +30,9 @@ import sqlite from 'node:sqlite';
 const sqlite = require('node:sqlite');
 ```
 
-This module is only available under the `node:` scheme.
+This module is only available under the `node:` scheme. SQL trace events can
+be observed via the [`diagnostics_channel`][] module. See
+[`'sqlite.db.query'`][] for details.
 
 The following example shows the basic usage of the `node:sqlite` module to open
 an in-memory database, write data to the database, and then read the data back.
@@ -309,8 +311,8 @@ added: v22.5.0
 Closes the database connection. An exception is thrown if the database is not
 open. An [`ERR_INVALID_STATE`][] error is thrown if the method is called while
 a statement is executing, such as inside a user-defined function, an aggregate
-function, or an authorizer callback. This method is a wrapper around
-[`sqlite3_close_v2()`][].
+function, an authorizer callback, or a [`'sqlite.db.query'`][] subscriber. This
+method is a wrapper around [`sqlite3_close_v2()`][].
 
 ### `database.loadExtension(path[, entryPoint])`
 
@@ -1114,7 +1116,12 @@ added: REPLACEME
 -->
 
 Finalizes the prepared statement. An exception is thrown if the statement is
-already finalized. This method is a wrapper around [`sqlite3_finalize()`][].
+already finalized. An [`ERR_INVALID_STATE`][] error is thrown if this statement
+is currently executing, which happens when the method is called from a callback
+that the statement itself triggered, such as a user-defined function, an
+aggregate function, or a [`'sqlite.db.query'`][] subscriber. Other statements
+on the same connection can be finalized from such a callback. This method is a
+wrapper around [`sqlite3_finalize()`][].
 
 ### `statement.columns()`
 
@@ -1361,7 +1368,9 @@ added: REPLACEME
 -->
 
 Finalizes the prepared statement. If the prepared statement is already
-finalized, then this is a no-op.
+finalized, then this is a no-op. An [`ERR_INVALID_STATE`][] error is thrown if
+this statement is currently executing, under the same conditions as
+[`statement.close()`][].
 
 ### `statement.stat(counter)`
 
@@ -1882,6 +1891,7 @@ callback function to indicate what type of operation is being authorized.
 [Run-Time Limits]: https://www.sqlite.org/c3ref/limit.html
 [SQL injection]: https://en.wikipedia.org/wiki/SQL_injection
 [Type conversion between JavaScript and SQLite]: #type-conversion-between-javascript-and-sqlite
+[`'sqlite.db.query'`]: diagnostics_channel.md#event-sqlitedbquery
 [`ATTACH DATABASE`]: https://www.sqlite.org/lang_attach.html
 [`ERR_INVALID_STATE`]: errors.md#err_invalid_state
 [`PRAGMA foreign_keys`]: https://www.sqlite.org/pragma.html#pragma_foreign_keys
@@ -1895,6 +1905,7 @@ callback function to indicate what type of operation is being authorized.
 [`database.createTagStore()`]: #databasecreatetagstoremaxsize
 [`database.serialize()`]: #databaseserializedbname
 [`database.setAuthorizer()`]: #databasesetauthorizercallback
+[`diagnostics_channel`]: diagnostics_channel.md
 [`sqlite3_backup_finish()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupfinish
 [`sqlite3_backup_init()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupinit
 [`sqlite3_backup_step()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupstep
@@ -1926,6 +1937,7 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3session_create()`]: https://www.sqlite.org/session/sqlite3session_create.html
 [`sqlite3session_delete()`]: https://www.sqlite.org/session/sqlite3session_delete.html
 [`sqlite3session_patchset()`]: https://www.sqlite.org/session/sqlite3session_patchset.html
+[`statement.close()`]: #statementclose
 [`statement.setAllowBareNamedParameters()`]: #statementsetallowbarenamedparametersenabled
 [`statement.setAllowUnknownNamedParameters()`]: #statementsetallowunknownnamedparametersenabled
 [`statement.stat()`]: #statementstatcounter
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 93a2e85857ab..998f17aa61d6 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -73,11 +73,19 @@ function markActive(channel) {
   ObjectSetPrototypeOf(channel, ActiveChannel.prototype);
   channel._subscribers = [];
   channel._stores = new SafeMap();
+
+  // Notify native modules that this channel just got its first subscriber.
+  if (channel._index !== undefined)
+    dc_binding.notifyChannelActive(channel._index);
 }
 
 function maybeMarkInactive(channel) {
   // When there are no more active subscribers or bound, restore to fast prototype.
   if (!channel._subscribers.length && !channel._stores.size) {
+    // Notify native modules that this channel just lost its last subscriber.
+    if (channel._index !== undefined)
+      dc_binding.notifyChannelInactive(channel._index);
+
     // eslint-disable-next-line no-use-before-define
     ObjectSetPrototypeOf(channel, Channel.prototype);
     channel._subscribers = undefined;
diff --git a/src/base_object_types.h b/src/base_object_types.h
index cd1a06e41a30..1a63e1da1e84 100644
--- a/src/base_object_types.h
+++ b/src/base_object_types.h
@@ -24,7 +24,8 @@ namespace node {
 #define UNSERIALIZABLE_BINDING_TYPES(V)                                        \
   V(http2_binding_data, http2::BindingData)                                    \
   V(http_parser_binding_data, http_parser::BindingData)                        \
-  V(quic_binding_data, quic::BindingData)
+  V(quic_binding_data, quic::BindingData)                                      \
+  V(sqlite_binding_data, sqlite::BindingData)
 
 // List of (non-binding) BaseObjects that are serializable in the snapshot.
 // The first argument should match what the type passes to
diff --git a/src/env_properties.h b/src/env_properties.h
index d501170442e7..4f0d55225d70 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -143,6 +143,7 @@
   V(crypto_rsa_pss_string, "rsa-pss")                                          \
   V(cwd_string, "cwd")                                                         \
   V(data_string, "data")                                                       \
+  V(database_string, "database")                                               \
   V(default_is_true_string, "defaultIsTrue")                                   \
   V(defensive_string, "defensive")                                             \
   V(deserialize_info_string, "deserializeInfo")                                \
@@ -359,6 +360,7 @@
   V(source_map_url_string, "sourceMapURL")                                     \
   V(source_url_string, "sourceURL")                                            \
   V(specifier_string, "specifier")                                             \
+  V(sql_string, "sql")                                                         \
   V(stack_string, "stack")                                                     \
   V(start_string, "start")                                                     \
   V(state_string, "state")                                                     \
diff --git a/src/node_diagnostics_channel.cc b/src/node_diagnostics_channel.cc
index ba0492a0df5e..2593f6eab90f 100644
--- a/src/node_diagnostics_channel.cc
+++ b/src/node_diagnostics_channel.cc
@@ -127,10 +127,38 @@ void BindingData::Deserialize(Local<Context> context,
   CHECK_NOT_NULL(binding);
 }
 
+void BindingData::SetChannelStatusCallback(uint32_t index,
+                                           ChannelStatusCallback cb) {
+  channel_status_callbacks_[index] = std::move(cb);
+}
+
+void BindingData::NotifyChannelActive(const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  if (binding == nullptr) return;
+  CHECK(args[0]->IsUint32());
+  uint32_t index = args[0].As<v8::Uint32>()->Value();
+  auto it = binding->channel_status_callbacks_.find(index);
+  if (it != binding->channel_status_callbacks_.end()) it->second(true);
+}
+
+void BindingData::NotifyChannelInactive(
+    const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  if (binding == nullptr) return;
+  CHECK(args[0]->IsUint32());
+  uint32_t index = args[0].As<v8::Uint32>()->Value();
+  auto it = binding->channel_status_callbacks_.find(index);
+  if (it != binding->channel_status_callbacks_.end()) it->second(false);
+}
+
 void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
                                              Local<ObjectTemplate> target) {
   Isolate* isolate = isolate_data->isolate();
   SetMethod(isolate, target, "linkNativeChannel", LinkNativeChannel);
+  SetMethod(isolate, target, "notifyChannelActive", NotifyChannelActive);
+  SetMethod(isolate, target, "notifyChannelInactive", NotifyChannelInactive);
 }
 
 void BindingData::CreatePerContextProperties(Local<Object> target,
@@ -145,6 +173,8 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
 void BindingData::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(LinkNativeChannel);
+  registry->Register(NotifyChannelActive);
+  registry->Register(NotifyChannelInactive);
 }
 
 Channel::Channel(Environment* env,
diff --git a/src/node_diagnostics_channel.h b/src/node_diagnostics_channel.h
index ca68e75a4361..c8c1a79994b2 100644
--- a/src/node_diagnostics_channel.h
+++ b/src/node_diagnostics_channel.h
@@ -4,6 +4,7 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <cinttypes>
+#include <functional>
 #include <string>
 #include <unordered_map>
 #include <vector>
@@ -52,6 +53,14 @@ class BindingData : public SnapshotableObject {
   static void LinkNativeChannel(
       const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  using ChannelStatusCallback = std::function<void(bool is_active)>;
+  void SetChannelStatusCallback(uint32_t index, ChannelStatusCallback cb);
+
+  static void NotifyChannelActive(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void NotifyChannelInactive(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+
   static void CreatePerIsolateProperties(IsolateData* isolate_data,
                                          v8::Local<v8::ObjectTemplate> target);
   static void CreatePerContextProperties(v8::Local<v8::Object> target,
@@ -62,6 +71,7 @@ class BindingData : public SnapshotableObject {
 
  private:
   InternalFieldInfo* internal_field_info_ = nullptr;
+  std::unordered_map<uint32_t, ChannelStatusCallback> channel_status_callbacks_;
 };
 
 class Channel : public BaseObject {
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 1b7c11cb69e7..8e6a230f625a 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -5,7 +5,9 @@
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
 #include "node.h"
+#include "node_diagnostics_channel.h"
 #include "node_errors.h"
+#include "node_external_reference.h"
 #include "node_mem-inl.h"
 #include "node_url.h"
 #include "simdutf.h"
@@ -79,6 +81,30 @@ inline MaybeLocal<String> Utf8StringMaybeOneByte(Isolate* isolate,
       isolate, input.data(), NewStringType::kNormal, len);
 }
 
+BindingData::BindingData(Realm* realm, Local<Object> wrap)
+    : BaseObject(realm, wrap) {
+  MakeWeak();
+}
+
+void BindingData::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("open_databases",
+                              open_databases.size() * sizeof(DatabaseSync*),
+                              "open_databases");
+}
+
+void BindingData::CreatePerContextProperties(Local<Object> target,
+                                             Local<Value> unused,
+                                             Local<Context> context,
+                                             void* priv) {
+  Realm* realm = Realm::GetCurrent(context);
+  Environment* env = realm->env();
+  Realm* principal = env->principal_realm();
+
+  if (principal->GetBindingData<BindingData>() != nullptr) return;
+
+  principal->AddBindingData<BindingData>(target);
+}
+
 #define CHECK_ERROR_OR_THROW(isolate, db, expr, expected, ret)                 \
   do {                                                                         \
     int r_ = (expr);                                                           \
@@ -957,6 +983,9 @@ DatabaseSync::DatabaseSync(Environment* env,
   enable_load_extension_ = allow_load_extension;
   ignore_next_sqlite_error_ = false;
 
+  BindingData* binding = env->principal_realm()->GetBindingData<BindingData>();
+  if (binding != nullptr) binding->open_databases.insert(this);
+
   if (open) {
     Open();
   }
@@ -979,6 +1008,10 @@ void DatabaseSync::DeleteSessions() {
 }
 
 DatabaseSync::~DatabaseSync() {
+  BindingData* binding =
+      env()->principal_realm()->GetBindingData<BindingData>();
+  if (binding != nullptr) binding->open_databases.erase(this);
+
   FinalizeBackups();
 
   if (IsOpen()) {
@@ -1076,10 +1109,29 @@ bool DatabaseSync::Open() {
         env()->isolate(), this, load_extension_ret, SQLITE_OK, false);
   }
 
+  trace_channel_ = diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
+  if (trace_channel_ && trace_channel_->HasSubscribers()) {
+    sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+  }
+
   opened = true;
   return true;
 }
 
+void DatabaseSync::EnableTracing() {
+  if (!IsOpen()) return;
+  if (!trace_channel_) {
+    trace_channel_ =
+        diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
+  }
+  sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+}
+
+void DatabaseSync::DisableTracing() {
+  if (!IsOpen()) return;
+  sqlite3_trace_v2(connection_, 0, nullptr, nullptr);
+}
+
 void DatabaseSync::FinalizeBackups() {
   for (auto backup : backups_) {
     backup->Cleanup();
@@ -2730,6 +2782,67 @@ int DatabaseSync::AuthorizerCallback(void* user_data,
   return int_result;
 }
 
+int DatabaseSync::TraceCallback(unsigned int type,
+                                void* user_data,
+                                void* p,
+                                void* x) {
+  if (type != SQLITE_TRACE_PROFILE) {
+    return 0;
+  }
+
+  DatabaseSync* db = static_cast<DatabaseSync*>(user_data);
+  Environment* env = db->env();
+
+  diagnostics_channel::Channel* ch = db->trace_channel_.get();
+  if (ch == nullptr || !ch->HasSubscribers() ||
+      db->AreTraceEventsSuppressed()) {
+    return 0;
+  }
+
+  Isolate* isolate = env->isolate();
+  HandleScope handle_scope(isolate);
+
+  char* expanded = sqlite3_expanded_sql(static_cast<sqlite3_stmt*>(p));
+  Local<Value> sql_string;
+  if (expanded != nullptr) {
+    bool ok = String::NewFromUtf8(isolate, expanded).ToLocal(&sql_string);
+    sqlite3_free(expanded);
+    if (!ok) {
+      return 0;
+    }
+  } else {
+    // Fallback to source SQL if expanded is unavailable
+    const char* source = sqlite3_sql(static_cast<sqlite3_stmt*>(p));
+    if (source == nullptr ||
+        !String::NewFromUtf8(isolate, source).ToLocal(&sql_string)) {
+      return 0;
+    }
+  }
+
+  // x points to the estimated statement run time in nanoseconds. A double is
+  // sufficient since 2^53 ns (~104 days) exceeds any realistic query duration.
+  sqlite3_int64 duration_ns = *static_cast<sqlite3_int64*>(x);
+
+  Local<Name> keys[3] = {
+      env->sql_string().As<Name>(),
+      env->database_string().As<Name>(),
+      env->duration_string().As<Name>(),
+  };
+
+  Local<Value> values[3] = {
+      sql_string,
+      db->object(),
+      Number::New(isolate, static_cast<double>(duration_ns)),
+  };
+
+  Local<Object> payload = Object::New(isolate, Null(isolate), keys, values, 3);
+
+  CallbackDepthGuard guard(db);
+  ch->Publish(env, payload);
+
+  return 0;
+}
+
 StatementSync::StatementSync(Environment* env,
                              Local<Object> object,
                              BaseObjectPtr<DatabaseSync> db,
@@ -2757,6 +2870,7 @@ void StatementSync::Close() {
 }
 
 void StatementSync::Finalize() {
+  TraceEventSuppressionGuard trace_guard(db_.get());
   statement_.reset();
   InvalidateColumnNameCache();
 }
@@ -4309,7 +4423,31 @@ static void Initialize(Local<Object> target,
                        Local<Context> context,
                        void* priv) {
   Environment* env = Environment::GetCurrent(context);
+  Realm* realm = env->principal_realm();
   Isolate* isolate = env->isolate();
+
+  // Set up the per-Environment database registry.
+  BindingData::CreatePerContextProperties(target, unused, context, priv);
+
+  // Register a native callback on the sqlite.db.query diagnostic channel so
+  // that SQLite tracing is enabled/disabled as subscribers come and go.
+  auto* diag_binding =
+      realm->GetBindingData<diagnostics_channel::BindingData>();
+  auto* sqlite_bd = realm->GetBindingData<BindingData>();
+  if (diag_binding != nullptr && sqlite_bd != nullptr) {
+    uint32_t idx = diag_binding->GetOrCreateChannelIndex("sqlite.db.query");
+    BaseObjectPtr<BindingData> bd_ptr(sqlite_bd);
+    diag_binding->SetChannelStatusCallback(idx, [bd_ptr](bool is_active) {
+      BindingData* bd = bd_ptr.get();
+      if (bd == nullptr) return;
+      for (DatabaseSync* db : bd->open_databases) {
+        if (is_active)
+          db->EnableTracing();
+        else
+          db->DisableTracing();
+      }
+    });
+  }
   Local<FunctionTemplate> db_tmpl =
       NewFunctionTemplate(isolate, DatabaseSync::New);
   db_tmpl->InstanceTemplate()->SetInternalFieldCount(
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index daa8d5b8a37e..475a759e75e8 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -19,6 +19,13 @@
 #include <vector>
 
 namespace node {
+
+namespace diagnostics_channel {
+class Channel;
+}  // namespace diagnostics_channel
+
+class ExternalReferenceRegistry;
+
 namespace sqlite {
 
 // Mapping from JavaScript property names to SQLite limit constants
@@ -195,6 +202,27 @@ class StatementExecutionHelper {
                                        bool use_big_ints);
 };
 
+class DatabaseSync;
+
+class BindingData : public BaseObject {
+ public:
+  SET_BINDING_ID(sqlite_binding_data)
+
+  BindingData(Realm* realm, v8::Local<v8::Object> wrap);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(BindingData)
+  SET_SELF_SIZE(BindingData)
+
+  std::unordered_set<DatabaseSync*> open_databases;
+
+  static void CreatePerContextProperties(v8::Local<v8::Object> target,
+                                         v8::Local<v8::Value> unused,
+                                         v8::Local<v8::Context> context,
+                                         void* priv);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+};
+
 class DatabaseSync : public BaseObject {
  public:
   enum InternalFields {
@@ -239,6 +267,10 @@ class DatabaseSync : public BaseObject {
                                 const char* param2,
                                 const char* param3,
                                 const char* param4);
+  static int TraceCallback(unsigned int type,
+                           void* user_data,
+                           void* p,
+                           void* x);
   void FinalizeStatements();
   void RemoveBackup(BackupJob* backup);
   void AddBackup(BackupJob* backup);
@@ -261,6 +293,8 @@ class DatabaseSync : public BaseObject {
   // enable that use case.
   void SetIgnoreNextSQLiteError(bool ignore);
   bool ShouldIgnoreSQLiteError();
+  void EnableTracing();
+  void DisableTracing();
 
   void IncrementCallbackDepth() { ++callback_depth_; }
   void DecrementCallbackDepth() { --callback_depth_; }
@@ -286,6 +320,10 @@ class DatabaseSync : public BaseObject {
                      stmt) != stepping_statements_.end();
   }
 
+  void IncrementTraceSuppressionDepth() { ++trace_suppression_depth_; }
+  void DecrementTraceSuppressionDepth() { --trace_suppression_depth_; }
+  bool AreTraceEventsSuppressed() const { return trace_suppression_depth_ > 0; }
+
   SET_MEMORY_INFO_NAME(DatabaseSync)
   SET_SELF_SIZE(DatabaseSync)
 
@@ -301,11 +339,13 @@ class DatabaseSync : public BaseObject {
   bool ignore_next_sqlite_error_;
   int callback_depth_ = 0;
   int authorizer_depth_ = 0;
+  int trace_suppression_depth_ = 0;
   std::vector<sqlite3_stmt*> stepping_statements_;
 
   std::set<BackupJob*> backups_;
   std::unordered_set<Session*> sessions_;
   std::unordered_set<StatementSync*> statements_;
+  BaseObjectPtr<diagnostics_channel::Channel> trace_channel_;
 
   friend class DatabaseSyncLimits;
   friend class Session;
@@ -483,6 +523,20 @@ class CallbackDepthGuard {
   DatabaseSync* db_;
 };
 
+class TraceEventSuppressionGuard {
+ public:
+  explicit TraceEventSuppressionGuard(DatabaseSync* db) : db_(db) {
+    db_->IncrementTraceSuppressionDepth();
+  }
+  ~TraceEventSuppressionGuard() { db_->DecrementTraceSuppressionDepth(); }
+  TraceEventSuppressionGuard(const TraceEventSuppressionGuard&) = delete;
+  TraceEventSuppressionGuard& operator=(const TraceEventSuppressionGuard&) =
+      delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
 class SteppingStatementGuard {
  public:
   SteppingStatementGuard(DatabaseSync* db, sqlite3_stmt* stmt) : db_(db) {
diff --git a/test/parallel/test-sqlite-diagnostic-channel.js b/test/parallel/test-sqlite-diagnostic-channel.js
new file mode 100644
index 000000000000..8b0776c969d7
--- /dev/null
+++ b/test/parallel/test-sqlite-diagnostic-channel.js
@@ -0,0 +1,237 @@
+// Flags: --expose-gc
+'use strict';
+
+const { mustCall, skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+const { DatabaseSync } = require('node:sqlite');
+const { suite, it } = require('node:test');
+const { gcUntil } = require('../common/gc');
+
+suite('sqlite.db.query diagnostics channel', () => {
+  it('subscriber receives SQL string for exec() statements', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+
+    assert.strictEqual(calls.length, 2);
+    assert.strictEqual(calls[0].sql, 'CREATE TABLE t (x INTEGER)');
+    assert.strictEqual(calls[1].sql, 'INSERT INTO t VALUES (1)');
+  });
+
+  it('subscriber receives SQL string for prepared INSERT statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('INSERT INTO t VALUES (?)');
+    stmt.run(42);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'INSERT INTO t VALUES (42.0)');
+  });
+
+  it('subscriber receives SQL string for prepared SELECT statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('SELECT x FROM t WHERE x = ?');
+    stmt.get(1);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'SELECT x FROM t WHERE x = 1.0');
+  });
+
+  it('subscriber receives SQL string for prepared UPDATE statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('UPDATE t SET x = ? WHERE x = ?');
+    stmt.run(2, 1);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'UPDATE t SET x = 2.0 WHERE x = 1.0');
+  });
+
+  it('subscriber receives SQL string for prepared DELETE statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('DELETE FROM t WHERE x = ?');
+    stmt.run(1);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'DELETE FROM t WHERE x = 1.0');
+  });
+
+  it('no calls received after unsubscribe', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    assert.strictEqual(calls.length, 1);
+
+    dc.unsubscribe('sqlite.db.query', handler);
+    db.exec('INSERT INTO t VALUES (1)');
+    assert.strictEqual(calls.length, 1); // No new calls after unsubscribe
+  });
+
+  it('falls back to source SQL when expansion fails', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:', { limits: { length: 1000 } });
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x TEXT)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('INSERT INTO t VALUES (?)');
+
+    const longValue = 'a'.repeat(977);
+    stmt.run(longValue);
+
+    assert.strictEqual(calls.length, 1);
+    // Falls back to source SQL with unexpanded '?' placeholder
+    assert.strictEqual(calls[0].sql, 'INSERT INTO t VALUES (?)');
+  });
+
+  it('database property identifies the correct database', (t) => {
+    const calls = [];
+    using db1 = new DatabaseSync(':memory:');
+    using db2 = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db1.exec('CREATE TABLE t (x INTEGER)');
+    db2.exec('CREATE TABLE t (x INTEGER)');
+
+    assert.strictEqual(calls.length, 2);
+    assert.strictEqual(calls[0].database, db1);
+    assert.strictEqual(calls[1].database, db2);
+    assert.notStrictEqual(calls[0].database, calls[1].database);
+  });
+
+  it('duration is a number', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(typeof calls[0].duration, 'number');
+  });
+
+  it('duration is non-negative', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+
+    assert.strictEqual(calls.length, 1);
+    assert.ok(calls[0].duration >= 0);
+  });
+
+  it('does not publish when an unfinished statement is collected', async (t) => {
+    let calls = 0;
+    const handler = () => calls++;
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    let collected = false;
+    const registry = new FinalizationRegistry(() => { collected = true; });
+
+    (() => {
+      const db = new DatabaseSync(':memory:');
+      db.exec('CREATE TABLE t (x INTEGER)');
+      for (let i = 0; i < 10; i++) {
+        db.exec(`INSERT INTO t VALUES (${i})`);
+      }
+
+      const stmt = db.prepare('SELECT x FROM t');
+      registry.register(stmt);
+      stmt.iterate().next(); // Leave the statement unfinished.
+    })();
+
+    calls = 0; // reset after setup
+    await gcUntil('unfinished statement is collected', () => collected);
+
+    assert.strictEqual(calls, 0);
+  });
+
+  it('subscriber cannot close the database or statement', (t) => {
+    using db = new DatabaseSync(':memory:');
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    using stmt = db.prepare('INSERT INTO t VALUES (?)');
+
+    const handler = mustCall(() => {
+      assert.throws(() => db.close(), { code: 'ERR_INVALID_STATE' });
+      assert.throws(() => stmt.close(), { code: 'ERR_INVALID_STATE' });
+      assert.throws(() => stmt[Symbol.dispose](), {
+        code: 'ERR_INVALID_STATE',
+      });
+    });
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    stmt.run(1);
+
+    dc.unsubscribe('sqlite.db.query', handler);
+    assert.deepStrictEqual(db.prepare('SELECT x FROM t').all(), [
+      { __proto__: null, x: 1 },
+    ]);
+  });
+});

From 9346570fed77cb2d1e7629614a0fa124572255be Mon Sep 17 00:00:00 2001
From: NIxxy25 <tellaoyinkansola25@gmail.com>
Date: Thu, 13 Aug 2026 20:04:39 +0000
Subject: [PATCH 194/344] test: convert forEach to for in test-constant.js file

Signed-off-by: NIxxy25 <tellaoyinkansola25@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65271
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 test/parallel/test-constants.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/parallel/test-constants.js b/test/parallel/test-constants.js
index 51023b56d4dc..6ae205ca24bb 100644
--- a/test/parallel/test-constants.js
+++ b/test/parallel/test-constants.js
@@ -14,7 +14,8 @@ assert.ok(binding.os.errno);
 assert.ok(binding.fs);
 assert.ok(binding.crypto);
 
-['os', 'fs', 'crypto'].forEach((l) => {
+const moduleNames = ['os', 'fs', 'crypto'];
+for (const l of moduleNames) {
   for (const k of Object.keys(binding[l])) {
     if (typeof binding[l][k] === 'object') { // errno and signals
       for (const j of Object.keys(binding[l][k])) {
@@ -25,6 +26,6 @@ assert.ok(binding.crypto);
       assert.strictEqual(binding[l][k], constants[k]);
     }
   }
-});
+}
 
 assert.ok(Object.isFrozen(constants));

From 1d5e5e8f432a3e0f1ae0579b387de3cf50ea9d01 Mon Sep 17 00:00:00 2001
From: Phillip Markert <pmarkert@users.noreply.github.com>
Date: Sat, 15 Aug 2026 17:59:44 -0400
Subject: [PATCH 195/344] test: replace `forEach()` with `for...of` in parallel
 tests

Replace `Array.prototype.forEach()` with `for...of` loops across 17
tests in `test/parallel`, so each loop body reads as a plain statement
rather than an arrow callback.

None of the iterated values are sparse arrays, the one case where
`forEach` and `for...of` genuinely differ, so both constructs visit the
same elements in the same order. No callback relied on `this`, an early
return, or async behaviour, and the number of assertions run in each
file is unchanged.

Signed-off-by: Phillip Markert <phillip@ephisys.com>
PR-URL: https://github.com/nodejs/node/pull/65272
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
---
 test/parallel/test-btoa-atob.js                    | 11 +++++++----
 ...test-child-process-fork-stdio-string-variant.js |  5 ++++-
 test/parallel/test-child-process-ipc-next-tick.js  |  4 ++--
 test/parallel/test-debugger-pid.js                 |  4 +++-
 ...newprotomethod-remove-unnecessary-prototypes.js |  7 ++++---
 .../test-events-uncaught-exception-stack.js        |  4 ++--
 test/parallel/test-fs-buffertype-writesync.js      |  7 ++++---
 .../test-fs-cp-sync-verbatim-symlinks-invalid.mjs  | 14 +++++++-------
 test/parallel/test-fs-readlink-type-check.js       |  5 +++--
 test/parallel/test-fs-rmdir-type-check.js          |  5 +++--
 test/parallel/test-fs-unlink-type-check.js         |  5 +++--
 test/parallel/test-http-correct-hostname.js        |  4 ++--
 test/parallel/test-http-hostname-typechecking.js   |  5 +++--
 .../test-http-req-close-robust-from-tampering.js   |  3 ++-
 test/parallel/test-http-server-unconsume.js        |  5 +++--
 .../test-http2-server-settimeout-no-callback.js    |  5 +++--
 test/parallel/test-http2-status-code-invalid.js    |  5 +++--
 17 files changed, 58 insertions(+), 40 deletions(-)

diff --git a/test/parallel/test-btoa-atob.js b/test/parallel/test-btoa-atob.js
index a2c8d9e3134c..3fde039f395e 100644
--- a/test/parallel/test-btoa-atob.js
+++ b/test/parallel/test-btoa-atob.js
@@ -26,14 +26,17 @@ assert.strictEqual(atob({ toString: () => '' }), '');
 assert.strictEqual(atob({ [Symbol.toPrimitive]: () => '' }), '');
 
 assert.throws(() => atob(Symbol()), /TypeError/);
-[
+const testCases = [
   undefined, false, () => {}, {}, [1],
   0, 1, 0n, 1n, -Infinity,
   'a', 'a\n\n\n', '\ra\r\r', '  a ', '\t\t\ta', 'a\f\f\f', '\ta\r \n\f',
-].forEach((value) =>
-  // See #2 - https://html.spec.whatwg.org/multipage/webappapis.html#dom-atob
+];
+
+// See #2 - https://html.spec.whatwg.org/multipage/webappapis.html#dom-atob
+for (const value of testCases) {
   assert.throws(() => atob(value), {
     constructor: DOMException,
     name: 'InvalidCharacterError',
     code: 5,
-  }));
+  });
+}
diff --git a/test/parallel/test-child-process-fork-stdio-string-variant.js b/test/parallel/test-child-process-fork-stdio-string-variant.js
index 6a396b51d9bd..91691b353a15 100644
--- a/test/parallel/test-child-process-fork-stdio-string-variant.js
+++ b/test/parallel/test-child-process-fork-stdio-string-variant.js
@@ -29,4 +29,7 @@ function test(stringVariant) {
   child.on('exit', common.mustCall((code) => assert.strictEqual(code, 0)));
 }
 
-['pipe', 'inherit', 'ignore'].forEach(test);
+const testCases = ['pipe', 'inherit', 'ignore'];
+for (const value of testCases) {
+  test(value);
+}
diff --git a/test/parallel/test-child-process-ipc-next-tick.js b/test/parallel/test-child-process-ipc-next-tick.js
index b23aefc85d11..849a927e251e 100644
--- a/test/parallel/test-child-process-ipc-next-tick.js
+++ b/test/parallel/test-child-process-ipc-next-tick.js
@@ -32,8 +32,8 @@ if (process.argv[2] === 'child') {
 
   child.on('message', common.mustCall((msg) => {
     assert.strictEqual(msg, 'ready');
-    values.forEach((value) => {
+    for (const value of values) {
       child.send(value);
-    });
+    };
   }));
 }
diff --git a/test/parallel/test-debugger-pid.js b/test/parallel/test-debugger-pid.js
index 157939c05c73..6fcdac4d9d1d 100644
--- a/test/parallel/test-debugger-pid.js
+++ b/test/parallel/test-debugger-pid.js
@@ -18,7 +18,9 @@ interfacer.stderr.setEncoding('utf-8');
 const onData = (data) => {
   data = (buffer + data).split('\n');
   buffer = data.pop();
-  data.forEach((line) => interfacer.emit('line', line));
+  for (const line of data) {
+    interfacer.emit('line', line);
+  }
 };
 interfacer.stdout.on('data', onData);
 interfacer.stderr.on('data', onData);
diff --git a/test/parallel/test-env-newprotomethod-remove-unnecessary-prototypes.js b/test/parallel/test-env-newprotomethod-remove-unnecessary-prototypes.js
index 22c0c8665d14..638c2c3c8722 100644
--- a/test/parallel/test-env-newprotomethod-remove-unnecessary-prototypes.js
+++ b/test/parallel/test-env-newprotomethod-remove-unnecessary-prototypes.js
@@ -7,13 +7,14 @@ require('../common');
 
 const assert = require('assert');
 const { internalBinding } = require('internal/test/binding');
-[
+const testCases = [
   internalBinding('udp_wrap').UDP.prototype.bind6,
   internalBinding('tcp_wrap').TCP.prototype.bind6,
   internalBinding('udp_wrap').UDP.prototype.send6,
   internalBinding('tcp_wrap').TCP.prototype.bind,
   internalBinding('udp_wrap').UDP.prototype.close,
   internalBinding('tcp_wrap').TCP.prototype.open,
-].forEach((binding, i) => {
+];
+for (const [i, binding] of testCases.entries()) {
   assert.strictEqual('prototype' in binding, false, `Test ${i} failed`);
-});
+}
diff --git a/test/parallel/test-events-uncaught-exception-stack.js b/test/parallel/test-events-uncaught-exception-stack.js
index 25fe9d6585f1..c11fcbabcb35 100644
--- a/test/parallel/test-events-uncaught-exception-stack.js
+++ b/test/parallel/test-events-uncaught-exception-stack.js
@@ -8,9 +8,9 @@ const EventEmitter = require('events');
 process.on('uncaughtException', common.mustCall((err) => {
   const [firstLine, ...lines] = err.stack.split('\n');
   assert.strictEqual(firstLine, 'Error');
-  lines.forEach((line) => {
+  for (const line of lines) {
     assert.match(line, /^ {4}at/);
-  });
+  }
 }));
 
 new EventEmitter().emit('error', new Error());
diff --git a/test/parallel/test-fs-buffertype-writesync.js b/test/parallel/test-fs-buffertype-writesync.js
index 5649a00569a2..d1738dd3cc35 100644
--- a/test/parallel/test-fs-buffertype-writesync.js
+++ b/test/parallel/test-fs-buffertype-writesync.js
@@ -6,11 +6,12 @@ require('../common');
 const assert = require('assert');
 const fs = require('fs');
 
-[
+const testCases = [
   true, false, 0, 1, Infinity, () => {}, {}, [], undefined, null,
-].forEach((value) => {
+];
+for (const value of testCases) {
   assert.throws(
     () => fs.writeSync(1, value),
     { message: /"buffer"/, code: 'ERR_INVALID_ARG_TYPE' }
   );
-});
+}
diff --git a/test/parallel/test-fs-cp-sync-verbatim-symlinks-invalid.mjs b/test/parallel/test-fs-cp-sync-verbatim-symlinks-invalid.mjs
index 3db176487f71..c9ec4e82f414 100644
--- a/test/parallel/test-fs-cp-sync-verbatim-symlinks-invalid.mjs
+++ b/test/parallel/test-fs-cp-sync-verbatim-symlinks-invalid.mjs
@@ -8,10 +8,10 @@ import fixtures from '../common/fixtures.js';
 tmpdir.refresh();
 
 const src = fixtures.path('copy/kitchen-sink');
-[1, [], {}, null, 1n, undefined, null, Symbol(), '', () => {}]
-  .forEach((verbatimSymlinks) => {
-    assert.throws(
-      () => cpSync(src, src, { verbatimSymlinks }),
-      { code: 'ERR_INVALID_ARG_TYPE' }
-    );
-  });
+const testCases = [1, [], {}, null, 1n, undefined, null, Symbol(), '', () => {}];
+for (const verbatimSymlinks of testCases) {
+  assert.throws(
+    () => cpSync(src, src, { verbatimSymlinks }),
+    { code: 'ERR_INVALID_ARG_TYPE' }
+  );
+}
diff --git a/test/parallel/test-fs-readlink-type-check.js b/test/parallel/test-fs-readlink-type-check.js
index 58d431308c76..adf2c96126e7 100644
--- a/test/parallel/test-fs-readlink-type-check.js
+++ b/test/parallel/test-fs-readlink-type-check.js
@@ -4,7 +4,8 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 
-[false, 1, {}, [], null, undefined].forEach((i) => {
+const testCases = [false, 1, {}, [], null, undefined];
+for (const i of testCases) {
   assert.throws(
     () => fs.readlink(i, common.mustNotCall()),
     {
@@ -19,4 +20,4 @@ const fs = require('fs');
       name: 'TypeError'
     }
   );
-});
+}
diff --git a/test/parallel/test-fs-rmdir-type-check.js b/test/parallel/test-fs-rmdir-type-check.js
index 7014ce27f8e3..321386b0d7d1 100644
--- a/test/parallel/test-fs-rmdir-type-check.js
+++ b/test/parallel/test-fs-rmdir-type-check.js
@@ -4,7 +4,8 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 
-[false, 1, [], {}, null, undefined].forEach((i) => {
+const testCases = [false, 1, [], {}, null, undefined];
+for (const i of testCases) {
   assert.throws(
     () => fs.rmdir(i, common.mustNotCall()),
     {
@@ -19,4 +20,4 @@ const fs = require('fs');
       name: 'TypeError'
     }
   );
-});
+}
diff --git a/test/parallel/test-fs-unlink-type-check.js b/test/parallel/test-fs-unlink-type-check.js
index 006e9ad73485..62c1cf3da71b 100644
--- a/test/parallel/test-fs-unlink-type-check.js
+++ b/test/parallel/test-fs-unlink-type-check.js
@@ -4,7 +4,8 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 
-[false, 1, {}, [], null, undefined].forEach((i) => {
+const testCases = [false, 1, {}, [], null, undefined];
+for (const i of testCases) {
   assert.throws(
     () => fs.unlink(i, common.mustNotCall()),
     {
@@ -19,4 +20,4 @@ const fs = require('fs');
       name: 'TypeError'
     }
   );
-});
+}
diff --git a/test/parallel/test-http-correct-hostname.js b/test/parallel/test-http-correct-hostname.js
index c67a6d49f2e7..ea4b3cb25a09 100644
--- a/test/parallel/test-http-correct-hostname.js
+++ b/test/parallel/test-http-correct-hostname.js
@@ -15,7 +15,7 @@ if (common.hasCrypto) {
   modules.https = https;
 }
 
-Object.keys(modules).forEach((module) => {
+for (const module of Object.keys(modules)) {
   const doNotCall = common.mustNotCall(
     `${module}.request should not connect to ${module}://example.com%60x.example.com`
   );
@@ -25,4 +25,4 @@ Object.keys(modules).forEach((module) => {
     'example.com`x.example.com',
   ]);
   req.abort();
-});
+};
diff --git a/test/parallel/test-http-hostname-typechecking.js b/test/parallel/test-http-hostname-typechecking.js
index 368766e08701..c143106b115e 100644
--- a/test/parallel/test-http-hostname-typechecking.js
+++ b/test/parallel/test-http-hostname-typechecking.js
@@ -8,7 +8,8 @@ const http = require('http');
 // when passed as the value of either options.hostname or options.host
 const vals = [{}, [], NaN, Infinity, -Infinity, true, false, 1, 0, new Date()];
 
-vals.forEach((v) => {
+
+for (const v of vals) {
   const received = common.invalidArgTypeHelper(v);
   assert.throws(
     () => http.request({ hostname: v }),
@@ -31,7 +32,7 @@ vals.forEach((v) => {
                received
     }
   );
-});
+}
 
 // These values are OK and should not throw synchronously.
 // Only testing for 'hostname' validation so ignore connection errors.
diff --git a/test/parallel/test-http-req-close-robust-from-tampering.js b/test/parallel/test-http-req-close-robust-from-tampering.js
index edfdb309a7e4..75f57ad54133 100644
--- a/test/parallel/test-http-req-close-robust-from-tampering.js
+++ b/test/parallel/test-http-req-close-robust-from-tampering.js
@@ -7,7 +7,8 @@ const { connect } = require('net');
 // cause an error.
 
 const server = createServer(common.mustCall((req, res) => {
-  req.client._events.close.forEach((fn) => { fn.bind(req)(); });
+  const closeHandlers = req.client._events.close;
+  for (const fn of closeHandlers) { fn.bind(req)(); }
 }));
 
 server.unref();
diff --git a/test/parallel/test-http-server-unconsume.js b/test/parallel/test-http-server-unconsume.js
index 0a0b5913812a..e92d7c127504 100644
--- a/test/parallel/test-http-server-unconsume.js
+++ b/test/parallel/test-http-server-unconsume.js
@@ -4,7 +4,8 @@ const assert = require('assert');
 const http = require('http');
 const net = require('net');
 
-['on', 'addListener', 'prependListener'].forEach((testFn) => {
+const testCases = ['on', 'addListener', 'prependListener'];
+for (const testFn of testCases) {
   let received = '';
 
   const server = http.createServer(function(req, res) {
@@ -30,4 +31,4 @@ const net = require('net');
       }));
     }));
   }));
-});
+};
diff --git a/test/parallel/test-http2-server-settimeout-no-callback.js b/test/parallel/test-http2-server-settimeout-no-callback.js
index d0352067b7bd..a5cb080609f5 100644
--- a/test/parallel/test-http2-server-settimeout-no-callback.js
+++ b/test/parallel/test-http2-server-settimeout-no-callback.js
@@ -11,7 +11,8 @@ const http2 = require('http2');
 const verifyCallbacks = common.mustCall((server) => {
   const testTimeout = 10;
 
-  [true, 1, {}, [], null, 'test'].forEach((notFunction) => {
+  const testCases = [true, 1, {}, [], null, 'test'];
+  for (const notFunction of testCases) {
     assert.throws(
       () => server.setTimeout(testTimeout, notFunction),
       {
@@ -19,7 +20,7 @@ const verifyCallbacks = common.mustCall((server) => {
         code: 'ERR_INVALID_ARG_TYPE',
       }
     );
-  });
+  };
 
   // No callback
   const returnedVal = server.setTimeout(testTimeout);
diff --git a/test/parallel/test-http2-status-code-invalid.js b/test/parallel/test-http2-status-code-invalid.js
index a906c706d7d7..a8b92aad6369 100644
--- a/test/parallel/test-http2-status-code-invalid.js
+++ b/test/parallel/test-http2-status-code-invalid.js
@@ -19,9 +19,10 @@ function expectsError(code) {
 server.on('stream', common.mustCall((stream) => {
 
   // Anything lower than 100 and greater than 599 is rejected
-  [ 99, 700, 1000 ].forEach((i) => {
+  const testCases = [ 99, 700, 1000 ];
+  for (const i of testCases) {
     assert.throws(() => stream.respond({ ':status': i }), expectsError(i));
-  });
+  }
 
   stream.respond();
   stream.end();

From c644f2e07c3e612f09bb301657dfbce3e9a6a141 Mon Sep 17 00:00:00 2001
From: freida-code <150387862+freida-code@users.noreply.github.com>
Date: Thu, 13 Aug 2026 15:53:37 -0400
Subject: [PATCH 196/344] test: convert test-async-local-storage-bind to async
 loop

Signed-off-by: freida-code <150387862+freida-code@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65270
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
---
 test/parallel/test-async-local-storage-bind.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/parallel/test-async-local-storage-bind.js b/test/parallel/test-async-local-storage-bind.js
index d8d4c4599826..01aa449c1d46 100644
--- a/test/parallel/test-async-local-storage-bind.js
+++ b/test/parallel/test-async-local-storage-bind.js
@@ -4,11 +4,11 @@ const common = require('../common');
 const assert = require('assert');
 const { AsyncLocalStorage } = require('async_hooks');
 
-[1, false, '', {}, []].forEach((i) => {
+for (const i of [1, false, '', {}, []]) {
   assert.throws(() => AsyncLocalStorage.bind(i), {
     code: 'ERR_INVALID_ARG_TYPE'
   });
-});
+}
 
 const fn = common.mustCall(AsyncLocalStorage.bind(() => 123));
 assert.strictEqual(fn(), 123);

From 3b6a918ab4e3c3527c3e59706d9acc6c2ceb2557 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Sun, 16 Aug 2026 14:40:37 +0500
Subject: [PATCH 197/344] doc: add missing `added:` tags to `fs.lchmod`

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65283
Fixes: https://github.com/nodejs/node/issues/65280
Refs: https://github.com/nodejs/node-v0.x-archive/issues/853
Refs: https://github.com/nodejs/node/commit/3935adced09cd557a836d00558b52d777b9a20a2
Refs: https://github.com/nodejs/node/pull/18297
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/fs.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index dd59bce3287e..cfb833d5b994 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1469,6 +1469,7 @@ const { glob } = require('node:fs/promises');
 ### `fsPromises.lchmod(path, mode)`
 
 <!-- YAML
+added: v10.0.0
 deprecated: v10.0.0
 -->
 
@@ -3653,7 +3654,8 @@ glob('**/*.js', (err, matches) => {
 ### `fs.lchmod(path, mode, callback)`
 
 <!-- YAML
-deprecated: v0.4.7
+added: v0.5.0
+deprecated: v0.5.0
 changes:
   - version: v18.0.0
     pr-url: https://github.com/nodejs/node/pull/41678
@@ -6269,7 +6271,8 @@ console.log(globSync('**/*.js'));
 ### `fs.lchmodSync(path, mode)`
 
 <!-- YAML
-deprecated: v0.4.7
+added: v0.5.0
+deprecated: v0.5.0
 -->
 
 > Stability: 0 - Deprecated

From 9ea318d4e3d6eda925fb63202907d2242685fab7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=84=9C=EC=9A=B8=EB=AF=BC=ED=8A=B8=EC=B4=88=EC=BD=94?=
 <minseong130502@gmail.com>
Date: Mon, 17 Aug 2026 10:59:52 +0900
Subject: [PATCH 198/344] doc: fix typo in onboarding.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: 서울민트초코 <minseong130502@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65295
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 onboarding.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/onboarding.md b/onboarding.md
index bc690190b490..74c114526044 100644
--- a/onboarding.md
+++ b/onboarding.md
@@ -283,8 +283,8 @@ needs to be pointed out separately during the onboarding.
   including accommodations, transportation, and visa fees (even in case the visa
   is denied) if needed. Check out the [summit](https://github.com/nodejs/summit)
   repository for details.
-* If you are interested in helping to fix coverity reports consider requesting
-  access to the projects coverity project as outlined in [static-analysis][].
+* If you are interested in helping to fix coverity reports, consider requesting
+  access to the project's coverity project as outlined in [static-analysis][].
 * If you are interested in helping out with CI reliability, check out the
   [reliability repository][] and [guide on how to deal with CI flakes][]. When
   fixing a flaky test, it is recommended to run [`node-stress-single-test`][]

From 676a1228cde008c7a51eea1ddc6515cdcab9b7ce Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Mon, 17 Aug 2026 11:00:04 +0900
Subject: [PATCH 199/344] doc: fix lint clean command

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65274
Refs: https://github.com/nodejs/node/pull/55266
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 doc/contributing/using-internal-errors.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/contributing/using-internal-errors.md b/doc/contributing/using-internal-errors.md
index db63abfe28a4..fec768663631 100644
--- a/doc/contributing/using-internal-errors.md
+++ b/doc/contributing/using-internal-errors.md
@@ -84,7 +84,7 @@ give users a place to go to easily look up the meaning of individual error
 codes.
 
 In case `make lint` fails to detect the new error codes added into `errors.md`,
-the markdown linting cache must be cleaned with `make lint-md-clean`.
+the markdown linting cache must be cleaned with `make lint-clean`.
 
 ## Testing new errors
 

From 4f6f2cfffa6dea2583142d6184b27eceb767fe37 Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Mon, 17 Aug 2026 11:00:16 +0900
Subject: [PATCH 200/344] stream: use validateNumber for BYOB reader
 options.min

The error thrown for a non-number min is unchanged.

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65014
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 lib/internal/webstreams/readablestream.js     |  4 +-
 ...est-whatwg-readablestream-byob-read-min.js | 41 +++++++++++++++++++
 2 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-whatwg-readablestream-byob-read-min.js

diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index 1a9287bc817e..84f16dc7b4a1 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -62,6 +62,7 @@ const {
 const {
   validateAbortSignal,
   validateBuffer,
+  validateNumber,
   validateObject,
   kValidateObjectAllowObjects,
   kValidateObjectAllowObjectsAndNull,
@@ -1086,8 +1087,7 @@ class ReadableStreamBYOBReader {
     // detached, but there's no API available to use to check that.
 
     const min = options?.min ?? 1;
-    if (typeof min !== 'number')
-      throw new ERR_INVALID_ARG_TYPE('options.min', 'number', min);
+    validateNumber(min, 'options.min');
     if (!NumberIsInteger(min))
       throw new ERR_INVALID_ARG_VALUE('options.min', min, 'must be an integer');
     if (min <= 0)
diff --git a/test/parallel/test-whatwg-readablestream-byob-read-min.js b/test/parallel/test-whatwg-readablestream-byob-read-min.js
new file mode 100644
index 000000000000..c428caa83478
--- /dev/null
+++ b/test/parallel/test-whatwg-readablestream-byob-read-min.js
@@ -0,0 +1,41 @@
+'use strict';
+const common = require('../common');
+const assert = require('node:assert');
+
+const {
+  ReadableStream,
+} = require('node:stream/web');
+
+// Validation of the options.min argument of ReadableStreamBYOBReader.read()
+// must reject with the same errors regardless of how the checks are implemented internally.
+
+const reader = new ReadableStream({ type: 'bytes' })
+  .getReader({ mode: 'byob' });
+
+(async () => {
+  // A null min is not covered here: `options?.min ?? 1` turns it into
+  // the default before validation, so it never reaches the type check.
+  for (const min of ['1', true, {}, [], 1n]) {
+    await assert.rejects(
+      reader.read(new Uint8Array(8), { min }),
+      { code: 'ERR_INVALID_ARG_TYPE' },
+    );
+  }
+
+  for (const min of [NaN, 1.5, 0, -1]) {
+    await assert.rejects(
+      reader.read(new Uint8Array(8), { min }),
+      { code: 'ERR_INVALID_ARG_VALUE' },
+    );
+  }
+
+  await assert.rejects(
+    reader.read(new Uint8Array(8), { min: 9 }),
+    { code: 'ERR_OUT_OF_RANGE' },
+  );
+
+  await assert.rejects(
+    reader.read(new DataView(new ArrayBuffer(8)), { min: 9 }),
+    { code: 'ERR_OUT_OF_RANGE' },
+  );
+})().then(common.mustCall());

From 6a2e0561e889674f41e06ba904d8f7b0d8b4cb5b Mon Sep 17 00:00:00 2001
From: greenhead <shren0812@gmail.com>
Date: Mon, 17 Aug 2026 12:39:42 +0900
Subject: [PATCH 201/344] stream: use validateObject for zlib/iter params

The kValidateObjectAllowArray flag matches the replaced check: arrays
keep passing and the thrown error is unchanged.

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65015
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/streams/iter/transform.js        |  5 ++--
 .../test-stream-iter-transform-params.js      | 30 +++++++++++++++++++
 2 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 test/parallel/test-stream-iter-transform-params.js

diff --git a/lib/internal/streams/iter/transform.js b/lib/internal/streams/iter/transform.js
index 583c6e9b192d..cb35906ded02 100644
--- a/lib/internal/streams/iter/transform.js
+++ b/lib/internal/streams/iter/transform.js
@@ -40,6 +40,7 @@ const { isArrayBufferView, isAnyArrayBuffer } = require('internal/util/types');
 const { kValidatedTransform } = require('internal/streams/iter/types');
 const {
   checkRangesOrGetDefault,
+  kValidateObjectAllowArray,
   validateFiniteNumber,
   validateObject,
 } = require('internal/validators');
@@ -106,9 +107,7 @@ function validateDictionary(dictionary) {
 
 function validateParams(params, maxParam, errClass) {
   if (params === undefined) return;
-  if (typeof params !== 'object' || params === null) {
-    throw new ERR_INVALID_ARG_TYPE('options.params', 'Object', params);
-  }
+  validateObject(params, 'options.params', kValidateObjectAllowArray);
   const keys = ObjectKeys(params);
   for (let i = 0; i < keys.length; i++) {
     const origKey = keys[i];
diff --git a/test/parallel/test-stream-iter-transform-params.js b/test/parallel/test-stream-iter-transform-params.js
new file mode 100644
index 000000000000..aa029f9713c9
--- /dev/null
+++ b/test/parallel/test-stream-iter-transform-params.js
@@ -0,0 +1,30 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { from, pull, bytes } = require('stream/iter');
+const { compressBrotli, compressZstd } = require('zlib/iter');
+
+// Type validation of options.params in zlib/iter transforms: plain
+// objects and arrays pass the check, any other value rejects with
+// ERR_INVALID_ARG_TYPE. Arrays have always passed the typeof-based
+// check, so this behavior must be preserved by any refactor.
+
+const consume = (transform) => bytes(pull(from('test'), transform));
+
+(async () => {
+  for (const compress of [compressBrotli, compressZstd]) {
+    for (const params of [42, 'bad', true, Symbol(), () => {}, null]) {
+      await assert.rejects(
+        consume(compress({ params })),
+        { code: 'ERR_INVALID_ARG_TYPE' },
+      );
+    }
+
+    // An empty array has no own keys, so it passes both the type check
+    // and the per-key validation and compression succeeds.
+    const out = await consume(compress({ params: [] }));
+    assert.ok(out.byteLength > 0);
+  }
+})().then(common.mustCall());

From e6bfec91be41f00b1b6fe4281c7f2ce904662e05 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sun, 16 Aug 2026 21:01:47 -0700
Subject: [PATCH 202/344] sqlite: validate StatementSync.run() integers

Use the standard SQLite integer conversion for changes and
lastInsertRowid. Throw ERR_OUT_OF_RANGE when a value cannot be
represented safely as a Number, or return it as a BigInt when
BigInt reads are enabled.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65178
Fixes: https://github.com/nodejs/node/issues/65177
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/node_sqlite.cc                          | 39 ++++++++++++---------
 test/parallel/test-sqlite-statement-sync.js | 19 ++++++++++
 2 files changed, 42 insertions(+), 16 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 8e6a230f625a..d0da887062bd 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -105,6 +105,24 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
   principal->AddBindingData<BindingData>(target);
 }
 
+inline MaybeLocal<Value> IntegerToValue(Isolate* isolate,
+                                        sqlite3_int64 value,
+                                        bool use_big_ints) {
+  if (use_big_ints) {
+    return BigInt::New(isolate, value);
+  }
+
+  if (value < -kMaxSafeJsInteger || value > kMaxSafeJsInteger) {
+    THROW_ERR_OUT_OF_RANGE(
+        isolate,
+        "Value is too large to be represented as a JavaScript number: %" PRId64,
+        value);
+    return MaybeLocal<Value>();
+  }
+
+  return Number::New(isolate, value);
+}
+
 #define CHECK_ERROR_OR_THROW(isolate, db, expr, expected, ret)                 \
   do {                                                                         \
     int r_ = (expr);                                                           \
@@ -159,16 +177,7 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
     switch (sqlite3_##from##_type(__VA_ARGS__)) {                              \
       case SQLITE_INTEGER: {                                                   \
         sqlite3_int64 val = sqlite3_##from##_int64(__VA_ARGS__);               \
-        if ((use_big_int_args)) {                                              \
-          (result) = BigInt::New((isolate), val);                              \
-        } else if (std::abs(val) <= kMaxSafeJsInteger) {                       \
-          (result) = Number::New((isolate), val);                              \
-        } else {                                                               \
-          THROW_ERR_OUT_OF_RANGE((isolate),                                    \
-                                 "Value is too large to be represented as a "  \
-                                 "JavaScript number: %" PRId64,                \
-                                 val);                                         \
-        }                                                                      \
+        (result) = IntegerToValue((isolate), val, (use_big_int_args));         \
         break;                                                                 \
       }                                                                        \
       case SQLITE_FLOAT: {                                                     \
@@ -3251,12 +3260,10 @@ MaybeLocal<Object> StatementExecutionHelper::Run(Environment* env,
   Local<Value> last_insert_rowid_val;
   Local<Value> changes_val;
 
-  if (use_big_ints) {
-    last_insert_rowid_val = BigInt::New(isolate, last_insert_rowid);
-    changes_val = BigInt::New(isolate, changes);
-  } else {
-    last_insert_rowid_val = Number::New(isolate, last_insert_rowid);
-    changes_val = Number::New(isolate, changes);
+  if (!IntegerToValue(isolate, last_insert_rowid, use_big_ints)
+           .ToLocal(&last_insert_rowid_val) ||
+      !IntegerToValue(isolate, changes, use_big_ints).ToLocal(&changes_val)) {
+    return MaybeLocal<Object>();
   }
 
   auto run_result_template = env->sqlite_run_result_template();
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index b13da41e9d71..44eb482f9bdb 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -821,6 +821,25 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
     });
   });
 
+  test('BigInt is required for reading large last insert row IDs', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY) STRICT');
+    const insert = db.prepare('INSERT INTO data VALUES (?)');
+
+    t.assert.throws(() => {
+      insert.run(9007199254740993n);
+    }, {
+      code: 'ERR_OUT_OF_RANGE',
+      message: /^Value is too large to be represented as a JavaScript number: 9007199254740993$/,
+    });
+
+    insert.setReadBigInts(true);
+    t.assert.deepStrictEqual(insert.run(9007199254740995n), {
+      changes: 1n,
+      lastInsertRowid: 9007199254740995n,
+    });
+  });
+
   test('throws if the statement is already finalized', (t) => {
     using db = new DatabaseSync(':memory:');
     const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');

From 815424db74e53dd3d3adb29b35163e5314165f3b Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sun, 16 Aug 2026 22:02:53 -0700
Subject: [PATCH 203/344] stream: avoid leaking consumers on signal failure

Validate Broadcast.push() and Share.pull() signals before registering
raw consumers. Return a rejecting iterable for pre-aborted signals
without adding a cursor.

This prevents failed subscriptions from leaving unreachable cursors
that inflate consumerCount and can permanently impose backpressure.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65299
Fixes: https://github.com/nodejs/node/issues/65298
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
---
 lib/internal/streams/iter/broadcast.js        | 21 +++++++++++++---
 lib/internal/streams/iter/share.js            | 24 ++++++++++++++++---
 .../test-stream-iter-broadcast-basic.js       | 12 ++++++++++
 test/parallel/test-stream-iter-share-async.js | 12 ++++++++++
 test/parallel/test-stream-iter-validation.js  | 18 ++++++++++++++
 5 files changed, 81 insertions(+), 6 deletions(-)

diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index a1384c9e4d51..4c63774bbb32 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -116,17 +116,32 @@ class BroadcastImpl {
 
   push(...args) {
     const { transforms, options } = parsePullArgs(args);
+    const signal = options?.signal;
+    validateAbortSignal(signal, 'options.signal');
+
+    // Avoid registering a consumer that the pre-aborted pipeline will never
+    // read or detach.
+    if (signal?.aborted) {
+      return {
+        __proto__: null,
+        // eslint-disable-next-line require-yield
+        async *[SymbolAsyncIterator]() {
+          throw signal.reason;
+        },
+      };
+    }
+
     const rawConsumer = this.#createRawConsumer();
 
     // When transforms are present, delegate to pull() which creates its
     // own internal AbortController that follows the external signal.
     // When no transforms, return rawConsumer directly (controller elided
     // per PULL-02 optimization -- no transforms means no signal recipient).
-    if (transforms.length > 0 || options?.signal) {
+    if (transforms.length > 0 || signal) {
       const pullArgs = [...transforms];
-      if (options?.signal) {
+      if (signal) {
         ArrayPrototypePush(pullArgs,
-                           { __proto__: null, signal: options.signal });
+                           { __proto__: null, signal });
       }
       return pullWithTransforms(rawConsumer, ...pullArgs);
     }
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 97efe7f3065b..662e57a7df55 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -93,11 +93,29 @@ class ShareImpl {
 
   pull(...args) {
     const { transforms, options } = parsePullArgs(args);
+    const signal = options?.signal;
+    validateAbortSignal(signal, 'options.signal');
+
+    // Avoid registering a consumer that the pre-aborted pipeline will never
+    // read or detach.
+    if (signal?.aborted) {
+      return {
+        __proto__: null,
+        // eslint-disable-next-line require-yield
+        async *[SymbolAsyncIterator]() {
+          throw signal.reason;
+        },
+      };
+    }
+
     const rawConsumer = this.#createRawConsumer();
 
-    if (transforms.length > 0 || options?.signal) {
-      if (options) {
-        return pullWithTransforms(rawConsumer, ...transforms, options);
+    if (transforms.length > 0 || signal) {
+      if (signal) {
+        return pullWithTransforms(
+          rawConsumer,
+          ...transforms,
+          { __proto__: null, signal });
       }
       return pullWithTransforms(rawConsumer, ...transforms);
     }
diff --git a/test/parallel/test-stream-iter-broadcast-basic.js b/test/parallel/test-stream-iter-broadcast-basic.js
index 125f386210c9..4438e82a7817 100644
--- a/test/parallel/test-stream-iter-broadcast-basic.js
+++ b/test/parallel/test-stream-iter-broadcast-basic.js
@@ -203,6 +203,17 @@ async function testPushAbortSignalRejectsPendingNext() {
   await rejected;
 }
 
+async function testPushPreAbortedSignalDoesNotAddConsumer() {
+  const reason = new Error('already aborted');
+  const signal = AbortSignal.abort(reason);
+  const { broadcast: bc } = broadcast();
+  const iter = bc.push({ signal })[Symbol.asyncIterator]();
+
+  assert.strictEqual(bc.consumerCount, 0);
+  await assert.rejects(iter.next(), (error) => error === reason);
+  assert.strictEqual(bc.consumerCount, 0);
+}
+
 // =============================================================================
 // Writer fail detaches consumers
 // =============================================================================
@@ -331,6 +342,7 @@ Promise.all([
   testCancelWithFalsyReason(),
   testPendingNextSettlesAfterReturn(),
   testPushAbortSignalRejectsPendingNext(),
+  testPushPreAbortedSignalDoesNotAddConsumer(),
   testFailDetachesConsumers(),
   testWriterFailIdempotent(),
   testLateJoinerSeesBufferedData(),
diff --git a/test/parallel/test-stream-iter-share-async.js b/test/parallel/test-stream-iter-share-async.js
index 314e7bfcf01c..c96a0cb0f3c3 100644
--- a/test/parallel/test-stream-iter-share-async.js
+++ b/test/parallel/test-stream-iter-share-async.js
@@ -226,6 +226,17 @@ async function testSharePullAbortSignalRejectsPendingNext() {
   shared.cancel();
 }
 
+async function testSharePullPreAbortedSignalDoesNotAddConsumer() {
+  const reason = new Error('already aborted');
+  const signal = AbortSignal.abort(reason);
+  const shared = share(from('data'));
+  const iter = shared.pull({ signal })[Symbol.asyncIterator]();
+
+  assert.strictEqual(shared.consumerCount, 0);
+  await assert.rejects(iter.next(), (error) => error === reason);
+  assert.strictEqual(shared.consumerCount, 0);
+}
+
 async function testShareAlreadyAborted() {
   const shared = share(from('data'), { signal: AbortSignal.abort() });
   const consumer = shared.pull();
@@ -372,6 +383,7 @@ Promise.all([
   testShareAbortSignal(),
   testShareAbortSignalWhileSourcePullPending(),
   testSharePullAbortSignalRejectsPendingNext(),
+  testSharePullPreAbortedSignalDoesNotAddConsumer(),
   testShareAlreadyAborted(),
   testShareSourceError(),
   testShareLateJoiningConsumer(),
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index 9f77fe330478..8dcfb46f173f 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -156,6 +156,15 @@ assert.throws(() => broadcast({ budget: 16383 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => broadcast({ backpressure: 'bad' }), { code: 'ERR_INVALID_ARG_VALUE' });
 
+// Broadcast consumer options.signal must be AbortSignal and validation must
+// not leave a consumer registered.
+{
+  const { broadcast: bc } = broadcast();
+  assert.throws(() => bc.push({ signal: {} }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.strictEqual(bc.consumerCount, 0);
+}
+
 // BroadcastWriter options.signal must be AbortSignal
 {
   const { writer } = broadcast();
@@ -212,6 +221,15 @@ assert.throws(() => share(from('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
 assert.throws(() => share(from('a'), { signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => share(from('a'), { backpressure: 'bad' }), { code: 'ERR_INVALID_ARG_VALUE' });
 
+// Share consumer options.signal must be AbortSignal and validation must not
+// leave a consumer registered.
+{
+  const shared = share(from('a'));
+  assert.throws(() => shared.pull({ signal: {} }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.strictEqual(shared.consumerCount, 0);
+}
+
 // share() values < 16384 are rejected
 assert.throws(() => share(from('a'), { budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: -1 }), { code: 'ERR_OUT_OF_RANGE' });

From 215223dff1ab32f32b987dc690deada25f372594 Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Mon, 17 Aug 2026 17:07:35 +0900
Subject: [PATCH 204/344] typings: add watchdog internal binding types

Add a WatchdogBinding declaration for internalBinding('watchdog')
and wire it into InternalBindingMap.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65228
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 typings/globals.d.ts                  |  2 ++
 typings/internalBinding/watchdog.d.ts | 15 +++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 typings/internalBinding/watchdog.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index b294042d790b..95b7b1356aef 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -35,6 +35,7 @@ import { URLPatternBinding } from "./internalBinding/url_pattern";
 import { UtilBinding } from './internalBinding/util';
 import { UVBinding } from './internalBinding/uv';
 import { WASIBinding } from './internalBinding/wasi';
+import { WatchdogBinding } from './internalBinding/watchdog';
 import { WorkerBinding } from './internalBinding/worker';
 import { ZlibBinding } from './internalBinding/zlib';
 
@@ -76,6 +77,7 @@ interface InternalBindingMap {
   util: UtilBinding;
   uv: UVBinding;
   wasi: WASIBinding;
+  watchdog: WatchdogBinding;
   worker: WorkerBinding;
   zlib: ZlibBinding;
 }
diff --git a/typings/internalBinding/watchdog.d.ts b/typings/internalBinding/watchdog.d.ts
new file mode 100644
index 000000000000..917ee3b96d48
--- /dev/null
+++ b/typings/internalBinding/watchdog.d.ts
@@ -0,0 +1,15 @@
+declare namespace InternalWatchdogBinding {
+  class TraceSigintWatchdog {
+    constructor();
+    start(): void;
+    stop(): void;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+  }
+}
+
+export interface WatchdogBinding {
+  TraceSigintWatchdog: typeof InternalWatchdogBinding.TraceSigintWatchdog;
+}

From 5219e53dd6cca31463a5d41b2ceff38ad5001fac Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Mon, 17 Aug 2026 17:07:48 +0900
Subject: [PATCH 205/344] typings: add diagnostics_channel typings

Add a DiagnosticsChannelBinding declaration for
internalBinding('diagnostics_channel') and wire it into
InternalBindingMap.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65227
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 typings/globals.d.ts                             | 2 ++
 typings/internalBinding/diagnostics_channel.d.ts | 6 ++++++
 2 files changed, 8 insertions(+)
 create mode 100644 typings/internalBinding/diagnostics_channel.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index 95b7b1356aef..6f6ca5d3f936 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -8,6 +8,7 @@ import { ConstantsBinding } from './internalBinding/constants';
 import { CredentialsBinding } from './internalBinding/credentials';
 import { CryptoBinding } from './internalBinding/crypto';
 import { DebugBinding } from './internalBinding/debug';
+import { DiagnosticsChannelBinding } from './internalBinding/diagnostics_channel';
 import { EncodingBinding } from './internalBinding/encoding_binding';
 import { FsBinding } from './internalBinding/fs';
 import { FsDirBinding } from './internalBinding/fs_dir';
@@ -50,6 +51,7 @@ interface InternalBindingMap {
   credentials: CredentialsBinding;
   crypto: CryptoBinding;
   debug: DebugBinding;
+  diagnostics_channel: DiagnosticsChannelBinding;
   encoding_binding: EncodingBinding;
   fs: FsBinding;
   fs_dir: FsDirBinding;
diff --git a/typings/internalBinding/diagnostics_channel.d.ts b/typings/internalBinding/diagnostics_channel.d.ts
new file mode 100644
index 000000000000..e6297d45ace0
--- /dev/null
+++ b/typings/internalBinding/diagnostics_channel.d.ts
@@ -0,0 +1,6 @@
+export interface DiagnosticsChannelBinding {
+  subscribers: Uint32Array;
+  linkNativeChannel(
+    callback: (name: string, index: number) => object | undefined,
+  ): void;
+}

From d69bed2f4911a45ecf89a4afd9a01e52e8c92fba Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Mon, 10 Aug 2026 13:46:04 +0200
Subject: [PATCH 206/344] debugger: wait for target startup

The inspector can accept a connection before an --inspect-brk target
enters its frontend wait. Runtime.runIfWaitingForDebugger can then be
handled too early, allowing the target to subsequently block forever.

Wait for NodeRuntime.waitingForDebugger before initializing and
releasing launched targets. Race the handshake against disconnects and
apply it to both interactive and probe startup.

Refs: https://github.com/nodejs/node/issues/64116
Assisted-by: codex:gpt-5.6-sol
Co-authored-by: Archkon <180910180+Archkon@users.noreply.github.com>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65194
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/debugger/inspect_helpers.js      | 196 +++++++++++++++++-
 lib/internal/debugger/inspect_probe.js        |  12 ++
 lib/internal/debugger/inspect_repl.js         |   7 +-
 test/parallel/test-debugger-no-inspect-brk.js | 158 ++++++++++++++
 .../test-debugger-probe-startup-disconnect.js |  56 +++++
 .../test-debugger-run-restart-init.js         |  66 +++++-
 .../test-debugger-wait-for-debugger.js        | 137 ++++++++++++
 7 files changed, 629 insertions(+), 3 deletions(-)
 create mode 100644 test/parallel/test-debugger-no-inspect-brk.js
 create mode 100644 test/parallel/test-debugger-probe-startup-disconnect.js
 create mode 100644 test/parallel/test-debugger-wait-for-debugger.js

diff --git a/lib/internal/debugger/inspect_helpers.js b/lib/internal/debugger/inspect_helpers.js
index f83876e96bc0..68d7901b38c5 100644
--- a/lib/internal/debugger/inspect_helpers.js
+++ b/lib/internal/debugger/inspect_helpers.js
@@ -1,11 +1,20 @@
 'use strict';
 
 const {
+  ArrayPrototypePop,
+  ArrayPrototypePush,
   ArrayPrototypePushApply,
+  MapPrototypeGet,
   Number,
   Promise,
+  PromiseWithResolvers,
   RegExpPrototypeExec,
+  RegExpPrototypeSymbolReplace,
+  SafePromiseRace,
   StringPrototypeEndsWith,
+  StringPrototypeIndexOf,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
 } = primordials;
 
 const { spawn } = require('child_process');
@@ -18,12 +27,24 @@ const {
   AbortController,
 } = require('internal/abort_controller');
 
-const { ERR_DEBUGGER_STARTUP_ERROR } = require('internal/errors').codes;
+const {
+  ERR_DEBUGGER_ERROR,
+  ERR_DEBUGGER_STARTUP_ERROR,
+} = require('internal/errors').codes;
 const {
   exitCodes: {
     kInvalidCommandLineArgument,
   },
 } = internalBinding('errors');
+const {
+  types: {
+    kBoolean,
+    kNoOp,
+    kV8Option,
+  },
+} = internalBinding('options');
+
+const { getCLIOptionsInfo } = require('internal/options');
 
 const debugRegex = /Debugger listening on ws:\/\/\[?(.+?)\]?:(\d+)\//;
 
@@ -61,6 +82,176 @@ function ensureTrailingNewline(text) {
   return StringPrototypeEndsWith(text, '\n') ? text : `${text}\n`;
 }
 
+// Mirror OptionsParser::Parse() far enough to find the child script. Options
+// before it must not undo the inspector setup added by launchChildProcess().
+function validateChildArgs(childArgs) {
+  const { options, aliases } = getCLIOptionsInfo();
+  const syntheticArgs = [];
+  let breakFirstLine = true;
+  let childArgIndex = 0;
+  let inspectorEnabled = true;
+
+  function peekArg() {
+    return syntheticArgs.length > 0 ?
+      syntheticArgs[syntheticArgs.length - 1] :
+      childArgs[childArgIndex];
+  }
+
+  function shiftArg() {
+    return syntheticArgs.length > 0 ?
+      ArrayPrototypePop(syntheticArgs) :
+      childArgs[childArgIndex++];
+  }
+
+  while (true) {
+    const nextArg = peekArg();
+    if (nextArg === undefined || nextArg.length <= 1 || nextArg[0] !== '-') {
+      break;
+    }
+
+    const isSynthetic = syntheticArgs.length > 0;
+    const arg = shiftArg();
+    if (arg === '--') { break; }
+    if (!isSynthetic &&
+        (arg === '--experimental-config-file' ||
+         arg === '--experimental-default-config-file')) {
+      // ConfigReader rewrites these to an inline default path before parsing.
+      continue;
+    }
+    if (!isSynthetic &&
+        StringPrototypeStartsWith(
+          arg, '--experimental-default-config-file=')) {
+      // ConfigReader rejects this form before parsing the remaining options.
+      return;
+    }
+
+    const equalsIndex = arg[1] === '-' ? StringPrototypeIndexOf(arg, '=') : -1;
+    let name = equalsIndex === -1 ? arg : StringPrototypeSlice(arg, 0, equalsIndex);
+    if (name.length > 2) {
+      name = `${StringPrototypeSlice(name, 0, 2)}${
+        RegExpPrototypeSymbolReplace(/_/g, StringPrototypeSlice(name, 2), '-')}`;
+    }
+
+    let isNegation = false;
+    if (StringPrototypeStartsWith(name, '--no-')) {
+      name = `--${StringPrototypeSlice(name, 5)}`;
+      isNegation = true;
+    }
+
+    while (true) {
+      let expansion = MapPrototypeGet(aliases, name);
+      if (expansion === undefined && equalsIndex !== -1) {
+        expansion = MapPrototypeGet(aliases, `${name}=`);
+      }
+      const aliasArg = peekArg();
+      if (expansion === undefined &&
+          aliasArg !== undefined &&
+          aliasArg.length > 0 &&
+          aliasArg[0] !== '-') {
+        expansion = MapPrototypeGet(aliases, `${name} <arg>`);
+      }
+      if (expansion === undefined) { break; }
+
+      const previousName = name;
+      // process.allowedNodeEnvironmentFlags may remove a self-recursive
+      // first entry from the cached alias metadata. Preserve the native
+      // parser's synthetic option terminator in that case.
+      if (expansion[0] === '--') {
+        for (let i = expansion.length - 1; i >= 0; i--) {
+          ArrayPrototypePush(syntheticArgs, expansion[i]);
+        }
+        break;
+      }
+      name = expansion[0];
+      for (let i = expansion.length - 1; i > 0; i--) {
+        ArrayPrototypePush(syntheticArgs, expansion[i]);
+      }
+      if (name === previousName) { break; }
+    }
+
+    const info = MapPrototypeGet(options, name);
+    if (info === undefined) { continue; }
+    if (isNegation && info.type !== kBoolean && info.type !== kV8Option) {
+      return;
+    }
+    if (info.type === kBoolean || info.type === kNoOp || info.type === kV8Option) {
+      if (name === '--inspect') {
+        inspectorEnabled = !isNegation;
+      } else if (name === '--inspect-brk') {
+        breakFirstLine = !isNegation;
+        if (!isNegation) { inspectorEnabled = true; }
+      } else if (!isNegation &&
+                 (name === '--inspect-wait' ||
+                  name === '--inspect-brk-node')) {
+        inspectorEnabled = true;
+      }
+      continue;
+    }
+
+    if (equalsIndex !== -1) {
+      if (equalsIndex === arg.length - 1) { return; }
+      continue;
+    }
+
+    const value = peekArg();
+    if (value === undefined || (value.length > 0 && value[0] === '-')) {
+      return;
+    }
+    shiftArg();
+  }
+
+  if (!inspectorEnabled) {
+    throw new ERR_DEBUGGER_STARTUP_ERROR(
+      '--no-inspect is incompatible with node inspect before the child script');
+  }
+  if (!breakFirstLine) {
+    throw new ERR_DEBUGGER_STARTUP_ERROR(
+      '--no-inspect-brk is incompatible with node inspect before the child script');
+  }
+}
+
+async function waitForDebugger(
+  client,
+  callMethod = (method) => client.callMethod(method),
+) {
+  const {
+    promise: waitingPromise,
+    resolve: resolveWaiting,
+  } = PromiseWithResolvers();
+  const {
+    promise: closedPromise,
+    reject: rejectClosed,
+  } = PromiseWithResolvers();
+  const onWaiting = () => resolveWaiting();
+  const onClose = () => {
+    rejectClosed(new ERR_DEBUGGER_ERROR(
+      'Debugger session ended while waiting for target startup'));
+  };
+
+  // The inspector can accept a connection before the target reaches its
+  // startup wait. Enabling NodeRuntime makes that state observable whether
+  // the target was already waiting or starts waiting later.
+  client.once('NodeRuntime.waitingForDebugger', onWaiting);
+  client.once('close', onClose);
+  try {
+    await SafePromiseRace([
+      callMethod('NodeRuntime.enable'),
+      closedPromise,
+    ]);
+    await SafePromiseRace([
+      waitingPromise,
+      closedPromise,
+    ]);
+    await SafePromiseRace([
+      callMethod('NodeRuntime.disable'),
+      closedPromise,
+    ]);
+  } finally {
+    client.removeListener('NodeRuntime.waitingForDebugger', onWaiting);
+    client.removeListener('close', onClose);
+  }
+}
+
 function writeInspectUsageAndExit(invokedAs, message, exitCode) {
   const code = exitCode ?? (message ? kInvalidCommandLineArgument : 0);
   const out = code === 0 ? process.stdout : process.stderr;
@@ -141,6 +332,8 @@ probe output schema.
 
 async function launchChildProcess(childArgs, inspectHost, inspectPort,
                                   childOutput, options = { __proto__: null }) {
+  validateChildArgs(childArgs);
+
   if (!options.skipPortPreflight) {
     await portIsFree(inspectHost, inspectPort);
   }
@@ -189,5 +382,6 @@ async function launchChildProcess(childArgs, inspectHost, inspectPort,
 module.exports = {
   ensureTrailingNewline,
   launchChildProcess,
+  waitForDebugger,
   writeInspectUsageAndExit,
 };
diff --git a/lib/internal/debugger/inspect_probe.js b/lib/internal/debugger/inspect_probe.js
index b6cac6dc5779..3b77a46f1ba1 100644
--- a/lib/internal/debugger/inspect_probe.js
+++ b/lib/internal/debugger/inspect_probe.js
@@ -33,6 +33,7 @@ const InspectClient = require('internal/debugger/inspect_client');
 const {
   ensureTrailingNewline,
   launchChildProcess,
+  waitForDebugger,
 } = require('internal/debugger/inspect_helpers');
 
 const { ERR_DEBUGGER_STARTUP_ERROR } = require('internal/errors').codes;
@@ -1044,6 +1045,17 @@ class ProbeInspectorSession {
       this.connected = true;
 
       try {
+        try {
+          await waitForDebugger(
+            this.client,
+            (method) => this.callCdp(method),
+          );
+        } catch (err) {
+          // A close event may have completed the structured report while the
+          // readiness helper was rejecting its disconnect race.
+          if (this.finished) { throw kInspectorFailedSentinel; }
+          throw err;
+        }
         await this.callCdp('Runtime.enable');
         await this.callCdp('Debugger.enable');
         await this.bindBreakpoints();
diff --git a/lib/internal/debugger/inspect_repl.js b/lib/internal/debugger/inspect_repl.js
index 548df089fb14..69ca174dd241 100644
--- a/lib/internal/debugger/inspect_repl.js
+++ b/lib/internal/debugger/inspect_repl.js
@@ -60,6 +60,7 @@ const { fileURLToPath } = require('internal/url');
 const { customInspectSymbol, SideEffectFreeRegExpPrototypeSymbolReplace } = require('internal/util');
 const { inspect: utilInspect } = require('internal/util/inspect');
 const { isObjectLiteral } = require('internal/repl/utils');
+const { waitForDebugger } = require('internal/debugger/inspect_helpers');
 const debuglog = require('internal/util/debuglog').debuglog('inspect');
 
 const SHORTCUTS = {
@@ -1204,9 +1205,13 @@ function createRepl(inspector) {
   }
 
   async function initAfterStart() {
+    const waitForDebuggerOnStart = !!inspector.options?.script;
     waitForInitialBreakRender =
-      !!inspector.options?.script &&
+      waitForDebuggerOnStart &&
       process.env.NODE_INSPECT_RESUME_ON_START !== '1';
+    if (waitForDebuggerOnStart) {
+      await waitForDebugger(inspector.client);
+    }
     await Runtime.enable();
     await Profiler.enable();
     await Profiler.setSamplingInterval({ interval: 100 });
diff --git a/test/parallel/test-debugger-no-inspect-brk.js b/test/parallel/test-debugger-no-inspect-brk.js
new file mode 100644
index 000000000000..611d28fd9f3e
--- /dev/null
+++ b/test/parallel/test-debugger-no-inspect-brk.js
@@ -0,0 +1,158 @@
+// Flags: --expose-internals
+
+// This tests that child --no-inspect and --no-inspect-brk options cannot leave
+// the inspector setup disabled, while remaining valid as application args.
+'use strict';
+
+const common = require('../common');
+common.skipIfInspectorDisabled();
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const {
+  spawnSyncAndAssert,
+  spawnSyncAndExit,
+} = require('../common/child_process');
+const { assertProbeJson } = require('../common/debugger-probe');
+const { launchChildProcess } = require('internal/debugger/inspect_helpers');
+
+const cwd = fixtures.path('debugger');
+const probeUrl = fixtures.fileURL('debugger', 'probe.js').href;
+const probeArgs = [
+  '--probe', 'probe.js:12',
+  '--expr', 'finalValue',
+];
+const incompatibleInspectBrk =
+  /--no-inspect-brk is incompatible with node inspect before the child script/;
+const incompatibleInspect =
+  /--no-inspect is incompatible with node inspect before the child script/;
+
+function assertSuccessfulProbe(childArgs) {
+  spawnSyncAndAssert(process.execPath, [
+    'inspect',
+    '--json',
+    ...probeArgs,
+    '--',
+    ...childArgs,
+  ], { cwd }, {
+    stdout(output) {
+      assertProbeJson(output, {
+        v: 2,
+        probes: [{
+          expr: 'finalValue',
+          target: { suffix: 'probe.js', line: 12 },
+        }],
+        results: [{
+          probe: 0,
+          event: 'hit',
+          hit: 1,
+          location: { url: probeUrl, line: 12, column: 1 },
+          result: { type: 'number', value: 81, description: '81' },
+        }, {
+          event: 'completed',
+        }],
+      });
+    },
+    trim: true,
+  });
+}
+
+for (const childOptions of [
+  ['--require', 'assert', '--no-inspect-brk'],
+  ['--require=assert', '--no-inspect-brk'],
+  ['-r', 'assert', '--no_inspect_brk'],
+]) {
+  spawnSyncAndExit(process.execPath, [
+    'inspect',
+    ...probeArgs,
+    '--',
+    ...childOptions,
+    'probe.js',
+  ], { cwd }, {
+    signal: null,
+    status: 1,
+    stderr: incompatibleInspectBrk,
+    trim: true,
+  });
+}
+
+spawnSyncAndExit(process.execPath, [
+  'inspect',
+  ...probeArgs,
+  '--',
+  '--require', 'assert',
+  '--no-inspect',
+  'probe.js',
+], { cwd }, {
+  signal: null,
+  status: 1,
+  stderr: incompatibleInspect,
+  trim: true,
+});
+
+for (const { option, error } of [
+  { option: '--no-inspect-brk', error: incompatibleInspectBrk },
+  { option: '--no-inspect', error: incompatibleInspect },
+]) {
+  spawnSyncAndExit(process.execPath, [
+    'inspect',
+    option,
+    'probe.js',
+  ], { cwd }, {
+    signal: null,
+    status: 1,
+    stderr: error,
+    trim: true,
+  });
+
+  assertSuccessfulProbe(['probe.js', option]);
+}
+
+// Node options are last-write-wins. A later --inspect-brk restores both
+// startup requirements.
+assertSuccessfulProbe([
+  '--no-inspect',
+  '--no-inspect-brk',
+  '--inspect-brk',
+  'probe.js',
+]);
+
+// ConfigReader rewrites these bare options to use the default path without
+// consuming the following argument.
+Promise.all([
+  assert.rejects(
+    launchChildProcess([
+      '--experimental-config-file',
+      '--no-inspect-brk',
+      'probe.js',
+    ], '127.0.0.1', 0, () => {}),
+    incompatibleInspectBrk,
+  ),
+  assert.rejects(
+    launchChildProcess([
+      '--experimental-default-config-file',
+      '--no-inspect-brk',
+      'probe.js',
+    ], '127.0.0.1', 0, () => {}),
+    incompatibleInspectBrk,
+  ),
+  // These options imply --inspect, but do not restore --inspect-brk.
+  assert.rejects(
+    launchChildProcess([
+      '--no-inspect',
+      '--inspect-wait',
+      '--no-inspect-brk',
+      'probe.js',
+    ], '127.0.0.1', 0, () => {}),
+    incompatibleInspectBrk,
+  ),
+  assert.rejects(
+    launchChildProcess([
+      '--no-inspect',
+      '--inspect-brk-node',
+      '--no-inspect-brk',
+      'probe.js',
+    ], '127.0.0.1', 0, () => {}),
+    incompatibleInspectBrk,
+  ),
+]).then(common.mustCall());
diff --git a/test/parallel/test-debugger-probe-startup-disconnect.js b/test/parallel/test-debugger-probe-startup-disconnect.js
new file mode 100644
index 000000000000..68c8432dc552
--- /dev/null
+++ b/test/parallel/test-debugger-probe-startup-disconnect.js
@@ -0,0 +1,56 @@
+// Flags: --expose-internals
+// This tests that a disconnect while probe mode is waiting for target startup
+// is reported as a structured probe failure instead of an internal error.
+'use strict';
+
+const common = require('../common');
+common.skipIfInspectorDisabled();
+
+const assert = require('assert');
+const { EventEmitter } = require('events');
+const { assertProbeJson } = require('../common/debugger-probe');
+const { ProbeInspectorSession } = require('internal/debugger/inspect_probe');
+
+const probe = {
+  expr: 'value',
+  target: { suffix: 'probe-target.js', line: 1 },
+};
+const client = new EventEmitter();
+client.connect = common.mustCall();
+client.callMethod = common.mustCall((method) => {
+  assert.strictEqual(method, 'NodeRuntime.enable');
+  setImmediate(() => client.emit('close'));
+  return new Promise(() => {});
+});
+client.reset = common.mustCall();
+
+const session = new ProbeInspectorSession({
+  childArgv: ['-e', ''],
+  host: '127.0.0.1',
+  port: 0,
+  probes: [probe],
+  skipPortPreflight: true,
+});
+session.client = client;
+
+session.run().then(common.mustCall(({ code, report }) => {
+  assert.strictEqual(code, 1);
+  assertProbeJson(report, {
+    v: 2,
+    probes: [probe],
+    results: [{
+      event: 'error',
+      pending: [0],
+      error: {
+        code: 'probe_failure',
+        message:
+          'Inspector connection lost before probes started before probes: ' +
+          'probe-target.js:1. The target startup may have torn down the ' +
+          'inspector. If startup does not touch the inspector, this is likely ' +
+          'a Node.js bug. Please file an issue.',
+        stderr: '',
+        details: { lastCdpMethod: 'NodeRuntime.enable' },
+      },
+    }],
+  });
+}));
diff --git a/test/parallel/test-debugger-run-restart-init.js b/test/parallel/test-debugger-run-restart-init.js
index 78f237353baf..b57939135f80 100644
--- a/test/parallel/test-debugger-run-restart-init.js
+++ b/test/parallel/test-debugger-run-restart-init.js
@@ -79,9 +79,29 @@ async function assertCommandWaitsForInit(repl, command, gate, calls) {
   const runGate = createGate();
   const restartGate = createGate();
   const gates = [null, runGate, restartGate];
+  const client = new EventEmitter();
+  let nodeRuntimeEnableCount = 0;
+  client.callMethod = common.mustCall(async (method) => {
+    calls.push(method);
+    if (method === 'NodeRuntime.enable') {
+      const emitWaiting = () => {
+        calls.push('NodeRuntime.waitingForDebugger');
+        client.emit('NodeRuntime.waitingForDebugger');
+      };
+      // Cover notifications arriving both before and after the enable reply.
+      if (nodeRuntimeEnableCount++ % 2 === 0) {
+        emitWaiting();
+      } else {
+        setImmediate(emitWaiting);
+      }
+    } else {
+      assert.strictEqual(method, 'NodeRuntime.disable');
+    }
+  }, 6);
   const inspector = {
-    client: new EventEmitter(),
+    client,
     domainNames: ['Debugger', 'HeapProfiler', 'Profiler', 'Runtime'],
+    options: { script: 'debugger-target.js' },
     stdin: new PassThrough(),
     stdout: new PassThrough(),
     run: common.mustCall(async () => {
@@ -101,6 +121,29 @@ async function assertCommandWaitsForInit(repl, command, gate, calls) {
   await assertCommandWaitsForInit(repl, 'run', runGate, calls);
   await assertCommandWaitsForInit(repl, 'restart', restartGate, calls);
 
+  assert.deepStrictEqual(
+    calls.filter((call) => (
+      call === 'NodeRuntime.enable' ||
+      call === 'NodeRuntime.waitingForDebugger' ||
+      call === 'NodeRuntime.disable' ||
+      call === 'Runtime.runIfWaitingForDebugger'
+    )),
+    [
+      'NodeRuntime.enable',
+      'NodeRuntime.waitingForDebugger',
+      'NodeRuntime.disable',
+      'Runtime.runIfWaitingForDebugger',
+      'NodeRuntime.enable',
+      'NodeRuntime.waitingForDebugger',
+      'NodeRuntime.disable',
+      'Runtime.runIfWaitingForDebugger',
+      'NodeRuntime.enable',
+      'NodeRuntime.waitingForDebugger',
+      'NodeRuntime.disable',
+      'Runtime.runIfWaitingForDebugger',
+    ],
+  );
+
   assert.deepStrictEqual(
     calls.filter((call) => (
       call === 'inspector.run' ||
@@ -116,4 +159,25 @@ async function assertCommandWaitsForInit(repl, command, gate, calls) {
   );
 
   repl.close();
+
+  const attachCalls = [];
+  const attachClient = new EventEmitter();
+  attachClient.callMethod = common.mustNotCall();
+  const attachInspector = {
+    client: attachClient,
+    domainNames: ['Debugger', 'HeapProfiler', 'Profiler', 'Runtime'],
+    options: {},
+    stdin: new PassThrough(),
+    stdout: new PassThrough(),
+    suspendReplWhile(fn) {
+      return fn();
+    },
+  };
+
+  for (const domain of attachInspector.domainNames) {
+    attachInspector[domain] = createAgent(domain, attachCalls, []);
+  }
+
+  const attachRepl = await createRepl(attachInspector)();
+  attachRepl.close();
 })().then(common.mustCall());
diff --git a/test/parallel/test-debugger-wait-for-debugger.js b/test/parallel/test-debugger-wait-for-debugger.js
new file mode 100644
index 000000000000..b438147ea832
--- /dev/null
+++ b/test/parallel/test-debugger-wait-for-debugger.js
@@ -0,0 +1,137 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+common.skipIfInspectorDisabled();
+
+const assert = require('assert');
+const { EventEmitter } = require('events');
+const {
+  waitForDebugger,
+} = require('internal/debugger/inspect_helpers');
+
+function assertListenersRemoved(client) {
+  assert.strictEqual(
+    client.listenerCount('NodeRuntime.waitingForDebugger'),
+    0,
+  );
+  assert.strictEqual(client.listenerCount('close'), 0);
+}
+
+async function testWaitingNotification(beforeEnableReply) {
+  const client = new EventEmitter();
+  const calls = [];
+  client.callMethod = common.mustCall(async (method) => {
+    calls.push(method);
+    const emitWaiting = () => {
+      client.emit('NodeRuntime.waitingForDebugger');
+    };
+    if (method === 'NodeRuntime.enable') {
+      if (beforeEnableReply) {
+        emitWaiting();
+      } else {
+        setImmediate(emitWaiting);
+      }
+    } else {
+      assert.strictEqual(method, 'NodeRuntime.disable');
+    }
+  }, 2);
+
+  await waitForDebugger(client);
+  assert.deepStrictEqual(calls, [
+    'NodeRuntime.enable',
+    'NodeRuntime.disable',
+  ]);
+  assertListenersRemoved(client);
+}
+
+async function testCloseWhileWaiting(beforeEnableReply) {
+  const client = new EventEmitter();
+  client.callMethod = common.mustCall((method) => {
+    assert.strictEqual(method, 'NodeRuntime.enable');
+    setImmediate(() => client.emit('close'));
+    return beforeEnableReply ? new Promise(() => {}) : Promise.resolve();
+  });
+
+  await assert.rejects(
+    waitForDebugger(client),
+    {
+      code: 'ERR_DEBUGGER_ERROR',
+      message: 'Debugger session ended while waiting for target startup',
+    },
+  );
+  assertListenersRemoved(client);
+}
+
+async function testCloseWhileDisabling() {
+  const client = new EventEmitter();
+  client.callMethod = common.mustCall((method) => {
+    if (method === 'NodeRuntime.enable') {
+      client.emit('NodeRuntime.waitingForDebugger');
+      return Promise.resolve();
+    }
+    assert.strictEqual(method, 'NodeRuntime.disable');
+    setImmediate(() => client.emit('close'));
+    return new Promise(() => {});
+  }, 2);
+
+  await assert.rejects(
+    waitForDebugger(client),
+    {
+      code: 'ERR_DEBUGGER_ERROR',
+      message: 'Debugger session ended while waiting for target startup',
+    },
+  );
+  assertListenersRemoved(client);
+}
+
+async function testEnableFailure() {
+  const client = new EventEmitter();
+  const expected = new Error('NodeRuntime.enable failed');
+  client.callMethod = common.mustCall(async (method) => {
+    assert.strictEqual(method, 'NodeRuntime.enable');
+    throw expected;
+  });
+
+  await assert.rejects(
+    waitForDebugger(client),
+    (error) => {
+      assert.strictEqual(error, expected);
+      return true;
+    },
+  );
+  assertListenersRemoved(client);
+}
+
+async function testDisableFailure() {
+  const client = new EventEmitter();
+  const expected = new Error('NodeRuntime.disable failed');
+  client.callMethod = common.mustCall(async (method) => {
+    if (method === 'NodeRuntime.enable') {
+      client.emit('NodeRuntime.waitingForDebugger');
+      return;
+    }
+    assert.strictEqual(method, 'NodeRuntime.disable');
+    throw expected;
+  }, 2);
+
+  await assert.rejects(
+    waitForDebugger(client),
+    (error) => {
+      assert.strictEqual(error, expected);
+      return true;
+    },
+  );
+  assertListenersRemoved(client);
+}
+
+(async () => {
+  await testWaitingNotification(true);
+  await testWaitingNotification(false);
+  await testCloseWhileWaiting(true);
+  await testCloseWhileWaiting(false);
+  await testCloseWhileDisabling();
+  await testEnableFailure();
+  await testDisableFailure();
+})().then(common.mustCall());

From a5e5c7f75632ef200483ee0b2d4409d52c6b5514 Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Mon, 17 Aug 2026 17:23:30 +0900
Subject: [PATCH 207/344] typings: add signal_wrap internal binding types

Add a SignalWrapBinding declaration for internalBinding('signal_wrap')
and wire it into InternalBindingMap.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65229
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 typings/globals.d.ts                     |  2 ++
 typings/internalBinding/signal_wrap.d.ts | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 typings/internalBinding/signal_wrap.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index 6f6ca5d3f936..e64b8e6d89fc 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -27,6 +27,7 @@ import { ProcessBinding } from './internalBinding/process';
 import { ProcessWrapBinding } from './internalBinding/process_wrap';
 import { SeaBinding } from './internalBinding/sea';
 import { SerdesBinding } from './internalBinding/serdes';
+import { SignalWrapBinding } from './internalBinding/signal_wrap';
 import { StringDecoderBinding } from './internalBinding/string_decoder';
 import { SymbolsBinding } from './internalBinding/symbols';
 import { TimersBinding } from './internalBinding/timers';
@@ -70,6 +71,7 @@ interface InternalBindingMap {
   process_wrap: ProcessWrapBinding;
   sea: SeaBinding;
   serdes: SerdesBinding;
+  signal_wrap: SignalWrapBinding;
   string_decoder: StringDecoderBinding;
   symbols: SymbolsBinding;
   timers: TimersBinding;
diff --git a/typings/internalBinding/signal_wrap.d.ts b/typings/internalBinding/signal_wrap.d.ts
new file mode 100644
index 000000000000..4c6473cbee22
--- /dev/null
+++ b/typings/internalBinding/signal_wrap.d.ts
@@ -0,0 +1,16 @@
+declare namespace InternalSignalWrapBinding {
+  class Signal {
+    constructor();
+    onsignal?: (signum: number) => void;
+    start(signum: number): number | undefined;
+    stop(): number;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+  }
+}
+
+export interface SignalWrapBinding {
+  Signal: typeof InternalSignalWrapBinding.Signal;
+}

From f373dab724b1896a9f58778ddc78419fd8f050bc Mon Sep 17 00:00:00 2001
From: Ayoub Mabrouk <77799760+Ayoub-Mabrouk@users.noreply.github.com>
Date: Mon, 17 Aug 2026 09:44:15 +0100
Subject: [PATCH 208/344] util: use more primordials in `comparisons.js`

PR-URL: https://github.com/nodejs/node/pull/61198
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
---
 lib/internal/util/comparisons.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 2582217febc6..6b608a66733a 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -761,7 +761,7 @@ function setEquiv(a, b, mode, memo) {
       // If the specified value doesn't exist in the second set it's a object
       // (or in loose mode: a non-matching primitive). Find the
       // deep-(mode-)equal element in a set copy to reduce duplicate checks.
-      array.push(val);
+      ArrayPrototypePush(array, val);
     }
   }
 
@@ -891,7 +891,7 @@ function mapEquiv(a, b, mode, memo) {
         }
         array = [];
       }
-      array.push(key2);
+      ArrayPrototypePush(array, key2);
     } else {
       // By directly retrieving the value we prevent another b.has(key2) check in
       // almost all possible cases.
@@ -907,7 +907,7 @@ function mapEquiv(a, b, mode, memo) {
         if (array === undefined) {
           array = [];
         }
-        array.push(key2);
+        ArrayPrototypePush(array, key2);
       }
     }
   }

From fdc1e785952d3f3dd46e0c02a6c8062c72f57111 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Mon, 17 Aug 2026 15:03:06 +0200
Subject: [PATCH 209/344] test: enforce exit code in
 `test-http-server-stale-close`

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65198
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 test/parallel/test-http-server-stale-close.js | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/test/parallel/test-http-server-stale-close.js b/test/parallel/test-http-server-stale-close.js
index d33c756a4a30..909d02c920eb 100644
--- a/test/parallel/test-http-server-stale-close.js
+++ b/test/parallel/test-http-server-stale-close.js
@@ -35,7 +35,7 @@ if (process.env.NODE_TEST_FORK_PORT) {
   req.write('BAM');
   req.end();
 } else {
-  const server = http.createServer(common.mustCallAtLeast((req, res) => {
+  const server = http.createServer(common.mustCall((req, res) => {
     res.writeHead(200, { 'Content-Length': '42' });
     req.pipe(res);
     assert.strictEqual(req.destroyed, false);
@@ -45,9 +45,13 @@ if (process.env.NODE_TEST_FORK_PORT) {
       res.end();
     }));
   }));
-  server.listen(0, function() {
-    fork(__filename, {
+  server.listen(0, common.mustCall(function() {
+    const cp = fork(__filename, {
+      stdio: 'inherit',
       env: { ...process.env, NODE_TEST_FORK_PORT: this.address().port }
     });
-  });
+    cp.once('exit', common.mustCall((code) => {
+      assert.strictEqual(code, 0);
+    }));
+  }));
 }

From 9024ec27b6333e5cd2bea5ce890fc2ff6fbab84f Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Mon, 17 Aug 2026 09:26:47 -0700
Subject: [PATCH 210/344] ffi: keep FFI functions non-constructible

Use concise method functions for Fast API and shared-buffer wrappers,
and create native fallback functions with ConstructorBehavior::kThrow,
so FFI functions remain non-constructible on all invocation paths.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65184
Fixes: https://github.com/nodejs/node/issues/65183
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 lib/internal/ffi-shared-buffer.js    | 70 ++++++++++++++--------------
 lib/internal/ffi/fast-api.js         | 18 +++----
 src/node_ffi.cc                      | 11 +++--
 test/ffi/test-ffi-dynamic-library.js | 21 +++++++++
 4 files changed, 75 insertions(+), 45 deletions(-)

diff --git a/lib/internal/ffi-shared-buffer.js b/lib/internal/ffi-shared-buffer.js
index c8b48d2aad4c..94764bdf0db7 100644
--- a/lib/internal/ffi-shared-buffer.js
+++ b/lib/internal/ffi-shared-buffer.js
@@ -198,6 +198,8 @@ function inheritMetadata(wrapper, rawFn, nargs) {
 // arguments out of it into invocation-local storage before `ffi_call` and
 // reads the return value back only after, so nested/reentrant calls into
 // the same function are safe.
+// Concise methods do not have [[Construct]], unlike function expressions, so
+// use them below to match the native FFI functions' non-constructible behavior.
 function wrapWithSharedBuffer(rawFn, signature) {
   if (rawFn == null) return rawFn;
   const buffer = rawFn[kSbSharedBuffer];
@@ -254,7 +256,7 @@ function wrapWithSharedBuffer(rawFn, signature) {
     // so arity specialization wouldn't buy much here.
     assert(slowInvoke !== undefined,
            'FFI: shared-buffer raw function with pointer arguments is missing kSbInvokeSlow');
-    wrapper = function(...args) {
+    wrapper = { invoke(...args) {
       if (args.length !== nargs) {
         throwFFIArgCountError(nargs, args.length);
       }
@@ -271,7 +273,7 @@ function wrapWithSharedBuffer(rawFn, signature) {
       }
       rawFn();
       return retGetter === null ? undefined : retGetter(view, 0, true);
-    };
+    } }.invoke;
   } else {
     // Arity specialization avoids the per-call `Array` allocation of
     // `...args`; the void/non-void split removes a per-call branch on
@@ -295,42 +297,42 @@ function buildNumericWrapper(
   /* c8 ignore start */
   if (nargs === 0) {
     if (retGetter === null) {
-      return function() {
+      return { invoke() {
         if (arguments.length !== 0) {
           throwFFIArgCountError(0, arguments.length);
         }
         rawFn();
-      };
+      } }.invoke;
     }
-    return function() {
+    return { invoke() {
       if (arguments.length !== 0) {
         throwFFIArgCountError(0, arguments.length);
       }
       rawFn();
       return retGetter(view, 0, true);
-    };
+    } }.invoke;
   }
   /* c8 ignore stop */
   if (nargs === 1) {
     const i0 = argInfos[0];
     const o0 = argOffsets[0];
     if (retGetter === null) {
-      return function(a0) {
+      return { invoke(a0) {
         if (arguments.length !== 1) {
           throwFFIArgCountError(1, arguments.length);
         }
         writeNumericArg(view, i0, o0, a0, 0);
         rawFn();
-      };
+      } }.invoke;
     }
-    return function(a0) {
+    return { invoke(a0) {
       if (arguments.length !== 1) {
         throwFFIArgCountError(1, arguments.length);
       }
       writeNumericArg(view, i0, o0, a0, 0);
       rawFn();
       return retGetter(view, 0, true);
-    };
+    } }.invoke;
   }
   if (nargs === 2) {
     const i0 = argInfos[0];
@@ -338,16 +340,16 @@ function buildNumericWrapper(
     const o0 = argOffsets[0];
     const o1 = argOffsets[1];
     if (retGetter === null) {
-      return function(a0, a1) {
+      return { invoke(a0, a1) {
         if (arguments.length !== 2) {
           throwFFIArgCountError(2, arguments.length);
         }
         writeNumericArg(view, i0, o0, a0, 0);
         writeNumericArg(view, i1, o1, a1, 1);
         rawFn();
-      };
+      } }.invoke;
     }
-    return function(a0, a1) {
+    return { invoke(a0, a1) {
       if (arguments.length !== 2) {
         throwFFIArgCountError(2, arguments.length);
       }
@@ -355,7 +357,7 @@ function buildNumericWrapper(
       writeNumericArg(view, i1, o1, a1, 1);
       rawFn();
       return retGetter(view, 0, true);
-    };
+    } }.invoke;
   }
   if (nargs === 3) {
     const i0 = argInfos[0];
@@ -365,7 +367,7 @@ function buildNumericWrapper(
     const o1 = argOffsets[1];
     const o2 = argOffsets[2];
     if (retGetter === null) {
-      return function(a0, a1, a2) {
+      return { invoke(a0, a1, a2) {
         if (arguments.length !== 3) {
           throwFFIArgCountError(3, arguments.length);
         }
@@ -373,9 +375,9 @@ function buildNumericWrapper(
         writeNumericArg(view, i1, o1, a1, 1);
         writeNumericArg(view, i2, o2, a2, 2);
         rawFn();
-      };
+      } }.invoke;
     }
-    return function(a0, a1, a2) {
+    return { invoke(a0, a1, a2) {
       if (arguments.length !== 3) {
         throwFFIArgCountError(3, arguments.length);
       }
@@ -384,7 +386,7 @@ function buildNumericWrapper(
       writeNumericArg(view, i2, o2, a2, 2);
       rawFn();
       return retGetter(view, 0, true);
-    };
+    } }.invoke;
   }
   if (nargs === 4) {
     const i0 = argInfos[0];
@@ -396,7 +398,7 @@ function buildNumericWrapper(
     const o2 = argOffsets[2];
     const o3 = argOffsets[3];
     if (retGetter === null) {
-      return function(a0, a1, a2, a3) {
+      return { invoke(a0, a1, a2, a3) {
         if (arguments.length !== 4) {
           throwFFIArgCountError(4, arguments.length);
         }
@@ -405,9 +407,9 @@ function buildNumericWrapper(
         writeNumericArg(view, i2, o2, a2, 2);
         writeNumericArg(view, i3, o3, a3, 3);
         rawFn();
-      };
+      } }.invoke;
     }
-    return function(a0, a1, a2, a3) {
+    return { invoke(a0, a1, a2, a3) {
       if (arguments.length !== 4) {
         throwFFIArgCountError(4, arguments.length);
       }
@@ -417,7 +419,7 @@ function buildNumericWrapper(
       writeNumericArg(view, i3, o3, a3, 3);
       rawFn();
       return retGetter(view, 0, true);
-    };
+    } }.invoke;
   }
   if (nargs === 5) {
     const i0 = argInfos[0];
@@ -431,7 +433,7 @@ function buildNumericWrapper(
     const o3 = argOffsets[3];
     const o4 = argOffsets[4];
     if (retGetter === null) {
-      return function(a0, a1, a2, a3, a4) {
+      return { invoke(a0, a1, a2, a3, a4) {
         if (arguments.length !== 5) {
           throwFFIArgCountError(5, arguments.length);
         }
@@ -441,9 +443,9 @@ function buildNumericWrapper(
         writeNumericArg(view, i3, o3, a3, 3);
         writeNumericArg(view, i4, o4, a4, 4);
         rawFn();
-      };
+      } }.invoke;
     }
-    return function(a0, a1, a2, a3, a4) {
+    return { invoke(a0, a1, a2, a3, a4) {
       if (arguments.length !== 5) {
         throwFFIArgCountError(5, arguments.length);
       }
@@ -454,7 +456,7 @@ function buildNumericWrapper(
       writeNumericArg(view, i4, o4, a4, 4);
       rawFn();
       return retGetter(view, 0, true);
-    };
+    } }.invoke;
   }
   if (nargs === 6) {
     const i0 = argInfos[0];
@@ -470,7 +472,7 @@ function buildNumericWrapper(
     const o4 = argOffsets[4];
     const o5 = argOffsets[5];
     if (retGetter === null) {
-      return function(a0, a1, a2, a3, a4, a5) {
+      return { invoke(a0, a1, a2, a3, a4, a5) {
         if (arguments.length !== 6) {
           throwFFIArgCountError(6, arguments.length);
         }
@@ -481,9 +483,9 @@ function buildNumericWrapper(
         writeNumericArg(view, i4, o4, a4, 4);
         writeNumericArg(view, i5, o5, a5, 5);
         rawFn();
-      };
+      } }.invoke;
     }
-    return function(a0, a1, a2, a3, a4, a5) {
+    return { invoke(a0, a1, a2, a3, a4, a5) {
       if (arguments.length !== 6) {
         throwFFIArgCountError(6, arguments.length);
       }
@@ -495,12 +497,12 @@ function buildNumericWrapper(
       writeNumericArg(view, i5, o5, a5, 5);
       rawFn();
       return retGetter(view, 0, true);
-    };
+    } }.invoke;
   }
   // 7+ args: further specialization is diminishing returns and bloats
   // this builder.
   if (retGetter === null) {
-    return function(...args) {
+    return { invoke(...args) {
       if (args.length !== nargs) {
         throwFFIArgCountError(nargs, args.length);
       }
@@ -508,9 +510,9 @@ function buildNumericWrapper(
         writeNumericArg(view, argInfos[i], argOffsets[i], args[i], i);
       }
       rawFn();
-    };
+    } }.invoke;
   }
-  return function(...args) {
+  return { invoke(...args) {
     if (args.length !== nargs) {
       throwFFIArgCountError(nargs, args.length);
     }
@@ -519,7 +521,7 @@ function buildNumericWrapper(
     }
     rawFn();
     return retGetter(view, 0, true);
-  };
+  } }.invoke;
 }
 
 module.exports = {
diff --git a/lib/internal/ffi/fast-api.js b/lib/internal/ffi/fast-api.js
index b93d061b00cd..4355ab1a992f 100644
--- a/lib/internal/ffi/fast-api.js
+++ b/lib/internal/ffi/fast-api.js
@@ -254,6 +254,8 @@ function throwIfFastLibraryClosed(state) {
   }
 }
 
+// Concise methods do not have [[Construct]], unlike function expressions.
+// Keep wrappers non-constructible to match the native FFI functions.
 function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
   if (rawFn === undefined || rawFn === null) {
     return rawFn;
@@ -287,7 +289,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
     const memory0 = needsRawPointerConversion(t0) || string0;
     const fastBufferInvoke = needsPointerLikeConversion(t0) ?
       rawFn[kFastBufferInvoke] : undefined;
-    wrapper = function(a0) {
+    wrapper = { invoke(a0) {
       throwIfFastLibraryClosed(state);
       if (arguments.length !== 1) {
         throwFFIArgCountError(1, arguments.length);
@@ -312,13 +314,13 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
         arg = getRawPointerArg(arg, 0);
       }
       return rawFn(arg);
-    };
+    } }.invoke;
   } else if (nargs === 2) {
     const c0 = ArrayPrototypeIncludes(indexes, 0);
     const c1 = ArrayPrototypeIncludes(indexes, 1);
     const t0 = argumentTypes[0];
     const t1 = argumentTypes[1];
-    wrapper = function(a0, a1) {
+    wrapper = { invoke(a0, a1) {
       throwIfFastLibraryClosed(state);
       if (arguments.length !== 2) {
         throwFFIArgCountError(2, arguments.length);
@@ -332,7 +334,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
       } finally {
         if (stringCall) exitStringConversion(stringState);
       }
-    };
+    } }.invoke;
   } else if (nargs === 3) {
     const c0 = ArrayPrototypeIncludes(indexes, 0);
     const c1 = ArrayPrototypeIncludes(indexes, 1);
@@ -340,7 +342,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
     const t0 = argumentTypes[0];
     const t1 = argumentTypes[1];
     const t2 = argumentTypes[2];
-    wrapper = function(a0, a1, a2) {
+    wrapper = { invoke(a0, a1, a2) {
       throwIfFastLibraryClosed(state);
       if (arguments.length !== 3) {
         throwFFIArgCountError(3, arguments.length);
@@ -356,9 +358,9 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
       } finally {
         if (stringCall) exitStringConversion(stringState);
       }
-    };
+    } }.invoke;
   } else {
-    wrapper = function(...args) {
+    wrapper = { invoke(...args) {
       throwIfFastLibraryClosed(state);
       if (args.length !== nargs) {
         throwFFIArgCountError(nargs, args.length);
@@ -382,7 +384,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
       } finally {
         if (stringCall) exitStringConversion(stringState);
       }
-    };
+    } }.invoke;
   }
 
   return inheritMetadata(wrapper, rawFn, nargs);
diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 42c62c829168..3bf80b142dfd 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -324,7 +324,9 @@ MaybeLocal<Function> DynamicLibrary::CreateFunction(
     maybe_ret = Function::New(context,
                               use_sb ? DynamicLibrary::InvokeFunctionSB
                                      : DynamicLibrary::InvokeFunction,
-                              info->object());
+                              info->object(),
+                              0,
+                              v8::ConstructorBehavior::kThrow);
   }
 
   Local<Function> ret;
@@ -377,8 +379,11 @@ MaybeLocal<Function> DynamicLibrary::CreateFunction(
     // (strings, Buffers, ArrayBuffers, and ArrayBufferViews).
     if (has_ptr_args) {
       Local<Function> slow_fn;
-      if (!Function::New(
-               context, DynamicLibrary::InvokeFunction, info->object())
+      if (!Function::New(context,
+                         DynamicLibrary::InvokeFunction,
+                         info->object(),
+                         0,
+                         v8::ConstructorBehavior::kThrow)
                .ToLocal(&slow_fn)) {
         return MaybeLocal<Function>();
       }
diff --git a/test/ffi/test-ffi-dynamic-library.js b/test/ffi/test-ffi-dynamic-library.js
index 82400335a12f..d22cf48d77b1 100644
--- a/test/ffi/test-ffi-dynamic-library.js
+++ b/test/ffi/test-ffi-dynamic-library.js
@@ -67,6 +67,27 @@ test('dlopen resolves functions from definitions', () => {
   }
 });
 
+test('FFI functions are not constructible', () => {
+  const { lib, functions } = ffi.dlopen(libraryPath, {
+    add_i32: fixtureSymbols.add_i32,
+    multiply_f64: fixtureSymbols.multiply_f64,
+  });
+
+  try {
+    assert.strictEqual(Object.hasOwn(functions.add_i32, 'prototype'), false);
+    assert.strictEqual(
+      Object.hasOwn(functions.multiply_f64, 'prototype'), false);
+    assert.throws(
+      () => Reflect.construct(functions.add_i32, [20, 22]),
+      TypeError);
+    assert.throws(
+      () => Reflect.construct(functions.multiply_f64, [6, 7]),
+      TypeError);
+  } finally {
+    lib.close();
+  }
+});
+
 test('DynamicLibrary exposes functions and symbols', () => {
   const lib = new ffi.DynamicLibrary(libraryPath);
 

From 0002f0a718de94258c5851b78930689394ff8bfe Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 4 Aug 2026 03:54:39 +0000
Subject: [PATCH 211/344] ffi: remove dead null check in callback arguments

InvokeCallback tested `args[i] == nullptr` and mapped the argument to
JS `null`. `args` is libffi's avalue array, and libffi always points
each slot at its own storage for the corresponding argument, so the
slot pointers are never null and the branch never ran.

The check also read as a guarantee the code does not provide: a NULL
pointer argument surfaces as the BigInt `0n`, because ToJSArgument
converts `ffi_type_pointer` values with BigInt::NewFromUnsigned. Drop
the branch rather than reimplementing it in ToJSArgument, which would
change behavior by making pointer parameters arrive as either a BigInt
or `null`.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/64998
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 src/node_ffi.cc | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 3bf80b142dfd..7e3da95b958f 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -32,7 +32,6 @@ using v8::Local;
 using v8::LocalVector;
 using v8::Maybe;
 using v8::MaybeLocal;
-using v8::Null;
 using v8::Object;
 using v8::PropertyAttribute;
 using v8::ReadOnly;
@@ -715,13 +714,11 @@ void DynamicLibrary::InvokeCallback(ffi_cif* cif,
   size_t expected_args = cb->args.size();
   LocalVector<Value> callback_args(isolate, expected_args);
 
+  // libffi always points `args[i]` at its own storage for the value of
+  // argument `i`, so the slot pointers themselves are never null. A NULL
+  // pointer argument surfaces as the BigInt `0n` via ToJSArgument.
   for (size_t i = 0; i < expected_args; i++) {
-    if (args[i] == nullptr) {
-      callback_args[i] = Null(isolate);
-      continue;
-    } else {
-      callback_args[i] = ToJSArgument(isolate, cb->args[i], args[i]);
-    }
+    callback_args[i] = ToJSArgument(isolate, cb->args[i], args[i]);
   }
 
   TryCatch try_catch(isolate);

From 825fcfe4d5b111073fd8c227a8158d470efcdf6a Mon Sep 17 00:00:00 2001
From: avivkeller <me@aviv.sh>
Date: Sat, 18 Jul 2026 18:52:13 -0700
Subject: [PATCH 212/344] repl: add benchmarks

Signed-off-by: avivkeller <me@aviv.sh>
PR-URL: https://github.com/nodejs/node/pull/64590
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 benchmark/repl/completion.js          | 53 +++++++++++++++++++++++++
 benchmark/repl/creation.js            | 39 ++++++++++++++++++
 benchmark/repl/evaluate.js            | 57 +++++++++++++++++++++++++++
 benchmark/repl/process-lines.js       | 52 ++++++++++++++++++++++++
 benchmark/repl/reset-context.js       | 26 ++++++++++++
 test/benchmark/test-benchmark-repl.js |  8 ++++
 6 files changed, 235 insertions(+)
 create mode 100644 benchmark/repl/completion.js
 create mode 100644 benchmark/repl/creation.js
 create mode 100644 benchmark/repl/evaluate.js
 create mode 100644 benchmark/repl/process-lines.js
 create mode 100644 benchmark/repl/reset-context.js
 create mode 100644 test/benchmark/test-benchmark-repl.js

diff --git a/benchmark/repl/completion.js b/benchmark/repl/completion.js
new file mode 100644
index 000000000000..b9f55d8416b0
--- /dev/null
+++ b/benchmark/repl/completion.js
@@ -0,0 +1,53 @@
+'use strict';
+
+const common = require('../common.js');
+const repl = require('node:repl');
+const { PassThrough, Writable } = require('node:stream');
+
+const bench = common.createBenchmark(main, {
+  n: [5e3],
+  query: [
+    'cons',
+    'console.lo',
+    'Buffer.prototype.wri',
+    "require('f",
+  ],
+  useGlobal: [0, 1],
+});
+
+function main({ n, query, useGlobal }) {
+  const input = new PassThrough();
+  const output = new Writable({ write(c, e, cb) { cb(); } });
+  const server = new repl.REPLServer({
+    input,
+    output,
+    terminal: false,
+    useGlobal: !!useGlobal,
+  });
+
+  // Inspector callbacks do not keep the event loop alive on their own.
+  const keepAlive = setInterval(() => {}, 0x7fffffff);
+  let remaining = n;
+
+  function complete() {
+    server.complete(query, onComplete);
+  }
+
+  function onComplete(err) {
+    if (err) {
+      throw err;
+    }
+
+    if (--remaining === 0) {
+      bench.end(n);
+      clearInterval(keepAlive);
+      server.close();
+      return;
+    }
+
+    setImmediate(complete);
+  }
+
+  bench.start();
+  setImmediate(complete);
+}
diff --git a/benchmark/repl/creation.js b/benchmark/repl/creation.js
new file mode 100644
index 000000000000..60e795063d19
--- /dev/null
+++ b/benchmark/repl/creation.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const common = require('../common.js');
+const repl = require('node:repl');
+const { PassThrough, Writable } = require('node:stream');
+
+const bench = common.createBenchmark(main, {
+  n: [500],
+  preview: [0, 1],
+  terminal: [0, 1],
+  useGlobal: [0, 1],
+}, {
+  combinationFilter: ({ preview, terminal }) => !!terminal || !preview,
+});
+
+function main({ n, preview, terminal, useGlobal }) {
+  const inputs = Array.from({ length: n }, () => new PassThrough());
+  const outputs = Array.from(
+    { length: n },
+    () => new Writable({ write(c, e, cb) { cb(); } }),
+  );
+  const servers = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    servers[i] = new repl.REPLServer({
+      input: inputs[i],
+      output: outputs[i],
+      preview: !!preview,
+      terminal: !!terminal,
+      useGlobal: !!useGlobal,
+    });
+  }
+  bench.end(n);
+
+  for (const server of servers) {
+    server.close();
+  }
+}
diff --git a/benchmark/repl/evaluate.js b/benchmark/repl/evaluate.js
new file mode 100644
index 000000000000..48376a2b48fe
--- /dev/null
+++ b/benchmark/repl/evaluate.js
@@ -0,0 +1,57 @@
+'use strict';
+
+const common = require('../common.js');
+const repl = require('node:repl');
+const { PassThrough, Writable } = require('node:stream');
+
+const bench = common.createBenchmark(main, {
+  n: [2e4],
+  code: [
+    '1 + 1',
+    '({ answer: 42 })',
+    'Promise.resolve(42)',
+    'await Promise.resolve(42)',
+  ],
+  mode: ['sloppy', 'strict'],
+  useGlobal: [0, 1],
+});
+
+function main({ n, code, mode, useGlobal }) {
+  const input = new PassThrough();
+  const output = new Writable({ write(c, e, cb) { cb(); } });
+  const server = new repl.REPLServer({
+    input,
+    output,
+    replMode: mode === 'strict' ?
+      repl.REPL_MODE_STRICT :
+      repl.REPL_MODE_SLOPPY,
+    terminal: false,
+    useGlobal: !!useGlobal,
+  });
+
+  // Inspector callbacks do not keep the event loop alive on their own.
+  const keepAlive = setInterval(() => {}, 0x7fffffff);
+  let remaining = n;
+
+  function evaluate() {
+    server.eval(`${code}\n`, server.context, 'repl', onEvaluate);
+  }
+
+  function onEvaluate(err) {
+    if (err) {
+      throw err;
+    }
+
+    if (--remaining === 0) {
+      bench.end(n);
+      clearInterval(keepAlive);
+      server.close();
+      return;
+    }
+
+    setImmediate(evaluate);
+  }
+
+  bench.start();
+  setImmediate(evaluate);
+}
diff --git a/benchmark/repl/process-lines.js b/benchmark/repl/process-lines.js
new file mode 100644
index 000000000000..fd019512f9fc
--- /dev/null
+++ b/benchmark/repl/process-lines.js
@@ -0,0 +1,52 @@
+'use strict';
+
+const common = require('../common.js');
+const repl = require('node:repl');
+const { PassThrough, Writable } = require('node:stream');
+
+const bench = common.createBenchmark(main, {
+  n: [1e4],
+  code: [
+    '1 + 1\n',
+    'Promise.resolve(42)\n',
+  ],
+  mode: ['sloppy', 'strict'],
+  terminal: [0, 1],
+  useGlobal: [0, 1],
+});
+
+function main({ n, code: inputCode, mode, terminal, useGlobal }) {
+  const input = new PassThrough();
+  const output = new Writable({ write(c, e, cb) { cb(); } });
+  const server = new repl.REPLServer({
+    input,
+    output,
+    replMode: mode === 'strict' ?
+      repl.REPL_MODE_STRICT :
+      repl.REPL_MODE_SLOPPY,
+    terminal: !!terminal,
+    useGlobal: !!useGlobal,
+  });
+  const originalEval = server.eval;
+  // TTY input dispatch can briefly have no other active event loop handles.
+  const keepAlive = setInterval(() => {}, 0x7fffffff);
+  let remaining = n;
+
+  // eslint-disable-next-line node-core/func-name-matching
+  server.eval = function REPLEval(code, context, file, callback) {
+    originalEval(code, context, file, function onEvaluate() {
+      const result = Reflect.apply(callback, this, arguments);
+      if (--remaining === 0) {
+        bench.end(n);
+        clearInterval(keepAlive);
+        server.close();
+      } else {
+        setImmediate(() => input.write(inputCode));
+      }
+      return result;
+    });
+  };
+
+  bench.start();
+  input.write(inputCode);
+}
diff --git a/benchmark/repl/reset-context.js b/benchmark/repl/reset-context.js
new file mode 100644
index 000000000000..ab96f92564f2
--- /dev/null
+++ b/benchmark/repl/reset-context.js
@@ -0,0 +1,26 @@
+'use strict';
+
+const common = require('../common.js');
+const repl = require('node:repl');
+const { PassThrough, Writable } = require('node:stream');
+
+const bench = common.createBenchmark(main, {
+  n: [1e3],
+});
+
+function main({ n }) {
+  const input = new PassThrough();
+  const output = new Writable({ write(c, e, cb) { cb(); } });
+  const server = new repl.REPLServer({
+    input,
+    output,
+    terminal: false,
+  });
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    server.resetContext();
+  }
+  bench.end(n);
+  server.close();
+}
diff --git a/test/benchmark/test-benchmark-repl.js b/test/benchmark/test-benchmark-repl.js
new file mode 100644
index 000000000000..045813039589
--- /dev/null
+++ b/test/benchmark/test-benchmark-repl.js
@@ -0,0 +1,8 @@
+'use strict';
+
+const common = require('../common');
+const runBenchmark = require('../common/benchmark');
+
+common.skipIfInspectorDisabled();
+
+runBenchmark('repl', { NODEJS_BENCHMARK_ZERO_ALLOWED: 1 });

From 613be79cf472fdc9102ce6bff44620904dcaf0ce Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 8 Aug 2026 21:31:29 -0700
Subject: [PATCH 213/344] src: add v8::Local specialization for
 MaybeStackBuffer

Long-term itch. Per v8 rules, we're not supposed to be
heap allocating v8::Local's; instead we're supposed to
be using v8::LocalVector. Create a specialization of
MaybeStackBuffer that uses either a stack array of
v8::Locals or v8::LocalVector with some additional
utility improvements.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65159
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 src/api/callback.cc      |  2 +-
 src/cares_wrap.cc        |  4 +-
 src/crypto/crypto_tls.cc |  6 +--
 src/js_stream.cc         |  8 +---
 src/js_udp_wrap.cc       |  9 ++---
 src/node_concepts.h      |  7 ++++
 src/node_dir.cc          |  5 ++-
 src/node_env_var.cc      |  7 +++-
 src/node_http2.cc        | 17 ++++----
 src/node_messaging.cc    |  4 +-
 src/node_messaging.h     |  2 +-
 src/node_v8.cc           | 10 ++---
 src/spawn_sync.cc        |  5 +--
 src/util-inl.h           | 40 +++++++++++++++----
 src/util.h               | 84 +++++++++++++++++++++++++++++++++++++++-
 15 files changed, 161 insertions(+), 49 deletions(-)

diff --git a/src/api/callback.cc b/src/api/callback.cc
index 0f458f470501..85da82ff84a5 100644
--- a/src/api/callback.cc
+++ b/src/api/callback.cc
@@ -245,7 +245,7 @@ MaybeLocal<Value> InternalMakeCallback(Environment* env,
 
   Local<Context> context = env->context();
   if (use_async_hooks_trampoline) {
-    MaybeStackBuffer<Local<Value>, 16> args(3 + argc);
+    MaybeStackBuffer<Value, 16> args(env->isolate(), 3 + argc);
     args[0] = Number::New(env->isolate(), asyncContext.async_id);
     args[1] = resource;
     args[2] = callback;
diff --git a/src/cares_wrap.cc b/src/cares_wrap.cc
index 7d9323c83ee6..f1382b040362 100644
--- a/src/cares_wrap.cc
+++ b/src/cares_wrap.cc
@@ -201,12 +201,12 @@ Local<Array> AddrTTLToArray(
     Environment* env,
     const T* addrttls,
     size_t naddrttls) {
-  MaybeStackBuffer<Local<Value>, 8> ttls(naddrttls);
+  MaybeStackBuffer<Value, 8> ttls(env->isolate(), naddrttls);
   for (size_t i = 0; i < naddrttls; i++) {
     ttls[i] = Integer::NewFromUnsigned(env->isolate(), addrttls[i].ttl);
   }
 
-  return Array::New(env->isolate(), ttls.out(), naddrttls);
+  return ttls.ToArray();
 }
 
 int GetAnswerCountForTTLBuffer(const unsigned char* buf, int len) {
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 936c201de99d..5a531209e232 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -41,7 +41,6 @@ using ncrypto::MarkPopErrorOnReturn;
 using ncrypto::SSLPointer;
 using ncrypto::SSLSessionPointer;
 using ncrypto::X509Pointer;
-using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
 using v8::BackingStore;
@@ -1956,7 +1955,7 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
   SSL* ssl = w->ssl_.get();
   int nsig = SSL_get_shared_sigalgs(ssl, 0, nullptr, nullptr, nullptr, nullptr,
                                     nullptr);
-  MaybeStackBuffer<Local<Value>, 16> ret_arr(nsig);
+  MaybeStackBuffer<Value, 16> ret_arr(env->isolate(), nsig);
 
   for (int i = 0; i < nsig; i++) {
     int hash_nid;
@@ -2023,8 +2022,7 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
     ret_arr[i] = OneByteString(env->isolate(), sig_with_md);
   }
 
-  args.GetReturnValue().Set(
-                 Array::New(env->isolate(), ret_arr.out(), ret_arr.length()));
+  args.GetReturnValue().Set(ret_arr.ToArray());
 }
 
 void TLSWrap::ExportKeyingMaterial(const FunctionCallbackInfo<Value>& args) {
diff --git a/src/js_stream.cc b/src/js_stream.cc
index 0d6d6a7ac80a..3a3a1c943d25 100644
--- a/src/js_stream.cc
+++ b/src/js_stream.cc
@@ -11,7 +11,6 @@ namespace node {
 
 using errors::TryCatchScope;
 
-using v8::Array;
 using v8::Context;
 using v8::FunctionCallbackInfo;
 using v8::FunctionTemplate;
@@ -119,17 +118,14 @@ int JSStream::DoWrite(WriteWrap* w,
 
   int value_int = UV_EPROTO;
 
-  MaybeStackBuffer<Local<Value>, 16> bufs_arr(count);
+  MaybeStackBuffer<Value, 16> bufs_arr(env()->isolate(), count);
   for (size_t i = 0; i < count; i++) {
     if (!Buffer::Copy(env(), bufs[i].base, bufs[i].len).ToLocal(&bufs_arr[i])) {
       return value_int;
     }
   }
 
-  Local<Value> argv[] = {
-    w->object(),
-    Array::New(env()->isolate(), bufs_arr.out(), count)
-  };
+  Local<Value> argv[] = {w->object(), bufs_arr.ToArray()};
 
   TryCatchScope try_catch(env());
   Local<Value> value;
diff --git a/src/js_udp_wrap.cc b/src/js_udp_wrap.cc
index 1648d162b8f7..83b91042023f 100644
--- a/src/js_udp_wrap.cc
+++ b/src/js_udp_wrap.cc
@@ -11,7 +11,6 @@
 namespace node {
 
 using errors::TryCatchScope;
-using v8::Array;
 using v8::Context;
 using v8::FunctionCallbackInfo;
 using v8::FunctionTemplate;
@@ -98,7 +97,7 @@ ssize_t JSUDPWrap::Send(uv_buf_t* bufs,
   int64_t value_int = JS_EXCEPTION_PENDING;
   size_t total_len = 0;
 
-  MaybeStackBuffer<Local<Value>, 16> buffers(nbufs);
+  MaybeStackBuffer<Value, 16> buffers(env()->isolate(), nbufs);
   for (size_t i = 0; i < nbufs; i++) {
     if (!Buffer::Copy(env(), bufs[i].base, bufs[i].len).ToLocal(&buffers[i])) {
       return value_int;
@@ -110,9 +109,9 @@ ssize_t JSUDPWrap::Send(uv_buf_t* bufs,
   if (!AddressToJS(env(), addr).ToLocal(&address)) return value_int;
 
   Local<Value> args[] = {
-    listener()->CreateSendWrap(total_len)->object(),
-    Array::New(env()->isolate(), buffers.out(), nbufs),
-    address,
+      listener()->CreateSendWrap(total_len)->object(),
+      buffers.ToArray(),
+      address,
   };
 
   if (!MakeCallback(env()->onwrite_string(), arraysize(args), args)
diff --git a/src/node_concepts.h b/src/node_concepts.h
index 5dbce5c6f88a..3109e2ab83f8 100644
--- a/src/node_concepts.h
+++ b/src/node_concepts.h
@@ -3,6 +3,7 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
+#include <v8.h>
 #include <concepts>
 #include <limits>
 #include <type_traits>
@@ -32,6 +33,12 @@ concept StandardCharType =
 template <typename T>
 concept IsCallable = std::is_function<T>::value || requires { &T::operator(); };
 
+// Types that can reside on V8's managed heap (v8::Value, v8::Object, etc.).
+// Used to select the MaybeStackBuffer specialization that holds handles in a
+// v8::LocalVector instead of malloc'd memory.
+template <typename T>
+concept V8Type = std::is_base_of_v<v8::Data, T>;
+
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/node_dir.cc b/src/node_dir.cc
index 952161d9e2cf..eca5140b6423 100644
--- a/src/node_dir.cc
+++ b/src/node_dir.cc
@@ -206,7 +206,7 @@ static MaybeLocal<Array> DirentListToArray(Environment* env,
                                            uv_dirent_t* ents,
                                            int num,
                                            enum encoding encoding) {
-  MaybeStackBuffer<Local<Value>, 64> entries(num * 2);
+  MaybeStackBuffer<Value, 64> entries(env->isolate(), num * 2);
 
   // Return an array of all read filenames.
   int j = 0;
@@ -222,7 +222,8 @@ static MaybeLocal<Array> DirentListToArray(Environment* env,
     entries[j++] = Integer::New(env->isolate(), ents[i].type);
   }
 
-  return Array::New(env->isolate(), entries.out(), j);
+  CHECK_EQ(j, num * 2);
+  return entries.ToArray();
 }
 
 static void AfterDirRead(uv_fs_t* req) {
diff --git a/src/node_env_var.cc b/src/node_env_var.cc
index e94180cd659d..25e405be86d2 100644
--- a/src/node_env_var.cc
+++ b/src/node_env_var.cc
@@ -201,7 +201,7 @@ MaybeLocal<Array> RealEnvStore::Enumerate(Isolate* isolate) const {
   auto cleanup = OnScopeLeave([&]() { uv_os_free_environ(items, count); });
   CHECK_EQ(uv_os_environ(&items, &count), 0);
 
-  MaybeStackBuffer<Local<Value>, 256> env_v(count);
+  MaybeStackBuffer<Value, 256> env_v(isolate, count);
   int env_v_index = 0;
   for (int i = 0; i < count; i++) {
 #ifdef _WIN32
@@ -216,7 +216,10 @@ MaybeLocal<Array> RealEnvStore::Enumerate(Isolate* isolate) const {
     env_v[env_v_index++] = str;
   }
 
-  return Array::New(isolate, env_v.out(), env_v_index);
+  // We're possibly not filling the entire buffer.
+  CHECK_LE(env_v_index, count);
+  env_v.SetLength(env_v_index);
+  return env_v.ToArray();
 }
 
 std::shared_ptr<KVStore> KVStore::Clone(Isolate* isolate) const {
diff --git a/src/node_http2.cc b/src/node_http2.cc
index 9af2f075d2ca..bbb088943b01 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -1585,8 +1585,8 @@ void Http2Session::HandleHeadersFrame(const nghttp2_frame* frame) {
   // this way for performance reasons (it's faster to generate and pass an
   // array than it is to generate and pass the object).
 
-  MaybeStackBuffer<Local<Value>, 64> headers_v(stream->headers_count() * 2);
-  MaybeStackBuffer<Local<Value>, 32> sensitive_v(stream->headers_count());
+  MaybeStackBuffer<Value, 64> headers_v(isolate, stream->headers_count() * 2);
+  MaybeStackBuffer<Value, 32> sensitive_v(isolate, stream->headers_count());
   size_t sensitive_count = 0;
 
   stream->TransferHeaders([&](const Http2Header& header, size_t i) {
@@ -1603,13 +1603,14 @@ void Http2Session::HandleHeadersFrame(const nghttp2_frame* frame) {
   stream->retained_headers_length_ += stream->current_headers_length_;
   stream->current_headers_length_ = 0;
 
+  sensitive_v.SetLength(sensitive_count);
   Local<Value> args[] = {
-    stream->object(),
-    Integer::New(isolate, id),
-    Integer::New(isolate, stream->headers_category()),
-    Integer::New(isolate, frame->hd.flags),
-    Array::New(isolate, headers_v.out(), headers_v.length()),
-    Array::New(isolate, sensitive_v.out(), sensitive_count),
+      stream->object(),
+      Integer::New(isolate, id),
+      Integer::New(isolate, stream->headers_category()),
+      Integer::New(isolate, frame->hd.flags),
+      headers_v.ToArray(),
+      sensitive_v.ToArray(),
   };
   MakeCallback(env()->http2session_on_headers_function(),
                arraysize(args), args);
diff --git a/src/node_messaging.cc b/src/node_messaging.cc
index f00ab803fef0..5a0c4962d3f7 100644
--- a/src/node_messaging.cc
+++ b/src/node_messaging.cc
@@ -1093,7 +1093,7 @@ void MessagePort::PostMessage(const FunctionCallbackInfo<Value>& args) {
                                        "MessagePort.postMessage");
   }
 
-  TransferList transfer_list;
+  TransferList transfer_list(env->isolate());
   if (!GetTransferList(env, context, args[1], &transfer_list)) {
     return;
   }
@@ -1607,7 +1607,7 @@ static void StructuredClone(const FunctionCallbackInfo<Value>& args) {
 
   Local<Value> value = args[0];
 
-  TransferList transfer_list;
+  TransferList transfer_list(isolate);
   Local<Object> options = args[1].As<Object>();
   Local<Value> transfer_list_v;
   if (!options->Get(context, env->transfer_string())
diff --git a/src/node_messaging.h b/src/node_messaging.h
index 3a838a39200a..0abd7da3bf02 100644
--- a/src/node_messaging.h
+++ b/src/node_messaging.h
@@ -17,7 +17,7 @@ namespace worker {
 class MessagePortData;
 class MessagePort;
 
-typedef MaybeStackBuffer<v8::Local<v8::Value>, 8> TransferList;
+typedef MaybeStackBuffer<v8::Value, 8> TransferList;
 
 // Used to represent the in-flight structure of an object that is being
 // transferred or cloned using postMessage().
diff --git a/src/node_v8.cc b/src/node_v8.cc
index 34e8460790b7..14ee626c9f3e 100644
--- a/src/node_v8.cc
+++ b/src/node_v8.cc
@@ -745,17 +745,17 @@ void Initialize(Local<Object> target,
   // Heap space names are extracted once and exposed to JavaScript to
   // avoid excessive creation of heap space name Strings.
   HeapSpaceStatistics s;
-  MaybeStackBuffer<Local<Value>, 16> heap_spaces(number_of_heap_spaces);
+  MaybeStackBuffer<Value, 16> heap_spaces(env->isolate(),
+                                          number_of_heap_spaces);
   for (size_t i = 0; i < number_of_heap_spaces; i++) {
     env->isolate()->GetHeapSpaceStatistics(&s, i);
     heap_spaces[i] = String::NewFromUtf8(env->isolate(), s.space_name())
                                              .ToLocalChecked();
   }
   target
-      ->Set(
-          context,
-          FIXED_ONE_BYTE_STRING(env->isolate(), "kHeapSpaces"),
-          Array::New(env->isolate(), heap_spaces.out(), number_of_heap_spaces))
+      ->Set(context,
+            FIXED_ONE_BYTE_STRING(env->isolate(), "kHeapSpaces"),
+            heap_spaces.ToArray())
       .Check();
 
   SetMethod(context,
diff --git a/src/spawn_sync.cc b/src/spawn_sync.cc
index 2da2e18950ad..0358bb995fee 100644
--- a/src/spawn_sync.cc
+++ b/src/spawn_sync.cc
@@ -767,7 +767,7 @@ MaybeLocal<Array> SyncProcessRunner::BuildOutputArray() {
   CHECK(!stdio_pipes_.empty());
 
   EscapableHandleScope scope(env()->isolate());
-  MaybeStackBuffer<Local<Value>, 8> js_output(stdio_pipes_.size());
+  MaybeStackBuffer<Value, 8> js_output(env()->isolate(), stdio_pipes_.size());
 
   for (uint32_t i = 0; i < stdio_pipes_.size(); i++) {
     SyncProcessStdioPipe* h = stdio_pipes_[i].get();
@@ -781,8 +781,7 @@ MaybeLocal<Array> SyncProcessRunner::BuildOutputArray() {
     }
   }
 
-  return scope.Escape(
-      Array::New(env()->isolate(), js_output.out(), js_output.length()));
+  return scope.Escape(js_output.ToArray());
 }
 
 Maybe<int> SyncProcessRunner::ParseOptions(Local<Value> js_value) {
diff --git a/src/util-inl.h b/src/util-inl.h
index 0a5a90def488..7eb5ebabbfea 100644
--- a/src/util-inl.h
+++ b/src/util-inl.h
@@ -394,14 +394,13 @@ v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
   if (isolate == nullptr) isolate = v8::Isolate::GetCurrent();
   v8::EscapableHandleScope handle_scope(isolate);
 
-  MaybeStackBuffer<v8::Local<v8::Value>, 128> arr(vec.size());
-  arr.SetLength(vec.size());
+  MaybeStackBuffer<v8::Value, 128> arr(isolate, vec.size());
   for (size_t i = 0; i < vec.size(); ++i) {
     if (!ToV8Value(context, vec[i], isolate).ToLocal(&arr[i]))
       return v8::MaybeLocal<v8::Value>();
   }
 
-  return handle_scope.Escape(v8::Array::New(isolate, arr.out(), arr.length()));
+  return handle_scope.Escape(arr.ToArray());
 }
 
 template <typename T>
@@ -430,8 +429,7 @@ v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
   if (isolate == nullptr) isolate = v8::Isolate::GetCurrent();
   v8::EscapableHandleScope handle_scope(isolate);
 
-  MaybeStackBuffer<v8::Local<v8::Value>, 128> arr(vec.size());
-  arr.SetLength(vec.size());
+  MaybeStackBuffer<v8::Value, 128> arr(isolate, vec.size());
   auto it = vec.begin();
   for (size_t i = 0; i < vec.size(); ++i) {
     if (!ToV8Value(context, *it, isolate).ToLocal(&arr[i]))
@@ -439,7 +437,7 @@ v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
     std::advance(it, 1);
   }
 
-  return handle_scope.Escape(v8::Array::New(isolate, arr.out(), arr.length()));
+  return handle_scope.Escape(arr.ToArray());
 }
 
 template <typename T, typename U>
@@ -519,7 +517,14 @@ v8::Local<v8::Array> ToV8ValuePrimitiveArray(v8::Local<v8::Context> context,
 }
 
 SlicedArguments::SlicedArguments(
-    const v8::FunctionCallbackInfo<v8::Value>& args, size_t start) {
+    const v8::FunctionCallbackInfo<v8::Value>& args, size_t start)
+    : SlicedArguments(args.GetIsolate(), args, start) {}
+
+SlicedArguments::SlicedArguments(
+    v8::Isolate* isolate,
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    size_t start)
+    : MaybeStackBuffer<v8::Value>(isolate) {
   const size_t length = static_cast<size_t>(args.Length());
   if (start >= length) return;
   const size_t size = length - start;
@@ -545,6 +550,27 @@ void MaybeStackBuffer<T, kStackStorageSize>::AllocateSufficientStorage(
   length_ = storage;
 }
 
+template <V8Type T, size_t kStackStorageSize>
+void MaybeStackBuffer<T, kStackStorageSize>::AllocateSufficientStorage(
+    size_t storage) {
+  CHECK(!IsInvalidated());
+  if (storage > capacity()) {
+    if (!local_vector_.has_value()) {
+      local_vector_.emplace(isolate_, storage);
+      // Copy existing stack data into the LocalVector.
+      for (size_t i = 0; i < length_; i++) {
+        (*local_vector_)[i] = buf_st_[i];
+      }
+    } else {
+      local_vector_->resize(storage);
+    }
+    buf_ = local_vector_->data();
+    capacity_ = storage;
+  }
+
+  length_ = storage;
+}
+
 template <typename T, size_t S>
   requires(sizeof(T) == 1)
 ArrayBufferViewContents<T, S>::ArrayBufferViewContents(
diff --git a/src/util.h b/src/util.h
index 0461a5ebb19f..621d2fbf4ee6 100644
--- a/src/util.h
+++ b/src/util.h
@@ -526,6 +526,85 @@ class MaybeStackBuffer {
   T buf_st_[kStackStorageSize];
 };
 
+template <V8Type T, size_t kStackStorageSize>
+class MaybeStackBuffer<T, kStackStorageSize> {
+ public:
+  using V = v8::Local<T>;
+
+  MaybeStackBuffer(const MaybeStackBuffer&) = delete;
+  MaybeStackBuffer& operator=(const MaybeStackBuffer& other) = delete;
+
+  const V* out() const { return buf_; }
+  V* out() { return buf_; }
+
+  // operator* for compatibility with `v8::String::(Utf8)Value`
+  V* operator*() { return buf_; }
+  const V* operator*() const { return buf_; }
+
+  V& operator[](size_t index) {
+    CHECK_LT(index, length());
+    return buf_[index];
+  }
+
+  const V& operator[](size_t index) const {
+    CHECK_LT(index, length());
+    return buf_[index];
+  }
+
+  size_t length() const { return length_; }
+
+  // Current maximum capacity of the buffer with which SetLength() can be used
+  // without first calling AllocateSufficientStorage().
+  size_t capacity() const { return capacity_; }
+
+  // Make sure enough space for `storage` entries is available.
+  // This method can be called multiple times throughout the lifetime of the
+  // buffer, but once this has been called Invalidate() cannot be used.
+  // Content of the buffer in the range [0, length()) is preserved.
+  void AllocateSufficientStorage(size_t storage);
+
+  void SetLength(size_t length) {
+    // capacity() returns how much memory is actually available.
+    CHECK_LE(length, capacity());
+    length_ = length;
+  }
+
+  // If the buffer is stored in a LocalVector rather than on the stack.
+  bool IsAllocated() const { return !IsInvalidated() && buf_ != buf_st_; }
+
+  // If Invalidate() has been called.
+  bool IsInvalidated() const { return buf_ == nullptr; }
+
+  explicit MaybeStackBuffer(v8::Isolate* isolate)
+      : isolate_(isolate),
+        length_(0),
+        capacity_(arraysize(buf_st_)),
+        buf_(buf_st_) {
+    // Default to a zero-length, null-terminated buffer.
+    buf_[0] = V();
+  }
+
+  MaybeStackBuffer(v8::Isolate* isolate, size_t storage)
+      : MaybeStackBuffer(isolate) {
+    AllocateSufficientStorage(storage);
+  }
+
+  // LocalVector (via optional) handles cleanup automatically.
+  ~MaybeStackBuffer() = default;
+
+  v8::Local<v8::Array> ToArray() const {
+    return v8::Array::New(isolate_, buf_, length_);
+  }
+
+ private:
+  v8::Isolate* isolate_;
+  size_t length_;
+  size_t capacity_;
+  V* buf_;
+  V buf_st_[kStackStorageSize];
+  std::optional<v8::LocalVector<T>> local_vector_;
+};
+
 // Provides access to an ArrayBufferView's storage, either the original,
 // or for small data, a copy of it. This object's lifetime is bound to the
 // original ArrayBufferView's lifetime.
@@ -782,10 +861,13 @@ constexpr inline bool IsBigEndian() {
 static_assert(IsLittleEndian() || IsBigEndian(),
               "Node.js does not support mixed-endian systems");
 
-class SlicedArguments : public MaybeStackBuffer<v8::Local<v8::Value>> {
+class SlicedArguments : public MaybeStackBuffer<v8::Value> {
  public:
   inline explicit SlicedArguments(
       const v8::FunctionCallbackInfo<v8::Value>& args, size_t start = 0);
+  inline SlicedArguments(v8::Isolate* isolate,
+                         const v8::FunctionCallbackInfo<v8::Value>& args,
+                         size_t start = 0);
 };
 
 // Convert a v8::PersistentBase, e.g. v8::Global, to a Local, with an extra

From 6c3516f17970248ea19078026426970e85ced511 Mon Sep 17 00:00:00 2001
From: Shani Singh <teamdeveloperworld@gmail.com>
Date: Tue, 18 Aug 2026 00:31:56 +0530
Subject: [PATCH 214/344] http: fix keylog listener setup on existing agent
 sockets

`maybeEnableKeylog()` runs as the agent's `'newListener'` handler and
attaches the agent's keylog handler to the sockets the agent already
owns. `agent.sockets` maps a name to an array of sockets, but the loop
treated those arrays as sockets and called `.on()` on them.

Adding a `'keylog'` listener to an agent that already owned a socket
therefore threw `TypeError: sockets[i].on is not a function` out of
`agent.on('keylog', ...)`. Since the throw happened inside the
`'newListener'` handler it propagated before the listener was stored,
so the caller got an exception and no listener. Sockets parked in
`agent.freeSockets` were never visited at all.

Walk both maps the way `Agent.prototype.destroy()` does.

Signed-off-by: Shani Singh <teamdeveloperworld@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65066
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 lib/_http_agent.js                            | 15 ++--
 ...test-http-agent-keylog-existing-sockets.js | 71 +++++++++++++++++++
 2 files changed, 82 insertions(+), 4 deletions(-)
 create mode 100644 test/parallel/test-http-agent-keylog-existing-sockets.js

diff --git a/lib/_http_agent.js b/lib/_http_agent.js
index 9e3129100f90..b8e5ff45f7dd 100644
--- a/lib/_http_agent.js
+++ b/lib/_http_agent.js
@@ -278,10 +278,17 @@ function maybeEnableKeylog(eventName) {
     this[kOnKeylog] = function onkeylog(keylog) {
       agent.emit('keylog', keylog, this);
     };
-    // Existing sockets will start listening on keylog now.
-    const sockets = ObjectValues(this.sockets);
-    for (let i = 0; i < sockets.length; i++) {
-      sockets[i].on('keylog', this[kOnKeylog]);
+    // Existing sockets will start listening on keylog now. Both maps hold
+    // arrays of sockets keyed by name, so each bucket has to be walked.
+    const sets = [this.freeSockets, this.sockets];
+    for (let s = 0; s < sets.length; s++) {
+      const buckets = ObjectValues(sets[s]);
+      for (let b = 0; b < buckets.length; b++) {
+        const sockets = buckets[b];
+        for (let n = 0; n < sockets.length; n++) {
+          sockets[n].on('keylog', this[kOnKeylog]);
+        }
+      }
     }
   }
 }
diff --git a/test/parallel/test-http-agent-keylog-existing-sockets.js b/test/parallel/test-http-agent-keylog-existing-sockets.js
new file mode 100644
index 000000000000..1a391c09b8be
--- /dev/null
+++ b/test/parallel/test-http-agent-keylog-existing-sockets.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+
+// Adding a 'keylog' listener to an agent is wired up by maybeEnableKeylog(),
+// which attaches the agent's keylog handler to the sockets the agent already
+// owns. `agent.sockets` and `agent.freeSockets` map a name to an *array* of
+// sockets, so each bucket has to be walked. Treating the buckets themselves as
+// sockets threw a TypeError out of `agent.on('keylog', ...)`, which also meant
+// the listener was never registered.
+
+// Two servers so the two sockets get different names, which keeps one parked
+// in freeSockets instead of being reused by the second request.
+const idleServer = http.createServer((req, res) => res.end('idle'));
+const busyServer = http.createServer((req, res) => {
+  setTimeout(() => res.end('busy'), common.platformTimeout(200));
+});
+
+function countSockets(agent) {
+  let free = 0;
+  let active = 0;
+  for (const bucket of Object.values(agent.freeSockets)) free += bucket.length;
+  for (const bucket of Object.values(agent.sockets)) active += bucket.length;
+  return { free, active };
+}
+
+idleServer.listen(0, common.mustCall(() => {
+  busyServer.listen(0, common.mustCall(() => {
+    const agent = new http.Agent({ keepAlive: true, maxSockets: 4 });
+
+    // First request finishes, so its socket is released into freeSockets.
+    http.get({ port: idleServer.address().port, agent }, common.mustCall((res) => {
+      res.resume();
+      res.on('end', common.mustCall(() => {
+        // Second request is still in flight, so its socket is in sockets.
+        const req = http.get({ port: busyServer.address().port, agent },
+                             common.mustCall((res2) => {
+                               res2.resume();
+                               res2.on('end', common.mustCall(() => {
+                                 agent.destroy();
+                                 idleServer.close();
+                                 busyServer.close();
+                               }));
+                             }));
+
+        req.on('socket', common.mustCall(() => {
+          setImmediate(common.mustCall(() => {
+            const { free, active } = countSockets(agent);
+            assert.strictEqual(free, 1);
+            assert.strictEqual(active, 1);
+
+            // Used to throw `TypeError: sockets[i].on is not a function`.
+            agent.on('keylog', common.mustNotCall());
+            assert.strictEqual(agent.listenerCount('keylog'), 1);
+
+            // Every existing socket, idle or in use, is now listening.
+            for (const set of [agent.freeSockets, agent.sockets]) {
+              for (const bucket of Object.values(set)) {
+                for (const socket of bucket) {
+                  assert.strictEqual(socket.listenerCount('keylog'), 1);
+                }
+              }
+            }
+          }));
+        }));
+      }));
+    }));
+  }));
+}));

From 8873b91fce8d53e699639aab4bd686309875d14d Mon Sep 17 00:00:00 2001
From: Y1D7NG <y1d7ng@yeah.net>
Date: Tue, 18 Aug 2026 05:03:39 +0800
Subject: [PATCH 215/344] fs: fix close listener leak in FileHandle streams

Fixes: https://github.com/nodejs/node/issues/64214
Signed-off-by: y1d7ng <y1d7ng@yeah.net>
PR-URL: https://github.com/nodejs/node/pull/64227
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
---
 lib/internal/fs/streams.js                    | 14 ++++++-
 .../test-fs-promises-file-handle-stream.js    | 39 +++++++++++++++++++
 2 files changed, 52 insertions(+), 1 deletion(-)

diff --git a/lib/internal/fs/streams.js b/lib/internal/fs/streams.js
index 4c53f7ea23e1..882aa8e71fc9 100644
--- a/lib/internal/fs/streams.js
+++ b/lib/internal/fs/streams.js
@@ -158,7 +158,19 @@ function importFd(stream, options) {
     stream[kHandle] = options.fd;
     stream[kFs] = FileHandleOperations(stream[kHandle]);
     stream[kHandle][kRef]();
-    options.fd.on('close', FunctionPrototypeBind(stream.close, stream));
+
+    const onclose = FunctionPrototypeBind(stream.close, stream);
+    options.fd.on('close', onclose);
+    if (options.autoClose === false) {
+      function cleanup() {
+        options.fd.removeListener('close', onclose);
+        options.fd[kUnref]();
+      }
+      stream.once('end', cleanup);
+      stream.once('finish', cleanup);
+      stream.once('error', cleanup);
+    }
+
     return options.fd.fd;
   }
 
diff --git a/test/parallel/test-fs-promises-file-handle-stream.js b/test/parallel/test-fs-promises-file-handle-stream.js
index 71f312b6f9d7..61d0b3ca2ec7 100644
--- a/test/parallel/test-fs-promises-file-handle-stream.js
+++ b/test/parallel/test-fs-promises-file-handle-stream.js
@@ -42,7 +42,46 @@ async function validateRead() {
   );
 }
 
+async function validateReusedCreateReadStream() {
+  const filePath = path.resolve(tmpDir, 'tmp-reused-stream.txt');
+  fs.writeFileSync(filePath, Buffer.from('ab', 'utf8'));
+
+  const fileHandle = await open(filePath, 'r');
+  try {
+    await buffer(fileHandle.createReadStream({
+      start: 0,
+      end: 0,
+      autoClose: false,
+    }));
+    assert.strictEqual(fileHandle.listenerCount('close'), 0);
+
+    await buffer(fileHandle.createReadStream({
+      start: 1,
+      end: 1,
+      autoClose: false,
+    }));
+    assert.strictEqual(fileHandle.listenerCount('close'), 0);
+  } finally {
+    await fileHandle.close();
+  }
+}
+
+async function validateReusedCreateWriteStream() {
+  const filePath = path.resolve(tmpDir, 'tmp-reused-write-stream.txt');
+  const fileHandle = await open(filePath, 'w');
+  try {
+    const stream = fileHandle.createWriteStream({ autoClose: false });
+    stream.end('a');
+    await finished(stream);
+    assert.strictEqual(fileHandle.listenerCount('close'), 0);
+  } finally {
+    await fileHandle.close();
+  }
+}
+
 Promise.all([
   validateWrite(),
   validateRead(),
+  validateReusedCreateReadStream(),
+  validateReusedCreateWriteStream(),
 ]).then(common.mustCall());

From 3da555a3ede551b4704284f4db2680d0ffd2552e Mon Sep 17 00:00:00 2001
From: ulofiai <ulofi@protonmail.com>
Date: Tue, 18 Aug 2026 05:45:03 +0800
Subject: [PATCH 216/344] build: pass target architecture to small-icu genccode

Signed-off-by: ulofiai <monsterking@tutamail.com>
PR-URL: https://github.com/nodejs/node/pull/65095
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 tools/icu/icu-generic.gyp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/icu/icu-generic.gyp b/tools/icu/icu-generic.gyp
index f49b4ddba74a..c4e8c6fbb9f8 100644
--- a/tools/icu/icu-generic.gyp
+++ b/tools/icu/icu-generic.gyp
@@ -208,6 +208,7 @@
                   'outputs': [ '<(SHARED_INTERMEDIATE_DIR)/icudt<(icu_ver_major)<(icu_endianness)_dat.<(icu_asm_ext)' ],
                   'action': [ '<(PRODUCT_DIR)/genccode<(EXECUTABLE_SUFFIX)',
                               '<@(icu_asm_opts)', # -o
+                              '-c', '<(target_arch)',
                               '-d', '<(SHARED_INTERMEDIATE_DIR)/',
                               '-n', 'icudata',
                               '-e', 'icusmdt<(icu_ver_major)',

From 24a76e18ecce18177f1a619297de47a41743d016 Mon Sep 17 00:00:00 2001
From: "Kamat, Trivikram" <16024985+trivikr@users.noreply.github.com>
Date: Fri, 24 Jul 2026 21:54:05 -0700
Subject: [PATCH 217/344] test: avoid timer race in event loop delay test

An expired timer can run before the first complete event loop
iteration, disabling the histogram before it records any samples.

Drive a known number of iterations with setImmediate before checking
the histograms, and share the chain between resolution variants.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/64728
Refs: https://github.com/nodejs/reliability/issues?q=sort%3Aupdated-desc%20test-performance-eventloopdelay
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 .../test-performance-eventloopdelay.js        | 85 +++++++++----------
 1 file changed, 38 insertions(+), 47 deletions(-)

diff --git a/test/sequential/test-performance-eventloopdelay.js b/test/sequential/test-performance-eventloopdelay.js
index ddd33372ec5e..ede729514937 100644
--- a/test/sequential/test-performance-eventloopdelay.js
+++ b/test/sequential/test-performance-eventloopdelay.js
@@ -9,6 +9,18 @@ const {
 } = require('perf_hooks');
 const { sleep } = require('internal/util');
 
+function runEventLoopIterations(iterations, callback) {
+  let remaining = iterations;
+  function tick() {
+    if (--remaining > 0) {
+      setImmediate(tick);
+    } else {
+      callback();
+    }
+  }
+  setImmediate(tick);
+}
+
 {
   const histogram = monitorEventLoopDelay();
   assert(histogram);
@@ -125,12 +137,16 @@ const { sleep } = require('internal/util');
 }
 
 {
+  const iterations = 10;
   const histogram = monitorEventLoopDelay({ samplePerIteration: true });
   histogram.enable();
-  setTimeout(common.mustCall(() => {
+  runEventLoopIterations(iterations, common.mustCall(() => {
     histogram.disable();
-    assert(histogram.count > 0,
-           `Expected samples to be recorded, got count=${histogram.count}`);
+    assert(
+      histogram.count >= iterations - 1,
+      `Expected at least ${iterations - 1} samples for ${iterations} iterations, ` +
+      `got ${histogram.count}`
+    );
     assert(histogram.min > 0);
     assert(histogram.max > 0);
     assert(histogram.mean > 0);
@@ -146,7 +162,7 @@ const { sleep } = require('internal/util');
     assert(Number.isNaN(histogram.mean));
     assert(Number.isNaN(histogram.stddev));
     assert.strictEqual(histogram.percentiles.size, 1);
-  }), common.platformTimeout(20));
+  }));
 }
 
 {
@@ -158,65 +174,40 @@ const { sleep } = require('internal/util');
   assert.strictEqual(histogram.disable(), false); // Already disabled, no-op
   // Re-enabling after disable should work
   assert.strictEqual(histogram.enable(), true);
-  setTimeout(common.mustCall(() => {
+  runEventLoopIterations(10, common.mustCall(() => {
     histogram.disable();
     assert(histogram.count > 0,
            `Expected samples after re-enable, got count=${histogram.count}`);
-  }), common.platformTimeout(20));
+  }));
 }
 
 {
   // Verify that samplePerIteration records exactly one sample per event loop iteration.
-  const N = 10;
+  // It should do so independently of the timer resolution used by the legacy
+  // monitorEventLoopDelay path.
+  const iterations = 10;
   const histogram = monitorEventLoopDelay({ samplePerIteration: true });
-  histogram.enable();
-
-  let iterations = 0;
-  const verify = common.mustCall(() => {
-    histogram.disable();
-    assert(
-      histogram.count >= N - 1,
-      `Expected at least ${N - 1} samples for ${N} iterations, got ${histogram.count}`
-    );
-  });
-
-  function tick() {
-    if (++iterations < N) {
-      setImmediate(tick);
-    } else {
-      verify();
-    }
-  }
-  setImmediate(tick);
-}
-
-{
-  // samplePerIteration should sample per event loop iteration, independent of
-  // the timer resolution used by the legacy monitorEventLoopDelay path.
-  const N = 10;
-  const histogram = monitorEventLoopDelay({
+  const largeResolutionHistogram = monitorEventLoopDelay({
     samplePerIteration: true,
     resolution: 60 * 1000,
   });
   histogram.enable();
+  largeResolutionHistogram.enable();
 
-  let iterations = 0;
-  const verify = common.mustCall(() => {
+  runEventLoopIterations(iterations, common.mustCall(() => {
     histogram.disable();
+    largeResolutionHistogram.disable();
     assert(
-      histogram.count >= N - 1,
-      `Expected samples despite large resolution, got count=${histogram.count}`
+      histogram.count >= iterations - 1,
+      `Expected at least ${iterations - 1} samples for ${iterations} iterations, ` +
+      `got ${histogram.count}`
     );
-  });
-
-  function tick() {
-    if (++iterations < N) {
-      setImmediate(tick);
-    } else {
-      verify();
-    }
-  }
-  setImmediate(tick);
+    assert(
+      largeResolutionHistogram.count >= iterations - 1,
+      `Expected samples despite large resolution, ` +
+      `got count=${largeResolutionHistogram.count}`
+    );
+  }));
 }
 
 // Make sure that the histogram instances can be garbage-collected without

From a39ad67482fb2ab4ffeb4753d2a5b2bd6da2823d Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 17 Aug 2026 20:33:43 -0400
Subject: [PATCH 218/344] deps: update googletest to
 49495eacfdbda3f4b6ba219923fedbb2e3f99376

PR-URL: https://github.com/nodejs/node/pull/65317
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
---
 .../googletest/include/gtest/gtest-printers.h | 11 +--
 .../include/gtest/internal/gtest-port.h       | 75 +++++++++++++++----
 deps/googletest/src/gtest-printers.cc         | 25 ++++++-
 3 files changed, 90 insertions(+), 21 deletions(-)

diff --git a/deps/googletest/include/gtest/gtest-printers.h b/deps/googletest/include/gtest/gtest-printers.h
index 315ce0a51016..69c9fec3ca95 100644
--- a/deps/googletest/include/gtest/gtest-printers.h
+++ b/deps/googletest/include/gtest/gtest-printers.h
@@ -1173,15 +1173,12 @@ class [[nodiscard]] UniversalTersePrinter<const wchar_t*> {
     }
   }
 };
-#endif
 
 template <>
-class [[nodiscard]] UniversalTersePrinter<wchar_t*> {
- public:
-  static void Print(wchar_t* str, ::std::ostream* os) {
-    UniversalTersePrinter<const wchar_t*>::Print(str, os);
-  }
-};
+class [[nodiscard]] UniversalTersePrinter<wchar_t*>
+    : public UniversalTersePrinter<const wchar_t*> {};
+
+#endif  // GTEST_HAS_STD_WSTRING
 
 template <typename T>
 void UniversalTersePrint(const T& value, ::std::ostream* os) {
diff --git a/deps/googletest/include/gtest/internal/gtest-port.h b/deps/googletest/include/gtest/internal/gtest-port.h
index 92e6591d2cec..051228553449 100644
--- a/deps/googletest/include/gtest/internal/gtest-port.h
+++ b/deps/googletest/include/gtest/internal/gtest-port.h
@@ -500,22 +500,71 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #endif  // defined(_MSC_VER) || defined(__BORLANDC__)
 #endif  // GTEST_HAS_EXCEPTIONS
 
-#ifndef GTEST_HAS_STD_WSTRING
-// The user didn't tell us whether ::std::wstring is available, so we need
-// to figure it out.
+// 1. Calculate default GTEST_HAS_STD_WSTRING values based on STL capabilities.
+#if defined(_MSVC_STL_VERSION)
+// Microsoft's STL implementation always supports ::std::wstring.
+#define GTEST_HAS_STD_WSTRING_DEFAULT 1
+
+#elif defined(_LIBCPP_VERSION)
+// Modern libc++ always defines _LIBCPP_HAS_WIDE_CHARACTERS; its value
+// determines whether wide characters are supported.
+// Older libc++ omits a definition for _LIBCPP_HAS_NO_WIDE_CHARACTERS when wide
+// characters are supported.
+#if (defined(_LIBCPP_HAS_WIDE_CHARACTERS) && !_LIBCPP_HAS_WIDE_CHARACTERS) || \
+    defined(_LIBCPP_HAS_NO_WIDE_CHARACTERS)
+#define GTEST_HAS_STD_WSTRING_DEFAULT 0
+#else
+#define GTEST_HAS_STD_WSTRING_DEFAULT 1
+#endif
+
+#elif defined(__GLIBCXX__)
+#if defined(_GLIBCXX_USE_WCHAR_T) && _GLIBCXX_USE_WCHAR_T
+#define GTEST_HAS_STD_WSTRING_DEFAULT 1
+#else
+#define GTEST_HAS_STD_WSTRING_DEFAULT 0
+#endif
+
+#else
+// Unknown standard library implementation; fall back looking at the OS.
+//
+// Always let the user override the defaults in this case; they might have more
+// information about what's supported than we do.
+#if defined(GTEST_OS_LINUX_ANDROID)
+// Android started supporting std::wstring with API Level 21 (Lollipop).
+#define GTEST_HAS_STD_WSTRING_DEFAULT (__ANDROID_API__ >= 21)
+// The following platforms are known not to support ::std::wstring; assume it's
+// supported on all others.
+//
 // Cygwin 1.7 and below doesn't support ::std::wstring.
-// Solaris' libc++ doesn't support it either.  Android has
-// no support for it at least as recent as Froyo (2.2).
-#if (!(defined(GTEST_OS_LINUX_ANDROID) || defined(GTEST_OS_CYGWIN) || \
-       defined(GTEST_OS_SOLARIS) || defined(GTEST_OS_HAIKU) ||        \
-       defined(GTEST_OS_ESP32) || defined(GTEST_OS_ESP8266) ||        \
-       defined(GTEST_OS_XTENSA) || defined(GTEST_OS_QURT) ||          \
-       defined(GTEST_OS_NXP_QN9090) || defined(GTEST_OS_NRF52)))
-#define GTEST_HAS_STD_WSTRING 1
+// Solaris' libc++ doesn't support it either.
+#elif defined(GTEST_OS_CYGWIN) || defined(GTEST_OS_SOLARIS) || \
+    defined(GTEST_OS_HAIKU) || defined(GTEST_OS_ESP32) ||      \
+    defined(GTEST_OS_ESP8266) || defined(GTEST_OS_XTENSA) ||   \
+    defined(GTEST_OS_QURT) || defined(GTEST_OS_NXP_QN9090) ||  \
+    defined(GTEST_OS_NRF52)
+#define GTEST_HAS_STD_WSTRING_DEFAULT 0
 #else
-#define GTEST_HAS_STD_WSTRING 0
+#define GTEST_HAS_STD_WSTRING_DEFAULT 1
+#endif
+#endif
+
+// 2. Validate explicit user overrides (if user passed -DGTEST_HAS_*=1) against
+//    what the standard library implementation tells us it supports.
+#if defined(GTEST_HAS_STD_WSTRING) && GTEST_HAS_STD_WSTRING
+#if defined(_LIBCPP_VERSION) &&                                                \
+    ((defined(_LIBCPP_HAS_WIDE_CHARACTERS) && !_LIBCPP_HAS_WIDE_CHARACTERS) || \
+     defined(_LIBCPP_HAS_NO_WIDE_CHARACTERS))
+#error Cannot explicitly enable GTEST_HAS_STD_WSTRING without libc++ wide character support.
+#elif defined(__GLIBCXX__) && \
+    !(defined(_GLIBCXX_USE_WCHAR_T) && _GLIBCXX_USE_WCHAR_T)
+#error Cannot explicitly enable GTEST_HAS_STD_WSTRING without libstdc++ wide character support.
+#endif
+#endif
+
+// 3. Set final values if not explicitly overridden by user
+#if !defined(GTEST_HAS_STD_WSTRING)
+#define GTEST_HAS_STD_WSTRING GTEST_HAS_STD_WSTRING_DEFAULT
 #endif
-#endif  // GTEST_HAS_STD_WSTRING
 
 #ifndef GTEST_HAS_FILE_SYSTEM
 // Most platforms support a file system.
diff --git a/deps/googletest/src/gtest-printers.cc b/deps/googletest/src/gtest-printers.cc
index 7c0ecc6ad1c9..975ebb829876 100644
--- a/deps/googletest/src/gtest-printers.cc
+++ b/deps/googletest/src/gtest-printers.cc
@@ -50,6 +50,7 @@
 #include <iomanip>
 #include <ios>
 #include <ostream>  // NOLINT
+#include <string>
 #include <string_view>
 #include <type_traits>
 
@@ -422,6 +423,28 @@ void UniversalPrintArray(const wchar_t* begin, size_t len, ostream* os) {
 
 namespace {
 
+template <typename Char>
+size_t GetLength(const Char* s) {
+  return std::char_traits<Char>::length(s);
+}
+
+#if !GTEST_HAS_STD_WSTRING
+
+// If GTEST_HAS_STD_WSTRING is unset because the standard library has disabled
+// wide character support, std::char_traits<wchar_t> won't be defined, which
+// will cause a compile error, even if user code never actually could print a
+// wide cstring. In that case, instead use `wcslen` directly.
+//
+// If `libc` _also_ lacks wide character support, this (and a bunch of other
+// calls to wc functions) will fail to link, but only if user code actually
+// uses them.
+template <>
+size_t GetLength<wchar_t>(const wchar_t* s) {
+  return wcslen(s);
+}
+
+#endif  // GTEST_HAS_STD_WSTRING
+
 // Prints a null-terminated C-style string to the ostream.
 template <typename Char>
 void PrintCStringTo(const Char* s, ostream* os) {
@@ -429,7 +452,7 @@ void PrintCStringTo(const Char* s, ostream* os) {
     *os << "NULL";
   } else {
     *os << ImplicitCast_<const void*>(s) << " pointing to ";
-    PrintCharsAsStringTo(s, std::char_traits<Char>::length(s), os);
+    PrintCharsAsStringTo(s, GetLength(s), os);
   }
 }
 

From 0e8af3378a6ceeaa5710e53c3b8138d2bdaf34a4 Mon Sep 17 00:00:00 2001
From: Edy Silva <edigleyssonsilva@gmail.com>
Date: Tue, 18 Aug 2026 03:21:03 -0300
Subject: [PATCH 219/344] sqlite: reuse cached column names in statement all()
 and get()

Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65276
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/node_sqlite.cc | 83 ++++++++++++++++------------------------------
 src/node_sqlite.h  | 14 ++------
 2 files changed, 31 insertions(+), 66 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index d0da887062bd..5a0522ba4240 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3182,10 +3182,11 @@ Maybe<void> ExtractRowValues(Environment* env,
 }
 
 MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
-                                                DatabaseSync* db,
-                                                sqlite3_stmt* stmt,
-                                                bool return_arrays,
-                                                bool use_big_ints) {
+                                                StatementSync* statement) {
+  DatabaseSync* db = statement->db_.get();
+  sqlite3_stmt* stmt = statement->statement_.get();
+  const bool return_arrays = statement->return_arrays_;
+  const bool use_big_ints = statement->use_big_ints_;
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
   int r;
@@ -3211,13 +3212,10 @@ MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
       rows.emplace_back(row_array);
     } else {
       if (row_keys.size() == 0) {
-        row_keys.reserve(num_cols);
-        for (int i = 0; i < num_cols; ++i) {
-          Local<Name> key;
-          if (!ColumnNameToName(env, stmt, i).ToLocal(&key)) {
-            return MaybeLocal<Value>();
-          }
-          row_keys.emplace_back(key);
+        // Reuses the statement's internalized column names instead of
+        // re-interning them on every call.
+        if (!statement->GetCachedColumnNames(&row_keys)) {
+          return MaybeLocal<Value>();
         }
       }
       DCHECK_EQ(row_keys.size(), row_values.size());
@@ -3232,9 +3230,10 @@ MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
 }
 
 MaybeLocal<Object> StatementExecutionHelper::Run(Environment* env,
-                                                 DatabaseSync* db,
-                                                 sqlite3_stmt* stmt,
-                                                 bool use_big_ints) {
+                                                 StatementSync* statement) {
+  DatabaseSync* db = statement->db_.get();
+  sqlite3_stmt* stmt = statement->statement_.get();
+  const bool use_big_ints = statement->use_big_ints_;
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
   // Declared before the reset below so that it outlives it: sqlite3_reset()
@@ -3319,10 +3318,11 @@ BaseObjectPtr<StatementSyncIterator> StatementExecutionHelper::Iterate(
 }
 
 MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
-                                                DatabaseSync* db,
-                                                sqlite3_stmt* stmt,
-                                                bool return_arrays,
-                                                bool use_big_ints) {
+                                                StatementSync* statement) {
+  DatabaseSync* db = statement->db_.get();
+  sqlite3_stmt* stmt = statement->statement_.get();
+  const bool return_arrays = statement->return_arrays_;
+  const bool use_big_ints = statement->use_big_ints_;
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
   // Declared before the reset below so that it outlives it: sqlite3_reset()
@@ -3360,13 +3360,10 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
     result = Array::New(isolate, row_values.data(), row_values.size());
   } else {
     LocalVector<Name> keys(isolate);
-    keys.reserve(num_cols);
-    for (int i = 0; i < num_cols; ++i) {
-      Local<Name> key;
-      if (!ColumnNameToName(env, stmt, i).ToLocal(&key)) {
-        return MaybeLocal<Value>();
-      }
-      keys.emplace_back(key);
+    // Reuses the statement's internalized column names instead of
+    // re-interning them on every call.
+    if (!statement->GetCachedColumnNames(&keys)) {
+      return MaybeLocal<Value>();
     }
 
     DCHECK_EQ(keys.size(), row_values.size());
@@ -3399,12 +3396,7 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
     if (needs_reset) sqlite3_reset(stmt->statement_.get());
   });
   Local<Value> result;
-  if (StatementExecutionHelper::All(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::All(env, stmt).ToLocal(&result)) {
     RESET_AND_CHECK(
         isolate, stmt->db_.get(), stmt->statement_.get(), needs_reset, void());
     args.GetReturnValue().Set(result);
@@ -3452,12 +3444,7 @@ void StatementSync::Get(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Value> result;
-  if (StatementExecutionHelper::Get(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Get(env, stmt).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3478,9 +3465,7 @@ void StatementSync::Run(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Object> result;
-  if (StatementExecutionHelper::Run(
-          env, stmt->db_.get(), stmt->statement_.get(), stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Run(env, stmt).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3821,9 +3806,7 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Object> result;
-  if (StatementExecutionHelper::Run(
-          env, stmt->db_.get(), stmt->statement_.get(), stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Run(env, stmt.get()).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3881,12 +3864,7 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Value> result;
-  if (StatementExecutionHelper::Get(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Get(env, stmt.get()).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3918,12 +3896,7 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
     if (needs_reset) sqlite3_reset(stmt->statement_.get());
   });
   Local<Value> result;
-  if (StatementExecutionHelper::All(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::All(env, stmt.get()).ToLocal(&result)) {
     RESET_AND_CHECK(
         isolate, stmt->db_.get(), stmt->statement_.get(), needs_reset, void());
     args.GetReturnValue().Set(result);
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 475a759e75e8..705cefb1811b 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -178,14 +178,9 @@ using StatementPtr = DeleteFnPtr<sqlite3_stmt, FinalizeStatement>;
 class StatementExecutionHelper {
  public:
   static v8::MaybeLocal<v8::Value> All(Environment* env,
-                                       DatabaseSync* db,
-                                       sqlite3_stmt* stmt,
-                                       bool return_arrays,
-                                       bool use_big_ints);
+                                       StatementSync* statement);
   static v8::MaybeLocal<v8::Object> Run(Environment* env,
-                                        DatabaseSync* db,
-                                        sqlite3_stmt* stmt,
-                                        bool use_big_ints);
+                                        StatementSync* statement);
   static BaseObjectPtr<StatementSyncIterator> Iterate(
       Environment* env, BaseObjectPtr<StatementSync> stmt);
   static v8::MaybeLocal<v8::Value> ColumnToValue(Environment* env,
@@ -196,10 +191,7 @@ class StatementExecutionHelper {
                                                    sqlite3_stmt* stmt,
                                                    const int column);
   static v8::MaybeLocal<v8::Value> Get(Environment* env,
-                                       DatabaseSync* db,
-                                       sqlite3_stmt* stmt,
-                                       bool return_arrays,
-                                       bool use_big_ints);
+                                       StatementSync* statement);
 };
 
 class DatabaseSync;

From 695cd896a78cadc40a5e1236291ef285eb4aa7c1 Mon Sep 17 00:00:00 2001
From: Yuya Inoue <65857152+inoway46@users.noreply.github.com>
Date: Tue, 18 Aug 2026 16:04:36 +0900
Subject: [PATCH 220/344] doc: add missing return types in buffer.md

Add return types for Blob methods and legacy Base64 helpers so doc-kit
does not render them as `void`.

Refs: nodejs/doc-kit#953
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65308
Refs: https://github.com/nodejs/doc-kit/issues/953
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/buffer.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 4fd34498c050..5ead75a414dd 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -536,6 +536,8 @@ added:
   - v20.16.0
 -->
 
+* Returns: {Promise}
+
 The `blob.bytes()` method returns the byte of the `Blob` object as a `Promise<Uint8Array>`.
 
 ```js
@@ -566,6 +568,7 @@ added:
 * `start` {number} The starting index.
 * `end` {number} The ending index.
 * `type` {string} The content-type for the new `Blob`
+* Returns: {Blob}
 
 Creates and returns a new `Blob` containing a subset of this `Blob` objects
 data. The original `Blob` is not altered.
@@ -5274,6 +5277,7 @@ added:
 > Stability: 3 - Legacy. Use `Buffer.from(data, 'base64')` instead.
 
 * `data` {any} The Base64-encoded input string.
+* Returns: {string}
 
 Decodes a string of Base64-encoded data into bytes, and encodes those bytes
 into a string using Latin-1 (ISO-8859-1).
@@ -5304,6 +5308,7 @@ added:
 > Stability: 3 - Legacy. Use `buf.toString('base64')` instead.
 
 * `data` {any} An ASCII (Latin1) string.
+* Returns: {string}
 
 Decodes a string into bytes using Latin-1 (ISO-8859), and encodes those bytes
 into a string using Base64.

From 262f96615551173e8d67a3757b0bb18aa1ccb908 Mon Sep 17 00:00:00 2001
From: Chaseton Collins <43923165+chasetonco@users.noreply.github.com>
Date: Tue, 18 Aug 2026 03:04:46 -0400
Subject: [PATCH 221/344] doc: add missing return types in fs.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three entries in the fs documentation described their return
value only in prose, or not at all, so doc-kit could not parse
a return type and fell back to `void`:

* `filehandle[Symbol.asyncDispose]()` and
  `dir[Symbol.asyncDispose]()` both return a promise, matching
  the existing `Returns: {Promise}` annotations on other async
  dispose methods.
* `new fs.Utf8Stream([options])` is a constructor and returns
  an instance of the class.

Verified at runtime and by rendering the page locally with
doc-kit.

Refs: https://github.com/nodejs/doc-kit/issues/953
Signed-off-by: Chxxeton <43923165+Chxxeton@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65307
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 doc/api/fs.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index cfb833d5b994..97fe3000e8f1 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1184,6 +1184,8 @@ changes:
    description: No longer experimental.
 -->
 
+* Returns: {Promise}
+
 Calls `filehandle.close()` and returns a promise that fulfills when the
 filehandle is closed.
 
@@ -7330,6 +7332,8 @@ changes:
    description: No longer experimental.
 -->
 
+* Returns: {Promise}
+
 Calls `dir.close()` if the directory handle is open, and returns a promise that
 fulfills when disposal is complete.
 
@@ -8393,6 +8397,7 @@ of bytes written is passed as the first argument to the event handler.
     * `writeBufferLen` {number}
     * `remainingBufferLen`: {number}
   * `sync`: {boolean} Perform writes synchronously.
+* Returns: {fs.Utf8Stream}
 
 #### `utf8Stream.append`
 

From 4a784cb3e6f9ce6f31a77c8b24bbd909a1de12af Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Tue, 18 Aug 2026 16:04:55 +0900
Subject: [PATCH 222/344] doc: document per-architecture fast FFI argument
 limits

The prior text covered only two of the seven supported architectures
and conflated x86-64 SysV with the stricter Win64 emitter.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65207
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 doc/api/ffi.md | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/doc/api/ffi.md b/doc/api/ffi.md
index 158aadffa3e3..54de34da7a18 100644
--- a/doc/api/ffi.md
+++ b/doc/api/ffi.md
@@ -126,13 +126,26 @@ raw pointer `bigint` values. For pointer-like parameters, `null`, `undefined`,
 strings, `Buffer`, typed array, `DataView`, and `ArrayBuffer` values are
 converted on the JavaScript side before calling the optimized native wrapper.
 
-Optimized Fast FFI calls support at most 8 function arguments, but the exact
-limit depends on the architecture and on the argument types, because each
-argument must fit in the registers used by the platform trampoline. Integer
-and pointer arguments are limited to 7 on AArch64 and to 6 on x86-64, while
-floating-point arguments can use up to 8 on both. Functions that exceed these
-limits, including any function with more than 8 arguments, use the generic FFI
-call path instead.
+Optimized Fast FFI calls fall back to the generic FFI call path when a
+function's arguments or return type do not fit the platform-specific fast
+trampoline. Fast FFI calls support at most 8 total arguments, and the
+register and argument limits differ per architecture:
+
+| Architecture               | Max integer/pointer args                  | Max floating-point args | Buffer-shaped args | Buffer-shaped + FP together | Narrow (8/16-bit) return |
+| -------------------------- | ----------------------------------------- | ----------------------- | ------------------ | --------------------------- | ------------------------ |
+| AArch64                    | 7 (6 when a buffer-shaped arg is present) | 8                       | Supported          | Not supported               | Supported                |
+| x86-64, Linux/macOS (SysV) | 6 (4 when a buffer-shaped arg is present) | 8                       | Supported          | Not supported               | Supported                |
+| x86-64, Windows (Win64)    | 3 (total arguments also capped at 3)      | 3                       | Not supported      | N/A                         | Supported                |
+| s390x                      | 4                                         | 4                       | Not supported      | N/A                         | Not supported            |
+| PPC64LE                    | 7                                         | 8                       | Not supported      | N/A                         | Not supported            |
+| LoongArch64                | 7                                         | 8                       | Not supported      | N/A                         | Not supported            |
+| RISC-V (64-bit)            | 7                                         | 8                       | Not supported      | N/A                         | Not supported            |
+
+PPC64BE has no fast-call trampoline and always uses the generic call path.
+"Buffer-shaped args" means `Buffer`, typed array, `DataView`, or `ArrayBuffer`
+values passed as pointer-like arguments. Functions whose argument or return
+types exceed the limits for the current platform use the generic FFI call
+path instead.
 
 ## Signature objects
 

From abfc51f757d1faecaaa78f4e1c68e7926f5a100b Mon Sep 17 00:00:00 2001
From: Erik Demaine <edemaine@mit.edu>
Date: Tue, 18 Aug 2026 03:05:05 -0400
Subject: [PATCH 223/344] doc: document setRawMode write access on Windows

Fixes: https://github.com/nodejs/node/issues/63852
Signed-off-by: Erik Demaine <edemaine@mit.edu>
PR-URL: https://github.com/nodejs/node/pull/63856
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/tty.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/api/tty.md b/doc/api/tty.md
index 03f86cd66052..cbfb3cc78377 100644
--- a/doc/api/tty.md
+++ b/doc/api/tty.md
@@ -86,6 +86,11 @@ characters. <kbd>Ctrl</kbd>+<kbd>C</kbd> will no longer cause a `SIGINT` when
 in this mode. This mode does not affect terminal output processing, such as
 newline translation on Unix terminals.
 
+On Windows, `setRawMode()` requires write permission to the console input
+buffer. When opening `"\\\\.\\CONIN$"` with the [`fs.open()`][] family of APIs
+(for passing into `new tty.ReadStream()`), be sure to use a read/write flag
+such as `'r+'`.
+
 ## Class: `tty.WriteStream`
 
 <!-- YAML
@@ -342,6 +347,7 @@ The `tty.isatty()` method returns `true` if the given `fd` is associated with
 a TTY and `false` if it is not, including whenever `fd` is not a non-negative
 integer.
 
+[`fs.open()`]: fs.md#fsopenpath-flags-mode-callback
 [`net.Socket` constructor]: net.md#new-netsocketoptions
 [`process.stderr`]: process.md#processstderr
 [`process.stdin`]: process.md#processstdin

From 63583c4e7591e70f9533982c2daf7054cdedfc1d Mon Sep 17 00:00:00 2001
From: T <6601329+cookesan@users.noreply.github.com>
Date: Tue, 18 Aug 2026 03:05:14 -0400
Subject: [PATCH 224/344] doc: clarify copyFile symlink behavior

Signed-off-by: T <cookesan@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/62941
Fixes: https://github.com/nodejs/node/issues/61518
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 doc/api/fs.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index 97fe3000e8f1..ec3c12f376ef 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1327,6 +1327,10 @@ changes:
 Asynchronously copies `src` to `dest`. By default, `dest` is overwritten if it
 already exists.
 
+Symbolic links are followed. If `src` is a symbolic link, the target file is
+copied. If `dest` is a symbolic link, the target file is overwritten unless
+`mode` contains `fs.constants.COPYFILE_EXCL`.
+
 No guarantees are made about the atomicity of the copy operation. If an
 error occurs after the destination file has been opened for writing, an attempt
 will be made to remove the destination.
@@ -2841,6 +2845,10 @@ callback function. Node.js makes no guarantees about the atomicity of the copy
 operation. If an error occurs after the destination file has been opened for
 writing, Node.js will attempt to remove the destination.
 
+Symbolic links are followed. If `src` is a symbolic link, the target file is
+copied. If `dest` is a symbolic link, the target file is overwritten unless
+`mode` contains `fs.constants.COPYFILE_EXCL`.
+
 `mode` is an optional integer that specifies the behavior
 of the copy operation. It is possible to create a mask consisting of the bitwise
 OR of two or more values (e.g.
@@ -6004,6 +6012,10 @@ already exists. Returns `undefined`. Node.js makes no guarantees about the
 atomicity of the copy operation. If an error occurs after the destination file
 has been opened for writing, Node.js will attempt to remove the destination.
 
+Symbolic links are followed. If `src` is a symbolic link, the target file is
+copied. If `dest` is a symbolic link, the target file is overwritten unless
+`mode` contains `fs.constants.COPYFILE_EXCL`.
+
 `mode` is an optional integer that specifies the behavior
 of the copy operation. It is possible to create a mask consisting of the bitwise
 OR of two or more values (e.g.

From 1a20d271180af69928e43d767aaf84446e402286 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 07:27:32 +0000
Subject: [PATCH 225/344] tools: bump undici from 6.27.0 to 6.28.0 in
 /tools/doc

Bumps [undici](https://github.com/nodejs/undici) from 6.27.0 to 6.28.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.27.0...v6.28.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65011
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 tools/doc/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/doc/package-lock.json b/tools/doc/package-lock.json
index a63b70a7d3c3..20912317efc8 100644
--- a/tools/doc/package-lock.json
+++ b/tools/doc/package-lock.json
@@ -4572,9 +4572,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

From 7c09bd5eced97b0a1d045dc14cd7801388879325 Mon Sep 17 00:00:00 2001
From: James Ross <james@jross.me>
Date: Tue, 18 Aug 2026 08:27:42 +0100
Subject: [PATCH 226/344] tools: fix man-page generation on Windows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James Ross <james@jross.me>
PR-URL: https://github.com/nodejs/node/pull/64886
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 tools/doc/man-page.doc-kit.config.mjs | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tools/doc/man-page.doc-kit.config.mjs b/tools/doc/man-page.doc-kit.config.mjs
index bed71a8cb80c..93c947c29011 100644
--- a/tools/doc/man-page.doc-kit.config.mjs
+++ b/tools/doc/man-page.doc-kit.config.mjs
@@ -5,7 +5,14 @@ import { fileURLToPath } from 'node:url';
 
 const root = new URL('../../', import.meta.url);
 
-const fromRoot = (path) => fileURLToPath(new URL(path, root));
+// POSIX separators, because `input` is a glob pattern and a backslash reads as
+// an escape character, which would mangle Windows paths into non-matches.
+const fromRoot = (path) =>
+  fileURLToPath(new URL(path, root)).replaceAll('\\', '/');
+
+// doc-kit only treats a value as local when it parses as a `file:` URL, and a
+// Windows drive letter parses as a URL scheme, so these must stay URLs.
+const urlFromRoot = (path) => new URL(path, root).href;
 
 export default {
   target: ['man-page'],
@@ -15,7 +22,7 @@ export default {
     output: fromRoot('tools/doc/.manpagecheck'),
 
     // Point every loadable URL at its local file so no network request is made.
-    changelog: fromRoot('CHANGELOG.md'),
-    index: fromRoot('doc/api/index.md'),
+    changelog: urlFromRoot('CHANGELOG.md'),
+    index: urlFromRoot('doc/api/index.md'),
   },
 };

From 3ed0492f5265562b97eb6514b2bf432e8d3210de Mon Sep 17 00:00:00 2001
From: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date: Tue, 18 Aug 2026 11:25:53 -0300
Subject: [PATCH 227/344] doc: update security release prepare command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/64699
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 doc/contributing/releases.md | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
index da61b360ac9f..c214f8c97cc5 100644
--- a/doc/contributing/releases.md
+++ b/doc/contributing/releases.md
@@ -377,14 +377,20 @@ git checkout -b v1.2.3-proposal upstream/v1.x-staging
 You can also run:
 
 ```bash
-git node release -S --prepare --security=../vulnerabilities.json --filterLabel vX.x
+git node release -S --prepare --security=../security-release
 ```
 
+The `--security` flag takes the path to your clone of the `security-release`
+repository (or directly to a `vulnerabilities.json` file). The reports and
+dependency updates to cherry-pick are selected automatically from each entry's
+`affectedVersions` mapping for the release line you are on, and the matching
+`CVE-ID` trailers are added from the same file.
+
 Example:
 
 ```bash
 git checkout v20.x
-git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x
+git node release -S --prepare --security=../security-release
 ```
 
 to automate the remaining steps until step 6 or you can perform it manually
@@ -392,7 +398,7 @@ following the below steps. For semver-minors, you can pass the new version
 explicitly with `--newVersion` arg:
 
 ```bash
-git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x --newVersion 20.20.0
+git node release -S --prepare --security=../security-release --newVersion 20.20.0
 ```
 
 <details>

From 89aba0c311ca605ce76a019c9686efab455df062 Mon Sep 17 00:00:00 2001
From: soreavis <263610811+soreavis@users.noreply.github.com>
Date: Tue, 18 Aug 2026 17:15:47 +0200
Subject: [PATCH 228/344] doc: clarify how fs.Dirent file types are determined

The file type of a directory entry returned by fs.readdir() or
fs.opendir() is the type reported by the operating system's directory
listing. Node.js falls back to lstat() only when the reported type is
unknown, and some file systems may report a type that differs from what
lstat() would return. Document this in the fs.Dirent class introduction,
with fs.lstat() as the accurate alternative.

Fixes: https://github.com/nodejs/node/issues/30646
Signed-off-by: Julian Soreavis <julian.soreavis@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64532
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
---
 doc/api/fs.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index ec3c12f376ef..cbea29c3469b 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -7386,6 +7386,13 @@ Additionally, when [`fs.readdir()`][] or [`fs.readdirSync()`][] is called with
 the `withFileTypes` option set to `true`, the resulting array is filled with
 {fs.Dirent} objects, rather than strings or {Buffer}s.
 
+When a directory is read, such as with [`fs.readdir()`][] or
+[`fs.opendir()`][], the file type of each entry is the type reported by the
+operating system and may depend on the file system; for example, some file
+systems may report a type that differs from what [`fs.lstat()`][] returns.
+Node.js calls [`fs.lstat()`][] on such an entry only when the reported type
+is unknown. Use [`fs.lstat()`][] when an accurate file type is required.
+
 #### `dirent.isBlockDevice()`
 
 <!-- YAML

From f33dba704d35c4f61b3d574d781e04e586f3480b Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 15 Aug 2026 22:09:21 +0000
Subject: [PATCH 229/344] string_decoder: decode UTF-8 via StringBytes::Encode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

StringDecoder used v8::String::NewFromUtf8() for UTF-8, while
Buffer#toString() goes through StringBytes::Encode(), which has
simdutf-backed ASCII, Latin-1 and UTF-16 paths and only falls back
to NewFromUtf8() for input that contains invalid sequences. Route
the decoder through the same function, so streams with
setEncoding('utf8') and readline decode at the same speed as
Buffer#toString(). U+FFFD replacement is unchanged because invalid
input still ends up in NewFromUtf8(), and the ERR_STRING_TOO_LONG
check is kept explicit so over-long input fails as before.

benchmark/string_decoder/string-decoder.js (encoding=utf8) and a
readline-over-pipe workload improve by 2-3x for chunks >= 1 KiB;
64 KiB newline-delimited JSON round trips over child stdio improve
by ~30% on the reading side alone.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65324
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/string_decoder.cc                         | 28 +++----
 .../test-string-decoder-utf8-large.js         | 81 +++++++++++++++++++
 2 files changed, 94 insertions(+), 15 deletions(-)
 create mode 100644 test/parallel/test-string-decoder-utf8-large.js

diff --git a/src/string_decoder.cc b/src/string_decoder.cc
index 4787a83aafe3..33f3ad94599a 100644
--- a/src/string_decoder.cc
+++ b/src/string_decoder.cc
@@ -28,23 +28,21 @@ MaybeLocal<String> MakeString(Isolate* isolate,
                               const char* data,
                               size_t length,
                               enum encoding encoding) {
-  MaybeLocal<Value> ret;
-  if (encoding == UTF8) {
-    MaybeLocal<String> utf8_string;
-    if (length <= static_cast<size_t>(v8::String::kMaxLength)) {
-      utf8_string = String::NewFromUtf8(
-          isolate, data, v8::NewStringType::kNormal, length);
-    }
-    if (utf8_string.IsEmpty()) {
-      isolate->ThrowException(node::ERR_STRING_TOO_LONG(isolate));
-      return MaybeLocal<String>();
-    } else {
-      return utf8_string;
-    }
-  } else {
-    ret = StringBytes::Encode(isolate, data, length, encoding);
+  // StringBytes::Encode() would report an over-long UTF-8 input as
+  // ERR_BUFFER_TOO_LARGE (or clamp it); keep reporting it the way this
+  // decoder always has.
+  if (encoding == UTF8 && length > static_cast<size_t>(v8::String::kMaxLength))
+      [[unlikely]] {
+    isolate->ThrowException(node::ERR_STRING_TOO_LONG(isolate));
+    return MaybeLocal<String>();
   }
 
+  // For UTF-8 this takes the simdutf-backed ASCII / Latin-1 / UTF-16 paths and
+  // only falls back to v8::String::NewFromUtf8() (the previous unconditional
+  // path here) for input containing invalid sequences, so U+FFFD replacement
+  // is unchanged.
+  MaybeLocal<Value> ret = StringBytes::Encode(isolate, data, length, encoding);
+
   if (ret.IsEmpty()) {
     return {};
   }
diff --git a/test/parallel/test-string-decoder-utf8-large.js b/test/parallel/test-string-decoder-utf8-large.js
new file mode 100644
index 000000000000..ccbabf26a27c
--- /dev/null
+++ b/test/parallel/test-string-decoder-utf8-large.js
@@ -0,0 +1,81 @@
+'use strict';
+// The UTF-8 StringDecoder shares its byte->string conversion with
+// Buffer#toString(): ASCII, Latin-1-representable and general inputs take
+// different (SIMD) paths depending on content and size, and invalid input
+// falls back to a replacing decoder. This test pins the decoder's output for
+// inputs that cross those size thresholds, for chunkings that split multibyte
+// sequences, and for invalid bytes embedded in otherwise large valid input.
+require('../common');
+const assert = require('assert');
+const { StringDecoder } = require('string_decoder');
+
+function decodeInChunks(buf, chunkSize) {
+  const decoder = new StringDecoder('utf8');
+  let out = '';
+  for (let i = 0; i < buf.length; i += chunkSize) {
+    out += decoder.write(buf.subarray(i, i + chunkSize));
+  }
+  return out + decoder.end();
+}
+
+function check(str, label) {
+  const buf = Buffer.from(str, 'utf8');
+  // Sanity: the expectation itself round-trips.
+  assert.strictEqual(buf.toString('utf8'), str, `${label}: toString`);
+  for (const chunkSize of [1, 2, 3, 4, 5, 7, 31, 32, 33, 255, 256, 257,
+                           4095, 4096, 65536, buf.length]) {
+    if (chunkSize > buf.length) continue;
+    // Keep the test fast: byte-sized chunks only for the smaller inputs.
+    if (buf.length > 100_000 && chunkSize < 4095) continue;
+    assert.strictEqual(decodeInChunks(buf, chunkSize), str,
+                       `${label}: chunkSize=${chunkSize}`);
+  }
+}
+
+const sizes = [31, 32, 33, 255, 256, 257, 4096, 70000, (1 << 20) + 5];
+for (const size of sizes) {
+  check('a'.repeat(size), `ascii ${size}`);
+  // Latin-1 range only (one-byte string in V8, two bytes each in UTF-8).
+  check('é'.repeat(size), `latin1 ${size}`);
+  // ASCII with a single Latin-1 character at the end / start.
+  check('a'.repeat(size - 1) + 'ÿ', `ascii+latin1 tail ${size}`);
+  check('Ä' + 'a'.repeat(size - 1), `latin1 head+ascii ${size}`);
+  // BMP beyond Latin-1 (three-byte sequences).
+  check('日'.repeat(size), `cjk ${size}`);
+  // Mixed, including astral plane characters (surrogate pairs, 4 bytes).
+  check(('abé日\u{1F600}').repeat(Math.ceil(size / 6)), `mixed ${size}`);
+}
+
+// Invalid bytes inside otherwise valid input of every size class must still be
+// replaced with U+FFFD exactly as before, regardless of chunking.
+for (const size of [8, 40, 300, 5000, (1 << 20) + 5]) {
+  const valid = Buffer.from('a'.repeat(size));
+  for (const bad of [[0xff], [0xc0, 0xaf], [0xe2, 0x28, 0xa1],
+                     [0xed, 0xa0, 0x80] /* encoded surrogate */,
+                     [0xf0, 0x9f, 0x98] /* truncated 4-byte */]) {
+    const buf = Buffer.concat([valid, Buffer.from(bad), valid]);
+    const expected = buf.toString('utf8');
+    assert.ok(expected.includes('�'), `size=${size} bad=${bad}`);
+    for (const chunkSize of [1, 3, 64, size, size + 1, buf.length]) {
+      if (buf.length > 100_000 && chunkSize < size) continue;
+      assert.strictEqual(decodeInChunks(buf, chunkSize), expected,
+                         `invalid ${bad} in ${size}, chunkSize=${chunkSize}`);
+    }
+  }
+}
+
+// A lone continuation / lead byte split across the size classes at the very
+// end is buffered by the decoder and flushed as U+FFFD by end().
+{
+  const decoder = new StringDecoder('utf8');
+  const big = Buffer.concat([Buffer.from('a'.repeat(300)), Buffer.from([0xe2, 0x82])]);
+  assert.strictEqual(decoder.write(big), 'a'.repeat(300));
+  assert.strictEqual(decoder.end(), '�');
+}
+{
+  const decoder = new StringDecoder('utf8');
+  const big = Buffer.concat([Buffer.from('é'.repeat(300)), Buffer.from([0xe2, 0x82])]);
+  assert.strictEqual(decoder.write(big), 'é'.repeat(300));
+  assert.strictEqual(decoder.write(Buffer.from([0xac])), '€');
+  assert.strictEqual(decoder.end(), '');
+}

From 32bb197f2a1c8c4b520bf2420b5ce10e35acb271 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 15 Aug 2026 22:34:28 +0000
Subject: [PATCH 230/344] src: use simdutf for two-byte strings in UTF-8 writes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

StringBytes::Write() already used simdutf to encode one-byte strings
as UTF-8 but sent every two-byte (UTF-16) string through
v8::String::WriteUtf8V2(), which is several times slower. That path
is behind Buffer.from(string), buf.write(), fs.write*() with string
data and every string written to a libuv stream, and JSON.stringify()
output is a two-byte string as soon as any value in the payload is
outside Latin-1.

Encode two-byte strings with simdutf as well whenever their UTF-8 form
is guaranteed to fit in the target: well-formed input is converted
directly, and input with unpaired surrogates is converted from a copy
passed through simdutf::to_well_formed_utf16(), which replaces each
unpaired surrogate with U+FFFD exactly like kReplaceInvalidUtf8 (this
mirrors what TextEncoder already does). Writes that have to truncate
at a character boundary keep using WriteUtf8V2(), so their output is
byte-for-byte unchanged, and so do strings of up to 32 code units, for
which V8 is already as fast (the same threshold TextEncoder uses).

buf.write() of a 2 KiB two-byte string improves ~5x (astral-heavy and
lone-surrogate strings ~3.5x and ~5x), Buffer.from() of a 64 KiB JSON
string ~2.7x; one-byte strings are unaffected.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65324
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 benchmark/buffers/buffer-write-string-utf8.js |  36 +++++
 src/string_bytes.cc                           |  30 +++-
 .../test-buffer-write-utf8-two-byte.js        | 128 ++++++++++++++++++
 3 files changed, 193 insertions(+), 1 deletion(-)
 create mode 100644 benchmark/buffers/buffer-write-string-utf8.js
 create mode 100644 test/parallel/test-buffer-write-utf8-two-byte.js

diff --git a/benchmark/buffers/buffer-write-string-utf8.js b/benchmark/buffers/buffer-write-string-utf8.js
new file mode 100644
index 000000000000..930b83dcd55b
--- /dev/null
+++ b/benchmark/buffers/buffer-write-string-utf8.js
@@ -0,0 +1,36 @@
+'use strict';
+
+// buf.write(string, 'utf8') for strings whose in-memory representation is
+// one-byte (Latin-1) or two-byte (UTF-16), which take different encoder paths.
+const common = require('../common.js');
+const bench = common.createBenchmark(main, {
+  chars: ['one-byte', 'two-byte', 'two-byte-astral', 'two-byte-lone-surrogate'],
+  len: [16, 256, 2048, 65536],
+  n: [5e5],
+});
+
+function makeString(chars, len) {
+  switch (chars) {
+    case 'one-byte':
+      return 'aé'.repeat(len / 2);
+    case 'two-byte':
+      return 'aé€日'.repeat(len / 4);
+    case 'two-byte-astral':
+      return 'aé€日\u{1F600}'.repeat(len / 6).padEnd(len, 'a');
+    case 'two-byte-lone-surrogate':
+      return 'aé€日'.repeat(len / 4 - 1) + 'ab\ud800c';
+    default:
+      throw new Error(chars);
+  }
+}
+
+function main({ chars, len, n }) {
+  const string = makeString(chars, len);
+  const buf = Buffer.allocUnsafe(Buffer.byteLength(string));
+  if (len >= 65536) n = Math.floor(n / 32);
+  bench.start();
+  for (let i = 0; i < n; ++i) {
+    buf.write(string, 0, 'utf8');
+  }
+  bench.end(n);
+}
diff --git a/src/string_bytes.cc b/src/string_bytes.cc
index b39d6fcc2ecb..88b499fb4289 100644
--- a/src/string_bytes.cc
+++ b/src/string_bytes.cc
@@ -310,9 +310,37 @@ size_t StringBytes::Write(Isolate* isolate,
             input_view.length(),
             buf,
             buflen);
-      } else {
+      } else if (input_view.length() <= 32) {
+        // V8 is as fast for tiny strings (same threshold TextEncoder uses).
         nbytes = str->WriteUtf8V2(
             isolate, buf, buflen, String::WriteFlags::kReplaceInvalidUtf8);
+      } else {
+        // Use simdutf for two-byte strings as well whenever the UTF-8 form
+        // is guaranteed to fit; truncating writes (which must stop at a
+        // character boundary) keep going through V8 so that their output
+        // stays byte-for-byte identical.
+        const char16_t* data =
+            reinterpret_cast<const char16_t*>(input_view.data16());
+        const size_t length = input_view.length();
+        MaybeStackBuffer<char16_t, 1024> well_formed;
+        if (!simdutf::validate_utf16(data, length)) {
+          // Unpaired surrogates: encode a copy in which each of them has been
+          // replaced with U+FFFD, which is what kReplaceInvalidUtf8 produces.
+          well_formed.AllocateSufficientStorage(length);
+          simdutf::to_well_formed_utf16(data, length, well_formed.out());
+          data = well_formed.out();
+        }
+        // A UTF-16 code unit never expands to more than 3 UTF-8 bytes, so
+        // 3 * length is what StorageSize() hands most callers; only compute
+        // the exact length when the buffer is smaller than that.
+        if (buflen >= 3 * length ||
+            buflen >= simdutf::utf8_length_from_utf16(data, length)) {
+          nbytes = simdutf::convert_utf16_to_utf8(data, length, buf);
+        } else {
+          // Does not fit: let V8 truncate at a character boundary.
+          nbytes = str->WriteUtf8V2(
+              isolate, buf, buflen, String::WriteFlags::kReplaceInvalidUtf8);
+        }
       }
       break;
 
diff --git a/test/parallel/test-buffer-write-utf8-two-byte.js b/test/parallel/test-buffer-write-utf8-two-byte.js
new file mode 100644
index 000000000000..5d68cc90e7e5
--- /dev/null
+++ b/test/parallel/test-buffer-write-utf8-two-byte.js
@@ -0,0 +1,128 @@
+'use strict';
+// UTF-8 encoding of two-byte (UTF-16) JS strings through the Buffer write
+// paths (Buffer.from, Buffer#write, Buffer.byteLength) must:
+//  - produce standard UTF-8 for well-formed input of any size,
+//  - replace lone surrogates with U+FFFD (EF BF BD),
+//  - never write a partial character when the target is too small,
+// independent of which internal fast path handles the string.
+require('../common');
+const assert = require('assert');
+
+// Reference encoder written out longhand so the test does not depend on the
+// implementation under test (TextEncoder shares code with it).
+function utf8Reference(str) {
+  const out = [];
+  for (let i = 0; i < str.length; i++) {
+    let cp = str.charCodeAt(i);
+    if (cp >= 0xd800 && cp <= 0xdbff) {
+      const next = i + 1 < str.length ? str.charCodeAt(i + 1) : 0;
+      if (next >= 0xdc00 && next <= 0xdfff) {
+        cp = 0x10000 + ((cp - 0xd800) << 10) + (next - 0xdc00);
+        i++;
+      } else {
+        cp = 0xfffd;
+      }
+    } else if (cp >= 0xdc00 && cp <= 0xdfff) {
+      cp = 0xfffd;
+    }
+    if (cp < 0x80) {
+      out.push(cp);
+    } else if (cp < 0x800) {
+      out.push(0xc0 | (cp >> 6), 0x80 | (cp & 0x3f));
+    } else if (cp < 0x10000) {
+      out.push(0xe0 | (cp >> 12), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f));
+    } else {
+      out.push(0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 0x3f),
+               0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f));
+    }
+  }
+  return Buffer.from(out);
+}
+
+function checkFull(str, label) {
+  const expected = utf8Reference(str);
+  assert.deepStrictEqual(Buffer.from(str, 'utf8'), expected, `${label}: Buffer.from`);
+  assert.strictEqual(Buffer.byteLength(str, 'utf8'), expected.length, `${label}: byteLength`);
+  // Exact-size target.
+  const exact = Buffer.alloc(expected.length);
+  assert.strictEqual(exact.write(str, 'utf8'), expected.length, `${label}: write exact`);
+  assert.deepStrictEqual(exact, expected, `${label}: write exact bytes`);
+  // Oversized target (3 bytes per code unit is what most internal callers allocate).
+  const big = Buffer.alloc(str.length * 3 + 7, 0xaa);
+  assert.strictEqual(big.write(str, 2, 'utf8'), expected.length, `${label}: write big`);
+  assert.deepStrictEqual(big.subarray(2, 2 + expected.length), expected, `${label}: write big bytes`);
+  assert.strictEqual(big[0], 0xaa);
+  assert.strictEqual(big[2 + expected.length], 0xaa, `${label}: no overrun`);
+}
+
+// Truncating writes must stop before the first character that does not fit.
+function checkTruncation(str, label) {
+  const expected = utf8Reference(str);
+  for (let size = 0; size <= Math.min(expected.length, 70); size++) {
+    const target = Buffer.alloc(size + 1, 0xaa);
+    const n = target.write(str, 0, size, 'utf8');
+    assert.ok(n <= size, `${label}: size=${size} wrote ${n}`);
+    assert.deepStrictEqual(target.subarray(0, n), expected.subarray(0, n), `${label}: prefix size=${size}`);
+    assert.strictEqual(target[size], 0xaa, `${label}: overrun size=${size}`);
+    // What was written must be a whole number of characters: the next byte in
+    // the reference (if any) has to be a lead byte, not a continuation byte.
+    if (n < expected.length) {
+      assert.notStrictEqual(expected[n] & 0xc0, 0x80, `${label}: split char at size=${size}`);
+      // And it stopped only because the next character really did not fit.
+      let next = n + 1;
+      while (next < expected.length && (expected[next] & 0xc0) === 0x80) next++;
+      assert.ok(next > size, `${label}: stopped early at size=${size} (n=${n}, next=${next})`);
+    }
+  }
+}
+
+// Force a two-byte representation even for ASCII/Latin-1 content by building
+// the string from a two-byte seed and slicing (V8 keeps the representation).
+function twoByte(str) {
+  const s = ('\u{1F600}' + str).slice(2);
+  assert.strictEqual(s, str);
+  return s;
+}
+
+const samples = {
+  ascii: 'The quick brown fox jumps over the lazy dog 0123456789',
+  latin1: 'français élan über naïve façade ÿ',
+  bmp: '日本語テキストとハングル한국어',
+  astral: 'emoji \u{1F600}\u{1F4A9} math \u{1D49C} han \u{20BB7}',
+  mixed: 'a é 日 \u{1F600} b ü 本 \u{1F4A9}',
+};
+
+for (const [name, base] of Object.entries(samples)) {
+  for (const repeat of [1, 3, 40, 700, 12000]) {
+    const str = twoByte(base.repeat(repeat));
+    checkFull(str, `${name} x${repeat}`);
+  }
+  checkTruncation(twoByte(base.repeat(3)), `${name} truncation`);
+}
+
+// Lone surrogates in various positions and sizes -> U+FFFD, rest intact.
+const high = '\ud83d';
+const low = '\ude00';
+const surrogateCases = {
+  'lone high': `ab${high}cd`,
+  'lone low': `ab${low}cd`,
+  'reversed pair': `ab${low}${high}cd`,
+  'high at end': `abcd${high}`,
+  'low at start': `${low}abcd`,
+  'high high low': `${high}${high}${low}x`,
+  'pair then lone': `${high}${low}${high}`,
+  'only lone': high,
+};
+for (const [name, base] of Object.entries(surrogateCases)) {
+  for (const pad of ['', 'x'.repeat(50), 'é'.repeat(300), '日'.repeat(30000)]) {
+    const str = pad + base + pad;
+    checkFull(str, `${name} pad=${pad.length}`);
+  }
+  checkTruncation(base + 'zz', `${name} truncation`);
+}
+
+// Buffer.from of a large two-byte string equals TextEncoder output.
+{
+  const str = twoByte(samples.mixed.repeat(50000));
+  assert.deepStrictEqual(Buffer.from(str), Buffer.from(new TextEncoder().encode(str)));
+}

From a9dc50d275e342b831ff7ee1f02d11c403a4c860 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 18 Aug 2026 22:36:15 -0700
Subject: [PATCH 231/344] stream: reject pull on signal abort during flush

An asynchronous transform can abort the pipeline while its final flush
resolves to null. With no final batch yielded, the pipeline previously
completed without observing the abort.

Check the signal after transform iteration completes so the consumer
rejects with the abort reason.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65346
Fixes: https://github.com/nodejs/node/issues/65345
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/internal/streams/iter/pull.js            |  4 ++++
 test/parallel/test-stream-iter-pull-async.js | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index c546e70ad961..d75a175443d3 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -764,6 +764,10 @@ async function* createAsyncPipeline(source, transforms, signal) {
       controller.signal.throwIfAborted();
       yield batch;
     }
+    // A transform can abort while completing without producing a final batch,
+    // for example when an async flush resolves to null. In that case the loop
+    // body has no opportunity to observe the abort.
+    controller.signal.throwIfAborted();
     completed = true;
   } catch (error) {
     if (!controller.signal.aborted) {
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 6fa3192e5855..3159b718f27e 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -295,6 +295,23 @@ async function testPullStatelessTransformFlushError() {
   }, { message: 'async flush boom' });
 }
 
+// An abort during an async flush must not be swallowed when the flush resolves
+// to null and therefore produces no final batch.
+async function testPullSignalAbortDuringAsyncFlush() {
+  const ac = new AbortController();
+  const reason = new Error('aborted during flush');
+  const transform = async (chunks) => {
+    if (chunks !== null) return chunks;
+    ac.abort(reason);
+    return null;
+  };
+
+  await assert.rejects(
+    () => text(pull(from('x'), transform, { signal: ac.signal })),
+    (error) => error === reason,
+  );
+}
+
 // Pull with a sync iterable source (not async)
 async function testPullWithSyncSource() {
   function* gen() {
@@ -409,6 +426,7 @@ async function testTransformOptionsNotShared() {
     testPullStatelessTransformFlush(),
     testPullConsecutiveStatelessTransformFlush(),
     testPullStatelessTransformFlushError(),
+    testPullSignalAbortDuringAsyncFlush(),
     testPullWithSyncSource(),
     testPullStringSource(),
     testTransformReturnsSingleUint8Array(),

From 810929b6dd853b005c1ba40ff8518ffa26129688 Mon Sep 17 00:00:00 2001
From: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Date: Wed, 19 Aug 2026 08:42:35 +0200
Subject: [PATCH 232/344] Revert "fs: fix close listener leak in FileHandle
 streams"

This reverts commit 8488e1324af0631105cfaf365e0e2673de295696.

It was advised that the fix in question is broken since
it will unref the handle multiple times.

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65387
Refs: https://github.com/nodejs/node/pull/64227
Refs: https://github.com/nodejs/node/issues/64214
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 lib/internal/fs/streams.js                    | 14 +------
 .../test-fs-promises-file-handle-stream.js    | 39 -------------------
 2 files changed, 1 insertion(+), 52 deletions(-)

diff --git a/lib/internal/fs/streams.js b/lib/internal/fs/streams.js
index 882aa8e71fc9..4c53f7ea23e1 100644
--- a/lib/internal/fs/streams.js
+++ b/lib/internal/fs/streams.js
@@ -158,19 +158,7 @@ function importFd(stream, options) {
     stream[kHandle] = options.fd;
     stream[kFs] = FileHandleOperations(stream[kHandle]);
     stream[kHandle][kRef]();
-
-    const onclose = FunctionPrototypeBind(stream.close, stream);
-    options.fd.on('close', onclose);
-    if (options.autoClose === false) {
-      function cleanup() {
-        options.fd.removeListener('close', onclose);
-        options.fd[kUnref]();
-      }
-      stream.once('end', cleanup);
-      stream.once('finish', cleanup);
-      stream.once('error', cleanup);
-    }
-
+    options.fd.on('close', FunctionPrototypeBind(stream.close, stream));
     return options.fd.fd;
   }
 
diff --git a/test/parallel/test-fs-promises-file-handle-stream.js b/test/parallel/test-fs-promises-file-handle-stream.js
index 61d0b3ca2ec7..71f312b6f9d7 100644
--- a/test/parallel/test-fs-promises-file-handle-stream.js
+++ b/test/parallel/test-fs-promises-file-handle-stream.js
@@ -42,46 +42,7 @@ async function validateRead() {
   );
 }
 
-async function validateReusedCreateReadStream() {
-  const filePath = path.resolve(tmpDir, 'tmp-reused-stream.txt');
-  fs.writeFileSync(filePath, Buffer.from('ab', 'utf8'));
-
-  const fileHandle = await open(filePath, 'r');
-  try {
-    await buffer(fileHandle.createReadStream({
-      start: 0,
-      end: 0,
-      autoClose: false,
-    }));
-    assert.strictEqual(fileHandle.listenerCount('close'), 0);
-
-    await buffer(fileHandle.createReadStream({
-      start: 1,
-      end: 1,
-      autoClose: false,
-    }));
-    assert.strictEqual(fileHandle.listenerCount('close'), 0);
-  } finally {
-    await fileHandle.close();
-  }
-}
-
-async function validateReusedCreateWriteStream() {
-  const filePath = path.resolve(tmpDir, 'tmp-reused-write-stream.txt');
-  const fileHandle = await open(filePath, 'w');
-  try {
-    const stream = fileHandle.createWriteStream({ autoClose: false });
-    stream.end('a');
-    await finished(stream);
-    assert.strictEqual(fileHandle.listenerCount('close'), 0);
-  } finally {
-    await fileHandle.close();
-  }
-}
-
 Promise.all([
   validateWrite(),
   validateRead(),
-  validateReusedCreateReadStream(),
-  validateReusedCreateWriteStream(),
 ]).then(common.mustCall());

From e2f952f2ffe23fee70e3757bc9ce09e72dfbfb04 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 18 Aug 2026 23:42:46 -0700
Subject: [PATCH 233/344] sqlite: prevent reentrant session.close()

Reject session.close() while generating a changeset or patchset.
Closing the session at that point frees it while SQLite is still
using it, causing a use-after-free.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65349
Fixes: https://github.com/nodejs/node/issues/65347
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 doc/api/sqlite.md                    |  3 ++-
 src/node_sqlite.cc                   |  6 ++++++
 src/node_sqlite.h                    |  1 +
 test/parallel/test-sqlite-session.js | 22 ++++++++++++++++++++++
 4 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 37755f90aa08..1b18060b6e74 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -1005,7 +1005,8 @@ wrapper around [`sqlite3session_patchset()`][].
 
 ### `session.close()`
 
-Closes the session. An exception is thrown if the database or the session is not open. This method is a
+Closes the session. An exception is thrown if the database or the session is not open,
+or if the session is currently generating a changeset or patchset. This method is a
 wrapper around [`sqlite3session_delete()`][].
 
 ### `session[Symbol.dispose]()`
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 5a0522ba4240..c6b8a8d0a611 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -4299,6 +4299,10 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
       env, session->session_ == nullptr, "session is not open");
   THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
+  session->is_generating_changeset_ = true;
+  auto changeset_guard =
+      OnScopeLeave([&] { session->is_generating_changeset_ = false; });
+
   int nChangeset;
   void* pChangeset;
   int r = sqliteChangesetFunc(session->session_, &nChangeset, &pChangeset);
@@ -4324,6 +4328,8 @@ void Session::Close(const FunctionCallbackInfo<Value>& args) {
       env, !session->database_->IsOpen(), "database is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, session->session_ == nullptr, "session is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, session->is_generating_changeset_, "session is currently in use");
 
   session->Delete();
 }
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 705cefb1811b..7fec61dbf9a4 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -458,6 +458,7 @@ class Session : public BaseObject {
   void Delete();
   sqlite3_session* session_;
   BaseObjectPtr<DatabaseSync> database_;  // The Parent Database
+  bool is_generating_changeset_ = false;
 
   friend class DatabaseSync;
 };
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
index 2a72740bf899..a8bbaa77d064 100644
--- a/test/parallel/test-sqlite-session.js
+++ b/test/parallel/test-sqlite-session.js
@@ -612,6 +612,28 @@ test('session.close() - closing twice', (t) => {
   });
 });
 
+test('session.close() - while generating changes throws exception', (t) => {
+  for (const method of ['changeset', 'patchset']) {
+    const database = new DatabaseSync(':memory:');
+    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+
+    const session = database.createSession({ table: 'data' });
+    database.exec("INSERT INTO data VALUES (1, 'a'), (2, 'b'), (3, 'c')");
+    database.setAuthorizer(() => {
+      session.close();
+      return constants.SQLITE_OK;
+    });
+
+    t.assert.throws(() => session[method](), {
+      code: 'ERR_INVALID_STATE',
+      message: 'session is currently in use',
+    });
+
+    database.setAuthorizer(null);
+    t.assert.notStrictEqual(session[method]().length, 0);
+  }
+});
+
 test('session - keeps its database alive after the db handle is dropped', async (t) => {
   const { gcUntil, onGC } = require('../common/gc');
 

From 77fedbd350f67e443456937b13f2eb8edc4cbe7d Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Wed, 19 Aug 2026 15:17:58 +0200
Subject: [PATCH 234/344] fs: read small files in one thread pool round trip

fs.readFile(path) took four libuv thread pool round trips for a typical
small file -- open, fstat, read and close, each its own uv_fs request
with its own queue wait, completion callback and JS/C++ crossing -- and
fs.promises.readFile(path) did the same through a FileHandle. For the
small files applications read most, the round trips are the cost, and
each occupies a slot in the pool that concurrent dns.lookup(), fs and
crypto work is also queueing for.

Add ReadFileJob (an AsyncWrap + ThreadPoolWork) that performs
open + fstat + read-to-EOF + close as one pool task and reports the
whole content, or, when the file turns out to be larger than one chunk
(kReadFileBufferLength, 512 KiB), stops after fstat() and hands the fd
and size back so that the existing chunked reader continues unchanged
(large reads stay interleaved and abortable between chunks, and still
save the fstat round trip). fs.readFile() and fs.promises.readFile()
use it for path arguments without a user buffer; file descriptors,
FileHandles, options.buffer and an active VFS keep their paths.

Behavior is otherwise kept: same bytes for every size and encoding;
open failures report syscall 'open' with the path, read failures
'read'; permission errors are delivered through the callback/promise
as before; an abort that arrives while the read is in flight still
wins; the job is an FSREQCALLBACK resource for async_hooks; a handed
back fd is tracked exactly like one from a plain open().

Tests that asserted the internal open/fstat/read/close request chain,
used readFile() as a proxy for an fstat trace event, or injected
faults through FileHandle.prototype for path-based reads are adjusted
to keep testing what they test (a file just over one chunk where the
chain shape matters, fs.fstat() for the fstat trace, a larger file so
the FileHandle path is taken).

fs.readFile() of 4 KiB files at concurrency 64 goes from ~51k to ~306k
files per second, and a mixed stat/readFile/dns.lookup burst from ~66k
to ~312k operations per second.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65327
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/fs.js                                     |  64 +++-
 lib/internal/fs/promises.js                   |  67 +++-
 src/node_file.cc                              | 290 ++++++++++++++++++
 .../test-async-exec-resource-match.js         |   4 +-
 .../test-fsreqcallback-readFile.js            |  19 +-
 test/async-hooks/test-graph.fsreq-readFile.js |  11 +-
 ...s-promises-file-handle-aggregate-errors.js |   5 +-
 ...st-fs-promises-file-handle-close-errors.js |   5 +-
 .../test-fs-promises-file-handle-op-errors.js |   5 +-
 test/parallel/test-fs-promises-readfile.js    |  16 +-
 .../test-fs-readfile-one-roundtrip.js         | 153 +++++++++
 test/parallel/test-trace-events-fs-async.js   |   4 +-
 12 files changed, 613 insertions(+), 30 deletions(-)
 create mode 100644 test/parallel/test-fs-readfile-one-roundtrip.js

diff --git a/lib/fs.js b/lib/fs.js
index 81c4d2b9c884..cfed38d8127e 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -81,6 +81,7 @@ const {
 
 const {
   FSReqCallback,
+  ReadFileJob,
 } = binding;
 const { toPathIfFileURL } = require('internal/url');
 const {
@@ -98,6 +99,7 @@ const {
 const {
   constants: {
     kIoMaxLength,
+    kReadFileBufferLength,
     kMaxUserId,
   },
   copyObject,
@@ -428,10 +430,70 @@ function readFile(path, options, callback) {
     return;
 
   const flagsNumber = stringToFlags(options.flag, 'options.flag');
+  path = getValidatedPath(path);
+  if (options.buffer === undefined) {
+    // Open + fstat + read + close in one thread pool round trip for files of
+    // up to one chunk; larger files come back as an open fd + size and take
+    // the chunked reader below (readFileAfterOneShot). `true`: a handed-back
+    // fd will be closed through fs.close(), so track it as unmanaged.
+    const job = new ReadFileJob(path, flagsNumber, kReadFileBufferLength, true);
+    job.context = context;
+    job.ondone = readFileAfterOneShot;
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      // Not scheduled: report it the way the request-based open() did.
+      callback(accessError);
+    }
+    return;
+  }
   const req = new FSReqCallback();
   req.context = context;
   req.oncomplete = readFileAfterOpen;
-  binding.open(getValidatedPath(path), flagsNumber, 0o666, req);
+  binding.open(path, flagsNumber, 0o666, req);
+}
+
+function readFileAfterOneShot(err, buffer, fd, size, closeErr) {
+  const context = this.context;
+  if (err) {
+    context.callback(err);
+    return;
+  }
+  if (fd !== -1) {
+    // (context.read() below performs the abort check for this case.)
+    // Larger than one chunk: continue exactly like after open + fstat.
+    context.fd = fd;
+    context.size = size;
+    if (size > kIoMaxLength) {
+      return context.close(new ERR_FS_FILE_TOO_LARGE(size));
+    }
+    try {
+      context.prepare();
+    } catch (err) {
+      return context.close(err);
+    }
+    context.read();
+    return;
+  }
+  if (closeErr) {
+    context.callback(closeErr);
+    return;
+  }
+  if (context.signal?.aborted) {
+    // An abort that arrived while the read was in flight wins, as it did when
+    // it was noticed between the open/fstat/read steps.
+    context.callback(new AbortError(undefined, { cause: context.signal.reason }));
+    return;
+  }
+  let result = buffer;
+  if (context.encoding) {
+    try {
+      result = buffer.toString(context.encoding);
+    } catch (err) {
+      context.callback(err);
+      return;
+    }
+  }
+  context.callback(null, result);
 }
 
 function tryStatSync(fd, isUserFd) {
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index 3e336024a15a..d571de820ced 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -1211,26 +1211,32 @@ async function readFileHandleWithUserBuffer(filehandle, options, size) {
   return encoding ? buffer.toString(encoding) : buffer.subarray(0, totalRead);
 }
 
-async function readFileHandle(filehandle, options) {
+async function readFileHandle(filehandle, options, knownRegularFileSize) {
   const signal = options?.signal;
   const encoding = options?.encoding;
   const decoder = encoding && new StringDecoder(encoding);
 
   checkAborted(signal);
 
-  const statFields = await PromisePrototypeThen(
-    binding.fstat(filehandle.fd, false, kUsePromises),
-    undefined,
-    handleErrorFromBinding,
-  );
-
-  checkAborted(signal);
-
   let size = 0;
   let length = 0;
-  if ((statFields[1/* mode */] & S_IFMT) === S_IFREG) {
-    size = statFields[8/* size */];
+  if (knownRegularFileSize !== undefined) {
+    // Handed over by readFile() together with an already open fd.
+    size = knownRegularFileSize;
     length = encoding ? MathMin(size, kReadFileBufferLength) : size;
+  } else {
+    const statFields = await PromisePrototypeThen(
+      binding.fstat(filehandle.fd, false, kUsePromises),
+      undefined,
+      handleErrorFromBinding,
+    );
+
+    checkAborted(signal);
+
+    if ((statFields[1/* mode */] & S_IFMT) === S_IFREG) {
+      size = statFields[8/* size */];
+      length = encoding ? MathMin(size, kReadFileBufferLength) : size;
+    }
   }
   if (length === 0) {
     length = kReadFileUnknownBufferLength;
@@ -2146,10 +2152,49 @@ async function readFile(path, options) {
 
   checkAborted(options.signal);
 
+  if (options.buffer === undefined && vfsState.handlers === null) {
+    // Open + fstat + read + close in one thread pool round trip for files of
+    // up to one chunk; larger files come back as an open fd + size and are
+    // read by readFileHandle() as before.
+    path = getValidatedPath(path);
+    const { 0: buffer, 1: fd, 2: size } = await readFileInOneRoundTrip(path, stringToFlags(flag));
+    if (fd === -1) {
+      checkAborted(options.signal);  // An abort during the read still wins.
+      return options.encoding ? buffer.toString(options.encoding) : buffer;
+    }
+    const filehandle = new FileHandle(new binding.FileHandle(fd));
+    return handleFdClose(readFileHandle(filehandle, options, size), filehandle.close);
+  }
+
   const fd = await open(path, flag, 0o666);
   return handleFdClose(readFileHandle(fd, options), fd.close);
 }
 
+/**
+ * @param {string|Buffer} path Validated path
+ * @param {number} flagsNumber
+ * @returns {Promise<[Buffer|undefined, number, number|undefined]>} [buffer, -1] or [undefined, fd, size]
+ */
+function readFileInOneRoundTrip(path, flagsNumber) {
+  return new Promise((resolve, reject) => {
+    const job = new binding.ReadFileJob(path, flagsNumber, kReadFileBufferLength);
+    job.ondone = (err, buffer, fd, size, closeErr) => {
+      const error = err ?? closeErr;
+      if (error != null) {
+        ErrorCaptureStackTrace(error, readFileInOneRoundTrip);
+        reject(error);
+      } else {
+        resolve([buffer, fd, size]);
+      }
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      ErrorCaptureStackTrace(accessError, readFileInOneRoundTrip);
+      reject(accessError);
+    }
+  });
+}
+
 async function* _watch(filename, options = kEmptyObject) {
   const h = vfsState.handlers;
   if (h !== null) {
diff --git a/src/node_file.cc b/src/node_file.cc
index ae0d9f34f8e1..776384f7e426 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -40,6 +40,7 @@
 #include "req_wrap-inl.h"
 #include "stream_base-inl.h"
 #include "string_bytes.h"
+#include "threadpoolwork-inl.h"
 #include "uv.h"
 #include "v8-fast-api-calls.h"
 
@@ -78,6 +79,7 @@ using v8::LocalVector;
 using v8::Maybe;
 using v8::MaybeLocal;
 using v8::Nothing;
+using v8::Null;
 using v8::Number;
 using v8::Object;
 using v8::ObjectTemplate;
@@ -2952,6 +2954,284 @@ static void ReadFileUtf8(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(val);
 }
 
+// Reads a whole (small) file in ONE thread pool round trip -- open + fstat +
+// read + close -- instead of one round trip per step, which is what dominates
+// fs.readFile() for the typical small file and multiplies thread pool
+// contention when many files are read at once. Files whose size exceeds
+// `limit` are not read here: the job hands the open fd and the size back so
+// that the caller continues with the chunked reader (which stays fair and
+// abortable for large files); it then only saved the fstat() round trip.
+//
+// JS: const job = new ReadFileJob(path, flags, limit, trackFd);
+//     job.ondone = (err, buffer, fd, size, closeErr) => {...}; job.run(path);
+// Exactly one of these outcomes is reported:
+//   err            -- open/fstat/read failed (any fd opened here was closed);
+//   fd >= 0, size  -- file is larger than `limit`: caller owns fd now (it is
+//                     registered as an unmanaged fd iff trackFd, i.e. when the
+//                     caller will close it through fs.close() rather than a
+//                     FileHandle);
+//   buffer         -- the whole content; closeErr set if only close() failed.
+class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_GE(args.Length(), 3);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    CHECK(args[1]->IsInt32());
+    CHECK(args[2]->IsNumber());
+    const int flags = args[1].As<Int32>()->Value();
+    const double limit = args[2].As<Number>()->Value();
+    const bool track_fd = args.Length() > 3 && args[3]->IsTrue();
+    new ReadFileJob(env,
+                    args.This(),
+                    path.ToString(),
+                    flags,
+                    limit < 0 ? 0 : static_cast<uint64_t>(limit),
+                    track_fd);
+  }
+
+  // Returns undefined when the job was scheduled, or the ERR_ACCESS_DENIED
+  // error the asynchronous open() would have delivered through its request
+  // (nothing is scheduled then; the caller passes it to the callback).
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    ReadFileJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    Environment* env = job->AsyncWrap::env();
+    CHECK(!job->scheduled_);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    Local<Value> access_error;
+    if (OpenPermissionError(env, path, job->flags_).ToLocal(&access_error)) {
+      args.GetReturnValue().Set(access_error);
+      return;
+    }
+    job->scheduled_ = true;
+    // Keep the wrapper alive while the work is in flight.
+    job->ClearWeak();
+    FS_ASYNC_TRACE_BEGIN0(UV_FS_READ, job)
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    uv_fs_t req;
+    int fd = uv_fs_open(nullptr, &req, path_.c_str(), flags_, 0666, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (fd < 0) return Fail("open", fd);
+
+    int rc = uv_fs_fstat(nullptr, &req, fd, nullptr);
+    if (rc < 0) {
+      uv_fs_req_cleanup(&req);
+      Fail("fstat", rc);
+      CloseQuietly(fd);
+      return;
+    }
+    const uv_stat_t* const st = static_cast<const uv_stat_t*>(req.ptr);
+    const bool regular = (st->st_mode & S_IFMT) == S_IFREG;
+    const uint64_t size = regular ? static_cast<uint64_t>(st->st_size) : 0;
+    uv_fs_req_cleanup(&req);
+
+    if (size > limit_) {
+      // Too large to read in one go here: hand the fd back.
+      fd_ = fd;
+      size_ = size;
+      return;
+    }
+
+    // Known size: read exactly that much (like the chunked reader, stop when
+    // it has been read or at EOF, whichever comes first). Unknown size (0,
+    // e.g. procfs): grow until EOF.
+    size_t cap = size > 0 ? static_cast<size_t>(size) : kUnknownSizeChunk;
+    data_ = UncheckedMalloc<char>(cap);
+    if (data_ == nullptr) {
+      Fail("read", UV_ENOMEM);
+      CloseQuietly(fd);
+      return;
+    }
+    while (true) {
+      if (len_ == cap) {
+        if (size > 0) break;  // Read all of the announced size.
+        // A file that claims size 0 keeps growing until EOF (or ENOMEM),
+        // like the chunked reader's buffer list did.
+        size_t new_cap = cap * 2;
+        char* grown = UncheckedRealloc<char>(data_, new_cap);
+        if (grown == nullptr) {
+          Fail("read", UV_ENOMEM);
+          break;
+        }
+        data_ = grown;
+        cap = new_cap;
+      }
+      uv_buf_t buf = uv_buf_init(data_ + len_,
+                                 static_cast<unsigned int>(std::min<size_t>(
+                                     cap - len_, kMaxReadChunk)));
+      int r = uv_fs_read(nullptr, &req, fd, &buf, 1, -1, nullptr);
+      uv_fs_req_cleanup(&req);
+      if (r < 0) {
+        Fail("read", r);
+        break;
+      }
+      if (r == 0) break;
+      len_ += static_cast<size_t>(r);
+    }
+
+    rc = uv_fs_close(nullptr, &req, fd, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (rc < 0) close_error_ = rc;
+    if (error_ != 0) {
+      free(data_);
+      data_ = nullptr;
+      len_ = 0;
+    } else if (cap - len_ >= 4096) {
+      // Do not retain the slack of a size-0 (grown) or short file.
+      char* shrunk = UncheckedRealloc<char>(data_, len_ > 0 ? len_ : 1);
+      if (shrunk != nullptr) data_ = shrunk;
+    }
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<ReadFileJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    FS_ASYNC_TRACE_END0(UV_FS_READ, this)
+    if (status == UV_ECANCELED) {
+      if (fd_ >= 0) CloseQuietly(fd_);
+      return;
+    }
+    if (!env->can_call_into_js()) {
+      if (fd_ >= 0) CloseQuietly(fd_);
+      return;
+    }
+    HandleScope handle_scope(env->isolate());
+    Context::Scope context_scope(env->context());
+    Isolate* isolate = env->isolate();
+
+    Local<Value> argv[5] = {Null(isolate),
+                            Undefined(isolate),
+                            Integer::New(isolate, -1),
+                            Undefined(isolate),
+                            Undefined(isolate)};
+    if (error_ != 0) {
+      argv[0] = UVException(isolate, error_, syscall_, nullptr, path_.c_str());
+    } else if (fd_ >= 0) {
+      if (track_fd_) env->AddUnmanagedFd(fd_);
+      argv[2] = Integer::New(isolate, fd_);
+      argv[3] = Number::New(isolate, static_cast<double>(size_));
+      fd_ = -1;
+    } else {
+      Local<Object> buffer;
+      char* data = data_;
+      data_ = nullptr;
+      if (!Buffer::New(env, data, len_).ToLocal(&buffer)) {
+        // Buffer::New took ownership of data either way.
+        argv[0] = ERR_MEMORY_ALLOCATION_FAILED(isolate);
+      } else {
+        argv[1] = buffer;
+      }
+      if (close_error_ != 0) {
+        argv[4] = UVException(isolate, close_error_, "close");
+      }
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  ~ReadFileJob() override {
+    free(data_);
+    if (fd_ >= 0) CloseQuietly(fd_);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(ReadFileJob)
+  SET_SELF_SIZE(ReadFileJob)
+
+ private:
+  static constexpr size_t kUnknownSizeChunk = 64 * 1024;
+  static constexpr size_t kMaxReadChunk = 256 * 1024 * 1024;
+
+  ReadFileJob(Environment* env,
+              Local<Object> object,
+              std::string&& path,
+              int flags,
+              uint64_t limit,
+              bool track_fd)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.readfile"),
+        path_(std::move(path)),
+        limit_(limit),
+        flags_(flags),
+        track_fd_(track_fd) {
+    MakeWeak();
+  }
+
+  void Fail(const char* syscall, int error) {
+    syscall_ = syscall;
+    error_ = error;
+  }
+
+  // The permission checks AsyncCheckOpenPermissions() performs for open(),
+  // producing the error object instead of rejecting a request wrap.
+  static MaybeLocal<Value> OpenPermissionError(Environment* env,
+                                               const BufferValue& path,
+                                               int flags) {
+    if (!env->permission()->enabled()) [[likely]]
+      return {};
+    const int rwflags =
+        flags & (UV_FS_O_RDONLY | UV_FS_O_WRONLY | UV_FS_O_RDWR);
+    const int write_as_side_effect =
+        flags &
+        (UV_FS_O_APPEND | UV_FS_O_CREAT | UV_FS_O_TRUNC | UV_FS_O_TEMPORARY);
+    const auto path_view = path.ToStringView();
+    auto denied = [&](permission::PermissionScope scope) -> MaybeLocal<Value> {
+      if (env->permission()->is_granted(env, scope, path_view) ||
+          env->permission()->warning_only()) {
+        return {};
+      }
+      Local<Value> err;
+      if (permission::CreateAccessDeniedError(env, scope, path_view)
+              .ToLocal(&err)) {
+        return err;
+      }
+      return Integer::New(env->isolate(), UV_EACCES);
+    };
+    if (rwflags != UV_FS_O_WRONLY) {
+      MaybeLocal<Value> err =
+          denied(permission::PermissionScope::kFileSystemRead);
+      if (!err.IsEmpty()) return err;
+    }
+    if (rwflags != UV_FS_O_RDONLY || write_as_side_effect) {
+      MaybeLocal<Value> err =
+          denied(permission::PermissionScope::kFileSystemWrite);
+      if (!err.IsEmpty()) return err;
+    }
+    return {};
+  }
+
+  static void CloseQuietly(int fd) {
+    uv_fs_t req;
+    uv_fs_close(nullptr, &req, fd, nullptr);
+    uv_fs_req_cleanup(&req);
+  }
+
+  // Inputs.
+  std::string path_;
+  uint64_t limit_;
+  int flags_;
+  bool track_fd_;
+  bool scheduled_ = false;
+  // Results (written on the thread pool thread, read on the loop thread).
+  uint64_t size_ = 0;
+  size_t len_ = 0;
+  char* data_ = nullptr;
+  const char* syscall_ = nullptr;
+  int error_ = 0;
+  int close_error_ = 0;
+  int fd_ = -1;
+};
+
 // Wrapper for readv(2).
 //
 // bytesRead = fs.readv(fd, buffers[, position], callback)
@@ -4259,6 +4539,14 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
       Integer::New(isolate,
                    static_cast<int32_t>(FsStatsOffset::kFsStatsFieldsNumber)));
 
+  // Create FunctionTemplate for ReadFileJob
+  Local<FunctionTemplate> rfj = NewFunctionTemplate(isolate, ReadFileJob::New);
+  rfj->InstanceTemplate()->SetInternalFieldCount(
+      ReadFileJob::kInternalFieldCount);
+  rfj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, rfj, "run", ReadFileJob::Run);
+  SetConstructorFunction(isolate, target, "ReadFileJob", rfj);
+
   // Create FunctionTemplate for FSReqCallback
   Local<FunctionTemplate> fst = NewFunctionTemplate(isolate, NewFSReqCallback);
   fst->InstanceTemplate()->SetInternalFieldCount(
@@ -4330,6 +4618,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(Close);
   registry->Register(ExistsSync);
   registry->Register(Open);
+  registry->Register(ReadFileJob::New);
+  registry->Register(ReadFileJob::Run);
   registry->Register(OpenFileHandle);
   registry->Register(Read);
   registry->Register(ReadFileUtf8);
diff --git a/test/async-hooks/test-async-exec-resource-match.js b/test/async-hooks/test-async-exec-resource-match.js
index 6174768ba768..0b68b30ffa93 100644
--- a/test/async-hooks/test-async-exec-resource-match.js
+++ b/test/async-hooks/test-async-exec-resource-match.js
@@ -12,7 +12,9 @@ const {
 // Ignore any asyncIds created before our hook is active.
 let firstSeenAsyncId = -1;
 const idResMap = new Map();
-const numExpectedCalls = 5;
+// The AsyncResource below plus at least one FSREQCALLBACK from readFile()
+// (a small file is read in a single request).
+const numExpectedCalls = 2;
 
 createHook({
   init: common.mustCallAtLeast(
diff --git a/test/async-hooks/test-fsreqcallback-readFile.js b/test/async-hooks/test-fsreqcallback-readFile.js
index 65f3652f12f9..fb84306cfa86 100644
--- a/test/async-hooks/test-fsreqcallback-readFile.js
+++ b/test/async-hooks/test-fsreqcallback-readFile.js
@@ -18,7 +18,12 @@ hooks.enable();
 fs.readFile(__filename, common.mustCall(onread));
 
 function onread() {
+  // fs.readFile() of a small file is a single request (open + fstat + read +
+  // close in one thread pool round trip); larger files continue with one
+  // request per chunk. Either way each request is an FSREQCALLBACK triggered
+  // by the previous one (or by the top-level for the first).
   const as = hooks.activitiesOfTypes('FSREQCALLBACK');
+  assert.ok(as.length >= 1);
   let lastParent = 1;
   for (let i = 0; i < as.length; i++) {
     const a = as[i];
@@ -27,17 +32,15 @@ function onread() {
     assert.strictEqual(a.triggerAsyncId, lastParent);
     lastParent = a.uid;
   }
-  checkInvocations(as[0], { init: 1, before: 1, after: 1, destroy: 1 },
-                   'reqwrap[0]: while in onread callback');
-  checkInvocations(as[1], { init: 1, before: 1, after: 1, destroy: 1 },
-                   'reqwrap[1]: while in onread callback');
-  checkInvocations(as[2], { init: 1, before: 1, after: 1, destroy: 1 },
-                   'reqwrap[2]: while in onread callback');
+  for (let i = 0; i < as.length - 1; i++) {
+    checkInvocations(as[i], { init: 1, before: 1, after: 1, destroy: 1 },
+                     `reqwrap[${i}]: while in onread callback`);
+  }
 
   // This callback is called from within the last fs req callback therefore
   // the last req is still going and after/destroy haven't been called yet
-  checkInvocations(as[3], { init: 1, before: 1 },
-                   'reqwrap[3]: while in onread callback');
+  checkInvocations(as[as.length - 1], { init: 1, before: 1 },
+                   `reqwrap[${as.length - 1}]: while in onread callback`);
   tick(2);
 }
 
diff --git a/test/async-hooks/test-graph.fsreq-readFile.js b/test/async-hooks/test-graph.fsreq-readFile.js
index 543ce68aa736..39435cdc4891 100644
--- a/test/async-hooks/test-graph.fsreq-readFile.js
+++ b/test/async-hooks/test-graph.fsreq-readFile.js
@@ -5,10 +5,19 @@ const initHooks = require('./init-hooks');
 const verifyGraph = require('./verify-graph');
 const fs = require('fs');
 
+const tmpdir = require('../common/tmpdir');
+
+// A file just over one read chunk (512 KiB): the first request opens, stats
+// and hands the fd back, then two chunked reads and a close follow, each
+// triggered by the previous request. (Smaller files are a single request.)
+tmpdir.refresh();
+const file = tmpdir.resolve('graph-readfile.bin');
+fs.writeFileSync(file, Buffer.alloc(512 * 1024 + 1, 'x'));
+
 const hooks = initHooks();
 
 hooks.enable();
-fs.readFile(__filename, common.mustCall(onread));
+fs.readFile(file, common.mustCall(onread));
 
 function onread() {}
 
diff --git a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
index f53ce1eeaf0d..36ebc23491ca 100644
--- a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
@@ -23,7 +23,10 @@ const originalFd = Object.getOwnPropertyDescriptor(FileHandle.prototype, 'fd');
 let count = 0;
 async function createFile() {
   const filePath = tmpdir.resolve(`aggregate_errors_${++count}.txt`);
-  await writeFile(filePath, 'content');
+  // Larger than one read chunk (512 KiB), so that readFile(path) reads it
+  // through a FileHandle (small files are read in a single native round trip
+  // that does not involve FileHandle.prototype).
+  await writeFile(filePath, 'content'.repeat(100_000));
   return filePath;
 }
 
diff --git a/test/parallel/test-fs-promises-file-handle-close-errors.js b/test/parallel/test-fs-promises-file-handle-close-errors.js
index 8d0a1bad4605..901e71c15ac5 100644
--- a/test/parallel/test-fs-promises-file-handle-close-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-close-errors.js
@@ -23,7 +23,10 @@ const originalFd = Object.getOwnPropertyDescriptor(FileHandle.prototype, 'fd');
 let count = 0;
 async function createFile() {
   const filePath = tmpdir.resolve(`close_errors_${++count}.txt`);
-  await writeFile(filePath, 'content');
+  // Larger than one read chunk (512 KiB), so that readFile(path) reads it
+  // through a FileHandle (small files are read in a single native round trip
+  // that does not involve FileHandle.prototype).
+  await writeFile(filePath, 'content'.repeat(100_000));
   return filePath;
 }
 
diff --git a/test/parallel/test-fs-promises-file-handle-op-errors.js b/test/parallel/test-fs-promises-file-handle-op-errors.js
index d87769cd7c47..46b4acd0b8ff 100644
--- a/test/parallel/test-fs-promises-file-handle-op-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-op-errors.js
@@ -23,7 +23,10 @@ const originalFd = Object.getOwnPropertyDescriptor(FileHandle.prototype, 'fd');
 let count = 0;
 async function createFile() {
   const filePath = tmpdir.resolve(`op_errors_${++count}.txt`);
-  await writeFile(filePath, 'content');
+  // Larger than one read chunk (512 KiB), so that readFile(path) reads it
+  // through a FileHandle (small files are read in a single native round trip
+  // that does not involve FileHandle.prototype).
+  await writeFile(filePath, 'content'.repeat(100_000));
   return filePath;
 }
 
diff --git a/test/parallel/test-fs-promises-readfile.js b/test/parallel/test-fs-promises-readfile.js
index ccf7aa16b12e..0efde29339c6 100644
--- a/test/parallel/test-fs-promises-readfile.js
+++ b/test/parallel/test-fs-promises-readfile.js
@@ -4,7 +4,7 @@
 const common = require('../common');
 
 const assert = require('assert');
-const { writeFile, readFile } = require('fs').promises;
+const { open, writeFile, readFile } = require('fs').promises;
 const tmpdir = require('../common/tmpdir');
 const { internalBinding } = require('internal/test/binding');
 const fsBinding = internalBinding('fs');
@@ -70,13 +70,21 @@ async function validateWrongSignalParam() {
 }
 
 async function validateZeroByteLiar() {
+  // readFile(path) sizes and reads small files natively (a lying size is
+  // handled there, see validateReadFileProc); the JS chunked reader that
+  // FileHandles use must cope with a file that claims size 0 as well.
   const originalFStat = fsBinding.fstat;
   fsBinding.fstat = common.mustCall(
     async () => (/* stat fields */ [0, 1, 2, 3, 4, 5, 6, 7, 0 /* size */])
   );
-  const readBuffer = await readFile(fn);
-  assert.strictEqual(readBuffer.toString(), largeBuffer.toString());
-  fsBinding.fstat = originalFStat;
+  const fh = await open(fn);
+  try {
+    const readBuffer = await readFile(fh);
+    assert.strictEqual(readBuffer.toString(), largeBuffer.toString());
+  } finally {
+    fsBinding.fstat = originalFStat;
+    await fh.close();
+  }
 }
 
 (async () => {
diff --git a/test/parallel/test-fs-readfile-one-roundtrip.js b/test/parallel/test-fs-readfile-one-roundtrip.js
new file mode 100644
index 000000000000..87df04795d8d
--- /dev/null
+++ b/test/parallel/test-fs-readfile-one-roundtrip.js
@@ -0,0 +1,153 @@
+'use strict';
+// fs.readFile()/fs.promises.readFile() read files of up to one chunk
+// (512 KiB) with a single thread pool round trip and hand larger files over
+// to the chunked reader. This pins the observable behaviour around that
+// boundary: contents, encodings, empty and size-misreporting files, error
+// shapes (which syscall failed), abort handling, flags, and that file
+// descriptors and user buffers keep taking their existing paths.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+const { promisify } = require('util');
+// Callback API through a promise, so both APIs can be awaited the same way.
+const readFileCb = promisify(fs.readFile);
+const async_hooks = require('async_hooks');
+
+tmpdir.refresh();
+
+const kChunk = 512 * 1024;
+const sizes = [0, 1, 4096, kChunk - 1, kChunk, kChunk + 1, 3 * kChunk + 17];
+const files = new Map();
+for (const size of sizes) {
+  const file = tmpdir.resolve(`f-${size}.bin`);
+  const buf = Buffer.alloc(size);
+  for (let i = 0; i < size; i++) buf[i] = (i * 31 + size) & 0xff;
+  fs.writeFileSync(file, buf);
+  files.set(size, { file, buf });
+}
+const textFile = tmpdir.resolve('text.txt');
+const text = 'héllo wörld ✓ \u{1F600}\n'.repeat(1000);
+fs.writeFileSync(textFile, text);
+
+async function main() {
+  // Contents across the one-shot / chunked boundary, both APIs.
+  for (const [size, { file, buf }] of files) {
+    assert.deepStrictEqual(await fs.promises.readFile(file), buf, `promises size=${size}`);
+    assert.deepStrictEqual(await new Promise((res, rej) => fs.readFile(file, (e, d) => (e ? rej(e) : res(d)))), buf,
+                           `callback size=${size}`);
+    // Explicit flags (string and numeric).
+    assert.deepStrictEqual(await fs.promises.readFile(file, { flag: 'r' }), buf);
+    assert.deepStrictEqual(await readFileCb(file, { flag: fs.constants.O_RDONLY }), buf);
+  }
+
+  // Encodings.
+  assert.strictEqual(await fs.promises.readFile(textFile, 'utf8'), text);
+  assert.strictEqual(await fs.promises.readFile(textFile, { encoding: 'latin1' }),
+                     Buffer.from(text).toString('latin1'));
+  assert.strictEqual(await readFileCb(textFile, 'base64'), Buffer.from(text).toString('base64'));
+  fs.readFile(textFile, 'utf8', common.mustSucceed((d) => assert.strictEqual(d, text)));
+
+  // Errors keep their syscall/code/path shape.
+  const missing = tmpdir.resolve('does-not-exist');
+  for (const read of [() => fs.promises.readFile(missing),
+                      () => new Promise((res, rej) => fs.readFile(missing, (e) => (e ? rej(e) : res())))]) {
+    await assert.rejects(read, (err) => {
+      assert.strictEqual(err.code, 'ENOENT');
+      assert.strictEqual(err.syscall, 'open');
+      assert.strictEqual(err.path, missing);
+      assert.match(err.message, /ENOENT: no such file or directory, open/);
+      return true;
+    });
+  }
+  if (!common.isWindows && !common.isAIX && !common.isFreeBSD) {
+    // Reading a directory: open succeeds, read fails (as before: syscall 'read').
+    // (On AIX and FreeBSD a directory can be opened and read.)
+    for (const read of [() => fs.promises.readFile(tmpdir.path),
+                        () => new Promise((res, rej) => fs.readFile(tmpdir.path, (e) => (e ? rej(e) : res())))]) {
+      await assert.rejects(read, { code: 'EISDIR', syscall: 'read' });
+    }
+  }
+  // Abort: already-aborted signals reject before touching the file; both APIs.
+  {
+    const signal = AbortSignal.abort();
+    await assert.rejects(fs.promises.readFile(textFile, { signal }), { name: 'AbortError' });
+    await assert.rejects(readFileCb(textFile, { signal }), { name: 'AbortError' });
+    // Aborting during a large (chunked) read still works.
+    const ac = new AbortController();
+    const big = files.get(3 * kChunk + 17).file;
+    const p = fs.promises.readFile(big, { signal: ac.signal });
+    ac.abort();
+    await assert.rejects(p, { name: 'AbortError' });
+  }
+
+  // File descriptors and FileHandles keep working (they take the existing path).
+  {
+    const { file, buf } = files.get(4096);
+    const fd = fs.openSync(file, 'r');
+    assert.deepStrictEqual(await new Promise((res, rej) => fs.readFile(fd, (e, d) => (e ? rej(e) : res(d)))), buf);
+    fs.closeSync(fd);
+    const fh = await fs.promises.open(file, 'r');
+    assert.deepStrictEqual(await fh.readFile(), buf);
+    assert.deepStrictEqual(await fs.promises.readFile(fh), Buffer.alloc(0));  // Position is at EOF now.
+    await fh.close();
+  }
+
+  // Large files handed back to the chunked reader must not leak the fd:
+  // read one many times and make sure we can still open files afterwards.
+  {
+    const { file, buf } = files.get(kChunk + 1);
+    for (let i = 0; i < 64; i++) {
+      assert.strictEqual((await fs.promises.readFile(file)).length, buf.length);
+    }
+    await Promise.all(Array.from({ length: 64 }, () => readFileCb(file)));
+  }
+
+  // Files whose reported size is wrong (Linux procfs/sysfs) are read completely.
+  if (common.isLinux) {
+    for (const file of ['/proc/self/status', '/proc/self/maps', '/sys/kernel/mm/transparent_hugepage/enabled']) {
+      let sync;
+      try { sync = fs.readFileSync(file); } catch { continue; }
+      const viaPromise = await fs.promises.readFile(file);
+      const viaCallback = await new Promise((res, rej) => fs.readFile(file, (e, d) => (e ? rej(e) : res(d))));
+      if (file === '/sys/kernel/mm/transparent_hugepage/enabled') {
+        assert.deepStrictEqual(viaPromise, sync);
+        assert.deepStrictEqual(viaCallback, sync);
+      } else {
+        assert.ok(viaPromise.length > 100 && viaCallback.length > 100, file);
+        if (file === '/proc/self/maps') assert.ok(viaCallback.length > 4096);
+      }
+    }
+  }
+
+  // async_hooks see the read as an FSREQCALLBACK-typed resource with proper
+  // init/before/after/destroy, and the callback runs in that context.
+  {
+    const seen = new Map();
+    const hook = async_hooks.createHook({
+      init(id, type) { if (type === 'FSREQCALLBACK') seen.set(id, ['init']); },
+      before(id) { seen.get(id)?.push('before'); },
+      after(id) { seen.get(id)?.push('after'); },
+      destroy(id) { seen.get(id)?.push('destroy'); },
+    }).enable();
+    await new Promise((res) => fs.readFile(textFile, common.mustSucceed(() => {
+      assert.ok([...seen.keys()].includes(async_hooks.executionAsyncId()));
+      res();
+    })));
+    await new Promise((r) => setImmediate(r));
+    hook.disable();
+    const complete = [...seen.values()].some((events) => events.join() === 'init,before,after,destroy');
+    assert.ok(complete, JSON.stringify([...seen.values()]));
+  }
+
+  // options.buffer (user-supplied buffer) keeps its own path and semantics.
+  {
+    const { file, buf } = files.get(4096);
+    const target = Buffer.alloc(8192);
+    const result = await fs.promises.readFile(file, { buffer: target });
+    assert.strictEqual(result.buffer, target.buffer);
+    assert.deepStrictEqual(result, buf);
+  }
+}
+
+main().then(common.mustCall());
diff --git a/test/parallel/test-trace-events-fs-async.js b/test/parallel/test-trace-events-fs-async.js
index 04149dae2e72..9b8e21b3d560 100644
--- a/test/parallel/test-trace-events-fs-async.js
+++ b/test/parallel/test-trace-events-fs-async.js
@@ -91,7 +91,9 @@ function fdatasync() {
 function fstat() {
   const fs = require('fs');
   fs.writeFileSync('fs8.txt', '123', 'utf8');
-  fs.readFile('fs8.txt', () => {
+  const fd = fs.openSync('fs8.txt', 'r');
+  fs.fstat(fd, () => {
+    fs.closeSync(fd);
     fs.unlinkSync('fs8.txt');
   });
 }

From 43757d07c15c19aa339a2322015d441aaf4439d4 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Wed, 19 Aug 2026 15:18:11 +0200
Subject: [PATCH 235/344] module: cache nearest parent package.json per
 directory

getNearestParentPackageJSON() memoized its answer per file, so every
module loaded still made one native call, and TraverseParent() builds
several std::filesystem::path temporaries per directory level and
serializes the whole package.json, which the JS side then usually
discarded because it already had that package.json deserialized.

The native traversal starts at the directory of the given path, so the
answer only depends on that directory: key the memo by it (following
NormalizePath()'s trailing-separator rule), so that all modules in a
directory share one native call. When the permission model is enabled
the traversal also depends on the read permissions in effect at call
time, so that configuration keeps the per-file cache.

Loading a 1000-module tree spread over ~240 directories goes from 1000
to 236 native calls.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65326
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
---
 lib/internal/modules/package_json_reader.js   | 68 +++++++++++++------
 ...odule-nearest-parent-package-json-cache.js | 57 ++++++++++++++++
 2 files changed, 106 insertions(+), 19 deletions(-)
 create mode 100644 test/parallel/test-module-nearest-parent-package-json-cache.js

diff --git a/lib/internal/modules/package_json_reader.js b/lib/internal/modules/package_json_reader.js
index 6c6bf0383bc3..c33cf166f53b 100644
--- a/lib/internal/modules/package_json_reader.js
+++ b/lib/internal/modules/package_json_reader.js
@@ -23,7 +23,8 @@ const {
     ERR_MODULE_NOT_FOUND,
   },
 } = require('internal/errors');
-const { kEmptyObject } = require('internal/util');
+const { kEmptyObject, isWindows } = require('internal/util');
+const permission = require('internal/process/permission');
 const modulesBinding = internalBinding('modules');
 const path = require('path');
 const { validateString } = require('internal/validators');
@@ -140,10 +141,18 @@ function read(jsonPath, { base, specifier, isESM } = kEmptyObject) {
 }
 
 /**
- * A cache mapping a module's path to its parent `package.json` file's path.
- * This is used in concert with `deserializedPackageJSONCache` to improve
- * the performance of `getNearestParentPackageJSON` when called repeatedly
- * on the same module paths.
+ * A cache mapping a directory to the path of the nearest `package.json` at or
+ * above it (`null` when there is none). The native traversal for a module
+ * starts at the module's directory, so every module in a directory shares one
+ * entry and one native call. Used in concert with
+ * `deserializedPackageJSONCache`.
+ */
+const directoryToParentPackageJSONPathCache = new SafeMap();
+
+/**
+ * When the permission model is enabled the native traversal also depends on
+ * the read permissions in effect at the time of the call, so results are only
+ * remembered per exact module path, as before.
  */
 const moduleToParentPackageJSONCache = new SafeMap();
 
@@ -158,6 +167,21 @@ const moduleToParentPackageJSONCache = new SafeMap();
  */
 const deserializedPackageJSONCache = new SafeMap();
 
+/**
+ * The directory the native nearest-parent traversal starts from for `checkPath`
+ * (see BindingData::NormalizePath/TraverseParent): the path itself when it has
+ * a trailing separator, its dirname otherwise.
+ * @param {string} checkPath
+ * @returns {string}
+ */
+function getTraversalStartDirectory(checkPath) {
+  const last = checkPath[checkPath.length - 1];
+  if (last === '/' || (isWindows && last === '\\')) {
+    return StringPrototypeSlice(checkPath, 0, -1);
+  }
+  return path.dirname(checkPath);
+}
+
 /**
  * Get the nearest parent package.json file from a given path.
  * Return the package.json data and the path to the package.json file, or undefined.
@@ -165,23 +189,29 @@ const deserializedPackageJSONCache = new SafeMap();
  * @returns {undefined | DeserializedPackageConfig}
  */
 function getNearestParentPackageJSON(checkPath) {
-  const parentPackageJSONPath = moduleToParentPackageJSONCache.get(checkPath);
-  if (parentPackageJSONPath !== undefined) {
-    return deserializedPackageJSONCache.get(parentPackageJSONPath);
+  const permissionEnabled = permission.isEnabled();
+  const cache = permissionEnabled ? moduleToParentPackageJSONCache : directoryToParentPackageJSONPathCache;
+  const key = permissionEnabled ? checkPath : getTraversalStartDirectory(checkPath);
+  let parentPackageJSONPath = cache.get(key);
+  if (parentPackageJSONPath === undefined) {
+    const result = modulesBinding.getNearestParentPackageJSON(checkPath);
+    if (result === undefined) {
+      parentPackageJSONPath = null;
+    } else {
+      const packageConfig = deserializePackageJSON(checkPath, result);
+      parentPackageJSONPath = packageConfig.path;
+      if (!deserializedPackageJSONCache.has(parentPackageJSONPath)) {
+        deserializedPackageJSONCache.set(parentPackageJSONPath, packageConfig);
+      }
+    }
+    cache.set(key, parentPackageJSONPath);
   }
 
-  const result = modulesBinding.getNearestParentPackageJSON(checkPath);
-  const packageConfig = deserializePackageJSON(checkPath, result);
-
-  moduleToParentPackageJSONCache.set(checkPath, packageConfig.path);
-
-  const maybeCachedPackageConfig = deserializedPackageJSONCache.get(packageConfig.path);
-  if (maybeCachedPackageConfig !== undefined) {
-    return maybeCachedPackageConfig;
+  if (parentPackageJSONPath === null) {
+    // No package.json above this path: same shape as before, carrying the queried path.
+    return deserializePackageJSON(checkPath, undefined);
   }
-
-  deserializedPackageJSONCache.set(packageConfig.path, packageConfig);
-  return packageConfig;
+  return deserializedPackageJSONCache.get(parentPackageJSONPath);
 }
 
 /**
diff --git a/test/parallel/test-module-nearest-parent-package-json-cache.js b/test/parallel/test-module-nearest-parent-package-json-cache.js
new file mode 100644
index 000000000000..3d818c9fe1d9
--- /dev/null
+++ b/test/parallel/test-module-nearest-parent-package-json-cache.js
@@ -0,0 +1,57 @@
+'use strict';
+// Flags: --expose-internals
+// The nearest parent package.json lookup that every CommonJS module load
+// performs is answered once per directory, not once per file.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { internalBinding } = require('internal/test/binding');
+const packageJsonReader = require('internal/modules/package_json_reader');
+
+tmpdir.refresh();
+const root = tmpdir.resolve('pkg');
+const sub = path.join(root, 'lib', 'sub');
+fs.mkdirSync(sub, { recursive: true });
+fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'pkg', type: 'commonjs' }));
+const files = [];
+for (const dir of [path.join(root, 'lib'), sub]) {
+  for (let i = 0; i < 5; i++) {
+    const file = path.join(dir, `m${i}.js`);
+    fs.writeFileSync(file, 'module.exports = __filename;');
+    files.push(file);
+  }
+}
+
+const modulesBinding = internalBinding('modules');
+const original = modulesBinding.getNearestParentPackageJSON;
+const calls = [];
+modulesBinding.getNearestParentPackageJSON = common.mustCallAtLeast((checkPath) => {
+  calls.push(checkPath);
+  return original(checkPath);
+}, 1);
+
+for (const file of files) {
+  assert.strictEqual(require(file), file);
+}
+// Ten modules in two directories: two lookups reach the binding.
+assert.strictEqual(calls.length, 2, `binding called for: ${calls.join(', ')}`);
+
+// Same answer (and the same object) for every file of a directory, and for
+// the directory itself when asked with a trailing separator.
+const viaFile = packageJsonReader.getNearestParentPackageJSON(files[0]);
+assert.strictEqual(viaFile.data.name, 'pkg');
+assert.strictEqual(packageJsonReader.getNearestParentPackageJSON(files[1]), viaFile);
+assert.strictEqual(packageJsonReader.getNearestParentPackageJSON(path.join(root, 'lib') + path.sep), viaFile);
+assert.strictEqual(calls.length, 2);
+
+// A directory that has not been seen yet is looked up once more.
+const other = path.join(root, 'other');
+fs.mkdirSync(other);
+fs.writeFileSync(path.join(other, 'x.js'), '');
+assert.strictEqual(packageJsonReader.getNearestParentPackageJSON(path.join(other, 'x.js')).data.name, 'pkg');
+assert.strictEqual(packageJsonReader.getNearestParentPackageJSON(path.join(other, 'y.js')).data.name, 'pkg');
+assert.strictEqual(calls.length, 3);
+
+modulesBinding.getNearestParentPackageJSON = original;

From 537feecd0b9d30e5f61b29f0c65137b1a96a93ef Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Wed, 19 Aug 2026 07:15:47 -0700
Subject: [PATCH 236/344] ffi: reject direct SharedArrayBuffer pointers

Reject direct SharedArrayBuffer pointer arguments in the JavaScript
wrapper and native fast-buffer helper. This keeps validation behavior
consistent before and after optimization.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65233
Fixes: https://github.com/nodejs/node/issues/65232
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 lib/internal/ffi/fast-api.js     |  5 ++---
 src/ffi/fast.cc                  | 10 ++++------
 test/ffi/test-ffi-fast-buffer.js | 31 ++++++++++++++++++++++++++++++-
 3 files changed, 36 insertions(+), 10 deletions(-)

diff --git a/lib/internal/ffi/fast-api.js b/lib/internal/ffi/fast-api.js
index 4355ab1a992f..4b531dfe039a 100644
--- a/lib/internal/ffi/fast-api.js
+++ b/lib/internal/ffi/fast-api.js
@@ -18,7 +18,6 @@ const {
 } = require('buffer');
 
 const {
-  isAnyArrayBuffer,
   isArrayBuffer,
   isArrayBufferView,
   isDataView,
@@ -130,7 +129,7 @@ function hasStringPointerArg(type, value) {
 
 function hasPointerMemoryArg(type, value) {
   return (needsRawPointerConversion(type) || needsStringPointerConversion(type)) &&
-         (isArrayBufferView(value) || isAnyArrayBuffer(value));
+         (isArrayBufferView(value) || isArrayBuffer(value));
 }
 
 function enterStringConversion(state) {
@@ -307,7 +306,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
         } finally {
           exitStringConversion(stringState);
         }
-      } else if (memory0 && (isArrayBufferView(arg) || isAnyArrayBuffer(arg))) {
+      } else if (memory0 && (isArrayBufferView(arg) || isArrayBuffer(arg))) {
         if (fastBufferInvoke !== undefined) {
           return fastBufferInvoke(arg);
         }
diff --git a/src/ffi/fast.cc b/src/ffi/fast.cc
index 919bacf061a8..8e92c56aebb7 100644
--- a/src/ffi/fast.cc
+++ b/src/ffi/fast.cc
@@ -248,9 +248,10 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
   constexpr uintptr_t kInvalidBuffer = std::numeric_limits<uintptr_t>::max();
   v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
-  // Accept only memory-backed JS values in the native helper. Other pointer
-  // conversions, including strings, stay in the JS wrapper so their temporary
-  // lifetime is explicit.
+  // Accept only the memory-backed JS values supported by ToFFIArgument in the
+  // native helper. Other pointer conversions, including strings and direct
+  // SharedArrayBuffers, stay in the JS wrapper so validation and temporary
+  // lifetimes match the generic path.
   if (value->IsArrayBufferView()) {
     v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
     if (view->Buffer()->WasDetached()) {
@@ -281,9 +282,6 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
     }
     return PointerFromValue(value);
   }
-  if (value->IsSharedArrayBuffer()) {
-    return PointerFromValue(value);
-  }
 
   if (isolate != nullptr) {
     // No HandleScope is active during a Fast API call, so open one before
diff --git a/test/ffi/test-ffi-fast-buffer.js b/test/ffi/test-ffi-fast-buffer.js
index 173ee29a32f1..add25a27f4e4 100644
--- a/test/ffi/test-ffi-fast-buffer.js
+++ b/test/ffi/test-ffi-fast-buffer.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-internals
+// Flags: --experimental-ffi --expose-internals --allow-natives-syntax
 'use strict';
 
 const common = require('../common');
@@ -70,6 +70,35 @@ test('fast FFI buffer arguments reject invalid values', () => {
   }
 });
 
+test('optimized pointer arguments reject direct SharedArrayBuffers', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+  const firstByte = lib.getFunction('first_byte', {
+    arguments: ['pointer'],
+    return: 'u8',
+  });
+  const regular = new ArrayBuffer(1);
+  const shared = new SharedArrayBuffer(1);
+  const expected = { code: 'ERR_INVALID_ARG_VALUE' };
+
+  function callFirstByte(value) {
+    return firstByte(value);
+  }
+
+  try {
+    assert.throws(() => callFirstByte(shared), expected);
+
+    eval('%PrepareFunctionForOptimization(callFirstByte)');
+    callFirstByte(regular);
+    callFirstByte(regular);
+    eval('%OptimizeFunctionOnNextCall(callFirstByte)');
+    callFirstByte(regular);
+
+    assert.throws(() => callFirstByte(shared), expected);
+  } finally {
+    lib.close();
+  }
+});
+
 test('fast FFI string buffers survive reentrant callbacks', {
   // Bundled libffi callbacks crash on SmartOS.
   skip: common.isSunOS,

From 13e7d54f6736879073015e325509d47553d73713 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Wed, 19 Aug 2026 07:51:28 -0800
Subject: [PATCH 237/344] buffer: prevent string write offset overflow

Reject offsets outside the destination buffer before subtracting from
its length in SlowWriteString. Normalize wrapper arguments once so
validated values reach the native binding.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65043
Reviewed-By: Robert Nagy <ronagy@icloud.com>
---
 lib/internal/buffer.js             | 15 ++++++++++++---
 src/node_buffer.cc                 |  5 +++++
 test/parallel/test-buffer-write.js | 14 ++++++++++++++
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index 5029f60e7ba0..5977bdf23768 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -960,30 +960,39 @@ function writeFloatBackwards(val, offset = 0) {
 
 class FastBuffer extends Uint8Array {}
 
-function asciiWrite(buf, string, offset = 0, length = buf.byteLength - offset) {
+function asciiWrite(buf, string, offset = 0, length) {
+  offset = Number(offset);
   if (offset < 0 || offset > buf.byteLength) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
   }
+  if (length === undefined) length = buf.byteLength - offset;
+  else length = Number(length);
   if (length < 0 || length > buf.byteLength - offset) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
   }
   return asciiWriteStatic(buf, string, offset, length);
 }
 
-function latin1Write(buf, string, offset = 0, length = buf.byteLength - offset) {
+function latin1Write(buf, string, offset = 0, length) {
+  offset = Number(offset);
   if (offset < 0 || offset > buf.byteLength) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
   }
+  if (length === undefined) length = buf.byteLength - offset;
+  else length = Number(length);
   if (length < 0 || length > buf.byteLength - offset) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
   }
   return latin1WriteStatic(buf, string, offset, length);
 }
 
-function utf8Write(buf, string, offset = 0, length = buf.byteLength - offset) {
+function utf8Write(buf, string, offset = 0, length) {
+  offset = Number(offset);
   if (offset < 0 || offset > buf.byteLength) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
   }
+  if (length === undefined) length = buf.byteLength - offset;
+  else length = Number(length);
   if (length < 0 || length > buf.byteLength - offset) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
   }
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index 5be36d41666f..a0453800d84a 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -1734,6 +1734,11 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {
   size_t max_length = 0;
 
   THROW_AND_RETURN_IF_OOB(ParseArrayIndex(env, args[2], 0, &offset));
+  if (offset > ts_obj_length) {
+    return node::THROW_ERR_BUFFER_OUT_OF_BOUNDS(
+        env, "\"offset\" is outside of buffer bounds");
+  }
+
   THROW_AND_RETURN_IF_OOB(
       ParseArrayIndex(env, args[3], ts_obj_length - offset, &max_length));
 
diff --git a/test/parallel/test-buffer-write.js b/test/parallel/test-buffer-write.js
index 4c797059b592..11cfb32ab19a 100644
--- a/test/parallel/test-buffer-write.js
+++ b/test/parallel/test-buffer-write.js
@@ -127,3 +127,17 @@ assert.throws(() => {
 }, common.expectsError({
   code: 'ERR_BUFFER_OUT_OF_BOUNDS',
 }));
+
+for (const method of ['asciiWrite', 'latin1Write', 'utf8Write']) {
+  let calls = 0;
+  const offset = {
+    valueOf() {
+      calls++;
+      return 2;
+    },
+  };
+  assert.throws(() => Buffer.alloc(1)[method]('ww', offset, 1), common.expectsError({
+    code: 'ERR_BUFFER_OUT_OF_BOUNDS',
+  }));
+  assert.strictEqual(calls, 1);
+}

From 33d7b4c6b35e8a3eb76ab763897783485a74c3b0 Mon Sep 17 00:00:00 2001
From: Anshika Jain <anshikajain196872@gmail.com>
Date: Thu, 20 Aug 2026 00:08:04 +0530
Subject: [PATCH 238/344] test: add closed-library assertions for getFunctions
 and getSymbols

Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63769
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 test/ffi/test-ffi-dynamic-library.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/ffi/test-ffi-dynamic-library.js b/test/ffi/test-ffi-dynamic-library.js
index d22cf48d77b1..c7dab03f64e9 100644
--- a/test/ffi/test-ffi-dynamic-library.js
+++ b/test/ffi/test-ffi-dynamic-library.js
@@ -268,6 +268,8 @@ test('closed libraries reject subsequent operations', () => {
   assert.throws(() => functions.add_i32(1, 2), /Library is closed/);
   assert.throws(() => lib.getFunction('add_i32', fixtureSymbols.add_i32), /Library is closed/);
   assert.throws(() => lib.getSymbol('add_i32'), /Library is closed/);
+  assert.throws(() => lib.getFunctions({ add_i32: fixtureSymbols.add_i32 }), /Library is closed/);
+  assert.throws(() => lib.getSymbols(), /Library is closed/);
 });
 
 test('optimized fast calls reject calls after the library is closed', () => {

From 9572a0b15fb36ef2e40e16c454a2e504975bf867 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Thu, 20 Aug 2026 00:25:21 +0500
Subject: [PATCH 239/344] test_runner: fix junit report on empty diagnostic

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65357
Fixes: https://github.com/nodejs/node/issues/65355
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 lib/internal/test_runner/reporter/junit.js    |  2 +-
 .../output/junit_empty_diagnostic.js          |  8 +++++++
 .../output/junit_empty_diagnostic.snapshot    | 23 +++++++++++++++++++
 .../test-output-junit-empty-diagnostic.mjs    | 11 +++++++++
 4 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 test/fixtures/test-runner/output/junit_empty_diagnostic.js
 create mode 100644 test/fixtures/test-runner/output/junit_empty_diagnostic.snapshot
 create mode 100644 test/test-runner/test-output-junit-empty-diagnostic.mjs

diff --git a/lib/internal/test_runner/reporter/junit.js b/lib/internal/test_runner/reporter/junit.js
index ed25a4bd5fbd..5052f5444c0d 100644
--- a/lib/internal/test_runner/reporter/junit.js
+++ b/lib/internal/test_runner/reporter/junit.js
@@ -41,7 +41,7 @@ function treeToXML(tree) {
     tag, attrs, nesting, children, comment,
   } = tree;
   const indent = StringPrototypeRepeat('\t', nesting + 1);
-  if (comment) {
+  if (comment != null) {
     return `${indent}<!-- ${escapeComment(comment)} -->\n`;
   }
   const attrsString = ArrayPrototypeJoin(
diff --git a/test/fixtures/test-runner/output/junit_empty_diagnostic.js b/test/fixtures/test-runner/output/junit_empty_diagnostic.js
new file mode 100644
index 000000000000..491c2f230d98
--- /dev/null
+++ b/test/fixtures/test-runner/output/junit_empty_diagnostic.js
@@ -0,0 +1,8 @@
+// Flags: --test --test-reporter=junit
+'use strict';
+const test = require('node:test');
+
+test('failing', (t) => {
+  t.diagnostic('');
+  throw new Error('error');
+});
diff --git a/test/fixtures/test-runner/output/junit_empty_diagnostic.snapshot b/test/fixtures/test-runner/output/junit_empty_diagnostic.snapshot
new file mode 100644
index 000000000000..666c5c3523a7
--- /dev/null
+++ b/test/fixtures/test-runner/output/junit_empty_diagnostic.snapshot
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+	<testcase name="failing" time="*" classname="test" file="*" failure="error">
+		<failure type="testCodeFailure" message="error">
+[Error [ERR_TEST_FAILURE]: error] {
+  code: 'ERR_TEST_FAILURE',
+  failureType: 'testCodeFailure',
+  cause: Error: error
+      at TestContext.&lt;anonymous> (<project-root>/test/fixtures/test-runner/output/junit_empty_diagnostic.js:7:9)
+      at <node-internal-frames>
+}
+		</failure>
+	</testcase>
+	<!--  -->
+	<!-- tests 1 -->
+	<!-- suites 0 -->
+	<!-- pass 0 -->
+	<!-- fail 1 -->
+	<!-- cancelled 0 -->
+	<!-- skipped 0 -->
+	<!-- todo 0 -->
+	<!-- duration_ms * -->
+</testsuites>
diff --git a/test/test-runner/test-output-junit-empty-diagnostic.mjs b/test/test-runner/test-output-junit-empty-diagnostic.mjs
new file mode 100644
index 000000000000..5c1cf4a2b382
--- /dev/null
+++ b/test/test-runner/test-output-junit-empty-diagnostic.mjs
@@ -0,0 +1,11 @@
+// Test that the output of test-runner/output/junit_empty_diagnostic.js matches
+// test-runner/output/junit_empty_diagnostic.snapshot
+import '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+import { spawnAndAssert, junitTransform, ensureCwdIsProjectRoot } from '../common/assertSnapshot.js';
+
+ensureCwdIsProjectRoot();
+await spawnAndAssert(
+  fixtures.path('test-runner/output/junit_empty_diagnostic.js'),
+  junitTransform,
+);

From 1fe7a1c33dee46943e985a052425a8422164513a Mon Sep 17 00:00:00 2001
From: Soul Lee <alus20x@gmail.com>
Date: Thu, 20 Aug 2026 05:59:45 +0900
Subject: [PATCH 240/344] ffi: validate the value passed to the float setters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65342
Fixes: https://github.com/nodejs/node/issues/65341
Refs: https://github.com/nodejs/node/pull/62858
Refs: https://github.com/nodejs/node/pull/64614
Refs: https://github.com/nodejs/node/pull/64691
Refs: https://github.com/nodejs/node/pull/65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
---
 src/ffi/data.cc             | 16 +++++++---------
 test/ffi/test-ffi-memory.js |  6 ++++++
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 6a8d54ca0d39..308bde60cae2 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -16,7 +16,6 @@ using v8::ArrayBuffer;
 using v8::ArrayBufferView;
 using v8::BackingStore;
 using v8::BigInt;
-using v8::Context;
 using v8::FunctionCallbackInfo;
 using v8::Integer;
 using v8::Isolate;
@@ -24,7 +23,6 @@ using v8::Just;
 using v8::JustVoid;
 using v8::Local;
 using v8::Maybe;
-using v8::MaybeLocal;
 using v8::NewStringType;
 using v8::Nothing;
 using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
   }
 
   T converted;
-  Local<Context> context = env->context();
 
   if constexpr (std::is_same_v<T, int8_t>) {
     int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
       return;
     }
   } else if constexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
-    MaybeLocal<Number> number = value->ToNumber(context);
-    Local<Number> number_local;
-
-    if (!number.ToLocal(&number_local)) {
-      THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
+    if (!value->IsNumber()) {
+      if constexpr (std::is_same_v<T, float>) {
+        THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
+      } else {
+        THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
+      }
       return;
     }
 
-    converted = static_cast<T>(number_local->Value());
+    converted = static_cast<T>(value.As<Number>()->Value());
   } else {
     UNREACHABLE();
   }
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index e5bf4ba07e13..72d37efacd5a 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
     assert.throws(() => ffi.setUint64(ptr, 0, -1n), /Value must be a uint64/);
     assert.throws(() => ffi.setUint64(ptr, 0, 2n ** 64n), /Value must be a uint64/);
     assert.throws(() => ffi.setUint64(ptr, 0, Number.MAX_SAFE_INTEGER + 1), /Value must be a uint64/);
+    assert.throws(() => ffi.setFloat32(ptr, 0, '1.5'), /Value must be a float/);
+    assert.throws(() => ffi.setFloat32(ptr, 0, null), /Value must be a float/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, '1.5'), /Value must be a double/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, true), /Value must be a double/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, {}), /Value must be a double/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, { valueOf: common.mustNotCall() }), /Value must be a double/);
     assert.throws(() => ffi.exportString(1, ptr, 4), { code: 'ERR_INVALID_ARG_TYPE' });
     assert.throws(() => ffi.exportString('ok', ptr, -1), { code: 'ERR_OUT_OF_RANGE' });
     assert.throws(() => ffi.exportString('ok', ptr, 4, 1), { code: 'ERR_INVALID_ARG_TYPE' });

From 65f675086edcfa425c1fd09e91641f8ace3033b4 Mon Sep 17 00:00:00 2001
From: Vedant Kulkarni <gamemaker0042@gmail.com>
Date: Wed, 19 Aug 2026 20:59:57 +0000
Subject: [PATCH 241/344] doc: clarify that ipv4 mapped to ipv6 are classified
 as ipv6

Signed-off-by: Vedant Kulkarni <gamemaker0042@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62117
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/net.md | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/doc/api/net.md b/doc/api/net.md
index 01277f22651a..06139fd5b703 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -2379,12 +2379,13 @@ added: v0.3.0
 * `input` {string}
 * Returns: {integer}
 
-Returns `6` if `input` is an IPv6 address. Returns `4` if `input` is an IPv4
-address in [dot-decimal notation][] with no leading zeroes. Otherwise, returns
-`0`.
+Returns `6` if `input` is an IPv6 address, including an IPv4-mapped IPv6 address.
+Returns `4` if `input` is an IPv4 address in [dot-decimal notation][] with no
+leading zeroes. Otherwise, returns `0`.
 
 ```js
 net.isIP('::1'); // returns 6
+net.isIP('::ffff:127.0.0.1'); // returns 6
 net.isIP('127.0.0.1'); // returns 4
 net.isIP('127.000.000.001'); // returns 0
 net.isIP('127.0.0.1/24'); // returns 0
@@ -2419,10 +2420,12 @@ added: v0.3.0
 * `input` {string}
 * Returns: {boolean}
 
-Returns `true` if `input` is an IPv6 address. Otherwise, returns `false`.
+Returns `true` if `input` is an IPv6 address, including an IPv4-mapped IPv6 address.
+Otherwise, returns `false`.
 
 ```js
 net.isIPv6('::1'); // returns true
+net.isIPv6('::ffff:127.0.0.1'); // returns true
 net.isIPv6('fhqwhgads'); // returns false
 ```
 

From d286423043e3b1a926e713cbb0a1c5e6bab049ac Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Wed, 19 Aug 2026 17:03:04 -0700
Subject: [PATCH 242/344] diagnostics_channel: validate before channel
 activation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Validate the first subscription before calling markActive().
This prevents invalid callbacks from leaving channels active and
notifying native consumers without an installed subscriber.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65313
Fixes: https://github.com/nodejs/node/issues/65312
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
---
 lib/diagnostics_channel.js                                      | 1 +
 .../parallel/test-diagnostics-channel-object-channel-pub-sub.js | 2 ++
 test/parallel/test-diagnostics-channel-pub-sub.js               | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 998f17aa61d6..7c1f4fa845ed 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -229,6 +229,7 @@ class Channel {
   }
 
   subscribe(subscription) {
+    validateFunction(subscription, 'subscription');
     markActive(this);
     this.subscribe(subscription);
   }
diff --git a/test/parallel/test-diagnostics-channel-object-channel-pub-sub.js b/test/parallel/test-diagnostics-channel-object-channel-pub-sub.js
index 9498419b806c..f02544936559 100644
--- a/test/parallel/test-diagnostics-channel-object-channel-pub-sub.js
+++ b/test/parallel/test-diagnostics-channel-object-channel-pub-sub.js
@@ -44,3 +44,5 @@ assert.ok(!channel.unsubscribe(subscriber));
 assert.throws(() => {
   channel.subscribe(null);
 }, { code: 'ERR_INVALID_ARG_TYPE' });
+assert.ok(!channel.hasSubscribers);
+assert.ok(!dc.hasSubscribers('test'));
diff --git a/test/parallel/test-diagnostics-channel-pub-sub.js b/test/parallel/test-diagnostics-channel-pub-sub.js
index a7232ab58ce8..e3a868b7ce0c 100644
--- a/test/parallel/test-diagnostics-channel-pub-sub.js
+++ b/test/parallel/test-diagnostics-channel-pub-sub.js
@@ -42,6 +42,8 @@ assert.ok(!dc.unsubscribe(name, subscriber));
 assert.throws(() => {
   dc.subscribe(name, null);
 }, { code: 'ERR_INVALID_ARG_TYPE' });
+assert.ok(!channel.hasSubscribers);
+assert.ok(!dc.hasSubscribers(name));
 
 // Reaching zero subscribers should not delete from the channels map as there
 // will be no more weakref to incRef if another subscribe happens while the

From 9ec9383d1d662694f8d8ffa5e15d946cc0c5514e Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Wed, 19 Aug 2026 19:56:00 -0800
Subject: [PATCH 243/344] stream: decouple transform backpressure changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The spec's [[backpressureChangePromise]] is only ever observed by the
transform source pull algorithm (settles when backpressure next becomes
true) and by a sink write arriving under backpressure (settles when it
next becomes false), both internal. Replace the promise record with
direct continuation delivery: a parked pull is completed by enqueueing
the readable controller's pull-fulfilled step on the shared resolved
promise, and a parked write by a cached per-stream continuation that
resolves the sink promise with the perform-transform promise, so
adoption reproduces the previous derived-chain settle depth exactly.
Each delivery lands at the same microtask position as the old record's
reaction.

transformStreamDefaultControllerPerformTransform now mirrors the
reference implementation's promiseCall().then(undefined, rejection
steps) directly instead of running an async wrapper pair per chunk: the
transformer.transform callback is wrapped raw, a non-thenable result
reuses the shared resolved promise, and a synchronous throw is
delivered through a rejected promise, keeping the error timing inside a
reaction.

A pipe-through benchmark is added since the suite had no
transform-throughput row.

pipeThrough passthrough improves by ~8% and a writer-driven transform
loop by ~14%; the pipe-to and read families are unchanged.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65143
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/webstreams/pipe-through.js       |  38 +++++
 lib/internal/webstreams/transformstream.js | 153 +++++++++++++++------
 lib/internal/webstreams/util.js            |   9 ++
 3 files changed, 156 insertions(+), 44 deletions(-)
 create mode 100644 benchmark/webstreams/pipe-through.js

diff --git a/benchmark/webstreams/pipe-through.js b/benchmark/webstreams/pipe-through.js
new file mode 100644
index 000000000000..8af088f4eed1
--- /dev/null
+++ b/benchmark/webstreams/pipe-through.js
@@ -0,0 +1,38 @@
+'use strict';
+const common = require('../common.js');
+const {
+  ReadableStream,
+  TransformStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [5e5],
+  kind: ['default', 'transform'],
+});
+
+async function main({ n, kind }) {
+  const b = Buffer.alloc(64);
+  let i = 0;
+  const rs = new ReadableStream({
+    pull(controller) {
+      if (i++ < n) {
+        controller.enqueue(b);
+      } else {
+        controller.close();
+      }
+    },
+  });
+  const ts = kind === 'default' ?
+    new TransformStream() :
+    new TransformStream({
+      transform(chunk, controller) { controller.enqueue(chunk); },
+    });
+
+  const reader = rs.pipeThrough(ts).getReader();
+  bench.start();
+  for (;;) {
+    const { done } = await reader.read();
+    if (done) break;
+  }
+  bench.end(n);
+}
diff --git a/lib/internal/webstreams/transformstream.js b/lib/internal/webstreams/transformstream.js
index 535c783a3a31..30b7b1c8fac1 100644
--- a/lib/internal/webstreams/transformstream.js
+++ b/lib/internal/webstreams/transformstream.js
@@ -5,6 +5,8 @@ const {
   ObjectDefineProperties,
   ObjectSetPrototypeOf,
   PromisePrototypeThen,
+  PromiseReject,
+  PromiseResolve,
   PromiseWithResolvers,
   Symbol,
   SymbolToStringTag,
@@ -44,12 +46,14 @@ const {
 
 const {
   createPromiseCallback1Param,
-  createPromiseCallback2Params,
+  createRawCallback2Params,
   customInspect,
   extractHighWaterMark,
   extractSizeAlgorithm,
   getNonWritablePropertyDescriptor,
   isBrandCheck,
+  kParkedAlgorithmResult,
+  kResolvedPromise,
   kState,
   kType,
   nonOpCancel,
@@ -258,7 +262,10 @@ function InternalTransferredTransformStream() {
     readable: undefined,
     writable: undefined,
     backpressure: undefined,
-    backpressureChange: undefined,
+    pullPending: false,
+    pendingWrite: undefined,
+    pendingWriteChunk: undefined,
+    writeContinuation: undefined,
     controller: undefined,
   };
 }
@@ -348,7 +355,9 @@ const isTransformStream =
 const isTransformStreamDefaultController =
   isBrandCheck('TransformStreamDefaultController');
 
-async function defaultTransformAlgorithm(chunk, controller) {
+// Raw callback (see createRawCallback*): invoked inside the try/catch of
+// transformStreamDefaultControllerPerformTransform.
+function defaultTransformAlgorithm(chunk, controller) {
   transformStreamDefaultControllerEnqueue(controller, chunk);
 }
 
@@ -385,7 +394,12 @@ function initializeTransformStream(
     writable,
     controller: undefined,
     backpressure: undefined,
-    backpressureChange: undefined,
+    // Continuation slots replacing the spec's
+    // [[backpressureChangePromise]]; see transformStreamSetBackpressure.
+    pullPending: false,
+    pendingWrite: undefined,
+    pendingWriteChunk: undefined,
+    writeContinuation: undefined,
   };
 
   transformStreamSetBackpressure(stream, true);
@@ -422,24 +436,30 @@ function transformStreamUnblockWrite(stream) {
 // The spec's [[backpressureChangePromise]] is only ever observed by the
 // source pull algorithm (settles when backpressure next becomes true) and
 // by a sink write arriving while backpressure is set (settles when
-// backpressure next becomes false). Instead of allocating a fresh promise
-// record on every flip, the record is materialized lazily on first
-// observation and dropped once settled; flips nobody is waiting on
-// allocate nothing.
-function transformStreamBackpressureChangePromise(stream) {
-  const state = stream[kState];
-  return (state.backpressureChange ??= PromiseWithResolvers()).promise;
-}
-
+// backpressure next becomes false). Both observers are internal, so the
+// promise record is replaced by continuation slots: a parked pull is
+// completed by delivering the readable controller's pull-fulfilled step,
+// and a parked write by the cached write continuation (see
+// transformStreamDefaultSinkWriteAlgorithm). Each is enqueued on the
+// shared resolved promise at the exact microtask position the old
+// record's reaction would have had.
 function transformStreamSetBackpressure(stream, backpressure) {
   const state = stream[kState];
   assert(state.backpressure !== backpressure);
-  const backpressureChange = state.backpressureChange;
-  if (backpressureChange !== undefined) {
-    state.backpressureChange = undefined;
-    backpressureChange.resolve();
-  }
   state.backpressure = backpressure;
+  if (backpressure) {
+    if (state.pullPending) {
+      state.pullPending = false;
+      // The pull-fulfilled step exists: a pull parked it (see
+      // transformStreamDefaultSourcePullAlgorithm), and the readable
+      // controller creates it before invoking the pull algorithm.
+      PromisePrototypeThen(
+        kResolvedPromise,
+        state.readable[kState].controller[kState].pullFulfilled);
+    }
+  } else if (state.pendingWrite !== undefined) {
+    PromisePrototypeThen(kResolvedPromise, state.writeContinuation);
+  }
 }
 
 function setupTransformStreamDefaultController(
@@ -456,6 +476,7 @@ function setupTransformStreamDefaultController(
     transformAlgorithm,
     flushAlgorithm,
     cancelAlgorithm,
+    performTransformRejected: undefined,
   };
   stream[kState].controller = controller;
 }
@@ -468,7 +489,7 @@ function setupTransformStreamDefaultControllerFromTransformer(
   const flush = transformer?.flush;
   const cancel = transformer?.cancel;
   const transformAlgorithm = transform ?
-    createPromiseCallback2Params('transformer.transform', transform, transformer) :
+    createRawCallback2Params('transformer.transform', transform, transformer) :
     defaultTransformAlgorithm;
   const flushAlgorithm = flush ?
     createPromiseCallback1Param('transformer.flush', flush, transformer) :
@@ -521,18 +542,40 @@ function transformStreamDefaultControllerError(controller, error) {
   transformStreamError(controller[kState].stream, error);
 }
 
-async function transformStreamDefaultControllerPerformTransform(controller, chunk) {
+// Mirrors the reference implementation's
+// `promiseCall(transformAlgorithm, ...).then(undefined, rejectionSteps)`:
+// the returned promise settles one microtask after the (coerced) result
+// does, and a rejection errors the transform stream before propagating.
+// The raw transform callback plus the shared resolved promise for
+// non-thenable results replace the previous async wrapper's two implicit
+// promises per chunk.
+function transformStreamDefaultControllerPerformTransform(controller, chunk) {
+  const controllerState = controller[kState];
+  const transformAlgorithm = controllerState.transformAlgorithm;
+  if (transformAlgorithm === undefined) {
+    // Algorithms were cleared by a concurrent cancel/abort/close.
+    return kResolvedPromise;
+  }
+  let result;
   try {
-    const transformAlgorithm = controller[kState].transformAlgorithm;
-    if (transformAlgorithm === undefined) {
-      // Algorithms were cleared by a concurrent cancel/abort/close.
-      return;
-    }
-    return await transformAlgorithm(chunk, controller);
+    result = transformAlgorithm(chunk, controller);
   } catch (error) {
+    result = PromiseReject(error);
+  }
+  if (result === null ||
+      (typeof result !== 'object' && typeof result !== 'function')) {
+    result = kResolvedPromise;
+  } else {
+    result = PromiseResolve(result);
+  }
+  controllerState.performTransformRejected ??= (error) => {
     transformStreamError(controller[kState].stream, error);
     throw error;
-  }
+  };
+  return PromisePrototypeThen(
+    result,
+    undefined,
+    controllerState.performTransformRejected);
 }
 
 function transformStreamDefaultControllerTerminate(controller) {
@@ -553,26 +596,42 @@ function transformStreamDefaultControllerTerminate(controller) {
 }
 
 function transformStreamDefaultSinkWriteAlgorithm(stream, chunk) {
+  const state = stream[kState];
   const {
     writable,
     controller,
-  } = stream[kState];
+  } = state;
   assert(writable[kState].state === 'writable');
-  if (stream[kState].backpressure) {
-    const backpressureChange = transformStreamBackpressureChangePromise(stream);
-    return PromisePrototypeThen(
-      backpressureChange,
-      () => {
-        const {
-          writable,
-        } = stream[kState];
-        if (writable[kState].state === 'erroring')
-          throw writable[kState].storedError;
-        assert(writable[kState].state === 'writable');
-        return transformStreamDefaultControllerPerformTransform(
+  if (state.backpressure) {
+    // Park the chunk and one promise record; the backpressure -> false
+    // flip delivers the cached continuation (see
+    // transformStreamSetBackpressure) at the same microtask position as
+    // the old [[backpressureChangePromise]] reaction. The continuation
+    // resolves the sink promise with the perform-transform promise, so
+    // adoption reproduces the old derived-chain settle depth exactly.
+    // The writable dispatches a single write at a time, so one pending
+    // slot suffices.
+    assert(state.pendingWrite === undefined);
+    const pendingWrite = PromiseWithResolvers();
+    state.pendingWrite = pendingWrite;
+    state.pendingWriteChunk = chunk;
+    state.writeContinuation ??= () => {
+      const pending = state.pendingWrite;
+      const pendingChunk = state.pendingWriteChunk;
+      state.pendingWrite = undefined;
+      state.pendingWriteChunk = undefined;
+      const writableState = state.writable[kState];
+      if (writableState.state === 'erroring') {
+        pending.reject(writableState.storedError);
+        return;
+      }
+      assert(writableState.state === 'writable');
+      pending.resolve(
+        transformStreamDefaultControllerPerformTransform(
           controller,
-          chunk);
-      });
+          pendingChunk));
+    };
+    return pendingWrite.promise;
   }
   return transformStreamDefaultControllerPerformTransform(controller, chunk);
 }
@@ -642,9 +701,15 @@ function transformStreamDefaultSinkCloseAlgorithm(stream) {
 }
 
 function transformStreamDefaultSourcePullAlgorithm(stream) {
-  assert(stream[kState].backpressure);
+  const state = stream[kState];
+  assert(state.backpressure);
   transformStreamSetBackpressure(stream, false);
-  return transformStreamBackpressureChangePromise(stream);
+  // Park the pull: the next backpressure -> true flip delivers the
+  // pull-fulfilled step (see transformStreamSetBackpressure). The old
+  // [[backpressureChangePromise]] this replaces was only ever resolved,
+  // so the parked pull needs no rejection delivery.
+  state.pullPending = true;
+  return kParkedAlgorithmResult;
 }
 
 function transformStreamDefaultSourceCancelAlgorithm(stream, reason) {
diff --git a/lib/internal/webstreams/util.js b/lib/internal/webstreams/util.js
index 05439a25dcb5..9598796f35c8 100644
--- a/lib/internal/webstreams/util.js
+++ b/lib/internal/webstreams/util.js
@@ -355,6 +355,12 @@ function createRawCallback2Params(name, fn, thisArg) {
 // the next microtask checkpoint without allocating a fresh promise.
 const kResolvedPromise = PromiseResolve();
 
+// Returned by an internal algorithm to signal that it parked the
+// operation and takes responsibility for delivering the fulfilled (or
+// rejected) continuation itself later, instead of settling a promise
+// (see the transform stream source pull algorithm).
+const kParkedAlgorithmResult = { __proto__: null };
+
 // Wires the (possibly non-thenable) result of an underlying algorithm
 // callback to its fulfilled/rejected continuations. A non-thenable result
 // means fulfillment is guaranteed and no then() lookup is observable, so
@@ -364,6 +370,8 @@ const kResolvedPromise = PromiseResolve();
 // matches the spec's "a promise resolved with" conversion (identity for
 // native promises).
 function thenAlgorithmResult(result, onFulfilled, onRejected) {
+  if (result === kParkedAlgorithmResult)
+    return;
   if (result === null ||
       (typeof result !== 'object' && typeof result !== 'function')) {
     PromisePrototypeThen(kResolvedPromise, onFulfilled);
@@ -457,6 +465,7 @@ module.exports = {
   isBrandCheck,
   isPromisePending,
   kEmptyQueue,
+  kParkedAlgorithmResult,
   kResolvedPromise,
   kState,
   kType,

From 41c510803d4a3e9094d133a1e55211f1f5850b63 Mon Sep 17 00:00:00 2001
From: trivenay <trivenay@amazon.com>
Date: Thu, 20 Aug 2026 12:33:21 +0530
Subject: [PATCH 244/344] quic: do not destroy incoming streams that have a
 consumer

An incoming stream was destroyed unless the session had an onstream
callback, even when session-level stream callbacks (onheaders et al)
were registered and the negotiated application (HTTP/3) would drive
the stream through them. Users had to register stub onstream handlers
just to keep their streams alive.

Destroy an incoming stream only when the session has no consumer for
it at all: no onstream callback, and no session-level stream callbacks
runnable on the negotiated application (checked via the existing
headersSupported session state, computed when the application is
selected from ALPN). Sessions with no consumers keep the current
destroy-and-warn behavior so unconsumed streams cannot accumulate and
hold flow control credit.

On HTTP/3 sessions only bidirectional request streams reach this path;
control and QPACK streams are consumed internally by nghttp3 and are
never exposed to JavaScript.

Fixes: https://github.com/nodejs/node/issues/64192

Signed-off-by: Naman Trivedi <trivenay@amazon.com>
PR-URL: https://github.com/nodejs/node/pull/65335
Fixes: https://github.com/nodejs/node/issues/64192
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/quic.md                               |  24 +-
 lib/internal/quic/quic.js                     |  38 ++-
 lib/internal/quic/state.js                    |  15 ++
 src/quic/application.h                        |   5 +
 src/quic/defs.h                               |   6 +
 src/quic/http3.cc                             |   2 +
 src/quic/session.cc                           |   5 +
 .../test-quic-h3-stream-without-onstream.mjs  | 244 ++++++++++++++++++
 8 files changed, 331 insertions(+), 8 deletions(-)
 create mode 100644 test/parallel/test-quic-h3-stream-without-onstream.mjs

diff --git a/doc/api/quic.md b/doc/api/quic.md
index b23f27984fc0..74e4644f8112 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -305,7 +305,11 @@ unidirectional (data flows in only one direction). The `quic` module provides
 separate APIs for creating each kind:
 [`session.createBidirectionalStream()`][] and
 [`session.createUnidirectionalStream()`][]. Streams initiated by a remote
-peer are delivered via the [`session.onstream`][] callback.
+peer are delivered via the [`session.onstream`][] callback. When the
+negotiated application protocol supports the stream-level callbacks (e.g.
+HTTP/3) and an `onheaders` callback is configured, incoming streams can
+instead be consumed entirely through it and registering `onstream` is
+optional.
 
 There are two ways to write data to a stream:
 
@@ -409,7 +413,9 @@ A typical client session progresses through these stages:
 
 On the server side, call [`quic.listen()`][] with a callback. The callback
 fires for each incoming session after the TLS handshake begins. Incoming
-streams arrive via the [`session.onstream`][] callback.
+streams arrive via the [`session.onstream`][] callback, or, for HTTP/3
+sessions with an `onheaders` callback configured, directly through that
+callback (see the [minimal HTTP/3 server][] example).
 
 [`session.destroy()`][] is available for immediate teardown — all open streams
 are destroyed and the session is closed without waiting for them to finish.
@@ -1108,6 +1114,15 @@ added: v23.8.0
 
 The callback to invoke when a new stream is initiated by a remote peer. Read/write.
 
+If no `onstream` callback is set and the stream has no other consumer, an
+incoming stream is destroyed on arrival and a warning is emitted. An
+`onheaders` callback counts as a consumer when the negotiated application
+protocol supports it (e.g. HTTP/3), because it is invoked for every incoming
+request stream. Other stream-level callbacks (`ontrailers`, `oninfo`,
+`onwanttrailers`) do not, since they are conditional or outbound-only and
+would leave the stream unobservable. An HTTP/3 server that handles requests
+entirely through `onheaders` does not need to set `onstream`.
+
 ### `session.ondatagram`
 
 <!-- YAML
@@ -3998,7 +4013,9 @@ import { listen } from 'node:quic';
 const encoder = new TextEncoder();
 
 const endpoint = await listen((session) => {
-  // The session.onstream callback fires for each new client-initiated stream.
+  // The session.onstream callback fires for each new client-initiated
+  // stream. It is optional here: with `onheaders` configured below,
+  // request streams are consumed through that callback.
 }, {
   sni: { '*': { keys: [defaultKey], certs: [defaultCert] } },
   // ALPN defaults to 'h3'.
@@ -4632,5 +4649,6 @@ throughput issues caused by flow control.
 [`stream.writer`]: #streamwriter
 [`writer.fail()`]: #streamwriter
 [`writer.fail(reason)`]: #streamwriter
+[minimal HTTP/3 server]: #minimal-http3-server
 [qlog]: https://datatracker.ietf.org/doc/draft-ietf-quic-qlog-main-schema/
 [qvis]: https://qvis.quictools.info/
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index f645998e628d..e6ab417ab0f6 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -4129,6 +4129,24 @@ class QuicSession {
     this.#inner.verifyPeer = value;
   }
 
+  /**
+   * True if an incoming stream has a consumer registered on this session:
+   * either an onstream callback, or - when the negotiated application
+   * supports headers (e.g. HTTP/3) - session-level stream callbacks that
+   * the application layer will invoke (onheaders et al).
+   * @returns {boolean}
+   */
+  #hasStreamConsumer() {
+    if (typeof this.#inner.onstream === 'function') return true;
+    // Only onheaders is guaranteed to fire for every incoming stream when
+    // the negotiated application supports stream callbacks (e.g. HTTP/3).
+    // Other stream callbacks are conditional (ontrailers, oninfo) or
+    // outbound-only (onwanttrailers) and do not expose the stream, so they
+    // do not count as a consumer.
+    if (typeof this[kStreamCallbacks]?.onheaders !== 'function') return false;
+    return getQuicSessionState(this).streamCallbacksSupported === 1;
+  }
+
   /**
    * @param {object} handle
    * @param {number} direction
@@ -4141,10 +4159,13 @@ class QuicSession {
     // Set the default byte budget for received streams.
     stream.budget = kDefaultBudget;
 
-    // A new stream was received. If we don't have an onstream callback, then
-    // there's nothing we can do about it. Destroy the stream in this case.
-    if (typeof inner.onstream !== 'function') {
-      process.emitWarning('A new stream was received but no onstream callback was provided');
+    // A new stream was received. If the session has no consumer for it -
+    // neither an onstream callback nor, on a session whose application
+    // supports headers (e.g. HTTP/3), any session-level stream callbacks -
+    // there's nothing that could ever read it. Destroy the stream in this
+    // case rather than letting it hold flow control credit.
+    if (!this.#hasStreamConsumer()) {
+      process.emitWarning('A new stream was received but no stream consumer callback was provided');
       stream.destroy();
       return;
     }
@@ -4175,7 +4196,14 @@ class QuicSession {
       });
     }
 
-    safeCallbackInvoke(inner.onstream, this, stream);
+    // Deliver the stream to the onstream consumer if one is registered.
+    // Reaching this point without one means #hasStreamConsumer accepted
+    // the stream on behalf of the application layer: the session-level
+    // stream callbacks were applied above and the application (e.g.
+    // HTTP/3) drives the stream, so there is nothing to invoke here.
+    if (typeof inner.onstream === 'function') {
+      safeCallbackInvoke(inner.onstream, this, stream);
+    }
   }
 
   [kRemoveStream](stream) {
diff --git a/lib/internal/quic/state.js b/lib/internal/quic/state.js
index 7d2ff3a96c6b..a41790c52024 100644
--- a/lib/internal/quic/state.js
+++ b/lib/internal/quic/state.js
@@ -72,6 +72,7 @@ const {
   IDX_STATE_SESSION_STREAM_OPEN_ALLOWED,
   IDX_STATE_SESSION_PRIORITY_SUPPORTED,
   IDX_STATE_SESSION_HEADERS_SUPPORTED,
+  IDX_STATE_SESSION_STREAM_CALLBACKS_SUPPORTED,
   IDX_STATE_SESSION_WRAPPED,
   IDX_STATE_SESSION_APPLICATION_TYPE,
   IDX_STATE_SESSION_NO_ERROR_CODE,
@@ -119,6 +120,7 @@ assert(IDX_STATE_SESSION_HANDSHAKE_CONFIRMED !== undefined);
 assert(IDX_STATE_SESSION_STREAM_OPEN_ALLOWED !== undefined);
 assert(IDX_STATE_SESSION_PRIORITY_SUPPORTED !== undefined);
 assert(IDX_STATE_SESSION_HEADERS_SUPPORTED !== undefined);
+assert(IDX_STATE_SESSION_STREAM_CALLBACKS_SUPPORTED !== undefined);
 assert(IDX_STATE_SESSION_WRAPPED !== undefined);
 assert(IDX_STATE_SESSION_APPLICATION_TYPE !== undefined);
 assert(IDX_STATE_SESSION_NO_ERROR_CODE !== undefined);
@@ -493,6 +495,19 @@ class QuicSessionState {
     return DataViewPrototypeGetUint8(handle, this.#offset + IDX_STATE_SESSION_HEADERS_SUPPORTED);
   }
 
+  /**
+   * Whether the negotiated application dispatches the session-level
+   * stream callbacks (onheaders et al) for incoming streams.
+   * Returns 0 (unknown), 1 (supported), or 2 (not supported).
+   * @type {number}
+   */
+  get streamCallbacksSupported() {
+    const handle = this.#handle;
+    if (handle === undefined) return undefined;
+    return DataViewPrototypeGetUint8(
+      handle, this.#offset + IDX_STATE_SESSION_STREAM_CALLBACKS_SUPPORTED);
+  }
+
   /** @type {boolean} */
   get isWrapped() {
     const handle = this.#handle;
diff --git a/src/quic/application.h b/src/quic/application.h
index 619b41dd8d0b..dec5cffb4243 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -210,6 +210,11 @@ class Session::Application : public MemoryRetainer {
   // do not support headers should return false (the default).
   virtual bool SupportsHeaders() const { return false; }
 
+  // True if this application dispatches the session-level stream
+  // callbacks (onheaders et al) for incoming streams when they are
+  // registered on the session.
+  virtual bool SupportsStreamCallbacks() const { return false; }
+
   // Initiates application-level graceful shutdown signaling (e.g.,
   // HTTP/3 GOAWAY). Called when Session::Close(GRACEFUL) is invoked.
   virtual void BeginShutdown() {}
diff --git a/src/quic/defs.h b/src/quic/defs.h
index 75ae915335be..5184288475b1 100644
--- a/src/quic/defs.h
+++ b/src/quic/defs.h
@@ -328,6 +328,12 @@ enum class HeadersSupportState : uint8_t {
   UNSUPPORTED,
 };
 
+enum class StreamCallbacksSupportState : uint8_t {
+  UNKNOWN,
+  SUPPORTED,
+  UNSUPPORTED,
+};
+
 enum class PathValidationResult : uint8_t {
   SUCCESS = NGTCP2_PATH_VALIDATION_RESULT_SUCCESS,
   FAILURE = NGTCP2_PATH_VALIDATION_RESULT_FAILURE,
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index b6d876af60f6..2cf4e2d6fdd1 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -202,6 +202,8 @@ class Http3ApplicationImpl final : public Session::Application {
 
   bool SupportsHeaders() const override { return true; }
 
+  bool SupportsStreamCallbacks() const override { return true; }
+
   bool is_started() const override { return started_; }
 
   bool Start() override {
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 1bea15fbadb4..60b27fbfa358 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -136,6 +136,7 @@ uint64_t MaxDatagramPayload(uint64_t max_frame_size) {
   V(STREAM_OPEN_ALLOWED, stream_open_allowed, uint8_t)                         \
   V(PRIORITY_SUPPORTED, priority_supported, uint8_t)                           \
   V(HEADERS_SUPPORTED, headers_supported, uint8_t)                             \
+  V(STREAM_CALLBACKS_SUPPORTED, stream_callbacks_supported, uint8_t)           \
   V(WRAPPED, wrapped, uint8_t)                                                 \
   V(APPLICATION_TYPE, application_type, uint8_t)                               \
   V(NO_ERROR_CODE, no_error_code, error_code)                                  \
@@ -2649,6 +2650,10 @@ void Session::SetApplication(std::unique_ptr<Application> app) {
   impl_->state()->headers_supported = static_cast<uint8_t>(
       app->SupportsHeaders() ? HeadersSupportState::SUPPORTED
                              : HeadersSupportState::UNSUPPORTED);
+  impl_->state()->stream_callbacks_supported =
+      static_cast<uint8_t>(app->SupportsStreamCallbacks()
+                               ? StreamCallbacksSupportState::SUPPORTED
+                               : StreamCallbacksSupportState::UNSUPPORTED);
   // Surface the application's "no error" and "internal error" codes via
   // session state so that JS-side code (e.g. the stream writer's fail()
   // path) can resolve the right wire code for the negotiated ALPN
diff --git a/test/parallel/test-quic-h3-stream-without-onstream.mjs b/test/parallel/test-quic-h3-stream-without-onstream.mjs
new file mode 100644
index 000000000000..fcd5bbe019ba
--- /dev/null
+++ b/test/parallel/test-quic-h3-stream-without-onstream.mjs
@@ -0,0 +1,244 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: incoming stream consumer checks.
+// An incoming stream must not be destroyed just because `onstream` is
+// not set: on a session whose application supports headers (HTTP/3),
+// session-level stream callbacks (`onheaders` et al) are a consumer
+// and the stream must be kept and driven by the application layer.
+// Refs: https://github.com/nodejs/node/issues/64192
+//
+// A session with no stream consumers at all still destroys incoming
+// streams (and emits a warning), so unconsumed streams cannot
+// accumulate and hold flow control credit.
+
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { text } = await import('stream/iter');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+// The consumer warning must never fire in the first block (onheaders is
+// a consumer) and must fire in the second (no runnable consumer).
+// common.expectWarning is not usable here: importing node:quic emits
+// ExperimentalWarning, which it would reject as unexpected.
+const kWarning =
+  'A new stream was received but no stream consumer callback was provided';
+function failOnConsumerWarning(warning) {
+  assert.notStrictEqual(warning.message, kWarning);
+}
+
+// --- An h3 request completes with only session-level stream callbacks ---
+{
+  process.on('warning', failOnConsumerWarning);
+  const serverDone = Promise.withResolvers();
+
+  // Note: no `onstream` callback anywhere on this session.
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onerror = () => {};
+  }), {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    onheaders: mustCall(function(headers) {
+      assert.strictEqual(headers[':path'], '/test');
+      this.sendHeaders({
+        ':status': '200',
+        'content-type': 'text/plain',
+      });
+      const w = this.writer;
+      w.writeSync('kept without onstream');
+      w.endSync();
+      serverDone.resolve();
+    }),
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+
+  const headersReceived = Promise.withResolvers();
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': '/test',
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+    onheaders: mustCall((headers) => {
+      assert.strictEqual(headers[':status'], 200);
+      headersReceived.resolve();
+    }),
+  });
+
+  await headersReceived.promise;
+  const body = await text(stream);
+  assert.strictEqual(body, 'kept without onstream');
+
+  await serverDone.promise;
+  await clientSession.close();
+  await serverEndpoint.close();
+  process.off('warning', failOnConsumerWarning);
+}
+
+// --- Stream callbacks that cannot run are not a consumer ---
+// On a session whose negotiated application does not support headers,
+// registered session-level stream callbacks can never fire, so an
+// incoming stream with no onstream callback is destroyed with the
+// warning. The h3 block above must not trigger that warning.
+{
+  // Awaiting warned.promise is the assertion: the test times out if the
+  // warning never fires.
+  const warned = Promise.withResolvers();
+  process.on('warning', function onWarning(warning) {
+    if (warning.message === kWarning) {
+      process.off('warning', onWarning);
+      warned.resolve();
+    }
+  });
+
+  // The onheaders callback is registered but the ALPN is not h3,
+  // so it can never run.
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onerror = () => {};
+  }), {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    alpn: ['test-proto'],
+    onheaders: () => {},
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    alpn: 'test-proto',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+
+  const stream = await clientSession.createUnidirectionalStream();
+  stream.writer.writeSync('x');
+
+  await warned.promise;
+  await clientSession.close();
+  await serverEndpoint.close();
+}
+
+// Session-level stream callbacks, classified by whether the application is
+// guaranteed to hand every incoming stream to that callback. `onheaders` is
+// invoked for every incoming h3 request stream; the others are conditional
+// (`ontrailers`, `oninfo`) or outbound-only (`onwanttrailers`) and do not
+// expose the stream, so registering only those is not a consumer.
+const kConsumerCallbacks = ['onheaders'];
+const kNonConsumerCallbacks = ['oninfo', 'ontrailers', 'onwanttrailers'];
+
+// --- Every session-level stream callback is classified ---
+// Guard: discover the callbacks the session attaches to an incoming stream
+// and assert each one is classified above, so a newly added stream callback
+// trips this test until someone puts it in the right list (and, if it is a
+// consumer, accepts it in QuicSession#hasStreamConsumer).
+{
+  // QuicStream is not exported; obtain its prototype from a stream instance,
+  // then offer every `on*` accessor to listen() and see which ones the
+  // session actually attaches to a received stream.
+  const bootstrap = await listen(mustCall((session) => {
+    session.onerror = () => {};
+  }), { sni: { '*': { keys: [key], certs: [cert] } }, onstream: () => {} });
+  const bootSession = await connect(bootstrap.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await bootSession.opened;
+  const probeStream = await bootSession.createBidirectionalStream();
+  probeStream.onerror = () => {};
+  const candidates = Object.getOwnPropertyNames(Object.getPrototypeOf(probeStream))
+    .filter((name) => name.startsWith('on'));
+  await bootSession.close();
+  await bootstrap.close();
+
+  const probes = { __proto__: null };
+  for (const name of candidates) probes[name] = () => {};
+
+  const applied = Promise.withResolvers();
+  const serverEndpoint = await listen(mustCall((session) => {
+    session.onerror = () => {};
+  }), {
+    __proto__: null,
+    ...probes,
+    sni: { '*': { keys: [key], certs: [cert] } },
+    onstream: mustCall((stream) => {
+      applied.resolve(candidates.filter((n) => typeof stream[n] === 'function'));
+    }),
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': '/test',
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+  });
+  stream.onerror = () => {};
+
+  assert.deepStrictEqual(
+    (await applied.promise).sort(),
+    [...kConsumerCallbacks, ...kNonConsumerCallbacks].sort(),
+    'A session-level stream callback was added: classify it in ' +
+    'kConsumerCallbacks (and accept it in QuicSession#hasStreamConsumer) ' +
+    'or kNonConsumerCallbacks.');
+
+  await clientSession.close();
+  await serverEndpoint.close();
+}
+
+// --- Callbacks that do not expose the stream are not a consumer ---
+// A session registering only a non-consumer callback has no way to observe
+// an incoming stream, so it must be destroyed with the warning.
+for (const callbackName of kNonConsumerCallbacks) {
+  const warned = Promise.withResolvers();
+  process.on('warning', function onWarning(warning) {
+    if (warning.message === kWarning) {
+      process.off('warning', onWarning);
+      warned.resolve();
+    }
+  });
+
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onerror = () => {};
+  }), {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    [callbackName]: mustNotCall(),
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': '/test',
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+  });
+  stream.onerror = () => {};
+
+  await warned.promise;
+  await clientSession.close();
+  await serverEndpoint.close();
+}

From 83a7949c1808104d9afab198b8d33ba9235a1368 Mon Sep 17 00:00:00 2001
From: Kirill Saied <sayed.kirill@gmail.com>
Date: Thu, 20 Aug 2026 13:05:05 +0200
Subject: [PATCH 245/344] src: define O_SYNC, O_DSYNC and O_DIRECT on Windows

Signed-off-by: Kirill Saied <sayed.kirill@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64707
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/fs.md                      |  8 +++++---
 src/node_constants.cc              | 18 ++++++++++++++++++
 test/parallel/test-fs-constants.js | 11 ++++++++++-
 3 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index cbea29c3469b..43a0f4b89a4f 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -8766,12 +8766,14 @@ The following constants are meant for use with `fs.open()`.
   <tr>
     <td><code>O_SYNC</code></td>
     <td>Flag indicating that the file is opened for synchronized I/O with write
-    operations waiting for file integrity.</td>
+    operations waiting for file integrity. On Windows, this maps to
+    <code>FILE_FLAG_WRITE_THROUGH</code>.</td>
   </tr>
   <tr>
     <td><code>O_DSYNC</code></td>
     <td>Flag indicating that the file is opened for synchronized I/O with write
-    operations waiting for data integrity.</td>
+    operations waiting for data integrity. On Windows, this maps to
+    <code>FILE_FLAG_WRITE_THROUGH</code>.</td>
   </tr>
   <tr>
     <td><code>O_SYMLINK</code></td>
@@ -8781,7 +8783,7 @@ The following constants are meant for use with `fs.open()`.
   <tr>
     <td><code>O_DIRECT</code></td>
     <td>When set, an attempt will be made to minimize caching effects of file
-    I/O.</td>
+    I/O. On Windows, this maps to <code>FILE_FLAG_NO_BUFFERING</code>.</td>
   </tr>
   <tr>
     <td><code>O_NONBLOCK</code></td>
diff --git a/src/node_constants.cc b/src/node_constants.cc
index 432b66808920..bd3b66414d18 100644
--- a/src/node_constants.cc
+++ b/src/node_constants.cc
@@ -1170,10 +1170,22 @@ void DefineFsConstants(Local<Object> target) {
 
 #ifdef O_SYNC
   NODE_DEFINE_CONSTANT(target, O_SYNC);
+#elif UV_FS_O_SYNC != 0
+// Windows lacks the POSIX O_SYNC macro, but libuv maps UV_FS_O_SYNC to
+// FILE_FLAG_WRITE_THROUGH, so expose it under the portable name.
+#define O_SYNC UV_FS_O_SYNC
+  NODE_DEFINE_CONSTANT(target, O_SYNC);
+#undef O_SYNC
 #endif
 
 #ifdef O_DSYNC
   NODE_DEFINE_CONSTANT(target, O_DSYNC);
+#elif UV_FS_O_DSYNC != 0
+// Windows lacks the POSIX O_DSYNC macro, but libuv maps UV_FS_O_DSYNC to
+// FILE_FLAG_WRITE_THROUGH, so expose it under the portable name.
+#define O_DSYNC UV_FS_O_DSYNC
+  NODE_DEFINE_CONSTANT(target, O_DSYNC);
+#undef O_DSYNC
 #endif
 
 
@@ -1183,6 +1195,12 @@ void DefineFsConstants(Local<Object> target) {
 
 #ifdef O_DIRECT
   NODE_DEFINE_CONSTANT(target, O_DIRECT);
+#elif UV_FS_O_DIRECT != 0
+// Windows lacks the POSIX O_DIRECT macro, but libuv maps UV_FS_O_DIRECT to
+// FILE_FLAG_NO_BUFFERING, so expose it under the portable name.
+#define O_DIRECT UV_FS_O_DIRECT
+  NODE_DEFINE_CONSTANT(target, O_DIRECT);
+#undef O_DIRECT
 #endif
 
 #ifdef O_NONBLOCK
diff --git a/test/parallel/test-fs-constants.js b/test/parallel/test-fs-constants.js
index b2ea4ce20ee6..62af2e8f1349 100644
--- a/test/parallel/test-fs-constants.js
+++ b/test/parallel/test-fs-constants.js
@@ -1,5 +1,5 @@
 'use strict';
-require('../common');
+const common = require('../common');
 const fs = require('fs');
 const assert = require('assert');
 
@@ -7,6 +7,15 @@ const assert = require('assert');
 assert.notStrictEqual(fs.constants.S_IRUSR, undefined);
 assert.notStrictEqual(fs.constants.S_IWUSR, undefined);
 
+// O_SYNC, O_DSYNC and O_DIRECT have no POSIX macro on Windows, but libuv
+// honors them via FILE_FLAG_WRITE_THROUGH / FILE_FLAG_NO_BUFFERING, so they
+// are exposed under their portable names with libuv's flag values.
+if (common.isWindows) {
+  assert.strictEqual(fs.constants.O_SYNC, 0x08000000);
+  assert.strictEqual(fs.constants.O_DSYNC, 0x04000000);
+  assert.strictEqual(fs.constants.O_DIRECT, 0x02000000);
+}
+
 // Check null prototype.
 assert.strictEqual(Object.getPrototypeOf(fs.constants), null);
 

From 2de845b2dd7ddc258f7e09bf5c69422f6b8c5e2e Mon Sep 17 00:00:00 2001
From: Kirill Saied <sayed.kirill@gmail.com>
Date: Thu, 20 Aug 2026 13:17:04 +0200
Subject: [PATCH 246/344] fs: treat `std::errc::permission_denied` as `EPERM`
 error

In the thrown exception, `std::errc::permission_denied` is already
treated as an `EPERM` error, but it is not included in one of the
omittable errors when retrying the `RmSync` operation. This commit
includes it.

This also fixes the `retryDelay` calculation on Windows where the
`retryDelay` is divided by `1000` but the win32's `Sleep` function
takes the argument as an `ms` unit, dividing the supplied `ms` unit
further to a much smaller delay.

Signed-off-by: louiellan <louie.lou.llaneta@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64698
Fixes: https://github.com/nodejs/node/issues/64016
Refs: https://github.com/nodejs/node/pull/64017
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 src/node_file.cc                              |  7 +-
 test/parallel/test-fs-rmSync-eperm-retries.js | 85 +++++++++++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-fs-rmSync-eperm-retries.js

diff --git a/src/node_file.cc b/src/node_file.cc
index 776384f7e426..f7437da0f2bb 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -1793,6 +1793,9 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
             error == std::errc::too_many_files_open ||
             error == std::errc::too_many_files_open_in_system ||
             error == std::errc::directory_not_empty ||
+#ifdef _WIN32
+            error == std::errc::permission_denied ||
+#endif
             error == std::errc::operation_not_permitted);
   };
 
@@ -1813,8 +1816,10 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
 
     if (retryDelay > 0) {
 #ifdef _WIN32
-      Sleep(i * retryDelay / 1000);
+      // No conversion needed: Sleep() takes milliseconds.
+      Sleep(i * retryDelay);
 #else
+      // sleep() takes seconds, so convert the millisecond delay.
       sleep(i * retryDelay / 1000);
 #endif
     }
diff --git a/test/parallel/test-fs-rmSync-eperm-retries.js b/test/parallel/test-fs-rmSync-eperm-retries.js
new file mode 100644
index 000000000000..55f1d9b30708
--- /dev/null
+++ b/test/parallel/test-fs-rmSync-eperm-retries.js
@@ -0,0 +1,85 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.isWindows)
+  common.skip('Windows-specific: EPERM sharing-violation retry in rmSync');
+
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { once } = require('events');
+const { spawn } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+tmpdir.refresh();
+
+// UV_FS_O_EXLOCK opens with share mode 0, so deletion fails with EPERM
+// until this process kills the child.
+const lockerScript = `
+  const fs = require('fs');
+  const UV_FS_O_EXLOCK = 0x10000000;
+  fs.openSync(process.argv[1], fs.constants.O_RDWR | UV_FS_O_EXLOCK);
+  process.stdout.write('locked');
+  setInterval(() => {}, 60_000);
+`;
+
+async function spawnLocker(file) {
+  const child = spawn(process.execPath, ['-e', lockerScript, file],
+                      { stdio: ['ignore', 'pipe', 'inherit'] });
+  const [data] = await once(child.stdout, 'data');
+  assert.strictEqual(data.toString(), 'locked');
+  return child;
+}
+
+// Sleep before retry i is i * retryDelay ms, so all retries take at least
+// retryDelay * (1 + 2 + ... + maxRetries) ms.
+function minRetryTime({ maxRetries, retryDelay }) {
+  return retryDelay * maxRetries * (maxRetries + 1) / 2;
+}
+
+function timedRmThrowsEPERM(dir, options) {
+  const start = Date.now();
+  assert.throws(() => {
+    fs.rmSync(dir, { recursive: true, ...options });
+  }, {
+    code: 'EPERM',
+    name: 'Error',
+    syscall: 'rm',
+  });
+  return Date.now() - start;
+}
+
+(async () => {
+  const dir = tmpdir.resolve('rm-eperm-retries');
+  const file = path.join(dir, 'locked.txt');
+  fs.mkdirSync(dir);
+  fs.writeFileSync(file, 'hello');
+
+  const child = await spawnLocker(file);
+  try {
+    // Proves the lock is effective: no retries means an immediate EPERM.
+    timedRmThrowsEPERM(dir, { maxRetries: 0, retryDelay: 0 });
+    assert.strictEqual(fs.existsSync(file), true);
+
+    const options = { maxRetries: 4, retryDelay: 100 };
+    const expected = minRetryTime(options);  // 100+200+300+400 = 1000 ms.
+    const elapsed = timedRmThrowsEPERM(dir, options);
+
+    // Windows timer granularity may shave a few ms off each Sleep() call.
+    const slack = 16 * options.maxRetries;
+    assert.ok(elapsed >= expected - slack,
+              `rmSync() gave up after ${elapsed}ms; expected it to spend at ` +
+              `least ~${expected}ms on ${options.maxRetries} retries of ` +
+              `${options.retryDelay}ms escalating delay`);
+
+    // Catches unit confusion (e.g. seconds vs. milliseconds) in the delay.
+    assert.ok(elapsed < common.platformTimeout(expected * 10),
+              `rmSync() gave up after ${elapsed}ms; expected roughly ` +
+              `${expected}ms for ${options.maxRetries} retries`);
+  } finally {
+    child.kill();
+  }
+  await once(child, 'exit');
+  assert.strictEqual(fs.existsSync(file), true);
+})().then(common.mustCall());

From 340b98346f4d6c6006b2abc47642132cf34a58b6 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Thu, 20 Aug 2026 14:16:09 +0200
Subject: [PATCH 247/344] src: run same-priority platform tasks in posting
 order

TaskQueue became a std::priority_queue when worker tasks started to
honor v8::TaskPriority. Its comparator returns false for entry types
without a priority member, and for entries of equal priority, on the
assumption that the heap then keeps insertion order. It does not: three
tasks pushed A, B, C pop as A, C, B, and larger batches come out in
heap order. That affects the per-isolate foreground task queue (tasks
of one priority no longer run in the order they were posted), the
foreground delayed task queue, and the delayed task scheduler of the
worker thread task runner, whose local queue is drained in one batch:
when v8 posts a delayed worker task shortly before the platform shuts
down, the StopTask pushed by Stop() can run before a ScheduleTask that
was pushed earlier, that ScheduleTask then starts a timer on the
scheduler's loop after all timers were supposed to be stopped, and
Shutdown() blocks in uv_thread_join() until the delay (e.g. the 8 s of
the memory reducer) expires.

Give every queued item a sequence number and use it as the tie
breaker, so that tasks of equal priority, and tasks without one, come
out in FIFO order again; higher priorities still come first. PopAll()
now returns the tasks in that order instead of handing out the heap.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65353
Refs: https://github.com/nodejs/node/pull/58047
Refs: https://github.com/nodejs/node/pull/61999
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 src/node_platform.cc         | 72 +++++++++++++++---------------------
 src/node_platform.h          | 41 +++++++++++---------
 test/cctest/test_platform.cc | 50 +++++++++++++++++++++++++
 3 files changed, 103 insertions(+), 60 deletions(-)

diff --git a/src/node_platform.cc b/src/node_platform.cc
index 57a43eeb6459..71a4e3d5ee83 100644
--- a/src/node_platform.cc
+++ b/src/node_platform.cc
@@ -157,16 +157,9 @@ class WorkerThreadsTaskRunner::DelayedTaskScheduler {
     DelayedTaskScheduler* scheduler =
         ContainerOf(&DelayedTaskScheduler::loop_, flush_tasks->loop);
 
-    auto tasks_to_run = scheduler->tasks_.Lock().PopAll();
-    while (!tasks_to_run.empty()) {
-      // We have to use const_cast because std::priority_queue::top() does not
-      // return a movable item.
-      std::unique_ptr<Task> task =
-          std::move(const_cast<std::unique_ptr<Task>&>(tasks_to_run.top()));
-      tasks_to_run.pop();
-      // This runs either the ScheduleTasks that scheduels the timers to
-      // pop the tasks back into the worker task runner queue, or the
-      // or the StopTasks to stop the timers and drop all the pending tasks.
+    // ScheduleTasks (start a timer that pops the task into the worker queue)
+    // in posting order, then, once Stop() was called, the StopTask.
+    for (std::unique_ptr<Task>& task : scheduler->tasks_.Lock().PopAll()) {
       task->Run();
     }
   }
@@ -611,15 +604,8 @@ void NodePlatform::DrainTasks(Isolate* isolate) {
 bool PerIsolatePlatformData::FlushForegroundTasksInternal() {
   bool did_work = false;
 
-  auto delayed_tasks_to_schedule = foreground_delayed_tasks_.Lock().PopAll();
-  while (!delayed_tasks_to_schedule.empty()) {
-    // We have to use const_cast because std::priority_queue::top() does not
-    // return a movable item.
-    std::unique_ptr<DelayedTask> delayed =
-        std::move(const_cast<std::unique_ptr<DelayedTask>&>(
-            delayed_tasks_to_schedule.top()));
-    delayed_tasks_to_schedule.pop();
-
+  for (std::unique_ptr<DelayedTask>& delayed :
+       foreground_delayed_tasks_.Lock().PopAll()) {
     did_work = true;
     uint64_t delay_millis = llround(delayed->timeout * 1000);
 
@@ -642,18 +628,8 @@ bool PerIsolatePlatformData::FlushForegroundTasksInternal() {
         });
   }
 
-  TaskQueue<TaskQueueEntry>::PriorityQueue tasks;
-  {
-    auto locked = foreground_tasks_.Lock();
-    tasks = locked.PopAll();
-  }
-
-  while (!tasks.empty()) {
-    // We have to use const_cast because std::priority_queue::top() does not
-    // return a movable item.
-    std::unique_ptr<TaskQueueEntry> entry =
-        std::move(const_cast<std::unique_ptr<TaskQueueEntry>&>(tasks.top()));
-    tasks.pop();
+  for (std::unique_ptr<TaskQueueEntry>& entry :
+       foreground_tasks_.Lock().PopAll()) {
     did_work = true;
     RunForegroundTask(std::move(entry->task));
   }
@@ -788,12 +764,21 @@ template <class T>
 TaskQueue<T>::Locked::Locked(TaskQueue* queue)
     : queue_(queue), lock_(queue->lock_) {}
 
+template <class T>
+std::unique_ptr<T> TaskQueue<T>::PopTask() {
+  // std::priority_queue::top() only hands out a const reference.
+  Item& top = const_cast<Item&>(task_queue_.top());
+  std::unique_ptr<T> task = std::move(top.task);
+  task_queue_.pop();
+  return task;
+}
+
 template <class T>
 void TaskQueue<T>::Locked::Push(std::unique_ptr<T> task, bool outstanding) {
   if (outstanding) {
     queue_->outstanding_tasks_++;
   }
-  queue_->task_queue_.push(std::move(task));
+  queue_->task_queue_.push({std::move(task), queue_->next_sequence_++});
   queue_->tasks_available_.Signal(lock_);
 }
 
@@ -802,10 +787,7 @@ std::unique_ptr<T> TaskQueue<T>::Locked::Pop() {
   if (queue_->task_queue_.empty()) {
     return std::unique_ptr<T>(nullptr);
   }
-  std::unique_ptr<T> result = std::move(
-      std::move(const_cast<std::unique_ptr<T>&>(queue_->task_queue_.top())));
-  queue_->task_queue_.pop();
-  return result;
+  return queue_->PopTask();
 }
 
 template <class T>
@@ -816,10 +798,7 @@ std::unique_ptr<T> TaskQueue<T>::Locked::BlockingPop() {
   if (queue_->stopped_) {
     return std::unique_ptr<T>(nullptr);
   }
-  std::unique_ptr<T> result = std::move(
-      std::move(const_cast<std::unique_ptr<T>&>(queue_->task_queue_.top())));
-  queue_->task_queue_.pop();
-  return result;
+  return queue_->PopTask();
 }
 
 template <class T>
@@ -843,12 +822,19 @@ void TaskQueue<T>::Locked::Stop() {
 }
 
 template <class T>
-TaskQueue<T>::PriorityQueue TaskQueue<T>::Locked::PopAll() {
-  TaskQueue<T>::PriorityQueue result;
-  result.swap(queue_->task_queue_);
+std::vector<std::unique_ptr<T>> TaskQueue<T>::Locked::PopAll() {
+  std::vector<std::unique_ptr<T>> result;
+  result.reserve(queue_->task_queue_.size());
+  while (!queue_->task_queue_.empty()) {
+    result.push_back(queue_->PopTask());
+  }
   return result;
 }
 
+template class TaskQueue<Task>;
+template class TaskQueue<TaskQueueEntry>;
+template class TaskQueue<DelayedTask>;
+
 void MultiIsolatePlatform::DisposeIsolate(Isolate* isolate) {
   // The order of these calls is important. When the Isolate is disposed,
   // it may still post tasks to the platform, so it must still be registered
diff --git a/src/node_platform.h b/src/node_platform.h
index e98ecf322802..bd6fe024d5e8 100644
--- a/src/node_platform.h
+++ b/src/node_platform.h
@@ -27,22 +27,6 @@ concept has_priority = requires(T t) { t.priority; };
 template <class T>
 class TaskQueue {
  public:
-  // If the entry type has a priority member, order the priority queue by
-  // that - higher priority first. Otherwise, maintain insertion order.
-  struct EntryCompare {
-    bool operator()(const std::unique_ptr<T>& a,
-                    const std::unique_ptr<T>& b) const {
-      if constexpr (has_priority<T>) {
-        return a->priority < b->priority;
-      } else {
-        return false;
-      }
-    }
-  };
-
-  using PriorityQueue = std::priority_queue<std::unique_ptr<T>,
-                                            std::vector<std::unique_ptr<T>>,
-                                            EntryCompare>;
   class Locked {
    public:
     void Push(std::unique_ptr<T> task, bool outstanding = false);
@@ -51,7 +35,8 @@ class TaskQueue {
     void NotifyOfOutstandingCompletion();
     void BlockingDrain();
     void Stop();
-    PriorityQueue PopAll();
+    // All queued tasks, in the order Pop() would have returned them.
+    std::vector<std::unique_ptr<T>> PopAll();
 
    private:
     friend class TaskQueue;
@@ -67,11 +52,33 @@ class TaskQueue {
   Locked Lock() { return Locked(this); }
 
  private:
+  struct Item {
+    std::unique_ptr<T> task;
+    uint64_t sequence;
+  };
+  // Higher priority first if the entry type has one; posting order otherwise
+  // and among equal priorities (a sequence number breaks the tie).
+  struct ItemCompare {
+    bool operator()(const Item& a, const Item& b) const {
+      if constexpr (has_priority<T>) {
+        if (a.task->priority != b.task->priority) {
+          return a.task->priority < b.task->priority;
+        }
+      }
+      return a.sequence > b.sequence;
+    }
+  };
+  using PriorityQueue =
+      std::priority_queue<Item, std::vector<Item>, ItemCompare>;
+
+  std::unique_ptr<T> PopTask();
+
   Mutex lock_;
   ConditionVariable tasks_available_;
   ConditionVariable outstanding_tasks_drained_;
   int outstanding_tasks_;
   bool stopped_;
+  uint64_t next_sequence_ = 0;
   PriorityQueue task_queue_;
 };
 
diff --git a/test/cctest/test_platform.cc b/test/cctest/test_platform.cc
index f1c1d52d92c7..170c43ba7441 100644
--- a/test/cctest/test_platform.cc
+++ b/test/cctest/test_platform.cc
@@ -128,3 +128,53 @@ TEST_F(PlatformTest, TracingControllerNullptr) {
   node::SetTracingController(orig_controller);
   EXPECT_EQ(node::GetTracingController(), orig_controller);
 }
+
+class RecordingTask : public v8::Task {
+ public:
+  RecordingTask(std::vector<int>* log, int id) : log_(log), id_(id) {}
+  void Run() override { log_->push_back(id_); }
+
+ private:
+  std::vector<int>* log_;
+  int id_;
+};
+
+TEST(TaskQueueTest, HigherPriorityFirstThenPostingOrder) {
+  std::vector<int> log;
+  {
+    node::TaskQueue<v8::Task> queue;
+    for (int i = 0; i < 64; i++) {
+      queue.Lock().Push(std::make_unique<RecordingTask>(&log, i));
+    }
+    for (std::unique_ptr<v8::Task>& task : queue.Lock().PopAll()) task->Run();
+    for (int i = 64; i < 96; i++) {
+      queue.Lock().Push(std::make_unique<RecordingTask>(&log, i));
+    }
+    while (std::unique_ptr<v8::Task> task = queue.Lock().Pop()) task->Run();
+  }
+  ASSERT_EQ(log.size(), 96u);
+  for (int i = 0; i < 96; i++) EXPECT_EQ(log[i], i);
+
+  log.clear();
+  {
+    using v8::TaskPriority;
+    node::TaskQueue<node::TaskQueueEntry> queue;
+    const TaskPriority priorities[] = {TaskPriority::kUserVisible,
+                                       TaskPriority::kBestEffort,
+                                       TaskPriority::kUserBlocking,
+                                       TaskPriority::kUserVisible,
+                                       TaskPriority::kUserBlocking,
+                                       TaskPriority::kBestEffort,
+                                       TaskPriority::kUserVisible};
+    int id = 0;
+    for (TaskPriority priority : priorities) {
+      queue.Lock().Push(std::make_unique<node::TaskQueueEntry>(
+          std::make_unique<RecordingTask>(&log, id++), priority));
+    }
+    for (std::unique_ptr<node::TaskQueueEntry>& entry : queue.Lock().PopAll()) {
+      entry->task->Run();
+    }
+  }
+  const std::vector<int> expected = {2, 4, 0, 3, 6, 1, 5};
+  EXPECT_EQ(log, expected);
+}

From 1a4f5e537b3c11c8035b2f57889025e154220e1c Mon Sep 17 00:00:00 2001
From: Stefan Stojanovic <StefanStojanovic@users.noreply.github.com>
Date: Thu, 20 Aug 2026 15:18:01 +0200
Subject: [PATCH 248/344] build,win: add PGO workload scripts

Signed-off-by: StefanStojanovic <stefan.stojanovic@janeasystems.com>
PR-URL: https://github.com/nodejs/node/pull/63696
Refs: https://github.com/nodejs/node/issues/61964
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 pgo.ps1                          | 162 +++++++
 tools/pgo/README.md              |  98 +++++
 tools/pgo/pgo-async-patterns.js  | 467 ++++++++++++++++++++
 tools/pgo/pgo-child-workers.js   | 284 ++++++++++++
 tools/pgo/pgo-compression.js     | 417 ++++++++++++++++++
 tools/pgo/pgo-crypto.js          | 401 +++++++++++++++++
 tools/pgo/pgo-fs.js              | 447 +++++++++++++++++++
 tools/pgo/pgo-http-server.js     | 380 ++++++++++++++++
 tools/pgo/pgo-json.js            | 341 +++++++++++++++
 tools/pgo/pgo-module-loading.js  | 719 +++++++++++++++++++++++++++++++
 tools/pgo/pgo-net.js             | 443 +++++++++++++++++++
 tools/pgo/pgo-run-all.js         | 339 +++++++++++++++
 tools/pgo/pgo-streams-buffers.js | 579 +++++++++++++++++++++++++
 tools/pgo/pgo-url-string.js      | 566 ++++++++++++++++++++++++
 14 files changed, 5643 insertions(+)
 create mode 100644 pgo.ps1
 create mode 100644 tools/pgo/README.md
 create mode 100644 tools/pgo/pgo-async-patterns.js
 create mode 100644 tools/pgo/pgo-child-workers.js
 create mode 100644 tools/pgo/pgo-compression.js
 create mode 100644 tools/pgo/pgo-crypto.js
 create mode 100644 tools/pgo/pgo-fs.js
 create mode 100644 tools/pgo/pgo-http-server.js
 create mode 100644 tools/pgo/pgo-json.js
 create mode 100644 tools/pgo/pgo-module-loading.js
 create mode 100644 tools/pgo/pgo-net.js
 create mode 100644 tools/pgo/pgo-run-all.js
 create mode 100644 tools/pgo/pgo-streams-buffers.js
 create mode 100644 tools/pgo/pgo-url-string.js

diff --git a/pgo.ps1 b/pgo.ps1
new file mode 100644
index 000000000000..39f5352463e3
--- /dev/null
+++ b/pgo.ps1
@@ -0,0 +1,162 @@
+# PGO (Profile-Guided Optimization) training script for Node.js (Clang / LLVM)
+#
+# Runs PGO training workloads against an instrumented Node.js binary
+# (Release\node.exe) and merges the resulting .profraw files into
+# node.profdata for use with -fprofile-use.
+#
+# Usage (from a VS Developer Command Prompt):
+#   .\pgo.ps1                     # Run workloads (15s each) and merge
+#   .\pgo.ps1 -Duration 30        # Run workloads (30s each) and merge
+#
+# Prerequisites:
+#   - Release\node.exe must be an instrumented build (built with pgo-generate)
+#   - llvm-profdata must be available (shipped with VS LLVM toolset)
+#
+# Output:
+#   - node.profdata in the repo root (ready for vcbuild.bat pgo-use)
+
+param(
+    [int]$Duration = 15
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# ---------------------------------------------------------------------------
+# Locate llvm-profdata shipped with Visual Studio's LLVM toolset
+# ---------------------------------------------------------------------------
+
+function Find-LlvmProfdata {
+    # vcbuild.bat uses %VCINSTALLDIR%\Tools\Llvm\x64\bin for clang.exe - same spot for profdata
+    $vcInstallDir = $env:VCINSTALLDIR
+
+    if ($vcInstallDir) {
+        $candidate = Join-Path $vcInstallDir "Tools\Llvm\x64\bin\llvm-profdata.exe"
+        if (Test-Path $candidate) {
+            return $candidate
+        }
+    }
+
+    # Fallback: try VS 2022 / 2026 default install locations
+    $vsPaths = @(
+        "${env:ProgramFiles}\Microsoft Visual Studio\2026\Enterprise\VC\Tools\Llvm\x64\bin",
+        "${env:ProgramFiles}\Microsoft Visual Studio\2026\Community\VC\Tools\Llvm\x64\bin",
+        "${env:ProgramFiles}\Microsoft Visual Studio\2022\Enterprise\VC\Tools\Llvm\x64\bin",
+        "${env:ProgramFiles}\Microsoft Visual Studio\2022\Community\VC\Tools\Llvm\x64\bin"
+    )
+    foreach ($dir in $vsPaths) {
+        $candidate = Join-Path $dir "llvm-profdata.exe"
+        if (Test-Path $candidate) {
+            return $candidate
+        }
+    }
+
+    # Last resort: PATH
+    $fromPath = Get-Command llvm-profdata -ErrorAction SilentlyContinue
+    if ($fromPath) {
+        return $fromPath.Source
+    }
+
+    return $null
+}
+
+# ---------------------------------------------------------------------------
+# Validate prerequisites
+# ---------------------------------------------------------------------------
+
+$instrumentedNode = Join-Path $PSScriptRoot "Release\node.exe"
+if (-not (Test-Path $instrumentedNode)) {
+    Write-Error "Instrumented binary not found: $instrumentedNode`nBuild with: vcbuild.bat pgo-generate"
+    exit 1
+}
+
+$pgoRunAll = Join-Path $PSScriptRoot "tools\pgo\pgo-run-all.js"
+if (-not (Test-Path $pgoRunAll)) {
+    Write-Error "PGO training script not found: $pgoRunAll"
+    exit 1
+}
+
+$llvmProfdata = Find-LlvmProfdata
+if (-not $llvmProfdata) {
+    Write-Error "llvm-profdata not found. Install the LLVM toolset via Visual Studio Installer."
+    exit 1
+}
+
+# ---------------------------------------------------------------------------
+# STEP 1 – Run workloads with the instrumented binary to collect profiles
+# ---------------------------------------------------------------------------
+
+Write-Host "`n=== STEP 1: Collect PGO profiles ===" -ForegroundColor Cyan
+
+# Directory that will receive .profraw files from the instrumented binary.
+# %p (PID) and %m (module hash) keep concurrent/fork'd processes from colliding.
+$profileDir = Join-Path $PSScriptRoot "pgo-profiles"
+
+if (Test-Path $profileDir) {
+    Remove-Item -Recurse -Force $profileDir
+}
+New-Item -ItemType Directory -Path $profileDir | Out-Null
+
+$env:LLVM_PROFILE_FILE = Join-Path $profileDir "node-%p-%m.profraw"
+
+Write-Host "Instrumented node : $instrumentedNode"
+Write-Host "Profile output    : $($env:LLVM_PROFILE_FILE)"
+Write-Host "Duration per script: ${Duration}s"
+Write-Host ""
+
+$sw = [System.Diagnostics.Stopwatch]::StartNew()
+$proc = Start-Process `
+    -FilePath $instrumentedNode `
+    -ArgumentList "`"$pgoRunAll`" --verbose --duration=$Duration" `
+    -Wait -PassThru -NoNewWindow
+$sw.Stop()
+Write-Host ("PGO training completed in {0}m {1}s (exit code: {2})" -f `
+    $sw.Elapsed.Minutes, $sw.Elapsed.Seconds, $proc.ExitCode)
+if ($proc.ExitCode -ne 0) {
+    Write-Warning "PGO training exited with code $($proc.ExitCode) - continuing with merge"
+}
+
+# Remove the env var so subsequent builds are not affected
+Remove-Item Env:\LLVM_PROFILE_FILE -ErrorAction SilentlyContinue
+
+# ---------------------------------------------------------------------------
+# STEP 2 – Merge .profraw files -> node.profdata
+# ---------------------------------------------------------------------------
+
+Write-Host "`n=== STEP 2: Merge profile data ===" -ForegroundColor Cyan
+
+Write-Host "Using llvm-profdata: $llvmProfdata"
+
+$profrawFiles = Get-ChildItem -Path $profileDir -Filter "*.profraw" -ErrorAction SilentlyContinue
+if ($profrawFiles.Count -eq 0) {
+    Write-Error "No .profraw files found in '$profileDir'. The instrumented binary may not have generated profile data."
+    exit 1
+}
+
+$totalSize = ($profrawFiles | Measure-Object -Property Length -Sum).Sum
+$totalSizeMB = [math]::Round($totalSize / 1MB, 1)
+Write-Host "Found $($profrawFiles.Count) .profraw file(s), ${totalSizeMB} MB total"
+
+$profdata = Join-Path $PSScriptRoot "node.profdata"
+$mergeArgs = @("merge", "--output=$profdata") + ($profrawFiles | Select-Object -ExpandProperty FullName)
+
+$mergeStopwatch = [System.Diagnostics.Stopwatch]::StartNew()
+& $llvmProfdata @mergeArgs
+$mergeExitCode = $LASTEXITCODE
+$mergeStopwatch.Stop()
+
+if ($mergeExitCode -ne 0) {
+    Write-Error "llvm-profdata merge failed (exit code $mergeExitCode)"
+    exit $mergeExitCode
+}
+
+$profdataSize = [math]::Round((Get-Item $profdata).Length / 1MB, 1)
+Write-Host "Merge completed in $([math]::Round($mergeStopwatch.Elapsed.TotalSeconds, 1))s"
+
+# Clean up .profraw files now that they've been merged
+Remove-Item -Recurse -Force $profileDir
+Write-Host "Removed $($profrawFiles.Count) .profraw file(s) (${totalSizeMB} MB reclaimed)"
+
+Write-Host "`n=== PGO training complete ===" -ForegroundColor Green
+Write-Host "  Profile data: $profdata (${profdataSize} MB)"
+Write-Host "  Next step:    vcbuild.bat pgo-use"
diff --git a/tools/pgo/README.md b/tools/pgo/README.md
new file mode 100644
index 000000000000..9277315508ca
--- /dev/null
+++ b/tools/pgo/README.md
@@ -0,0 +1,98 @@
+# Node.js PGO Training Scripts
+
+Training workloads for Profile-Guided Optimization (PGO) builds using
+Clang/LLVM (including Clang-CL on Windows).
+
+## What is PGO?
+
+PGO uses runtime profile data to guide compiler optimizations (inlining,
+branch prediction, code layout), typically improving throughput by 5-20%.
+
+The process has three phases:
+
+1. **Instrument** — Build with `-fprofile-generate` (produces `.profraw` files)
+2. **Train** — Run representative workloads to collect profile data
+3. **Optimize** — Merge `.profraw` → `node.profdata` via `llvm-profdata`,
+   then rebuild with `-fprofile-use`
+
+## Quick Start
+
+From a VS Developer Command Prompt:
+
+```powershell
+# Step 1: Build the instrumented binary
+vcbuild.bat pgo-generate
+
+# Step 2: Run workloads and merge profile data
+.\pgo.ps1
+
+# Step 3: Build the optimized binary
+vcbuild.bat pgo-use
+```
+
+`pgo.ps1` expects the instrumented binary at `Release\node.exe` (produced by
+step 1) and writes `node.profdata` to the repo root (consumed by step 3).
+
+```powershell
+# Optionally set a longer training duration (default: 15s per script)
+.\pgo.ps1 -Duration 30
+```
+
+## Training Scripts
+
+All scripts use only Node.js built-in modules (no npm dependencies).
+Each script is run as a separate process via `fork()`, producing its own
+`.profraw` file.
+
+| Script                   | What it exercises                                             |
+| ------------------------ | ------------------------------------------------------------- |
+| `pgo-http-server.js`     | llhttp parser, TCP stack, header serialization, JSON, routing |
+| `pgo-json.js`            | V8 JSON parser/serializer, string allocation, GC pressure     |
+| `pgo-crypto.js`          | OpenSSL (hashing, HMAC, AES, RSA, ECDSA, random, KDF)        |
+| `pgo-streams-buffers.js` | Buffer C++ impl, stream state machine, back-pressure          |
+| `pgo-fs.js`              | libuv fs operations, thread pool, path module                 |
+| `pgo-async-patterns.js`  | V8 Promises, microtask queue, EventEmitter, timers            |
+| `pgo-url-string.js`      | Ada URL parser, V8 string internals, regex JIT                |
+| `pgo-compression.js`     | zlib, brotli C libraries, streaming compression               |
+| `pgo-net.js`             | libuv TCP/pipe handles, c-ares DNS resolver                   |
+| `pgo-module-loading.js`  | Module resolver, V8 script compilation, vm module             |
+| `pgo-child-workers.js`   | Worker thread messaging, SharedArrayBuffer, inline eval       |
+
+### Running the Orchestrator Directly
+
+The orchestrator can also be invoked directly (e.g. for testing individual
+workloads). When used with `pgo.ps1`, this is handled automatically.
+
+```bash
+# Run all scripts
+node tools/pgo/pgo-run-all.js --duration=15 --verbose
+
+# Run specific scripts
+node tools/pgo/pgo-run-all.js --scripts=http-server,json,crypto --duration=30
+
+# Show help
+node tools/pgo/pgo-run-all.js --help
+```
+
+Each script reads the `PGO_TRAINING_DURATION` environment variable (in
+milliseconds) to determine how long to run. The orchestrator sets this
+automatically from the `--duration` flag (in seconds).
+
+## Files
+
+```
+tools/pgo/
+├── pgo-run-all.js          # Training orchestrator
+├── pgo-http-server.js      # HTTP server + client workload
+├── pgo-json.js             # JSON parse/stringify workload
+├── pgo-crypto.js           # Crypto operations workload
+├── pgo-streams-buffers.js  # Streams and Buffer workload
+├── pgo-fs.js               # File system operations workload
+├── pgo-async-patterns.js   # Promise/async, EventEmitter, timers workload
+├── pgo-url-string.js       # URL parsing, string ops, regex workload
+├── pgo-compression.js      # Gzip/brotli/deflate compression workload
+├── pgo-net.js              # TCP networking and DNS workload
+├── pgo-module-loading.js   # Module require/import, VM compilation workload
+├── pgo-child-workers.js    # Worker threads workload
+└── README.md               # This file
+```
diff --git a/tools/pgo/pgo-async-patterns.js b/tools/pgo/pgo-async-patterns.js
new file mode 100644
index 000000000000..3f00c13fb08f
--- /dev/null
+++ b/tools/pgo/pgo-async-patterns.js
@@ -0,0 +1,467 @@
+'use strict';
+
+/* eslint-disable no-void */
+
+// PGO Training Script: Async Patterns, Timers, and Events
+//
+// Modern Node.js code is dominated by async/await and Promises.
+// This script exercises:
+// - Promise creation, chaining, and resolution (every async operation)
+// - async/await control flow (the primary coding pattern)
+// - Promise.all/allSettled/race/any (concurrent operation patterns)
+// - EventEmitter (backbone of all Node.js I/O)
+// - Timers: setTimeout, setInterval, setImmediate (scheduling)
+// - AbortController/AbortSignal (cancellation - growing usage)
+// - queueMicrotask / process.nextTick (microtask scheduling)
+// - AsyncLocalStorage (request context propagation - growing fast)
+//
+// This exercises: V8 Promise machinery, microtask queue, libuv timer heap,
+// EventEmitter C++/JS boundary, AbortSignal C++ implementation.
+
+const { EventEmitter } = require('events');
+const { AsyncLocalStorage } = require('async_hooks');
+const {
+  setTimeout: setTimeoutPromise,
+  setImmediate: setImmediatePromise,
+} = require('timers/promises');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+
+// Workload 1: Promise chains (REST API middleware pattern)
+async function workloadPromiseChains(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Simple promise chain (Express middleware-like)
+    await Promise.resolve({ method: 'GET', url: '/api/users' })
+      .then((req) => ({ ...req, authenticated: true }))
+      .then((req) => ({ ...req, parsed: true, body: {} }))
+      .then((req) => ({ ...req, validated: true }))
+      .then(() => ({
+        status: 200,
+        body: JSON.stringify({ users: [], total: 0 }),
+        headers: { 'content-type': 'application/json' },
+      }));
+    ops++;
+
+    // Promise with error handling (try/catch in async flow)
+    try {
+      await Promise.resolve(i)
+        .then((v) => {
+          if (v % 7 === 0) throw new Error('validation');
+          return v;
+        })
+        .then((v) => v * 2)
+        .catch((err) => ({ error: err.message }));
+      ops++;
+    } catch {
+      ops++;
+    }
+
+    // Nested promise resolution (database query pattern)
+    const result = await new Promise((resolve) => {
+      // Simulate async work
+      resolve({
+        rows: Array.from({ length: 10 }, (_, j) => ({ id: j, value: i + j })),
+      });
+    });
+    await new Promise((resolve) => {
+      resolve(result.rows.map((r) => ({ ...r, processed: true })));
+    });
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 2: Promise.all / allSettled / race / any (concurrent patterns)
+async function workloadPromiseConcurrency(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Promise.all (parallel database queries, batch API calls)
+    await Promise.all(
+      Array.from({ length: 20 }, (_, j) =>
+        Promise.resolve({ id: j, data: `result_${j}` }),
+      ),
+    );
+    ops++;
+
+    // Promise.allSettled (fault-tolerant batch operations)
+    await Promise.allSettled(
+      Array.from({ length: 15 }, (_, j) =>
+        (j % 5 === 0 ?
+          Promise.reject(new Error(`fail_${j}`)) :
+          Promise.resolve({ id: j, ok: true })),
+      ),
+    );
+    ops++;
+
+    // Promise.race (timeout pattern)
+    await Promise.race([
+      Promise.resolve('fast'),
+      new Promise((resolve) => setTimeout(resolve, 10000, 'slow')),
+    ]);
+    ops++;
+
+    // Promise.any (failover pattern)
+    await Promise.any([
+      Promise.reject(new Error('server1')),
+      Promise.resolve('server2'),
+      Promise.resolve('server3'),
+    ]);
+    ops++;
+
+    // Batched parallel with limit (connection pool pattern)
+    const batchSize = 5;
+    const items = Array.from({ length: 20 }, (_, j) => j);
+    for (let start = 0; start < items.length; start += batchSize) {
+      const batch = items.slice(start, start + batchSize);
+      await Promise.all(batch.map((item) => Promise.resolve(item * 2)));
+    }
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 3: EventEmitter (core Node.js pattern)
+function workloadEventEmitter(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const emitter = new EventEmitter();
+
+    // Add multiple listeners (typical server setup)
+    const listeners = [];
+    for (let j = 0; j < 10; j++) {
+      const listener = (data) => {
+        data.processed = true;
+      };
+      listeners.push(listener);
+      emitter.on('data', listener);
+    }
+    ops++;
+
+    // Once listener (connection setup pattern)
+    emitter.once('connect', () => {});
+    emitter.once('ready', () => {});
+    ops++;
+
+    // Emit events (hot path in I/O)
+    for (let j = 0; j < 100; j++) {
+      emitter.emit('data', { id: j, value: j * 2 });
+    }
+    ops += 100;
+
+    // Emit with multiple arguments
+    for (let j = 0; j < 20; j++) {
+      emitter.emit('data', { id: j }, 'extra', j);
+    }
+    ops += 20;
+
+    // Error event handling
+    emitter.on('error', () => {});
+    emitter.emit('error', new Error('test'));
+    ops++;
+
+    // listenerCount / listeners (monitoring)
+    emitter.listenerCount('data');
+    emitter.listeners('data');
+    emitter.rawListeners('data');
+    emitter.eventNames();
+    ops += 4;
+
+    // Remove listeners (cleanup)
+    for (const listener of listeners) {
+      emitter.removeListener('data', listener);
+    }
+    emitter.removeAllListeners();
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 4: EventTarget (Web API compatibility — growing usage)
+function workloadEventTarget(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const target = new EventTarget();
+
+    // Add listeners
+    const handlers = [];
+    for (let j = 0; j < 5; j++) {
+      const handler = (e) => {
+        void e.detail;
+      };
+      handlers.push(handler);
+      target.addEventListener('message', handler);
+    }
+    ops++;
+
+    // Dispatch events
+    for (let j = 0; j < 50; j++) {
+      target.dispatchEvent(new Event('message'));
+    }
+    ops += 50;
+
+    // Remove listeners
+    for (const handler of handlers) {
+      target.removeEventListener('message', handler);
+    }
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 5: Timers (setTimeout, setInterval, setImmediate)
+async function workloadTimers(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // setTimeout with 0 (defer to next event loop - very common)
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    ops++;
+
+    // setImmediate (process next I/O callbacks first)
+    await new Promise((resolve) => setImmediate(resolve));
+    ops++;
+
+    // setTimeout promise API
+    await setTimeoutPromise(0);
+    ops++;
+
+    // setImmediate promise API
+    await setImmediatePromise();
+    ops++;
+
+    // Timer creation and cancellation (debounce/throttle patterns)
+    for (let j = 0; j < 10; j++) {
+      const timer = setTimeout(() => {}, 10000);
+      clearTimeout(timer);
+    }
+    ops += 10;
+
+    // setInterval + clearInterval (polling pattern)
+    const interval = setInterval(() => {}, 1000);
+    clearInterval(interval);
+    ops++;
+
+    // process.nextTick (microtask — higher priority than timers)
+    await new Promise((resolve) => process.nextTick(resolve));
+    ops++;
+
+    // queueMicrotask
+    await new Promise((resolve) => queueMicrotask(resolve));
+    ops++;
+
+    // Nested nextTick/microtask (realistic: multiple middleware layers)
+    await new Promise((outerResolve) => {
+      process.nextTick(() => {
+        queueMicrotask(() => {
+          process.nextTick(() => {
+            outerResolve();
+          });
+        });
+      });
+    });
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 6: AbortController (cancellation — widely used since Node.js 16+)
+async function workloadAbortController(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Create and signal (timeout pattern)
+    const ac1 = new AbortController();
+    const { signal: sig1 } = ac1;
+    sig1.addEventListener('abort', () => {});
+    ac1.abort();
+    ops++;
+
+    // AbortSignal.timeout (modern API)
+    const sig2 = AbortSignal.timeout(5000);
+    void sig2.aborted; // check status
+    ops++;
+
+    // AbortSignal.any (composite signals)
+    const ac3 = new AbortController();
+    const sig3 = AbortSignal.any([ac3.signal, AbortSignal.timeout(10000)]);
+    sig3.addEventListener('abort', () => {});
+    ac3.abort('cancelled');
+    ops++;
+
+    // Using with setTimeout (common pattern)
+    try {
+      const ac = new AbortController();
+      const timer = setTimeout(() => ac.abort(), 0);
+      await setTimeoutPromise(0, undefined, { signal: ac.signal });
+      clearTimeout(timer);
+      ops++;
+    } catch {
+      ops++; // AbortError is expected sometimes
+    }
+  }
+  return ops;
+}
+
+// Workload 7: AsyncLocalStorage (request context — Express, Fastify, Nest.js)
+async function workloadAsyncLocalStorage(iterations) {
+  let ops = 0;
+  const als = new AsyncLocalStorage();
+
+  for (let i = 0; i < iterations; i++) {
+    // Run with context (HTTP request lifecycle)
+    await als.run(
+      { requestId: `req-${i}`, userId: `user-${i % 100}` },
+      async () => {
+        const store = als.getStore();
+
+        // "Middleware" that reads context
+        void store.requestId;
+
+        // "Service" layer — context propagates through async calls
+        await Promise.resolve().then(() => {
+          const ctx = als.getStore();
+          return { ...ctx, processed: true };
+        });
+
+        // Nested async operation with context
+        await new Promise((resolve) => {
+          setImmediate(() => {
+            const ctx = als.getStore();
+            resolve(ctx);
+          });
+        });
+
+        ops++;
+      },
+    );
+
+    // enterWith pattern (alternative API)
+    als.enterWith({ contextId: i });
+    als.getStore();
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 8: Error creation and stack traces (very frequent in real apps)
+function workloadErrors(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Error creation with stack trace
+    const err1 = new Error(`Something went wrong: ${i}`);
+    void err1.stack; // Access stack (forces stack trace computation)
+    void err1.message;
+    ops++;
+
+    // TypeError (most common runtime error)
+    const err2 = new TypeError(`Cannot read property of undefined`);
+    void err2.stack;
+    ops++;
+
+    // RangeError
+    const err3 = new RangeError(`Value out of range: ${i}`);
+    err3.code = 'ERR_OUT_OF_RANGE';
+    void err3.stack;
+    ops++;
+
+    // try/catch (V8's exception handling path)
+    for (let j = 0; j < 10; j++) {
+      try {
+        if (j % 3 === 0) throw new Error(`Caught error ${j}`);
+        if (j % 7 === 0) throw new TypeError(`Type error ${j}`);
+      } catch (e) {
+        void e.message; // Access message
+      }
+    }
+    ops += 10;
+
+    // Error.captureStackTrace (custom errors pattern)
+    class AppError extends Error {
+      constructor(message, code) {
+        super(message);
+        this.code = code;
+        Error.captureStackTrace(this, AppError);
+      }
+    }
+    const err4 = new AppError('Not found', 404);
+    void err4.stack;
+    ops++;
+  }
+  return ops;
+}
+
+async function main() {
+  console.log('[pgo-async-patterns] Starting async patterns workload...');
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  while (remaining() > 0) {
+    round++;
+    const scale = Math.max(0.1, remaining() / DURATION_MS);
+    const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+    // Promise chains (extremely high frequency)
+    if (round === 1)
+      console.log('[pgo-async-patterns] Running promise chains...');
+    totalOps += await workloadPromiseChains(iterScale(500));
+    if (remaining() <= 0) break;
+
+    // Promise concurrency
+    if (round === 1)
+      console.log('[pgo-async-patterns] Running promise concurrency...');
+    totalOps += await workloadPromiseConcurrency(iterScale(200));
+    if (remaining() <= 0) break;
+
+    // EventEmitter (core pattern)
+    if (round === 1)
+      console.log('[pgo-async-patterns] Running EventEmitter...');
+    totalOps += workloadEventEmitter(iterScale(200));
+    if (remaining() <= 0) break;
+
+    // EventTarget
+    if (round === 1) console.log('[pgo-async-patterns] Running EventTarget...');
+    totalOps += workloadEventTarget(iterScale(100));
+    if (remaining() <= 0) break;
+
+    // Timers
+    if (round === 1) console.log('[pgo-async-patterns] Running timers...');
+    totalOps += await workloadTimers(iterScale(100));
+    if (remaining() <= 0) break;
+
+    // AbortController
+    if (round === 1)
+      console.log('[pgo-async-patterns] Running AbortController...');
+    totalOps += await workloadAbortController(iterScale(100));
+    if (remaining() <= 0) break;
+
+    // AsyncLocalStorage
+    if (round === 1)
+      console.log('[pgo-async-patterns] Running AsyncLocalStorage...');
+    totalOps += await workloadAsyncLocalStorage(iterScale(100));
+    if (remaining() <= 0) break;
+
+    // Errors
+    if (round === 1)
+      console.log('[pgo-async-patterns] Running error patterns...');
+    totalOps += workloadErrors(iterScale(300));
+  }
+
+  const elapsed = (Date.now() - startTime) / 1000;
+  console.log(
+    `[pgo-async-patterns] Completed ${totalOps} ops in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-async-patterns] Error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-child-workers.js b/tools/pgo/pgo-child-workers.js
new file mode 100644
index 000000000000..9f8451641cb3
--- /dev/null
+++ b/tools/pgo/pgo-child-workers.js
@@ -0,0 +1,284 @@
+'use strict';
+
+// PGO Training Script: Worker Threads
+//
+// Node.js Worker threads are used for:
+// - CPU-intensive parallel work (image processing, parsing, compilation)
+// - Thread pool patterns for offloading blocking work
+// - SharedArrayBuffer-based parallel computation
+// - Inline eval workers (used by some frameworks)
+//
+// This exercises: Worker thread messaging, structured clone serialization,
+// SharedArrayBuffer, Atomics, V8 isolate creation, module loading in workers.
+//
+// Note: child_process.spawn/fork are excluded from PGO training because each
+// spawned process generates its own .profraw file, creating hundreds of
+// startup-heavy profiles that dilute the steady-state profile data.
+
+const { Worker, isMainThread } = require('worker_threads');
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+const TEMP_DIR = path.join(
+  os.tmpdir(),
+  `node-pgo-workers-${process.pid}-${Date.now()}`,
+);
+
+function setup() {
+  fs.mkdirSync(TEMP_DIR, { recursive: true });
+
+  // Write worker script files
+  fs.writeFileSync(
+    path.join(TEMP_DIR, 'worker-cpu.js'),
+    `
+    'use strict';
+    const { parentPort, workerData } = require('worker_threads');
+
+    // CPU-intensive work: hash computation, JSON processing, regex
+    function doWork(data) {
+      const crypto = require('crypto');
+      const results = [];
+
+      for (let i = 0; i < data.iterations; i++) {
+        // Hash computation
+        const hash = crypto.createHash('sha256')
+          .update(JSON.stringify({ index: i, data: data.payload }))
+          .digest('hex');
+
+        // JSON round-trip
+        const obj = JSON.parse(JSON.stringify({
+          id: i,
+          hash,
+          timestamp: Date.now(),
+          nested: { a: { b: { c: i } } },
+        }));
+
+        // Regex processing
+        const text = 'The quick brown fox jumps over the lazy dog '.repeat(10);
+        const matches = text.match(/\\b\\w{4,}\\b/g) || [];
+
+        results.push({ hash: hash.slice(0, 8), matches: matches.length });
+      }
+
+      return { count: results.length, sample: results[0] };
+    }
+
+    parentPort.on('message', (msg) => {
+      if (msg.type === 'work') {
+        const result = doWork(msg.data);
+        parentPort.postMessage({ type: 'result', data: result });
+      }
+      if (msg.type === 'exit') {
+        process.exit(0);
+      }
+    });
+
+    // Also handle direct workerData
+    if (workerData && workerData.autoStart) {
+      const result = doWork(workerData);
+      parentPort.postMessage({ type: 'result', data: result });
+    }
+  `,
+  );
+
+  fs.writeFileSync(
+    path.join(TEMP_DIR, 'worker-shared.js'),
+    `
+    'use strict';
+    const { parentPort, workerData } = require('worker_threads');
+
+    // Shared memory worker: operates on SharedArrayBuffer
+    const { buffer, offset, length } = workerData;
+    const view = new Int32Array(buffer);
+
+    // Process assigned segment
+    for (let i = offset; i < offset + length; i++) {
+      // Atomic operations
+      Atomics.add(view, i, 1);
+      Atomics.load(view, i);
+    }
+
+    parentPort.postMessage({ done: true, processed: length });
+  `,
+  );
+}
+
+function cleanup() {
+  try {
+    fs.rmSync(TEMP_DIR, { recursive: true, force: true });
+  } catch {
+    // best effort
+  }
+}
+
+// Workload 1: Worker threads — message passing (the dominant pattern)
+async function workloadWorkerMessages(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const worker = new Worker(path.join(TEMP_DIR, 'worker-cpu.js'));
+
+    await new Promise((resolve, reject) => {
+      worker.on('message', (msg) => {
+        if (msg.type === 'result') {
+          ops++;
+          worker.postMessage({ type: 'exit' });
+        }
+      });
+      worker.on('exit', resolve);
+      worker.on('error', reject);
+
+      // Send work
+      worker.postMessage({
+        type: 'work',
+        data: { iterations: 50, payload: `batch_${i}` },
+      });
+    });
+  }
+  return ops;
+}
+
+// Workload 2: Worker threads — workerData initialization
+async function workloadWorkerData(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const worker = new Worker(path.join(TEMP_DIR, 'worker-cpu.js'), {
+      workerData: { autoStart: true, iterations: 30, payload: `init_${i}` },
+    });
+
+    await new Promise((resolve, reject) => {
+      worker.on('message', (msg) => {
+        if (msg.type === 'result') {
+          ops++;
+          worker.terminate();
+        }
+      });
+      worker.on('exit', resolve);
+      worker.on('error', reject);
+    });
+  }
+  return ops;
+}
+
+// Workload 3: Worker threads — SharedArrayBuffer (parallel computation)
+async function workloadSharedMemory(iterations) {
+  let ops = 0;
+  const ARRAY_SIZE = 1024;
+  const NUM_WORKERS = Math.min(4, os.cpus().length);
+
+  for (let i = 0; i < iterations; i++) {
+    const sharedBuffer = new SharedArrayBuffer(ARRAY_SIZE * 4); // Int32Array
+    const segmentSize = Math.floor(ARRAY_SIZE / NUM_WORKERS);
+
+    const workers = [];
+    const promises = [];
+
+    for (let w = 0; w < NUM_WORKERS; w++) {
+      const worker = new Worker(path.join(TEMP_DIR, 'worker-shared.js'), {
+        workerData: {
+          buffer: sharedBuffer,
+          offset: w * segmentSize,
+          length: segmentSize,
+        },
+      });
+
+      const promise = new Promise((resolve, reject) => {
+        worker.on('message', (msg) => {
+          ops++;
+          resolve(msg);
+        });
+        worker.on('error', reject);
+        worker.on('exit', () => resolve());
+      });
+
+      workers.push(worker);
+      promises.push(promise);
+    }
+
+    await Promise.all(promises);
+  }
+  return ops;
+}
+
+// Workload 4: Worker from inline code (eval pattern — used by some frameworks)
+async function workloadInlineWorker(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const code = `
+      const { parentPort } = require('worker_threads');
+      const crypto = require('crypto');
+      const result = crypto.createHash('sha256').update('data-${i}').digest('hex');
+      parentPort.postMessage({ hash: result });
+    `;
+
+    const worker = new Worker(code, { eval: true });
+
+    await new Promise((resolve, reject) => {
+      worker.on('message', (msg) => {
+        ops++;
+        resolve(msg);
+      });
+      worker.on('error', reject);
+      worker.on('exit', () => resolve());
+    });
+  }
+  return ops;
+}
+
+async function main() {
+  if (!isMainThread) return; // Guard against being loaded as worker
+
+  console.log('[pgo-child-workers] Starting worker thread workload...');
+
+  setup();
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  try {
+    while (remaining() > 0) {
+      round++;
+      const scale = Math.max(0.1, remaining() / DURATION_MS);
+      const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+      // Worker threads (most impactful for PGO)
+      if (round === 1)
+        console.log('[pgo-child-workers] Running worker messages...');
+      totalOps += await workloadWorkerMessages(iterScale(10));
+      if (remaining() <= 0) break;
+
+      if (round === 1)
+        console.log('[pgo-child-workers] Running workerData init...');
+      totalOps += await workloadWorkerData(iterScale(10));
+      if (remaining() <= 0) break;
+
+      if (round === 1)
+        console.log('[pgo-child-workers] Running shared memory workers...');
+      totalOps += await workloadSharedMemory(iterScale(5));
+      if (remaining() <= 0) break;
+
+      if (round === 1)
+        console.log('[pgo-child-workers] Running inline workers...');
+      totalOps += await workloadInlineWorker(iterScale(10));
+    }
+
+    const elapsed = (Date.now() - startTime) / 1000;
+    console.log(
+      `[pgo-child-workers] Completed ${totalOps} ops in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+    );
+  } finally {
+    cleanup();
+  }
+}
+
+main().catch((err) => {
+  console.error('[pgo-child-workers] Error:', err);
+  cleanup();
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-compression.js b/tools/pgo/pgo-compression.js
new file mode 100644
index 000000000000..4c1c7570b8b4
--- /dev/null
+++ b/tools/pgo/pgo-compression.js
@@ -0,0 +1,417 @@
+'use strict';
+
+// PGO Training Script: Compression (zlib/brotli)
+//
+// HTTP response compression is used on virtually every production Node.js server.
+// This script exercises:
+// - gzip compression/decompression (the most common HTTP content-encoding)
+// - deflate compression/decompression
+// - brotli compression/decompression (modern, better ratio)
+// - Streaming compression (piped through HTTP responses)
+// - One-shot compression (in-memory buffers)
+// - Various compression levels and data types
+// - CRC-32 computation
+//
+// This exercises: zlib C library, brotli C library, libuv thread pool
+// (async compression), stream infrastructure, Buffer allocation.
+
+const zlib = require('zlib');
+const crypto = require('crypto');
+const { pipeline } = require('stream/promises');
+const { Readable, Writable } = require('stream');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+
+// Test data of different types and sizes (compression ratio varies)
+const JSON_DATA = Buffer.from(
+  JSON.stringify({
+    users: Array.from({ length: 200 }, (_, i) => ({
+      id: i,
+      name: `User ${i}`,
+      email: `user${i}@example.com`,
+      role: ['admin', 'editor', 'viewer'][i % 3],
+      active: i % 4 !== 0,
+      profile: {
+        bio: `This is the biography for user ${i}. It contains some repetitive text to demonstrate compression.`,
+        location: ['New York', 'London', 'Tokyo', 'Berlin', 'Sydney'][i % 5],
+        joinDate: `2024-${String((i % 12) + 1).padStart(2, '0')}-${String((i % 28) + 1).padStart(2, '0')}`,
+      },
+    })),
+  }),
+);
+
+const HTML_DATA = Buffer.from(`<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="UTF-8"><title>Test Page</title></head>
+<body>
+${Array.from(
+  { length: 100 },
+  (_, i) => `
+<div class="card" id="card-${i}">
+  <h2 class="card-title">Card Title ${i}</h2>
+  <p class="card-body">This is the body text for card number ${i}. It contains enough text to be meaningful for compression benchmarks.</p>
+  <div class="card-footer">
+    <button class="btn btn-primary">Action ${i}</button>
+    <span class="badge">${i % 5}</span>
+  </div>
+</div>`,
+).join('\n')}
+</body></html>`);
+
+const CSS_DATA = Buffer.from(
+  Array.from(
+    { length: 200 },
+    (_, i) => `
+.component-${i} { display: flex; align-items: center; padding: ${i}px; margin: ${i % 20}px; }
+.component-${i}:hover { background-color: #${String(i * 111)
+      .padStart(6, '0')
+      .slice(0, 6)}; transition: all 0.3s ease; }
+.component-${i} .title { font-size: ${12 + (i % 8)}px; font-weight: ${i % 2 === 0 ? 'bold' : 'normal'}; }
+.component-${i} .description { color: #666; line-height: 1.5; max-width: ${200 + i * 5}px; }
+`,
+  ).join('\n'),
+);
+
+const JS_DATA = Buffer.from(
+  Array.from(
+    { length: 100 },
+    (_, i) => `
+function handler${i}(req, res) {
+  const data = req.body;
+  if (!data || !data.id) {
+    return res.status(400).json({ error: 'Missing id' });
+  }
+  const result = processData${i}(data);
+  return res.json({ success: true, data: result, timestamp: Date.now() });
+}
+function processData${i}(data) {
+  return { ...data, processed: true, handler: 'handler${i}' };
+}
+module.exports = { handler${i}, processData${i} };
+`,
+  ).join('\n'),
+);
+
+// Binary data (images, wasm — less compressible)
+const BINARY_DATA = crypto.randomBytes(32768);
+
+const TEST_DATA = [
+  { name: 'JSON', data: JSON_DATA, weight: 5 },
+  { name: 'HTML', data: HTML_DATA, weight: 3 },
+  { name: 'CSS', data: CSS_DATA, weight: 2 },
+  { name: 'JS', data: JS_DATA, weight: 2 },
+  { name: 'Binary', data: BINARY_DATA, weight: 1 },
+];
+
+const weightedData = [];
+for (const item of TEST_DATA) {
+  for (let i = 0; i < item.weight; i++) {
+    weightedData.push(item);
+  }
+}
+
+// Workload 1: Gzip compress/decompress (one-shot, most common pattern)
+async function workloadGzip(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const item = weightedData[i % weightedData.length];
+
+    // Compress (HTTP response compression)
+    const compressed = await new Promise((resolve, reject) => {
+      zlib.gzip(item.data, (err, result) => {
+        if (err) reject(err);
+        else resolve(result);
+      });
+    });
+    ops++;
+
+    // Decompress (HTTP response decompression on client)
+    await new Promise((resolve, reject) => {
+      zlib.gunzip(compressed, (err, result) => {
+        if (err) reject(err);
+        else resolve(result);
+      });
+    });
+    ops++;
+
+    // Sync variant (used in some build tools)
+    if (i % 5 === 0) {
+      const compSync = zlib.gzipSync(item.data);
+      zlib.gunzipSync(compSync);
+      ops += 2;
+    }
+
+    // Different compression levels
+    if (i % 3 === 0) {
+      await new Promise((resolve, reject) => {
+        zlib.gzip(item.data, { level: 1 }, (err, result) => {
+          // Fast
+          if (err) reject(err);
+          else resolve(result);
+        });
+      });
+      ops++;
+    }
+    if (i % 7 === 0) {
+      await new Promise((resolve, reject) => {
+        zlib.gzip(item.data, { level: 9 }, (err, result) => {
+          // Best
+          if (err) reject(err);
+          else resolve(result);
+        });
+      });
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 2: Deflate compress/decompress
+async function workloadDeflate(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const item = weightedData[i % weightedData.length];
+
+    // deflate (used in some HTTP implementations)
+    const compressed = await new Promise((resolve, reject) => {
+      zlib.deflate(item.data, (err, result) => {
+        if (err) reject(err);
+        else resolve(result);
+      });
+    });
+    ops++;
+
+    await new Promise((resolve, reject) => {
+      zlib.inflate(compressed, (err, result) => {
+        if (err) reject(err);
+        else resolve(result);
+      });
+    });
+    ops++;
+
+    // deflateRaw (no header — used in some protocols)
+    if (i % 3 === 0) {
+      const raw = zlib.deflateRawSync(item.data);
+      zlib.inflateRawSync(raw);
+      ops += 2;
+    }
+  }
+  return ops;
+}
+
+// Workload 3: Brotli compress/decompress (modern HTTP content-encoding)
+async function workloadBrotli(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const item = weightedData[i % weightedData.length];
+
+    // Brotli compress (response compression for supported clients)
+    const compressed = await new Promise((resolve, reject) => {
+      zlib.brotliCompress(item.data, (err, result) => {
+        if (err) reject(err);
+        else resolve(result);
+      });
+    });
+    ops++;
+
+    // Brotli decompress
+    await new Promise((resolve, reject) => {
+      zlib.brotliDecompress(compressed, (err, result) => {
+        if (err) reject(err);
+        else resolve(result);
+      });
+    });
+    ops++;
+
+    // Different quality levels
+    if (i % 3 === 0) {
+      await new Promise((resolve, reject) => {
+        zlib.brotliCompress(
+          item.data,
+          {
+            params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 1 }, // Fast
+          },
+          (err, result) => {
+            if (err) reject(err);
+            else resolve(result);
+          },
+        );
+      });
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 4: Streaming compression (piped HTTP responses)
+async function workloadStreamCompress(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const item = weightedData[i % weightedData.length];
+
+    // Gzip stream (Express compression middleware pattern)
+    await pipeline(
+      Readable.from([item.data]),
+      zlib.createGzip(),
+      new Writable({
+        write(chunk, encoding, callback) {
+          callback();
+        },
+      }),
+    );
+    ops++;
+
+    // Brotli stream
+    if (i % 2 === 0) {
+      await pipeline(
+        Readable.from([item.data]),
+        zlib.createBrotliCompress(),
+        new Writable({
+          write(chunk, encoding, callback) {
+            callback();
+          },
+        }),
+      );
+      ops++;
+    }
+
+    // Chunked stream compression (large response simulation)
+    if (i % 3 === 0) {
+      const chunkSize = 4096;
+      const chunks = [];
+      for (let offset = 0; offset < item.data.length; offset += chunkSize) {
+        chunks.push(
+          item.data.subarray(
+            offset,
+            Math.min(offset + chunkSize, item.data.length),
+          ),
+        );
+      }
+
+      await pipeline(
+        Readable.from(chunks),
+        zlib.createGzip({ flush: zlib.constants.Z_SYNC_FLUSH }),
+        new Writable({
+          write(chunk, encoding, callback) {
+            callback();
+          },
+        }),
+      );
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 5: CRC-32 (used in gzip, PNG, etc.)
+function workloadCRC32(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const item = weightedData[i % weightedData.length];
+    zlib.crc32(item.data);
+    ops++;
+
+    // Incremental CRC (streaming pattern)
+    if (i % 3 === 0) {
+      const chunkSize = 1024;
+      let crc = 0;
+      for (let offset = 0; offset < item.data.length; offset += chunkSize) {
+        const chunk = item.data.subarray(
+          offset,
+          Math.min(offset + chunkSize, item.data.length),
+        );
+        crc = zlib.crc32(chunk, crc);
+      }
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 6: Compression object creation (middleware initialization)
+function workloadCompressionCreation(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Express compression middleware creates these per-request
+    zlib.createGzip();
+    zlib.createGunzip();
+    zlib.createDeflate();
+    zlib.createInflate();
+    zlib.createBrotliCompress();
+    zlib.createBrotliDecompress();
+    ops += 6;
+
+    // With options (common in production)
+    zlib.createGzip({ level: 6, memLevel: 8, windowBits: 15 });
+    zlib.createBrotliCompress({
+      params: {
+        [zlib.constants.BROTLI_PARAM_QUALITY]: 4,
+        [zlib.constants.BROTLI_PARAM_MODE]: zlib.constants.BROTLI_MODE_TEXT,
+      },
+    });
+    ops += 2;
+  }
+  return ops;
+}
+
+async function main() {
+  console.log('[pgo-compression] Starting compression workload...');
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  while (remaining() > 0) {
+    round++;
+    const scale = Math.max(0.1, remaining() / DURATION_MS);
+    const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+    // Gzip (most common — Accept-Encoding: gzip is universal)
+    if (round === 1) console.log('[pgo-compression] Running gzip...');
+    totalOps += await workloadGzip(iterScale(100));
+    if (remaining() <= 0) break;
+
+    // Deflate
+    if (round === 1) console.log('[pgo-compression] Running deflate...');
+    totalOps += await workloadDeflate(iterScale(50));
+    if (remaining() <= 0) break;
+
+    // Brotli (growing rapidly)
+    if (round === 1) console.log('[pgo-compression] Running brotli...');
+    totalOps += await workloadBrotli(iterScale(50));
+    if (remaining() <= 0) break;
+
+    // Streaming compression
+    if (round === 1)
+      console.log('[pgo-compression] Running stream compression...');
+    totalOps += await workloadStreamCompress(iterScale(30));
+    if (remaining() <= 0) break;
+
+    // CRC-32
+    if (round === 1) console.log('[pgo-compression] Running CRC-32...');
+    totalOps += workloadCRC32(iterScale(1000));
+    if (remaining() <= 0) break;
+
+    // Object creation
+    if (round === 1)
+      console.log('[pgo-compression] Running compression object creation...');
+    totalOps += workloadCompressionCreation(iterScale(500));
+  }
+
+  const elapsed = (Date.now() - startTime) / 1000;
+  console.log(
+    `[pgo-compression] Completed ${totalOps} ops in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-compression] Error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-crypto.js b/tools/pgo/pgo-crypto.js
new file mode 100644
index 000000000000..977942a0f7f3
--- /dev/null
+++ b/tools/pgo/pgo-crypto.js
@@ -0,0 +1,401 @@
+'use strict';
+
+// PGO Training Script: Crypto Operations
+//
+// Exercises the most common crypto operations in Node.js applications:
+// - TLS/HTTPS is used in virtually every production deployment
+// - Password hashing (bcrypt-like patterns via pbkdf2/scrypt)
+// - HMAC for API authentication (AWS Signature, JWT)
+// - SHA-256/SHA-512 hashing for checksums, ETags, content-addressing
+// - AES-GCM encryption for data-at-rest
+// - Random byte generation (session tokens, UUIDs, nonces)
+// - Certificate/key handling patterns
+//
+// This exercises: OpenSSL (via Node.js crypto binding), Buffer allocation,
+// C++ ↔ JS boundary crossing, async crypto operations, KeyObject handling.
+
+const crypto = require('crypto');
+const { subtle } = globalThis.crypto;
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+
+// Test data of varying sizes
+const DATA_TINY = Buffer.from('Hello, World!');
+const DATA_SMALL = crypto.randomBytes(256);
+const DATA_MEDIUM = crypto.randomBytes(4096);
+const DATA_LARGE = crypto.randomBytes(65536);
+const DATA_XLARGE = crypto.randomBytes(262144); // 256 KB
+const DATA_SIZES = [
+  DATA_TINY,
+  DATA_SMALL,
+  DATA_MEDIUM,
+  DATA_LARGE,
+  DATA_XLARGE,
+];
+
+// Pre-generated keys for symmetric encryption
+const AES_KEY = crypto.randomBytes(32); // AES-256
+const HMAC_KEY = crypto.randomBytes(64);
+
+// RSA key pair (pre-generated for speed)
+const { publicKey: RSA_PUBLIC, privateKey: RSA_PRIVATE } =
+  crypto.generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+
+// EC key pair
+const { publicKey: EC_PUBLIC, privateKey: EC_PRIVATE } =
+  crypto.generateKeyPairSync('ec', {
+    namedCurve: 'P-256',
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+
+// Ed25519 for modern signing
+const { publicKey: ED_PUBLIC, privateKey: ED_PRIVATE } =
+  crypto.generateKeyPairSync('ed25519', {
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+
+// Workload 1: Hashing (most common crypto operation)
+function workloadHashing(iterations) {
+  const algorithms = ['sha256', 'sha384', 'sha512', 'sha1', 'md5'];
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    for (const algo of algorithms) {
+      const data = DATA_SIZES[i % DATA_SIZES.length];
+
+      // One-shot hash (most common pattern: ETags, checksums)
+      crypto.createHash(algo).update(data).digest('hex');
+      ops++;
+
+      // Streaming hash (file hashing pattern)
+      if (i % 5 === 0) {
+        const hash = crypto.createHash(algo);
+        const chunkSize = 1024;
+        for (let offset = 0; offset < data.length; offset += chunkSize) {
+          hash.update(
+            data.subarray(offset, Math.min(offset + chunkSize, data.length)),
+          );
+        }
+        hash.digest('base64');
+        ops++;
+      }
+    }
+  }
+  return ops;
+}
+
+// Workload 2: HMAC (API auth, JWT signatures, webhook verification)
+function workloadHMAC(iterations) {
+  let ops = 0;
+  const algorithms = ['sha256', 'sha384', 'sha512'];
+
+  for (let i = 0; i < iterations; i++) {
+    const algo = algorithms[i % algorithms.length];
+    const data = DATA_SIZES[i % DATA_SIZES.length];
+
+    // HMAC compute (AWS Signature v4, JWT pattern)
+    const sig = crypto.createHmac(algo, HMAC_KEY).update(data).digest();
+    ops++;
+
+    // HMAC verify (webhook verification pattern)
+    const sig2 = crypto.createHmac(algo, HMAC_KEY).update(data).digest();
+    crypto.timingSafeEqual(sig, sig2);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 3: AES-GCM encryption/decryption (data protection)
+function workloadAESGCM(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const data = DATA_SIZES[i % DATA_SIZES.length];
+    const iv = crypto.randomBytes(12);
+
+    // Encrypt
+    const cipher = crypto.createCipheriv('aes-256-gcm', AES_KEY, iv);
+    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    ops++;
+
+    // Decrypt
+    const decipher = crypto.createDecipheriv('aes-256-gcm', AES_KEY, iv);
+    decipher.setAuthTag(tag);
+    Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 4: RSA sign/verify (JWT RS256, code signing)
+function workloadRSASignVerify(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const data = DATA_SIZES[Math.min(i % 3, DATA_SIZES.length - 1)]; // RSA limits payload size
+
+    // Sign
+    const sign = crypto.createSign('RSA-SHA256');
+    sign.update(data);
+    const signature = sign.sign(RSA_PRIVATE);
+    ops++;
+
+    // Verify
+    const verify = crypto.createVerify('RSA-SHA256');
+    verify.update(data);
+    verify.verify(RSA_PUBLIC, signature);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 5: ECDSA sign/verify (modern TLS, smaller keys)
+function workloadECDSA(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const data = DATA_SIZES[i % DATA_SIZES.length];
+
+    const signature = crypto.sign('SHA256', data, EC_PRIVATE);
+    ops++;
+
+    crypto.verify('SHA256', data, EC_PUBLIC, signature);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 6: Ed25519 sign/verify (modern fast signing)
+function workloadEd25519(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const data = DATA_SIZES[i % DATA_SIZES.length];
+
+    const signature = crypto.sign(null, data, ED_PRIVATE);
+    ops++;
+
+    crypto.verify(null, data, ED_PUBLIC, signature);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 7: Random byte generation (tokens, session IDs, UUIDs)
+function workloadRandom(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Session tokens
+    crypto.randomBytes(32);
+    ops++;
+
+    // UUID generation
+    crypto.randomUUID();
+    ops++;
+
+    // Random integers (for OTP codes, etc.)
+    crypto.randomInt(100000, 999999);
+    ops++;
+
+    // Fill existing buffer (pool pattern)
+    const buf = Buffer.allocUnsafe(64);
+    crypto.randomFillSync(buf);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 8: PBKDF2 / Scrypt (password hashing - async)
+async function workloadPasswordHashing(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const password = `password_${i}_with_some_length`;
+    const salt = crypto.randomBytes(16);
+
+    // PBKDF2 (most common password hashing in Node.js)
+    await new Promise((resolve, reject) => {
+      crypto.pbkdf2(password, salt, 1000, 64, 'sha512', (err, key) => {
+        if (err) reject(err);
+        else resolve(key);
+      });
+    });
+    ops++;
+
+    // Scrypt (recommended for new apps)
+    if (i % 3 === 0) {
+      await new Promise((resolve, reject) => {
+        crypto.scrypt(
+          password,
+          salt,
+          64,
+          { N: 1024, r: 8, p: 1 },
+          (err, key) => {
+            if (err) reject(err);
+            else resolve(key);
+          },
+        );
+      });
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 9: HKDF (key derivation for encryption key rotation)
+async function workloadHKDF(iterations) {
+  let ops = 0;
+  const ikm = crypto.randomBytes(32);
+  const salt = crypto.randomBytes(32);
+  const info = Buffer.from('encryption-key-v1');
+
+  for (let i = 0; i < iterations; i++) {
+    await new Promise((resolve, reject) => {
+      crypto.hkdf('sha256', ikm, salt, info, 32, (err, key) => {
+        if (err) reject(err);
+        else resolve(key);
+      });
+    });
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 10: WebCrypto API (increasingly used in modern Node.js)
+async function workloadWebCrypto(iterations) {
+  let ops = 0;
+
+  // Generate WebCrypto key
+  const key = await subtle.generateKey(
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['encrypt', 'decrypt'],
+  );
+
+  const hmacKey = await subtle.generateKey(
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign', 'verify'],
+  );
+
+  for (let i = 0; i < iterations; i++) {
+    const data = DATA_SIZES[i % 3]; // Keep data smaller for WebCrypto
+    const iv = crypto.randomBytes(12);
+
+    // AES-GCM encrypt/decrypt via WebCrypto
+    const encrypted = await subtle.encrypt({ name: 'AES-GCM', iv }, key, data);
+    await subtle.decrypt({ name: 'AES-GCM', iv }, key, encrypted);
+    ops += 2;
+
+    // HMAC sign/verify via WebCrypto
+    const sig = await subtle.sign('HMAC', hmacKey, data);
+    await subtle.verify('HMAC', hmacKey, sig, data);
+    ops += 2;
+
+    // SHA-256 digest via WebCrypto
+    await subtle.digest('SHA-256', data);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 11: DH key exchange (TLS handshake simulation)
+function workloadDH(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // ECDH key exchange (used in every TLS connection)
+    const alice = crypto.createECDH('prime256v1');
+    const bob = crypto.createECDH('prime256v1');
+
+    alice.generateKeys();
+    bob.generateKeys();
+
+    const aliceSecret = alice.computeSecret(bob.getPublicKey());
+    bob.computeSecret(alice.getPublicKey());
+
+    // Derive encryption key from shared secret
+    crypto.createHash('sha256').update(aliceSecret).digest();
+    ops++;
+  }
+  return ops;
+}
+
+async function main() {
+  console.log('[pgo-crypto] Starting crypto workload...');
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  while (remaining() > 0) {
+    round++;
+    const scale = Math.max(0.1, remaining() / DURATION_MS);
+    const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+    // Sync workloads (weighted by real-world frequency)
+    if (round === 1) console.log('[pgo-crypto] Running hash workloads...');
+    totalOps += workloadHashing(iterScale(500));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running HMAC workloads...');
+    totalOps += workloadHMAC(iterScale(300));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running AES-GCM workloads...');
+    totalOps += workloadAESGCM(iterScale(200));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running random generation...');
+    totalOps += workloadRandom(iterScale(500));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running RSA sign/verify...');
+    totalOps += workloadRSASignVerify(iterScale(30));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running ECDSA sign/verify...');
+    totalOps += workloadECDSA(iterScale(100));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running Ed25519 sign/verify...');
+    totalOps += workloadEd25519(iterScale(100));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running DH key exchange...');
+    totalOps += workloadDH(iterScale(30));
+    if (remaining() <= 0) break;
+
+    // Async workloads
+    if (round === 1)
+      console.log('[pgo-crypto] Running password hashing (async)...');
+    totalOps += await workloadPasswordHashing(iterScale(20));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running HKDF (async)...');
+    totalOps += await workloadHKDF(iterScale(50));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-crypto] Running WebCrypto workloads...');
+    totalOps += await workloadWebCrypto(iterScale(50));
+  }
+
+  const elapsed = (Date.now() - startTime) / 1000;
+  console.log(
+    `[pgo-crypto] Completed ${totalOps} crypto operations in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-crypto] Error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-fs.js b/tools/pgo/pgo-fs.js
new file mode 100644
index 000000000000..6e0a9e05f0b4
--- /dev/null
+++ b/tools/pgo/pgo-fs.js
@@ -0,0 +1,447 @@
+'use strict';
+
+// PGO Training Script: File System Operations
+//
+// Exercises the most common fs operations in Node.js applications:
+// - readFile/writeFile (config loading, template rendering, static file serving)
+// - stat/access (file existence checks, middleware, caching)
+// - readdir (directory listings, file discovery, build tools)
+// - read/write streams (log file appending, file upload/download)
+// - mkdir/rmdir (temp directories, build artifacts)
+// - path operations (resolve, join, parse — used constantly)
+// - watch (file watchers in dev tools, though we only test creation here)
+//
+// This exercises: libuv filesystem operations, thread pool (async fs),
+// Buffer allocation for file data, string encoding, path module.
+
+const fs = require('fs');
+const fsp = require('fs/promises');
+const path = require('path');
+const os = require('os');
+const crypto = require('crypto');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+
+// Create a unique temp directory for our operations
+const TEMP_DIR = path.join(
+  os.tmpdir(),
+  `node-pgo-fs-${process.pid}-${Date.now()}`,
+);
+
+// Test data
+const MEDIUM_CONTENT = Array.from(
+  { length: 100 },
+  (_, i) => `Line ${i}: ${crypto.randomBytes(40).toString('hex')}`,
+).join('\n');
+const LARGE_CONTENT = crypto.randomBytes(256 * 1024).toString('base64');
+const JSON_CONFIG = JSON.stringify(
+  {
+    database: {
+      host: 'localhost',
+      port: 5432,
+      name: 'myapp',
+      pool: { min: 2, max: 10 },
+    },
+    redis: { host: 'localhost', port: 6379, db: 0 },
+    server: { port: 3000, host: '0.0.0.0', cors: { origin: '*' } },
+    logging: { level: 'info', format: 'json', outputs: ['stdout', 'file'] },
+    features: { darkMode: true, betaFeatures: false, maxUploadSize: 10485760 },
+  },
+  null,
+  2,
+);
+
+function setup() {
+  fs.mkdirSync(TEMP_DIR, { recursive: true });
+  fs.mkdirSync(path.join(TEMP_DIR, 'subdir', 'nested'), { recursive: true });
+  fs.mkdirSync(path.join(TEMP_DIR, 'logs'), { recursive: true });
+  fs.mkdirSync(path.join(TEMP_DIR, 'uploads'), { recursive: true });
+  fs.mkdirSync(path.join(TEMP_DIR, 'cache'), { recursive: true });
+
+  // Pre-create files for reading
+  for (let i = 0; i < 50; i++) {
+    fs.writeFileSync(
+      path.join(TEMP_DIR, `file-${i}.txt`),
+      `Content of file ${i}\n`.repeat(10),
+    );
+  }
+  for (let i = 0; i < 10; i++) {
+    fs.writeFileSync(
+      path.join(TEMP_DIR, 'subdir', `sub-${i}.json`),
+      JSON.stringify({ id: i, data: `value-${i}` }),
+    );
+  }
+  fs.writeFileSync(path.join(TEMP_DIR, 'config.json'), JSON_CONFIG);
+  fs.writeFileSync(path.join(TEMP_DIR, 'large.dat'), LARGE_CONTENT);
+  fs.writeFileSync(path.join(TEMP_DIR, 'medium.txt'), MEDIUM_CONTENT);
+}
+
+function cleanup() {
+  try {
+    fs.rmSync(TEMP_DIR, { recursive: true, force: true });
+  } catch {
+    // Best effort cleanup
+  }
+}
+
+// Workload 1: readFile + writeFile (async, the dominant pattern)
+async function workloadReadWriteAsync(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Read config file (very common — Express/Fastify load configs at startup)
+    await fsp.readFile(path.join(TEMP_DIR, 'config.json'), 'utf8');
+    ops++;
+
+    // Read and parse JSON config
+    const configStr = await fsp.readFile(
+      path.join(TEMP_DIR, 'config.json'),
+      'utf8',
+    );
+    JSON.parse(configStr);
+    ops++;
+
+    // Read binary file (static file serving)
+    await fsp.readFile(path.join(TEMP_DIR, `file-${i % 50}.txt`));
+    ops++;
+
+    // Write new file (log rotation, temp files, uploads)
+    const tempFile = path.join(TEMP_DIR, 'uploads', `upload-${i}.tmp`);
+    await fsp.writeFile(
+      tempFile,
+      `Upload content ${i}: ${crypto.randomBytes(100).toString('hex')}`,
+    );
+    ops++;
+
+    // Read back
+    await fsp.readFile(tempFile, 'utf8');
+    ops++;
+
+    // Overwrite (atomic-ish update pattern)
+    await fsp.writeFile(tempFile, `Updated content ${i}`);
+    ops++;
+
+    // Read large file (less frequently)
+    if (i % 10 === 0) {
+      await fsp.readFile(path.join(TEMP_DIR, 'large.dat'));
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 2: readFileSync + writeFileSync (startup, require.resolve)
+function workloadReadWriteSync(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Sync read (very common in require() for package.json, .json configs)
+    fs.readFileSync(path.join(TEMP_DIR, 'config.json'), 'utf8');
+    ops++;
+
+    // Sync read various files
+    fs.readFileSync(path.join(TEMP_DIR, `file-${i % 50}.txt`), 'utf8');
+    ops++;
+
+    // Sync JSON file read/parse (package.json pattern)
+    for (let j = 0; j < 10; j++) {
+      const content = fs.readFileSync(
+        path.join(TEMP_DIR, 'subdir', `sub-${j}.json`),
+        'utf8',
+      );
+      JSON.parse(content);
+    }
+    ops += 10;
+
+    // Sync write (cache files, lock files)
+    const cacheFile = path.join(TEMP_DIR, 'cache', `cache-${i % 20}.json`);
+    fs.writeFileSync(
+      cacheFile,
+      JSON.stringify({ key: `key-${i}`, value: i * 42, ts: Date.now() }),
+    );
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 3: stat / access / exists (file existence checks)
+async function workloadStatAccess(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // stat (used by express.static, require.resolve, etc.)
+    await fsp.stat(path.join(TEMP_DIR, `file-${i % 50}.txt`));
+    ops++;
+
+    // stat directory
+    await fsp.stat(path.join(TEMP_DIR, 'subdir'));
+    ops++;
+
+    // Access check (permission verification)
+    try {
+      await fsp.access(
+        path.join(TEMP_DIR, `file-${i % 50}.txt`),
+        fs.constants.R_OK,
+      );
+    } catch {
+      /* expected for some */
+    }
+    ops++;
+
+    // lstat (symlink-aware, used by tools)
+    await fsp.lstat(path.join(TEMP_DIR, `file-${i % 50}.txt`));
+    ops++;
+
+    // Stat non-existent (cache miss pattern)
+    try {
+      await fsp.stat(path.join(TEMP_DIR, `nonexistent-${i}.txt`));
+    } catch {
+      /* expected */
+    }
+    ops++;
+
+    // Sync variants (require.resolve uses these)
+    fs.statSync(path.join(TEMP_DIR, `file-${i % 50}.txt`));
+    ops++;
+
+    fs.existsSync(path.join(TEMP_DIR, `file-${i % 50}.txt`));
+    ops++;
+
+    fs.existsSync(path.join(TEMP_DIR, `nonexistent-${i}.txt`));
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 4: readdir (directory listing, build tools, file watchers)
+async function workloadReaddir(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Simple readdir
+    await fsp.readdir(TEMP_DIR);
+    ops++;
+
+    // Readdir with file types (common for file tree traversal)
+    await fsp.readdir(TEMP_DIR, { withFileTypes: true });
+    ops++;
+
+    // Readdir subdirectory
+    await fsp.readdir(path.join(TEMP_DIR, 'subdir'), { withFileTypes: true });
+    ops++;
+
+    // Sync variant (build tools)
+    fs.readdirSync(TEMP_DIR);
+    ops++;
+
+    // Recursive readdir (newer API, gaining adoption)
+    if (i % 5 === 0) {
+      await fsp.readdir(TEMP_DIR, { recursive: true });
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 5: mkdir / rmdir / rename / copy (build tool patterns)
+async function workloadDirectoryOps(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const dir = path.join(TEMP_DIR, `build-${i}`);
+
+    // mkdir (build output directories)
+    await fsp.mkdir(dir, { recursive: true });
+    ops++;
+
+    // Create file in new dir
+    const file = path.join(dir, 'output.txt');
+    await fsp.writeFile(file, `Build output ${i}`);
+    ops++;
+
+    // Rename (atomic file update pattern)
+    const newFile = path.join(dir, 'output.final.txt');
+    await fsp.rename(file, newFile);
+    ops++;
+
+    // Copy file
+    const copyDest = path.join(dir, 'output.backup.txt');
+    await fsp.copyFile(newFile, copyDest);
+    ops++;
+
+    // rmdir (cleanup)
+    await fsp.rm(dir, { recursive: true, force: true });
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 6: Stream read/write (large file processing, log files)
+async function workloadStreams(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Read stream (file download, static serving of large files)
+    await new Promise((resolve, reject) => {
+      const rs = fs.createReadStream(path.join(TEMP_DIR, 'large.dat'), {
+        highWaterMark: 16 * 1024,
+      });
+      rs.on('data', () => {});
+      rs.on('end', () => {
+        ops++;
+        resolve();
+      });
+      rs.on('error', reject);
+    });
+
+    // Write stream (log file appending)
+    await new Promise((resolve, reject) => {
+      const ws = fs.createWriteStream(
+        path.join(TEMP_DIR, 'logs', `app-${i % 5}.log`),
+        { flags: 'a' },
+      );
+      for (let j = 0; j < 50; j++) {
+        ws.write(
+          `[${new Date().toISOString()}] INFO: Request processed in ${Math.random() * 100}ms\n`,
+        );
+      }
+      ws.end(() => {
+        ops++;
+        resolve();
+      });
+      ws.on('error', reject);
+    });
+
+    // Pipe pattern (file copy via streams)
+    if (i % 3 === 0) {
+      await new Promise((resolve, reject) => {
+        const rs = fs.createReadStream(path.join(TEMP_DIR, 'medium.txt'));
+        const ws = fs.createWriteStream(
+          path.join(TEMP_DIR, `pipe-copy-${i}.txt`),
+        );
+        rs.pipe(ws);
+        ws.on('finish', () => {
+          ops++;
+          resolve();
+        });
+        ws.on('error', reject);
+      });
+    }
+  }
+  return ops;
+}
+
+// Workload 7: Path operations (used in every file operation)
+function workloadPathOps(iterations) {
+  let ops = 0;
+  const testPaths = [
+    '/usr/local/lib/node_modules/express/lib/router/index.js',
+    'C:\\Users\\user\\project\\node_modules\\lodash\\lodash.js',
+    '../relative/path/to/file.js',
+    './src/components/Button/index.tsx',
+    'https://example.com/path/to/resource?query=value#hash',
+    '/path/with spaces/and (parens)/file name.txt',
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    for (const p of testPaths) {
+      path.resolve(p);
+      path.dirname(p);
+      path.basename(p);
+      path.extname(p);
+      path.parse(p);
+      path.normalize(p);
+      path.isAbsolute(p);
+      ops += 7;
+    }
+
+    // path.join (the most common path operation)
+    path.join('src', 'components', 'Button', 'index.tsx');
+    path.join(TEMP_DIR, 'subdir', 'nested', 'file.txt');
+    path.join('..', '..', 'node_modules', '.cache');
+    ops += 3;
+
+    // path.relative (monorepo/build tool pattern)
+    path.relative(
+      '/project/packages/core/src',
+      '/project/packages/utils/src/helpers.js',
+    );
+    path.relative(TEMP_DIR, path.join(TEMP_DIR, 'subdir', 'file.txt'));
+    ops += 2;
+
+    // path.format (inverse of parse)
+    path.format({
+      root: '/',
+      dir: '/home/user',
+      base: 'file.txt',
+      ext: '.txt',
+      name: 'file',
+    });
+    ops++;
+  }
+  return ops;
+}
+
+async function main() {
+  console.log('[pgo-fs] Starting file system workload...');
+
+  setup();
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  try {
+    while (remaining() > 0) {
+      round++;
+      const scale = Math.max(0.1, remaining() / DURATION_MS);
+      const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+      // Path ops first — pure CPU, exercises V8 string handling
+      if (round === 1) console.log('[pgo-fs] Running path operations...');
+      totalOps += workloadPathOps(iterScale(2000));
+      if (remaining() <= 0) break;
+
+      // Sync reads (startup/require pattern)
+      if (round === 1) console.log('[pgo-fs] Running sync read/write...');
+      totalOps += workloadReadWriteSync(iterScale(100));
+      if (remaining() <= 0) break;
+
+      // Async reads/writes (most common runtime pattern)
+      if (round === 1) console.log('[pgo-fs] Running async read/write...');
+      totalOps += await workloadReadWriteAsync(iterScale(50));
+      if (remaining() <= 0) break;
+
+      // stat/access (middleware, require.resolve)
+      if (round === 1) console.log('[pgo-fs] Running stat/access...');
+      totalOps += await workloadStatAccess(iterScale(100));
+      if (remaining() <= 0) break;
+
+      // Directory operations
+      if (round === 1) console.log('[pgo-fs] Running readdir...');
+      totalOps += await workloadReaddir(iterScale(100));
+      if (remaining() <= 0) break;
+
+      if (round === 1) console.log('[pgo-fs] Running directory ops...');
+      totalOps += await workloadDirectoryOps(iterScale(30));
+      if (remaining() <= 0) break;
+
+      // Stream operations
+      if (round === 1) console.log('[pgo-fs] Running stream read/write...');
+      totalOps += await workloadStreams(iterScale(20));
+    }
+
+    const elapsed = (Date.now() - startTime) / 1000;
+    console.log(
+      `[pgo-fs] Completed ${totalOps} fs operations in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+    );
+  } finally {
+    cleanup();
+  }
+}
+
+main().catch((err) => {
+  console.error('[pgo-fs] Error:', err);
+  cleanup();
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-http-server.js b/tools/pgo/pgo-http-server.js
new file mode 100644
index 000000000000..0950bfbff50d
--- /dev/null
+++ b/tools/pgo/pgo-http-server.js
@@ -0,0 +1,380 @@
+'use strict';
+
+// PGO Training Script: HTTP Server Workload
+//
+// Simulates the most common Node.js use case — an HTTP server handling:
+// - JSON REST API requests (GET/POST with JSON bodies)
+// - Static content serving (HTML, CSS, JS responses)
+// - Chunked transfer encoding
+// - Various header patterns (few/many headers, Set-Cookie, CORS)
+// - Keep-alive connections with request pipelining
+// - URL routing with path parameters and query strings
+//
+// This exercises: llhttp parser, TCP stack (libuv), header serialization,
+// Buffer encoding, URL parsing, JSON parse/stringify, EventEmitter, streams.
+
+const http = require('http');
+const { URL } = require('url');
+const crypto = require('crypto');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+const CONCURRENT_CLIENTS = 20;
+const PORT = 0; // OS-assigned
+
+// Realistic JSON payloads of varying sizes
+const SMALL_JSON = JSON.stringify({ id: 1, name: 'test', active: true });
+const MEDIUM_JSON = JSON.stringify({
+  users: Array.from({ length: 50 }, (_, i) => ({
+    id: i,
+    name: `user_${i}`,
+    email: `user${i}@example.com`,
+    age: 20 + (i % 40),
+    active: i % 3 !== 0,
+    tags: ['tag1', 'tag2', 'tag3'],
+    address: {
+      street: `${i * 100} Main St`,
+      city: 'Anytown',
+      state: 'CA',
+      zip: `${90000 + i}`,
+    },
+  })),
+  total: 50,
+  page: 1,
+  perPage: 50,
+});
+const LARGE_JSON = JSON.stringify({
+  data: Array.from({ length: 500 }, (_, i) => ({
+    id: crypto.randomUUID(),
+    timestamp: new Date().toISOString(),
+    type: ['click', 'view', 'purchase', 'signup'][i % 4],
+    properties: {
+      source: ['web', 'mobile', 'api'][i % 3],
+      browser: ['chrome', 'firefox', 'safari', 'edge'][i % 4],
+      os: ['windows', 'macos', 'linux', 'ios', 'android'][i % 5],
+      duration: Math.random() * 10000,
+      amount: i % 4 === 2 ? (Math.random() * 500).toFixed(2) : undefined,
+      items:
+        i % 4 === 2 ?
+          Array.from({ length: 3 }, (_, j) => ({
+            sku: `SKU-${j}-${i}`,
+            qty: j + 1,
+            price: (Math.random() * 100).toFixed(2),
+          })) :
+          undefined,
+    },
+    metadata: {
+      ip: `192.168.${i % 256}.${(i * 7) % 256}`,
+      userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+      sessionId: crypto.randomUUID(),
+    },
+  })),
+});
+
+// Simulated HTML page
+const HTML_PAGE = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>App</title>
+  <link rel="stylesheet" href="/styles.css">
+</head>
+<body>
+  <div id="root"></div>
+  <script src="/app.js"></script>
+</body>
+</html>`;
+
+// Simulated CSS
+const CSS_CONTENT = `body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; }
+.container { max-width: 1200px; margin: 0 auto; padding: 0 20px; }
+.header { background: #1a1a2e; color: white; padding: 1rem 0; }
+.nav { display: flex; gap: 1rem; }
+.card { border: 1px solid #ddd; border-radius: 8px; padding: 1rem; margin: 1rem 0; }
+.btn { display: inline-block; padding: 0.5rem 1rem; border-radius: 4px; cursor: pointer; }
+.btn-primary { background: #0066cc; color: white; }
+@media (max-width: 768px) { .container { padding: 0 10px; } }`;
+
+// Simulated JS bundle (minified-ish)
+const JS_BUNDLE =
+  `!function(){"use strict";` +
+  'const e=document.getElementById("root");' +
+  'function t(e,t){return Object.assign(document.createElement(e),t)}' +
+  Array.from(
+    { length: 100 },
+    (_, i) =>
+      `function c${i}(d){return t("div",{className:"c${i}",textContent:JSON.stringify(d)})}`,
+  ).join(';') +
+  '}();';
+
+function handleRequest(req, res) {
+  const url = new URL(req.url, `http://localhost`);
+  const path = url.pathname;
+  const method = req.method;
+
+  // CORS headers (very common in REST APIs)
+  res.setHeader('Access-Control-Allow-Origin', '*');
+  res.setHeader(
+    'Access-Control-Allow-Methods',
+    'GET, POST, PUT, DELETE, OPTIONS',
+  );
+  res.setHeader('X-Request-Id', crypto.randomUUID());
+
+  if (method === 'OPTIONS') {
+    res.writeHead(204);
+    res.end();
+    return;
+  }
+
+  // REST API routes
+  if (path === '/api/users' && method === 'GET') {
+    const page = url.searchParams.get('page') || '1';
+    const limit = url.searchParams.get('limit') || '50';
+    res.writeHead(200, {
+      'Content-Type': 'application/json',
+      'X-Page': page,
+      'X-Limit': limit,
+      'X-Total': '500',
+      'Cache-Control': 'no-cache',
+    });
+    res.end(MEDIUM_JSON);
+    return;
+  }
+
+  if (path === '/api/events' && method === 'POST') {
+    let body = '';
+    req.on('data', (chunk) => {
+      body += chunk;
+    });
+    req.on('end', () => {
+      try {
+        const parsed = JSON.parse(body);
+        const response = JSON.stringify({
+          status: 'accepted',
+          count: Array.isArray(parsed) ? parsed.length : 1,
+          timestamp: new Date().toISOString(),
+        });
+        res.writeHead(202, {
+          'Content-Type': 'application/json',
+          'Content-Length': Buffer.byteLength(response),
+        });
+        res.end(response);
+      } catch {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end('{"error":"Invalid JSON"}');
+      }
+    });
+    return;
+  }
+
+  if (path === '/api/analytics' && method === 'GET') {
+    // Chunked response (common for large datasets)
+    res.writeHead(200, {
+      'Content-Type': 'application/json',
+      'Transfer-Encoding': 'chunked',
+    });
+    res.write(LARGE_JSON.slice(0, 4096));
+    res.write(LARGE_JSON.slice(4096, 8192));
+    res.write(LARGE_JSON.slice(8192));
+    res.end();
+    return;
+  }
+
+  if (path.startsWith('/api/users/') && method === 'GET') {
+    const userId = path.split('/')[3];
+    const user = JSON.stringify({
+      id: userId,
+      name: `User ${userId}`,
+      email: `user${userId}@example.com`,
+      createdAt: new Date().toISOString(),
+      profile: { bio: 'A sample user', avatar: '/img/default.png' },
+    });
+    res.writeHead(200, {
+      'Content-Type': 'application/json',
+      'ETag': `"${crypto.createHash('md5').update(user).digest('hex')}"`,
+      'Cache-Control': 'max-age=60',
+    });
+    res.end(user);
+    return;
+  }
+
+  if (path === '/health') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(SMALL_JSON);
+    return;
+  }
+
+  // Static content routes
+  if (path === '/' || path === '/index.html') {
+    res.writeHead(200, {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Content-Length': Buffer.byteLength(HTML_PAGE),
+      'Cache-Control': 'public, max-age=3600',
+    });
+    res.end(HTML_PAGE);
+    return;
+  }
+
+  if (path === '/styles.css') {
+    res.writeHead(200, {
+      'Content-Type': 'text/css',
+      'Content-Length': Buffer.byteLength(CSS_CONTENT),
+      'Cache-Control': 'public, max-age=86400',
+    });
+    res.end(CSS_CONTENT);
+    return;
+  }
+
+  if (path === '/app.js') {
+    res.writeHead(200, {
+      'Content-Type': 'application/javascript',
+      'Content-Length': Buffer.byteLength(JS_BUNDLE),
+      'Cache-Control': 'public, max-age=86400',
+    });
+    res.end(JS_BUNDLE);
+    return;
+  }
+
+  // Set-Cookie responses (common for auth)
+  if (path === '/api/login' && method === 'POST') {
+    req.on('data', () => {});
+    req.on('end', () => {
+      const token = crypto.randomBytes(32).toString('hex');
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        'Set-Cookie': [
+          `token=${token}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=3600`,
+          `session=${crypto.randomUUID()}; HttpOnly; Path=/`,
+        ],
+      });
+      res.end(JSON.stringify({ token, expiresIn: 3600 }));
+    });
+    return;
+  }
+
+  // 404
+  res.writeHead(404, { 'Content-Type': 'application/json' });
+  res.end('{"error":"Not Found"}');
+}
+
+// Request patterns that clients will cycle through
+const REQUEST_PATTERNS = [
+  // Weight distribution reflects real API usage
+  { method: 'GET', path: '/api/users?page=1&limit=50', weight: 20 },
+  {
+    method: 'GET',
+    path: '/api/users?page=2&limit=25&sort=name&order=asc',
+    weight: 10,
+  },
+  { method: 'GET', path: '/api/users/123', weight: 15 },
+  { method: 'GET', path: '/api/users/456', weight: 10 },
+  { method: 'GET', path: '/api/analytics', weight: 5 },
+  { method: 'GET', path: '/health', weight: 15 },
+  { method: 'GET', path: '/', weight: 8 },
+  { method: 'GET', path: '/styles.css', weight: 4 },
+  { method: 'GET', path: '/app.js', weight: 4 },
+  {
+    method: 'POST',
+    path: '/api/events',
+    body: JSON.stringify([
+      { type: 'click', target: 'button', timestamp: Date.now() },
+      { type: 'view', page: '/dashboard', timestamp: Date.now() },
+    ]),
+    weight: 5,
+  },
+  {
+    method: 'POST',
+    path: '/api/login',
+    body: '{"email":"test@example.com","password":"pass123"}',
+    weight: 3,
+  },
+  { method: 'OPTIONS', path: '/api/users', weight: 1 },
+];
+
+// Build weighted selection array
+const weightedPatterns = [];
+for (const pattern of REQUEST_PATTERNS) {
+  for (let i = 0; i < pattern.weight; i++) {
+    weightedPatterns.push(pattern);
+  }
+}
+
+function makeRequest(port, pattern) {
+  return new Promise((resolve, reject) => {
+    const options = {
+      hostname: '127.0.0.1',
+      port,
+      path: pattern.path,
+      method: pattern.method,
+      headers: {
+        'Host': 'localhost',
+        'User-Agent': 'PGO-Training/1.0',
+        'Accept': 'application/json, text/html',
+        'Accept-Encoding': 'identity',
+        'Connection': 'keep-alive',
+      },
+    };
+
+    if (pattern.body) {
+      options.headers['Content-Type'] = 'application/json';
+      options.headers['Content-Length'] = Buffer.byteLength(pattern.body);
+    }
+
+    const req = http.request(options, (res) => {
+      let data = '';
+      res.on('data', (chunk) => {
+        data += chunk;
+      });
+      res.on('end', () =>
+        resolve({ status: res.statusCode, size: data.length }),
+      );
+    });
+    req.on('error', reject);
+    if (pattern.body) req.write(pattern.body);
+    req.end();
+  });
+}
+
+async function runClient(port, endTime) {
+  let requests = 0;
+  const agent = new http.Agent({ keepAlive: true, maxSockets: 2 });
+
+  while (Date.now() < endTime) {
+    const pattern =
+      weightedPatterns[Math.floor(Math.random() * weightedPatterns.length)];
+    try {
+      await makeRequest(port, pattern);
+      requests++;
+    } catch {
+      // Instrumented builds are slow; brief pause on error
+      await new Promise((r) => setTimeout(r, 10));
+    }
+  }
+  agent.destroy();
+  return requests;
+}
+
+async function main() {
+  const server = http.createServer(handleRequest);
+
+  await new Promise((resolve) => server.listen(PORT, '127.0.0.1', resolve));
+  const port = server.address().port;
+  console.log(`[pgo-http-server] Server listening on port ${port}`);
+
+  const endTime = Date.now() + DURATION_MS;
+  const clients = Array.from({ length: CONCURRENT_CLIENTS }, () =>
+    runClient(port, endTime),
+  );
+  const results = await Promise.all(clients);
+  const totalRequests = results.reduce((a, b) => a + b, 0);
+
+  server.close();
+  console.log(
+    `[pgo-http-server] Completed ${totalRequests} requests in ${DURATION_MS / 1000}s (${(totalRequests / (DURATION_MS / 1000)).toFixed(0)} req/s)`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-http-server] Error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-json.js b/tools/pgo/pgo-json.js
new file mode 100644
index 000000000000..203d746f7716
--- /dev/null
+++ b/tools/pgo/pgo-json.js
@@ -0,0 +1,341 @@
+'use strict';
+
+// PGO Training Script: JSON Processing Workload
+//
+// JSON.parse() and JSON.stringify() are among the most frequently called
+// functions in Node.js applications (every REST API request/response cycle).
+// This script exercises the JSON parser and serializer with:
+// - Small objects (API responses, config)
+// - Medium objects (paginated lists, user profiles)
+// - Large objects (analytics payloads, data exports)
+// - Nested structures (deep objects, arrays of objects)
+// - Various value types (strings, numbers, booleans, null, arrays, objects)
+// - Edge cases (unicode, escaped characters, large numbers, empty objects)
+// - Realistic patterns: parse → transform → stringify pipeline
+//
+// This exercises: V8 JSON parser, V8 JSON serializer, string allocation,
+// property access patterns, array iteration, GC pressure from allocations.
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+const ITERATIONS_PER_BATCH = 500;
+
+// Realistic JSON payloads matching common API shapes
+
+// 1. Small config/health check (~100 bytes)
+const SMALL_PAYLOADS = [
+  '{"status":"ok","uptime":12345,"version":"1.0.0"}',
+  '{"id":42,"name":"test","active":true,"score":98.5}',
+  '{"error":null,"data":{"key":"value"},"meta":{}}',
+  '{"token":"abc123def456","expires":1700000000}',
+  '{"success":true,"count":0,"items":[]}',
+];
+
+// 2. Medium user/product objects (~1-5 KB)
+function generateUserPayload(count) {
+  const users = [];
+  for (let i = 0; i < count; i++) {
+    users.push({
+      id: `usr_${i.toString(36).padStart(8, '0')}`,
+      email: `user${i}@company.example.com`,
+      name: { first: `First${i}`, last: `Last${i}` },
+      role: ['admin', 'editor', 'viewer', 'member'][i % 4],
+      permissions: ['read', 'write', 'delete', 'admin'].slice(0, (i % 4) + 1),
+      settings: {
+        theme: i % 2 === 0 ? 'dark' : 'light',
+        language: ['en', 'es', 'fr', 'de', 'ja'][i % 5],
+        notifications: { email: true, push: i % 3 !== 0, sms: false },
+        timezone: 'America/New_York',
+      },
+      metadata: {
+        createdAt: '2024-01-15T08:30:00.000Z',
+        updatedAt: '2024-12-01T14:22:33.456Z',
+        lastLogin: '2024-12-15T09:45:00.000Z',
+        loginCount: 100 + i * 7,
+      },
+    });
+  }
+  return JSON.stringify({ data: users, total: count, page: 1, perPage: count });
+}
+
+// 3. Large analytics/event payloads (~50-200 KB)
+function generateEventPayload(count) {
+  const events = [];
+  for (let i = 0; i < count; i++) {
+    events.push({
+      id: `evt_${Date.now()}_${i}`,
+      type: [
+        'page_view',
+        'click',
+        'form_submit',
+        'api_call',
+        'error',
+        'purchase',
+      ][i % 6],
+      timestamp: new Date(Date.now() - i * 60000).toISOString(),
+      session: `sess_${Math.floor(i / 10)}`,
+      user: i % 5 === 0 ? null : `usr_${i % 100}`,
+      properties: {
+        url: `https://example.com/page/${i % 20}?ref=dashboard&utm_source=email`,
+        title: `Page Title ${i % 20} — Application Dashboard`,
+        referrer: i % 3 === 0 ? 'https://google.com/search?q=test' : '',
+        duration: Math.round(Math.random() * 30000),
+        viewport: { width: 1920, height: 1080 },
+        device: {
+          type: ['desktop', 'mobile', 'tablet'][i % 3],
+          os: ['Windows 11', 'macOS 14', 'iOS 17', 'Android 14'][i % 4],
+          browser: ['Chrome 120', 'Firefox 121', 'Safari 17'][i % 3],
+        },
+      },
+      context: {
+        ip: `10.${i % 256}.${(i * 3) % 256}.${(i * 7) % 256}`,
+        locale: ['en-US', 'en-GB', 'es-ES', 'fr-FR', 'de-DE'][i % 5],
+        campaign:
+          i % 10 === 0 ?
+            { name: 'holiday_sale', medium: 'email', source: 'mailchimp' } :
+            null,
+      },
+    });
+  }
+  return JSON.stringify({
+    events,
+    batch_id: `batch_${Date.now()}`,
+    sent_at: new Date().toISOString(),
+  });
+}
+
+// 4. Deeply nested structure (config files, GraphQL responses)
+function generateNestedPayload(depth, breadth) {
+  function nest(d) {
+    if (d === 0) return { value: 'leaf', count: 42, tags: ['a', 'b'] };
+    const obj = {};
+    for (let i = 0; i < breadth; i++) {
+      obj[`level_${d}_key_${i}`] = nest(d - 1);
+    }
+    return obj;
+  }
+  return JSON.stringify({ root: nest(depth), _meta: { depth, breadth } });
+}
+
+// 5. Array-heavy payload (table data, CSV-like)
+function generateTablePayload(rows, cols) {
+  const headers = Array.from({ length: cols }, (_, i) => `column_${i}`);
+  const data = [];
+  for (let r = 0; r < rows; r++) {
+    const row = {};
+    for (let c = 0; c < cols; c++) {
+      row[headers[c]] =
+        c % 3 === 0 ? r * c : c % 3 === 1 ? `val_${r}_${c}` : r % 2 === 0;
+    }
+    data.push(row);
+  }
+  return JSON.stringify({ headers, data, rowCount: rows });
+}
+
+// 6. Unicode-heavy payload (i18n content)
+const UNICODE_PAYLOAD = JSON.stringify({
+  messages: {
+    en: { greeting: 'Hello, World!', farewell: 'Goodbye!' },
+    ja: { greeting: 'こんにちは世界！', farewell: 'さようなら！' },
+    ko: { greeting: '안녕하세요 세계!', farewell: '안녕히 가세요!' },
+    zh: { greeting: '你好世界！', farewell: '再见！' },
+    ar: { greeting: 'مرحبا بالعالم!', farewell: 'مع السلامة!' },
+    ru: { greeting: 'Привет мир!', farewell: 'До свидания!' },
+    de: { greeting: 'Hallo Welt!', farewell: 'Auf Wiedersehen!' },
+    emoji: { greeting: '👋🌍✨', farewell: '👋😢💫' },
+  },
+  descriptions: Array.from(
+    { length: 50 },
+    (_, i) =>
+      `Item ${i}: Ünîcödé tëst with spëcîal chars — «quotes» "double" 'single' & ampersand \\ backslash / slash`,
+  ),
+});
+
+// Pre-generate payloads as strings
+const mediumPayload10 = generateUserPayload(10);
+const mediumPayload50 = generateUserPayload(50);
+const largePayload100 = generateEventPayload(100);
+const largePayload500 = generateEventPayload(500);
+const nestedPayload = generateNestedPayload(5, 3);
+const tablePayload = generateTablePayload(200, 15);
+
+// All payloads weighted by real-world frequency
+const PAYLOADS = [
+  // Small payloads (health checks, simple responses) - most frequent
+  ...SMALL_PAYLOADS.map((p) => ({ json: p, weight: 5 })),
+  // Medium payloads (typical API responses)
+  { json: mediumPayload10, weight: 8 },
+  { json: mediumPayload50, weight: 6 },
+  // Large payloads (analytics, batch operations)
+  { json: largePayload100, weight: 3 },
+  { json: largePayload500, weight: 1 },
+  // Nested payloads (config, GraphQL)
+  { json: nestedPayload, weight: 2 },
+  // Table payloads (data grids, reports)
+  { json: tablePayload, weight: 2 },
+  // Unicode payloads (i18n)
+  { json: UNICODE_PAYLOAD, weight: 2 },
+];
+
+const weightedPayloads = [];
+for (const p of PAYLOADS) {
+  for (let i = 0; i < p.weight; i++) {
+    weightedPayloads.push(p.json);
+  }
+}
+
+// Workload 1: Parse → access properties → stringify (REST API middleware pattern)
+function workloadParseTransformStringify(jsonStr) {
+  const obj = JSON.parse(jsonStr);
+
+  // Typical middleware transforms
+  if (obj.data && Array.isArray(obj.data)) {
+    // Add computed field (common API pattern)
+    for (const item of obj.data) {
+      item._computed =
+        typeof item.id === 'string' ? item.id.toUpperCase() : String(item.id);
+    }
+  }
+  if (obj.events && Array.isArray(obj.events)) {
+    // Filter/transform (analytics pipeline)
+    obj.events = obj.events.filter((e) => e.type !== 'error');
+    obj.filteredCount = obj.events.length;
+  }
+
+  return JSON.stringify(obj);
+}
+
+// Workload 2: Parse → extract subset → stringify (GraphQL resolver pattern)
+function workloadSelectiveSerialize(jsonStr) {
+  const obj = JSON.parse(jsonStr);
+  const subset = {};
+
+  // Pick only requested fields (like GraphQL field selection)
+  for (const key of Object.keys(obj)) {
+    if (typeof obj[key] !== 'object' || obj[key] === null) {
+      subset[key] = obj[key];
+    } else if (Array.isArray(obj[key]) && obj[key].length > 0) {
+      subset[key] = obj[key].slice(0, 5).map((item) => {
+        if (typeof item === 'object' && item !== null) {
+          const { id, name, type, email } = item;
+          return { id, name, type, email };
+        }
+        return item;
+      });
+    }
+  }
+
+  return JSON.stringify(subset);
+}
+
+// Workload 3: Repeated parse/stringify of same shape (template response caching pattern)
+function workloadRepeatedShapes() {
+  const results = [];
+  for (let i = 0; i < 100; i++) {
+    const obj = {
+      id: i,
+      name: `Item ${i}`,
+      description: `Description for item ${i} with some additional text`,
+      price: (i * 1.5).toFixed(2),
+      inStock: i % 3 !== 0,
+      categories: ['cat1', 'cat2'],
+      ratings: { average: 4.5, count: i * 10 },
+    };
+    results.push(JSON.stringify(obj));
+  }
+  // Parse them all back
+  return results.map((s) => JSON.parse(s));
+}
+
+// Workload 4: JSON.parse with reviver / JSON.stringify with replacer
+function workloadReviverReplacer(jsonStr) {
+  // Parse with date reviver (common pattern)
+  const dateReviver = (key, value) => {
+    if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(value)) {
+      return new Date(value);
+    }
+    return value;
+  };
+  const obj = JSON.parse(jsonStr, dateReviver);
+
+  // Stringify with replacer to exclude nulls (sanitization)
+  const nullRemover = (key, value) => (value === null ? undefined : value);
+  return JSON.stringify(obj, nullRemover);
+}
+
+// Workload 5: Build large JSON incrementally (logging, audit trail)
+function workloadIncrementalBuild() {
+  const entries = [];
+  for (let i = 0; i < 200; i++) {
+    entries.push({
+      level: ['info', 'warn', 'error', 'debug'][i % 4],
+      message: `Log entry ${i}: Operation completed successfully with result code ${i * 3}`,
+      timestamp: Date.now() - i * 1000,
+      context: { requestId: `req_${i}`, userId: `user_${i % 20}` },
+    });
+  }
+  const logBatch = JSON.stringify({ entries, count: entries.length });
+  // Verify round-trip
+  const parsed = JSON.parse(logBatch);
+  return parsed.count;
+}
+
+async function main() {
+  console.log('[pgo-json] Starting JSON processing workload...');
+  const startTime = Date.now();
+  let totalOps = 0;
+  let batchNum = 0;
+
+  while (Date.now() - startTime < DURATION_MS) {
+    batchNum++;
+
+    // Workload 1: Parse-transform-stringify (highest weight — most common)
+    for (let i = 0; i < ITERATIONS_PER_BATCH; i++) {
+      const payload = weightedPayloads[i % weightedPayloads.length];
+      workloadParseTransformStringify(payload);
+      totalOps++;
+    }
+
+    // Workload 2: Selective serialization
+    for (let i = 0; i < Math.floor(ITERATIONS_PER_BATCH / 2); i++) {
+      const payload = weightedPayloads[i % weightedPayloads.length];
+      workloadSelectiveSerialize(payload);
+      totalOps++;
+    }
+
+    // Workload 3: Repeated shapes (every 3rd batch)
+    if (batchNum % 3 === 0) {
+      workloadRepeatedShapes();
+      totalOps += 200; // 100 stringify + 100 parse
+    }
+
+    // Workload 4: Reviver/replacer (every 2nd batch)
+    if (batchNum % 2 === 0) {
+      for (let i = 0; i < 50; i++) {
+        const payload = weightedPayloads[i % weightedPayloads.length];
+        workloadReviverReplacer(payload);
+        totalOps++;
+      }
+    }
+
+    // Workload 5: Incremental build (every 5th batch)
+    if (batchNum % 5 === 0) {
+      workloadIncrementalBuild();
+      totalOps += 201; // 200 items + 1 round-trip
+    }
+
+    // Yield to event loop periodically (realistic for servers)
+    if (batchNum % 10 === 0) {
+      await new Promise((resolve) => setImmediate(resolve));
+    }
+  }
+
+  const elapsed = (Date.now() - startTime) / 1000;
+  console.log(
+    `[pgo-json] Completed ${totalOps} JSON operations in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s)`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-json] Error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-module-loading.js b/tools/pgo/pgo-module-loading.js
new file mode 100644
index 000000000000..ffb11706ba91
--- /dev/null
+++ b/tools/pgo/pgo-module-loading.js
@@ -0,0 +1,719 @@
+'use strict';
+
+/* eslint-disable no-void */
+
+// PGO Training Script: Module Loading and Startup
+//
+// Module loading (require/import) is one of Node.js's most performance-critical
+// paths, especially for:
+// - Application startup time (serverless cold starts, CLI tools)
+// - require() resolution algorithm (stat cascade, package.json parsing)
+// - ESM vs CJS loading (import() dynamic imports)
+// - Circular dependency resolution
+// - Built-in module loading
+// - JSON module loading (package.json, config files)
+//
+// This exercises: module resolver (fs.stat/readFile cascade), V8 script
+// compilation, source code parsing, JSON parsing, path resolution,
+// module wrapper function, exports/require machinery.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const vm = require('vm');
+const Module = require('module');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+const TEMP_DIR = path.join(
+  os.tmpdir(),
+  `node-pgo-module-${process.pid}-${Date.now()}`,
+);
+
+function setup() {
+  fs.mkdirSync(TEMP_DIR, { recursive: true });
+
+  // Create a realistic module tree
+  // node_modules/
+  //   express/
+  //     package.json
+  //     index.js
+  //     lib/router.js, lib/request.js, lib/response.js
+  //   lodash/
+  //     package.json
+  //     lodash.js
+  //   config/
+  //     package.json
+  //     index.js
+  //  src/
+  //    index.js, utils.js, helpers.js, constants.js
+  //    models/user.js, models/product.js
+  //    middleware/auth.js, middleware/logger.js
+
+  const dirs = [
+    'node_modules/express/lib',
+    'node_modules/lodash',
+    'node_modules/config',
+    'node_modules/debug',
+    'node_modules/body-parser',
+    'src/models',
+    'src/middleware',
+    'src/routes',
+    'src/utils',
+    'lib',
+  ];
+
+  for (const dir of dirs) {
+    fs.mkdirSync(path.join(TEMP_DIR, dir), { recursive: true });
+  }
+
+  // Express-like module
+  writeFile(
+    'node_modules/express/package.json',
+    JSON.stringify({
+      name: 'express',
+      version: '4.18.2',
+      main: 'index.js',
+    }),
+  );
+  writeFile(
+    'node_modules/express/index.js',
+    `
+    'use strict';
+    const router = require('./lib/router');
+    const request = require('./lib/request');
+    const response = require('./lib/response');
+    function createApp() {
+      const app = { routes: [], use(fn) { this.routes.push(fn); return this; } };
+      Object.assign(app, router, request, response);
+      return app;
+    }
+    module.exports = createApp;
+    module.exports.Router = router.Router;
+    module.exports.static = function(root) { return function(req, res, next) { next(); }; };
+  `,
+  );
+  writeFile(
+    'node_modules/express/lib/router.js',
+    `
+    'use strict';
+    class Router { constructor() { this.stack = []; } route(path) { return this; } }
+    exports.Router = function() { return new Router(); };
+    exports.handle = function(req, res) {};
+    exports.param = function(name, fn) {};
+  `,
+  );
+  writeFile(
+    'node_modules/express/lib/request.js',
+    `
+    'use strict';
+    exports.get = function(field) { return ''; };
+    exports.accepts = function() { return true; };
+    exports.is = function(type) { return type; };
+  `,
+  );
+  writeFile(
+    'node_modules/express/lib/response.js',
+    `
+    'use strict';
+    exports.send = function(body) { return this; };
+    exports.json = function(obj) { return this; };
+    exports.status = function(code) { return this; };
+  `,
+  );
+
+  // Lodash-like module
+  writeFile(
+    'node_modules/lodash/package.json',
+    JSON.stringify({
+      name: 'lodash',
+      version: '4.17.21',
+      main: 'lodash.js',
+    }),
+  );
+  writeFile(
+    'node_modules/lodash/lodash.js',
+    `
+    'use strict';
+    const _ = {};
+    _.map = (arr, fn) => arr.map(fn);
+    _.filter = (arr, fn) => arr.filter(fn);
+    _.reduce = (arr, fn, init) => arr.reduce(fn, init);
+    _.get = (obj, path, def) => { const keys = path.split('.'); let val = obj; for (const k of keys) { val = val?.[k]; } return val ?? def; };
+    _.set = (obj, path, val) => { const keys = path.split('.'); let cur = obj; for (let i = 0; i < keys.length - 1; i++) { cur = cur[keys[i]] ??= {}; } cur[keys[keys.length-1]] = val; return obj; };
+    _.cloneDeep = (obj) => JSON.parse(JSON.stringify(obj));
+    _.debounce = (fn, wait) => { let timer; return (...args) => { clearTimeout(timer); timer = setTimeout(() => fn(...args), wait); }; };
+    _.chunk = (arr, size) => { const res = []; for (let i = 0; i < arr.length; i += size) res.push(arr.slice(i, i + size)); return res; };
+    _.flatten = (arr) => arr.flat();
+    _.uniq = (arr) => [...new Set(arr)];
+    module.exports = _;
+  `,
+  );
+
+  // Config module
+  writeFile(
+    'node_modules/config/package.json',
+    JSON.stringify({
+      name: 'config',
+      version: '3.3.9',
+      main: 'index.js',
+    }),
+  );
+  writeFile(
+    'node_modules/config/index.js',
+    `
+    'use strict';
+    const config = { db: { host: 'localhost', port: 5432 }, app: { port: 3000 } };
+    module.exports = { get(key) { return key.split('.').reduce((o, k) => o?.[k], config); }, has(key) { return this.get(key) !== undefined; } };
+  `,
+  );
+
+  // Debug module
+  writeFile(
+    'node_modules/debug/package.json',
+    JSON.stringify({
+      name: 'debug',
+      version: '4.3.4',
+      main: 'index.js',
+    }),
+  );
+  writeFile(
+    'node_modules/debug/index.js',
+    `
+    'use strict';
+    module.exports = function(namespace) {
+      return function(...args) { /* noop in production */ };
+    };
+  `,
+  );
+
+  // Body-parser module
+  writeFile(
+    'node_modules/body-parser/package.json',
+    JSON.stringify({
+      name: 'body-parser',
+      version: '1.20.2',
+      main: 'index.js',
+    }),
+  );
+  writeFile(
+    'node_modules/body-parser/index.js',
+    `
+    'use strict';
+    exports.json = function(options) { return function(req, res, next) { next(); }; };
+    exports.urlencoded = function(options) { return function(req, res, next) { next(); }; };
+    exports.raw = function(options) { return function(req, res, next) { next(); }; };
+  `,
+  );
+
+  // Application source files
+  writeFile(
+    'src/index.js',
+    `
+    'use strict';
+    const express = require('express');
+    const bodyParser = require('body-parser');
+    const debug = require('debug');
+    const config = require('config');
+    const { authenticate } = require('./middleware/auth');
+    const { logger } = require('./middleware/logger');
+    const userRoutes = require('./routes/users');
+    const { formatDate, generateId } = require('./utils/helpers');
+    const { ROLES, STATUS } = require('./utils/constants');
+    module.exports = { express, bodyParser, debug, config, authenticate, logger, userRoutes, formatDate, generateId, ROLES, STATUS };
+  `,
+  );
+
+  writeFile(
+    'src/utils/helpers.js',
+    `
+    'use strict';
+    const crypto = require('crypto');
+    exports.formatDate = (d) => new Date(d).toISOString();
+    exports.generateId = () => crypto.randomUUID();
+    exports.sanitize = (str) => str.replace(/[<>&"']/g, '');
+    exports.paginate = (arr, page, size) => arr.slice((page - 1) * size, page * size);
+  `,
+  );
+
+  writeFile(
+    'src/utils/constants.js',
+    `
+    'use strict';
+    exports.ROLES = Object.freeze({ ADMIN: 'admin', USER: 'user', GUEST: 'guest' });
+    exports.STATUS = Object.freeze({ ACTIVE: 'active', INACTIVE: 'inactive', PENDING: 'pending' });
+    exports.LIMITS = Object.freeze({ MAX_PAGE_SIZE: 100, MAX_UPLOAD: 10 * 1024 * 1024 });
+  `,
+  );
+
+  writeFile(
+    'src/models/user.js',
+    `
+    'use strict';
+    const { generateId } = require('../utils/helpers');
+    const { ROLES, STATUS } = require('../utils/constants');
+    class User { constructor(data) { this.id = generateId(); this.role = ROLES.USER; this.status = STATUS.PENDING; Object.assign(this, data); } toJSON() { return { id: this.id, name: this.name, role: this.role }; } }
+    module.exports = User;
+  `,
+  );
+
+  writeFile(
+    'src/models/product.js',
+    `
+    'use strict';
+    const { generateId } = require('../utils/helpers');
+    class Product { constructor(data) { this.id = generateId(); Object.assign(this, data); } toJSON() { return { id: this.id, name: this.name, price: this.price }; } }
+    module.exports = Product;
+  `,
+  );
+
+  writeFile(
+    'src/middleware/auth.js',
+    `
+    'use strict';
+    const crypto = require('crypto');
+    exports.authenticate = function(req, res, next) { const token = req?.headers?.authorization; return !!token; };
+    exports.authorize = function(...roles) { return function(req, res, next) { return roles.length > 0; }; };
+  `,
+  );
+
+  writeFile(
+    'src/middleware/logger.js',
+    `
+    'use strict';
+    exports.logger = function(req, res, next) {
+      const start = Date.now();
+      return { duration: Date.now() - start, method: req?.method, url: req?.url };
+    };
+  `,
+  );
+
+  writeFile(
+    'src/routes/users.js',
+    `
+    'use strict';
+    const User = require('../models/user');
+    const { paginate } = require('../utils/helpers');
+    const { authenticate } = require('../middleware/auth');
+    exports.getUsers = function(page, size) { return paginate([], page, size); };
+    exports.createUser = function(data) { return new User(data); };
+    exports.getUser = function(id) { return null; };
+  `,
+  );
+
+  // ESM modules
+  writeFile(
+    'src/esm-entry.mjs',
+    `
+    import { createRequire } from 'module';
+    import { fileURLToPath } from 'url';
+    import { dirname, join } from 'path';
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = dirname(__filename);
+    const require = createRequire(import.meta.url);
+    export const config = { loaded: true, dir: __dirname };
+    export function greet(name) { return \`Hello, \${name}!\`; }
+    export default { config, greet };
+  `,
+  );
+
+  // JSON file (loaded as module)
+  writeFile(
+    'config/default.json',
+    JSON.stringify(
+      {
+        server: { port: 3000, host: '0.0.0.0' },
+        database: {
+          url: 'postgres://localhost:5432/myapp',
+          pool: { min: 2, max: 10 },
+        },
+        redis: { url: 'redis://localhost:6379' },
+        jwt: { secret: 'test-secret', expiresIn: '1h' },
+        logging: { level: 'info' },
+      },
+      null,
+      2,
+    ),
+  );
+
+  // package.json at root
+  writeFile(
+    'package.json',
+    JSON.stringify(
+      {
+        name: 'pgo-test-app',
+        version: '1.0.0',
+        main: 'src/index.js',
+        dependencies: {
+          'express': '^4.18.0',
+          'lodash': '^4.17.0',
+          'config': '^3.3.0',
+          'debug': '^4.3.0',
+          'body-parser': '^1.20.0',
+        },
+      },
+      null,
+      2,
+    ),
+  );
+}
+
+function writeFile(relPath, content) {
+  const fullPath = path.join(TEMP_DIR, relPath);
+  fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+  fs.writeFileSync(fullPath, content);
+}
+
+function cleanup() {
+  try {
+    fs.rmSync(TEMP_DIR, { recursive: true, force: true });
+  } catch {
+    // best effort
+  }
+}
+
+// Workload 1: require() with full resolution (CJS — the dominant pattern)
+function workloadCJSRequire(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Clear module cache to force re-resolution
+    const keys = Object.keys(require.cache).filter((k) =>
+      k.startsWith(TEMP_DIR),
+    );
+    for (const key of keys) {
+      delete require.cache[key];
+    }
+
+    // Require the full app (cascading dependencies)
+    require(path.join(TEMP_DIR, 'src', 'index.js'));
+    ops++;
+
+    // Require individual modules
+    require(path.join(TEMP_DIR, 'node_modules', 'lodash', 'lodash.js'));
+    require(path.join(TEMP_DIR, 'src', 'models', 'user.js'));
+    require(path.join(TEMP_DIR, 'src', 'models', 'product.js'));
+    ops += 3;
+
+    // JSON require (package.json resolution)
+    delete require.cache[path.join(TEMP_DIR, 'package.json')];
+    require(path.join(TEMP_DIR, 'package.json'));
+    delete require.cache[path.join(TEMP_DIR, 'config', 'default.json')];
+    require(path.join(TEMP_DIR, 'config', 'default.json'));
+    ops += 2;
+  }
+  return ops;
+}
+
+// Workload 2: Built-in module loading (no resolution needed, but exercises native binding)
+function workloadBuiltinRequire(iterations) {
+  let ops = 0;
+  const builtins = [
+    'fs',
+    'path',
+    'http',
+    'https',
+    'crypto',
+    'os',
+    'url',
+    'util',
+    'events',
+    'stream',
+    'buffer',
+    'net',
+    'dns',
+    'zlib',
+    'child_process',
+    'querystring',
+    'string_decoder',
+    'timers',
+    'assert',
+    'tls',
+    'fs/promises',
+    'stream/promises',
+    'timers/promises',
+    'node:fs',
+    'node:path',
+    'node:http',
+    'node:crypto',
+    'node:os',
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    for (const mod of builtins) {
+      require(mod);
+    }
+    ops += builtins.length;
+  }
+  return ops;
+}
+
+// Workload 3: Module.createRequire and resolution
+function workloadModuleResolution(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // createRequire (used in ESM ↔ CJS interop)
+    const customRequire = Module.createRequire(
+      path.join(TEMP_DIR, 'src', 'index.js'),
+    );
+
+    // Resolve module paths (this is the hot path in require())
+    try {
+      customRequire.resolve('express');
+    } catch {
+      // expected
+    }
+    try {
+      customRequire.resolve('lodash');
+    } catch {
+      // expected
+    }
+    try {
+      customRequire.resolve('./models/user');
+    } catch {
+      // expected
+    }
+    try {
+      customRequire.resolve('../package.json');
+    } catch {
+      // expected
+    }
+    ops += 4;
+
+    // Module._resolveFilename (internal but exercises the same path)
+    try {
+      Module._resolveFilename('fs');
+    } catch {
+      // expected
+    }
+    try {
+      Module._resolveFilename('path');
+    } catch {
+      // expected
+    }
+    ops += 2;
+
+    // Module.builtinModules
+    void Module.builtinModules;
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 4: vm.Script compilation (V8 script compilation path)
+function workloadVMCompilation(iterations) {
+  let ops = 0;
+
+  const scripts = [
+    // Simple expression
+    'const x = 1 + 2; x;',
+    // Function definition
+    'function add(a, b) { return a + b; } add(1, 2);',
+    // Object manipulation
+    'const obj = { a: 1, b: { c: [1, 2, 3] } }; JSON.stringify(obj);',
+    // Loop
+    'let sum = 0; for (let i = 0; i < 1000; i++) sum += i; sum;',
+    // Async-like pattern
+    'const p = Promise.resolve(42); p.then(v => v * 2);',
+    // Class definition (modern JS)
+    `class Foo { constructor(x) { this.x = x; } get value() { return this.x; } }
+     const f = new Foo(42); f.value;`,
+    // Destructuring + spread
+    'const { a, b, ...rest } = { a: 1, b: 2, c: 3, d: 4 }; [a, b, ...Object.values(rest)];',
+    // Map/Set
+    'const m = new Map([[1,"a"],[2,"b"]]); const s = new Set([1,2,3]); m.size + s.size;',
+    // Regex
+    'const re = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$/; re.test("test@example.com");',
+    // Template literals
+    // eslint-disable-next-line no-template-curly-in-string
+    'const name = "World"; const greeting = `Hello, ${name}! Today is ${new Date().toISOString()}`; greeting;',
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    for (const code of scripts) {
+      const script = new vm.Script(code, {
+        filename: `script-${i}.js`,
+        produceCachedData: i % 5 === 0, // Some with code caching
+      });
+
+      const context = vm.createContext({
+        JSON,
+        Date,
+        Promise,
+        Map,
+        Set,
+        console,
+      });
+      script.runInContext(context, { timeout: 1000 });
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 5: Dynamic import() (ESM loading — growing usage)
+async function workloadDynamicImport(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Dynamic import of built-in modules (common in ESM code)
+    await import('node:fs');
+    await import('node:path');
+    await import('node:crypto');
+    await import('node:os');
+    await import('node:util');
+    await import('node:url');
+    await import('node:events');
+    await import('node:stream');
+    ops += 8;
+  }
+  return ops;
+}
+
+// Workload 6: Module._compile simulation (exercises V8 compilation)
+function workloadCompilePatterns(iterations) {
+  let ops = 0;
+
+  // Source code patterns that exercise different V8 compilation paths
+  const sourcePatterns = [
+    // Arrow functions (very common in modern JS)
+    'module.exports = {\n' +
+      Array.from(
+        { length: 20 },
+        (_, i) => `  fn${i}: (x) => x * ${i + 1},`,
+      ).join('\n') +
+      '\n};',
+
+    // async/await (extremely common in server code)
+    `module.exports = async function(data) {
+      const result = await Promise.resolve(data);
+      const items = await Promise.all(
+        Array.from({length: 10}, (_, i) => Promise.resolve(i * 2))
+      );
+      return { result, items, total: items.reduce((a,b) => a+b, 0) };
+    };`,
+
+    // try/catch with specific error types
+    `module.exports = function(input) {
+      try {
+        const data = JSON.parse(input);
+        if (!data.id) throw new TypeError('Missing id');
+        if (data.age < 0) throw new RangeError('Invalid age');
+        return data;
+      } catch (err) {
+        if (err instanceof SyntaxError) return { error: 'Invalid JSON' };
+        if (err instanceof TypeError) return { error: err.message };
+        throw err;
+      }
+    };`,
+
+    // Generator function (used in Koa, some ORMs)
+    `module.exports = function* paginate(items, pageSize) {
+      for (let i = 0; i < items.length; i += pageSize) {
+        yield items.slice(i, i + pageSize);
+      }
+    };`,
+
+    // Proxy/Reflect (used in Vue.js reactivity, ORMs)
+    `module.exports = function createReactive(target) {
+      return new Proxy(target, {
+        get(obj, prop) { return Reflect.get(obj, prop); },
+        set(obj, prop, value) { return Reflect.set(obj, prop, value); },
+        has(obj, prop) { return Reflect.has(obj, prop); },
+      });
+    };`,
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    for (const source of sourcePatterns) {
+      const script = new vm.Script(
+        `(function(exports, require, module, __filename, __dirname) { ${source} })`,
+        { filename: `compile-${i}.js` },
+      );
+      const context = vm.createContext({
+        JSON,
+        Promise,
+        Array,
+        Object,
+        Map,
+        Set,
+        Proxy,
+        Reflect,
+        TypeError,
+        RangeError,
+        SyntaxError,
+        Error,
+      });
+      script.runInContext(context);
+      ops++;
+    }
+  }
+  return ops;
+}
+
+async function main() {
+  console.log('[pgo-module-loading] Starting module loading workload...');
+
+  setup();
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  try {
+    while (remaining() > 0) {
+      round++;
+      const scale = Math.max(0.1, remaining() / DURATION_MS);
+      const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+      // CJS require (the most common module operation)
+      if (round === 1)
+        console.log('[pgo-module-loading] Running CJS require...');
+      totalOps += workloadCJSRequire(iterScale(100));
+      if (remaining() <= 0) break;
+
+      // Built-in module loading
+      if (round === 1)
+        console.log('[pgo-module-loading] Running built-in require...');
+      totalOps += workloadBuiltinRequire(iterScale(200));
+      if (remaining() <= 0) break;
+
+      // Module resolution
+      if (round === 1)
+        console.log('[pgo-module-loading] Running module resolution...');
+      totalOps += workloadModuleResolution(iterScale(200));
+      if (remaining() <= 0) break;
+
+      // VM compilation
+      if (round === 1)
+        console.log('[pgo-module-loading] Running VM compilation...');
+      totalOps += workloadVMCompilation(iterScale(50));
+      if (remaining() <= 0) break;
+
+      // Compilation patterns
+      if (round === 1)
+        console.log('[pgo-module-loading] Running compile patterns...');
+      totalOps += workloadCompilePatterns(iterScale(100));
+      if (remaining() <= 0) break;
+
+      // Dynamic import
+      if (round === 1)
+        console.log('[pgo-module-loading] Running dynamic import...');
+      totalOps += await workloadDynamicImport(iterScale(50));
+    }
+
+    const elapsed = (Date.now() - startTime) / 1000;
+    console.log(
+      `[pgo-module-loading] Completed ${totalOps} ops in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+    );
+  } finally {
+    cleanup();
+  }
+}
+
+main().catch((err) => {
+  console.error('[pgo-module-loading] Error:', err);
+  cleanup();
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-net.js b/tools/pgo/pgo-net.js
new file mode 100644
index 000000000000..7f98fbd7723a
--- /dev/null
+++ b/tools/pgo/pgo-net.js
@@ -0,0 +1,443 @@
+'use strict';
+
+/* eslint-disable no-void */
+
+// PGO Training Script: Network (TCP) and DNS
+//
+// Exercises the core networking primitives used by every HTTP server/client:
+// - TCP server/client (the foundation of HTTP)
+// - DNS resolution (every outbound connection)
+// - Connection pooling patterns (keep-alive, max sockets)
+// - Various data transfer patterns (small messages, large payloads, streaming)
+// - Unix domain sockets / named pipes on Windows (IPC)
+//
+// This exercises: libuv TCP/pipe handles, DNS resolver (c-ares),
+// socket state machine, Buffer transfers, EventEmitter for net events.
+
+const net = require('net');
+const dns = require('dns');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+const PORT_TCP = 0; // OS-assigned
+
+// Test payloads simulating real protocols
+const SMALL_MSG = Buffer.from('{"type":"ping","ts":1234567890}\n');
+const MEDIUM_MSG = Buffer.from(
+  JSON.stringify({
+    type: 'data',
+    payload: Array.from({ length: 100 }, (_, i) => ({
+      key: `item_${i}`,
+      value: crypto.randomBytes(16).toString('hex'),
+    })),
+  }) + '\n',
+);
+const LARGE_MSG = crypto.randomBytes(64 * 1024);
+
+// Workload 1: TCP echo server with concurrent clients
+async function workloadTCPEcho(duration) {
+  let totalOps = 0;
+
+  const server = net.createServer((socket) => {
+    socket.on('data', (data) => {
+      // Echo back with a small transformation (realistic: add header/length prefix)
+      const response = Buffer.concat([Buffer.from(`${data.length}:`), data]);
+      socket.write(response);
+    });
+    socket.on('error', () => {});
+  });
+
+  await new Promise((resolve) => server.listen(PORT_TCP, '127.0.0.1', resolve));
+  const port = server.address().port;
+
+  const endTime = Date.now() + duration;
+
+  async function runClient() {
+    let ops = 0;
+    while (Date.now() < endTime) {
+      await new Promise((resolve) => {
+        const client = net.createConnection({ port, host: '127.0.0.1' }, () => {
+          let msgsSent = 0;
+          const maxMsgs = 50;
+
+          function sendNext() {
+            if (msgsSent >= maxMsgs || Date.now() >= endTime) {
+              client.end();
+              return;
+            }
+            // Vary message sizes (realistic: mostly small, some medium, rare large)
+            const r = Math.random();
+            const msg = r < 0.7 ? SMALL_MSG : r < 0.95 ? MEDIUM_MSG : LARGE_MSG;
+            client.write(msg);
+            msgsSent++;
+            ops++;
+          }
+
+          client.on('data', () => {
+            sendNext();
+          });
+          sendNext();
+        });
+
+        client.on('end', resolve);
+        client.on('error', () => resolve());
+        client.setTimeout(2000, () => {
+          client.destroy();
+          resolve();
+        });
+      });
+    }
+    return ops;
+  }
+
+  const clients = Array.from({ length: 10 }, () => runClient());
+  const results = await Promise.all(clients);
+  totalOps = results.reduce((a, b) => a + b, 0);
+
+  server.close();
+  return totalOps;
+}
+
+// Workload 2: TCP request/response (HTTP-like pattern without HTTP overhead)
+async function workloadTCPRequestResponse(duration) {
+  let totalOps = 0;
+
+  const server = net.createServer((socket) => {
+    let buffer = '';
+    socket.on('data', (data) => {
+      buffer += data.toString();
+      // Simple line-delimited protocol (like Redis, memcached)
+      const lines = buffer.split('\n');
+      buffer = lines.pop() || '';
+
+      for (const line of lines) {
+        if (!line) continue;
+        try {
+          const req = JSON.parse(line);
+          let response;
+
+          switch (req.cmd) {
+            case 'GET':
+              response = {
+                status: 'ok',
+                key: req.key,
+                value: 'cached_value_' + req.key,
+              };
+              break;
+            case 'SET':
+              response = { status: 'ok', key: req.key };
+              break;
+            case 'DEL':
+              response = { status: 'ok', deleted: 1 };
+              break;
+            case 'MGET':
+              response = {
+                status: 'ok',
+                values: req.keys.map((k) => 'val_' + k),
+              };
+              break;
+            default:
+              response = { status: 'error', message: 'Unknown command' };
+          }
+          socket.write(JSON.stringify(response) + '\n');
+        } catch {
+          socket.write('{"status":"error","message":"Parse error"}\n');
+        }
+      }
+    });
+    socket.on('error', () => {});
+  });
+
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = server.address().port;
+
+  const endTime = Date.now() + duration;
+
+  async function runClient() {
+    let ops = 0;
+    while (Date.now() < endTime) {
+      await new Promise((resolve) => {
+        const client = net.createConnection({ port, host: '127.0.0.1' }, () => {
+          let pending = 0;
+          const maxOps = 100;
+
+          function sendNext() {
+            if (pending >= maxOps || Date.now() >= endTime) {
+              client.end();
+              return;
+            }
+
+            const commands = [
+              { cmd: 'GET', key: `user:${pending}` },
+              {
+                cmd: 'SET',
+                key: `session:${pending}`,
+                value: crypto.randomUUID(),
+              },
+              { cmd: 'MGET', keys: ['key1', 'key2', 'key3'] },
+              { cmd: 'DEL', key: `temp:${pending}` },
+            ];
+            const cmd = commands[pending % commands.length];
+            client.write(JSON.stringify(cmd) + '\n');
+            pending++;
+            ops++;
+          }
+
+          client.on('data', () => {
+            sendNext();
+          });
+          sendNext();
+        });
+
+        client.on('end', resolve);
+        client.on('error', () => resolve());
+        client.setTimeout(2000, () => {
+          client.destroy();
+          resolve();
+        });
+      });
+    }
+    return ops;
+  }
+
+  const clients = Array.from({ length: 8 }, () => runClient());
+  const results = await Promise.all(clients);
+  totalOps = results.reduce((a, b) => a + b, 0);
+
+  server.close();
+  return totalOps;
+}
+
+// Workload 3: Named pipe / IPC (very common on Windows - VS Code, build tools)
+async function workloadIPC(duration) {
+  let totalOps = 0;
+  const pipePath =
+    process.platform === 'win32' ?
+      `\\\\.\\pipe\\node-pgo-${process.pid}-${Date.now()}` :
+      path.join(os.tmpdir(), `node-pgo-ipc-${process.pid}.sock`);
+
+  const server = net.createServer((socket) => {
+    socket.on('data', (data) => {
+      // IPC protocol: length-prefixed messages
+      const msg = JSON.parse(data.toString());
+      const response = {
+        id: msg.id,
+        result: msg.method === 'eval' ? 'ok' : 'unknown',
+        data: { processed: true, timestamp: Date.now() },
+      };
+      const buf = Buffer.from(JSON.stringify(response));
+      socket.write(buf);
+    });
+    socket.on('error', () => {});
+  });
+
+  await new Promise((resolve) => server.listen(pipePath, resolve));
+
+  const endTime = Date.now() + duration;
+
+  async function runClient() {
+    let ops = 0;
+    while (Date.now() < endTime) {
+      await new Promise((resolve) => {
+        const client = net.createConnection(pipePath, () => {
+          let count = 0;
+          const maxMsgs = 50;
+
+          function sendNext() {
+            if (count >= maxMsgs || Date.now() >= endTime) {
+              client.end();
+              return;
+            }
+            const msg = {
+              id: count,
+              method: ['eval', 'complete', 'lint', 'format'][count % 4],
+              params: { file: `src/file${count}.ts`, line: count * 2 },
+            };
+            client.write(JSON.stringify(msg));
+            count++;
+            ops++;
+          }
+
+          client.on('data', () => sendNext());
+          sendNext();
+        });
+
+        client.on('end', resolve);
+        client.on('error', () => resolve());
+        client.setTimeout(2000, () => {
+          client.destroy();
+          resolve();
+        });
+      });
+    }
+    return ops;
+  }
+
+  const clients = Array.from({ length: 4 }, () => runClient());
+  const results = await Promise.all(clients);
+  totalOps = results.reduce((a, b) => a + b, 0);
+
+  server.close();
+  // Cleanup socket file on Unix
+  if (process.platform !== 'win32') {
+    try {
+      require('fs').unlinkSync(pipePath);
+    } catch {
+      // best effort
+    }
+  }
+  return totalOps;
+}
+
+// Workload 4: DNS resolution (every HTTP client connection does this)
+async function workloadDNS(iterations) {
+  let ops = 0;
+
+  // Use localhost and standard DNS patterns
+  const hosts = ['localhost', '127.0.0.1', '::1'];
+
+  for (let i = 0; i < iterations; i++) {
+    // dns.lookup (uses OS resolver — libuv thread pool)
+    for (const host of hosts) {
+      try {
+        await new Promise((resolve, reject) => {
+          dns.lookup(host, (err, address) => {
+            if (err) reject(err);
+            else resolve(address);
+          });
+        });
+        ops++;
+      } catch {
+        ops++;
+      }
+    }
+
+    // dns.lookup with options (IPv4/IPv6 preference)
+    try {
+      await new Promise((resolve, reject) => {
+        dns.lookup('localhost', { family: 4 }, (err, address) => {
+          if (err) reject(err);
+          else resolve(address);
+        });
+      });
+      ops++;
+    } catch {
+      ops++;
+    }
+
+    // dns.lookupService (reverse lookup)
+    try {
+      await new Promise((resolve, reject) => {
+        dns.lookupService('127.0.0.1', 80, (err, hostname, service) => {
+          if (err) reject(err);
+          else resolve({ hostname, service });
+        });
+      });
+      ops++;
+    } catch {
+      ops++;
+    }
+
+    // net.isIP / net.isIPv4 / net.isIPv6 (validation in every request)
+    net.isIP('192.168.1.1');
+    net.isIP('::1');
+    net.isIP('not-an-ip');
+    net.isIPv4('192.168.1.1');
+    net.isIPv6('::1');
+    net.isIPv6('fe80::1%eth0');
+    ops += 6;
+  }
+  return ops;
+}
+
+// Workload 5: Socket options and state transitions
+async function workloadSocketOps(duration) {
+  let totalOps = 0;
+
+  const server = net.createServer((socket) => {
+    // Exercise socket properties (common in logging, monitoring)
+    void socket.remoteAddress;
+    void socket.remotePort;
+    void socket.localAddress;
+    void socket.localPort;
+    void socket.bytesRead;
+    void socket.bytesWritten;
+    void socket.readyState;
+
+    socket.setNoDelay(true);
+    socket.setKeepAlive(true, 1000);
+
+    socket.on('data', (data) => {
+      socket.write(data);
+    });
+    socket.on('error', () => {});
+  });
+
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = server.address().port;
+
+  const endTime = Date.now() + duration;
+
+  // Rapid connect/disconnect (connection churn — load balancer pattern)
+  while (Date.now() < endTime) {
+    await new Promise((resolve) => {
+      const client = net.createConnection({ port, host: '127.0.0.1' }, () => {
+        client.setNoDelay(true);
+        client.write('ping');
+      });
+      client.on('data', () => {
+        totalOps++;
+        client.end();
+      });
+      client.on('end', resolve);
+      client.on('error', () => resolve());
+      client.setTimeout(1000, () => {
+        client.destroy();
+        resolve();
+      });
+    });
+  }
+
+  server.close();
+  return totalOps;
+}
+
+async function main() {
+  console.log('[pgo-net] Starting network workload...');
+  const startTime = Date.now();
+  let totalOps = 0;
+
+  const timeBudget = (fraction) => Math.floor(DURATION_MS * fraction);
+
+  // TCP echo (data transfer throughput)
+  console.log('[pgo-net] Running TCP echo...');
+  totalOps += await workloadTCPEcho(timeBudget(0.25));
+
+  // TCP request/response (protocol handling)
+  console.log('[pgo-net] Running TCP request/response...');
+  totalOps += await workloadTCPRequestResponse(timeBudget(0.25));
+
+  // IPC / Named pipes
+  console.log('[pgo-net] Running IPC...');
+  totalOps += await workloadIPC(timeBudget(0.15));
+
+  // DNS resolution
+  console.log('[pgo-net] Running DNS...');
+  totalOps += await workloadDNS(100);
+
+  // Socket operations
+  console.log('[pgo-net] Running socket ops...');
+  totalOps += await workloadSocketOps(timeBudget(0.15));
+
+  const elapsed = (Date.now() - startTime) / 1000;
+  console.log(
+    `[pgo-net] Completed ${totalOps} net operations in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s)`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-net] Error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-run-all.js b/tools/pgo/pgo-run-all.js
new file mode 100644
index 000000000000..b654d2a88bce
--- /dev/null
+++ b/tools/pgo/pgo-run-all.js
@@ -0,0 +1,339 @@
+'use strict';
+
+// PGO Training Orchestrator: Runs All PGO Training Workloads
+//
+// This script orchestrates the execution of all PGO training workloads
+// sequentially. It is designed to be run against a PGO-instrumented
+
+// Node.js build to generate profile data (.profraw files on Clang/Clang-CL,
+// .gcda files on GCC).
+//
+// Usage:
+//   node tools/pgo/pgo-run-all.js [--duration=<seconds>] [--scripts=<comma-separated>]
+//
+// Options:
+//   --duration=<seconds>   Duration per script in seconds (default: 15)
+//   --scripts=<list>       Comma-separated list of scripts to run (default: all)
+//                          e.g. --scripts=http-server,json,crypto
+//   --sequential           Run scripts one at a time (default, safest for PGO)
+//   --verbose              Show detailed output from each script
+//
+// The scripts are ordered by their importance to real-world Node.js usage:
+// 1. HTTP Server      (~60% of Node.js usage is web servers)
+// 2. JSON Processing  (every REST API request/response)
+// 3. Crypto/TLS       (every HTTPS connection)
+// 4. Streams/Buffers  (all I/O goes through these)
+// 5. File System      (config loading, static serving, build tools)
+// 6. Async Patterns   (Promise/async-await is the concurrency model)
+// 7. URL/String       (URL parsing in every request, string ops everywhere)
+// 8. Compression      (HTTP response compression)
+// 9. Net/DNS          (underlying TCP/DNS for all networking)
+// 10. Module Loading  (startup, require() resolution)
+// 11. Child/Workers   (build tools, process managers)
+
+const { fork } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+
+const SCRIPT_DIR = __dirname;
+
+// Training scripts in order of real-world importance
+const ALL_SCRIPTS = [
+  {
+    name: 'http-server',
+    file: 'pgo-http-server.js',
+    desc: 'HTTP server with JSON APIs, static content, routing',
+  },
+  {
+    name: 'json',
+    file: 'pgo-json.js',
+    desc: 'JSON parse/stringify with realistic payloads',
+  },
+  {
+    name: 'crypto',
+    file: 'pgo-crypto.js',
+    desc: 'Hashing, HMAC, AES-GCM, RSA/ECDSA, random, PBKDF2',
+  },
+  {
+    name: 'streams-buffers',
+    file: 'pgo-streams-buffers.js',
+    desc: 'Buffer creation/encoding, stream pipes, transforms',
+  },
+  {
+    name: 'fs',
+    file: 'pgo-fs.js',
+    desc: 'File read/write, stat, readdir, streams, path ops',
+  },
+  {
+    name: 'async-patterns',
+    file: 'pgo-async-patterns.js',
+    desc: 'Promises, EventEmitter, timers, AbortController, ALS',
+  },
+  {
+    name: 'url-string',
+    file: 'pgo-url-string.js',
+    desc: 'URL parsing, regex, string ops, TextEncoder, util',
+  },
+  {
+    name: 'compression',
+    file: 'pgo-compression.js',
+    desc: 'Gzip, deflate, brotli compress/decompress',
+  },
+  {
+    name: 'net',
+    file: 'pgo-net.js',
+    desc: 'TCP server/client, IPC, DNS resolution',
+  },
+  {
+    name: 'module-loading',
+    file: 'pgo-module-loading.js',
+    desc: 'CJS require, ESM import, VM compilation',
+  },
+  {
+    name: 'child-workers',
+    file: 'pgo-child-workers.js',
+    desc: 'Worker thread messaging, SharedArrayBuffer, inline eval',
+  },
+];
+
+function parseArgs() {
+  const args = {
+    duration: 15,
+    scripts: null,
+    verbose: false,
+  };
+
+  for (const arg of process.argv.slice(2)) {
+    if (arg.startsWith('--duration=')) {
+      args.duration = parseInt(arg.split('=')[1], 10);
+    } else if (arg.startsWith('--scripts=')) {
+      args.scripts = arg
+        .split('=')[1]
+        .split(',')
+        .map((s) => s.trim());
+    } else if (arg === '--verbose') {
+      args.verbose = true;
+    } else if (arg === '--help' || arg === '-h') {
+      console.log(`
+PGO Training Orchestrator for Node.js
+
+Usage: node tools/pgo/pgo-run-all.js [options]
+
+Options:
+  --duration=<seconds>   Duration per script (default: 15)
+  --scripts=<list>       Comma-separated script names (default: all)
+  --verbose              Show script output
+  --help                 Show this help
+
+Available scripts:
+${ALL_SCRIPTS.map((s) => `  ${s.name.padEnd(20)} ${s.desc}`).join('\n')}
+
+Example:
+  node tools/pgo/pgo-run-all.js --duration=20 --verbose
+  node tools/pgo/pgo-run-all.js --scripts=http-server,json,crypto --duration=30
+`);
+      process.exit(0);
+    }
+  }
+
+  return args;
+}
+
+function runScript(scriptPath, duration, verbose) {
+  return new Promise((resolve) => {
+    const env = {
+      ...process.env,
+      PGO_TRAINING_DURATION: String(duration * 1000),
+    };
+    const child = fork(scriptPath, [], {
+      stdio: verbose ? 'inherit' : ['ignore', 'pipe', 'pipe', 'ipc'],
+      env,
+    });
+
+    let output = '';
+    if (!verbose && child.stdout) {
+      child.stdout.on('data', (data) => {
+        output += data.toString();
+      });
+    }
+    if (!verbose && child.stderr) {
+      child.stderr.on('data', (data) => {
+        output += data.toString();
+      });
+    }
+
+    // Safety timeout: kill if script runs too long
+    const timeout = setTimeout(
+      () => {
+        console.log('    [TIMEOUT] Killing script...');
+        child.kill('SIGTERM');
+        setTimeout(() => child.kill('SIGKILL'), 5000);
+      },
+      (duration + 30) * 1000,
+    );
+
+    child.on('exit', (code) => {
+      clearTimeout(timeout);
+      if (code !== 0 && code !== null) {
+        // Extract last line of output for summary
+        const lastLine = output.trim().split('\n').pop() || '';
+        console.log(`    [WARNING] Exited with code ${code}: ${lastLine}`);
+      }
+      resolve({ code, output });
+    });
+
+    child.on('error', (err) => {
+      clearTimeout(timeout);
+      console.log(`    [ERROR] ${err.message}`);
+      resolve({ code: -1, output: err.message });
+    });
+  });
+}
+
+async function main() {
+  const args = parseArgs();
+
+  // Select scripts
+  let scripts = ALL_SCRIPTS;
+  if (args.scripts) {
+    scripts = args.scripts.map((name) => {
+      const found = ALL_SCRIPTS.find((s) => s.name === name);
+      if (!found) {
+        console.error(`Unknown script: ${name}`);
+        console.error(
+          `Available: ${ALL_SCRIPTS.map((s) => s.name).join(', ')}`,
+        );
+        process.exit(1);
+      }
+      return found;
+    });
+  }
+
+  const totalTime = scripts.length * args.duration;
+
+  console.log(
+    '╔══════════════════════════════════════════════════════════════╗',
+  );
+  console.log('║          Node.js PGO Training Workload Runner              ║');
+  console.log(
+    '╠══════════════════════════════════════════════════════════════╣',
+  );
+  console.log(`║  Scripts:  ${String(scripts.length).padEnd(48)}║`);
+  console.log(
+    `║  Duration: ${String(args.duration + 's per script').padEnd(48)}║`,
+  );
+  console.log(`║  Total:    ~${String(totalTime + 's estimated').padEnd(47)}║`);
+  console.log(`║  Node:     ${process.version.padEnd(48)}║`);
+  console.log(
+    `║  Arch:     ${(process.arch + ' / ' + process.platform).padEnd(48)}║`,
+  );
+  console.log(
+    '╚══════════════════════════════════════════════════════════════╝',
+  );
+  console.log('');
+
+  const startTime = Date.now();
+  const results = [];
+
+  for (let i = 0; i < scripts.length; i++) {
+    const script = scripts[i];
+    const scriptPath = path.join(SCRIPT_DIR, script.file);
+    const num = `[${i + 1}/${scripts.length}]`;
+
+    console.log(`${num} Running: ${script.name}`);
+    console.log(`    ${script.desc}`);
+
+    const scriptStart = Date.now();
+    const result = await runScript(scriptPath, args.duration, args.verbose);
+    const elapsed = ((Date.now() - scriptStart) / 1000).toFixed(1);
+
+    const status = result.code === 0 ? 'OK' : `FAIL(${result.code})`;
+    console.log(`    Completed in ${elapsed}s [${status}]`);
+
+    // Extract ops/s from output if available
+    if (!args.verbose && result.output) {
+      const match = result.output.match(/(\d+) ops\/s|(\d+) req\/s/);
+      if (match) {
+        console.log(`    Throughput: ${match[0]}`);
+      }
+    }
+    console.log('');
+
+    results.push({
+      name: script.name,
+      elapsed: parseFloat(elapsed),
+      code: result.code,
+    });
+  }
+
+  const totalElapsed = ((Date.now() - startTime) / 1000).toFixed(1);
+  const passed = results.filter((r) => r.code === 0).length;
+  const failed = results.filter((r) => r.code !== 0).length;
+
+  console.log(
+    '════════════════════════════════════════════════════════════════',
+  );
+  console.log(`PGO Training Complete: ${totalElapsed}s total`);
+  console.log(
+    `  ${passed} passed, ${failed} failed out of ${results.length} scripts`,
+  );
+
+  if (failed > 0) {
+    console.log(
+      `  Failed: ${results
+        .filter((r) => r.code !== 0)
+        .map((r) => r.name)
+        .join(', ')}`,
+    );
+  }
+
+  // Scan for .profraw files to verify profile data was collected
+  const profrawDir = process.env.LLVM_PROFILE_FILE ?
+    path.dirname(process.env.LLVM_PROFILE_FILE.replace(/%[mp]/g, '_')) :
+    process.cwd();
+  let profrawFiles = [];
+  try {
+    profrawFiles = fs
+      .readdirSync(profrawDir)
+      .filter((f) => f.endsWith('.profraw'));
+  } catch {
+    // Directory may not exist if LLVM_PROFILE_FILE points elsewhere
+  }
+
+  console.log('');
+  if (profrawFiles.length > 0) {
+    let totalSize = 0;
+    for (const f of profrawFiles) {
+      try {
+        totalSize += fs.statSync(path.join(profrawDir, f)).size;
+      } catch {
+        // Ignore stat errors
+      }
+    }
+    const sizeMB = (totalSize / (1024 * 1024)).toFixed(1);
+    console.log(
+      `Profile data: ${profrawFiles.length} .profraw file(s), ${sizeMB} MB total`,
+    );
+    console.log(`  Location: ${profrawDir}`);
+  } else {
+    console.log('WARNING: No .profraw files found in ' + profrawDir);
+    console.log(
+      '  Ensure LLVM_PROFILE_FILE is set and the binary was built with -fprofile-generate',
+    );
+  }
+
+  console.log('');
+  console.log(
+    'Profile data should now be available for PGO-optimized rebuild.',
+  );
+  console.log(
+    '════════════════════════════════════════════════════════════════',
+  );
+
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+main().catch((err) => {
+  console.error('PGO Orchestrator error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-streams-buffers.js b/tools/pgo/pgo-streams-buffers.js
new file mode 100644
index 000000000000..6eb970fd97bf
--- /dev/null
+++ b/tools/pgo/pgo-streams-buffers.js
@@ -0,0 +1,579 @@
+'use strict';
+
+/* eslint-disable no-void */
+
+// PGO Training Script: Streams and Buffers
+//
+// Buffers and Streams are the backbone of all I/O in Node.js.
+// This script exercises:
+// - Buffer creation (from, alloc, allocUnsafe — most frequent allocations)
+// - Buffer encoding conversion (utf8, base64, hex, latin1 — every HTTP body)
+// - Buffer copy, slice, concat, compare, indexOf (data processing)
+// - Readable streams (HTTP request bodies, file reads)
+// - Writable streams (HTTP responses, file writes)
+// - Transform streams (compression, encryption, data pipelines)
+// - Pipe chains (the core streaming pattern)
+// - Object mode streams (ORMs, data processing libraries)
+// - Async iteration over streams (modern pattern)
+//
+// This exercises: Buffer C++ implementation, stream state machine,
+// back-pressure handling, highWaterMark management, GC pressure.
+
+const { Readable, Writable, Transform, PassThrough } = require('stream');
+const { pipeline: pipelinePromise } = require('stream/promises');
+const { Buffer } = require('buffer');
+const crypto = require('crypto');
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+
+// ============== BUFFER WORKLOADS ==============
+
+// Workload 1: Buffer creation (the most frequent allocation in Node.js)
+function workloadBufferCreation(iterations) {
+  let ops = 0;
+  const str =
+    'Hello, World! This is a test string for buffer creation benchmarks.';
+  const arr = Array.from({ length: 64 }, (_, i) => i);
+  const uint8 = new Uint8Array(64);
+  const ab = new ArrayBuffer(64);
+
+  for (let i = 0; i < iterations; i++) {
+    // Buffer.from string (most common — every HTTP body, every JSON parse input)
+    Buffer.from(str);
+    Buffer.from(str, 'utf8');
+    Buffer.from(str, 'ascii');
+    Buffer.from(str, 'latin1');
+    ops += 4;
+
+    // Buffer.from with various source types
+    Buffer.from(arr);
+    Buffer.from(uint8);
+    Buffer.from(ab);
+    Buffer.from(Buffer.alloc(64));
+    ops += 4;
+
+    // Buffer.alloc (zeroed — safe allocation)
+    Buffer.alloc(16);
+    Buffer.alloc(256);
+    Buffer.alloc(4096);
+    Buffer.alloc(64, 0xff);
+    ops += 4;
+
+    // Buffer.allocUnsafe (fast allocation — used in hot paths)
+    Buffer.allocUnsafe(16);
+    Buffer.allocUnsafe(256);
+    Buffer.allocUnsafe(4096);
+    Buffer.allocUnsafe(65536);
+    ops += 4;
+
+    // Buffer.concat (building response bodies)
+    const chunks = [
+      Buffer.from('chunk1'),
+      Buffer.from('chunk2'),
+      Buffer.from('chunk3'),
+    ];
+    Buffer.concat(chunks);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 2: Buffer encoding/decoding (every HTTP interaction)
+function workloadBufferEncoding(iterations) {
+  let ops = 0;
+  const testData = crypto.randomBytes(1024);
+  const testString =
+    'The quick brown fox jumps over the lazy dog. 日本語テスト 🎉';
+  const base64Data = testData.toString('base64');
+  const hexData = testData.toString('hex');
+  const base64urlData = testData.toString('base64url');
+
+  for (let i = 0; i < iterations; i++) {
+    // UTF-8 encode/decode (dominant encoding for web)
+    const utf8Buf = Buffer.from(testString, 'utf8');
+    utf8Buf.toString('utf8');
+    ops += 2;
+
+    // Base64 encode/decode (binary data in JSON, data URIs, email attachments)
+    testData.toString('base64');
+    Buffer.from(base64Data, 'base64');
+    ops += 2;
+
+    // Base64url (JWT tokens)
+    testData.toString('base64url');
+    Buffer.from(base64urlData, 'base64url');
+    ops += 2;
+
+    // Hex encode/decode (crypto hashes, color codes, debugging)
+    testData.toString('hex');
+    Buffer.from(hexData, 'hex');
+    ops += 2;
+
+    // ASCII/Latin1 (HTTP headers, protocol parsing)
+    Buffer.from(
+      'HTTP/1.1 200 OK\r\nContent-Type: application/json\r\n\r\n',
+      'ascii',
+    );
+    Buffer.from('Set-Cookie: session=abc123; Path=/; HttpOnly', 'latin1');
+    ops += 2;
+
+    // Buffer.byteLength (Content-Length header computation)
+    Buffer.byteLength(testString, 'utf8');
+    Buffer.byteLength(base64Data, 'base64');
+    Buffer.byteLength('simple ascii text');
+    ops += 3;
+  }
+  return ops;
+}
+
+// Workload 3: Buffer operations (data processing patterns)
+function workloadBufferOps(iterations) {
+  let ops = 0;
+  const buf1 = crypto.randomBytes(1024);
+  const buf2 = crypto.randomBytes(1024);
+  const needle = Buffer.from('test');
+
+  for (let i = 0; i < iterations; i++) {
+    // Buffer.compare (sorting, binary search)
+    Buffer.compare(buf1, buf2);
+    buf1.compare(buf2, 0, 100, 0, 100);
+    ops += 2;
+
+    // Buffer.equals
+    buf1.equals(buf2);
+    buf1.equals(buf1);
+    ops += 2;
+
+    // slice/subarray (zero-copy views — extremely common)
+    buf1.subarray(0, 256);
+    buf1.subarray(256, 512);
+    buf1.subarray(512);
+    ops += 3;
+
+    // copy (building protocol messages)
+    const dest = Buffer.allocUnsafe(2048);
+    buf1.copy(dest, 0);
+    buf2.copy(dest, 1024);
+    ops += 2;
+
+    // indexOf / includes (searching in binary data, parsers)
+    buf1.indexOf(needle);
+    buf1.includes(65); // ASCII 'A'
+    buf1.lastIndexOf(0);
+    ops += 3;
+
+    // fill (clearing sensitive data, initializing)
+    const fillBuf = Buffer.allocUnsafe(256);
+    fillBuf.fill(0);
+    fillBuf.fill('abc');
+    ops += 2;
+
+    // Read/write numeric values (protocol parsing, binary formats)
+    buf1.readUInt32BE(0);
+    buf1.readUInt32LE(0);
+    buf1.readInt16BE(4);
+    buf1.readFloatLE(8);
+    buf1.readDoubleBE(16);
+    dest.writeUInt32BE(i, 0);
+    dest.writeInt16LE(i % 32768, 4);
+    dest.writeFloatLE(i * 1.5, 8);
+    ops += 8;
+
+    // swap (endianness conversion)
+    const swapBuf = Buffer.from(buf1.subarray(0, 64));
+    swapBuf.swap16();
+    swapBuf.swap32();
+    ops += 2;
+  }
+  return ops;
+}
+
+// ============== STREAM WORKLOADS ==============
+
+// Workload 4: Readable → Writable pipe (canonical throughput pattern)
+async function workloadPipeChain(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    const chunkCount = 1000;
+    const chunkSize = 1024;
+
+    await new Promise((resolve) => {
+      let pushed = 0;
+      const source = new Readable({
+        read() {
+          if (pushed >= chunkCount) {
+            this.push(null);
+            return;
+          }
+          this.push(crypto.randomBytes(chunkSize));
+          pushed++;
+        },
+      });
+
+      const sink = new Writable({
+        write(chunk, encoding, callback) {
+          callback();
+        },
+      });
+
+      sink.on('finish', () => {
+        ops += chunkCount;
+        resolve();
+      });
+      source.pipe(sink);
+    });
+  }
+  return ops;
+}
+
+// Workload 5: Transform streams (compression/encryption pattern)
+async function workloadTransform(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    await new Promise((resolve) => {
+      let pushed = 0;
+      const chunkCount = 500;
+      const source = new Readable({
+        read() {
+          if (pushed >= chunkCount) {
+            this.push(null);
+            return;
+          }
+          this.push(
+            Buffer.from(
+              `{"id":${pushed},"data":"${crypto.randomBytes(32).toString('hex')}"}\n`,
+            ),
+          );
+          pushed++;
+        },
+      });
+
+      // Transform: parse JSON line by line (NDJSON processing pattern)
+      const transformer = new Transform({
+        transform(chunk, encoding, callback) {
+          const lines = chunk.toString().split('\n').filter(Boolean);
+          for (const line of lines) {
+            try {
+              const obj = JSON.parse(line);
+              obj.processed = true;
+              obj.timestamp = Date.now();
+              this.push(JSON.stringify(obj) + '\n');
+            } catch {
+              /* skip invalid */
+            }
+          }
+          callback();
+        },
+      });
+
+      const sink = new Writable({
+        write(chunk, encoding, callback) {
+          callback();
+        },
+      });
+
+      sink.on('finish', () => {
+        ops += chunkCount;
+        resolve();
+      });
+      source.pipe(transformer).pipe(sink);
+    });
+  }
+  return ops;
+}
+
+// Workload 6: Object mode streams (database query result processing)
+async function workloadObjectMode(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    await new Promise((resolve) => {
+      let pushed = 0;
+      const objCount = 200;
+
+      const source = new Readable({
+        objectMode: true,
+        read() {
+          if (pushed >= objCount) {
+            this.push(null);
+            return;
+          }
+          this.push({
+            id: pushed,
+            name: `Record ${pushed}`,
+            value: Math.random() * 1000,
+            tags: ['tag1', 'tag2'],
+            metadata: { created: Date.now(), source: 'db' },
+          });
+          pushed++;
+        },
+      });
+
+      // Transform: filter + map (like a database cursor)
+      const filter = new Transform({
+        objectMode: true,
+        transform(obj, encoding, callback) {
+          if (obj.value > 100) {
+            callback(null, {
+              ...obj,
+              value: Math.round(obj.value * 100) / 100,
+              qualified: true,
+            });
+          } else {
+            callback();
+          }
+        },
+      });
+
+      const results = [];
+      const collect = new Writable({
+        objectMode: true,
+        write(obj, encoding, callback) {
+          results.push(obj);
+          callback();
+        },
+      });
+
+      collect.on('finish', () => {
+        ops += objCount;
+        resolve();
+      });
+      source.pipe(filter).pipe(collect);
+    });
+  }
+  return ops;
+}
+
+// Workload 7: Async iteration over streams (modern Node.js pattern)
+async function workloadAsyncIteration(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    let pushed = 0;
+    const chunkCount = 500;
+
+    const source = new Readable({
+      read() {
+        if (pushed >= chunkCount) {
+          this.push(null);
+          return;
+        }
+        this.push(
+          Buffer.from(
+            `Line ${pushed}: ${crypto.randomBytes(20).toString('hex')}\n`,
+          ),
+        );
+        pushed++;
+      },
+    });
+
+    let lines = 0;
+    for await (const chunk of source) {
+      lines += chunk.toString().split('\n').filter(Boolean).length;
+    }
+    ops += lines;
+  }
+  return ops;
+}
+
+// Workload 8: pipeline() with error handling (production pattern)
+async function workloadPipeline(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    let pushed = 0;
+    const chunkCount = 300;
+
+    const source = new Readable({
+      read() {
+        if (pushed >= chunkCount) {
+          this.push(null);
+          return;
+        }
+        this.push(crypto.randomBytes(512));
+        pushed++;
+      },
+    });
+
+    const uppercase = new Transform({
+      transform(chunk, encoding, callback) {
+        callback(null, chunk.toString('hex').toUpperCase());
+      },
+    });
+
+    let bytes = 0;
+    const sink = new Writable({
+      write(chunk, encoding, callback) {
+        bytes += chunk.length;
+        callback();
+      },
+    });
+
+    await pipelinePromise(source, uppercase, sink);
+    ops += chunkCount;
+    void bytes;
+  }
+  return ops;
+}
+
+// Workload 9: PassThrough / Duplex (proxy patterns, tee)
+async function workloadPassThrough(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    let pushed = 0;
+    const chunkCount = 200;
+
+    const source = new Readable({
+      read() {
+        if (pushed >= chunkCount) {
+          this.push(null);
+          return;
+        }
+        this.push(crypto.randomBytes(256));
+        pushed++;
+      },
+    });
+
+    // Tee pattern: split stream to two destinations
+    const pt1 = new PassThrough();
+    const pt2 = new PassThrough();
+
+    let bytes1 = 0;
+    let bytes2 = 0;
+    const sink1 = new Writable({
+      write(chunk, encoding, callback) {
+        bytes1 += chunk.length;
+        callback();
+      },
+    });
+    const sink2 = new Writable({
+      write(chunk, encoding, callback) {
+        bytes2 += chunk.length;
+        callback();
+      },
+    });
+
+    source.pipe(pt1).pipe(sink1);
+    source.pipe(pt2).pipe(sink2);
+
+    await Promise.all([
+      new Promise((r) => sink1.on('finish', r)),
+      new Promise((r) => sink2.on('finish', r)),
+    ]);
+    ops += chunkCount * 2;
+    void bytes1;
+    void bytes2;
+  }
+  return ops;
+}
+
+// Workload 10: Readable.from() with generators (modern data source pattern)
+async function workloadReadableFrom(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // From array
+    const arr = Array.from({ length: 100 }, (_, j) => `item-${j}\n`);
+    const stream1 = Readable.from(arr);
+    let data1 = '';
+    for await (const chunk of stream1) {
+      data1 += chunk;
+    }
+    ops += 100;
+    void data1;
+
+    // From async generator (database cursor simulation)
+    async function* generateRows() {
+      for (let j = 0; j < 100; j++) {
+        yield JSON.stringify({ row: j, value: Math.random() }) + '\n';
+      }
+    }
+
+    const stream2 = Readable.from(generateRows());
+    let data2 = '';
+    for await (const chunk of stream2) {
+      data2 += chunk;
+    }
+    ops += 100;
+    void data2;
+  }
+  return ops;
+}
+
+async function main() {
+  console.log('[pgo-streams-buffers] Starting streams & buffers workload...');
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  while (remaining() > 0) {
+    round++;
+    const scale = Math.max(0.1, remaining() / DURATION_MS);
+    const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+    // Buffer workloads (sync, fast — exercise C++ bindings extensively)
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running buffer creation...');
+    totalOps += workloadBufferCreation(iterScale(2000));
+    if (remaining() <= 0) break;
+
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running buffer encoding...');
+    totalOps += workloadBufferEncoding(iterScale(1000));
+    if (remaining() <= 0) break;
+
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running buffer operations...');
+    totalOps += workloadBufferOps(iterScale(1000));
+    if (remaining() <= 0) break;
+
+    // Stream workloads (async, exercise event loop + back-pressure)
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running pipe chains...');
+    totalOps += await workloadPipeChain(iterScale(5));
+    if (remaining() <= 0) break;
+
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running transform streams...');
+    totalOps += await workloadTransform(iterScale(5));
+    if (remaining() <= 0) break;
+
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running object mode streams...');
+    totalOps += await workloadObjectMode(iterScale(10));
+    if (remaining() <= 0) break;
+
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running async iteration...');
+    totalOps += await workloadAsyncIteration(iterScale(5));
+    if (remaining() <= 0) break;
+
+    if (round === 1) console.log('[pgo-streams-buffers] Running pipeline()...');
+    totalOps += await workloadPipeline(iterScale(5));
+    if (remaining() <= 0) break;
+
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running PassThrough...');
+    totalOps += await workloadPassThrough(iterScale(5));
+    if (remaining() <= 0) break;
+
+    if (round === 1)
+      console.log('[pgo-streams-buffers] Running Readable.from()...');
+    totalOps += await workloadReadableFrom(iterScale(10));
+  }
+
+  const elapsed = (Date.now() - startTime) / 1000;
+  console.log(
+    `[pgo-streams-buffers] Completed ${totalOps} ops in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-streams-buffers] Error:', err);
+  process.exit(1);
+});
diff --git a/tools/pgo/pgo-url-string.js b/tools/pgo/pgo-url-string.js
new file mode 100644
index 000000000000..87fb22060894
--- /dev/null
+++ b/tools/pgo/pgo-url-string.js
@@ -0,0 +1,566 @@
+'use strict';
+
+/* eslint-disable no-void */
+
+// PGO Training Script: URL Parsing and String Operations
+//
+// URL parsing and string manipulation are pervasive in Node.js web apps:
+// - WHATWG URL parsing (every HTTP request in modern code)
+// - Legacy url.parse (still heavily used in existing codebases)
+// - URLSearchParams (query string handling in every API)
+// - Regex matching (routing, validation, sanitization)
+// - String operations (template rendering, concatenation, encoding)
+// - TextEncoder/TextDecoder (Web API string encoding)
+// - querystring module (legacy but still widely used)
+// - util.format, util.inspect (logging, debugging)
+//
+// This exercises: V8 string internals (one-byte/two-byte, cons, sliced),
+// Ada URL parser (C++), regex JIT, TextEncoder/Decoder C++ implementation.
+
+const url = require('url');
+const { URL, URLSearchParams } = url;
+const querystring = require('querystring');
+const util = require('util');
+const { TextEncoder, TextDecoder } = util;
+
+const DURATION_MS = parseInt(process.env.PGO_TRAINING_DURATION, 10) || 15_000;
+
+// Realistic URLs from web applications
+const TEST_URLS = [
+  'https://api.example.com/v2/users?page=1&limit=50&sort=name&order=asc',
+  'https://www.example.com/products/category/electronics?brand=apple&min_price=100&max_price=2000&in_stock=true',
+  'http://localhost:3000/api/auth/login',
+  'https://cdn.example.com/assets/images/hero-banner-2024.webp?w=1920&h=1080&q=85',
+  'https://user:pass@db.example.com:5432/myapp?ssl=true&pool=10',
+  'wss://realtime.example.com/ws/v1?token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0',
+  'https://example.com/path/to/resource#section-2',
+  'https://search.example.com/q?query=node.js+performance+optimization&lang=en&safe=on',
+  'https://api.example.com/v3/organizations/org-123/projects/proj-456/deployments/deploy-789/logs?since=2024-01-01T00:00:00Z&until=2024-12-31T23:59:59Z&level=error',
+  'https://example.com/path%20with%20spaces/file%23name.html?key=value%26more',
+  'https://xn--nxasmq6b.example.com/internationalized', // IDN
+  'file:///C:/Users/user/Documents/project/index.html',
+  'https://api.github.com/repos/nodejs/node/commits?sha=main&per_page=30',
+  'https://registry.npmjs.org/@types/node/-/node-20.10.0.tgz',
+  'http://[::1]:8080/ipv6-local',
+  'data:text/html;base64,PGh0bWw+PC9odG1sPg==',
+];
+
+// Workload 1: WHATWG URL parsing (modern standard — every HTTP request)
+function workloadWHATWGURL(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    for (const urlStr of TEST_URLS) {
+      try {
+        const parsed = new URL(urlStr);
+
+        // Access all properties (common in routing/logging)
+        void parsed.href;
+        void parsed.origin;
+        void parsed.protocol;
+        void parsed.hostname;
+        void parsed.port;
+        void parsed.pathname;
+        void parsed.search;
+        void parsed.hash;
+        void parsed.username;
+        void parsed.password;
+        ops++;
+
+        // Modify URL (redirect, base URL construction)
+        const modified = new URL(urlStr);
+        modified.pathname = '/new-path';
+        modified.searchParams.set('modified', 'true');
+        modified.toString();
+        ops++;
+
+        // URL.canParse (validation)
+        URL.canParse(urlStr);
+        URL.canParse('not-a-url');
+        ops++;
+      } catch {
+        ops++;
+      }
+    }
+  }
+  return ops;
+}
+
+// Workload 2: URLSearchParams (query string handling)
+function workloadURLSearchParams(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    // Create from string
+    const params1 = new URLSearchParams(
+      'page=1&limit=50&sort=name&order=asc&fields=id,name,email',
+    );
+    params1.get('page');
+    params1.get('limit');
+    params1.getAll('fields');
+    params1.has('sort');
+    ops++;
+
+    // Create from object (common API pattern)
+    const params2 = new URLSearchParams({
+      q: 'node.js performance',
+      lang: 'en',
+      page: '1',
+      format: 'json',
+    });
+    params2.toString();
+    ops++;
+
+    // Create from entries (Map-like)
+    const params3 = new URLSearchParams([
+      ['key1', 'value1'],
+      ['key2', 'value2'],
+      ['key1', 'value3'],
+    ]);
+    params3.getAll('key1');
+    ops++;
+
+    // Iterate (common for logging, forwarding)
+    for (const entry of params1) {
+      void entry;
+    }
+    ops++;
+
+    // Modify (adding/removing filters in API clients)
+    params1.set('page', '2');
+    params1.append('filter', 'active');
+    params1.append('filter', 'verified');
+    params1.delete('order');
+    params1.sort();
+    params1.toString();
+    ops++;
+
+    // Complex real-world query strings
+    const complexQuery = new URLSearchParams(
+      'filters[status]=active&filters[role][]=admin&filters[role][]=editor&' +
+        'sort=-createdAt&fields=id,name,email,role&page[number]=1&page[size]=25&' +
+        'include=profile,permissions&meta=true',
+    );
+    for (const entry of complexQuery) {
+      void entry;
+    }
+    complexQuery.toString();
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 3: Legacy url.parse (still very common in existing code)
+function workloadLegacyURL(iterations) {
+  let ops = 0;
+
+  for (let i = 0; i < iterations; i++) {
+    for (const urlStr of TEST_URLS) {
+      try {
+        // url.parse (Express's req.url handling)
+        const parsed = url.parse(urlStr, true); // true = parse query string
+        void parsed.pathname;
+        void parsed.query;
+        void parsed.hostname;
+        void parsed.protocol;
+        ops++;
+
+        // url.format (building URLs)
+        url.format({
+          protocol: 'https',
+          hostname: 'api.example.com',
+          pathname: `/v2/users/${i}`,
+          query: { fields: 'id,name', format: 'json' },
+        });
+        ops++;
+
+        // url.resolve (relative URL resolution)
+        url.resolve('https://example.com/base/', './relative/path');
+        url.resolve('https://example.com/base/path', '../other/path');
+        ops++;
+      } catch {
+        ops++;
+      }
+    }
+  }
+  return ops;
+}
+
+// Workload 4: querystring module (legacy but still heavily used)
+function workloadQuerystring(iterations) {
+  let ops = 0;
+
+  const testQueries = [
+    'name=John+Doe&age=30&city=New+York',
+    'key1=val1&key2=val2&key3=val3&key4=val4&key5=val5',
+    'q=search+term&page=1&per_page=20&sort=relevance',
+    'data=%7B%22key%22%3A%22value%22%7D',
+    'tags=node&tags=javascript&tags=performance',
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    for (const qs of testQueries) {
+      // Parse
+      const parsed = querystring.parse(qs);
+      ops++;
+
+      // Stringify
+      querystring.stringify(parsed);
+      ops++;
+    }
+
+    // Encode/decode
+    querystring.escape('Hello World! <>&"');
+    querystring.unescape('Hello%20World%21%20%3C%3E%26%22');
+    ops += 2;
+
+    // Stringify with custom separator (some APIs use ; instead of &)
+    querystring.stringify({ a: 1, b: 2, c: 3 }, ';', ':');
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 5: String operations (templating, manipulation)
+function workloadStringOps(iterations) {
+  let ops = 0;
+
+  const template = 'Hello, {{name}}! You have {{count}} new {{type}} messages.';
+  const strings = [
+    'the quick brown fox jumps over the lazy dog',
+    'UPPERCASE STRING TO CONVERT',
+    '  whitespace  string  with  extra  spaces  ',
+    'CamelCaseString_with_mixed_SEPARATORS-and-dashes',
+    'path/to/some/file.extension.backup.2024',
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    // Template replacement (Mustache/Handlebars-like pattern)
+    template.replace(/\{\{(\w+)\}\}/g, (match, key) => {
+      const values = { name: 'User', count: '5', type: 'unread' };
+      return values[key] || match;
+    });
+    ops++;
+
+    for (const str of strings) {
+      // Case conversion (header normalization, camelCase conversion)
+      str.toLowerCase();
+      str.toUpperCase();
+      ops += 2;
+
+      // Trim (input sanitization)
+      str.trim();
+      str.trimStart();
+      str.trimEnd();
+      ops += 3;
+
+      // Split/join (CSV processing, path parsing)
+      str.split(/[\s_-]+/).join(' ');
+      str.split('.').join('/');
+      ops += 2;
+
+      // Include/startsWith/endsWith (routing, MIME detection)
+      str.includes('fox');
+      str.startsWith('the');
+      str.endsWith('dog');
+      str.indexOf('the');
+      str.lastIndexOf('the');
+      ops += 5;
+
+      // Slice/substring (truncation, preview generation)
+      str.slice(0, 20);
+      str.substring(5, 15);
+      ops += 2;
+
+      // Replace (sanitization, normalization)
+      str.replace(/[^a-zA-Z0-9]/g, '_');
+      str.replaceAll(' ', '-');
+      ops += 2;
+
+      // padStart/padEnd (formatting)
+      String(i).padStart(6, '0');
+      str.slice(0, 10).padEnd(20, '.');
+      ops += 2;
+
+      // Repeat (indentation generation)
+      '  '.repeat(Math.min(i % 10, 5));
+      ops++;
+    }
+
+    // String concatenation patterns
+    let result = '';
+    for (let j = 0; j < 100; j++) {
+      result += `item_${j},`;
+    }
+    ops++;
+    void result;
+
+    // Template literal (most common string building pattern)
+    const items = Array.from(
+      { length: 20 },
+      (_, j) => `  "${j}": "value_${j}"`,
+    );
+    const json = `{\n${items.join(',\n')}\n}`;
+    ops++;
+    void json;
+
+    // String.fromCharCode / codePointAt (encoding)
+    for (let j = 32; j < 127; j++) {
+      String.fromCharCode(j);
+    }
+    'Hello! 日本語'.codePointAt(0);
+    ops++;
+  }
+  return ops;
+}
+
+// Workload 6: Regular expressions (routing, validation, parsing)
+function workloadRegex(iterations) {
+  let ops = 0;
+
+  // Pre-compiled regexes (real-world patterns)
+  const emailRe = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+  const uuidRe =
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  const ipv4Re = /^(\d{1,3}\.){3}\d{1,3}$/;
+  const routeRe =
+    /^\/api\/v(\d+)\/(users|products|orders)(?:\/([a-zA-Z0-9_-]+))?$/;
+  const htmlTagRe = /<([a-z]+)([^>]*)>(.*?)<\/\1>/gi;
+  const semverRe =
+    /^v?(\d+)\.(\d+)\.(\d+)(?:-([a-zA-Z0-9.]+))?(?:\+([a-zA-Z0-9.]+))?$/;
+  const dateRe = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z?)?$/;
+  const csvRe = /(?:^|,)("(?:[^"]*(?:""[^"]*)*)"|[^,]*)/g;
+
+  const testStrings = {
+    emails: ['test@example.com', 'invalid@', 'user+tag@domain.co.uk', 'nope'],
+    uuids: [
+      '550e8400-e29b-41d4-a716-446655440000',
+      'not-a-uuid',
+      '550E8400-E29B-41D4-A716-446655440000',
+    ],
+    ips: ['192.168.1.1', '10.0.0.0', '999.999.999.999', 'not.an.ip'],
+    routes: [
+      '/api/v2/users',
+      '/api/v1/products/abc-123',
+      '/api/v3/orders/',
+      '/other/path',
+    ],
+    html: [
+      '<div class="container">Hello</div>',
+      '<p>Text</p>',
+      '<span id="x">Content</span>',
+    ],
+    semver: ['v1.2.3', '2.0.0-beta.1', '1.0.0+build.123', '1.2', 'not-semver'],
+    dates: [
+      '2024-01-15',
+      '2024-01-15T10:30:00Z',
+      '2024-01-15T10:30:00.123Z',
+      'not-a-date',
+    ],
+    csv: [
+      '"John","Doe",30',
+      '"Jane ""J"" Doe","Smith",25',
+      'simple,values,here',
+    ],
+  };
+
+  for (let i = 0; i < iterations; i++) {
+    // Email validation (form submission, user registration)
+    for (const email of testStrings.emails) {
+      emailRe.test(email);
+      ops++;
+    }
+
+    // UUID validation (API parameters)
+    for (const uuid of testStrings.uuids) {
+      uuidRe.test(uuid);
+      ops++;
+    }
+
+    // IP validation (rate limiting, geo-blocking)
+    for (const ip of testStrings.ips) {
+      ipv4Re.test(ip);
+      ops++;
+    }
+
+    // Route matching (URL routing in Express/Fastify)
+    for (const route of testStrings.routes) {
+      const match = routeRe.exec(route);
+      if (match) {
+        void match[1];
+        void match[2];
+        void match[3];
+      }
+      ops++;
+    }
+
+    // HTML tag parsing (template engines, sanitization)
+    for (const html of testStrings.html) {
+      html.replace(htmlTagRe, (match, tag, attrs, content) => content);
+      ops++;
+    }
+
+    // Semver parsing (package resolution)
+    for (const ver of testStrings.semver) {
+      semverRe.test(ver);
+      ops++;
+    }
+
+    // Date validation (API input)
+    for (const date of testStrings.dates) {
+      dateRe.test(date);
+      ops++;
+    }
+
+    // CSV parsing (data import)
+    for (const csv of testStrings.csv) {
+      void [...csv.matchAll(csvRe)];
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 7: TextEncoder/TextDecoder (Web API compatibility)
+function workloadTextEncoding(iterations) {
+  let ops = 0;
+  const encoder = new TextEncoder();
+  const decoder = new TextDecoder('utf-8');
+  const testStrings = [
+    'Hello, World!',
+    'The quick brown fox jumps over the lazy dog',
+    '日本語テスト Unicode text with émojis 🎉',
+    'A'.repeat(1000),
+    Array.from({ length: 100 }, (_, i) => `line ${i}`).join('\n'),
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    for (const str of testStrings) {
+      // Encode (string → Uint8Array)
+      const encoded = encoder.encode(str);
+      ops++;
+
+      // Decode (Uint8Array → string)
+      decoder.decode(encoded);
+      ops++;
+
+      // encodeInto (reuse buffer — more efficient)
+      const dest = new Uint8Array(str.length * 3);
+      encoder.encodeInto(str, dest);
+      ops++;
+    }
+  }
+  return ops;
+}
+
+// Workload 8: util.format and util.inspect (logging — extremely common)
+function workloadUtilFormat(iterations) {
+  let ops = 0;
+
+  const testObjects = [
+    { simple: 'object', count: 42 },
+    { nested: { deep: { value: [1, 2, 3] } }, fn: () => {} },
+    new Map([['key', 'value']]),
+    new Set([1, 2, 3]),
+    new Error('test error'),
+    Buffer.from('test'),
+    /regex/gi,
+    new Date(),
+  ];
+
+  for (let i = 0; i < iterations; i++) {
+    // util.format (console.log uses this internally)
+    util.format('Request %s %s completed in %dms', 'GET', '/api/users', 42.5);
+    util.format('User %j logged in', { id: 1, name: 'test' });
+    util.format('Values: %o %O', { a: 1 }, { b: 2 });
+    ops += 3;
+
+    // util.inspect (debug output, REPL)
+    for (const obj of testObjects) {
+      util.inspect(obj, { depth: 3, colors: false, maxArrayLength: 10 });
+      ops++;
+    }
+
+    // util.types (type checking)
+    util.types.isDate(new Date());
+    util.types.isRegExp(/test/);
+    util.types.isSet(new Set());
+    util.types.isMap(new Map());
+    util.types.isPromise(Promise.resolve());
+    ops += 5;
+
+    // util.deprecate (module system pattern)
+    util.deprecate(() => {}, 'Use newAPI instead');
+    ops++;
+  }
+  return ops;
+}
+
+async function main() {
+  console.log('[pgo-url-string] Starting URL & string workload...');
+  const startTime = Date.now();
+  let totalOps = 0;
+  let round = 0;
+
+  const remaining = () => DURATION_MS - (Date.now() - startTime);
+
+  while (remaining() > 0) {
+    round++;
+    const scale = Math.max(0.1, remaining() / DURATION_MS);
+    const iterScale = (base) => Math.max(1, Math.floor(base * scale));
+
+    // WHATWG URL (highest priority — modern web standard)
+    if (round === 1)
+      console.log('[pgo-url-string] Running WHATWG URL parsing...');
+    totalOps += workloadWHATWGURL(iterScale(300));
+    if (remaining() <= 0) break;
+
+    // URLSearchParams
+    if (round === 1) console.log('[pgo-url-string] Running URLSearchParams...');
+    totalOps += workloadURLSearchParams(iterScale(500));
+    if (remaining() <= 0) break;
+
+    // Legacy URL
+    if (round === 1)
+      console.log('[pgo-url-string] Running legacy url.parse...');
+    totalOps += workloadLegacyURL(iterScale(200));
+    if (remaining() <= 0) break;
+
+    // Querystring
+    if (round === 1) console.log('[pgo-url-string] Running querystring...');
+    totalOps += workloadQuerystring(iterScale(500));
+    if (remaining() <= 0) break;
+
+    // String operations
+    if (round === 1)
+      console.log('[pgo-url-string] Running string operations...');
+    totalOps += workloadStringOps(iterScale(300));
+    if (remaining() <= 0) break;
+
+    // Regex
+    if (round === 1) console.log('[pgo-url-string] Running regex patterns...');
+    totalOps += workloadRegex(iterScale(500));
+    if (remaining() <= 0) break;
+
+    // TextEncoder/Decoder
+    if (round === 1)
+      console.log('[pgo-url-string] Running TextEncoder/Decoder...');
+    totalOps += workloadTextEncoding(iterScale(500));
+    if (remaining() <= 0) break;
+
+    // util.format/inspect
+    if (round === 1)
+      console.log('[pgo-url-string] Running util.format/inspect...');
+    totalOps += workloadUtilFormat(iterScale(200));
+  }
+
+  const elapsed = (Date.now() - startTime) / 1000;
+  console.log(
+    `[pgo-url-string] Completed ${totalOps} ops in ${elapsed.toFixed(1)}s (${(totalOps / elapsed).toFixed(0)} ops/s) [${round} rounds]`,
+  );
+}
+
+main().catch((err) => {
+  console.error('[pgo-url-string] Error:', err);
+  process.exit(1);
+});

From 03692786efcb77f6f6f1a40155f52e1a1c4f8513 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Thu, 20 Aug 2026 16:19:31 +0200
Subject: [PATCH 249/344] build: add simdutf dir to include path in GN build

The GN build defaults `node_simdutf_path` to `//third_party/simdutf`,
the copy that ships in a Chromium checkout. That target doesn't put
its own directory on the include path, so the unqualified
`#include "simdutf.h"` in libnode, node_js2c and node_cctest doesn't
resolve unless the embedder adds the directory themselves.

Add `get_label_info(node_simdutf_path, "dir")` to `node_internal_config`
(used by libnode and node_cctest) and to node_js2c's `include_dirs`.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65382
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 unofficial.gni | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/unofficial.gni b/unofficial.gni
index 2d9b13774a77..16bf46acb0f8 100644
--- a/unofficial.gni
+++ b/unofficial.gni
@@ -81,6 +81,7 @@ template("node_gn_build") {
       "src/inspector:*",
     ]
     configs = [ ":node_external_config" ]
+    include_dirs = [ get_label_info(node_simdutf_path, "dir") ]
     libs = []
     cflags = [ "-Wno-microsoft-include" ]
     cflags_cc = [
@@ -337,7 +338,10 @@ template("node_gn_build") {
       "src/builtin_info.cc",
       "src/builtin_info.h",
     ]
-    include_dirs = [ "src" ]
+    include_dirs = [
+      "src",
+      get_label_info(node_simdutf_path, "dir"),
+    ]
   }
 
   action("run_node_js2c") {

From ec956f2abc560bf0f72fb12933eba3b2257c336c Mon Sep 17 00:00:00 2001
From: Marten Richter <marten.richter@tu-berlin.de>
Date: Sun, 26 Jul 2026 22:13:37 +0200
Subject: [PATCH 250/344] quic: write desired size needs update on maxstream

Without this update the streams can stall, if the
chunks are close or bigger than the window size.

Signed-off-by: Marten Richter <marten.richter@freenet.de>
PR-URL: https://github.com/nodejs/node/pull/64768
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/quic/application.cc                       |  1 +
 src/quic/http3.cc                             |  1 +
 ...-maxstreamdata-external-buffer-failure.mjs | 80 +++++++++++++++++++
 ...-maxstreamdata-external-buffer-failure.mjs | 75 +++++++++++++++++
 4 files changed, 157 insertions(+)
 create mode 100644 test/parallel/test-quic-h3-maxstreamdata-external-buffer-failure.mjs
 create mode 100644 test/parallel/test-quic-maxstreamdata-external-buffer-failure.mjs

diff --git a/src/quic/application.cc b/src/quic/application.cc
index 79a3263b8537..6062f9d08483 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -431,6 +431,7 @@ class DefaultApplication final : public Session::Application {
     // The peer granted more flow control for this stream. Re-schedule
     // it so SendPendingData will resume writing.
     DCHECK_NOT_NULL(stream);
+    stream->UpdateWriteDesiredSize();  // the stream might be blocked on js side
     stream->Schedule(&stream_queue_);
   }
 
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index 2cf4e2d6fdd1..08aac7cdc6c4 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -377,6 +377,7 @@ class Http3ApplicationImpl final : public Session::Application {
     Debug(&session(),
           "HTTP/3 application extending max stream data to %" PRIu64,
           max_data);
+    stream->UpdateWriteDesiredSize();  // the stream might be blocked on js side
     nghttp3_conn_unblock_stream(*this, stream->id());
   }
 
diff --git a/test/parallel/test-quic-h3-maxstreamdata-external-buffer-failure.mjs b/test/parallel/test-quic-h3-maxstreamdata-external-buffer-failure.mjs
new file mode 100644
index 000000000000..df74e4db408b
--- /dev/null
+++ b/test/parallel/test-quic-h3-maxstreamdata-external-buffer-failure.mjs
@@ -0,0 +1,80 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: Quic maxstreamdata updates on http/3
+// Client sends a body that precisely fills the window size,
+// and verifies that it is data transfer is not stalled.
+
+import { hasQuic, skip } from '../common/index.mjs';
+import { readFile } from 'node:fs/promises';
+import { setTimeout as sleep } from 'node:timers/promises';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { drainableProtocol } = await import('stream/iter');
+
+const keys = 'test/fixtures/keys';
+const key = createPrivateKey(await readFile(`${keys}/agent1-key.pem`));
+const cert = await readFile(`${keys}/agent1-cert.pem`);
+
+const WINDOW = 4096;
+// Fills the window exactly: HTTP/3 spends 11 of those bytes on framing (8 for
+// the HEADERS frame below, 3 for the DATA frame header). The send buffer then
+// empties at the same moment the window reaches zero, leaving nothing in
+// flight to ack. Any other size leaves bytes queued, and the ack for those
+// wakes the writer instead, hiding the bug.
+const BODY = WINDOW - 11;
+
+let letServerRead;
+const serverMayRead = new Promise((resolve) => { letServerRead = resolve; });
+
+const endpoint = await listen((session) => {
+  session.onstream = async (stream) => {
+    await serverMayRead;
+    // eslint-disable-next-line no-unused-vars
+    for await (const _ of stream) { /* reading extends the window */ }
+  };
+}, {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  transportParams: {
+    initialMaxStreamDataBidiRemote: WINDOW,
+    initialMaxData: 1024 * 1024,
+  },
+  onheaders() { this.sendHeaders({ ':status': '200' }); },
+});
+
+const session = await connect(endpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+await session.opened;
+
+// Budget well above the window, so the window is what stops the writer.
+const stream = await session.createBidirectionalStream({ budget: 1024 * 1024 });
+stream.sendHeaders({
+  ':method': 'POST',
+  ':path': '/',
+  ':scheme': 'https',
+  ':authority': 'localhost',
+}, { terminal: false });
+
+const writer = stream.writer;
+writer.writeSync(new Uint8Array(BODY));
+
+// Long enough for every byte to be acked. The peer acks as data arrives,
+// whether or not its application has read any of it, so by now the window is
+// exhausted, the send buffer is empty, and no further ACK can arrive.
+await sleep(500);
+
+const watchdog = setTimeout(() => {
+  console.error('STALLED: no drain after MAX_STREAM_DATA');
+  process.exit(1);
+}, 5000);
+
+letServerRead();                 // Extend the window, with no ack attached
+await writer[drainableProtocol]();
+
+clearTimeout(watchdog);
+process.exit(0);
diff --git a/test/parallel/test-quic-maxstreamdata-external-buffer-failure.mjs b/test/parallel/test-quic-maxstreamdata-external-buffer-failure.mjs
new file mode 100644
index 000000000000..79d11e05794a
--- /dev/null
+++ b/test/parallel/test-quic-maxstreamdata-external-buffer-failure.mjs
@@ -0,0 +1,75 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: Quic maxstreamdata updates on pure quic
+// Client sends a body that precisely fills the window size,
+// and verifies that it is data transfer is not stalled.
+
+import { hasQuic, skip } from '../common/index.mjs';
+import { readFile } from 'node:fs/promises';
+import { setTimeout as sleep } from 'node:timers/promises';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { drainableProtocol } = await import('stream/iter');
+
+const keys = 'test/fixtures/keys';
+const key = createPrivateKey(await readFile(`${keys}/agent1-key.pem`));
+const cert = await readFile(`${keys}/agent1-cert.pem`);
+
+const WINDOW = 4096;
+// Fills the window exactly: HTTP/3 spends 11 of those bytes on framing (8 for
+// the HEADERS frame below, 3 for the DATA frame header). The send buffer then
+// empties at the same moment the window reaches zero, leaving nothing in
+// flight to ack. Any other size leaves bytes queued, and the ack for those
+// wakes the writer instead, hiding the bug.
+const BODY = WINDOW;
+
+let letServerRead;
+const serverMayRead = new Promise((resolve) => { letServerRead = resolve; });
+
+const endpoint = await listen((session) => {
+  session.onstream = async (stream) => {
+    await serverMayRead;
+    // eslint-disable-next-line no-unused-vars
+    for await (const _ of stream) { /* reading extends the window */ }
+  };
+}, {
+  alpn: 'foo',
+  sni: { '*': { keys: [key], certs: [cert] } },
+  transportParams: {
+    initialMaxStreamDataBidiRemote: WINDOW,
+    initialMaxData: 1024 * 1024,
+  }
+});
+
+const session = await connect(endpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+  alpn: 'foo'
+});
+await session.opened;
+
+// Budget well above the window, so the window is what stops the writer.
+const stream = await session.createBidirectionalStream({ budget: 1024 * 1024 });
+
+const writer = stream.writer;
+writer.writeSync(new Uint8Array(BODY));
+
+// Long enough for every byte to be acked. The peer acks as data arrives,
+// whether or not its application has read any of it, so by now the window is
+// exhausted, the send buffer is empty, and no further ACK can arrive.
+await sleep(500);
+
+const watchdog = setTimeout(() => {
+  console.error('STALLED: no drain after MAX_STREAM_DATA');
+  process.exit(1);
+}, 5000);
+
+letServerRead();                 // Extend the window, with no ack attached
+await writer[drainableProtocol]();
+
+clearTimeout(watchdog);
+process.exit(0);

From 41edd2f214070cdc40393184c26ade136867d79c Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 20 Aug 2026 21:15:56 +0200
Subject: [PATCH 251/344] tools: make env variables consistent in cron jobs

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65168
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 .github/workflows/auto-start-ci.yml |  14 ++-
 .github/workflows/commit-queue.yml  |  16 +--
 doc/contributing/commit-queue.md    | 166 ++--------------------------
 tools/actions/commit-queue.sh       |  26 ++---
 tools/actions/start-ci.sh           |   9 +-
 5 files changed, 36 insertions(+), 195 deletions(-)

diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 34488eeed6d7..0a69ff636f25 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -1,3 +1,6 @@
+# This action uses the following secrets:
+#   JENKINS_USER: GitHub user whose Jenkins token is defined below
+#   JENKINS_TOKEN: Jenkins token, to be used to start CI
 name: Auto Start CI
 
 on:
@@ -36,11 +39,13 @@ jobs:
                   -t '{{ range . }}{{ .number }} {{ end }}' \
                   --limit 5)" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   start-ci:
     permissions:
+      checks: read
       contents: read
       pull-requests: write
+      statuses: read
     needs: get-prs-for-ci
     if: needs.get-prs-for-ci.outputs.numbers != ''
     runs-on: ubuntu-slim
@@ -59,10 +64,10 @@ jobs:
           ncu-config set token "$GH_TOKEN"
           ncu-config set jenkins_token "$JENKINS_TOKEN"
           ncu-config set owner "$GITHUB_REPOSITORY_OWNER"
-          ncu-config set repo "$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)"
+          ncu-config set repo "${GITHUB_REPOSITORY#*/}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
       - name: Start the CI
@@ -70,5 +75,4 @@ jobs:
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
           | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index dff69b18564b..a1d691e9e19f 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -52,7 +52,7 @@ jobs:
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   commitQueue:
     needs: get_candidate_prs
     if: needs.get_candidate_prs.outputs.candidates != ''
@@ -63,18 +63,14 @@ jobs:
       statuses: read
     runs-on: ubuntu-slim
     steps:
-      # Install dependencies
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+
       - name: Install @node-core/utils
         run: npm install -g @node-core/utils
 
-      - name: Set variables
-        run: |
-          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
-
       - name: Configure @node-core/utils
         run: |
           # Keep the config outside the workspace so checkout does not remove it.
@@ -83,7 +79,7 @@ jobs:
           ncu-config --global set username "$USERNAME"
           ncu-config --global set token "$GH_TOKEN"
           ncu-config --global set jenkins_token "$JENKINS_TOKEN"
-          ncu-config --global set repo "${REPOSITORY}"
+          ncu-config --global set repo "${GITHUB_REPOSITORY#*/}"
           ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
@@ -102,8 +98,6 @@ jobs:
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
             output="${RUNNER_TEMP}/metadata-${pr}.txt"
             if git node metadata "$pr" \
-                    --owner "$GITHUB_REPOSITORY_OWNER" \
-                    --repo "$REPOSITORY" \
                     --readme "$readme" \
                     --json > "$metadata" 2> "$output"; then
               metadata_status=0
@@ -171,7 +165,9 @@ jobs:
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''
         run: |
+          git config --local user.email "github-bot@iojs.org"
+          git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
+          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
diff --git a/doc/contributing/commit-queue.md b/doc/contributing/commit-queue.md
index 6aa73f126390..e9669bf33183 100644
--- a/doc/contributing/commit-queue.md
+++ b/doc/contributing/commit-queue.md
@@ -11,174 +11,24 @@ blocked on a deferrable condition, currently wait time, the queue leaves the
 label in place and retries later. Other failures continue to the existing
 landing and failure-reporting path.
 
-This document gives an overview of how the Commit Queue works, as well as
-implementation details, reasoning for design choices, and current limitations.
-
-## Overview
-
-From a high-level, the Commit Queue works as follows:
-
-1. Collaborators will add `commit-queue` label to pull requests they want the
-   queue to land. The label can be added before the pull request has completed
-   its wait time. Required approvals must already be in place, and any required
-   CI must have completed successfully. The commit queue does not request CI on
-   its own.
-2. On each scheduled run, the queue builds a candidate list from open pull
-   requests with the `commit-queue` label and without the `blocked` label. A
-   candidate must also either have been created at least two days earlier or
-   have the `fast-track` label. Other labeled pull requests retain the label
-   until they become old enough or are fast-tracked. The workflow uses a
-   five-minute cron, but GitHub Actions scheduled workflows are not guaranteed
-   to run exactly every five minutes. For each candidate, the queue will:
-   1. In the landing job, install and configure `@node-core/utils`, then run a
-      metadata-only readiness check without checking out the repository
-   2. If the metadata check exits with a deferrable readiness code, meaning
-      the PR is only blocked on wait time, keep the `commit-queue` label and
-      skip this PR until a later queue run
-   3. Run `git node land` for ready PRs and PRs with hard or mixed readiness
-      failures, keeping the `commit-queue` label in place during the attempt
-   4. If it fails:
-      1. Replace the `commit-queue` label with the `commit-queue-failed` label
-      2. Leave a comment on the PR with the output from `git node land`
-      3. Abort the `git node land` session. If the abort succeeds, continue to
-         the next PR; otherwise, stop the queue in an unknown state
-   5. If it succeeds:
-      1. Push or merge the changes into nodejs/node
-      2. Leave a comment on the PR with `Landed in ...`
-      3. Close the PR
-      4. Remove the `commit-queue` label
-      5. Go to next PR in the queue
-
 To make the Commit Queue squash all the commits of a pull request into the
 first one, add the `commit-queue-squash` label.
 To make the Commit Queue land a pull request containing several commits, add the
 `commit-queue-rebase` label. When using this option, make sure
 that all commits are self-contained, meaning every commit should pass all tests.
 
+The implementation is in `commit-queue.yml` and `commit-queue.sh`.
+
 ## Current limitations
 
-The Commit Queue feature is still in early stages, and as such it might not
-work for more complex pull requests. These are the currently known limitations
-of the commit queue:
+These are the currently known limitations of the commit queue:
 
 1. All commits in a pull request must either be following commit message
    guidelines or be a valid [`fixup!`](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---fixupamendrewordltcommitgt)
    commit that will be correctly handled by the [`--autosquash`](https://git-scm.com/docs/git-rebase#Documentation/git-rebase.txt---autosquash)
-   option
-2. A CI must have run and succeeded since the last change on the PR
-3. A collaborator must have approved the PR since the last change
-4. Only Jenkins CI and GitHub Actions are checked (V8 CI and CITGM are ignored)
+   option.
+2. A CI must have run and succeeded since the last change on the PR.
+3. A collaborator must have approved the PR since the last change.
+4. Only Jenkins CI and GitHub Actions are checked (V8 CI and CITGM are ignored).
 5. The PR must target the `main` branch (PRs opened against other branches, such
-   as backport PRs, are ignored)
-
-## Implementation
-
-The [action](../../.github/workflows/commit-queue.yml) runs on scheduled events.
-It uses a five-minute cron because that is the smallest interval accepted by
-GitHub Actions. Scheduled workflows are not guaranteed to run exactly at that
-cadence and might take longer between runs.
-
-The workflow also uses a concurrency group so only one commit queue run can be
-active at a time. If a scheduled run starts while a previous run is still
-running, GitHub Actions keeps at most one pending run for the same concurrency
-group. A newer pending run replaces an older pending run.
-
-Using the scheduler is preferable over using pull\_request\_target for two
-reasons:
-
-1. if two Commit Queue Actions execution overlap, there's a high-risk that
-   the last one to finish will fail because the local branch will be out of
-   sync with the remote after the first Action pushes. `issue_comment` event
-   has the same limitation.
-2. `pull_request_target` will only run if the Action exists on the base commit
-   of a pull request, and it will run the Action version present on that
-   commit, meaning we wouldn't be able to use it for already opened PRs
-   without rebasing them first.
-
-The workflow starts with a small candidate job that uses GitHub CLI to fetch
-open pull requests with the `commit-queue` label and without the `blocked`
-label. It fetches two buckets: pull requests created at least two days earlier
-and pull requests with the `fast-track` label. The job de-duplicates the
-buckets before passing the candidates to the landing job. Pull requests in
-neither bucket remain labeled but are not processed during that run.
-
-If there are candidate PRs, the landing job installs and configures
-`@node-core/utils` once with a personal token and a Jenkins token from
-[@nodejs-github-bot](https://github.com/nodejs/github-bot). It then downloads
-the workflow commit's README without checking out the repository and runs
-`git node metadata --readme --json` for each candidate. This uses the same
-`@node-core/utils` PR readiness checks as `git node land`, but does not clone,
-fetch, or merge the PR. The filter consumes the structured metadata result
-and its exit code instead of matching human-readable output:
-
-* exit code `0`: the PR is ready and is passed to
-  [`commit-queue.sh`](../../tools/actions/commit-queue.sh)
-* exit codes `20`-`29`: the PR is not ready for a deferrable metadata reason,
-  currently wait time, so it keeps the `commit-queue` label and is retried
-  later
-* exit codes `40`-`49`: the PR has a hard or mixed metadata readiness failure
-  and is passed to [`commit-queue.sh`](../../tools/actions/commit-queue.sh)
-
-The `20`-`29` exit code range is reserved by `@node-core/utils` for deferrable
-metadata readiness states, and `40`-`49` is reserved for hard metadata failure
-states. Unknown filter failures fail the workflow before starting the landing
-script and leave PR labels unchanged so the queue can retry on a later
-scheduled run. PRs passed through with exit code `40`-`49` continue through
-`commit-queue.sh`. The workflow checks out the repository only when at least
-one PR remains after filtering. The script does not separately skip PRs with a
-`request-ci` label or pending GitHub checks. Instead, `git node land` performs
-the landing checks and the script reports any failure through the normal queue
-failure path.
-
-> The personal token needs permission for public repositories and to read
-> profiles. It is used by `@node-core/utils` and by the landing job for
-> checkout, label and comment updates, merging, and pushing. Jenkins token is
-> required to check CI status.
-
-`commit-queue.sh` receives the following positional arguments:
-
-1. The repository owner
-2. The repository name
-3. Every positional argument starting at this one will be a pull request ID of
-   a pull request with commit-queue set.
-
-The script iterates over the pull requests. For each PR, it uses GitHub CLI to
-fetch the labels and select the multiple-commit policy, then runs
-`git node land`, forwarding stdout and stderr to a file. It does not perform a
-separate CI preflight; `git node land` performs the current readiness and CI
-validation.
-
-The script keeps the `commit-queue` label in place while `git node land` is
-running. PRs that are only blocked on wait time should have already been
-filtered by the metadata check. A hard or mixed readiness failure is passed
-through so `git node land` can produce the failure output. If the landing
-attempt fails for that or any other reason, the job replaces the
-`commit-queue` label with `commit-queue-failed`, leaves a comment with the
-output, and then aborts the landing session. If the abort fails, the queue
-stops instead of continuing in an unknown state.
-
-Fast-tracked PRs use the metadata check before checkout and the landing script.
-If the fast-track request has not yet received enough collaborator thumbs-up,
-the queue keeps the `commit-queue` label and retries until either the
-fast-track request is approved or the PR becomes landable through the regular
-wait-time rules. The commit queue does not create the fast-track request
-comment; that is handled when the `fast-track` label is added. If that comment
-is missing, the queue reports the failure instead of keeping the PR queued.
-
-If no errors happen during `git node land`, the script either pushes the direct
-rebase landing to `main` or uses GitHub's squash merge API for single-commit and
-fixup landings. It then leaves a `Landed in ...` comment in the PR. GitHub
-closes PRs merged through the merge API automatically; for direct pushes, the
-script closes the PR. The script then removes the `commit-queue` label.
-Iteration continues until all PRs have done the steps above.
-
-## Reverting broken commits
-
-Reverting broken commits is done manually by collaborators, just like when
-commits are landed manually via `git node land`. An easy way to revert is a
-good feature for the project, but is not explicitly required for the Commit
-Queue to work because the Action lands PRs just like collaborators do today. If
-once we start using the Commit Queue we notice that the number of required
-reverts increases drastically, we can pause the queue until a Revert Queue is
-implemented, but until then we can enable the Commit Queue and then work on a
-Revert Queue as a follow-up.
+   as backport PRs, are ignored).
diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index 9828f2d6b3e8..deb2edf7cf2f 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -2,39 +2,31 @@
 
 set -xe
 
-OWNER=$1
-REPOSITORY=$2
-shift 2
-
 UPSTREAM=origin
 DEFAULT_BRANCH=main
 
 COMMIT_QUEUE_LABEL="commit-queue"
 COMMIT_QUEUE_FAILED_LABEL="commit-queue-failed"
 
+cqurl="${GITHUB_SERVER_URL:?}/${GITHUB_REPOSITORY:?}/actions/runs/${GITHUB_RUN_ID:?}"
+
 commit_queue_failed() {
   pr=$1
 
-  gh pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
+  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
 
-  # shellcheck disable=SC2154
-  cqurl="${GITHUB_SERVER_URL}/${OWNER}/${REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
   body="<details><summary>Commit Queue failed</summary><pre>$(sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g' output)</pre><a href='$cqurl'>$cqurl</a></details>"
   echo "$body"
 
-  gh pr comment "$pr" --body "$body"
+  gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "$body"
 
   rm output
 }
 
-# TODO(mmarchini): should this be set with whoever added the label for each PR?
-git config --local user.email "github-bot@iojs.org"
-git config --local user.name "Node.js GitHub Bot"
-
 SHOULD_ABORT=
 
 for pr in "$@"; do
-  gh pr view "$pr" --json labels --jq ".labels" > labels.json
+  gh -R "$GITHUB_REPOSITORY" pr view "$pr" --json labels --jq ".labels" > labels.json
   
   if jq -e 'map(.name) | index("commit-queue-squash")' < labels.json; then
     MULTIPLE_COMMIT_POLICY="--fixupAll"
@@ -87,7 +79,7 @@ for pr in "$@"; do
         --arg body "${commit_body}" \
         --arg head "${commit_head}" \
         '{merge_method:"squash",commit_title:$title,commit_message:$body,sha:$head}' |\
-      gh api -X PUT "repos/${OWNER}/${REPOSITORY}/pulls/${pr}/merge" --input -\
+      gh api -X PUT "repos/${GITHUB_REPOSITORY}/pulls/${pr}/merge" --input -\
         --jq 'if .merged then .sha else halt_error end'
     )"; then
       commit_queue_failed "$pr"
@@ -97,12 +89,12 @@ for pr in "$@"; do
 
   rm output
 
-  gh pr comment "$pr" --body "Landed in $commits"
+  gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "Landed in $commits"
 
-  [ -z "$MULTIPLE_COMMIT_POLICY" ] && gh pr close "$pr"
+  [ -z "$MULTIPLE_COMMIT_POLICY" ] && gh -R "$GITHUB_REPOSITORY" pr close "$pr"
 
   # Delete the commit queue label (but ignore errors, it's no big deal if a closed PR still has the label)
-  gh pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL" || true
+  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL" || true
 done
 
 rm -f labels.json
diff --git a/tools/actions/start-ci.sh b/tools/actions/start-ci.sh
index 4d4fadf958a9..d4d19b92082d 100755
--- a/tools/actions/start-ci.sh
+++ b/tools/actions/start-ci.sh
@@ -4,9 +4,10 @@ set -xe
 
 REQUEST_CI_LABEL="request-ci"
 REQUEST_CI_FAILED_LABEL="request-ci-failed"
+cqurl="${GITHUB_SERVER_URL:?}/${GITHUB_REPOSITORY:?}/actions/runs/${GITHUB_RUN_ID:?}"
 
 for pr in "$@"; do
-  gh pr edit "$pr" --remove-label "$REQUEST_CI_LABEL"
+  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --remove-label "$REQUEST_CI_LABEL"
 
   ci_started=yes
   rm -f output;
@@ -15,14 +16,12 @@ for pr in "$@"; do
 
   if [ "$ci_started" = "no" ]; then
     # Do we need to reset?
-    gh pr edit "$pr" --add-label "$REQUEST_CI_FAILED_LABEL"
+    gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "$REQUEST_CI_FAILED_LABEL"
 
-    # shellcheck disable=SC2154
-    cqurl="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
     body="<details><summary>Failed to start CI</summary><pre>$(cat output)</pre><a href='$cqurl'>$cqurl</a></details>"
     echo "$body"
 
-    gh pr comment "$pr" --body "$body"
+    gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "$body"
 
     rm output
   fi

From 400d598b3ca9937224acf12b16d035ef389e0ade Mon Sep 17 00:00:00 2001
From: mag123c <diehreo@gmail.com>
Date: Fri, 21 Aug 2026 04:16:07 +0900
Subject: [PATCH 252/344] test_runner: add classname hierarchy for JUnit
 reporter

Signed-off-by: mag123c <diehreo@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/60220
Fixes: https://github.com/nodejs/node/issues/59417
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/test_runner/test.js              | 12 ++++++++++
 lib/internal/test_runner/tests_stream.js      |  2 ++
 .../output/junit_classname_hierarchy.js       | 19 +++++++++++++++
 .../output/junit_classname_hierarchy.snapshot | 23 ++++++++++++++++++
 .../output/junit_reporter.snapshot            | 24 +++++++++----------
 test/parallel/test-runner-reporters.js        |  2 +-
 .../test-output-junit-classname-hierarchy.mjs | 12 ++++++++++
 7 files changed, 81 insertions(+), 13 deletions(-)
 create mode 100644 test/fixtures/test-runner/output/junit_classname_hierarchy.js
 create mode 100644 test/fixtures/test-runner/output/junit_classname_hierarchy.snapshot
 create mode 100644 test/test-runner/test-output-junit-classname-hierarchy.mjs

diff --git a/lib/internal/test_runner/test.js b/lib/internal/test_runner/test.js
index a728378182df..34f3dfaae9df 100644
--- a/lib/internal/test_runner/test.js
+++ b/lib/internal/test_runner/test.js
@@ -2,6 +2,7 @@
 const {
   ArrayFrom,
   ArrayPrototypeEvery,
+  ArrayPrototypeJoin,
   ArrayPrototypePush,
   ArrayPrototypePushApply,
   ArrayPrototypeShift,
@@ -1672,6 +1673,17 @@ class Test extends AsyncResource {
       details.passed_on_attempt = this.passedAttempt;
     }
 
+    // Generate classname from suite hierarchy for JUnit reporter
+    if (this.parent && this.parent !== this.root) {
+      const parts = [];
+      for (let t = this.parent; t !== t.root; t = t.parent) {
+        ArrayPrototypeUnshift(parts, t.name);
+      }
+      if (parts.length > 0) {
+        details.classname = ArrayPrototypeJoin(parts, '.');
+      }
+    }
+
     return { __proto__: null, details, directive };
   }
 
diff --git a/lib/internal/test_runner/tests_stream.js b/lib/internal/test_runner/tests_stream.js
index 7fb514fb99e2..f8dd21152eeb 100644
--- a/lib/internal/test_runner/tests_stream.js
+++ b/lib/internal/test_runner/tests_stream.js
@@ -45,6 +45,7 @@ class TestsStream extends Readable {
       parentId,
       details,
       tags: ArrayPrototypeSlice(tags),
+      ...(details.classname && { __proto__: null, classname: details.classname }),
       ...loc,
       ...directive,
     });
@@ -60,6 +61,7 @@ class TestsStream extends Readable {
       parentId,
       details,
       tags: ArrayPrototypeSlice(tags),
+      ...(details.classname && { __proto__: null, classname: details.classname }),
       ...loc,
       ...directive,
     });
diff --git a/test/fixtures/test-runner/output/junit_classname_hierarchy.js b/test/fixtures/test-runner/output/junit_classname_hierarchy.js
new file mode 100644
index 000000000000..8b634be39380
--- /dev/null
+++ b/test/fixtures/test-runner/output/junit_classname_hierarchy.js
@@ -0,0 +1,19 @@
+'use strict';
+require('../../../common');
+const { suite, test } = require('node:test');
+
+suite('Math', () => {
+  suite('Addition', () => {
+    test('adds positive numbers', () => {});
+  });
+
+  suite('Multiplication', () => {
+    test('multiplies positive numbers', () => {});
+  });
+});
+
+suite('String', () => {
+  test('concatenates strings', () => {});
+});
+
+test('standalone test', () => {});
diff --git a/test/fixtures/test-runner/output/junit_classname_hierarchy.snapshot b/test/fixtures/test-runner/output/junit_classname_hierarchy.snapshot
new file mode 100644
index 000000000000..fd3806f531e0
--- /dev/null
+++ b/test/fixtures/test-runner/output/junit_classname_hierarchy.snapshot
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+	<testsuite name="Math" time="*" disabled="0" errors="0" tests="2" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
+		<testsuite name="Addition" time="*" disabled="0" errors="0" tests="1" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
+			<testcase name="adds positive numbers" time="*" classname="Math.Addition" file="*"/>
+		</testsuite>
+		<testsuite name="Multiplication" time="*" disabled="0" errors="0" tests="1" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
+			<testcase name="multiplies positive numbers" time="*" classname="Math.Multiplication" file="*"/>
+		</testsuite>
+	</testsuite>
+	<testsuite name="String" time="*" disabled="0" errors="0" tests="1" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
+		<testcase name="concatenates strings" time="*" classname="String" file="*"/>
+	</testsuite>
+	<testcase name="standalone test" time="*" classname="test" file="*"/>
+	<!-- tests 4 -->
+	<!-- suites 4 -->
+	<!-- pass 4 -->
+	<!-- fail 0 -->
+	<!-- cancelled 0 -->
+	<!-- skipped 0 -->
+	<!-- todo 0 -->
+	<!-- duration_ms * -->
+</testsuites>
diff --git a/test/fixtures/test-runner/output/junit_reporter.snapshot b/test/fixtures/test-runner/output/junit_reporter.snapshot
index cef5f0b52da1..5130996dd2fd 100644
--- a/test/fixtures/test-runner/output/junit_reporter.snapshot
+++ b/test/fixtures/test-runner/output/junit_reporter.snapshot
@@ -129,7 +129,7 @@ true !== false
 	<testcase name="immediate reject - passes but warns" time="*" classname="test" file="*"/>
 	<testcase name="immediate resolve pass" time="*" classname="test" file="*"/>
 	<testsuite name="subtest sync throw fail" time="*" disabled="0" errors="0" tests="1" failures="1" skipped="0" timestamp="*" hostname="HOSTNAME">
-		<testcase name="+sync throw fail" time="*" classname="test" file="*" failure="thrown from subtest sync throw fail">
+		<testcase name="+sync throw fail" time="*" classname="subtest sync throw fail" file="*" failure="thrown from subtest sync throw fail">
 			<failure type="testCodeFailure" message="thrown from subtest sync throw fail">
 Error [ERR_TEST_FAILURE]: thrown from subtest sync throw fail
     at TestContext.&lt;anonymous> (<project-root>/test/fixtures/test-runner/output/output.js:125:11)
@@ -152,15 +152,15 @@ Error [ERR_TEST_FAILURE]: thrown from subtest sync throw fail
 		</failure>
 	</testcase>
 	<testsuite name="level 0a" time="*" disabled="0" errors="0" tests="4" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
-		<testcase name="level 1a" time="*" classname="test" file="*"/>
-		<testcase name="level 1b" time="*" classname="test" file="*"/>
-		<testcase name="level 1c" time="*" classname="test" file="*"/>
-		<testcase name="level 1d" time="*" classname="test" file="*"/>
+		<testcase name="level 1a" time="*" classname="level 0a" file="*"/>
+		<testcase name="level 1b" time="*" classname="level 0a" file="*"/>
+		<testcase name="level 1c" time="*" classname="level 0a" file="*"/>
+		<testcase name="level 1d" time="*" classname="level 0a" file="*"/>
 	</testsuite>
 	<testsuite name="top level" time="*" disabled="0" errors="0" tests="2" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
-		<testcase name="+long running" time="*" classname="test" file="*"/>
+		<testcase name="+long running" time="*" classname="top level" file="*"/>
 		<testsuite name="+short running" time="*" disabled="0" errors="0" tests="1" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
-			<testcase name="++short running" time="*" classname="test" file="*"/>
+			<testcase name="++short running" time="*" classname="top level.+short running" file="*"/>
 		</testsuite>
 	</testsuite>
 	<testcase name="invalid subtest - pass but subtest fails" time="*" classname="test" file="*"/>
@@ -267,9 +267,9 @@ Error [ERR_TEST_FAILURE]: thrown from callback async throw
 	</testcase>
 	<testcase name="callback async throw after done" time="*" classname="test" file="*"/>
 	<testsuite name="only is set on subtests but not in only mode" time="*" disabled="0" errors="0" tests="3" failures="0" skipped="0" timestamp="*" hostname="HOSTNAME">
-		<testcase name="running subtest 1" time="*" classname="test" file="*"/>
-		<testcase name="running subtest 3" time="*" classname="test" file="*"/>
-		<testcase name="running subtest 4" time="*" classname="test" file="*"/>
+		<testcase name="running subtest 1" time="*" classname="only is set on subtests but not in only mode" file="*"/>
+		<testcase name="running subtest 3" time="*" classname="only is set on subtests but not in only mode" file="*"/>
+		<testcase name="running subtest 4" time="*" classname="only is set on subtests but not in only mode" file="*"/>
 	</testsuite>
 	<testcase name="custom inspect symbol fail" time="*" classname="test" file="*" failure="customized">
 		<failure type="testCodeFailure" message="customized">
@@ -289,7 +289,7 @@ Error [ERR_TEST_FAILURE]: thrown from callback async throw
 		</failure>
 	</testcase>
 	<testsuite name="subtest sync throw fails" time="*" disabled="0" errors="0" tests="2" failures="2" skipped="0" timestamp="*" hostname="HOSTNAME">
-		<testcase name="sync throw fails at first" time="*" classname="test" file="*" failure="thrown from subtest sync throw fails at first">
+		<testcase name="sync throw fails at first" time="*" classname="subtest sync throw fails" file="*" failure="thrown from subtest sync throw fails at first">
 			<failure type="testCodeFailure" message="thrown from subtest sync throw fails at first">
 Error [ERR_TEST_FAILURE]: thrown from subtest sync throw fails at first
     at TestContext.&lt;anonymous> (<project-root>/test/fixtures/test-runner/output/output.js:334:11)
@@ -304,7 +304,7 @@ Error [ERR_TEST_FAILURE]: thrown from subtest sync throw fails at first
 }
 			</failure>
 		</testcase>
-		<testcase name="sync throw fails at second" time="*" classname="test" file="*" failure="thrown from subtest sync throw fails at second">
+		<testcase name="sync throw fails at second" time="*" classname="subtest sync throw fails" file="*" failure="thrown from subtest sync throw fails at second">
 			<failure type="testCodeFailure" message="thrown from subtest sync throw fails at second">
 Error [ERR_TEST_FAILURE]: thrown from subtest sync throw fails at second
     at TestContext.&lt;anonymous> (<project-root>/test/fixtures/test-runner/output/output.js:337:11) {
diff --git a/test/parallel/test-runner-reporters.js b/test/parallel/test-runner-reporters.js
index 7fed79d45b48..a2f6316a84fe 100644
--- a/test/parallel/test-runner-reporters.js
+++ b/test/parallel/test-runner-reporters.js
@@ -207,7 +207,7 @@ describe('node:test reporters', { concurrency: true }, () => {
     assert.match(timestamp, /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/);
     assert.ok(!Number.isNaN(Date.parse(timestamp)), `expected a valid date, got ${timestamp}`);
     assert.match(fileContents, /<testcase .*name="failing".*>\s*<failure .*type="testCodeFailure".*message="error".*>/);
-    assert.match(fileContents, /<testcase .*name="ok".*classname="test".*\/>/);
+    assert.match(fileContents, /<testcase .*name="ok".*classname="nested".*\/>/);
     assert.match(fileContents, /<testcase .*name="top level".*classname="test".*\/>/);
   });
 });
diff --git a/test/test-runner/test-output-junit-classname-hierarchy.mjs b/test/test-runner/test-output-junit-classname-hierarchy.mjs
new file mode 100644
index 000000000000..737cefd89eca
--- /dev/null
+++ b/test/test-runner/test-output-junit-classname-hierarchy.mjs
@@ -0,0 +1,12 @@
+// Test that the output of test-runner/output/junit_classname_hierarchy.js matches
+// test-runner/output/junit_classname_hierarchy.snapshot
+import '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+import { spawnAndAssert, junitTransform, ensureCwdIsProjectRoot } from '../common/assertSnapshot.js';
+
+ensureCwdIsProjectRoot();
+await spawnAndAssert(
+  fixtures.path('test-runner/output/junit_classname_hierarchy.js'),
+  junitTransform,
+  { flags: ['--test-reporter=junit'] },
+);

From 3619dc060116b5bc1d7fa32dcdd5325ab2cb706e Mon Sep 17 00:00:00 2001
From: June <kimjune01@gmail.com>
Date: Thu, 20 Aug 2026 16:02:33 -0700
Subject: [PATCH 253/344] lib: fix ERR_INVALID_ARG_TYPE with
 --enable-source-maps

Signed-off-by: June Kim <kimjune01@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63215
Fixes: https://github.com/nodejs/node/issues/63169
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 lib/internal/errors/error_source.js           | 11 ++++++++--
 .../source_map_assert_no_source_map.mjs       |  9 +++++++++
 .../source_map_assert_no_source_map.snapshot  | 20 +++++++++++++++++++
 .../source_map_assert_ok_no_source_map.cjs    | 10 ++++++++++
 ...ource_map_assert_ok_no_source_map.snapshot | 20 +++++++++++++++++++
 test/parallel/test-node-output-sourcemaps.mjs |  2 ++
 6 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 test/fixtures/source-map/output/source_map_assert_no_source_map.mjs
 create mode 100644 test/fixtures/source-map/output/source_map_assert_no_source_map.snapshot
 create mode 100644 test/fixtures/source-map/output/source_map_assert_ok_no_source_map.cjs
 create mode 100644 test/fixtures/source-map/output/source_map_assert_ok_no_source_map.snapshot

diff --git a/lib/internal/errors/error_source.js b/lib/internal/errors/error_source.js
index eddd6af23080..c17f5a151c70 100644
--- a/lib/internal/errors/error_source.js
+++ b/lib/internal/errors/error_source.js
@@ -32,6 +32,10 @@ function getErrorSourceLocation(error) {
     startColumn,
   } = pos;
 
+  if (!sourceLine) {
+    return;
+  }
+
   // Source map is not enabled. Return the source line directly.
   if (!getSourceMapsSupport().enabled) {
     return { sourceLine, startColumn };
@@ -39,7 +43,8 @@ function getErrorSourceLocation(error) {
 
   const sm = findSourceMap(scriptResourceName);
   if (sm === undefined) {
-    return;
+    // No source map for this file; use the generated source line.
+    return { sourceLine, startColumn };
   }
   const {
     originalLine,
@@ -49,7 +54,9 @@ function getErrorSourceLocation(error) {
   const originalSourceLine = getSourceLine(sm, originalSource, originalLine, originalColumn);
 
   if (!originalSourceLine) {
-    return;
+    // Source map exists but original source is unavailable; use the
+    // generated source line rather than returning undefined.
+    return { sourceLine, startColumn };
   }
 
   return {
diff --git a/test/fixtures/source-map/output/source_map_assert_no_source_map.mjs b/test/fixtures/source-map/output/source_map_assert_no_source_map.mjs
new file mode 100644
index 000000000000..34d81d0f249a
--- /dev/null
+++ b/test/fixtures/source-map/output/source_map_assert_no_source_map.mjs
@@ -0,0 +1,9 @@
+// Flags: --enable-source-maps
+
+import '../../../common/index.mjs';
+import { strict as assert } from 'node:assert';
+
+// Regression test for https://github.com/nodejs/node/issues/63169
+// Under --enable-source-maps with no source map for this file, a failing
+// assert(value) must throw AssertionError, not TypeError ERR_INVALID_ARG_TYPE.
+assert(false); // eslint-disable-line no-restricted-syntax
diff --git a/test/fixtures/source-map/output/source_map_assert_no_source_map.snapshot b/test/fixtures/source-map/output/source_map_assert_no_source_map.snapshot
new file mode 100644
index 000000000000..0a2ea1a45fe6
--- /dev/null
+++ b/test/fixtures/source-map/output/source_map_assert_no_source_map.snapshot
@@ -0,0 +1,20 @@
+node:internal/modules/run_main:<line>
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: The expression evaluated to a falsy value:
+
+  assert(false)
+
+    at file://<project-root>/test/fixtures/source-map/output/source_map_assert_no_source_map.mjs:9:1
+    at <node-internal-frames>
+    at <node-internal-frames> {
+  generatedMessage: true,
+  code: 'ERR_ASSERTION',
+  actual: false,
+  expected: true,
+  operator: '==',
+  diff: 'simple'
+}
+
+Node.js <node-version>
diff --git a/test/fixtures/source-map/output/source_map_assert_ok_no_source_map.cjs b/test/fixtures/source-map/output/source_map_assert_ok_no_source_map.cjs
new file mode 100644
index 000000000000..2dd8cbd07b1f
--- /dev/null
+++ b/test/fixtures/source-map/output/source_map_assert_ok_no_source_map.cjs
@@ -0,0 +1,10 @@
+// Flags: --enable-source-maps
+
+'use strict';
+require('../../../common');
+const assert = require('node:assert');
+
+// Regression test for https://github.com/nodejs/node/issues/63169
+// Under --enable-source-maps with no source map for this file, a failing
+// assert.ok(value) must throw AssertionError, not TypeError ERR_INVALID_ARG_TYPE.
+assert.ok(false); // eslint-disable-line no-restricted-syntax
diff --git a/test/fixtures/source-map/output/source_map_assert_ok_no_source_map.snapshot b/test/fixtures/source-map/output/source_map_assert_ok_no_source_map.snapshot
new file mode 100644
index 000000000000..8ee5ff2ee294
--- /dev/null
+++ b/test/fixtures/source-map/output/source_map_assert_ok_no_source_map.snapshot
@@ -0,0 +1,20 @@
+node:internal/assert/utils:<line>
+  throw error;
+  ^
+
+AssertionError [ERR_ASSERTION]: The expression evaluated to a falsy value:
+
+  assert.ok(false)
+
+    at Object.<anonymous> (<project-root>/test/fixtures/source-map/output/source_map_assert_ok_no_source_map.cjs:10:8)
+    at <node-internal-frames>
+    at <node-internal-frames> {
+  generatedMessage: true,
+  code: 'ERR_ASSERTION',
+  actual: false,
+  expected: true,
+  operator: '==',
+  diff: 'simple'
+}
+
+Node.js <node-version>
diff --git a/test/parallel/test-node-output-sourcemaps.mjs b/test/parallel/test-node-output-sourcemaps.mjs
index 26baa0cd53af..c96eac2bd031 100644
--- a/test/parallel/test-node-output-sourcemaps.mjs
+++ b/test/parallel/test-node-output-sourcemaps.mjs
@@ -5,6 +5,8 @@ import { describe, it } from 'node:test';
 
 describe('sourcemaps output', { concurrency: !process.env.TEST_PARALLEL }, () => {
   const tests = [
+    { name: 'source-map/output/source_map_assert_no_source_map.mjs' },
+    { name: 'source-map/output/source_map_assert_ok_no_source_map.cjs' },
     { name: 'source-map/output/source_map_disabled_by_api.js' },
     { name: 'source-map/output/source_map_disabled_by_process_api.js' },
     { name: 'source-map/output/source_map_enabled_by_api.js' },

From 4cb6b1335e79ede24e80478f862ce061ed6527db Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Thu, 20 Aug 2026 19:55:28 -0400
Subject: [PATCH 254/344] deps: update simdjson to 4.6.7

PR-URL: https://github.com/nodejs/node/pull/65318
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 deps/simdjson/simdjson.cpp | 29 ++++++++++++++++++++++++++++-
 deps/simdjson/simdjson.h   |  6 +++---
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/deps/simdjson/simdjson.cpp b/deps/simdjson/simdjson.cpp
index 0d19312880fd..7b8b0c44f057 100644
--- a/deps/simdjson/simdjson.cpp
+++ b/deps/simdjson/simdjson.cpp
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-07-30 16:20:13 -0400. version 4.6.6 Do not edit! */
+/* auto-generated on 2026-08-14 12:14:27 -0400. version 4.6.7 Do not edit! */
 /* including simdjson.cpp:  */
 /* begin file simdjson.cpp */
 #define SIMDJSON_SRC_SIMDJSON_CPP
@@ -15228,6 +15228,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -21620,6 +21623,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -28007,6 +28013,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -34665,6 +34674,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -41885,6 +41897,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -48136,6 +48151,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -54291,6 +54309,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -60865,6 +60886,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
@@ -64733,6 +64757,9 @@ simdjson_warn_unused simdjson_inline error_code tape_builder::visit_number(json_
     const uint8_t *p = value;
     if (*p == '-') p++;
     while (numberparsing::is_digit(*p)) p++;
+    // The digit run must be terminated by a structural or whitespace character; otherwise the
+    // token is malformed (e.g. "123456789123456789123x").
+    if (jsoncharutils::is_not_structural_or_whitespace(*p)) { return NUMBER_ERROR; }
     size_t len = size_t(p - value);
     tape.append(current_string_buf_loc - iter.dom_parser.doc->string_buf.get(), internal::tape_type::BIGINT);
     uint8_t *dst = current_string_buf_loc + sizeof(uint32_t);
diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
index 89175e6d6f70..afcca85ad6bf 100644
--- a/deps/simdjson/simdjson.h
+++ b/deps/simdjson/simdjson.h
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-07-30 16:20:13 -0400. version 4.6.6 Do not edit! */
+/* auto-generated on 2026-08-14 12:14:27 -0400. version 4.6.7 Do not edit! */
 /* including simdjson.h:  */
 /* begin file simdjson.h */
 #ifndef SIMDJSON_H
@@ -2538,7 +2538,7 @@ namespace std {
 #define SIMDJSON_SIMDJSON_VERSION_H
 
 /** The version of simdjson being used (major.minor.revision) */
-#define SIMDJSON_VERSION "4.6.6"
+#define SIMDJSON_VERSION "4.6.7"
 
 namespace simdjson {
 enum {
@@ -2553,7 +2553,7 @@ enum {
   /**
    * The revision (major.minor.REVISION) of simdjson being used.
    */
-  SIMDJSON_VERSION_REVISION = 6
+  SIMDJSON_VERSION_REVISION = 7
 };
 } // namespace simdjson
 

From 5c7c0b8b15113ba03dca29e38c37c8729b20c776 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Thu, 20 Aug 2026 19:55:38 -0400
Subject: [PATCH 255/344] deps: update zlib to 1.3.2.1-motley-8002e91

PR-URL: https://github.com/nodejs/node/pull/65316
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 deps/zlib/google/OWNERS                 |  2 +-
 deps/zlib/google/zip_reader_unittest.cc | 13 ++++---------
 src/zlib_version.h                      |  2 +-
 3 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/deps/zlib/google/OWNERS b/deps/zlib/google/OWNERS
index 1bd83ac482ee..901c226205f8 100644
--- a/deps/zlib/google/OWNERS
+++ b/deps/zlib/google/OWNERS
@@ -1,4 +1,4 @@
-satorux@chromium.org
+satorux@google.com
 
 # compression_utils*
 asvitkine@chromium.org
diff --git a/deps/zlib/google/zip_reader_unittest.cc b/deps/zlib/google/zip_reader_unittest.cc
index 578539ffbf76..6e58f7f72ee8 100644
--- a/deps/zlib/google/zip_reader_unittest.cc
+++ b/deps/zlib/google/zip_reader_unittest.cc
@@ -35,7 +35,6 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
-#include "third_party/icu/source/i18n/unicode/timezone.h"
 #include "third_party/zlib/google/zip_internal.h"
 
 using ::testing::_;
@@ -367,10 +366,8 @@ TEST_F(ZipReaderTest, RegularFile) {
 
   EXPECT_EQ(target_path, entry->path);
   EXPECT_EQ(13527, entry->original_size);
-  EXPECT_EQ("2009-05-29 06:22:20.000",
-            base::UnlocalizedTimeFormatWithPattern(entry->last_modified,
-                                                   "y-MM-dd HH:mm:ss.SSS",
-                                                   icu::TimeZone::getGMT()));
+  EXPECT_EQ("2009-05-29T06:22:20.000Z",
+            base::TimeFormatAsIso8601(entry->last_modified));
   EXPECT_FALSE(entry->is_unsafe);
   EXPECT_FALSE(entry->is_directory);
 }
@@ -467,10 +464,8 @@ TEST_F(ZipReaderTest, Directory) {
   EXPECT_EQ(target_path, entry->path);
   // The directory size should be zero.
   EXPECT_EQ(0, entry->original_size);
-  EXPECT_EQ("2009-05-31 15:49:52.000",
-            base::UnlocalizedTimeFormatWithPattern(entry->last_modified,
-                                                   "y-MM-dd HH:mm:ss.SSS",
-                                                   icu::TimeZone::getGMT()));
+  EXPECT_EQ("2009-05-31T15:49:52.000Z",
+            base::TimeFormatAsIso8601(entry->last_modified));
   EXPECT_FALSE(entry->is_unsafe);
   EXPECT_TRUE(entry->is_directory);
 }
diff --git a/src/zlib_version.h b/src/zlib_version.h
index 302282a2027e..861b339e2bfc 100644
--- a/src/zlib_version.h
+++ b/src/zlib_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.2.1-motley-42c2f19"
+#define ZLIB_VERSION "1.3.2.1-motley-8002e91"
 #endif  // SRC_ZLIB_VERSION_H_

From eb5d66e8561acaadfe37bff7b696175ecf1ed4c8 Mon Sep 17 00:00:00 2001
From: Paul Bouchon <mail@bitpshr.net>
Date: Thu, 20 Aug 2026 19:56:07 -0400
Subject: [PATCH 256/344] module: report unreadable package.json

A package.json that exists but cannot be read was treated the same as
one that is not there: the read failure returned no config and
resolution continued as if the package had none. Fields such as
"exports" and "type" silently disappear, so a specifier can resolve to
a different file than the package declares, while an unparsable
package.json already throws ERR_INVALID_PACKAGE_CONFIG.

Keep treating ENOENT and ENOTDIR as "no package config here", and
report any other read failure with the underlying error.

Fixes: https://github.com/nodejs/node/issues/65220
Signed-off-by: Paul Bouchon <mail@bitpshr.net>
PR-URL: https://github.com/nodejs/node/pull/65223
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 src/node_modules.cc                           | 18 +++++-
 .../test-module-unreadable-package-json.js    | 57 +++++++++++++++++++
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-module-unreadable-package-json.js

diff --git a/src/node_modules.cc b/src/node_modules.cc
index 717d84a4f89a..30780e12aed1 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -111,7 +111,23 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
   PackageConfig package_config{};
   package_config.file_path = path;
   // No need to exclude BOM since simdjson will skip it.
-  if (ReadFileSync(&package_config.raw_json, path.data()) < 0) {
+  int read_error = ReadFileSync(&package_config.raw_json, path.data());
+  if (read_error < 0) {
+    // No file at this path, a path component that is not a directory, or a
+    // "package.json" that is itself a directory all mean there is no package
+    // config here. Any other failure means a package.json is present but
+    // could not be read. Treating that as absent silently drops fields such
+    // as "exports" and "type", which can resolve a specifier to a different
+    // file, so surface the read error instead of continuing.
+    if (read_error != UV_ENOENT && read_error != UV_ENOTDIR &&
+        read_error != UV_EISDIR) {
+      THROW_ERR_INVALID_PACKAGE_CONFIG(realm->isolate(),
+                                       "Cannot read package config %s: %s.",
+                                       path.data(),
+                                       uv_strerror(read_error));
+      return nullptr;
+    }
+
     // Add `nullopt` to the package config cache so that we don't
     // need to open and attempt to read this path again
     binding_data->package_configs_.insert({std::string(path), std::nullopt});
diff --git a/test/parallel/test-module-unreadable-package-json.js b/test/parallel/test-module-unreadable-package-json.js
new file mode 100644
index 000000000000..4261dad85580
--- /dev/null
+++ b/test/parallel/test-module-unreadable-package-json.js
@@ -0,0 +1,57 @@
+'use strict';
+
+// A package.json that exists but cannot be read must not be treated as
+// absent. Doing so silently drops fields such as "exports", which can resolve
+// a specifier to a different file than the one the package declares.
+// Refs: https://github.com/nodejs/node/issues/65220
+
+const common = require('../common');
+
+if (common.isWindows) {
+  common.skip('chmod does not restrict reads on Windows');
+}
+if (process.getuid?.() === 0) {
+  common.skip('cannot make a file unreadable as root');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const depDir = tmpdir.resolve('node_modules/dep');
+fs.mkdirSync(path.join(depDir, 'lib'), { recursive: true });
+const depPackageJson = path.join(depDir, 'package.json');
+fs.writeFileSync(
+  depPackageJson,
+  '{"name":"dep","exports":{".":"./lib/real.js"}}',
+);
+fs.writeFileSync(path.join(depDir, 'lib', 'real.js'), 'export const which = "real";');
+// If the package config is ignored, resolution falls back to this file.
+fs.writeFileSync(path.join(depDir, 'index.js'), 'export const which = "decoy";');
+
+fs.writeFileSync(tmpdir.resolve('package.json'), '{"type":"module"}');
+const entry = tmpdir.resolve('main.mjs');
+fs.writeFileSync(entry, 'import { which } from "dep"; console.log(which);');
+
+// Sanity check: the export resolves while the package config is readable.
+{
+  const child = spawnSync(process.execPath, [entry], { encoding: 'utf8' });
+  assert.strictEqual(child.stdout.trim(), 'real');
+  assert.strictEqual(child.status, 0, child.stderr);
+}
+
+fs.chmodSync(depPackageJson, 0o000);
+
+try {
+  const child = spawnSync(process.execPath, [entry], { encoding: 'utf8' });
+  // The read failure must be reported rather than resolving to index.js.
+  assert.doesNotMatch(child.stdout, /decoy/);
+  assert.match(child.stderr, /Cannot read package config/);
+  assert.notStrictEqual(child.status, 0);
+} finally {
+  fs.chmodSync(depPackageJson, 0o644);
+}

From 109566a2f78e0359745ff0ced1a68c608f4c5993 Mon Sep 17 00:00:00 2001
From: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Date: Fri, 21 Aug 2026 01:56:17 +0200
Subject: [PATCH 257/344] crypto: fix missing error checks on
 ASN1_STRING_to_UTF8()

This function returns a negative error code on error.
When it does so, the `value_str` pointer will remain uninitialized
and cause a crash later on when it is freed by OPENSSL_free().
Even if it wouldn't crash there, it still fails to signal the error
and an empty string may be propagated to the callers.
The check also mirrors the other one in the same file.

Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: https://github.com/nodejs/node/pull/65200
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 deps/ncrypto/ncrypto.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index 089465ad5b95..c36f6ac14d45 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -6908,6 +6908,9 @@ std::pair<std::string, std::string> X509Name::Iterator::operator*() const {
 
   unsigned char* value_str;
   int value_str_size = ASN1_STRING_to_UTF8(&value_str, value);
+  if (value_str_size < 0) [[unlikely]] {
+    return {{}, {}};
+  }
 
   std::string out(reinterpret_cast<const char*>(value_str), value_str_size);
   OPENSSL_free(value_str);  // free after copy

From 992af05719ebe47c95f9bb8cd3345bfc1f2ca6ac Mon Sep 17 00:00:00 2001
From: Hierax_Umbra <72476163+frandle331-yh@users.noreply.github.com>
Date: Fri, 21 Aug 2026 08:56:28 +0900
Subject: [PATCH 258/344] fs: fix out-of-bounds write in mkdtemp for long
 prefixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.

Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.

Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 src/node_file.cc | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/node_file.cc b/src/node_file.cc
index f7437da0f2bb..871d8f16bd34 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
   CHECK_GE(argc, 2);
 
   BufferValue tmpl(isolate, args[0]);
-  static constexpr const char* const suffix = "XXXXXX";
-  const auto length = tmpl.length();
-  tmpl.AllocateSufficientStorage(length + strlen(suffix));
-  snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
+  const auto prefix_length = tmpl.length();
+  static constexpr std::string_view suffix = "XXXXXX";
+  tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
+  memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
+  tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
 
   CHECK_NOT_NULL(*tmpl);
 

From 88d5f644a2dcea5d24c293113469ecd4b017d7f5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 00:49:54 +0000
Subject: [PATCH 259/344] tools: bump brace-expansion in `/tools/clang-format`

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.13 to 1.1.18.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.13...v1.1.18)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
...

PR-URL: https://github.com/nodejs/node/pull/64984
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 tools/clang-format/package-lock.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tools/clang-format/package-lock.json b/tools/clang-format/package-lock.json
index 5d03eb31fde1..10ee47a76269 100644
--- a/tools/clang-format/package-lock.json
+++ b/tools/clang-format/package-lock.json
@@ -23,9 +23,9 @@
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dependencies": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"
@@ -193,9 +193,9 @@
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
     },
     "brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "requires": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"

From 152a326f926b41ef223e1536a59de99ac64e54e1 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Fri, 21 Aug 2026 05:50:05 +0500
Subject: [PATCH 260/344] dns: validate address type in lookupService

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64878
Fixes: https://github.com/nodejs/node/issues/64877
Reviewed-By: theanarkh <theratliter@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 lib/dns.js                   |  3 +++
 lib/internal/dns/promises.js |  2 ++
 test/parallel/test-dns.js    | 18 ++++++++++++++++++
 3 files changed, 23 insertions(+)

diff --git a/lib/dns.js b/lib/dns.js
index 110a19298ead..da1ffd21f052 100644
--- a/lib/dns.js
+++ b/lib/dns.js
@@ -83,6 +83,7 @@ const {
   validateNumber,
   validateOneOf,
   validatePort,
+  validateString,
   validateStringWithoutNullBytes,
 } = require('internal/validators');
 
@@ -269,6 +270,8 @@ function lookupService(address, port, callback) {
   if (arguments.length !== 3)
     throw new ERR_MISSING_ARGS('address', 'port', 'callback');
 
+  validateString(address, 'address');
+
   if (isIP(address) === 0)
     throw new ERR_INVALID_ARG_VALUE('address', address);
 
diff --git a/lib/internal/dns/promises.js b/lib/internal/dns/promises.js
index 0b6914500b23..1dd6417d7535 100644
--- a/lib/internal/dns/promises.js
+++ b/lib/internal/dns/promises.js
@@ -282,6 +282,8 @@ function lookupService(address, port) {
   if (arguments.length !== 2)
     throw new ERR_MISSING_ARGS('address', 'port');
 
+  validateString(address, 'address');
+
   if (isIP(address) === 0)
     throw new ERR_INVALID_ARG_VALUE('address', address);
 
diff --git a/test/parallel/test-dns.js b/test/parallel/test-dns.js
index d04877f5177e..f28fc869e779 100644
--- a/test/parallel/test-dns.js
+++ b/test/parallel/test-dns.js
@@ -394,6 +394,24 @@ assert.throws(() => {
   }, err);
 }
 
+{
+  const invalidAddress = Buffer.from('127.0.0.1');
+  const err = {
+    code: 'ERR_INVALID_ARG_TYPE',
+    name: 'TypeError',
+    message: 'The "address" argument must be of type string. ' +
+    'Received an instance of Buffer'
+  };
+
+  assert.throws(() => {
+    dnsPromises.lookupService(invalidAddress, 0);
+  }, err);
+
+  assert.throws(() => {
+    dns.lookupService(invalidAddress, 0, common.mustNotCall());
+  }, err);
+}
+
 [null, undefined, 65538, 'test', NaN, Infinity, Symbol(), 0n, true, false, '', () => {}, {}].forEach((port) => {
   const err = {
     code: 'ERR_SOCKET_BAD_PORT',

From 21655dccbc91da4b56660b228fc261c88abe99ab Mon Sep 17 00:00:00 2001
From: Kirill Saied <sayed.kirill@gmail.com>
Date: Fri, 21 Aug 2026 02:50:15 +0200
Subject: [PATCH 261/344] child_process: keep SIGWINCH from killing on Win

Fixes: https://github.com/nodejs/node/issues/64324
Signed-off-by: PickBas <sayed.kirill@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64510
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 doc/api/child_process.md                      | 12 ++++---
 src/process_wrap.cc                           |  2 +-
 .../test-child-process-kill-sigwinch.js       | 34 +++++++++++++++++++
 3 files changed, 43 insertions(+), 5 deletions(-)
 create mode 100644 test/parallel/test-child-process-kill-sigwinch.js

diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index 913542c2dc06..68f4d7ef14a9 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -1714,10 +1714,14 @@ may not actually terminate the process.
 
 See kill(2) for reference.
 
-On Windows, where POSIX signals do not exist, the `signal` argument will be
-ignored except for `'SIGKILL'`, `'SIGTERM'`, `'SIGINT'` and `'SIGQUIT'`, and the
-process will always be killed forcefully and abruptly (similar to `'SIGKILL'`).
-See [Signal Events][] for more details.
+On Windows, where POSIX signals do not exist, signals are handled as follows.
+`'SIGKILL'`, `'SIGTERM'`, `'SIGINT'` and `'SIGQUIT'` terminate the process
+forcefully and abruptly (similar to `'SIGKILL'`); any other signal whose name is
+known on Windows (such as `'SIGHUP'`) does the same. `'SIGWINCH'` is not
+terminal and is not coerced: `subprocess.kill()` throws an `ENOSYS` error and
+the child keeps running. A signal name that does not exist on Windows (such as
+`'SIGSTOP'`) throws an `ERR_UNKNOWN_SIGNAL` error. See [Signal Events][] for more
+details.
 
 On Linux, child processes of child processes will not be terminated
 when attempting to kill their parent. This is likely to happen when running a
diff --git a/src/process_wrap.cc b/src/process_wrap.cc
index 21ccb2a9989b..4d9420757122 100644
--- a/src/process_wrap.cc
+++ b/src/process_wrap.cc
@@ -351,7 +351,7 @@ class ProcessWrap : public HandleWrap {
     }
 #ifdef _WIN32
     if (signal != SIGKILL && signal != SIGTERM && signal != SIGINT &&
-        signal != SIGQUIT && signal != 0) {
+        signal != SIGQUIT && signal != 0 && signal != SIGWINCH) {
       signal = SIGKILL;
     }
 #endif
diff --git a/test/parallel/test-child-process-kill-sigwinch.js b/test/parallel/test-child-process-kill-sigwinch.js
new file mode 100644
index 000000000000..e474eefa40b4
--- /dev/null
+++ b/test/parallel/test-child-process-kill-sigwinch.js
@@ -0,0 +1,34 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const { spawn } = require('child_process');
+
+// SIGWINCH is a non-terminal signal: sending it must not terminate the target
+// process. On Windows, kill() must surface ENOSYS instead of coercing
+// SIGWINCH into a SIGKILL (which would wrongly terminate the process).
+// Refs: https://github.com/nodejs/node/issues/64324
+
+const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)']);
+
+// The process must survive the SIGWINCH; it is only ever torn down by the
+// explicit SIGKILL in the cleanup below (after the listener is removed).
+child.on('exit', common.mustNotCall('child must survive SIGWINCH'));
+
+child.on('spawn', common.mustCall(() => {
+  if (common.isWindows) {
+    assert.throws(() => child.kill('SIGWINCH'), { code: 'ENOSYS' });
+  } else {
+    assert.strictEqual(child.kill('SIGWINCH'), true);
+  }
+
+  assert.strictEqual(child.signalCode, null);
+  assert.strictEqual(child.exitCode, null);
+
+  setTimeout(common.mustCall(() => {
+    assert.strictEqual(child.signalCode, null);
+    assert.strictEqual(child.exitCode, null);
+
+    child.removeAllListeners('exit');
+    child.kill('SIGKILL');
+  }), common.platformTimeout(500));
+}));

From fda8ee894e79b3dcd1a6a97cac45db4cfcaa7d37 Mon Sep 17 00:00:00 2001
From: Yagiz Nizipli <yagiz@nizipli.com>
Date: Thu, 20 Aug 2026 21:21:30 -0400
Subject: [PATCH 262/344] build: use build-ci for benchmark merge-commit
 rebuild

The merge-commit job used `make -j4`, which skips configure. After
node.gyp or generated sources change, that can leave the comparison
binary unlinked against new files. `make build-ci` re-runs configure
first, matching the base-build step.

Assisted-by: Grok
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: https://github.com/nodejs/node/pull/65362
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 .github/workflows/benchmark.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 276cf738f8a6..561f8d56813f 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -141,7 +141,7 @@ jobs:
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
-                make -j4 V=1
+                make build-ci -j4 V=1
             '
 
       - name: Run benchmark

From 29f010fbb0bb7ad59d33da87221322e10400e79a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EA=B5=AC=ED=98=84=EC=9A=B0?=
 <162293672+guhyunwoo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 10:21:47 +0900
Subject: [PATCH 263/344] test: fix Linux debug skip in SEA test guard

process.config.variables.is_debug is only populated by the GN build
flow (tools/generate_config_gypi.py), so on the gyp builds used by CI
the guard never fired and SEA tests ran on Linux debug builds against
the original intent. Switch to
process.config.target_defaults.default_configuration === 'Debug',
matching the pattern used in test/common/index.js.

Fixes: https://github.com/nodejs/node/issues/63749
Refs: https://github.com/nodejs/node/issues/61483
Signed-off-by: Hyunwoo Gu <realization0327@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63751
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 test/common/sea.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/common/sea.js b/test/common/sea.js
index f7819c365db9..13a9a4a615cb 100644
--- a/test/common/sea.js
+++ b/test/common/sea.js
@@ -27,7 +27,7 @@ function skipIfSingleExecutableIsNotSupported() {
   if (!['darwin', 'win32', 'linux'].includes(process.platform))
     common.skip(`Unsupported platform ${process.platform}.`);
 
-  if (process.platform === 'linux' && process.config.variables.is_debug === 1)
+  if (process.platform === 'linux' && common.isDebug)
     common.skip('Running the resultant binary fails with `Couldn\'t read target executable"`.');
 
   if (process.config.variables.node_shared)

From fce6754a83d73170ecd8837b8c014f21e13972fa Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Thu, 20 Aug 2026 20:30:10 -0700
Subject: [PATCH 264/344] sqlite: reject busy statement finalization in
 authorizer

An iterator can leave a statement active between sqlite3_step() calls.
Finalizing that statement from an authorizer callback can release its
locks and change the outcome of the statement being authorized.

Reject close() and Symbol.dispose when the statement is busy and the
connection is in an authorizer callback. Continue allowing idle
statements to be finalized.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65369
Fixes: https://github.com/nodejs/node/issues/65368
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 doc/api/sqlite.md                  |  2 +-
 src/node_sqlite.cc                 | 11 ++++++++
 src/node_sqlite.h                  |  5 ++--
 test/parallel/test-sqlite-authz.js | 43 +++++++++++++++++++++++++++---
 4 files changed, 53 insertions(+), 8 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 1b18060b6e74..59d3fdbba112 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -1120,7 +1120,7 @@ Finalizes the prepared statement. An exception is thrown if the statement is
 already finalized. An [`ERR_INVALID_STATE`][] error is thrown if this statement
 is currently executing, which happens when the method is called from a callback
 that the statement itself triggered, such as a user-defined function, an
-aggregate function, or a [`'sqlite.db.query'`][] subscriber. Other statements
+aggregate function, or a [`'sqlite.db.query'`][] subscriber. Idle statements
 on the same connection can be finalized from such a callback. This method is a
 wrapper around [`sqlite3_finalize()`][].
 
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index c6b8a8d0a611..8558b91cc15a 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -160,6 +160,15 @@ inline MaybeLocal<Value> IntegerToValue(Isolate* isolate,
       (db)->IsInAuthorizerCallback(),                                          \
       "database cannot be accessed from an authorizer callback")
 
+// Finalizing a busy statement from an authorizer can release its locks and
+// change the outer statement's outcome.
+#define THROW_AND_RETURN_IF_BUSY_IN_AUTHORIZER(env, stmt)                      \
+  THROW_AND_RETURN_ON_BAD_STATE(                                               \
+      (env),                                                                   \
+      (stmt)->db_->IsInAuthorizerCallback() &&                                 \
+          sqlite3_stmt_busy((stmt)->statement_.get()),                         \
+      "database cannot be accessed from an authorizer callback")
+
 // A statement's virtual machine cannot be reentered while sqlite3_step() is
 // running it. Finalizing it frees the VM outright, and re-running it resets the
 // VM mid-execution; both are use-after-free rather than merely a contract
@@ -2900,6 +2909,7 @@ void StatementSync::Close(const FunctionCallbackInfo<Value>& args) {
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
   THROW_AND_RETURN_IF_STEPPING(env, stmt);
+  THROW_AND_RETURN_IF_BUSY_IN_AUTHORIZER(env, stmt);
   stmt->Close();
 }
 
@@ -2913,6 +2923,7 @@ void StatementSync::Dispose(const FunctionCallbackInfo<Value>& args) {
     return;
   }
   THROW_AND_RETURN_IF_STEPPING(env, stmt);
+  THROW_AND_RETURN_IF_BUSY_IN_AUTHORIZER(env, stmt);
   stmt->Close();
 }
 
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 7fec61dbf9a4..ef7105f63242 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -299,9 +299,8 @@ class DatabaseSync : public BaseObject {
   void DecrementAuthorizerDepth() { --authorizer_depth_; }
   bool IsInAuthorizerCallback() const { return authorizer_depth_ > 0; }
 
-  // Finalizing a statement frees its virtual machine, so a callback that
-  // SQLite invokes from inside sqlite3_step() must not finalize the statement
-  // being stepped. Other statements on the connection are safe to finalize.
+  // A callback must not finalize the statement being stepped. Other statements
+  // are safe unless they are busy during an authorizer callback.
   void PushSteppingStatement(sqlite3_stmt* stmt) {
     stepping_statements_.push_back(stmt);
   }
diff --git a/test/parallel/test-sqlite-authz.js b/test/parallel/test-sqlite-authz.js
index f6020ce9047e..eda923e258b9 100644
--- a/test/parallel/test-sqlite-authz.js
+++ b/test/parallel/test-sqlite-authz.js
@@ -397,10 +397,8 @@ suite('authorizer callback reentrancy', () => {
     assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
   });
 
-  // Only the statement being stepped is unsafe to finalize. Other statements
-  // on the connection have their own virtual machines, so finalizing them from
-  // a callback is allowed.
-  it('allows finalizing a statement that is not being executed', () => {
+  // An idle statement has no virtual-machine state or locks to release.
+  it('allows finalizing an idle statement', () => {
     const db = new DatabaseSync(':memory:');
     db.exec('CREATE TABLE t (x INTEGER)');
     db.exec('INSERT INTO t VALUES (1)');
@@ -417,6 +415,43 @@ suite('authorizer callback reentrancy', () => {
     });
   });
 
+  // A paused iterator is busy and may hold locks between sqlite3_step() calls.
+  it('rejects finalizing another active statement', () => {
+    for (const method of ['close', 'dispose']) {
+      const db = new DatabaseSync(':memory:');
+      db.exec('CREATE TABLE t (x INTEGER)');
+      db.exec('INSERT INTO t VALUES (1), (2), (3)');
+      const stmt = db.prepare('SELECT x FROM t');
+      const iter = stmt.iterate();
+      iter.next();
+      let outcome = 'authorizer callback did not run';
+
+      db.setAuthorizer((actionCode) => {
+        if (actionCode === constants.SQLITE_DROP_TABLE) {
+          try {
+            if (method === 'close') {
+              stmt.close();
+            } else {
+              stmt[Symbol.dispose]();
+            }
+            outcome = 'did not throw';
+          } catch (err) {
+            outcome = `${err.code}: ${err.message}`;
+          }
+        }
+        return constants.SQLITE_OK;
+      });
+
+      assert.throws(() => db.exec('DROP TABLE t'), {
+        code: 'ERR_SQLITE_ERROR',
+        message: 'database table is locked',
+      });
+      assert.strictEqual(outcome, expectedError);
+      db.setAuthorizer(null);
+      iter.return();
+    }
+  });
+
   // Disposal is idempotent, so a statement that is already finalized must stay
   // a no-op even inside a callback. Throwing here would turn a `using` scope's
   // real exception into a SuppressedError.

From 9d8d27d444a585ce4cb15981f1ca704fa041d3cf Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Fri, 21 Aug 2026 14:53:42 +0900
Subject: [PATCH 265/344] doc: update outdated nodejs.org guide links

Update outdated `nodejs.org/en/docs/guides/...` links
to their current `nodejs.org/learn/...` destinations.

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65394
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/cli.md    | 2 +-
 doc/api/n-api.md  | 2 +-
 doc/api/timers.md | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 71f91a825095..e07492b77e2e 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -4531,7 +4531,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [conditional exports]: packages.md#conditional-exports
 [context-aware]: addons.md#context-aware-addons
 [debugger]: debugger.md
-[debugging security implications]: https://nodejs.org/en/docs/guides/debugging-getting-started/#security-implications
+[debugging security implications]: https://nodejs.org/learn/getting-started/debugging#security-implications
 [deprecation warnings]: deprecations.md#list-of-deprecated-apis
 [emit_warning]: process.md#processemitwarningwarning-options
 [environment_variables]: #environment-variables_1
diff --git a/doc/api/n-api.md b/doc/api/n-api.md
index ca80a1e9969f..ed5433262977 100644
--- a/doc/api/n-api.md
+++ b/doc/api/n-api.md
@@ -6958,7 +6958,7 @@ node_api_get_module_file_name(node_api_basic_env env, const char** result);
 `result` may be an empty string if the add-on loading process fails to establish
 the add-on's file name during loading.
 
-[ABI Stability]: https://nodejs.org/en/docs/guides/abi-stability/
+[ABI Stability]: https://nodejs.org/learn/modules/abi-stability
 [AppVeyor]: https://www.appveyor.com
 [C++ Addons]: addons.md
 [CMake]: https://cmake.org
diff --git a/doc/api/timers.md b/doc/api/timers.md
index 7c91543c4573..cdbed03ba7ac 100644
--- a/doc/api/timers.md
+++ b/doc/api/timers.md
@@ -600,7 +600,7 @@ being developed as a standard Web Platform API.
 Calling `timersPromises.scheduler.yield()` is equivalent to calling
 `timersPromises.setImmediate()` with no arguments.
 
-[Event Loop]: https://nodejs.org/en/docs/guides/event-loop-timers-and-nexttick/#setimmediate-vs-settimeout
+[Event Loop]: https://nodejs.org/learn/asynchronous-work/event-loop-timers-and-nexttick#setimmediate-vs-settimeout
 [Scheduling APIs]: https://github.com/WICG/scheduling-apis
 [`AbortController`]: globals.md#class-abortcontroller
 [`TypeError`]: errors.md#class-typeerror

From 96b91dc987ddb70ed6a1890faf2be96e8095289f Mon Sep 17 00:00:00 2001
From: Dayun <dlekdbs6530@gmail.com>
Date: Fri, 21 Aug 2026 22:39:55 +0900
Subject: [PATCH 266/344] doc: clarify socket destroyed behavior

Signed-off-by: Dayun <dlekdbs6530@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65395
Fixes: https://github.com/nodejs/node/issues/57367
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 doc/api/net.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/api/net.md b/doc/api/net.md
index 06139fd5b703..d91fed769907 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -1408,15 +1408,15 @@ added: v0.1.90
 * `error` {Object}
 * Returns: {net.Socket}
 
-Ensures that no more I/O activity happens on this socket.
+Ensures that no more I/O activity happens on the current connection.
 Destroys the stream and closes the connection.
 
 See [`writable.destroy()`][] for further details.
 
 ### `socket.destroyed`
 
-* Type: {boolean} Indicates if the connection is destroyed or not. Once a
-  connection is destroyed no further data can be transferred using it.
+* Type: {boolean} Indicates if the connection is destroyed or not. No further
+  data can be transferred using a destroyed connection.
 
 See [`writable.destroyed`][] for further details.
 

From 235a0baf8b0b73ceb9d22605f1a5f61f7d725429 Mon Sep 17 00:00:00 2001
From: Junsoo Ha <35479251+ganjanggejang@users.noreply.github.com>
Date: Fri, 21 Aug 2026 22:40:07 +0900
Subject: [PATCH 267/344] test: use common/child_process spawnSync helpers

Replace manual spawnSync() result assertions
with test/common/child_process helper functions.

Signed-off-by: Junsoo Ha <junsoo2018@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65377
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/parallel/test-crypto-key-store-pkcs11.js |  4 +--
 ...test-experimental-shared-value-conveyor.js | 12 ++++-----
 test/parallel/test-heap-prof-basic.js         |  9 ++-----
 test/parallel/test-heap-prof-exec-argv.js     |  8 ++----
 test/parallel/test-heap-prof-loop-drained.js  |  9 ++-----
 test/parallel/test-inspect-address-in-use.js  | 27 +++++++++----------
 test/parallel/test-os-homedir-no-envvar.js    |  6 ++---
 test/parallel/test-process-execpath.js        | 10 +++----
 .../test-runner-mock-timers-with-timeout.js   |  6 ++---
 test/parallel/test-v8-stop-coverage.js        |  7 +++--
 test/parallel/test-v8-take-coverage-noop.js   |  7 +++--
 test/parallel/test-v8-take-coverage.js        |  7 +++--
 12 files changed, 45 insertions(+), 67 deletions(-)

diff --git a/test/parallel/test-crypto-key-store-pkcs11.js b/test/parallel/test-crypto-key-store-pkcs11.js
index 971f4909166b..0fec81a9c647 100644
--- a/test/parallel/test-crypto-key-store-pkcs11.js
+++ b/test/parallel/test-crypto-key-store-pkcs11.js
@@ -34,6 +34,7 @@ const {
   verify,
 } = require('crypto');
 const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 const { subtle } = globalThis.crypto;
 const kData = Buffer.from(
@@ -65,7 +66,7 @@ function softhsmOptions() {
 
 function runInChild() {
   const { cwd, env } = softhsmOptions();
-  const child = spawnSync(process.execPath, [
+  spawnSyncAndExitWithoutError(process.execPath, [
     `--openssl-config=${kOpenSSLConfig}`,
     __filename,
   ], {
@@ -73,7 +74,6 @@ function runInChild() {
     env: { ...process.env, ...env, NODE_TEST_PKCS11_CHILD: '1' },
     stdio: 'inherit',
   });
-  assert.strictEqual(child.status, 0);
 }
 
 function privateKeyUrl(label) {
diff --git a/test/parallel/test-experimental-shared-value-conveyor.js b/test/parallel/test-experimental-shared-value-conveyor.js
index 17eb32c66b11..123e212bd1da 100644
--- a/test/parallel/test-experimental-shared-value-conveyor.js
+++ b/test/parallel/test-experimental-shared-value-conveyor.js
@@ -1,8 +1,8 @@
 'use strict';
 const common = require('../common');
 const assert = require('assert');
-const { spawnSync } = require('child_process');
 const { Worker, parentPort } = require('worker_threads');
+const { spawnSyncAndAssert } = require('../common/child_process');
 
 if (process.env.TEST_CHILD_PROCESS === '1') {
   // Do not use isMainThread so that this test itself can be run inside a Worker.
@@ -29,10 +29,10 @@ if (process.env.TEST_CHILD_PROCESS === '1') {
 
   const args = ['--harmony-struct', __filename];
   const options = { env: { TEST_CHILD_PROCESS: '1', ...process.env } };
-  const child = spawnSync(process.execPath, args, options);
 
-  assert.strictEqual(child.stderr.toString().trim(), '');
-  assert.strictEqual(child.stdout.toString().trim(), '');
-  assert.strictEqual(child.status, 0);
-  assert.strictEqual(child.signal, null);
+  spawnSyncAndAssert(process.execPath, args, options, {
+    stdout: '',
+    stderr: '',
+    trim: true
+  });
 }
diff --git a/test/parallel/test-heap-prof-basic.js b/test/parallel/test-heap-prof-basic.js
index 34d8af9a7840..4ddc313ff048 100644
--- a/test/parallel/test-heap-prof-basic.js
+++ b/test/parallel/test-heap-prof-basic.js
@@ -9,7 +9,7 @@ const fixtures = require('../common/fixtures');
 common.skipIfInspectorDisabled();
 
 const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 const tmpdir = require('../common/tmpdir');
 
@@ -20,18 +20,13 @@ const {
 
 {
   tmpdir.refresh();
-  const output = spawnSync(process.execPath, [
+  spawnSyncAndExitWithoutError(process.execPath, [
     '--heap-prof',
     fixtures.path('workload', 'allocation.js'),
   ], {
     cwd: tmpdir.path,
     env
   });
-  if (output.status !== 0) {
-    console.log(output.stderr.toString());
-    console.log(output);
-  }
-  assert.strictEqual(output.status, 0);
   const profiles = getHeapProfiles(tmpdir.path);
   assert.strictEqual(profiles.length, 1);
 }
diff --git a/test/parallel/test-heap-prof-exec-argv.js b/test/parallel/test-heap-prof-exec-argv.js
index 02ad4430dba7..186b4d5d631b 100644
--- a/test/parallel/test-heap-prof-exec-argv.js
+++ b/test/parallel/test-heap-prof-exec-argv.js
@@ -9,7 +9,7 @@ const fixtures = require('../common/fixtures');
 common.skipIfInspectorDisabled();
 
 const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 const tmpdir = require('../common/tmpdir');
 
@@ -20,7 +20,7 @@ const {
 
 {
   tmpdir.refresh();
-  const output = spawnSync(process.execPath, [
+  const { child: output } = spawnSyncAndExitWithoutError(process.execPath, [
     fixtures.path('workload', 'allocation-worker-argv.js'),
   ], {
     cwd: tmpdir.path,
@@ -29,10 +29,6 @@ const {
       HEAP_PROF_INTERVAL: '128'
     }
   });
-  if (output.status !== 0) {
-    console.log(output.stderr.toString());
-  }
-  assert.strictEqual(output.status, 0);
   const profiles = getHeapProfiles(tmpdir.path);
   assert.strictEqual(profiles.length, 1);
   verifyFrames(output, profiles[0], 'runAllocation');
diff --git a/test/parallel/test-heap-prof-loop-drained.js b/test/parallel/test-heap-prof-loop-drained.js
index d0fc4c987849..d8e07b33cb46 100644
--- a/test/parallel/test-heap-prof-loop-drained.js
+++ b/test/parallel/test-heap-prof-loop-drained.js
@@ -8,7 +8,7 @@ const fixtures = require('../common/fixtures');
 common.skipIfInspectorDisabled();
 
 const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 const tmpdir = require('../common/tmpdir');
 
@@ -21,7 +21,7 @@ const {
 
 {
   tmpdir.refresh();
-  const output = spawnSync(process.execPath, [
+  const { child: output } = spawnSyncAndExitWithoutError(process.execPath, [
     '--heap-prof',
     '--heap-prof-interval',
     kHeapProfInterval,
@@ -30,11 +30,6 @@ const {
     cwd: tmpdir.path,
     env
   });
-  if (output.status !== 0) {
-    console.log(output.stderr.toString());
-    console.log(output);
-  }
-  assert.strictEqual(output.status, 0);
   const profiles = getHeapProfiles(tmpdir.path);
   assert.strictEqual(profiles.length, 1);
   verifyFrames(output, profiles[0], 'runAllocation');
diff --git a/test/parallel/test-inspect-address-in-use.js b/test/parallel/test-inspect-address-in-use.js
index d900fdfb6795..bd954e4a7bc8 100644
--- a/test/parallel/test-inspect-address-in-use.js
+++ b/test/parallel/test-inspect-address-in-use.js
@@ -2,7 +2,7 @@
 const common = require('../common');
 common.skipIfInspectorDisabled();
 
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExit } = require('../common/child_process');
 const { createServer } = require('http');
 const assert = require('assert');
 const tmpdir = require('../common/tmpdir');
@@ -25,19 +25,18 @@ function testOnServerListen(fn) {
 function testChildProcess(getArgs, exitCode, options) {
   testOnServerListen(common.mustCall((server) => {
     const { port } = server.address();
-    const child = spawnSync(process.execPath, getArgs(port), options);
-    const stderr = child.stderr.toString().trim();
-    const stdout = child.stdout.toString().trim();
-    console.log('[STDERR]');
-    console.log(stderr);
-    console.log('[STDOUT]');
-    console.log(stdout);
-    const match = stderr.match(
-      /Starting inspector on 127\.0\.0\.1:(\d+) failed: address already in use/
-    );
-    assert.notStrictEqual(match, null);
-    assert.strictEqual(match[1], port + '');
-    assert.strictEqual(child.status, exitCode);
+    spawnSyncAndExit(process.execPath, getArgs(port), options, {
+      status: exitCode,
+      signal: null,
+      trim: true,
+      stderr: function(str) {
+        const match = str.match(
+          /Starting inspector on 127\.0\.0\.1:(\d+) failed: address already in use/
+        );
+        assert.notStrictEqual(match, null);
+        assert.strictEqual(match[1], port + '');
+      },
+    });
   }));
 }
 
diff --git a/test/parallel/test-os-homedir-no-envvar.js b/test/parallel/test-os-homedir-no-envvar.js
index 2f9b1b47a704..3a47d6d72c4d 100644
--- a/test/parallel/test-os-homedir-no-envvar.js
+++ b/test/parallel/test-os-homedir-no-envvar.js
@@ -1,9 +1,9 @@
 'use strict';
 const common = require('../common');
 const assert = require('assert');
-const cp = require('child_process');
 const os = require('os');
 const path = require('path');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 
 if (process.argv[2] === 'child') {
@@ -22,9 +22,7 @@ if (process.argv[2] === 'child') {
   else
     delete process.env.HOME;
 
-  const child = cp.spawnSync(process.execPath, [__filename, 'child'], {
+  spawnSyncAndExitWithoutError(process.execPath, [__filename, 'child'], {
     env: process.env
   });
-
-  assert.strictEqual(child.status, 0);
 }
diff --git a/test/parallel/test-process-execpath.js b/test/parallel/test-process-execpath.js
index 0fce35e2645e..53d8f39fbf7e 100644
--- a/test/parallel/test-process-execpath.js
+++ b/test/parallel/test-process-execpath.js
@@ -4,7 +4,7 @@ if (common.isWindows)
   common.skip('symlinks are weird on windows');
 
 const assert = require('assert');
-const child_process = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const fs = require('fs');
 
 assert.strictEqual(process.execPath, fs.realpathSync(process.execPath));
@@ -19,8 +19,8 @@ if (process.argv[2] === 'child') {
   const symlinkedNode = tmpdir.resolve('symlinked-node');
   fs.symlinkSync(process.execPath, symlinkedNode);
 
-  const proc = child_process.spawnSync(symlinkedNode, [__filename, 'child']);
-  assert.strictEqual(proc.stderr.toString(), '');
-  assert.strictEqual(proc.stdout.toString(), `${process.execPath}\n`);
-  assert.strictEqual(proc.status, 0);
+  spawnSyncAndAssert(symlinkedNode, [__filename, 'child'], {
+    stdout: `${process.execPath}\n`,
+    stderr: ''
+  });
 }
diff --git a/test/parallel/test-runner-mock-timers-with-timeout.js b/test/parallel/test-runner-mock-timers-with-timeout.js
index 67f266851fe1..6d98e6e9479a 100644
--- a/test/parallel/test-runner-mock-timers-with-timeout.js
+++ b/test/parallel/test-runner-mock-timers-with-timeout.js
@@ -1,14 +1,12 @@
 'use strict';
 require('../common');
 const fixtures = require('../common/fixtures');
-const assert = require('node:assert');
-const { spawnSync } = require('node:child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 const { test } = require('node:test');
 
 test('mock timers do not break test timeout cleanup', async () => {
   const fixture = fixtures.path('test-runner', 'mock-timers-with-timeout.js');
-  const cp = spawnSync(process.execPath, ['--test', fixture], {
+  spawnSyncAndExitWithoutError(process.execPath, ['--test', fixture], {
     timeout: 30_000,
   });
-  assert.strictEqual(cp.status, 0, `Test failed:\nstdout: ${cp.stdout}\nstderr: ${cp.stderr}`);
 });
diff --git a/test/parallel/test-v8-stop-coverage.js b/test/parallel/test-v8-stop-coverage.js
index e9764d60477b..b37f8320abb4 100644
--- a/test/parallel/test-v8-stop-coverage.js
+++ b/test/parallel/test-v8-stop-coverage.js
@@ -5,7 +5,7 @@ const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const assert = require('assert');
 const fs = require('fs');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 common.skipIfInspectorDisabled();
 
@@ -13,7 +13,7 @@ tmpdir.refresh();
 const intervals = 20;
 
 {
-  const output = spawnSync(process.execPath, [
+  const { child } = spawnSyncAndExitWithoutError(process.execPath, [
     '-r',
     fixtures.path('v8-coverage', 'stop-coverage'),
     '-r',
@@ -27,8 +27,7 @@ const intervals = 20;
       TEST_INTERVALS: intervals
     },
   });
-  console.log(output.stderr.toString());
-  assert.strictEqual(output.status, 0);
+  console.log(child.stderr.toString());
   const coverageFiles = fs.readdirSync(tmpdir.path);
   assert.strictEqual(coverageFiles.length, 0);
 }
diff --git a/test/parallel/test-v8-take-coverage-noop.js b/test/parallel/test-v8-take-coverage-noop.js
index 8d49b0f23296..14bb8a2c3a91 100644
--- a/test/parallel/test-v8-take-coverage-noop.js
+++ b/test/parallel/test-v8-take-coverage-noop.js
@@ -5,7 +5,7 @@ const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const assert = require('assert');
 const fs = require('fs');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 common.skipIfInspectorDisabled();
 
@@ -14,7 +14,7 @@ tmpdir.refresh();
 // v8.takeCoverage() should be a noop if NODE_V8_COVERAGE is not set.
 const intervals = 40;
 {
-  const output = spawnSync(process.execPath, [
+  const { child } = spawnSyncAndExitWithoutError(process.execPath, [
     '-r',
     fixtures.path('v8-coverage', 'take-coverage'),
     fixtures.path('v8-coverage', 'interval'),
@@ -25,8 +25,7 @@ const intervals = 40;
       TEST_INTERVALS: intervals
     },
   });
-  console.log(output.stderr.toString());
-  assert.strictEqual(output.status, 0);
+  console.log(child.stderr.toString());
   const coverageFiles = fs.readdirSync(tmpdir.path);
   assert.strictEqual(coverageFiles.length, 0);
 }
diff --git a/test/parallel/test-v8-take-coverage.js b/test/parallel/test-v8-take-coverage.js
index 6b1fe149e992..2119a30d6ad9 100644
--- a/test/parallel/test-v8-take-coverage.js
+++ b/test/parallel/test-v8-take-coverage.js
@@ -5,7 +5,7 @@ const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const assert = require('assert');
 const fs = require('fs');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 common.skipIfInspectorDisabled();
 
@@ -13,7 +13,7 @@ tmpdir.refresh();
 const intervals = 40;
 // Outputs coverage when v8.takeCoverage() is invoked.
 {
-  const output = spawnSync(process.execPath, [
+  const { child } = spawnSyncAndExitWithoutError(process.execPath, [
     '-r',
     fixtures.path('v8-coverage', 'take-coverage'),
     fixtures.path('v8-coverage', 'interval'),
@@ -25,8 +25,7 @@ const intervals = 40;
       TEST_INTERVALS: intervals
     },
   });
-  console.log(output.stderr.toString());
-  assert.strictEqual(output.status, 0);
+  console.log(child.stderr.toString());
   const coverageFiles = fs.readdirSync(tmpdir.path);
 
   let coverages = [];

From 60cb384c15b3d3480b49afbfb37d6521ae29f82a Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Fri, 21 Aug 2026 07:19:45 -0700
Subject: [PATCH 268/344] sqlite: remove unused column name helper

Remove the unused column name helper from StatementExecutionHelper.
It became unused after all() and get() switched to cached names.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65401
Refs: https://github.com/nodejs/node/pull/65276
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
---
 src/node_sqlite.cc | 14 --------------
 src/node_sqlite.h  |  3 ---
 2 files changed, 17 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 8558b91cc15a..0ce54b6d36bc 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3158,20 +3158,6 @@ MaybeLocal<Value> StatementExecutionHelper::ColumnToValue(Environment* env,
   return js_val;
 }
 
-MaybeLocal<Name> StatementExecutionHelper::ColumnNameToName(Environment* env,
-                                                            sqlite3_stmt* stmt,
-                                                            const int column) {
-  const char* col_name = sqlite3_column_name(stmt, column);
-  if (col_name == nullptr) {
-    THROW_ERR_INVALID_STATE(env, "Cannot get name of column %d", column);
-    return MaybeLocal<Name>();
-  }
-
-  return String::NewFromUtf8(
-             env->isolate(), col_name, NewStringType::kInternalized)
-      .As<Name>();
-}
-
 void StatementSync::MemoryInfo(MemoryTracker* tracker) const {}
 
 Maybe<void> ExtractRowValues(Environment* env,
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index ef7105f63242..7b34d4222b4a 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -187,9 +187,6 @@ class StatementExecutionHelper {
                                                  sqlite3_stmt* stmt,
                                                  const int column,
                                                  bool use_big_ints);
-  static v8::MaybeLocal<v8::Name> ColumnNameToName(Environment* env,
-                                                   sqlite3_stmt* stmt,
-                                                   const int column);
   static v8::MaybeLocal<v8::Value> Get(Environment* env,
                                        StatementSync* statement);
 };

From 35b18b4455e86dba69ffa5e64cbd82828b8dfb14 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 21 Aug 2026 17:01:39 +0200
Subject: [PATCH 269/344] tools: fix max body length handler in
 `create-release-proposal.sh`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65455
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 tools/actions/create-release-proposal.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/tools/actions/create-release-proposal.sh b/tools/actions/create-release-proposal.sh
index f4878f1cc940..9240fa2ad7f7 100755
--- a/tools/actions/create-release-proposal.sh
+++ b/tools/actions/create-release-proposal.sh
@@ -35,9 +35,14 @@ HEAD_SHA="$(git rev-parse HEAD^)"
 
 TITLE="$(git log -1 --format=%s)"
 
-TEMP_BODY="$(awk -v MAX_BODY_LENGTH="65536" \
-    "/^## ${RELEASE_DATE}/,/^<a id=/{ if (/^<a id=/) {exit;} if ((output_length += length(\$0)) > MAX_BODY_LENGTH) {exit 1;} print }" \
-    "doc/changelogs/CHANGELOG_V${RELEASE_LINE}.md" || echo "…")"
+# GH rest API has an undocumented limit of 65536 char for the body, setting it
+# to 65534 to account for the ellipsis and the final EOL.
+TEMP_BODY="$(awk -v MAX_BODY_LENGTH="65534" \
+    "/^## ${RELEASE_DATE}/,/^<a id=/{
+      if (/^<a id=/) {exit;}
+      if ((output_length += length(\$0) + 1) > MAX_BODY_LENGTH) {exit 1;}
+      print
+    }" "doc/changelogs/CHANGELOG_V${RELEASE_LINE}.md" || echo "…")"
 
 # Create the proposal branch
 gh api \

From dae434132e3d7ae5ac2c39bddf7d08667fd25fb0 Mon Sep 17 00:00:00 2001
From: soreavis <263610811+soreavis@users.noreply.github.com>
Date: Fri, 21 Aug 2026 17:01:49 +0200
Subject: [PATCH 270/344] doc: fix broken TLS security level example

The example under "Setting security levels" does not run. The client
sets `maxVersion: 'TLSv1'` while its `minVersion` stays at the
`tls.DEFAULT_MIN_VERSION` default of `'TLSv1.2'`, so no version overlaps
and the connection fails with ERR_SSL_NO_PROTOCOLS_AVAILABLE. Setting
the client's `minVersion` is not enough on its own: the handshake then
fails with an alert 40, because `createServer` is given no key or
certificate and the server has no shared cipher.

Set `minVersion` on the client, add the key and certificate placeholders
and the openssl recipe that the other sections using them already carry,
pass the server certificate as the client's `ca`, and use port 8000 like
the rest of the file. The section now runs from an empty directory and
prints "Client connected with protocol: TLSv1".

Signed-off-by: Julian Soreavis <julian.soreavis@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65391
Fixes: https://github.com/nodejs/node/issues/60569
Refs: https://github.com/nodejs/node/pull/60571
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/tls.md | 41 +++++++++++++++++++++++++++++++++++------
 1 file changed, 35 insertions(+), 6 deletions(-)

diff --git a/doc/api/tls.md b/doc/api/tls.md
index 69aa6a9ceacc..4917365e2c15 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -468,35 +468,64 @@ to set the security level to 0 while using the default OpenSSL cipher list, you
 
 ```mjs
 import { createServer, connect } from 'node:tls';
-const port = 443;
+import { readFileSync } from 'node:fs';
+const port = 8000;
 
-createServer({ ciphers: 'DEFAULT@SECLEVEL=0', minVersion: 'TLSv1' }, function(socket) {
+createServer({
+  key: readFileSync('server-key.pem'),
+  cert: readFileSync('server-cert.pem'),
+  ciphers: 'DEFAULT@SECLEVEL=0',
+  minVersion: 'TLSv1',
+}, function(socket) {
   console.log('Client connected with protocol:', socket.getProtocol());
   socket.end();
   this.close();
 })
 .listen(port, () => {
-  connect(port, { ciphers: 'DEFAULT@SECLEVEL=0', maxVersion: 'TLSv1' });
+  connect(port, {
+    ciphers: 'DEFAULT@SECLEVEL=0',
+    minVersion: 'TLSv1',
+    maxVersion: 'TLSv1',
+    ca: [ readFileSync('server-cert.pem') ],
+  });
 });
 ```
 
 ```cjs
 const { createServer, connect } = require('node:tls');
-const port = 443;
+const { readFileSync } = require('node:fs');
+const port = 8000;
 
-createServer({ ciphers: 'DEFAULT@SECLEVEL=0', minVersion: 'TLSv1' }, function(socket) {
+createServer({
+  key: readFileSync('server-key.pem'),
+  cert: readFileSync('server-cert.pem'),
+  ciphers: 'DEFAULT@SECLEVEL=0',
+  minVersion: 'TLSv1',
+}, function(socket) {
   console.log('Client connected with protocol:', socket.getProtocol());
   socket.end();
   this.close();
 })
 .listen(port, () => {
-  connect(port, { ciphers: 'DEFAULT@SECLEVEL=0', maxVersion: 'TLSv1' });
+  connect(port, {
+    ciphers: 'DEFAULT@SECLEVEL=0',
+    minVersion: 'TLSv1',
+    maxVersion: 'TLSv1',
+    ca: [ readFileSync('server-cert.pem') ],
+  });
 });
 ```
 
 This approach sets the security level to 0, allowing the use of legacy features while still
 leveraging the default OpenSSL ciphers.
 
+To generate the certificate and key for this example, run:
+
+```bash
+openssl req -x509 -newkey rsa:2048 -nodes -sha256 -subj '/CN=localhost' \
+  -keyout server-key.pem -out server-cert.pem
+```
+
 ### Using [`--tls-cipher-list`][]
 
 You can also set the security level and ciphers from the command line using the

From 3770f9baea2e47597bd16fd5b943f8314cea2f9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Fri, 21 Aug 2026 18:00:21 +0200
Subject: [PATCH 271/344] meta: move targos to emeritus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-Off-By: Michaël Zasso <targos@protonmail.com>
PR-URL: https://github.com/nodejs/node/pull/65393
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 README.md                                 | 12 ++++++------
 doc/contributing/strategic-initiatives.md |  2 --
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index e27d95f26f1f..3827556a44fb 100644
--- a/README.md
+++ b/README.md
@@ -182,8 +182,6 @@ For information about the governance of the Node.js project, see
   **Ruy Adorno** <<ruy@vlt.sh>> (he/him)
 * [ShogunPanda](https://github.com/ShogunPanda) -
   **Paolo Insogna** <<paolo@cowtech.it>> (he/him)
-* [targos](https://github.com/targos) -
-  **Michaël Zasso** <<targos@protonmail.com>> (he/him)
 * [tniessen](https://github.com/tniessen) -
   **Tobias Nießen** <<tniessen@tnie.de>> (he/him)
 
@@ -260,6 +258,8 @@ For information about the governance of the Node.js project, see
   **Sam Roberts** <<vieuxtech@gmail.com>>
 * [shigeki](https://github.com/shigeki) -
   **Shigeki Ohtsu** <<ohtsu@ohtsu.org>> (he/him)
+* [targos](https://github.com/targos) -
+  **Michaël Zasso** <<targos@protonmail.com>> (he/him)
 * [thefourtheye](https://github.com/thefourtheye) -
   **Sakthipriyan Vairamani** <<thechargingvolcano@gmail.com>> (he/him)
 * [TimothyGu](https://github.com/TimothyGu) -
@@ -429,8 +429,6 @@ For information about the governance of the Node.js project, see
   **Stefan Stojanovic** <<stefan.stojanovic@janeasystems.com>> (he/him)
 * [sxa](https://github.com/sxa) -
   **Stewart X Addison** <<sxa@redhat.com>> (he/him)
-* [targos](https://github.com/targos) -
-  **Michaël Zasso** <<targos@protonmail.com>> (he/him)
 * [theanarkh](https://github.com/theanarkh) -
   **theanarkh** <<theratliter@gmail.com>> (he/him)
 * [tniessen](https://github.com/tniessen) -
@@ -699,6 +697,8 @@ For information about the governance of the Node.js project, see
   **Weijia Wang** <<starkwang@126.com>>
 * [stefanmb](https://github.com/stefanmb) -
   **Stefan Budeanu** <<stefan@budeanu.com>>
+* [targos](https://github.com/targos) -
+  **Michaël Zasso** <<targos@protonmail.com>> (he/him)
 * [tellnes](https://github.com/tellnes) -
   **Christian Tellnes** <<christian@tellnes.no>>
 * [thefourtheye](https://github.com/thefourtheye) -
@@ -779,8 +779,6 @@ Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
   `DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7`
 * **Marco Ippolito** <<marcoippolito54@gmail.com>>
   `CC68F5A3106FF448322E48ED27F5E38D5B0A215F`
-* **Michaël Zasso** <<targos@protonmail.com>>
-  `8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600`
 * **Rafael Gonzaga** <<rafael.nunu@hotmail.com>>
   `890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4`
 * **Richard Lau** <<richard.lau@ibm.com>>
@@ -846,6 +844,8 @@ verify a downloaded file.
   `61FC681DFB92A079F1685E77973F295594EC4689`
 * **Julien Gilli** <<jgilli@fastmail.fm>>
   `114F43EE0176B71C7BC219DD50A3051F888C628D`
+* **Michaël Zasso** <<targos@protonmail.com>>
+  `8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600`
 * **Myles Borins** <<myles.borins@gmail.com>>
   `C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`
 * **Rod Vagg** <<rod@vagg.org>>
diff --git a/doc/contributing/strategic-initiatives.md b/doc/contributing/strategic-initiatives.md
index ac154c0e2bb7..a7ee78f42aae 100644
--- a/doc/contributing/strategic-initiatives.md
+++ b/doc/contributing/strategic-initiatives.md
@@ -11,7 +11,6 @@ agenda to ensure they are active and have the support they need.
 | QUIC / HTTP3           | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Unified HTTP API       | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Shadow Realm           | [Chengzhong Wu][legendecas]      | <https://github.com/nodejs/node/issues/42528> |
-| V8 Currency            | [Michaël Zasso][targos]          |                                               |
 | Next-10                | [Jacob Smith][JakobJingleheimer] | <https://github.com/nodejs/next-10>           |
 | Single executable apps | [Darshan Sen][RaisinTen]         | <https://github.com/nodejs/single-executable> |
 | Performance            | [Rafael Gonzaga][RafaelGSS]      | <https://github.com/nodejs/performance>       |
@@ -47,4 +46,3 @@ agenda to ensure they are active and have the support they need.
 [jasnell]: https://github.com/jasnell
 [joyeecheung]: https://github.com/joyeecheung
 [legendecas]: https://github.com/legendecas
-[targos]: https://github.com/targos

From 6f0c08bf8067a257d5c35e55fb9efb22972c6e6c Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 21 Aug 2026 19:04:49 +0200
Subject: [PATCH 272/344] tools: refactor `shell.nix` pkcs11 integration to its
 own section

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65404
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 shell.nix | 83 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 43 insertions(+), 40 deletions(-)

diff --git a/shell.nix b/shell.nix
index 74a93d0e9ff4..96fcccbc1914 100644
--- a/shell.nix
+++ b/shell.nix
@@ -55,16 +55,6 @@ let
   useSharedTemporal = builtins.hasAttr "temporal_capi" sharedLibDeps;
   needsRustCompiler = withTemporal && !useSharedTemporal;
 
-  usePkcs11 = pkcs11 != false && pkcs11 != null;
-  pkcs11Fixture =
-    if pkcs11 == true then
-      import ./tools/nix/pkcs11.nix {
-        inherit pkgs;
-        inherit (sharedLibDeps) openssl;
-      }
-    else
-      pkcs11;
-
   nativeBuildInputs =
     pkgs.nodejs-slim_latest.nativeBuildInputs
     ++ pkgs.lib.optionals needsRustCompiler [
@@ -88,35 +78,35 @@ let
   ++ pkgs.lib.optional (withTemporal && useSharedTemporal) "--shared-temporal_capi"
   ++ pkgs.lib.optional withPerfetto "--with-perfetto";
 in
-pkgs.mkShell (
-  {
-    inherit nativeBuildInputs;
+pkgs.mkShell {
+  inherit nativeBuildInputs;
 
-    buildInputs =
-      builtins.attrValues sharedLibDeps
-      ++ buildInputs
-      ++ pkgs.lib.optional (useSeparateDerivationForV8 != false) (
-        if useSeparateDerivationForV8 == true then
-          let
-            sharedLibsToMock = pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { };
-          in
-          pkgs.callPackage ./tools/nix/v8.nix {
-            inherit nativeBuildInputs icu;
+  buildInputs =
+    builtins.attrValues sharedLibDeps
+    ++ buildInputs
+    ++ pkgs.lib.optional (useSeparateDerivationForV8 != false) (
+      if useSeparateDerivationForV8 == true then
+        let
+          sharedLibsToMock = pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { };
+        in
+        pkgs.callPackage ./tools/nix/v8.nix {
+          inherit nativeBuildInputs icu;
 
-            configureFlags = configureFlags ++ sharedLibsToMock.configureFlags ++ [ "--ninja" ];
-            buildInputs = buildInputs ++ [ sharedLibsToMock ];
-          }
-        else
-          useSeparateDerivationForV8
-      );
+          configureFlags = configureFlags ++ sharedLibsToMock.configureFlags ++ [ "--ninja" ];
+          buildInputs = buildInputs ++ [ sharedLibsToMock ];
+        }
+      else
+        useSeparateDerivationForV8
+    );
 
-    packages = devTools ++ benchmarkTools ++ pkgs.lib.optional (ccache != null) ccache;
+  packages = devTools ++ benchmarkTools ++ pkgs.lib.optional (ccache != null) ccache;
 
-    shellHook = pkgs.lib.optionalString (ccache != null) ''
-      export CC="${pkgs.lib.getExe ccache} $CC"
-      export CXX="${pkgs.lib.getExe ccache} $CXX"
-    '';
+  shellHook = pkgs.lib.optionalString (ccache != null) ''
+    export CC="${pkgs.lib.getExe ccache} $CC"
+    export CXX="${pkgs.lib.getExe ccache} $CXX"
+  '';
 
+  env = {
     BUILD_WITH = if (ninja != null) then "ninja" else "make";
     NINJA = pkgs.lib.optionalString (ninja != null) "${pkgs.lib.getExe ninja}";
     CONFIG_FLAGS = builtins.toString (
@@ -154,9 +144,22 @@ pkgs.mkShell (
   // pkgs.lib.optionalAttrs (!withSQLite) {
     NOSQLITE = "1";
   }
-  // pkgs.lib.optionalAttrs usePkcs11 {
-    NODE_TEST_PKCS11_OPENSSL_CONF = "${pkcs11Fixture.opensslConf}";
-    NODE_TEST_PKCS11_PIN = pkcs11Fixture.softhsmDir.pin;
-    NODE_TEST_PKCS11_SOFTHSM_DIR = "${pkcs11Fixture.softhsmDir}";
-  }
-)
+  // pkgs.lib.optionalAttrs (pkcs11 != false && pkcs11 != null) (
+    let
+      pkcs11' =
+        if pkcs11 == true then
+          import ./tools/nix/pkcs11.nix {
+            inherit pkgs;
+            # Building pkcs11-provider without a shared OpenSSL is not supported.
+            inherit (sharedLibDeps) openssl;
+          }
+        else
+          pkcs11;
+    in
+    {
+      NODE_TEST_PKCS11_OPENSSL_CONF = pkcs11'.opensslConf;
+      NODE_TEST_PKCS11_PIN = pkcs11'.softhsmDir.pin;
+      NODE_TEST_PKCS11_SOFTHSM_DIR = pkcs11'.softhsmDir;
+    }
+  );
+}

From 78175c68f865d36974ae02f105f29ae7ed3e876d Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 21 Aug 2026 19:05:15 +0200
Subject: [PATCH 273/344] tools: improve nix-changes coverage

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65403
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 .github/workflows/build-tarball.yml    |  2 +
 .github/workflows/coverage-windows.yml |  2 +
 .github/workflows/nix-changes.yml      | 39 ++++------------
 .github/workflows/test-linux.yml       |  2 +
 .github/workflows/test-macos.yml       |  2 +
 .github/workflows/test-shared.yml      |  2 +
 tools/nix/list-requisites.sh           | 62 ++++++++++++++++++++++++++
 7 files changed, 81 insertions(+), 30 deletions(-)
 create mode 100755 tools/nix/list-requisites.sh

diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index ab0698e11b74..248e64bab776 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -52,6 +53,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
index 59329670e6c2..d0236cd7d609 100644
--- a/.github/workflows/coverage-windows.yml
+++ b/.github/workflows/coverage-windows.yml
@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'
diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index 84c4337bab19..ed25798152e3 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -11,10 +11,12 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
+      - tools/nix/**
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
+      - tools/nix/**
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
         with:
           fetch-depth: 2
           persist-credentials: false
-          sparse-checkout: '*.nix'
+          sparse-checkout: |
+            shell.nix
+            tools/nix/
           sparse-checkout-cone-mode: false
 
       - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
@@ -60,39 +64,14 @@ jobs:
           name: nodejs
 
       - name: Compute requisites after change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-        run: |
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                  // import ./tools/nix/pkcs11.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-after.list
+        run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
       - name: Compute requisites before change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
         run: |
           git reset HEAD^ --hard
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                  // import ./tools/nix/pkcs11.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-before.list
+          # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+          [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+          ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
       - name: Output diff
         run: |
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index 40762503f685..7681a176139d 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -9,6 +9,7 @@ on:
       - tools/actions/**
       - tools/clang-format/**
       - tools/dep_updaters/**
+      - tools/nix/**
       - test/internet/**
       - '**.nix'
       - .github/**
@@ -27,6 +28,7 @@ on:
       - tools/actions/**
       - tools/clang-format/**
       - tools/dep_updaters/**
+      - tools/nix/**
       - test/internet/**
       - '**.nix'
       - .github/**
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
index e87e83505d6d..c53bcde2851c 100644
--- a/.github/workflows/test-macos.yml
+++ b/.github/workflows/test-macos.yml
@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -53,6 +54,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 284372317359..8a04fe4d74fc 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -44,6 +44,7 @@ on:
       - '!tools/nix/**'
       - '!tools/v8/**'
       - '!tools/v8_gypfiles/**'
+      - tools/nix/list-requisites.sh
       - typings/**
       - vcbuild.bat
       - .**
@@ -96,6 +97,7 @@ on:
       - '!tools/nix/**'
       - '!tools/v8/**'
       - '!tools/v8_gypfiles/**'
+      - tools/nix/list-requisites.sh
       - typings/**
       - vcbuild.bat
       - .**
diff --git a/tools/nix/list-requisites.sh b/tools/nix/list-requisites.sh
new file mode 100755
index 000000000000..92aa91794326
--- /dev/null
+++ b/tools/nix/list-requisites.sh
@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+  (import <nixpkgs> {}).lib.concatMapStrings
+    (n: ''--arg \${n} true '')
+    (builtins.filter
+      (n: builtins.match ''with[A-Z].+'' n != null)
+      (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+  "
+)
+
+DRV=$(
+  cd "$BASE_DIR"
+  # shellcheck disable=SC2086
+  nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+    $OPTIONAL_FLAGS \
+    --arg sharedLibDeps '{
+      # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+      # We pass the shared deps as devTools below so they are still accounted for.
+    }' \
+    --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+      # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+    }' \
+    --arg devTools '
+      let
+        pkgs = import <nixpkgs> { };
+        sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+      in
+      (import ./tools/nix/devTools.nix { })
+      ++ pkgs.lib.flatten (
+        with (pkgs.callPackage ./tools/nix/v8.nix { });
+        [
+          # We do not want to build V8 here, but still want to list its requisites.
+          buildInputs
+          nativeBuildInputs
+          propagatedBuildInputs
+          propagatedNativeBuildInputs
+          (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+        ]
+      )
+      ++ builtins.attrValues (
+        {
+          # Additional packages we are using across the codebase
+          inherit (pkgs) nixfmt-tree sccache;
+        }
+        // import ./tools/nix/openssl-matrix.nix { }
+        // sharedLibDepsFn (
+          pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+            builtins.functionArgs sharedLibDepsFn
+          )
+        )
+      )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS" | xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS" | xargs nix-store --query --requisites)
+
+echo "$REQUISITES" | sort -k1.45 | uniq

From 24cd694237c92dd8cad177bf51320b7396b94c89 Mon Sep 17 00:00:00 2001
From: Orgad Shaneh <orgad.shaneh@audiocodes.com>
Date: Fri, 21 Aug 2026 20:05:31 +0300
Subject: [PATCH 274/344] doc: document that an empty OPENSSL_CONF skips config
 loading

A default OpenSSL configuration file that exists but cannot be read is
fatal at startup: CONF_MFLAGS_IGNORE_MISSING_FILE only covers ENOENT
and ENOTDIR, so a container that mounts /etc/ssl inaccessible to the
user Node.js runs as cannot start at all.

OpenSSL skips config loading entirely when OPENSSL_CONF is set to an
empty value, which gets past this, but that was undocumented. Say so,
including that no configuration is applied, FIPS setup included.

Refs: https://github.com/nodejs/node/issues/62230
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Orgad Shaneh <orgad.shaneh@audiocodes.com>
PR-URL: https://github.com/nodejs/node/pull/64949
Fixes: https://github.com/nodejs/node/issues/62230
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/cli.md                                |  9 ++++-
 doc/node.1                                    |  8 +++-
 .../test-openssl-unreadable-config.js         | 40 +++++++++++++++++++
 3 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-openssl-unreadable-config.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index e07492b77e2e..b2f6db700961 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -4246,8 +4246,15 @@ added: v6.11.0
 Load an OpenSSL configuration file on startup. The file can be used as part of
 a [FIPS mode][] configuration.
 
+If the variable is set to an empty value, Node.js starts without loading any
+OpenSSL configuration file. This is a way past a default configuration file
+that exists but cannot be read, for example when `/etc/ssl` is not accessible
+to the user Node.js runs as, which is otherwise fatal at startup. No
+configuration is applied in that case, including any [FIPS mode][] setup the
+file would have performed.
+
 If the [`--openssl-config`][] command-line option is used, the environment
-variable is ignored.
+variable is ignored, and an empty value has no effect.
 
 ### `SSL_CERT_DIR=dir`
 
diff --git a/doc/node.1 b/doc/node.1
index 4d9b8922ba75..c9b925a23974 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -2378,8 +2378,14 @@ environment variable is arbitrary.
 .It Ev OPENSSL_CONF Ar file
 Load an OpenSSL configuration file on startup. The file can be used as part of
 a FIPS mode configuration.
+If the variable is set to an empty value, Node.js starts without loading any
+OpenSSL configuration file. This is a way past a default configuration file
+that exists but cannot be read, for example when \fB/etc/ssl\fR is not accessible
+to the user Node.js runs as, which is otherwise fatal at startup. No
+configuration is applied in that case, including any FIPS mode setup the
+file would have performed.
 If the \fB--openssl-config\fR command-line option is used, the environment
-variable is ignored.
+variable is ignored, and an empty value has no effect.
 .
 .It Ev SSL_CERT_DIR Ar dir
 If \fB--use-openssl-ca\fR is enabled, or if \fB--use-system-ca\fR is enabled on
diff --git a/test/parallel/test-openssl-unreadable-config.js b/test/parallel/test-openssl-unreadable-config.js
new file mode 100644
index 000000000000..99681e0ecba0
--- /dev/null
+++ b/test/parallel/test-openssl-unreadable-config.js
@@ -0,0 +1,40 @@
+'use strict';
+
+// A default OpenSSL configuration file that cannot be read is fatal, and an
+// empty OPENSSL_CONF is the documented way past it.
+// Refs: https://github.com/nodejs/node/issues/62230
+
+const common = require('../common');
+const assert = require('node:assert');
+const { spawnSync } = require('node:child_process');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+if (!common.isLinux)
+  common.skip('linux only');
+if (process.config.variables.node_shared_openssl)
+  common.skip('shared openssl may read a different configuration file');
+
+// Replace /etc/ssl with an empty tmpfs in a private mount namespace, where
+// openssl.cnf is a symlink loop: opening it then fails with ELOOP instead of
+// ENOENT, which OpenSSL ignores on its own. The namespace goes away with the
+// process, so the host /etc/ssl is left alone.
+const setup = 'mount -t tmpfs tmpfs /etc/ssl && ln -s openssl.cnf /etc/ssl/openssl.cnf';
+
+if (spawnSync('unshare', ['-Urm', 'sh', '-c', setup]).status !== 0)
+  common.skip('cannot set up an unprivileged user and mount namespace');
+
+function run(env) {
+  return spawnSync(
+    'unshare',
+    ['-Urm', 'sh', '-c', `${setup} && exec "$0" -p 42`, process.execPath],
+    { encoding: 'utf8', env: { ...process.env, ...env } });
+}
+
+const failed = run({});
+assert.notStrictEqual(failed.status, 0);
+assert.match(failed.stderr, /OpenSSL configuration error/);
+
+const skipped = run({ OPENSSL_CONF: '' });
+assert.strictEqual(skipped.status, 0);
+assert.strictEqual(skipped.stdout.trim(), '42');

From 101a215472bf47d97c9db161fb318a376cac66b4 Mon Sep 17 00:00:00 2001
From: Mert Can Altin <mertgold60@gmail.com>
Date: Fri, 21 Aug 2026 20:06:02 +0300
Subject: [PATCH 275/344] src: use simdutf for two-byte utf8 conversion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Mert Can Altin <mertgold60@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62248
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 benchmark/util/utf8-value.js | 25 +++++++++++++++++++++++++
 src/util.cc                  | 17 ++++++++++++-----
 2 files changed, 37 insertions(+), 5 deletions(-)
 create mode 100644 benchmark/util/utf8-value.js

diff --git a/benchmark/util/utf8-value.js b/benchmark/util/utf8-value.js
new file mode 100644
index 000000000000..bc6101e74e51
--- /dev/null
+++ b/benchmark/util/utf8-value.js
@@ -0,0 +1,25 @@
+'use strict';
+
+const common = require('../common.js');
+
+const bench = common.createBenchmark(main, {
+  type: ['ascii', 'two_bytes', 'three_bytes', 'mixed'],
+  n: [5e6],
+});
+
+const urls = {
+  ascii: 'https://example.com/path/to/resource?query=value&foo=bar',
+  two_bytes: 'https://example.com/yol/türkçe/içerik?sağlık=değer',
+  three_bytes: 'https://example.com/路径/资源?查询=值&名称=数据',
+  mixed: 'https://example.com/hello/世界/path?name=değer&key=数据',
+};
+
+function main({ n, type }) {
+  const str = urls[type];
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    URL.canParse(str);
+  }
+  bench.end(n);
+}
diff --git a/src/util.cc b/src/util.cc
index ce45c1ad4ede..15cbb202c9a6 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -121,13 +121,20 @@ static void MakeUtf8String(Isolate* isolate,
     return;
   }
 
-  // Add +1 for null termination.
-  size_t storage = (3 * value_length) + 1;
+  auto const_char16 = reinterpret_cast<const char16_t*>(value_view.data16());
+  size_t storage = static_cast<size_t>(value_length) * 3 + 1;
   target->AllocateSufficientStorage(storage);
 
-  size_t length = string->WriteUtf8V2(
-      isolate, target->out(), storage, String::WriteFlags::kReplaceInvalidUtf8);
-  target->SetLengthAndZeroTerminate(length);
+  size_t actual_length =
+      simdutf::convert_utf16_to_utf8(const_char16, value_length, target->out());
+  if (actual_length == 0) {
+    actual_length =
+        string->WriteUtf8V2(isolate,
+                            target->out(),
+                            storage,
+                            String::WriteFlags::kReplaceInvalidUtf8);
+  }
+  target->SetLengthAndZeroTerminate(actual_length);
 }
 
 Utf8Value::Utf8Value(Isolate* isolate, Local<Value> value) {

From 1ad7ca310afc7dad38f49b0d3f9d3b59b8f3d6a2 Mon Sep 17 00:00:00 2001
From: Paul Bouchon <mail@bitpshr.net>
Date: Mon, 20 Jul 2026 23:10:59 -0400
Subject: [PATCH 276/344] test_runner: restore directory search for --test

Passing a directory to `node --test` (e.g. `node --test tests`) matched
the directory itself as a glob pattern and then tried to run it as a
test file, failing with MODULE_NOT_FOUND. Before glob patterns were
supported, a directory argument was searched for test files within it.

Expand a pattern that resolves to a directory into a search for the
default test files inside it. Despite the report framing this as
Windows-only, it reproduces on every platform: it is a plain
regression from when directory arguments stopped being searched.

Fixes: https://github.com/nodejs/node/issues/64555
Signed-off-by: Paul Bouchon <mail@bitpshr.net>
PR-URL: https://github.com/nodejs/node/pull/64637
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 lib/internal/test_runner/runner.js | 19 +++++++++++++++++++
 test/parallel/test-runner-cli.js   | 21 +++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/lib/internal/test_runner/runner.js b/lib/internal/test_runner/runner.js
index 49ef9cb465b4..59862716a28b 100644
--- a/lib/internal/test_runner/runner.js
+++ b/lib/internal/test_runner/runner.js
@@ -19,6 +19,7 @@ const {
   ObjectAssign,
   PromisePrototypeThen,
   PromiseWithResolvers,
+  RegExpPrototypeSymbolReplace,
   SafeMap,
   SafePromiseAll,
   SafePromiseAllReturnVoid,
@@ -35,6 +36,7 @@ const {
 } = primordials;
 
 const { spawn } = require('child_process');
+const { statSync } = require('fs');
 const { finished } = require('internal/streams/end-of-stream');
 const { availableParallelism } = require('os');
 const { resolve, sep, isAbsolute } = require('path');
@@ -154,6 +156,23 @@ function createTestFileList(patterns, cwd) {
   const hasUserSuppliedPattern = patterns != null;
   if (!patterns || patterns.length === 0) {
     patterns = [kDefaultPattern];
+  } else {
+    patterns = ArrayPrototypeMap(patterns, (pattern) => {
+      // A directory argument is expanded to search for the default test files
+      // within it, matching the behavior from before glob patterns were
+      // supported. Glob patterns always use forward slashes, so a trailing
+      // path separator (of either kind) is stripped before appending.
+      const resolved = isAbsolute(pattern) ? pattern : resolve(cwd, pattern);
+      try {
+        if (statSync(resolved).isDirectory()) {
+          return `${RegExpPrototypeSymbolReplace(/[\\/]+$/, pattern, '')}/${kDefaultPattern}`;
+        }
+      } catch {
+        // Not a directory or not accessible; leave the pattern as-is so the
+        // existing "Could not find" handling still applies.
+      }
+      return pattern;
+    });
   }
   const glob = new Glob(patterns, {
     __proto__: null,
diff --git a/test/parallel/test-runner-cli.js b/test/parallel/test-runner-cli.js
index f563d67d1a9a..0702c5c1500c 100644
--- a/test/parallel/test-runner-cli.js
+++ b/test/parallel/test-runner-cli.js
@@ -62,6 +62,27 @@ for (const isolation of ['none', 'process']) {
     assert.doesNotMatch(stdout, /ok 4 - this should pass/);
   }
 
+  {
+    // A directory argument is searched for the default test files within it,
+    // both bare and with a trailing separator.
+    // Refs: https://github.com/nodejs/node/issues/64555
+    for (const dir of ['matching-patterns', 'matching-patterns/']) {
+      const args = ['--test', '--test-reporter=tap',
+                    '--no-experimental-strip-types',
+                    `--test-isolation=${isolation}`, dir];
+      const child = spawnSync(process.execPath, args, { cwd: testFixtures });
+
+      assert.strictEqual(child.status, 0);
+      assert.strictEqual(child.signal, null);
+      assert.strictEqual(child.stderr.toString(), '');
+      const stdout = child.stdout.toString();
+
+      assert.match(stdout, /ok 1 - this should pass/);
+      assert.match(stdout, /ok 2 - this should pass/);
+      assert.match(stdout, /ok 3 - this should pass/);
+    }
+  }
+
   {
     // Should match files with "-test.(c|m)(t|j)s" suffix when typescript support is enabled
     const args = ['--test', '--test-reporter=tap', '--no-warnings',

From 797ef40d23609314ba0266cd87d80f8c24dd07ff Mon Sep 17 00:00:00 2001
From: Maruthan G <maruthang4@gmail.com>
Date: Sat, 25 Apr 2026 12:49:32 +0530
Subject: [PATCH 277/344] test_runner: mock dual-package with conditional
 exports

When `mock.module()` targets a package whose `exports` field maps
`import` and `require` to different files, the ESM resolver and the
CJS resolver disagree on the resolved path. Only the ESM path was
registered in `mockMap`, so `require()` of the mocked specifier
bypassed the mock and loaded the real CJS module.

Resolve the specifier through `Module._resolveFilename` from the
caller's directory in addition to the existing ESM resolution. When
the two paths differ, register the CJS path as a second key in
`mockMap` and invalidate `Module._cache[cjsPath]`, restoring it on
`restore()`. Single-resolution packages keep their existing behavior.

Fixes: https://github.com/nodejs/node/issues/58231
Signed-off-by: Maruthan G <maruthang4@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62943
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Jacob Smith <jacob@frende.me>
---
 lib/internal/test_runner/mock/mock.js         | 86 +++++++++++++++++++
 test/fixtures/test-runner/mock-nm-dual-pkg.js | 32 +++++++
 .../dual-pkg-with-exports/index.cjs           |  5 ++
 .../dual-pkg-with-exports/index.js            |  2 +
 .../dual-pkg-with-exports/package.json        | 12 +++
 .../parallel/test-runner-mock-dual-package.js | 36 ++++++++
 6 files changed, 173 insertions(+)
 create mode 100644 test/fixtures/test-runner/mock-nm-dual-pkg.js
 create mode 100644 test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.cjs
 create mode 100644 test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.js
 create mode 100644 test/fixtures/test-runner/node_modules/dual-pkg-with-exports/package.json
 create mode 100644 test/parallel/test-runner-mock-dual-package.js

diff --git a/lib/internal/test_runner/mock/mock.js b/lib/internal/test_runner/mock/mock.js
index 970356bcae3a..4ac1e0a7e0b6 100644
--- a/lib/internal/test_runner/mock/mock.js
+++ b/lib/internal/test_runner/mock/mock.js
@@ -20,6 +20,7 @@ const {
   ReflectConstruct,
   ReflectGet,
   SafeMap,
+  StringPrototypeIncludes,
   StringPrototypeSlice,
   StringPrototypeStartsWith,
 } = primordials;
@@ -207,6 +208,7 @@ class MockModuleContext {
     baseURL,
     cache,
     caller,
+    cjsPath,
     format,
     fullPath,
     moduleExports,
@@ -222,12 +224,25 @@ class MockModuleContext {
 
     sharedState.mockMap.set(baseURL, config);
     sharedState.mockMap.set(fullPath, config);
+    // For dual packages (e.g., a package with a "exports" field that exposes
+    // both ESM and CJS entry points), the file selected by the ESM resolver
+    // (used to compute fullPath) may differ from the one selected by CJS
+    // require(). Register the CJS-resolved path so that require() also picks
+    // up the mock. See https://github.com/nodejs/node/issues/58231.
+    if (cjsPath !== null && cjsPath !== fullPath) {
+      sharedState.mockMap.set(cjsPath, config);
+    }
 
     this.#sharedState = sharedState;
     this.#restore = {
       __proto__: null,
       baseURL,
       cached: fullPath in Module._cache,
+      cjsPath,
+      cjsCached: cjsPath !== null && cjsPath !== fullPath &&
+        cjsPath in Module._cache,
+      cjsValue: cjsPath !== null && cjsPath !== fullPath ?
+        Module._cache[cjsPath] : undefined,
       format,
       fullPath,
       value: Module._cache[fullPath],
@@ -257,6 +272,9 @@ class MockModuleContext {
     }
 
     delete Module._cache[fullPath];
+    if (cjsPath !== null && cjsPath !== fullPath) {
+      delete Module._cache[cjsPath];
+    }
     sharedState.mockExports.set(baseURL, {
       __proto__: null,
       moduleExports,
@@ -276,6 +294,14 @@ class MockModuleContext {
       Module._cache[this.#restore.fullPath] = this.#restore.value;
     }
 
+    if (this.#restore.cjsPath !== null &&
+        this.#restore.cjsPath !== this.#restore.fullPath) {
+      delete Module._cache[this.#restore.cjsPath];
+      if (this.#restore.cjsCached) {
+        Module._cache[this.#restore.cjsPath] = this.#restore.cjsValue;
+      }
+    }
+
     const mock = mocks.get(this.#restore.baseURL);
 
     if (mock !== undefined) {
@@ -285,6 +311,10 @@ class MockModuleContext {
 
     this.#sharedState.mockMap.delete(this.#restore.baseURL);
     this.#sharedState.mockMap.delete(this.#restore.fullPath);
+    if (this.#restore.cjsPath !== null &&
+        this.#restore.cjsPath !== this.#restore.fullPath) {
+      this.#sharedState.mockMap.delete(this.#restore.cjsPath);
+    }
     this.#restore = undefined;
   }
 }
@@ -680,11 +710,19 @@ class MockTracker {
 
     const fullPath = StringPrototypeStartsWith(url, 'file://') ?
       fileURLToPath(url) : null;
+    // For dual packages, the ESM resolver may return a different file than
+    // CJS require() would for the same specifier (e.g., when a package's
+    // "exports" field points to different files for the "import" and
+    // "require" conditions). Compute the CJS-resolved path so that
+    // require() of a mocked module also picks up the mock.
+    // See https://github.com/nodejs/node/issues/58231.
+    const cjsPath = resolveAsCJS(mockSpecifier, caller, fullPath);
     const ctx = new MockModuleContext({
       __proto__: null,
       baseURL: baseURL.href,
       cache,
       caller,
+      cjsPath,
       format,
       fullPath,
       moduleExports,
@@ -987,6 +1025,54 @@ function cjsMockModuleLoad(request, parent, isMain) {
   return modExports;
 }
 
+// Resolve `specifier` using CJS resolution rules so that mocks for dual
+// packages (e.g., a package whose "exports" field points to different files
+// for the "import" and "require" conditions) also intercept require().
+// Returns an absolute file path on success, or null when the specifier cannot
+// be resolved as CJS (for example, when the package is ESM-only or when it is
+// a non-file URL such as data: or node:).
+function resolveAsCJS(specifier, callerURL, esmFullPath) {
+  if (isBuiltin(specifier) ||
+      StringPrototypeStartsWith(specifier, 'node:') ||
+      StringPrototypeStartsWith(specifier, 'data:')) {
+    return null;
+  }
+
+  let parentPath;
+  if (StringPrototypeStartsWith(callerURL, 'file://')) {
+    try {
+      parentPath = fileURLToPath(callerURL);
+    } catch {
+      return null;
+    }
+  } else {
+    return null;
+  }
+
+  try {
+    const tmpModule = new Module(parentPath, null);
+    tmpModule.paths = _nodeModulePaths(parentPath);
+    const resolved = _resolveFilename(specifier, tmpModule, false);
+    if (typeof resolved !== 'string') {
+      return null;
+    }
+    // If the resolution matches what the ESM resolver picked, there is
+    // nothing additional to register.
+    if (resolved === esmFullPath) {
+      return esmFullPath;
+    }
+    // If the resolution returned something that is not a filesystem path
+    // (e.g., a builtin id without a slash or backslash), ignore it.
+    if (!StringPrototypeIncludes(resolved, '/') &&
+        !StringPrototypeIncludes(resolved, '\\')) {
+      return null;
+    }
+    return resolved;
+  } catch {
+    return null;
+  }
+}
+
 function validateStringOrSymbol(value, name) {
   if (typeof value !== 'string' && typeof value !== 'symbol') {
     throw new ERR_INVALID_ARG_TYPE(name, ['string', 'symbol'], value);
diff --git a/test/fixtures/test-runner/mock-nm-dual-pkg.js b/test/fixtures/test-runner/mock-nm-dual-pkg.js
new file mode 100644
index 000000000000..3686373c6032
--- /dev/null
+++ b/test/fixtures/test-runner/mock-nm-dual-pkg.js
@@ -0,0 +1,32 @@
+'use strict';
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fixture = 'dual-pkg-with-exports';
+
+test('mock node_modules dual package with conditional exports', async (t) => {
+  const mock = t.mock.module(fixture, {
+    namedExports: { add(x, y) { return 1 + x + y; }, flavor: 'mocked' },
+  });
+
+  // CJS require should pick up the mock even though the package's "exports"
+  // field maps the "require" condition to a different file than "import".
+  const cjsImpl = require(fixture);
+  assert.strictEqual(cjsImpl.add(4, 5), 10);
+  assert.strictEqual(cjsImpl.flavor, 'mocked');
+
+  // ESM dynamic import should also pick up the mock.
+  const esmImpl = await import(fixture);
+  assert.strictEqual(esmImpl.add(4, 5), 10);
+  assert.strictEqual(esmImpl.flavor, 'mocked');
+
+  mock.restore();
+
+  // After restore, both module systems should see the original exports.
+  const restoredCjs = require(fixture);
+  assert.strictEqual(restoredCjs.add(4, 5), 9);
+  assert.strictEqual(restoredCjs.flavor, 'cjs');
+
+  const restoredEsm = await import(fixture);
+  assert.strictEqual(restoredEsm.add(4, 5), 9);
+  assert.strictEqual(restoredEsm.flavor, 'esm');
+});
diff --git a/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.cjs b/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.cjs
new file mode 100644
index 000000000000..a8085de75d60
--- /dev/null
+++ b/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.cjs
@@ -0,0 +1,5 @@
+'use strict';
+const add = (x, y) => x + y;
+const flavor = 'cjs';
+
+module.exports = { add, flavor };
diff --git a/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.js b/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.js
new file mode 100644
index 000000000000..f9e72d7f62fb
--- /dev/null
+++ b/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/index.js
@@ -0,0 +1,2 @@
+export const add = (x, y) => x + y;
+export const flavor = 'esm';
diff --git a/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/package.json b/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/package.json
new file mode 100644
index 000000000000..e225302a770e
--- /dev/null
+++ b/test/fixtures/test-runner/node_modules/dual-pkg-with-exports/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "dual-pkg-with-exports",
+  "type": "module",
+  "main": "index.js",
+  "exports": {
+    ".": {
+      "import": "./index.js",
+      "require": "./index.cjs"
+    }
+  },
+  "private": true
+}
diff --git a/test/parallel/test-runner-mock-dual-package.js b/test/parallel/test-runner-mock-dual-package.js
new file mode 100644
index 000000000000..f96837d2cebf
--- /dev/null
+++ b/test/parallel/test-runner-mock-dual-package.js
@@ -0,0 +1,36 @@
+'use strict';
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('registering customization hooks in Workers does not work');
+}
+
+const fixtures = require('../common/fixtures');
+const assert = require('node:assert');
+const { test } = require('node:test');
+
+// Regression test for https://github.com/nodejs/node/issues/58231
+// When a dual package exposes both ESM and CJS entry points via the
+// "exports" field with "import"/"require" conditions, the ESM resolver
+// picks one file (e.g. index.js) and CJS require() picks another
+// (e.g. index.cjs). mock.module() must intercept both so that require()
+// of the mocked module does not return the original CJS file.
+test('mock.module intercepts dual package require with conditional exports',
+     async () => {
+       const cwd = fixtures.path('test-runner');
+       const fixture = fixtures.path('test-runner', 'mock-nm-dual-pkg.js');
+       const args = ['--experimental-test-module-mocks', fixture];
+       const {
+         code,
+         stdout,
+         signal,
+       } = await common.spawnPromisified(process.execPath, args, { cwd });
+
+       assert.strictEqual(signal, null);
+       assert.strictEqual(code, 0,
+                          'child process exited with non-zero status\n' +
+                          `stdout:\n${stdout}`);
+       assert.match(stdout, /pass 1/);
+       assert.match(stdout, /fail 0/);
+     });

From 58213628196d4c2b0cb5a15c341733014b042af2 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 21 Aug 2026 23:53:19 +0200
Subject: [PATCH 278/344] module: do not split a portable compile cache by uid

A portable compile cache is meant to be reused wherever the same module
layout is found, which includes being generated once (at build time,
say) and shipped read-only with an application for whoever runs it. On
platforms with uids the cache subdirectory is suffixed with the uid of
the user who created it, so such a cache is only ever found by that one
user. Omit the suffix in portable mode: a user who cannot write to the
directory still reads it, and a failed write is only a cache miss.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65293
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/cli.md                                |  5 +++--
 doc/api/module.md                             |  8 ++++++++
 doc/node.1                                    |  5 +++--
 src/compile_cache.cc                          | 20 +++++++++++++------
 .../test-compile-cache-api-portable.js        |  8 ++++++++
 5 files changed, 36 insertions(+), 10 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index b2f6db700961..40a61c90ac26 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -3704,8 +3704,9 @@ Enable the [module compile cache][] for the Node.js instance. See the documentat
 
 ### `NODE_COMPILE_CACHE_PORTABLE=1`
 
-When set to 1, the [module compile cache][]  can be reused across different directory
-locations as long as the module layout relative to the cache directory remains the same.
+When set to 1, the [module compile cache][] can be reused across different directory
+locations as long as the module layout relative to the cache directory remains the same,
+and by any user (the cache subdirectory is not suffixed with the creating user's uid).
 
 ### `NODE_DEBUG=module[,…]`
 
diff --git a/doc/api/module.md b/doc/api/module.md
index 6af6f391a5db..7d2a4c89c1c8 100644
--- a/doc/api/module.md
+++ b/doc/api/module.md
@@ -405,6 +405,14 @@ to the cache directory remains the same. This would be done on a best-effort bas
 Node.js cannot compute the location of a module relative to the cache directory, the module
 will not be cached.
 
+A portable cache is also not split by user: on platforms with uids the
+cache subdirectory of a non-portable cache is suffixed with the uid of the
+user who created it, so it is only found by that user, while a portable
+cache uses the same subdirectory for every user. This lets a cache generated
+once (for example at build time, then shipped read-only with an application)
+be read by whoever runs the code; a user who cannot write to the directory
+still reads it, and a failed write only means the module is compiled again.
+
 There are two ways to enable the portable mode:
 
 1. Using the portable option in [`module.enableCompileCache()`][]:
diff --git a/doc/node.1 b/doc/node.1
index c9b925a23974..2bb02f81b819 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -1858,8 +1858,9 @@ Enable the module compile cache for the Node.js instance. See the documentation
 module compile cache for details.
 .
 .It Ev NODE_COMPILE_CACHE_PORTABLE Ar 1
-When set to 1, the module compile cache  can be reused across different directory
-locations as long as the module layout relative to the cache directory remains the same.
+When set to 1, the module compile cache can be reused across different directory
+locations as long as the module layout relative to the cache directory remains the same,
+and by any user (the cache subdirectory is not suffixed with the creating user's uid).
 .
 .It Ev NODE_DEBUG Ar module[,…]
 \fB','\fR-separated list of core modules that should print debug information.
diff --git a/src/compile_cache.cc b/src/compile_cache.cc
index dd097acd86f8..f24a26e9bab8 100644
--- a/src/compile_cache.cc
+++ b/src/compile_cache.cc
@@ -44,16 +44,23 @@ uint32_t GetHash(const char* data, size_t size) {
   return crc32(crc, reinterpret_cast<const Bytef*>(data), size);
 }
 
-std::string GetCacheVersionTag() {
+std::string GetCacheVersionTag(EnableOption option) {
+  std::string tag = std::string(NODE_VERSION) + '-' + std::string(NODE_ARCH) +
+                    '-' + Uint32ToHex(ScriptCompiler::CachedDataVersionTag());
+#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
   // On platforms where uids are available, use different folders for
   // different users to avoid cache miss due to permission incompatibility.
   // On platforms where uids are not available, bare with the cache miss.
   // This should be fine on Windows, as there local directories tend to be
   // user-specific.
-  std::string tag = std::string(NODE_VERSION) + '-' + std::string(NODE_ARCH) +
-                    '-' + Uint32ToHex(ScriptCompiler::CachedDataVersionTag());
-#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
-  tag += '-' + std::to_string(getuid());
+  // A portable cache is meant to be reused wherever the same layout is
+  // found, including by other users (e.g. a cache generated at build time
+  // and shipped read-only with an application), so it is not split by uid:
+  // a user who cannot write to it still reads it, and a failed write is
+  // only a cache miss.
+  if (option != EnableOption::PORTABLE) {
+    tag += '-' + std::to_string(getuid());
+  }
 #endif
   return tag;
 }
@@ -532,11 +539,12 @@ CompileCacheHandler::CompileCacheHandler(Environment* env)
 // Directory structure:
 // - Compile cache directory (from NODE_COMPILE_CACHE)
 //   - $NODE_VERSION-$ARCH-$CACHE_DATA_VERSION_TAG-$UID
+//     ($UID is omitted for a portable cache)
 //     - $FILENAME_AND_MODULE_TYPE_HASH.cache: a hash of filename + module type
 CompileCacheEnableResult CompileCacheHandler::Enable(Environment* env,
                                                      const std::string& dir,
                                                      EnableOption option) {
-  std::string cache_tag = GetCacheVersionTag();
+  std::string cache_tag = GetCacheVersionTag(option);
   std::string absolute_cache_dir_base = PathResolve(env, {dir});
   std::string cache_dir_with_tag =
       absolute_cache_dir_base + kPathSeparator + cache_tag;
diff --git a/test/parallel/test-compile-cache-api-portable.js b/test/parallel/test-compile-cache-api-portable.js
index 3c7c84b32202..620b3bdce875 100644
--- a/test/parallel/test-compile-cache-api-portable.js
+++ b/test/parallel/test-compile-cache-api-portable.js
@@ -57,6 +57,14 @@ const NODE_TEST_COMPILE_CACHE_OPTIONS = JSON.stringify({ directory: cacheRel, po
   );
 }
 
+// The cache subdirectory of a portable cache is not suffixed with the uid,
+// so a cache generated by one user is found by another.
+{
+  const [tag] = fs.readdirSync(path.join(workDir, cacheRel));
+  // $NODE_VERSION-$ARCH-$CACHE_DATA_VERSION_TAG, with no -$UID.
+  assert.match(tag, new RegExp(`^${process.version}-${process.arch}-[0-9a-f]+$`));
+}
+
 // Second run — moved directory, but same relative cache path
 {
   const movedWorkDir = `${workDir}_moved`;

From 6ec735c91018e691999c9daca74c3a978e04e500 Mon Sep 17 00:00:00 2001
From: Trevor Burnham <trevorburnham@gmail.com>
Date: Fri, 21 Aug 2026 18:54:43 -0400
Subject: [PATCH 279/344] sqlite: reject reentry while binding parameters

c4b755ee002 tracks the statements currently being stepped and rejects
reentry into them, but the guard is established inside the execution
helpers, after the entry point has already reset the statement and
bound its parameters. Binding reads properties off the supplied
object, so a named-parameter getter runs JavaScript in that window.
Reentering the same statement there resets it a second time and, for
iterate(), hands out a second iterator; both iterators record the
same reset generation, so neither is invalidated and they interleave
rows from one virtual machine.

Establish the guard at the four StatementSync entry points instead,
before the reset, so it spans binding as well as stepping. The
existing guards inside the helpers are left in place; the stepping
set is a stack, so the nested acquisition is balanced.

Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/65294
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/node_sqlite.cc                            |  4 ++
 .../test-sqlite-statement-binding-reentry.js  | 63 +++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 test/parallel/test-sqlite-statement-binding-reentry.js

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 0ce54b6d36bc..5775824a1f67 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3381,6 +3381,7 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
   THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
   THROW_AND_RETURN_IF_STEPPING(env, stmt);
   Isolate* isolate = env->isolate();
+  SteppingStatementGuard stepping(stmt->db_.get(), stmt->statement_.get());
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3408,6 +3409,7 @@ void StatementSync::Iterate(const FunctionCallbackInfo<Value>& args) {
       env, stmt->IsFinalized(), "statement has been finalized");
   THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
   THROW_AND_RETURN_IF_STEPPING(env, stmt);
+  SteppingStatementGuard stepping(stmt->db_.get(), stmt->statement_.get());
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3433,6 +3435,7 @@ void StatementSync::Get(const FunctionCallbackInfo<Value>& args) {
       env, stmt->IsFinalized(), "statement has been finalized");
   THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
   THROW_AND_RETURN_IF_STEPPING(env, stmt);
+  SteppingStatementGuard stepping(stmt->db_.get(), stmt->statement_.get());
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3454,6 +3457,7 @@ void StatementSync::Run(const FunctionCallbackInfo<Value>& args) {
       env, stmt->IsFinalized(), "statement has been finalized");
   THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
   THROW_AND_RETURN_IF_STEPPING(env, stmt);
+  SteppingStatementGuard stepping(stmt->db_.get(), stmt->statement_.get());
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
diff --git a/test/parallel/test-sqlite-statement-binding-reentry.js b/test/parallel/test-sqlite-statement-binding-reentry.js
new file mode 100644
index 000000000000..052803e72a88
--- /dev/null
+++ b/test/parallel/test-sqlite-statement-binding-reentry.js
@@ -0,0 +1,63 @@
+'use strict';
+
+const { skipIfSQLiteMissing, mustCall } = require('../common');
+skipIfSQLiteMissing();
+const assert = require('node:assert');
+const { test } = require('node:test');
+const { DatabaseSync } = require('node:sqlite');
+
+const reentryError = {
+  code: 'ERR_INVALID_STATE',
+  message: 'statement is already being executed',
+};
+
+// Binding a named parameter reads properties off the supplied object, so a
+// getter runs JavaScript after the statement has been reset but before it is
+// stepped. Reentering the same statement there resets it a second time and
+// hands out a second iterator over one virtual machine.
+for (const method of ['all', 'get', 'run', 'iterate']) {
+  test(`${method}() reentry during parameter binding is rejected`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER);
+      INSERT INTO data VALUES (1), (2), (3);
+    `);
+
+    let statement;
+    const invoke = (params) => (method === 'iterate' ?
+      [...statement.iterate(params)] :
+      statement[method](params));
+    const reenter = mustCall(() => {
+      assert.throws(() => invoke({ $min: 2 }), reentryError);
+      return 1;
+    });
+    const params = { get $min() { return reenter(); } };
+
+    statement = db.prepare('SELECT value FROM data WHERE value >= $min');
+    invoke(params);
+  });
+}
+
+test('two iterators cannot share one virtual machine', () => {
+  const db = new DatabaseSync(':memory:');
+  db.exec(`
+    CREATE TABLE data (value INTEGER);
+    INSERT INTO data VALUES (1), (2), (3);
+  `);
+
+  const statement = db.prepare('SELECT value FROM data WHERE value >= $min');
+  let inner;
+  const reenter = mustCall(() => {
+    assert.throws(() => {
+      inner = statement.iterate({ $min: 1 });
+    }, reentryError);
+    return 1;
+  });
+  const params = { get $min() { return reenter(); } };
+
+  assert.deepStrictEqual(
+    [...statement.iterate(params)].map((row) => row.value),
+    [1, 2, 3],
+  );
+  assert.strictEqual(inner, undefined);
+});

From cce803b174ca6f19d0ce9274f0b5449b9ba14d87 Mon Sep 17 00:00:00 2001
From: Sylvester Keil <sylvester@keil.or.at>
Date: Sun, 15 Mar 2026 23:51:03 +0100
Subject: [PATCH 280/344] test_runner: use run options with isolation="none"

When using run() programatically with isolation="none",
testNamePatterns, testSkipPattersn, and only were ignored.
This combination of options only worked when set via CLI flags,
because parseCommandLine() is still used to seed globalOptions.

Fixes: https://github.com/nodejs/node/issues/57399
Signed-off-by: Sylvester Keil <sylvester@keil.or.at>
PR-URL: https://github.com/nodejs/node/pull/62269
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
---
 lib/internal/test_runner/runner.js            | 12 ++++++
 .../test-runner-isolation-none.mjs            | 32 ++++++++++++++
 test/parallel/test-runner-run.mjs             | 42 +++++++++++++++++++
 3 files changed, 86 insertions(+)
 create mode 100644 test/fixtures/test-runner/test-runner-isolation-none.mjs

diff --git a/lib/internal/test_runner/runner.js b/lib/internal/test_runner/runner.js
index 59862716a28b..da3bd744ffc1 100644
--- a/lib/internal/test_runner/runner.js
+++ b/lib/internal/test_runner/runner.js
@@ -982,6 +982,18 @@ function run(options = kEmptyObject) {
     testTagFilters,
   };
 
+  if (isolation === 'none') {
+    if (testNamePatterns != null) {
+      globalOptions.testNamePatterns = testNamePatterns;
+    }
+    if (testSkipPatterns != null) {
+      globalOptions.testSkipPatterns = testSkipPatterns;
+    }
+    if (only != null) {
+      globalOptions.only = only;
+    }
+  }
+
   const root = createTestTree(rootTestOptions, globalOptions);
   let testFiles = files ?? createTestFileList(globPatterns, cwd);
   const { isTestRunner } = globalOptions;
diff --git a/test/fixtures/test-runner/test-runner-isolation-none.mjs b/test/fixtures/test-runner/test-runner-isolation-none.mjs
new file mode 100644
index 000000000000..03a32fd6ad57
--- /dev/null
+++ b/test/fixtures/test-runner/test-runner-isolation-none.mjs
@@ -0,0 +1,32 @@
+import { run } from 'node:test';
+import { tap } from 'node:test/reporters';
+import { parseArgs } from 'node:util';
+
+const {
+  values,
+} = parseArgs({
+  args: process.argv.slice(2),
+  options: {
+    file: { type: 'string' },
+    only: { type: 'boolean' },
+    'name-pattern': { type: 'string' },
+    'skip-pattern': { type: 'string' },
+  },
+});
+
+const opts = {
+  isolation: 'none',
+  files: [values.file],
+};
+
+if (values.only) {
+  opts.only = true;
+}
+if (values['name-pattern']) {
+  opts.testNamePatterns = [new RegExp(values['name-pattern'])];
+}
+if (values['skip-pattern']) {
+  opts.testSkipPatterns = [new RegExp(values['skip-pattern'])];
+}
+
+run(opts).compose(tap).pipe(process.stdout);
\ No newline at end of file
diff --git a/test/parallel/test-runner-run.mjs b/test/parallel/test-runner-run.mjs
index c6b888432cf8..d1d384a522e2 100644
--- a/test/parallel/test-runner-run.mjs
+++ b/test/parallel/test-runner-run.mjs
@@ -870,6 +870,48 @@ describe('forceExit', () => {
   });
 });
 
+describe('with isolation="none"', () => {
+  const isolationNoneFixture = fixtures.path('test-runner', 'test-runner-isolation-none.mjs');
+
+  it('should pass only to children', async () => {
+    const child = await common.spawnPromisified(process.execPath, [
+      isolationNoneFixture,
+      '--file', join(testFixtures, 'test_only.js'),
+      '--only',
+    ]);
+
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+    assert.match(child.stdout, /ok 1 - this should be executed/);
+    assert.match(child.stdout, /# tests 1/);
+  });
+
+  it('should skip tests not matching testNamePatterns - RegExp', async () => {
+    const child = await common.spawnPromisified(process.execPath, [
+      isolationNoneFixture,
+      '--file', join(testFixtures, 'default-behavior/test/skip_by_name.cjs'),
+      '--name-pattern', 'executed',
+    ]);
+
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+    assert.match(child.stdout, /ok 1 - this should be executed/);
+    assert.match(child.stdout, /# tests 1/);
+  });
+
+  it('should skip tests matching testSkipPatterns - RegExp', async () => {
+    const child = await common.spawnPromisified(process.execPath, [
+      isolationNoneFixture,
+      '--file', join(testFixtures, 'default-behavior/test/skip_by_name.cjs'),
+      '--skip-pattern', 'skipped',
+    ]);
+
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+    assert.match(child.stdout, /ok 1 - this should be executed/);
+    assert.match(child.stdout, /# tests 1/);
+  });
+});
 
 // exitHandler doesn't run until after the tests / after hooks finish.
 process.on('exit', () => {

From 646221a4959819525979a9ce0dcfa9e617ef7963 Mon Sep 17 00:00:00 2001
From: Shivay-98 <shivay8306@gmail.com>
Date: Mon, 20 Jul 2026 21:39:29 -0700
Subject: [PATCH 281/344] net: handle undefined parent in _unrefTimer and
 _destroy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fix and approach are from #64491 by Shivay-98; this reopens it to
get it landed, since the original stalled awaiting requested changes.

`Socket.prototype._unrefTimer` and `Socket.prototype._destroy` both walk
the `_parent` chain with a strict `!== null` check. During connection
teardown a socket's `_parent` can be left `undefined` (for example a TLS
socket layered over another stream), so the loop steps onto `undefined`
and reads a property off it, throwing a TypeError:

    Cannot read properties of undefined (reading 'Symbol(timeout)')

from an uncaught I/O callback and crashing the process.

Using a nullish (`!= null`) check terminates the walk on both `null` and
`undefined`.

[petter@hightouch.io: apply the same fix to the identical loop in
`_destroy`, which the original regression test already exercised via
`destroy()`; add direct unit coverage for both paths.]

Fixes: https://github.com/nodejs/node/issues/64490
Refs: https://github.com/nodejs/node/pull/64491

Signed-off-by: Petter Häggholm <petter@hightouch.io>
PR-URL: https://github.com/nodejs/node/pull/64644
Fixes: https://github.com/nodejs/node/issues/64490
Refs: https://github.com/nodejs/node/pull/64491
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 lib/net.js                                    |  8 +++-
 ...est-net-socket-unref-timer-parent-chain.js | 25 ++++++++++++
 .../test-net-unref-timer-parent-undefined.js  | 39 +++++++++++++++++++
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-net-socket-unref-timer-parent-chain.js
 create mode 100644 test/parallel/test-net-unref-timer-parent-undefined.js

diff --git a/lib/net.js b/lib/net.js
index 55fc6ea843ce..36e1531a780c 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -736,7 +736,9 @@ ObjectSetPrototypeOf(Socket, stream.Duplex);
 
 // Refresh existing timeouts.
 Socket.prototype._unrefTimer = function _unrefTimer() {
-  for (let s = this; s !== null; s = s._parent) {
+  // `_parent` may be null; we use a loose `!= null` check in case external
+  // code sets it to undefined.
+  for (let s = this; s != null; s = s._parent) {
     if (s[kTimeout])
       s[kTimeout].refresh();
   }
@@ -1097,7 +1099,9 @@ Socket.prototype._destroy = function(exception, cb) {
 
   this.connecting = false;
 
-  for (let s = this; s !== null; s = s._parent) {
+  // `_parent` may be null; we use a loose `!= null` check in case external
+  // code sets it to undefined.
+  for (let s = this; s != null; s = s._parent) {
     clearTimeout(s[kTimeout]);
   }
 
diff --git a/test/parallel/test-net-socket-unref-timer-parent-chain.js b/test/parallel/test-net-socket-unref-timer-parent-chain.js
new file mode 100644
index 000000000000..36a88f1c158e
--- /dev/null
+++ b/test/parallel/test-net-socket-unref-timer-parent-chain.js
@@ -0,0 +1,25 @@
+'use strict';
+const common = require('../common');
+
+// Walking the `_parent` chain must stop on a nullish link, not only strict
+// `null`. During connection teardown a socket's `_parent` can be left
+// `undefined`, which previously caused `_unrefTimer()` and `_destroy()` to read
+// a property off `undefined` and throw.
+// Refs: https://github.com/nodejs/node/issues/64490
+
+const assert = require('assert');
+const net = require('net');
+
+{
+  const socket = new net.Socket();
+  socket._parent = undefined;
+  socket._unrefTimer();
+}
+
+{
+  const socket = new net.Socket();
+  socket._parent = undefined;
+  socket.on('error', common.mustNotCall());
+  socket.destroy();
+  assert.strictEqual(socket.destroyed, true);
+}
diff --git a/test/parallel/test-net-unref-timer-parent-undefined.js b/test/parallel/test-net-unref-timer-parent-undefined.js
new file mode 100644
index 000000000000..01e45e82f908
--- /dev/null
+++ b/test/parallel/test-net-unref-timer-parent-undefined.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+
+// A TLS socket whose `_parent` is left `undefined` during teardown must not
+// crash when reads land on it (`onStreamRead` -> `_unrefTimer`) or when it is
+// destroyed (`_destroy`). Both walk the `_parent` chain.
+// Refs: https://github.com/nodejs/node/issues/64490
+
+const options = {
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+};
+
+const server = tls.createServer(options, common.mustCall((conn) => {
+  setTimeout(() => conn.write('x'), 50);
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    client._parent = undefined;
+  }));
+
+  client.on('data', common.mustCall(() => {
+    server.close();
+    client.destroy();
+  }));
+
+  client.on('error', common.mustNotCall());
+}));

From b6852e2b96a4b19ef71b63cb83146f084e411584 Mon Sep 17 00:00:00 2001
From: sangwook <rewq5991@gmail.com>
Date: Sat, 22 Aug 2026 11:46:41 +0900
Subject: [PATCH 282/344] test: deflake test-net-listen-ipv6only

The test verified ipv6Only by connecting to the IPv4 side of an
ephemeral port and expecting ECONNREFUSED, but it never reserved that
IPv4 port. Under parallel execution another test could occupy it,
making the connection succeed instead of being refused.

Run the test sequentially with a fixed common.PORT so it no longer
competes with other tests for the same port, matching the fix already
applied to the sibling cluster variants.

Fixes: https://github.com/nodejs/node/issues/64172
Signed-off-by: sangwook <rewq5991@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64173
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/{parallel => sequential}/test-net-listen-ipv6only.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 rename test/{parallel => sequential}/test-net-listen-ipv6only.js (68%)

diff --git a/test/parallel/test-net-listen-ipv6only.js b/test/sequential/test-net-listen-ipv6only.js
similarity index 68%
rename from test/parallel/test-net-listen-ipv6only.js
rename to test/sequential/test-net-listen-ipv6only.js
index a329011bcc8a..c85f813bc08b 100644
--- a/test/parallel/test-net-listen-ipv6only.js
+++ b/test/sequential/test-net-listen-ipv6only.js
@@ -11,9 +11,13 @@ const net = require('net');
 
 const host = '::';
 const server = net.createServer();
+// Use a fixed port and run this test sequentially. The assertion below relies
+// on nothing else listening on the IPv4 side of the chosen port; with an
+// ephemeral port under parallel execution another test can occupy that IPv4
+// port, making the connection succeed instead of being refused.
 server.listen({
   host,
-  port: 0,
+  port: common.PORT,
   ipv6Only: true,
 }, common.mustCall(() => {
   const { port } = server.address();

From 1ad09f712a1f6530e1b5dec3654958120da55983 Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Sat, 22 Aug 2026 12:49:24 +0900
Subject: [PATCH 283/344] doc: fix broken GYP link in n-api.md

Replace the unavailable GYP website with the GYP documentation
preserved in the Chromium source repository.

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65413
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 doc/api/n-api.md | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/doc/api/n-api.md b/doc/api/n-api.md
index ed5433262977..a5571640624b 100644
--- a/doc/api/n-api.md
+++ b/doc/api/n-api.md
@@ -194,9 +194,8 @@ the native addon.
 
 #### node-gyp
 
-[node-gyp][] is a build system based on the [gyp-next][] fork of
-Google's [GYP][] tool and comes bundled with npm. GYP, and therefore node-gyp,
-requires that Python be installed.
+[node-gyp][] is a build system based on the [gyp-next][] tool and comes bundled with npm.
+node-gyp requires that Python be installed.
 
 Historically, node-gyp has been the tool of choice for building native
 addons. It has widespread adoption and documentation. However, some
@@ -6966,7 +6965,6 @@ the add-on's file name during loading.
 [ECMAScript Language Specification]: https://tc39.es/ecma262/
 [Error handling]: #error-handling
 [GCC]: https://gcc.gnu.org
-[GYP]: https://gyp.gsrc.io
 [GitHub releases]: https://help.github.com/en/github/administering-a-repository/about-releases
 [LLVM]: https://llvm.org
 [Native Abstractions for Node.js]: https://github.com/nodejs/nan

From eb1ebbb39ddf0e6afc3c7b2f66dc9f7ceb956c48 Mon Sep 17 00:00:00 2001
From: Richard Gibson <richard.gibson@gmail.com>
Date: Sat, 22 Aug 2026 01:07:59 -0400
Subject: [PATCH 284/344] util: fix formatting of functions returned from
 getters

Fixes: https://github.com/nodejs/node/issues/64838
Signed-off-by: Richard Gibson <richard.gibson@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64839
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/util/inspect.js       |  2 +-
 test/parallel/test-util-inspect.js | 22 ++++++++++++++--------
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index 193ae8524632..a9e49a65b628 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -2576,7 +2576,7 @@ function formatProperty(ctx, value, recurseTimes, key, type, desc,
         const tmp = FunctionPrototypeCall(desc.get, original);
         if (tmp === null) {
           str = `${s(`[${label}:`, sp)} ${s('null', 'null')}${s(']', sp)}`;
-        } else if (typeof tmp === 'object') {
+        } else if (typeof tmp === 'object' || typeof tmp === 'function') {
           str = `${s(`[${label}]`, sp)} ${formatValue(ctx, tmp, recurseTimes)}`;
         } else {
           const primitive = formatPrimitive(s, tmp, ctx);
diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
index 1e305f0a45fb..5d55240f03f3 100644
--- a/test/parallel/test-util-inspect.js
+++ b/test/parallel/test-util-inspect.js
@@ -2596,6 +2596,15 @@ assert.strictEqual(
       "'foobar', { x: 1 } },\n  inc: [Getter: NaN]\n}");
 }
 
+// Getter returning a function.
+// https://github.com/nodejs/node/issues/64838
+{
+  const obj = { get foo() { return function bar() {}; } };
+  assert.strictEqual(
+    inspect(obj, { getters: true }),
+    '{ foo: [Getter] [Function: bar] }');
+}
+
 // Property getter throwing an error.
 {
   const error = new Error('Oops');
@@ -3524,16 +3533,14 @@ assert.strictEqual(
       '\x1B[2mdef: \x1B[33m5\x1B[39m\x1B[22m }'
   );
 
-  assert.match(
+  assert.strictEqual(
     inspect(Object.getPrototypeOf(bar), { showHidden: true, getters: true }),
-    new RegExp('^' + RegExp.escape(
-      '<ref *1> Foo [Map] {\n' +
-      '  [constructor]: [class Bar extends Foo] {\n' +
+    '<ref *2> Foo [Map] {\n' +
+      '  [constructor]: <ref *1> [class Bar extends Foo] {\n' +
       '    [length]: 0,\n' +
       "    [name]: 'Bar',\n" +
-      '    [prototype]: [Circular *1],\n' +
-      '    [Symbol(Symbol.species)]: [Getter: <Inspection threw ' +
-      "(TypeError: Symbol.prototype.toString requires that 'this' be a Symbol") + '.*' + RegExp.escape(')>]\n' +
+      '    [prototype]: [Circular *2],\n' +
+      '    [Symbol(Symbol.species)]: [Getter] [Circular *1]\n' +
       '  },\n' +
       "  [xyz]: [Getter: 'YES!'],\n" +
       '  [Symbol(nodejs.util.inspect.custom)]: [Function: [nodejs.util.inspect.custom]] {\n' +
@@ -3543,7 +3550,6 @@ assert.strictEqual(
       '  [abc]: [Getter: true],\n' +
       '  [def]: [Getter/Setter: false]\n' +
       '}'
-    ) + '$', 's')
   );
 
   assert.strictEqual(

From 7670c81d993389b9f666bff9e6c43f5dc73d3c41 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sat, 22 Aug 2026 00:28:28 -0700
Subject: [PATCH 285/344] ffi: prefer canonical type names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document long type names as canonical and use them in examples.
Group alternative spellings separately in the documentation and
internal type maps while retaining support for every existing alias.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65417
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 doc/api/ffi.md                    | 75 +++++++++++++++++++------------
 lib/internal/ffi-shared-buffer.js | 34 +++++++-------
 lib/internal/ffi/fast-api.js      | 24 +++++-----
 src/ffi/fast.cc                   | 41 +++++++++--------
 src/ffi/types.cc                  | 35 +++++++--------
 5 files changed, 115 insertions(+), 94 deletions(-)

diff --git a/doc/api/ffi.md b/doc/api/ffi.md
index 54de34da7a18..fcb39d223f01 100644
--- a/doc/api/ffi.md
+++ b/doc/api/ffi.md
@@ -63,22 +63,40 @@ Supported type names:
 
 * `void`
 * `char`
-* `i8`, `int8`
-* `u8`, `uint8`, `bool`
-* `i16`, `int16`
-* `u16`, `uint16`
-* `i32`, `int32`
-* `u32`, `uint32`
-* `i64`, `int64`
-* `u64`, `uint64`
-* `f32`, `float`, `float32`
-* `f64`, `double`, `float64`
-* `pointer`, `ptr`
-* `string`, `str`
+* `int8`
+* `uint8`
+* `int16`
+* `uint16`
+* `int32`
+* `uint32`
+* `int64`
+* `uint64`
+* `float32`
+* `float64`
+* `pointer`
+* `string`
 * `buffer`
 * `arraybuffer`
 * `function`
 
+<details>
+<summary>Alternative spellings</summary>
+
+* `i8` for `int8`
+* `u8` and `bool` for `uint8`
+* `i16` for `int16`
+* `u16` for `uint16`
+* `i32` for `int32`
+* `u32` for `uint32`
+* `i64` for `int64`
+* `u64` for `uint64`
+* `f32` and `float` for `float32`
+* `f64` and `double` for `float64`
+* `ptr` for `pointer`
+* `str` for `string`
+
+</details>
+
 These type names are also exposed as constants on `ffi.types`:
 
 * `ffi.types.VOID` = `'void'`
@@ -116,15 +134,15 @@ through reentrant JavaScript such as FFI callbacks. Doing so may crash the
 process, produce incorrect output, or corrupt memory.
 
 The `char` type follows the platform C ABI. On platforms where plain C `char`
-is signed it behaves like `i8`; otherwise it behaves like `u8`.
+is signed it behaves like `int8`; otherwise it behaves like `uint8`.
 
 The `bool` type is marshaled as an 8-bit unsigned integer. Pass numeric values
 such as `0` and `1`; JavaScript `true` and `false` are not accepted.
 
-On optimized Fast FFI calls, `pointer`, `ptr`, and `function` parameters accept
-raw pointer `bigint` values. For pointer-like parameters, `null`, `undefined`,
-strings, `Buffer`, typed array, `DataView`, and `ArrayBuffer` values are
-converted on the JavaScript side before calling the optimized native wrapper.
+On optimized Fast FFI calls, `pointer` and `function` parameters accept raw
+pointer `bigint` values. For pointer-like parameters, `null`, `undefined`,
+strings, `Buffer`, typed array, `DataView`, and `ArrayBuffer` values are converted
+on the JavaScript side before calling the optimized native wrapper.
 
 Optimized Fast FFI calls fall back to the generic FFI call path when a
 function's arguments or return type do not fit the platform-specific fast
@@ -161,8 +179,8 @@ optional:
 
 ```js
 const signature = {
-  return: 'i32',
-  arguments: ['i32', 'i32'],
+  return: 'int32',
+  arguments: ['int32', 'int32'],
 };
 ```
 
@@ -220,7 +238,7 @@ import { dlopen, suffix } from 'node:ffi';
 
 {
   using handle = dlopen(`./mylib.${suffix}`, {
-    add_i32: { arguments: ['i32', 'i32'], return: 'i32' },
+    add_i32: { arguments: ['int32', 'int32'], return: 'int32' },
   });
   console.log(handle.functions.add_i32(20, 22));
 } // handle.lib.close() is invoked automatically here.
@@ -230,8 +248,8 @@ import { dlopen, suffix } from 'node:ffi';
 import { dlopen, suffix } from 'node:ffi';
 
 const { lib, functions } = dlopen(`./mylib.${suffix}`, {
-  add_i32: { arguments: ['i32', 'i32'], return: 'i32' },
-  string_length: { arguments: ['pointer'], return: 'u64' },
+  add_i32: { arguments: ['int32', 'int32'], return: 'int32' },
+  string_length: { arguments: ['pointer'], return: 'uint64' },
 });
 
 console.log(functions.add_i32(20, 22));
@@ -241,8 +259,8 @@ console.log(functions.add_i32(20, 22));
 const { dlopen, suffix } = require('node:ffi');
 
 const { lib, functions } = dlopen(`./mylib.${suffix}`, {
-  add_i32: { arguments: ['i32', 'i32'], return: 'i32' },
-  string_length: { arguments: ['pointer'], return: 'u64' },
+  add_i32: { arguments: ['int32', 'int32'], return: 'int32' },
+  string_length: { arguments: ['pointer'], return: 'uint64' },
 });
 
 console.log(functions.add_i32(20, 22));
@@ -384,8 +402,8 @@ const { DynamicLibrary, suffix } = require('node:ffi');
 
 const lib = new DynamicLibrary(`./mylib.${suffix}`);
 const add = lib.getFunction('add_i32', {
-  arguments: ['i32', 'i32'],
-  return: 'i32',
+  arguments: ['int32', 'int32'],
+  return: 'int32',
 });
 
 console.log(add(20, 22));
@@ -435,7 +453,7 @@ const { DynamicLibrary, suffix } = require('node:ffi');
 const lib = new DynamicLibrary(`./mylib.${suffix}`);
 
 const callback = lib.registerCallback(
-  { arguments: ['i32'], return: 'i32' },
+  { arguments: ['int32'], return: 'int32' },
   (value) => value * 2,
 );
 ```
@@ -498,7 +516,8 @@ Argument conversion depends on the declared FFI type.
 For 8-, 16-, and 32-bit integer types and for floating-point types, pass
 JavaScript `number` values that match the declared type.
 
-For 64-bit integer types (`i64` and `u64`), pass JavaScript `bigint` values.
+For 64-bit integer types (`int64` and `uint64`), pass JavaScript `bigint`
+values.
 
 For pointer-like arguments:
 
diff --git a/lib/internal/ffi-shared-buffer.js b/lib/internal/ffi-shared-buffer.js
index 94764bdf0db7..13002193cd9c 100644
--- a/lib/internal/ffi-shared-buffer.js
+++ b/lib/internal/ffi-shared-buffer.js
@@ -64,38 +64,40 @@ const gF64 = DataViewPrototypeGetFloat64;
 
 const sbTypeInfo = {
   __proto__: null,
-  i8: { set: sI8, get: gI8, kind: 'int', min: -128, max: 127, label: 'an int8' },
-  int8: { set: sI8, get: gI8, kind: 'int', min: -128, max: 127, label: 'an int8' },
   char: charIsSigned ?
     { set: sI8, get: gI8, kind: 'int', min: -128, max: 127, label: 'an int8' } :
     { set: sU8, get: gU8, kind: 'int', min: 0, max: 255, label: 'a uint8' },
-  u8: { set: sU8, get: gU8, kind: 'int', min: 0, max: 255, label: 'a uint8' },
+  int8: { set: sI8, get: gI8, kind: 'int', min: -128, max: 127, label: 'an int8' },
   uint8: { set: sU8, get: gU8, kind: 'int', min: 0, max: 255, label: 'a uint8' },
+  int16: { set: sI16, get: gI16, kind: 'int', min: -32768, max: 32767, label: 'an int16' },
+  uint16: { set: sU16, get: gU16, kind: 'int', min: 0, max: 65535, label: 'a uint16' },
+  int32: { set: sI32, get: gI32, kind: 'int', min: -2147483648, max: 2147483647, label: 'an int32' },
+  uint32: { set: sU32, get: gU32, kind: 'int', min: 0, max: 4294967295, label: 'a uint32' },
+  int64: { set: sI64, get: gI64, kind: 'i64', label: 'an int64' },
+  uint64: { set: sU64, get: gU64, kind: 'u64', label: 'a uint64' },
+  float32: { set: sF32, get: gF32, kind: 'float', label: 'a float' },
+  float64: { set: sF64, get: gF64, kind: 'float', label: 'a double' },
+  pointer: { set: sU64, get: gU64, kind: 'pointer' },
+  string: { set: sU64, get: gU64, kind: 'pointer' },
+  buffer: { set: sU64, get: gU64, kind: 'pointer' },
+  arraybuffer: { set: sU64, get: gU64, kind: 'pointer' },
+  function: { set: sU64, get: gU64, kind: 'pointer' },
+
+  // Alternative spellings.
+  i8: { set: sI8, get: gI8, kind: 'int', min: -128, max: 127, label: 'an int8' },
+  u8: { set: sU8, get: gU8, kind: 'int', min: 0, max: 255, label: 'a uint8' },
   bool: { set: sU8, get: gU8, kind: 'int', min: 0, max: 255, label: 'a uint8' },
   i16: { set: sI16, get: gI16, kind: 'int', min: -32768, max: 32767, label: 'an int16' },
-  int16: { set: sI16, get: gI16, kind: 'int', min: -32768, max: 32767, label: 'an int16' },
   u16: { set: sU16, get: gU16, kind: 'int', min: 0, max: 65535, label: 'a uint16' },
-  uint16: { set: sU16, get: gU16, kind: 'int', min: 0, max: 65535, label: 'a uint16' },
   i32: { set: sI32, get: gI32, kind: 'int', min: -2147483648, max: 2147483647, label: 'an int32' },
-  int32: { set: sI32, get: gI32, kind: 'int', min: -2147483648, max: 2147483647, label: 'an int32' },
   u32: { set: sU32, get: gU32, kind: 'int', min: 0, max: 4294967295, label: 'a uint32' },
-  uint32: { set: sU32, get: gU32, kind: 'int', min: 0, max: 4294967295, label: 'a uint32' },
   i64: { set: sI64, get: gI64, kind: 'i64', label: 'an int64' },
-  int64: { set: sI64, get: gI64, kind: 'i64', label: 'an int64' },
   u64: { set: sU64, get: gU64, kind: 'u64', label: 'a uint64' },
-  uint64: { set: sU64, get: gU64, kind: 'u64', label: 'a uint64' },
   f32: { set: sF32, get: gF32, kind: 'float', label: 'a float' },
   float: { set: sF32, get: gF32, kind: 'float', label: 'a float' },
-  float32: { set: sF32, get: gF32, kind: 'float', label: 'a float' },
   f64: { set: sF64, get: gF64, kind: 'float', label: 'a double' },
   double: { set: sF64, get: gF64, kind: 'float', label: 'a double' },
-  float64: { set: sF64, get: gF64, kind: 'float', label: 'a double' },
-  pointer: { set: sU64, get: gU64, kind: 'pointer' },
   ptr: { set: sU64, get: gU64, kind: 'pointer' },
-  function: { set: sU64, get: gU64, kind: 'pointer' },
-  buffer: { set: sU64, get: gU64, kind: 'pointer' },
-  arraybuffer: { set: sU64, get: gU64, kind: 'pointer' },
-  string: { set: sU64, get: gU64, kind: 'pointer' },
   str: { set: sU64, get: gU64, kind: 'pointer' },
 };
 
diff --git a/lib/internal/ffi/fast-api.js b/lib/internal/ffi/fast-api.js
index 4b531dfe039a..38f4f4e34372 100644
--- a/lib/internal/ffi/fast-api.js
+++ b/lib/internal/ffi/fast-api.js
@@ -47,26 +47,28 @@ const fastLibraryStates = new SafeWeakMap();
 // conversions, so the public FFI ranges must be checked before the raw call.
 const fastIntegerTypeInfo = {
   __proto__: null,
-  i8: { kind: 'number', min: -128, max: 127, label: 'an int8' },
-  int8: { kind: 'number', min: -128, max: 127, label: 'an int8' },
   char: charIsSigned ?
     { kind: 'number', min: -128, max: 127, label: 'an int8' } :
     { kind: 'number', min: 0, max: 255, label: 'a uint8' },
-  u8: { kind: 'number', min: 0, max: 255, label: 'a uint8' },
+  int8: { kind: 'number', min: -128, max: 127, label: 'an int8' },
   uint8: { kind: 'number', min: 0, max: 255, label: 'a uint8' },
+  int16: { kind: 'number', min: -32768, max: 32767, label: 'an int16' },
+  uint16: { kind: 'number', min: 0, max: 65535, label: 'a uint16' },
+  int32: { kind: 'number', min: -2147483648, max: 2147483647, label: 'an int32' },
+  uint32: { kind: 'number', min: 0, max: 4294967295, label: 'a uint32' },
+  int64: { kind: 'bigint', min: I64_MIN, max: I64_MAX, label: 'an int64' },
+  uint64: { kind: 'bigint', min: 0n, max: U64_MAX, label: 'a uint64' },
+
+  // Alternative spellings.
+  i8: { kind: 'number', min: -128, max: 127, label: 'an int8' },
+  u8: { kind: 'number', min: 0, max: 255, label: 'a uint8' },
   bool: { kind: 'number', min: 0, max: 255, label: 'a uint8' },
   i16: { kind: 'number', min: -32768, max: 32767, label: 'an int16' },
-  int16: { kind: 'number', min: -32768, max: 32767, label: 'an int16' },
   u16: { kind: 'number', min: 0, max: 65535, label: 'a uint16' },
-  uint16: { kind: 'number', min: 0, max: 65535, label: 'a uint16' },
   i32: { kind: 'number', min: -2147483648, max: 2147483647, label: 'an int32' },
-  int32: { kind: 'number', min: -2147483648, max: 2147483647, label: 'an int32' },
   u32: { kind: 'number', min: 0, max: 4294967295, label: 'a uint32' },
-  uint32: { kind: 'number', min: 0, max: 4294967295, label: 'a uint32' },
   i64: { kind: 'bigint', min: I64_MIN, max: I64_MAX, label: 'an int64' },
-  int64: { kind: 'bigint', min: I64_MIN, max: I64_MAX, label: 'an int64' },
   u64: { kind: 'bigint', min: 0n, max: U64_MAX, label: 'a uint64' },
-  uint64: { kind: 'bigint', min: 0n, max: U64_MAX, label: 'a uint64' },
 };
 
 function throwFFIArgError(msg) {
@@ -97,8 +99,8 @@ function needsRawPointerConversion(type) {
 }
 
 function needsPointerLikeConversion(type) {
-  return type === 'pointer' || type === 'ptr' || type === 'function' ||
-         type === 'buffer' || type === 'arraybuffer';
+  return type === 'pointer' || type === 'function' || type === 'buffer' ||
+         type === 'arraybuffer' || type === 'ptr';
 }
 
 function needsStringPointerConversion(type) {
diff --git a/src/ffi/fast.cc b/src/ffi/fast.cc
index 8e92c56aebb7..24809e744a20 100644
--- a/src/ffi/fast.cc
+++ b/src/ffi/fast.cc
@@ -36,34 +36,32 @@ bool FastScalarTypeFromName(std::string_view type, FastFFIType* out) {
   // JavaScript wrappers handle strings and object-to-pointer conversions.
   if (type == "void") {
     *out = FastFFIType::kVoid;
-  } else if (type == "bool") {
-    *out = FastFFIType::kUint8;
-  } else if (IsTypeName(type, {"i8", "int8"})) {
-    *out = FastFFIType::kInt8;
-  } else if (IsTypeName(type, {"u8", "uint8"})) {
-    *out = FastFFIType::kUint8;
   } else if (type == "char") {
     *out = CHAR_MIN < 0 ? FastFFIType::kInt8 : FastFFIType::kUint8;
-  } else if (IsTypeName(type, {"i16", "int16"})) {
+  } else if (IsTypeName(type, {"int8", "i8"})) {
+    *out = FastFFIType::kInt8;
+  } else if (IsTypeName(type, {"uint8", "u8", "bool"})) {
+    *out = FastFFIType::kUint8;
+  } else if (IsTypeName(type, {"int16", "i16"})) {
     *out = FastFFIType::kInt16;
-  } else if (IsTypeName(type, {"u16", "uint16"})) {
+  } else if (IsTypeName(type, {"uint16", "u16"})) {
     *out = FastFFIType::kUint16;
-  } else if (IsTypeName(type, {"i32", "int32"})) {
+  } else if (IsTypeName(type, {"int32", "i32"})) {
     *out = FastFFIType::kInt32;
-  } else if (IsTypeName(type, {"u32", "uint32"})) {
+  } else if (IsTypeName(type, {"uint32", "u32"})) {
     *out = FastFFIType::kUint32;
-  } else if (IsTypeName(type, {"i64", "int64"})) {
+  } else if (IsTypeName(type, {"int64", "i64"})) {
     *out = FastFFIType::kInt64;
-  } else if (IsTypeName(type, {"u64", "uint64"})) {
+  } else if (IsTypeName(type, {"uint64", "u64"})) {
     *out = FastFFIType::kUint64;
-  } else if (IsTypeName(type, {"f32", "float", "float32"})) {
+  } else if (IsTypeName(type, {"float32", "f32", "float"})) {
     *out = FastFFIType::kFloat32;
-  } else if (IsTypeName(type, {"f64", "double", "float64"})) {
+  } else if (IsTypeName(type, {"float64", "f64", "double"})) {
     *out = FastFFIType::kFloat64;
   } else if (IsTypeName(type, {"buffer", "arraybuffer"})) {
     *out = FastFFIType::kPointer;
   } else if (IsTypeName(type,
-                        {"pointer", "ptr", "string", "str", "function"})) {
+                        {"pointer", "string", "function", "ptr", "str"})) {
     *out = FastFFIType::kPointer;
   } else {
     return false;
@@ -162,11 +160,12 @@ bool SignatureNeedsFastIntegerValidation(const FFIFunction& fn) {
   // V8 widens narrow integers to 32 bits and truncates BigInts to 64 bits for
   // Fast API calls. These types need a JS range check before the trampoline.
   for (const std::string& name : fn.arg_type_names) {
-    if (name == "bool" || name == "char" || name == "i8" || name == "int8" ||
-        name == "u8" || name == "uint8" || name == "i16" || name == "int16" ||
-        name == "u16" || name == "uint16" || name == "i32" || name == "int32" ||
-        name == "u32" || name == "uint32" || name == "i64" || name == "int64" ||
-        name == "u64" || name == "uint64") {
+    if (name == "char" || name == "int8" || name == "uint8" ||
+        name == "int16" || name == "uint16" || name == "int32" ||
+        name == "uint32" || name == "int64" || name == "uint64" ||
+        name == "i8" || name == "u8" || name == "bool" || name == "i16" ||
+        name == "u16" || name == "i32" || name == "u32" || name == "i64" ||
+        name == "u64") {
       return true;
     }
   }
@@ -176,7 +175,7 @@ bool SignatureNeedsFastIntegerValidation(const FFIFunction& fn) {
 bool IsPointerTypeName(const std::string& name) {
   // `pointer`, `ptr`, and `function` all use the same uintptr ABI slot; only
   // the public type spelling differs.
-  return name == "pointer" || name == "ptr" || name == "function";
+  return name == "pointer" || name == "function" || name == "ptr";
 }
 
 bool IsBufferTypeName(const std::string& name) {
diff --git a/src/ffi/types.cc b/src/ffi/types.cc
index db0c913c547d..83be0f48eccd 100644
--- a/src/ffi/types.cc
+++ b/src/ffi/types.cc
@@ -552,34 +552,33 @@ void WriteFFIReturnToBuffer(ffi_type* type,
 v8::Maybe<ffi_type*> ToFFIType(Environment* env, std::string_view type_str) {
   if (type_str == "void") {
     return Just(&ffi_type_void);
-  } else if (type_str == "i8" || type_str == "int8") {
-    return Just(&ffi_type_sint8);
-  } else if (type_str == "u8" || type_str == "uint8" || type_str == "bool") {
-    return Just(&ffi_type_uint8);
   } else if (type_str == "char") {
     return Just(CHAR_MIN < 0 ? &ffi_type_sint8 : &ffi_type_uint8);
-  } else if (type_str == "i16" || type_str == "int16") {
+  } else if (type_str == "int8" || type_str == "i8") {
+    return Just(&ffi_type_sint8);
+  } else if (type_str == "uint8" || type_str == "u8" || type_str == "bool") {
+    return Just(&ffi_type_uint8);
+  } else if (type_str == "int16" || type_str == "i16") {
     return Just(&ffi_type_sint16);
-  } else if (type_str == "u16" || type_str == "uint16") {
+  } else if (type_str == "uint16" || type_str == "u16") {
     return Just(&ffi_type_uint16);
-  } else if (type_str == "i32" || type_str == "int32") {
+  } else if (type_str == "int32" || type_str == "i32") {
     return Just(&ffi_type_sint32);
-  } else if (type_str == "u32" || type_str == "uint32") {
+  } else if (type_str == "uint32" || type_str == "u32") {
     return Just(&ffi_type_uint32);
-  } else if (type_str == "i64" || type_str == "int64") {
+  } else if (type_str == "int64" || type_str == "i64") {
     return Just(&ffi_type_sint64);
-  } else if (type_str == "u64" || type_str == "uint64") {
+  } else if (type_str == "uint64" || type_str == "u64") {
     return Just(&ffi_type_uint64);
-  } else if (type_str == "f32" || type_str == "float" ||
-             type_str == "float32") {
+  } else if (type_str == "float32" || type_str == "f32" ||
+             type_str == "float") {
     return Just(&ffi_type_float);
-  } else if (type_str == "f64" || type_str == "double" ||
-             type_str == "float64") {
+  } else if (type_str == "float64" || type_str == "f64" ||
+             type_str == "double") {
     return Just(&ffi_type_double);
-  } else if (type_str == "buffer" || type_str == "arraybuffer" ||
-             type_str == "string" || type_str == "str" ||
-             type_str == "pointer" || type_str == "ptr" ||
-             type_str == "function") {
+  } else if (type_str == "pointer" || type_str == "string" ||
+             type_str == "buffer" || type_str == "arraybuffer" ||
+             type_str == "function" || type_str == "ptr" || type_str == "str") {
     return Just(&ffi_type_pointer);
   } else {
     THROW_ERR_INVALID_ARG_VALUE(env, "Unsupported FFI type: %s", type_str);

From f0531f1c8727ddf2dd47fb10bd875a72f8dd2892 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 22 Aug 2026 10:24:09 +0200
Subject: [PATCH 286/344] crypto: enable SIV and GCM-SIV modes in
 Cipher/Decipher APIs

Closes #63393

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63411
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 deps/ncrypto/ncrypto.cc                    | 166 +++++++++++++++++++-
 deps/ncrypto/ncrypto.h                     |  27 +++-
 doc/api/crypto.md                          | 109 +++++++++----
 src/crypto/crypto_cipher.cc                | 118 ++++++++++----
 src/crypto/crypto_cipher.h                 |   3 +
 test/fixtures/aead-vectors.js              |  53 +++++++
 test/parallel/test-crypto-authenticated.js | 169 ++++++++++++++++++++-
 test/parallel/test-crypto-getcipherinfo.js |  37 ++++-
 8 files changed, 610 insertions(+), 72 deletions(-)

diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index c36f6ac14d45..fb7446578f57 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
 
 // ============================================================================
 
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
+    : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
+#endif
+
+Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+  if (other.fetched_cipher_ != nullptr) {
+    if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
+      fetched_cipher_.reset(other.fetched_cipher_.get());
+    } else {
+      cipher_ = nullptr;
+    }
+  }
+#endif
+}
+
+Cipher& Cipher::operator=(const Cipher& other) {
+  if (this == &other) return *this;
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+  if (other.fetched_cipher_ != nullptr) {
+    if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
+      fetched_cipher_.reset(other.fetched_cipher_.get());
+    } else {
+      fetched_cipher_.reset();
+      cipher_ = nullptr;
+      return *this;
+    }
+  } else {
+    fetched_cipher_.reset();
+  }
+#endif
+  cipher_ = other.cipher_;
+  return *this;
+}
+
 const Cipher Cipher::FromName(const char* name) {
-  return Cipher(EVP_get_cipherbyname(name));
+  const EVP_CIPHER* cipher = EVP_get_cipherbyname(name);
+  if (cipher != nullptr) return Cipher(cipher);
+
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
+      EVP_CIPHER_fetch(nullptr, name, nullptr));
+  if (fetched == nullptr) return Cipher();
+
+  const int mode = EVP_CIPHER_mode(fetched.get());
+  const bool is_siv_mode =
+#if OPENSSL_WITH_AES_SIV
+      mode == EVP_CIPH_SIV_MODE ||
+#endif
+#if OPENSSL_WITH_AES_GCM_SIV
+      mode == EVP_CIPH_GCM_SIV_MODE ||
+#endif
+      false;
+  if (is_siv_mode) return Cipher(std::move(fetched));
+
+  return Cipher();
+#else
+  return Cipher();
+#endif
 }
 
 const Cipher Cipher::FromNid(int nid) {
-  return Cipher(EVP_get_cipherbynid(nid));
+  const EVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
+  if (cipher != nullptr) return Cipher(cipher);
+
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+  const char* name = OBJ_nid2sn(nid);
+  if (name != nullptr) return FromName(name);
+#endif
+
+  return Cipher();
 }
 
 const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
   return getMode() == EVP_CIPH_OCB_MODE;
 }
 
+bool Cipher::isSivMode() const {
+  if (!cipher_) return false;
+#if OPENSSL_WITH_AES_SIV
+  return getMode() == EVP_CIPH_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
+bool Cipher::isGcmSivMode() const {
+  if (!cipher_) return false;
+#if OPENSSL_WITH_AES_GCM_SIV
+  return getMode() == EVP_CIPH_GCM_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
 bool Cipher::isStreamMode() const {
   if (!cipher_) return false;
   return getMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
       return "ocb";
     case EVP_CIPH_OFB_MODE:
       return "ofb";
+#if OPENSSL_WITH_AES_SIV
+    case EVP_CIPH_SIV_MODE:
+      return "siv";
+#endif
+#if OPENSSL_WITH_AES_GCM_SIV
+    case EVP_CIPH_GCM_SIV_MODE:
+      return "gcm-siv";
+#endif
     case EVP_CIPH_WRAP_MODE:
       return "wrap";
     case EVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
   if (!cipher_) return {};
   // OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
   // EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
-  return OBJ_nid2sn(getNid());
+  const int nid = getNid();
+  if (nid != NID_undef) {
+    const char* name = OBJ_nid2sn(nid);
+    if (name != nullptr) return name;
+  }
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+  return EVP_CIPHER_get0_name(cipher_);
+#else
+  return {};
+#endif
 }
 
 bool Cipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
     case EVP_CIPH_GCM_MODE:
 #ifndef OPENSSL_NO_OCB
     case EVP_CIPH_OCB_MODE:
+#endif
+#if OPENSSL_WITH_AES_SIV
+    case EVP_CIPH_SIV_MODE:
+#endif
+#if OPENSSL_WITH_AES_GCM_SIV
+    case EVP_CIPH_GCM_SIV_MODE:
 #endif
       return true;
     case EVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
   return getMode() == EVP_CIPH_WRAP_MODE;
 }
 
+bool CipherCtxPointer::isSivMode() const {
+  if (!ctx_) return false;
+#if OPENSSL_WITH_AES_SIV
+  return getMode() == EVP_CIPH_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
+bool CipherCtxPointer::isGcmSivMode() const {
+  if (!ctx_) return false;
+#if OPENSSL_WITH_AES_GCM_SIV
+  return getMode() == EVP_CIPH_GCM_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
 bool CipherCtxPointer::isChaCha20Poly1305() const {
   if (!ctx_) return false;
   return getNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
   void operator()(const char* name) { cb(name); }
 };
 
+#if OPENSSL_WITH_AES_SIV
+constexpr const char* kProviderOnlyAesSivCiphers[] = {
+    "aes-128-siv",
+    "aes-192-siv",
+    "aes-256-siv",
+};
+#endif
+
+#if OPENSSL_WITH_AES_GCM_SIV
+constexpr const char* kProviderOnlyAesGcmSivCiphers[] = {
+    "aes-128-gcm-siv",
+    "aes-192-gcm-siv",
+    "aes-256-gcm-siv",
+};
+#endif
+
 #if OPENSSL_VERSION_MAJOR >= 3
 template <class TypeName,
           TypeName* fetch_type(OSSL_LIB_CTX*, const char*, const char*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
       array_push_back<EVP_CIPHER>,
 #endif
       &context);
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+  auto maybe_push_provider_only_cipher = [&](const char* name) {
+    EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
+    if (cipher == nullptr) return;
+    EVP_CIPHER_free(cipher);
+    context.cb(name);
+  };
+#endif
+#if OPENSSL_WITH_AES_SIV
+  for (const char* name : kProviderOnlyAesSivCiphers) {
+    maybe_push_provider_only_cipher(name);
+  }
+#endif
+#if OPENSSL_WITH_AES_GCM_SIV
+  for (const char* name : kProviderOnlyAesGcmSivCiphers) {
+    maybe_push_provider_only_cipher(name);
+  }
+#endif
 #endif
 }
 
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 26b359d1f231..58e32cc18fc7 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -105,6 +105,18 @@
 #define OPENSSL_WITH_EVP_MAC 0
 #endif
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
+#define OPENSSL_WITH_AES_SIV 1
+#else
+#define OPENSSL_WITH_AES_SIV 0
+#endif
+
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
+#define OPENSSL_WITH_AES_GCM_SIV 1
+#else
+#define OPENSSL_WITH_AES_GCM_SIV 0
+#endif
+
 #if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
 #define OPENSSL_WITH_SIGNATURE_CONTEXT_STRING 1
 #else
@@ -437,9 +449,12 @@ class Cipher final {
 
   Cipher() = default;
   Cipher(const EVP_CIPHER* cipher) : cipher_(cipher) {}
-  Cipher(const Cipher&) = default;
-  Cipher& operator=(const Cipher&) = default;
+  Cipher(const Cipher& other);
+  Cipher& operator=(const Cipher& other);
   inline Cipher& operator=(const EVP_CIPHER* cipher) {
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+    fetched_cipher_.reset();
+#endif
     cipher_ = cipher;
     return *this;
   }
@@ -462,6 +477,8 @@ class Cipher final {
   bool isCtrMode() const;
   bool isCcmMode() const;
   bool isOcbMode() const;
+  bool isSivMode() const;
+  bool isGcmSivMode() const;
   bool isStreamMode() const;
   bool isChaCha20Poly1305() const;
 
@@ -533,6 +550,10 @@ class Cipher final {
 
  private:
   const EVP_CIPHER* cipher_ = nullptr;
+#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+  explicit Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
+#endif
 };
 
 // ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
   bool isOcbMode() const;
   bool isCcmMode() const;
   bool isWrapMode() const;
+  bool isSivMode() const;
+  bool isGcmSivMode() const;
   bool isChaCha20Poly1305() const;
 
   bool update(const Buffer<const unsigned char>& in,
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 413533c63d01..de0b9c986d7c 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -862,8 +862,8 @@ added: v1.0.0
 -->
 
 * Returns: {Buffer} When using an authenticated encryption mode (`GCM`, `CCM`,
-  `OCB`, and `chacha20-poly1305` are currently supported), the
-  `cipher.getAuthTag()` method returns a
+  `OCB`, `SIV`, `GCM-SIV`, and `chacha20-poly1305` are currently
+  supported), the `cipher.getAuthTag()` method returns a
   [`Buffer`][] containing the _authentication tag_ that has been computed from
   the given data.
 
@@ -885,14 +885,14 @@ added: v1.0.0
   * `encoding` {string} The string encoding to use when `buffer` is a string.
 * Returns: {Cipheriv} The same `Cipheriv` instance for method chaining.
 
-When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, and
-`chacha20-poly1305` are
-currently supported), the `cipher.setAAD()` method sets the value used for the
-_additional authenticated data_ (AAD) input parameter.
+When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, `SIV`,
+`GCM-SIV`, and `chacha20-poly1305` are currently supported), the
+`cipher.setAAD()` method sets the value used for the _additional authenticated
+data_ (AAD) input parameter.
 
-The `plaintextLength` option is optional for `GCM` and `OCB`. When using `CCM`,
-the `plaintextLength` option must be specified and its value must match the
-length of the plaintext in bytes. See [CCM mode][].
+The `plaintextLength` option is optional for `GCM`, `OCB`, `SIV`, and
+`GCM-SIV`. When using `CCM`, the `plaintextLength` option must be specified and
+its value must match the length of the plaintext in bytes. See [CCM mode][].
 
 The `cipher.setAAD()` method must be called before [`cipher.update()`][].
 
@@ -1190,14 +1190,14 @@ changes:
   * `encoding` {string} String encoding to use when `buffer` is a string.
 * Returns: {Decipheriv} The same `Decipheriv` instance for method chaining.
 
-When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, and
-`chacha20-poly1305` are
-currently supported), the `decipher.setAAD()` method sets the value used for the
-_additional authenticated data_ (AAD) input parameter.
+When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, `SIV`,
+`GCM-SIV`, and `chacha20-poly1305` are currently supported), the
+`decipher.setAAD()` method sets the value used for the _additional
+authenticated data_ (AAD) input parameter.
 
-The `options` argument is optional for `GCM`. When using `CCM`, the
-`plaintextLength` option must be specified and its value must match the length
-of the ciphertext in bytes. See [CCM mode][].
+The `options` argument is optional for `GCM`, `OCB`, `SIV`, and `GCM-SIV`.
+When using `CCM`, the `plaintextLength` option must be specified and its value
+must match the length of the ciphertext in bytes. See [CCM mode][].
 
 The `decipher.setAAD()` method must be called before [`decipher.update()`][].
 
@@ -1237,18 +1237,18 @@ changes:
 * `encoding` {string} String encoding to use when `buffer` is a string.
 * Returns: {Decipheriv} The same `Decipheriv` instance for method chaining.
 
-When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, and
-`chacha20-poly1305` are
-currently supported), the `decipher.setAuthTag()` method is used to pass in the
-received _authentication tag_. If no tag is provided, or if the cipher text
-has been tampered with, [`decipher.final()`][] will throw, indicating that the
-cipher text should be discarded due to failed authentication. If the tag length
-is invalid according to [NIST SP 800-38D][] or does not match the value of the
+When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, `SIV`,
+`GCM-SIV`, and `chacha20-poly1305` are currently supported), the
+`decipher.setAuthTag()` method is used to pass in the received
+_authentication tag_. If no tag is provided, or if the cipher text has been
+tampered with, [`decipher.final()`][] will throw, indicating that the cipher
+text should be discarded due to failed authentication. If the tag length is
+invalid according to [NIST SP 800-38D][] or does not match the value of the
 `authTagLength` option, `decipher.setAuthTag()` will throw an error.
 
 The `decipher.setAuthTag()` method must be called before [`decipher.update()`][]
-for `CCM` mode or before [`decipher.final()`][] for `GCM` and `OCB` modes and
-`chacha20-poly1305`.
+for `CCM`, `SIV`, and `GCM-SIV` modes or before [`decipher.final()`][] for
+`GCM` and `OCB` modes and `chacha20-poly1305`.
 `decipher.setAuthTag()` can only be called once.
 
 When passing a string as the authentication tag, please consider
@@ -3554,6 +3554,9 @@ operations. The specific constants currently defined are described in
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63411
+    description: Ciphers in SIV and GCM-SIV modes are now supported.
   - version: v26.0.0
     pr-url: https://github.com/nodejs/node/pull/62453
     description: Passing a CryptoKey as `key` is deprecated.
@@ -3604,7 +3607,9 @@ cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
 authentication tag in bytes, see [CCM mode][]. In GCM mode, the `authTagLength`
 option is not required but can be used to set the length of the authentication
 tag that will be returned by `getAuthTag()` and defaults to 16 bytes.
-For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
+For `SIV`, `GCM-SIV`, and `chacha20-poly1305`, the `authTagLength` option
+defaults to 16 bytes. `SIV` and `GCM-SIV` only support 16-byte authentication
+tags.
 
 The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
 recent OpenSSL releases, `openssl list -cipher-algorithms` will
@@ -3631,6 +3636,9 @@ given IV will be.
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63411
+    description: Ciphers in SIV and GCM-SIV modes are now supported.
   - version: v26.0.0
     pr-url: https://github.com/nodejs/node/pull/62453
     description: Passing a CryptoKey as `key` is deprecated.
@@ -3676,7 +3684,9 @@ cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
 `authTagLength` option is required and specifies the length of the
 authentication tag in bytes, see [CCM mode][].
 For AES-GCM and `chacha20-poly1305`, the `authTagLength` option defaults to 16
-bytes and must be set to a different value if a different length is used.
+bytes and must be set to a different value if a different length is used. For
+`SIV` and `GCM-SIV`, the `authTagLength` option defaults to 16 bytes and only
+16-byte authentication tags are supported.
 
 The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
 recent OpenSSL releases, `openssl list -cipher-algorithms` will
@@ -4765,15 +4775,17 @@ added: v15.0.0
   * `ivLength` {number} A test IV length.
 * Returns: {Object}
   * `name` {string} The name of the cipher
-  * `nid` {number} The nid of the cipher
-  * `blockSize` {number} The block size of the cipher in bytes. This property
-    is omitted when `mode` is `'stream'`.
-  * `ivLength` {number} The expected or default initialization vector length in
-    bytes. This property is omitted if the cipher does not use an initialization
+  * `nid` {number|undefined} The nid of the cipher. This property is `undefined` if the
+    cipher has no OpenSSL nid.
+  * `blockSize` {number|undefined} The block size of the cipher in bytes. This property
+    is `undefined` when `mode` is `'stream'`.
+  * `ivLength` {number|undefined} The expected or default initialization vector length in
+    bytes. This property is `undefined` if the cipher does not use an initialization
     vector.
   * `keyLength` {number} The expected or default key length in bytes.
   * `mode` {string} The cipher mode. One of `'cbc'`, `'ccm'`, `'cfb'`, `'ctr'`,
-    `'ecb'`, `'gcm'`, `'ocb'`, `'ofb'`, `'stream'`, `'wrap'`, `'xts'`.
+    `'ecb'`, `'gcm'`, `'gcm-siv'`, `'ocb'`, `'ofb'`, `'siv'`, `'stream'`,
+    `'wrap'`, `'xts'`.
 
 Returns information about a given cipher.
 
@@ -6650,6 +6662,37 @@ try {
 console.log(receivedPlaintext);
 ```
 
+### SIV and GCM-SIV modes
+
+`SIV`[^openssl30] and `GCM-SIV`[^openssl32] are supported [AEAD algorithms][]
+when supported by OpenSSL. Applications which use these modes must adhere to
+certain restrictions when using the cipher API:
+
+* The authentication tag length is fixed at 16 bytes.
+* `AES-SIV` keys are twice the named AES key size: `aes-128-siv` requires a
+  32-byte key, `aes-192-siv` requires a 48-byte key, and `aes-256-siv`
+  requires a 64-byte key.
+* `AES-SIV` ciphers do not use an initialization vector. Pass `null` or a
+  zero-length `iv` to [`crypto.createCipheriv()`][] or
+  [`crypto.createDecipheriv()`][].
+* `AES-SIV` and `AES-GCM-SIV` support zero-length plaintext only with OpenSSL
+  3.5 or later.
+* `AES-SIV` does not have a separate nonce or IV parameter. RFC 5297 defines
+  `AES-SIV` over an ordered list of associated-data inputs. Each `setAAD()`
+  call supplies one input in that list. If a protocol uses a nonce with
+  `AES-SIV`, call `setAAD(nonce)` after the other associated-data inputs and
+  before `update()`. At most 126 associated-data inputs may be supplied.
+* `AES-GCM-SIV` ciphers require a 12-byte initialization vector.
+* When decrypting, the authentication tag must be set via `setAuthTag()` before
+  calling `update()`.
+* Using stream methods such as `write(data)`, `end(data)` or `pipe()` might
+  fail as these modes cannot handle more than one chunk of data per instance.
+* As these modes process the whole message at once, `update()` must be called
+  exactly once.
+* Even though calling `update()` is sufficient to encrypt/decrypt the message,
+  applications _must_ call `final()` to compute or verify the authentication
+  tag.
+
 ### FIPS mode
 
 Node.js exposes the FIPS support provided by the linked OpenSSL library. Node.js
diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
index e4aaf0b953a7..720eb656b89d 100644
--- a/src/crypto/crypto_cipher.cc
+++ b/src/crypto/crypto_cipher.cc
@@ -8,6 +8,10 @@
 #include "node_process-inl.h"
 #include "v8.h"
 
+#include <algorithm>
+#include <string>
+#include <vector>
+
 namespace node {
 
 using ncrypto::Cipher;
@@ -113,8 +117,8 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
     if (args[2]->IsUint32()) {
       size_t check_len = args[2].As<Uint32>()->Value();
       // For CCM modes, the IV may be between 7 and 13 bytes.
-      // For GCM and OCB modes, we'll check by attempting to
-      // set the value. For everything else, just check that
+      // For GCM modes, any IV length is accepted. For OCB modes, we'll check
+      // by attempting to set the value. For everything else, just check that
       // check_len == iv_length.
 
       if (cipher.isCcmMode()) {
@@ -123,6 +127,8 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
         // Nothing to do.
       } else if (cipher.isOcbMode()) {
         if (!ctx.setIvLength(check_len)) return;
+      } else if (cipher.isSivMode() || cipher.isGcmSivMode()) {
+        if (check_len != iv_length) return;
       } else {
         if (check_len != iv_length) return;
       }
@@ -137,7 +143,10 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
 
   values[0] = ToV8Value(env->context(), cipher.getModeLabel(), env->isolate());
   values[1] = ToV8Value(env->context(), name_str, env->isolate());
-  values[2] = Uint32::NewFromUnsigned(env->isolate(), cipher.getNid());
+  const int nid = cipher.getNid();
+  if (nid != NID_undef) {
+    values[2] = Uint32::NewFromUnsigned(env->isolate(), nid);
+  }
   values[3] = Uint32::NewFromUnsigned(env->isolate(), key_length);
 
   // Stream ciphers do not have a meaningful block size
@@ -183,20 +192,24 @@ void CipherBase::GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
 
 void CipherBase::GetCiphers(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
+  std::vector<std::string> cipher_names;
+  Cipher::ForEach(
+      [&](std::string_view name) { cipher_names.emplace_back(name); });
+  std::sort(cipher_names.begin(), cipher_names.end());
+  cipher_names.erase(std::unique(cipher_names.begin(), cipher_names.end()),
+                     cipher_names.end());
+
   LocalVector<Value> ciphers(env->isolate());
   bool errored = false;
-  Cipher::ForEach([&](std::string_view name) {
-    // If a prior iteration errored, do nothing further. We apparently
-    // can't actually stop openssl from stopping its iteration here.
-    // But why does it matter? Good question.
-    if (errored) return;
+  for (const std::string& name : cipher_names) {
+    if (errored) break;
     Local<Value> val;
     if (!ToV8Value(env->context(), name, env->isolate()).ToLocal(&val)) {
       errored = true;
-      return;
+      break;
     }
     ciphers.push_back(val);
-  });
+  }
 
   // If errored is true here, then we encountered a JavaScript error
   // while trying to create the V8 String from the std::string_view
@@ -207,15 +220,15 @@ void CipherBase::GetCiphers(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-CipherBase::CipherBase(Environment* env,
-                       Local<Object> wrap,
-                       CipherKind kind)
+CipherBase::CipherBase(Environment* env, Local<Object> wrap, CipherKind kind)
     : BaseObject(env, wrap),
       ctx_(nullptr),
       kind_(kind),
       auth_tag_state_(kAuthTagUnknown),
       auth_tag_len_(kNoAuthTagLength),
-      pending_auth_failed_(false) {
+      pending_auth_failed_(false),
+      has_siv_update_(false),
+      siv_aad_components_(0) {
   MakeWeak();
 }
 
@@ -414,6 +427,15 @@ void CipherBase::InitIv(const char* cipher_type,
     }
   }
 
+  if (cipher.isSivMode() && has_iv) {
+    return THROW_ERR_CRYPTO_INVALID_IV(env());
+  }
+
+  if (cipher.isGcmSivMode() &&
+      (!has_iv || static_cast<int>(iv_buf.size()) != expected_iv_len)) {
+    return THROW_ERR_CRYPTO_INVALID_IV(env());
+  }
+
   CommonInit(
       cipher_type,
       cipher,
@@ -430,7 +452,9 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
   CHECK(IsAuthenticatedMode());
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  if (!ctx_.setIvLength(iv_len)) {
+  const bool is_siv = ctx_.isSivMode() || ctx_.isGcmSivMode();
+
+  if (!is_siv && !ctx_.setIvLength(iv_len)) {
     THROW_ERR_CRYPTO_INVALID_IV(env());
     return false;
   }
@@ -451,9 +475,9 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
   }
 
   if (auth_tag_len == kNoAuthTagLength) {
-    // Both GCM and ChaCha20-Poly1305 have a default tag length of 16 bytes.
+    // GCM, SIV, and ChaCha20-Poly1305 have a default tag length of 16 bytes.
     // Other modes (CCM, OCB) require an explicit tag length.
-    if (ctx_.isGcmMode()) {
+    if (ctx_.isGcmMode() || is_siv) {
       auth_tag_len = EVP_GCM_TLS_TAG_LEN;
 #ifdef EVP_CHACHAPOLY_TLS_TAG_LEN
     } else if (ctx_.isChaCha20Poly1305()) {
@@ -464,13 +488,24 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
           env(), "authTagLength required for %s", cipher_type);
       return false;
     }
-  } else if ((ctx_.isGcmMode() && !Cipher::IsValidGCMTagLength(auth_tag_len)) ||
-             (!ctx_.isGcmMode() && !ctx_.setAeadTagLength(auth_tag_len))) {
+  } else {
     // GCM authentication tag lengths are restricted according to NIST 800-38d,
-    // page 9. For other modes, we rely on OpenSSL to validate the length.
-    THROW_ERR_CRYPTO_INVALID_AUTH_TAG(
-        env(), "Invalid authentication tag length: %u", auth_tag_len);
-    return false;
+    // page 9. SIV modes only support 16-byte tags. For other modes, we rely on
+    // OpenSSL to validate the length.
+    bool is_invalid_auth_tag_length;
+    if (is_siv) {
+      is_invalid_auth_tag_length = auth_tag_len != EVP_GCM_TLS_TAG_LEN;
+    } else if (ctx_.isGcmMode()) {
+      is_invalid_auth_tag_length = !Cipher::IsValidGCMTagLength(auth_tag_len);
+    } else {
+      is_invalid_auth_tag_length = !ctx_.setAeadTagLength(auth_tag_len);
+    }
+
+    if (is_invalid_auth_tag_length) {
+      THROW_ERR_CRYPTO_INVALID_AUTH_TAG(
+          env(), "Invalid authentication tag length: %u", auth_tag_len);
+      return false;
+    }
   }
 
   // Remember the given authentication tag length for later.
@@ -527,6 +562,11 @@ void CipherBase::SetAuthTag(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().Set(false);
   }
 
+  if ((cipher->ctx_.isSivMode() || cipher->ctx_.isGcmSivMode()) &&
+      cipher->has_siv_update_) {
+    return args.GetReturnValue().Set(false);
+  }
+
   ArrayBufferOrViewContents<char> auth_tag(args[0]);
   if (!auth_tag.CheckSizeInt32()) [[unlikely]] {
     return THROW_ERR_OUT_OF_RANGE(env, "buffer is too big");
@@ -557,6 +597,9 @@ bool CipherBase::SetAAD(
     int plaintext_len) {
   if (!ctx_ || !IsAuthenticatedMode())
     return false;
+  const bool is_siv = ctx_.isSivMode();
+  if ((is_siv || ctx_.isGcmSivMode()) && has_siv_update_) return false;
+  if (is_siv && siv_aad_components_ >= kMaxSivAADComponents) return false;
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
   int outlen;
@@ -588,7 +631,9 @@ bool CipherBase::SetAAD(
       .data = data.data(),
       .len = data.size(),
   };
-  return ctx_.update(buffer, nullptr, &outlen);
+  const bool success = ctx_.update(buffer, nullptr, &outlen);
+  if (success && is_siv) siv_aad_components_++;
+  return success;
 }
 
 void CipherBase::SetAAD(const FunctionCallbackInfo<Value>& args) {
@@ -618,6 +663,11 @@ CipherBase::UpdateResult CipherBase::Update(
     return kErrorMessageSize;
   }
 
+  const bool is_siv = ctx_.isSivMode() || ctx_.isGcmSivMode();
+  if (is_siv && has_siv_update_) {
+    return kErrorState;
+  }
+
   const int block_size = ctx_.getBlockSize();
   CHECK_GT(block_size, 0);
   if (len + block_size > INT_MAX) return kErrorState;
@@ -644,6 +694,18 @@ CipherBase::UpdateResult CipherBase::Update(
 
   bool r = ctx_.update(
       buffer, static_cast<unsigned char*>((*out)->Data()), &buf_len);
+  if (is_siv) {
+    has_siv_update_ = true;
+  }
+
+  // When in CCM mode, EVP_CipherUpdate will fail if the authentication tag is
+  // invalid. AES-SIV reports the same authentication failure at update time,
+  // but the AEAD contract expects the failure to surface from final().
+  const bool pending_auth_failed =
+      !r && kind_ == kDecipher && (ctx_.isCcmMode() || is_siv);
+  if (pending_auth_failed) {
+    buf_len = 0;
+  }
 
   CHECK_LE(static_cast<size_t>(buf_len), (*out)->ByteLength());
   if (buf_len == 0) {
@@ -657,9 +719,7 @@ CipherBase::UpdateResult CipherBase::Update(
     memcpy((*out)->Data(), old_out->Data(), buf_len);
   }
 
-  // When in CCM mode, EVP_CipherUpdate will fail if the authentication tag is
-  // invalid. In that case, remember the error and throw in final().
-  if (!r && kind_ == kDecipher && ctx_.isCcmMode()) {
+  if (pending_auth_failed) {
     pending_auth_failed_ = true;
     return kSuccess;
   }
@@ -713,6 +773,10 @@ void CipherBase::SetAutoPadding(const FunctionCallbackInfo<Value>& args) {
 
 bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
   if (!ctx_) return false;
+  if ((ctx_.isSivMode() || ctx_.isGcmSivMode()) && !has_siv_update_) {
+    ctx_.reset();
+    return false;
+  }
 
   *out = ArrayBuffer::NewBackingStore(
       env()->isolate(),
diff --git a/src/crypto/crypto_cipher.h b/src/crypto/crypto_cipher.h
index 4837a63ca631..b751173d5591 100644
--- a/src/crypto/crypto_cipher.h
+++ b/src/crypto/crypto_cipher.h
@@ -43,6 +43,7 @@ class CipherBase : public BaseObject {
     kAuthTagComputed,
   };
   static const unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
+  static constexpr unsigned int kMaxSivAADComponents = 126;
 
   void CommonInit(const char* cipher_type,
                   const ncrypto::Cipher& cipher,
@@ -86,6 +87,8 @@ class CipherBase : public BaseObject {
   unsigned int auth_tag_len_;
   char auth_tag_[ncrypto::Cipher::MAX_AUTH_TAG_LENGTH];
   bool pending_auth_failed_;
+  bool has_siv_update_;
+  unsigned int siv_aad_components_;
   int max_message_size_;
 };
 
diff --git a/test/fixtures/aead-vectors.js b/test/fixtures/aead-vectors.js
index 6b1d169b2a7a..e511c6babf38 100644
--- a/test/fixtures/aead-vectors.js
+++ b/test/fixtures/aead-vectors.js
@@ -1,4 +1,57 @@
 module.exports = [
+  // RFC 5297, Appendix A.1
+  { algo: 'aes-128-siv',
+    key: 'fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0' +
+         'f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff',
+    iv: '',
+    plain: '112233445566778899aabbccddee',
+    plainIsHex: true,
+    aad: '101112131415161718191a1b1c1d1e1f2021222324252627',
+    ct: '40c02b9690c4dc04daef7f6afe5c',
+    tag: '85632d07c6e8f37f950acd320a2ecc93', tampered: false },
+
+  // RFC 5297, Appendix A.2
+  { algo: 'aes-128-siv',
+    key: '7f7e7d7c7b7a79787776757473727170' +
+         '404142434445464748494a4b4c4d4e4f',
+    iv: '',
+    plain: '7468697320697320736f6d6520706c61' +
+           '696e7465787420746f20656e63727970' +
+           '74207573696e67205349562d414553',
+    plainIsHex: true,
+    aads: [
+      '00112233445566778899aabbccddeeff' +
+      'deaddadadeaddadaffeeddccbbaa9988' +
+      '7766554433221100',
+      '102030405060708090a0',
+      '09f911029d74e35bd84156c5635688c0',
+    ],
+    ct: 'cb900f2fddbe404326601965c889bf17' +
+        'dba77ceb094fa663b7a3f748ba8af829' +
+        'ea64ad544a272e9c485b62a3fd5c0d',
+    tag: '7bdb6e3b432667eb06f4d14bff2fbd0f', tampered: false },
+
+  // RFC 8452, Appendix C.1
+  { algo: 'aes-128-gcm-siv',
+    key: '36864200e0eaf5284d884a0e77d31646',
+    iv: 'bae8e37fc83441b16034566b',
+    plain: '7a806c',
+    plainIsHex: true,
+    aad: '46bb91c3c5',
+    ct: 'af60eb',
+    tag: '711bd85bc1e4d3e0a462e074eea428a8', tampered: false },
+
+  // RFC 8452, Appendix C.2
+  { algo: 'aes-256-gcm-siv',
+    key: 'bae8e37fc83441b16034566b7a806c46' +
+         'bb91c3c5aedb64a6c590bc84d1a5e269',
+    iv: 'e4b47801afc0577e34699b9e',
+    plain: '671fdd',
+    plainIsHex: true,
+    aad: '4fbdc66f14',
+    ct: '0eaccb',
+    tag: '93da9bb81333aee0c785b240d319719d', tampered: false },
+
   { algo: 'aes-128-gcm',
     key: '6970787039613669314d623455536234',
     iv: '583673497131313748307652', plain: 'Hello World!',
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index 4062a5b5495f..f27fcfa22dbf 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -65,6 +65,7 @@ for (const test of TEST_CASES) {
 
   const isCCM = /^aes-(128|192|256)-ccm$/.test(test.algo);
   const isOCB = /^aes-(128|192|256)-ocb$/.test(test.algo);
+  const isSIV = /^aes-(128|192|256)-siv$/.test(test.algo);
 
   let options;
   if (isCCM || isOCB)
@@ -78,6 +79,7 @@ for (const test of TEST_CASES) {
       plaintextLength: Buffer.from(test.plain, inputEncoding).length
     };
   }
+  const aads = test.aads ?? (test.aad === undefined ? [] : [test.aad]);
 
   {
     const encrypt = crypto.createCipheriv(test.algo,
@@ -85,8 +87,9 @@ for (const test of TEST_CASES) {
                                           Buffer.from(test.iv, 'hex'),
                                           options);
 
-    if (test.aad)
-      encrypt.setAAD(Buffer.from(test.aad, 'hex'), aadOptions);
+    for (const aad of aads) {
+      encrypt.setAAD(Buffer.from(aad, 'hex'), aadOptions);
+    }
 
     let hex = encrypt.update(test.plain, inputEncoding, 'hex');
     hex += encrypt.final('hex');
@@ -113,8 +116,9 @@ for (const test of TEST_CASES) {
                                               Buffer.from(test.iv, 'hex'),
                                               options);
       decrypt.setAuthTag(Buffer.from(test.tag, 'hex'));
-      if (test.aad)
-        decrypt.setAAD(Buffer.from(test.aad, 'hex'), aadOptions);
+      for (const aad of aads) {
+        decrypt.setAAD(Buffer.from(aad, 'hex'), aadOptions);
+      }
 
       const outputEncoding = test.plainIsHex ? 'hex' : 'ascii';
 
@@ -145,7 +149,7 @@ for (const test of TEST_CASES) {
       crypto.createCipheriv(
         test.algo,
         Buffer.from(test.key, 'hex'),
-        Buffer.alloc(0)
+        isSIV ? Buffer.alloc(1) : Buffer.alloc(0)
       );
     }, errMessages.length);
   }
@@ -204,6 +208,161 @@ for (const test of TEST_CASES) {
   }
 }
 
+// SIV and GCM-SIV use fixed 16-byte authentication tags.
+{
+  for (const { algo, key, iv } of [
+    {
+      algo: 'aes-128-siv',
+      key: Buffer.alloc(32),
+      iv: null
+    },
+    {
+      algo: 'aes-128-gcm-siv',
+      key: Buffer.alloc(16),
+      iv: Buffer.alloc(12)
+    },
+  ]) {
+    if (!ciphers.includes(algo)) {
+      common.printSkipMessage(`unsupported ${algo} test`);
+      continue;
+    }
+
+    // OpenSSL 3.5 added support for zero-length SIV messages.
+    const supportsEmptyPlaintext = hasOpenSSL(3, 5);
+
+    for (const authTagLength of [1, 15, 17]) {
+      assert.throws(() => {
+        crypto.createCipheriv(algo, key, iv, { authTagLength });
+      }, errMessages.authTagLength);
+
+      assert.throws(() => {
+        crypto.createDecipheriv(algo, key, iv, { authTagLength });
+      }, errMessages.authTagLength);
+    }
+
+    if (algo === 'aes-128-siv') {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      for (let i = 0; i < 126; i++) {
+        cipher.setAAD(Buffer.alloc(0));
+      }
+      assert.throws(() => {
+        cipher.setAAD(Buffer.alloc(0));
+      }, errMessages.state);
+      cipher.update(Buffer.alloc(1));
+      cipher.final();
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      cipher.update('a');
+      assert.throws(() => {
+        cipher.update('b');
+      }, /Trying to add data in unsupported state/);
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = cipher.update('authenticated plaintext');
+      assert.throws(() => {
+        cipher.setAAD(Buffer.from('too late'));
+      }, errMessages.state);
+      cipher.final();
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(cipher.getAuthTag());
+      const plaintext = decipher.update(ciphertext);
+      assert.throws(() => {
+        decipher.setAAD(Buffer.from('too late'));
+      }, errMessages.state);
+      assert.strictEqual(
+        Buffer.concat([plaintext, decipher.final()]).toString(),
+        'authenticated plaintext');
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = cipher.update('authenticated plaintext');
+      cipher.final();
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.update(ciphertext);
+      assert.throws(() => {
+        decipher.setAuthTag(cipher.getAuthTag());
+      }, errMessages.state);
+      assert.throws(() => {
+        decipher.final();
+      }, errMessages.auth);
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      assert.throws(() => {
+        cipher.final();
+      }, errMessages.auth);
+      assert.throws(() => {
+        cipher.update('too late');
+      }, errMessages.state);
+      assert.throws(() => {
+        cipher.final();
+      }, errMessages.state);
+    }
+
+    if (supportsEmptyPlaintext) {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = Buffer.concat([
+        cipher.update(Buffer.alloc(0)),
+        cipher.final(),
+      ]);
+      assert.strictEqual(ciphertext.length, 0);
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(cipher.getAuthTag());
+      assert.throws(() => {
+        decipher.final();
+      }, errMessages.auth);
+      assert.throws(() => {
+        decipher.update(Buffer.alloc(0));
+      }, errMessages.state);
+      assert.throws(() => {
+        decipher.final();
+      }, errMessages.state);
+    }
+
+    if (supportsEmptyPlaintext) {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = Buffer.concat([
+        cipher.update(Buffer.alloc(0)),
+        cipher.final(),
+      ]);
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(cipher.getAuthTag());
+      const plaintext = Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final(),
+      ]);
+      assert.strictEqual(plaintext.length, 0);
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = Buffer.concat([
+        cipher.update('authenticated plaintext'),
+        cipher.final(),
+      ]);
+      const authTag = cipher.getAuthTag();
+      authTag[0] ^= 1;
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(authTag);
+      decipher.update(ciphertext);
+      assert.throws(() => {
+        decipher.final();
+      }, /Unsupported state or unable to authenticate data/);
+    }
+  }
+}
+
 // Test that GCM can produce shorter authentication tags than 16 bytes.
 {
   const fullTag = '1debb47b2c91ba2cea16fad021703070';
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index 4f9f2975ad6d..0a984f0ce54e 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const {
+  createHash,
   getCiphers,
   getCipherInfo,
 } = require('crypto');
@@ -16,6 +17,12 @@ const ciphers = getCiphers();
 
 assert.strictEqual(getCipherInfo(-1), undefined);
 assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
+if (!process.features.openssl_is_boringssl) {
+  // A failed provider fetch must not contaminate the OpenSSL error queue.
+  assert.throws(() => createHash('sha256', { outputLength: 28 }), {
+    code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH',
+  });
+}
 
 for (const cipher of ciphers) {
   const info = getCipherInfo(cipher);
@@ -26,8 +33,10 @@ for (const cipher of ciphers) {
     continue;
   }
   assert(info);
-  const info2 = getCipherInfo(info.nid);
-  assert.deepStrictEqual(info, info2);
+  if (info.nid !== undefined) {
+    const info2 = getCipherInfo(info.nid);
+    assert.deepStrictEqual(info, info2);
+  }
 }
 
 const info = getCipherInfo('aes-128-cbc');
@@ -86,3 +95,27 @@ if (hasFIPS(3)) {
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-ocb test cases');
 }
+
+if (ciphers.includes('aes-128-siv')) {
+  const info = getCipherInfo('aes-128-siv');
+  assert.strictEqual(info.name, 'aes-128-siv');
+  assert.strictEqual(info.mode, 'siv');
+  assert.strictEqual(info.keyLength, 32);
+  assert.strictEqual(info.ivLength, undefined);
+  assert(getCipherInfo('aes-128-siv', { ivLength: 0 }));
+  assert(!getCipherInfo('aes-128-siv', { ivLength: 1 }));
+} else {
+  common.printSkipMessage('Skipping unsupported aes-128-siv test cases');
+}
+
+if (ciphers.includes('aes-128-gcm-siv')) {
+  const info = getCipherInfo('aes-128-gcm-siv');
+  assert.strictEqual(info.name, 'aes-128-gcm-siv');
+  assert.strictEqual(info.mode, 'gcm-siv');
+  assert.strictEqual(info.keyLength, 16);
+  assert.strictEqual(info.ivLength, 12);
+  assert(getCipherInfo('aes-128-gcm-siv', { ivLength: 12 }));
+  assert(!getCipherInfo('aes-128-gcm-siv', { ivLength: 11 }));
+} else {
+  common.printSkipMessage('Skipping unsupported aes-128-gcm-siv test cases');
+}

From 0f36ee375592859a0d8f691c45ccad501b49a75f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=ED=98=9C=EB=AF=B8?=
 <103042868+hyemimi@users.noreply.github.com>
Date: Sat, 22 Aug 2026 20:59:46 +0900
Subject: [PATCH 287/344] doc: remove outdated WASI version fallback

Signed-off-by: hyemimi <hyemi7375@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65303
Refs: https://github.com/nodejs/node/pull/47391
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 doc/api/wasi.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/api/wasi.md b/doc/api/wasi.md
index 7303e0eeabbe..6f477a765daf 100644
--- a/doc/api/wasi.md
+++ b/doc/api/wasi.md
@@ -197,8 +197,7 @@ If version `unstable` was passed into the constructor it will return:
 { wasi_unstable: wasi.wasiImport }
 ```
 
-If version `preview1` was passed into the constructor or no version was
-specified it will return:
+If version `preview1` was passed into the constructor it will return:
 
 ```json
 { wasi_snapshot_preview1: wasi.wasiImport }

From a457631496d7652fee4c4408d9c6f02329509f12 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 22 Aug 2026 16:24:44 +0200
Subject: [PATCH 288/344] tools: improve commit queue failure comment

Commit Queue failure comments hid the actionable reason inside the
collapsed landing transcript.

Surface the reason and retry instructions before the full output. Add
specific guidance for a missing multi-commit policy and explicit reasons
for push and squash-merge failures.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65433
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 tools/actions/commit-queue.sh | 60 ++++++++++++++++++++++++++++++++---
 1 file changed, 56 insertions(+), 4 deletions(-)

diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index deb2edf7cf2f..9fb74ed9cad8 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -10,12 +10,62 @@ COMMIT_QUEUE_FAILED_LABEL="commit-queue-failed"
 
 cqurl="${GITHUB_SERVER_URL:?}/${GITHUB_REPOSITORY:?}/actions/runs/${GITHUB_RUN_ID:?}"
 
+escape_code_block_or_line() {
+  case $1 in
+    *"
+"*|'') fence='```' sep='
+' ;;
+    *[![:space:]]*) fence='`' sep=' ' ;;
+    *) fence='`' sep='' ;;
+  esac
+  while case $1 in *"$fence"*) ;; *) false ;; esac; do
+    fence=$fence'`'
+  done
+  printf '%s%s%s%s%s\n' "$fence" "$sep" "$1" "$sep" "$fence"
+}
+
 commit_queue_failed() {
   pr=$1
+  reported_failure=${2:-}
 
   gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
 
-  body="<details><summary>Commit Queue failed</summary><pre>$(sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g' output)</pre><a href='$cqurl'>$cqurl</a></details>"
+  last_output_line=$(awk 'NF { line = $0 } END { sub(/^[[:space:]]*/, "", line); print line }' output)
+  # shellcheck disable=SC2016
+  missing_policy_message='ℹ  Add `commit-queue-squash` label to land the PR as one commit, or `commit-queue-rebase` to land as separate commits.'
+  if [ "$last_output_line" = "$missing_policy_message" ]; then
+    failure_body='This pull request has multiple commits, but no landing policy was selected.
+
+Add https://github.com/nodejs/node/labels/commit-queue-squash to land it as one commit, or https://github.com/nodejs/node/labels/commit-queue-rebase to land the commits separately.'
+  else
+    if [ -z "$reported_failure" ]; then
+      reported_failure=$(grep -e '✘' -e '⚠' output | tail -n 10)
+    fi
+    if [ -z "$reported_failure" ]; then
+      reported_failure=$(tail -n 10 output)
+    fi
+    if [ -z "$reported_failure" ]; then
+      reported_failure='No failure reason was reported.'
+    fi
+    failure_body=$(escape_code_block_or_line "$reported_failure")
+  fi
+
+  raw_output=$(cat output)
+
+  body="### Commit Queue failed
+
+$failure_body
+
+The pull request was removed from the Commit Queue and labeled https://github.com/nodejs/node/labels/commit-queue-failed. After resolving the failure, remove that label and add https://github.com/nodejs/node/labels/commit-queue to retry.
+
+<details>
+<summary>Full Commit Queue output</summary>
+
+$(escape_code_block_or_line "$raw_output")
+
+</details>
+
+[View workflow run]($cqurl)"
   echo "$body"
 
   gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "$body"
@@ -63,7 +113,8 @@ for pr in "$@"; do
     commits="${start_sha}...${end_sha}"
 
     if ! git push $UPSTREAM $DEFAULT_BRANCH >> output 2>&1; then
-      commit_queue_failed "$pr"
+      commit_queue_failed "$pr" \
+        "Failed to push the landed commits to ${UPSTREAM}/${DEFAULT_BRANCH}."
       continue
     fi
   else
@@ -80,9 +131,10 @@ for pr in "$@"; do
         --arg head "${commit_head}" \
         '{merge_method:"squash",commit_title:$title,commit_message:$body,sha:$head}' |\
       gh api -X PUT "repos/${GITHUB_REPOSITORY}/pulls/${pr}/merge" --input -\
-        --jq 'if .merged then .sha else halt_error end'
+        --jq 'if .merged then .sha else halt_error end' 2>> output
     )"; then
-      commit_queue_failed "$pr"
+      commit_queue_failed "$pr" \
+        'GitHub failed to squash and merge this pull request.'
       continue
     fi
   fi

From e8e2abcc8dbf02428f30c308de743f12410a5da7 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 22 Aug 2026 19:07:39 +0200
Subject: [PATCH 289/344] lib: load fewer builtins when bootstrapping without a
 snapshot

Contexts that are not deserialized from the built-in snapshot -- worker
threads, and the main context of embedders that create their own
isolate or of `node --no-node-snapshot` -- compile (with the code cache
at best) every builtin the bootstrap touches, so each eagerly required
builtin is startup time (~0.15-0.4 ms apiece). A number of them are only
required eagerly so that they end up in the snapshot, or for features
the bootstrap path never uses.

Load lazily what those paths do not need:

- is_main_thread.js: preload util, url, the ESM loader (translators,
  resolver, module_job/map, source maps, node:module, vm modules, mime,
  data_url, the TypeScript stripper), internal/blob and
  internal/dns/utils only while building a snapshot; they load on first
  use otherwise.
- fs: internal/blob (+ internal/encoding and its tables) is only used
  by fs.openAsBlob().
- internal/url: internal/data_url (+ internal/mime) is only used by the
  Buffer-returning file URL helpers.
- internal/process/execution, the CommonJS loader, esm/translators and
  esm/load: the TypeScript stripper and data: URL helpers are only
  needed for TypeScript sources / data: URLs.
- pre_execution: internal/dns/utils (+ internal/net) is only needed up
  front to validate an explicit --dns-result-order or to register the
  resolver's snapshot serializer; the default order becomes the
  variable's initializer.
- internal/worker: event_loop_utilization and error_serdes are only
  needed once a sub-worker's ELU is read or it reports an error.
- worker_threads: `locks` is defined lazily, like util's lazy exports.

Main-thread startup with the snapshot is unchanged (the same modules
are preloaded into it; the bootstrap-modules test lists are adjusted).
A bare worker compiles 95 -> 83 builtins (cold start -5%); without the
snapshot an empty CommonJS entry point compiles 76 -> 59 builtins and an
empty ES module entry point 76 -> 69.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65329
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/fs.js                                     |  3 +-
 .../bootstrap/switches/is_main_thread.js      | 23 +++++++++---
 lib/internal/dns/utils.js                     |  8 ++--
 lib/internal/modules/cjs/loader.js            |  4 +-
 lib/internal/modules/esm/load.js              |  4 +-
 lib/internal/modules/esm/translators.js       |  5 ++-
 lib/internal/process/execution.js             |  4 +-
 lib/internal/process/pre_execution.js         |  7 +++-
 lib/internal/url.js                           | 10 +++--
 lib/internal/worker.js                        |  7 +---
 lib/worker_threads.js                         | 12 ++++--
 test/parallel/test-bootstrap-modules.js       | 37 +++++++++++--------
 12 files changed, 78 insertions(+), 46 deletions(-)

diff --git a/lib/fs.js b/lib/fs.js
index cfed38d8127e..96da9b762dc3 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -64,8 +64,6 @@ const { isArrayBufferView } = require('internal/util/types');
 
 const binding = internalBinding('fs');
 
-const { createBlobFromFilePath } = require('internal/blob');
-
 const { Buffer } = require('buffer');
 const { isBuffer: BufferIsBuffer } = Buffer;
 const BufferToString = uncurryThis(Buffer.prototype.toString);
@@ -784,6 +782,7 @@ function openAsBlob(path, options = kEmptyObject) {
   // To give ourselves flexibility to maybe return the Blob asynchronously,
   // this API returns a Promise.
   path = getValidatedPath(path);
+  const { createBlobFromFilePath } = require('internal/blob');
   return PromiseResolve(createBlobFromFilePath(path, { type }));
 }
 
diff --git a/lib/internal/bootstrap/switches/is_main_thread.js b/lib/internal/bootstrap/switches/is_main_thread.js
index 06ac27c84869..8cf57b231856 100644
--- a/lib/internal/bootstrap/switches/is_main_thread.js
+++ b/lib/internal/bootstrap/switches/is_main_thread.js
@@ -292,12 +292,27 @@ rawMethods.resetStdioForTesting = function() {
 
 // Needed by the module loader and generally needed everywhere.
 require('fs');
-require('util');
-require('url'); // eslint-disable-line no-restricted-modules
 internalBinding('module_wrap');
 require('internal/modules/cjs/loader');
-require('internal/modules/esm/loader');
 require('internal/modules/esm/utils');
+if (isBuildingSnapshot()) {
+  // Preloaded so that they are part of the snapshot, where they cost nothing
+  // at startup. When bootstrapping WITHOUT a snapshot (worker threads,
+  // embedders that create their own isolate, --no-node-snapshot) they are
+  // loaded on first use instead: the ESM loader (with its translators,
+  // resolver and their dependencies) by run_main/import(), the public util
+  // and url modules by whoever requires them, data: URL and TypeScript
+  // support by the module loaders, internal/blob by fs.openAsBlob(), and the
+  // DNS helpers by node:dns or an explicit --dns-result-order (see
+  // pre_execution).
+  require('util');
+  require('url'); // eslint-disable-line no-restricted-modules
+  require('internal/modules/esm/loader');
+  require('internal/data_url');
+  require('internal/modules/typescript');
+  require('internal/blob');
+  require('internal/dns/utils');
+}
 
 // Needed to refresh the time origin.
 require('internal/perf/utils');
@@ -311,8 +326,6 @@ internalBinding('wasm_web_api');
 internalBinding('worker');
 // Needed by most execution modes.
 require('internal/modules/run_main');
-// Needed to refresh DNS configurations.
-require('internal/dns/utils');
 // Needed by almost all execution modes. It's fine to
 // load them into the snapshot as long as we don't run
 // any of the initialization.
diff --git a/lib/internal/dns/utils.js b/lib/internal/dns/utils.js
index 8e70baffb904..50ec10d3b042 100644
--- a/lib/internal/dns/utils.js
+++ b/lib/internal/dns/utils.js
@@ -214,15 +214,15 @@ class ResolverBase {
 }
 
 let defaultResolver;
-let dnsOrder;
+// May already hold a value chosen by the snapshotted application; a
+// --dns-result-order flag given at runtime overrides it in initializeDns().
+let dnsOrder = 'verbatim';
 const validDnsOrders = ['verbatim', 'ipv4first', 'ipv6first'];
 const validFamilies = [0, 4, 6];
 
 function initializeDns() {
   const orderFromCLI = getOptionValue('--dns-result-order');
-  if (!orderFromCLI) {
-    dnsOrder ??= 'verbatim';
-  } else {
+  if (orderFromCLI) {
     // Allow the deserialized application to override order from CLI.
     validateOneOf(orderFromCLI, '--dns-result-order', validDnsOrders);
     dnsOrder = orderFromCLI;
diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
index e1f8a0eed31e..554746b6e2b3 100644
--- a/lib/internal/modules/cjs/loader.js
+++ b/lib/internal/modules/cjs/loader.js
@@ -180,7 +180,7 @@ const {
   resolveWithHooks,
   validateLoadStrict,
 } = require('internal/modules/customization_hooks');
-const { stripTypeScriptModuleTypes } = require('internal/modules/typescript');
+const lazyTypeScript = getLazy(() => require('internal/modules/typescript'));
 const packageJsonReader = require('internal/modules/package_json_reader');
 const { getOptionValue, getEmbedderOptions } = require('internal/options');
 const shouldReportRequiredModules = getLazy(() => process.env.WATCH_REPORT_DEPENDENCIES);
@@ -1885,7 +1885,7 @@ function wrapSafe(filename, content, cjsModuleInstance, format) {
 Module.prototype._compile = function(content, filename, format) {
   if (format === 'commonjs-typescript' || format === 'module-typescript' || format === 'typescript') {
     this[kURL] ??= convertCJSFilenameToURL(filename);
-    content = stripTypeScriptModuleTypes(content, filename, this[kURL]);
+    content = lazyTypeScript().stripTypeScriptModuleTypes(content, filename, this[kURL]);
     switch (format) {
       case 'commonjs-typescript': {
         format = 'commonjs';
diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
index 94879761553e..0c38ae082e32 100644
--- a/lib/internal/modules/esm/load.js
+++ b/lib/internal/modules/esm/load.js
@@ -20,9 +20,6 @@ const {
   ERR_UNSUPPORTED_ESM_URL_SCHEME,
 } = require('internal/errors').codes;
 
-const {
-  dataURLProcessor,
-} = require('internal/data_url');
 
 /**
  * @param {URL} url URL to the module
@@ -40,6 +37,7 @@ function getSourceSync(url, context) {
     // Prefer module.registerHooks() or other more formal fs hooks released in the future.
     source = fs.readFileSync(url);
   } else if (protocol === 'data:') {
+    const { dataURLProcessor } = require('internal/data_url');  // Only for data: URLs.
     const result = dataURLProcessor(url);
     if (result === 'failure') {
       throw new ERR_INVALID_URL(responseURL);
diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
index ad3de25bf6d5..e3baaaefa6c0 100644
--- a/lib/internal/modules/esm/translators.js
+++ b/lib/internal/modules/esm/translators.js
@@ -30,7 +30,10 @@ const {
   stripBOM,
   urlToFilename,
 } = require('internal/modules/helpers');
-const { stripTypeScriptModuleTypes } = require('internal/modules/typescript');
+function stripTypeScriptModuleTypes(source, url) {
+  // Only needed for TypeScript sources; keep it out of the loader's startup path.
+  return require('internal/modules/typescript').stripTypeScriptModuleTypes(source, url);
+}
 const {
   kIsCachedByESMLoader,
   Module: CJSModule,
diff --git a/lib/internal/process/execution.js b/lib/internal/process/execution.js
index 4a2b57790bd7..46cf9f95407a 100644
--- a/lib/internal/process/execution.js
+++ b/lib/internal/process/execution.js
@@ -25,7 +25,9 @@ const {
   kSourcePhase,
   kEvaluationPhase,
 } = internalBinding('module_wrap');
-const { stripTypeScriptModuleTypes } = require('internal/modules/typescript');
+function stripTypeScriptModuleTypes(source, filename) {
+  return require('internal/modules/typescript').stripTypeScriptModuleTypes(source, filename);
+}
 
 const {
   executionAsyncId,
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index 30d1612c459e..59c63d59ed64 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -137,7 +137,12 @@ function prepareExecution(options) {
 
   initializeConfigFileSupport();
 
-  require('internal/dns/utils').initializeDns();
+  // internal/dns/utils (and internal/net behind it) is only needed up front
+  // to validate an explicit --dns-result-order or to register the resolver's
+  // snapshot serialization; otherwise it is loaded with node:dns.
+  if (getOptionValue('--dns-result-order') || isBuildingSnapshot()) {
+    require('internal/dns/utils').initializeDns();
+  }
 
   if (isMainThread) {
     assert(internalBinding('worker').isMainThread);
diff --git a/lib/internal/url.js b/lib/internal/url.js
index e96df6148f98..876a5d2a3618 100644
--- a/lib/internal/url.js
+++ b/lib/internal/url.js
@@ -93,7 +93,11 @@ const {
   kValidateObjectAllowObjects,
 } = require('internal/validators');
 
-const { percentDecode } = require('internal/data_url');
+let percentDecode;
+function lazyPercentDecode(input) {
+  percentDecode ??= require('internal/data_url').percentDecode;
+  return percentDecode(input);
+}
 
 const querystring = require('querystring');
 
@@ -1560,7 +1564,7 @@ function getPathBufferFromURLWin32(url) {
   // percent encoded characters and we take the string as is. Any invalid
   // percent encodings, e.g. `%ZZ` are ignored and are passed through
   // literally.
-  const decodedu8 = percentDecode(Buffer.from(pathname, 'utf8'));
+  const decodedu8 = lazyPercentDecode(Buffer.from(pathname, 'utf8'));
   const decodedPathname = Buffer.from(TypedArrayPrototypeGetBuffer(decodedu8),
                                       TypedArrayPrototypeGetByteOffset(decodedu8),
                                       TypedArrayPrototypeGetByteLength(decodedu8));
@@ -1635,7 +1639,7 @@ function getPathBufferFromURLPosix(url) {
   // won't scan for the slashes at all, and instead will decode the bytes
   // literally into the returned Buffer. We're going to do the best we can and
   // just interpret the input url as a sequence of bytes.
-  const u8 = percentDecode(Buffer.from(pathname, 'utf8'));
+  const u8 = lazyPercentDecode(Buffer.from(pathname, 'utf8'));
   return Buffer.from(TypedArrayPrototypeGetBuffer(u8),
                      TypedArrayPrototypeGetByteOffset(u8),
                      TypedArrayPrototypeGetByteLength(u8));
diff --git a/lib/internal/worker.js b/lib/internal/worker.js
index 3afd2180d705..39eb59ef8f67 100644
--- a/lib/internal/worker.js
+++ b/lib/internal/worker.js
@@ -30,10 +30,6 @@ const {
 const EventEmitter = require('events');
 const assert = require('internal/assert');
 const path = require('path');
-const {
-  internalEventLoopUtilization,
-} = require('internal/perf/event_loop_utilization');
-
 const errorCodes = require('internal/errors').codes;
 const {
   ERR_WORKER_NOT_RUNNING,
@@ -60,7 +56,6 @@ const {
   WritableWorkerStdio,
 } = workerIo;
 const { createMainThreadPort, destroyMainThreadPort } = require('internal/worker/messaging');
-const { deserializeError } = require('internal/error_serdes');
 const { fileURLToPath, isURL, pathToFileURL } = require('internal/url');
 const {
   constructSharedArrayBuffer,
@@ -415,6 +410,7 @@ class Worker extends EventEmitter {
 
   [kOnErrorMessage](serialized) {
     // This is what is called for uncaught exceptions.
+    const { deserializeError } = require('internal/error_serdes');
     const error = deserializeError(serialized);
     this.emit('error', error);
   }
@@ -697,6 +693,7 @@ function makeResourceLimits(float64arr) {
 }
 
 function eventLoopUtilization(util1, util2) {
+  const { internalEventLoopUtilization } = require('internal/perf/event_loop_utilization');
   // TODO(trevnorris): Works to solve the thread-safe read/write issue of
   // loopTime, but has the drawback that it can't be set until the event loop
   // has had a chance to turn. So it will be impossible to read the ELU of
diff --git a/lib/worker_threads.js b/lib/worker_threads.js
index 78007d1502b3..622bef3f55c1 100644
--- a/lib/worker_threads.js
+++ b/lib/worker_threads.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { defineLazyProperties } = require('internal/util');
+
 const {
   isInternalThread,
   isMainThread,
@@ -30,8 +32,6 @@ const {
   isMarkedAsUntransferable,
 } = require('internal/buffer');
 
-const { locks } = require('internal/locks');
-
 module.exports = {
   isInternalThread,
   isMainThread,
@@ -53,5 +53,11 @@ module.exports = {
   BroadcastChannel,
   setEnvironmentData,
   getEnvironmentData,
-  locks,
 };
+
+// The Web Locks API implementation is only needed once `locks` is used.
+defineLazyProperties(
+  module.exports,
+  'internal/locks',
+  ['locks'],
+);
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index 099f8d2eaf05..b4827a13fcea 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -20,10 +20,10 @@ const actual = {
 // add more builtins to worker snapshots, we should also distinguish
 // the two stages for them.
 const expected = {};
+const getFormatNativeModule = 'NativeModule internal/modules/esm/get_format';
 
 expected.beforePreExec = new Set([
   'Internal Binding builtins',
-  'Internal Binding encoding_binding',
   'Internal Binding modules',
   'Internal Binding errors',
   'Internal Binding util',
@@ -88,10 +88,6 @@ expected.beforePreExec = new Set([
   'NativeModule internal/v8/startup_snapshot',
   'NativeModule internal/process/signal',
   'Internal Binding fs',
-  'NativeModule internal/encoding',
-  'NativeModule internal/encoding/single-byte',
-  'NativeModule internal/encoding/util',
-  'NativeModule internal/blob',
   'NativeModule internal/fs/utils',
   'NativeModule fs',
   'Internal Binding options',
@@ -109,15 +105,10 @@ expected.beforePreExec = new Set([
   'Internal Binding diagnostics_channel',
   'Internal Binding wasm_web_api',
   'NativeModule internal/events/abort_listener',
-  'NativeModule internal/modules/typescript',
-  'NativeModule internal/data_url',
-  'NativeModule internal/mime',
   'NativeModule internal/modules/esm/utils',
   'Internal Binding worker',
   'NativeModule internal/modules/run_main',
-  'NativeModule internal/net',
-  'NativeModule internal/dns/utils',
-  'NativeModule internal/modules/esm/get_format',
+  getFormatNativeModule,
   'NativeModule internal/trace_events',
 ]);
 
@@ -126,8 +117,13 @@ expected.atRunTime = new Set([
 ]);
 
 const { isMainThread } = require('worker_threads');
+// Binaries built without the snapshot (e.g. cross-compiled) and
+// --no-node-snapshot bootstrap the main context from scratch, like a worker.
+const mainContextFromSnapshot = isMainThread &&
+  process.config.variables.node_use_node_snapshot &&
+  !process.execArgv.includes('--no-node-snapshot');
 
-if (isMainThread) {
+if (mainContextFromSnapshot) {
   [
     'Internal Binding cjs_lexer',
     'NativeModule internal/modules/esm/assert',
@@ -138,15 +134,24 @@ if (isMainThread) {
     'NativeModule internal/modules/esm/module_job',
     'NativeModule internal/modules/esm/module_map',
     'NativeModule url',
+    'Internal Binding encoding_binding',
+    'NativeModule internal/blob',
+    'NativeModule internal/data_url',
+    'NativeModule internal/dns/utils',
+    'NativeModule internal/encoding',
+    'NativeModule internal/encoding/single-byte',
+    'NativeModule internal/encoding/util',
+    'NativeModule internal/mime',
+    'NativeModule internal/modules/typescript',
+    'NativeModule internal/net',
   ].forEach(expected.beforePreExec.add.bind(expected.beforePreExec));
+} else if (isMainThread) {
+  expected.beforePreExec.delete(getFormatNativeModule);
+  expected.atRunTime.add(getFormatNativeModule);
 } else {  // Worker.
   [
-    'Internal Binding locks',
     'NativeModule diagnostics_channel',
     'NativeModule internal/abort_controller',
-    'NativeModule internal/error_serdes',
-    'NativeModule internal/locks',
-    'NativeModule internal/perf/event_loop_utilization',
     'NativeModule internal/process/worker_thread_only',
     'NativeModule internal/streams/add-abort-signal',
     'NativeModule internal/streams/compose',

From ddf9f9d265c4eeeae03bfc1511de64043dde19c2 Mon Sep 17 00:00:00 2001
From: Richard Lau <richard.lau@ibm.com>
Date: Sat, 22 Aug 2026 18:18:06 +0100
Subject: [PATCH 290/344] build: target Power 9 and z14

Set compiler flags to match the minimum supported Power and z
architectures.

Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/65439
Refs: https://github.com/nodejs/node/pull/61005
Refs: https://chromium-review.googlesource.com/c/v8/v8/+/7239348
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 common.gypi                      | 16 ++++++++--------
 node.gypi                        |  6 ++++++
 tools/v8_gypfiles/toolchain.gypi |  4 ++--
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/common.gypi b/common.gypi
index 0b01ec8c49fe..a83523286a91 100644
--- a/common.gypi
+++ b/common.gypi
@@ -604,12 +604,12 @@
                     'cflags': [ '-mminimal-toc' ],
                   }],
                 ],
-                'cflags': [ '-m64' ],
-                'ldflags': [ '-m64' ],
+                'cflags': [ '-m64', '-mcpu=power9' ],
+                'ldflags': [ '-m64', '-mcpu=power9' ],
               }],
               [ 'host_arch=="s390x" and OS=="linux"', {
-                'cflags': [ '-m64', '-march=z196' ],
-                'ldflags': [ '-m64', '-march=z196' ],
+                'cflags': [ '-m64', '-march=z14' ],
+                'ldflags': [ '-m64', '-march=z14' ],
               }],
             ],
           }],
@@ -629,12 +629,12 @@
                     'cflags': [ '-mminimal-toc' ],
                   }],
                 ],
-                'cflags': [ '-m64' ],
-                'ldflags': [ '-m64' ],
+                'cflags': [ '-m64', '-mcpu=power9' ],
+                'ldflags': [ '-m64', '-mcpu=power9' ],
               }],
               [ 'target_arch=="s390x" and OS=="linux"', {
-                'cflags': [ '-m64', '-march=z196' ],
-                'ldflags': [ '-m64', '-march=z196' ],
+                'cflags': [ '-m64', '-march=z14' ],
+                'ldflags': [ '-m64', '-march=z14' ],
               }],
             ],
           }],
diff --git a/node.gypi b/node.gypi
index 3636633c622a..104e884e6614 100644
--- a/node.gypi
+++ b/node.gypi
@@ -87,6 +87,12 @@
     [ 'OS=="aix" or OS=="os400"', {
       'cflags': [ '-mcpu=power9' ],
     }],
+    [ 'OS=="linux" and target_arch=="ppc64"', {
+      'cflags': [ '-mcpu=power9' ],
+    }],
+    [ 'OS=="linux" and target_arch=="s390x"', {
+      'cflags': [ '-march=z14' ],
+    }],
     [ 'node_enable_d8=="true"', {
       'dependencies': [ 'tools/v8_gypfiles/d8.gyp:d8' ],
     }],
diff --git a/tools/v8_gypfiles/toolchain.gypi b/tools/v8_gypfiles/toolchain.gypi
index 5aa9d020a920..3676848df8a4 100644
--- a/tools/v8_gypfiles/toolchain.gypi
+++ b/tools/v8_gypfiles/toolchain.gypi
@@ -316,7 +316,7 @@
               'V8_TARGET_ARCH_S390_LE_SIM',
             ],
           }, {
-            'cflags': [ '-march=z196' ],
+            'cflags': [ '-march=z14' ],
           }],
           ],
       }],  # s390x
@@ -326,11 +326,11 @@
         ],
         'cflags': [
           '-ffp-contract=off',
+          '-mcpu=power9',
         ],
         'conditions': [
           ['OS=="aix" or OS=="os400"', {
             # Work around AIX ceil, trunc and round oddities.
-            'cflags': [ '-mcpu=power9' ],
             'conditions': [
               ['clang==0', {
                 'cflags': [ '-mfprnd' ],

From 2cb96dd462ae99de26cccac362dca0851c81f5c1 Mon Sep 17 00:00:00 2001
From: Luan Muniz <luanmuniz@users.noreply.github.com>
Date: Sat, 22 Aug 2026 19:18:16 +0200
Subject: [PATCH 291/344] benchmark: add test-only and mock timers cases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only benchmark covers creating selected and non-selected
tests when running with --test-only.

The mock timers benchmark covers enabling timer mocks, setTimeout,
setInterval, setImmediate, scheduler.wait, AbortSignal.timeout,
mocked Date.now(), setTime(), and runAll().

Refs: https://github.com/nodejs/node/issues/55723
Signed-off-by: Luan Muniz <luan@luanmuniz.com.br>
PR-URL: https://github.com/nodejs/node/pull/64097
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 benchmark/test_runner/mock-timers.js | 262 +++++++++++++++++++++++++++
 benchmark/test_runner/test-only.js   |  39 ++++
 2 files changed, 301 insertions(+)
 create mode 100644 benchmark/test_runner/mock-timers.js
 create mode 100644 benchmark/test_runner/test-only.js

diff --git a/benchmark/test_runner/mock-timers.js b/benchmark/test_runner/mock-timers.js
new file mode 100644
index 000000000000..4815c20ecd73
--- /dev/null
+++ b/benchmark/test_runner/mock-timers.js
@@ -0,0 +1,262 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { test } = require('node:test');
+const nodeTimersPromises = require('node:timers/promises');
+
+const bench = common.createBenchmark(main, {
+  n: [1000],
+  mode: [
+    'enable-empty-apis',
+    'enable-setTimeout',
+    'enable-setInterval',
+    'enable-setImmediate',
+    'enable-Date',
+    'enable-scheduler.wait',
+    'enable-AbortSignal.timeout',
+    'enable-all',
+    'enable-default',
+    'setTimeout',
+    'setInterval',
+    'setImmediate',
+    'scheduler.wait',
+    'AbortSignal.timeout',
+    'Date',
+    'setTime',
+    'runAll',
+  ],
+}, {
+  // We don't want to test the reporter here.
+  flags: ['--test-reporter=./benchmark/fixtures/empty-test-reporter.js'],
+});
+
+function benchmarkEnable(n, mode) {
+  const enableMode = mode.replace('enable-', '');
+  let enableOptions = { apis: [enableMode] };
+
+  if (enableMode === 'all') {
+    enableOptions.apis = ['setTimeout', 'setInterval', 'setImmediate', 'Date', 'scheduler.wait', 'AbortSignal.timeout'];
+  }
+
+  if (enableMode === 'empty-apis') {
+    enableOptions.apis = [];
+  }
+
+  if (enableMode === 'default') {
+    enableOptions = undefined;
+  }
+
+  test((t) => {
+    bench.start();
+
+    for (let i = 0; i < n; i++) {
+      t.mock.timers.enable(enableOptions);
+      t.mock.timers.reset();
+    }
+
+    bench.end(n);
+  });
+}
+
+function benchmarkSetTimeout(n) {
+  test((t) => {
+    let noDead;
+
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    bench.start();
+
+    for (let i = 0; i < n; i++) {
+      setTimeout(() => {
+        noDead = i;
+      }, i + 1);
+    }
+
+    t.mock.timers.tick(n + 1);
+    bench.end(n);
+
+    assert.strictEqual(noDead, n - 1);
+  });
+}
+
+function benchmarkSetInterval(n) {
+  test((t) => {
+    let noDead = 0;
+
+    t.mock.timers.enable({ apis: ['setInterval'] });
+
+    setInterval(() => {
+      noDead++;
+    }, 1);
+
+    bench.start();
+
+    t.mock.timers.tick(n);
+
+    bench.end(n);
+
+    assert.strictEqual(noDead, n);
+  });
+}
+
+function benchmarkSetImmediate(n) {
+  test((t) => {
+    let noDead;
+
+    t.mock.timers.enable({ apis: ['setImmediate'] });
+
+    bench.start();
+
+    for (let i = 0; i < n; i++) {
+      setImmediate(() => {
+        noDead = i;
+      });
+    }
+
+    t.mock.timers.tick(0);
+    bench.end(n);
+
+    assert.strictEqual(noDead, n - 1);
+  });
+}
+
+function benchmarkSchedulerWait(n) {
+  test(async (t) => {
+    const promises = [];
+    let noDead;
+
+    t.mock.timers.enable({ apis: ['scheduler.wait'] });
+
+    bench.start();
+
+    for (let i = 0; i < n; i++) {
+      promises.push(nodeTimersPromises.scheduler.wait(i + 1).then(() => {
+        noDead = i;
+      }));
+    }
+
+    t.mock.timers.tick(n + 1);
+    await Promise.all(promises);
+    bench.end(n);
+
+    assert.strictEqual(noDead, n - 1);
+  });
+}
+
+function benchmarkAbortSignalTimeout(n) {
+  test((t) => {
+    let noDead;
+
+    t.mock.timers.enable({ apis: ['AbortSignal.timeout'] });
+
+    bench.start();
+
+    for (let i = 0; i < n; i++) {
+      noDead = AbortSignal.timeout(i + 1);
+    }
+
+    t.mock.timers.tick(n + 1);
+    bench.end(n);
+
+    assert.strictEqual(noDead.aborted, true);
+  });
+}
+
+function benchmarkDate(n) {
+  test((t) => {
+    let noDead;
+
+    t.mock.timers.enable({ apis: ['Date'] });
+
+    bench.start();
+
+    for (let i = 0; i < n; i++) {
+      noDead = Date.now();
+    }
+
+    bench.end(n);
+
+    assert.strictEqual(noDead, 0);
+  });
+}
+
+function benchmarkSetTime(n) {
+  test((t) => {
+    let noDead;
+
+    t.mock.timers.enable({ apis: ['Date'] });
+
+    bench.start();
+
+    for (let i = 0; i < n; i++) {
+      t.mock.timers.setTime(i);
+      noDead = Date.now();
+    }
+
+    bench.end(n);
+
+    assert.strictEqual(noDead, n - 1);
+  });
+}
+
+function benchmarkRunAll(n) {
+  test((t) => {
+    let noDead = 0;
+
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+
+    for (let i = 0; i < n; i++) {
+      setTimeout(() => {
+        noDead++;
+      }, i + 1);
+    }
+
+    bench.start();
+
+    t.mock.timers.runAll();
+
+    bench.end(n);
+
+    assert.strictEqual(noDead, n);
+  });
+}
+
+function main({ n, mode }) {
+  switch (mode) {
+    case 'enable-empty-apis':
+    case 'enable-setTimeout':
+    case 'enable-setInterval':
+    case 'enable-setImmediate':
+    case 'enable-Date':
+    case 'enable-scheduler.wait':
+    case 'enable-AbortSignal.timeout':
+    case 'enable-all':
+    case 'enable-default':
+      benchmarkEnable(n, mode);
+      break;
+    case 'setTimeout':
+      benchmarkSetTimeout(n);
+      break;
+    case 'setInterval':
+      benchmarkSetInterval(n);
+      break;
+    case 'setImmediate':
+      benchmarkSetImmediate(n);
+      break;
+    case 'scheduler.wait':
+      benchmarkSchedulerWait(n);
+      break;
+    case 'AbortSignal.timeout':
+      benchmarkAbortSignalTimeout(n);
+      break;
+    case 'Date':
+      benchmarkDate(n);
+      break;
+    case 'setTime':
+      benchmarkSetTime(n);
+      break;
+    case 'runAll':
+      benchmarkRunAll(n);
+      break;
+  }
+}
diff --git a/benchmark/test_runner/test-only.js b/benchmark/test_runner/test-only.js
new file mode 100644
index 000000000000..fe79f10dfdd8
--- /dev/null
+++ b/benchmark/test_runner/test-only.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const common = require('../common');
+const { finished } = require('node:stream/promises');
+const reporter = require('../fixtures/empty-test-reporter');
+const { test } = require('node:test');
+
+const bench = common.createBenchmark(main, {
+  n: [10000],
+  selected: [1],
+}, {
+  // We don't want to test the reporter here.
+  flags: [
+    '--test-reporter=./benchmark/fixtures/empty-test-reporter.js',
+    '--test-only',
+  ],
+});
+
+async function run({ n, selected }) {
+  for (let i = 0; i < selected; i++) {
+    test(`selected-${i}`, { only: true }, () => {});
+  }
+
+  for (let i = 0; i < n; i++) {
+    test(`not-selected-${i}`, () => {
+      throw new Error(`This test ${i} should not run.`);
+    });
+  }
+
+  return finished(reporter);
+}
+
+function main(params) {
+  bench.start();
+
+  run(params).then(() => {
+    bench.end(params.n);
+  });
+}

From 98e6272c70959eefc83fd3266475705f737668cd Mon Sep 17 00:00:00 2001
From: GetThatCookie <NimmenKeks@gmx.de>
Date: Sat, 22 Aug 2026 19:44:04 +0200
Subject: [PATCH 292/344] http: cache maxHeaderPairs per header section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: GetThatCookie <NimmenKeks@gmx.de>
PR-URL: https://github.com/nodejs/node/pull/64988
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/http/bench-parser.js                |  2 +
 src/node_http_parser.cc                       | 30 +++++---
 ...test-http-parser-max-header-pairs-cache.js | 77 +++++++++++++++++++
 3 files changed, 97 insertions(+), 12 deletions(-)
 create mode 100644 test/parallel/test-http-parser-max-header-pairs-cache.js

diff --git a/benchmark/http/bench-parser.js b/benchmark/http/bench-parser.js
index 0a1e8f7b5e8a..72cb2b6feb18 100644
--- a/benchmark/http/bench-parser.js
+++ b/benchmark/http/bench-parser.js
@@ -31,6 +31,8 @@ function main({ len, n }) {
   function newParser(type) {
     const parser = new HTTPParser();
     parser.initialize(type, {});
+    // Direct parsers bypass cleanParser(); use its production default.
+    parser.maxHeaderPairs = 2000;
 
     parser.headers = [];
 
diff --git a/src/node_http_parser.cc b/src/node_http_parser.cc
index 62e83074bf88..c7b4eeac88f9 100644
--- a/src/node_http_parser.cc
+++ b/src/node_http_parser.cc
@@ -323,6 +323,7 @@ class Parser : public AsyncWrap, public StreamListener {
     allocator_.Reset();
     url_.Reset();
     status_message_.Reset();
+    max_header_pairs_ = -1;
 
     if (connectionsList_ != nullptr) {
       connectionsList_->Push(this);
@@ -465,6 +466,7 @@ class Parser : public AsyncWrap, public StreamListener {
     num_fields_ = 0;
     num_values_ = 0;
     header_pairs_ = 0;
+    max_header_pairs_ = -1;
 
     // METHOD
     if (parser_.type == HTTP_REQUEST) {
@@ -1034,6 +1036,7 @@ class Parser : public AsyncWrap, public StreamListener {
     headers_completed_ = false;
     max_http_header_size_ = max_http_header_size;
     header_pairs_ = 0;
+    max_header_pairs_ = -1;
   }
 
 
@@ -1053,21 +1056,23 @@ class Parser : public AsyncWrap, public StreamListener {
 
     header_pairs_ += 2;
 
-    Local<Value> max_header_pairs_v;
-    if (!object()
-             ->Get(env()->context(),
-                   FIXED_ONE_BYTE_STRING(env()->isolate(), "maxHeaderPairs"))
-             .ToLocal(&max_header_pairs_v)) {
-      got_exception_ = true;
-      return -1;
-    }
+    if (max_header_pairs_ < 0) {
+      Local<Value> max_header_pairs_v;
+      if (!object()
+               ->Get(env()->context(),
+                     FIXED_ONE_BYTE_STRING(env()->isolate(), "maxHeaderPairs"))
+               .ToLocal(&max_header_pairs_v)) {
+        got_exception_ = true;
+        return -1;
+      }
 
-    if (!max_header_pairs_v->IsNumber()) {
-      return 0;
+      const double value = max_header_pairs_v->IsNumber()
+                               ? max_header_pairs_v.As<Number>()->Value()
+                               : 0;
+      max_header_pairs_ = value > 0 ? value : 0;
     }
 
-    const double max_header_pairs = max_header_pairs_v.As<Number>()->Value();
-    if (max_header_pairs > 0 && header_pairs_ > max_header_pairs) {
+    if (max_header_pairs_ > 0 && header_pairs_ > max_header_pairs_) {
       llhttp_set_error_reason(&parser_, "HPE_HEADER_OVERFLOW:Header overflow");
       return HPE_USER;
     }
@@ -1109,6 +1114,7 @@ class Parser : public AsyncWrap, public StreamListener {
   const char* current_buffer_data_;
   bool headers_completed_ = false;
   size_t header_pairs_ = 0;
+  double max_header_pairs_ = -1;
   bool pending_pause_ = false;
   bool received_data_ = false;
   uint64_t header_nread_ = 0;
diff --git a/test/parallel/test-http-parser-max-header-pairs-cache.js b/test/parallel/test-http-parser-max-header-pairs-cache.js
new file mode 100644
index 000000000000..dc8a60f36b0f
--- /dev/null
+++ b/test/parallel/test-http-parser-max-header-pairs-cache.js
@@ -0,0 +1,77 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { HTTPParser } = require('_http_common');
+
+const { REQUEST } = HTTPParser;
+const kOnHeaders = HTTPParser.kOnHeaders | 0;
+const kOnHeadersComplete = HTTPParser.kOnHeadersComplete | 0;
+const kOnBody = HTTPParser.kOnBody | 0;
+const kOnMessageComplete = HTTPParser.kOnMessageComplete | 0;
+
+function createParser() {
+  const parser = new HTTPParser();
+  parser.initialize(REQUEST, {});
+  parser[kOnHeaders] = () => {};
+  parser[kOnHeadersComplete] = () => {};
+  parser[kOnBody] = common.mustNotCall();
+  parser[kOnMessageComplete] = () => {};
+  return parser;
+}
+
+// maxHeaderPairs is cached once for each independent header section. Main
+// headers, trailers, the next message, and a reinitialized parser must each
+// observe a fresh value.
+{
+  const parser = createParser();
+  const limits = [2, 4, 2, 2];
+
+  Object.defineProperty(parser, 'maxHeaderPairs', {
+    configurable: true,
+    get: common.mustCall(() => limits.shift(), limits.length),
+  });
+
+  parser[kOnHeadersComplete] = common.mustCall(undefined, 3);
+  parser[kOnMessageComplete] = common.mustCall(undefined, 3);
+
+  const pipelined = Buffer.from(
+    'POST /first HTTP/1.1\r\n' +
+    'Transfer-Encoding: chunked\r\n' +
+    '\r\n' +
+    '0\r\n' +
+    'X-A: a\r\n' +
+    'X-B: b\r\n' +
+    '\r\n' +
+    'GET /second HTTP/1.1\r\n' +
+    'X-C: c\r\n' +
+    '\r\n'
+  );
+  assert.strictEqual(parser.execute(pipelined, 0, pipelined.length), pipelined.length);
+
+  parser.initialize(REQUEST, {});
+  const reused = Buffer.from('GET /reused HTTP/1.1\r\nX-D: d\r\n\r\n');
+  assert.strictEqual(parser.execute(reused, 0, reused.length), reused.length);
+  assert.deepStrictEqual(limits, []);
+}
+
+// Preserve the existing exception behavior for the first property lookup.
+{
+  const parser = createParser();
+  const expected = new Error('maxHeaderPairs getter');
+  Object.defineProperty(parser, 'maxHeaderPairs', {
+    get: common.mustCall(() => { throw expected; }),
+  });
+  const request = Buffer.from('GET / HTTP/1.1\r\nX-A: a\r\n\r\n');
+  assert.throws(() => parser.execute(request, 0, request.length), expected);
+}
+
+// Non-positive and non-number values continue to mean unlimited.
+for (const maxHeaderPairs of [undefined, null, NaN, 0, -1, new Number(2)]) {
+  const parser = createParser();
+  parser.maxHeaderPairs = maxHeaderPairs;
+  const request = Buffer.from(
+    'GET / HTTP/1.1\r\nX-A: a\r\nX-B: b\r\nX-C: c\r\n\r\n'
+  );
+  assert.strictEqual(parser.execute(request, 0, request.length), request.length);
+}

From b405e9b0398383e0ba6cbb76ca6a15288bfaf40d Mon Sep 17 00:00:00 2001
From: nashit hayat <nashit@bugqore.com>
Date: Sat, 22 Aug 2026 23:14:15 +0530
Subject: [PATCH 293/344] src: fix out-of-bounds write when transcoding
 odd-length ucs2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Nashit-h <nashit@bugqore.com>
PR-URL: https://github.com/nodejs/node/pull/64512
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 src/node_i18n.cc                    |  7 +++++--
 test/parallel/test-icu-transcode.js | 15 +++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/node_i18n.cc b/src/node_i18n.cc
index 96ec2f6ee5ab..e743941734a7 100644
--- a/src/node_i18n.cc
+++ b/src/node_i18n.cc
@@ -121,10 +121,13 @@ MaybeLocal<Object> ToBufferEndian(Environment* env, MaybeStackBuffer<T>* buf) {
 
 void CopySourceBuffer(MaybeStackBuffer<UChar>* dest,
                       const char* data,
-                      const size_t length,
                       const size_t length_in_chars) {
   dest->AllocateSufficientStorage(length_in_chars);
   char* dst = reinterpret_cast<char*>(**dest);
+  // The destination holds length_in_chars UChar units. Copy that many whole
+  // units and ignore a trailing odd byte; copying the raw byte length would
+  // write one byte past the buffer when the source length is not even.
+  const size_t length = length_in_chars * sizeof(UChar);
   memcpy(dst, data, length);
   if constexpr (IsBigEndian()) {
     CHECK(nbytes::SwapBytes16(dst, length));
@@ -197,7 +200,7 @@ MaybeLocal<Object> TranscodeFromUcs2(Environment* env,
   to.set_subst_chars(sub.c_str());
 
   const size_t length_in_chars = source_length / sizeof(UChar);
-  CopySourceBuffer(&sourcebuf, source, source_length, length_in_chars);
+  CopySourceBuffer(&sourcebuf, source, length_in_chars);
   MaybeStackBuffer<char> destbuf(length_in_chars);
   const uint32_t len = ucnv_fromUChars(to.conv(), *destbuf, length_in_chars,
                                        *sourcebuf, length_in_chars, status);
diff --git a/test/parallel/test-icu-transcode.js b/test/parallel/test-icu-transcode.js
index 875d954b6cab..6bcab0054c61 100644
--- a/test/parallel/test-icu-transcode.js
+++ b/test/parallel/test-icu-transcode.js
@@ -88,3 +88,18 @@ assert.deepStrictEqual(
 {
   buffer.transcode(new buffer.Buffer.allocUnsafeSlow(1), 'utf16le', 'ucs2');
 }
+
+// An odd-length ucs2 source must only convert whole 2-byte code units and
+// leave the trailing byte untouched, without reading or writing past the
+// conversion buffer. Lengths are chosen to exercise both the on-stack and the
+// heap-allocated code paths.
+for (const len of [2049, 4099]) {
+  const src = Buffer.alloc(len, 0x61);
+  const wholeUnits = src.subarray(0, len - 1);
+  for (const to of ['latin1', 'ascii']) {
+    assert.deepStrictEqual(
+      buffer.transcode(src, 'utf16le', to),
+      buffer.transcode(wholeUnits, 'utf16le', to),
+      `ucs2->${to} odd length ${len}`);
+  }
+}

From c5cb6bc7e250726d537da0b4134e6490572222e4 Mon Sep 17 00:00:00 2001
From: Samuel Attard <sattard@anthropic.com>
Date: Sat, 22 Aug 2026 10:44:25 -0700
Subject: [PATCH 294/344] fs: allocate FSReqPromise stat arrays lazily

Every promise-based fs operation eagerly allocated two AliasedBuffers
(a stats array and a statfs array) at request creation, although only
stat-family resolutions ever read the first and only statfs() reads
the second. Each allocation is an ArrayBuffer, a TypedArray and a
strong v8::Global. The callback path has no equivalent cost since it
resolves through a shared global array.

Construct the arrays lazily in ResolveStat()/ResolveStatFs() instead.
Once created the lifetime is unchanged, so deferred continuations
still read from request-owned memory.

Improves fs/promises throughput under concurrency: writeFile +53%,
stat +26%, readFile +22% at 64 in-flight operations on tmpfs, with
callback paths unchanged.

Signed-off-by: Sam Attard <sattard@anthropic.com>
PR-URL: https://github.com/nodejs/node/pull/63886
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
---
 src/node_file-inl.h                     | 34 +++++++++++++++----------
 src/node_file.h                         |  7 +++--
 test/pummel/test-heapdump-fs-promise.js |  6 ++---
 3 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/src/node_file-inl.h b/src/node_file-inl.h
index e0fc86bedc74..ebd97c1c8c52 100644
--- a/src/node_file-inl.h
+++ b/src/node_file-inl.h
@@ -209,13 +209,7 @@ FSReqPromise<AliasedBufferT>::FSReqPromise(BindingData* binding_data,
                                            v8::Local<v8::Object> obj,
                                            bool use_bigint)
     : FSReqBase(
-          binding_data, obj, AsyncWrap::PROVIDER_FSREQPROMISE, use_bigint),
-      stats_field_array_(
-          env()->isolate(),
-          static_cast<size_t>(FsStatsOffset::kFsStatsFieldsNumber)),
-      statfs_field_array_(
-          env()->isolate(),
-          static_cast<size_t>(FsStatFsOffset::kFsStatFsFieldsNumber)) {}
+          binding_data, obj, AsyncWrap::PROVIDER_FSREQPROMISE, use_bigint) {}
 
 template <typename AliasedBufferT>
 void FSReqPromise<AliasedBufferT>::Reject(v8::Local<v8::Value> reject) {
@@ -253,14 +247,24 @@ void FSReqPromise<AliasedBufferT>::Resolve(v8::Local<v8::Value> value) {
 
 template <typename AliasedBufferT>
 void FSReqPromise<AliasedBufferT>::ResolveStat(const uv_stat_t* stat) {
-  FillStatsArray(&stats_field_array_, stat);
-  Resolve(stats_field_array_.GetJSArray());
+  if (!stats_field_array_.has_value()) {
+    stats_field_array_.emplace(
+        env()->isolate(),
+        static_cast<size_t>(FsStatsOffset::kFsStatsFieldsNumber));
+  }
+  FillStatsArray(&stats_field_array_.value(), stat);
+  Resolve(stats_field_array_->GetJSArray());
 }
 
 template <typename AliasedBufferT>
 void FSReqPromise<AliasedBufferT>::ResolveStatFs(const uv_statfs_t* stat) {
-  FillStatFsArray(&statfs_field_array_, stat);
-  Resolve(statfs_field_array_.GetJSArray());
+  if (!statfs_field_array_.has_value()) {
+    statfs_field_array_.emplace(
+        env()->isolate(),
+        static_cast<size_t>(FsStatFsOffset::kFsStatFsFieldsNumber));
+  }
+  FillStatFsArray(&statfs_field_array_.value(), stat);
+  Resolve(statfs_field_array_->GetJSArray());
 }
 
 template <typename AliasedBufferT>
@@ -280,8 +284,12 @@ void FSReqPromise<AliasedBufferT>::SetReturnValue(
 template <typename AliasedBufferT>
 void FSReqPromise<AliasedBufferT>::MemoryInfo(MemoryTracker* tracker) const {
   FSReqBase::MemoryInfo(tracker);
-  tracker->TrackField("stats_field_array", stats_field_array_);
-  tracker->TrackField("statfs_field_array", statfs_field_array_);
+  if (stats_field_array_.has_value()) {
+    tracker->TrackField("stats_field_array", stats_field_array_.value());
+  }
+  if (statfs_field_array_.has_value()) {
+    tracker->TrackField("statfs_field_array", statfs_field_array_.value());
+  }
 }
 
 FSReqBase* GetReqWrap(const v8::FunctionCallbackInfo<v8::Value>& args,
diff --git a/src/node_file.h b/src/node_file.h
index 17f3b4203c8e..fab01a4c17b8 100644
--- a/src/node_file.h
+++ b/src/node_file.h
@@ -266,8 +266,11 @@ class FSReqPromise final : public FSReqBase {
                       bool use_bigint);
 
   bool finished_ = false;
-  AliasedBufferT stats_field_array_;
-  AliasedBufferT statfs_field_array_;
+  // Constructed lazily in ResolveStat()/ResolveStatFs(): most operations
+  // never resolve with stats, and eagerly allocating the backing stores
+  // for every request is a significant per-request cost.
+  std::optional<AliasedBufferT> stats_field_array_;
+  std::optional<AliasedBufferT> statfs_field_array_;
 };
 
 class FSReqAfterScope final {
diff --git a/test/pummel/test-heapdump-fs-promise.js b/test/pummel/test-heapdump-fs-promise.js
index 429359e1a6be..5b259ea2dd32 100644
--- a/test/pummel/test-heapdump-fs-promise.js
+++ b/test/pummel/test-heapdump-fs-promise.js
@@ -20,7 +20,7 @@ fs.stat(__filename);
   validateByRetainingPathFromNodes(nodes, 'Node / FSReqPromise', [
     { node_name: 'FSReqPromise', edge_name: 'native_to_javascript' },
   ]);
-  validateByRetainingPathFromNodes(nodes, 'Node / FSReqPromise', [
-    { node_name: 'Node / AliasedFloat64Array', edge_name: 'stats_field_array' },
-  ]);
+  // The stats field array is allocated lazily when the request resolves
+  // with stats, so it is not retained by a request that is still pending
+  // and cannot be observed in a heap snapshot.
 }

From 6305a744df59fe53d50f8df4d2e1a5c70bcb60ac Mon Sep 17 00:00:00 2001
From: Jerry Zhao <165626830+shulaoda@users.noreply.github.com>
Date: Sun, 23 Aug 2026 01:44:37 +0800
Subject: [PATCH 295/344] fs: pass symlink type in cp when filter is provided
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When `fs.cp`/`fs.cpSync` is called with both `verbatimSymlinks: true`
and a `filter` function, directory symlinks were incorrectly created
as file symlinks on Windows.

Without a `filter`, cp takes the C++ fast path (`cpSyncCopyDir`) which
uses `std::filesystem::copy_symlink()` and preserves the symlink type
automatically. With a `filter`, the JS fallback calls `symlinkSync`/
`symlink` without a `type` argument. On Windows, that causes the type
to be auto-detected by stat-ing the resolved target at the destination,
but during a recursive copy the target directory may not exist yet at
the destination (e.g. `linked/` is copied before `packages/` in
alphabetical order). The stat fails and `type` falls back to `'file'`,
producing a file symlink in place of a directory symlink.

Detect the symlink type from the source (which always exists) via
`internalModuleStat(src)` and pass it explicitly to the `symlinkSync`/
`symlink` call sites. `onLink` already computed `srcIsDir` for
subdirectory validation; hoist that computation above the early-return
paths and thread the derived `symlinkType` through `copyLink` as well.
Both the sync (`cp-sync.js`) and async (`cp.js`) implementations are
fixed.

Add two regression tests that copy a tree containing a relative
directory symlink with `verbatimSymlinks: true` and a `filter`
function, then assert the destination link still resolves as a
directory.

Fixes: https://github.com/nodejs/node/issues/62653
Signed-off-by: shulaoda <165626830+shulaoda@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/62654
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/fs/cp/cp-sync.js                 | 13 +++---
 lib/internal/fs/cp/cp.js                      | 14 +++---
 ...sync-verbatim-dir-symlinks-with-filter.mjs | 46 +++++++++++++++++++
 ...sync-verbatim-dir-symlinks-with-filter.mjs | 46 +++++++++++++++++++
 4 files changed, 106 insertions(+), 13 deletions(-)
 create mode 100644 test/parallel/test-fs-cp-async-verbatim-dir-symlinks-with-filter.mjs
 create mode 100644 test/parallel/test-fs-cp-sync-verbatim-dir-symlinks-with-filter.mjs

diff --git a/lib/internal/fs/cp/cp-sync.js b/lib/internal/fs/cp/cp-sync.js
index 03fcae9b7cdb..f2b00f3f82bb 100644
--- a/lib/internal/fs/cp/cp-sync.js
+++ b/lib/internal/fs/cp/cp-sync.js
@@ -191,8 +191,10 @@ function onLink(destStat, src, dest, verbatimSymlinks) {
   if (!verbatimSymlinks && !isAbsolute(resolvedSrc)) {
     resolvedSrc = resolve(dirname(src), resolvedSrc);
   }
+  const srcIsDir = fsBinding.internalModuleStat(src) === 1;
+  const symlinkType = srcIsDir ? 'dir' : 'file';
   if (!destStat) {
-    return symlinkSync(resolvedSrc, dest);
+    return symlinkSync(resolvedSrc, dest, symlinkType);
   }
   let resolvedDest;
   try {
@@ -202,14 +204,13 @@ function onLink(destStat, src, dest, verbatimSymlinks) {
     // Windows may throw UNKNOWN error. If dest already exists,
     // fs throws error anyway, so no need to guard against it here.
     if (err.code === 'EINVAL' || err.code === 'UNKNOWN') {
-      return symlinkSync(resolvedSrc, dest);
+      return symlinkSync(resolvedSrc, dest, symlinkType);
     }
     throw err;
   }
   if (!isAbsolute(resolvedDest)) {
     resolvedDest = resolve(dirname(dest), resolvedDest);
   }
-  const srcIsDir = fsBinding.internalModuleStat(src) === 1;
 
   if (srcIsDir && isSrcSubdir(resolvedSrc, resolvedDest)) {
     throw new ERR_FS_CP_EINVAL({
@@ -233,12 +234,12 @@ function onLink(destStat, src, dest, verbatimSymlinks) {
       code: 'EINVAL',
     });
   }
-  return copyLink(resolvedSrc, dest);
+  return copyLink(resolvedSrc, dest, symlinkType);
 }
 
-function copyLink(resolvedSrc, dest) {
+function copyLink(resolvedSrc, dest, symlinkType) {
   unlinkSync(dest);
-  return symlinkSync(resolvedSrc, dest);
+  return symlinkSync(resolvedSrc, dest, symlinkType);
 }
 
 module.exports = { cpSyncFn };
diff --git a/lib/internal/fs/cp/cp.js b/lib/internal/fs/cp/cp.js
index 10c52b114634..2eb4f0ffdd83 100644
--- a/lib/internal/fs/cp/cp.js
+++ b/lib/internal/fs/cp/cp.js
@@ -336,8 +336,10 @@ async function onLink(destStat, src, dest, opts) {
   if (!opts.verbatimSymlinks && !isAbsolute(resolvedSrc)) {
     resolvedSrc = resolve(dirname(src), resolvedSrc);
   }
+  const srcIsDir = fsBinding.internalModuleStat(src) === 1;
+  const symlinkType = srcIsDir ? 'dir' : 'file';
   if (!destStat) {
-    return symlink(resolvedSrc, dest);
+    return symlink(resolvedSrc, dest, symlinkType);
   }
   let resolvedDest;
   try {
@@ -347,7 +349,7 @@ async function onLink(destStat, src, dest, opts) {
     // Windows may throw UNKNOWN error. If dest already exists,
     // fs throws error anyway, so no need to guard against it here.
     if (err.code === 'EINVAL' || err.code === 'UNKNOWN') {
-      return symlink(resolvedSrc, dest);
+      return symlink(resolvedSrc, dest, symlinkType);
     }
     throw err;
   }
@@ -355,8 +357,6 @@ async function onLink(destStat, src, dest, opts) {
     resolvedDest = resolve(dirname(dest), resolvedDest);
   }
 
-  const srcIsDir = fsBinding.internalModuleStat(src) === 1;
-
   if (srcIsDir && isSrcSubdir(resolvedSrc, resolvedDest)) {
     throw new ERR_FS_CP_EINVAL({
       message: `cannot copy ${resolvedSrc} to a subdirectory of self ` +
@@ -380,12 +380,12 @@ async function onLink(destStat, src, dest, opts) {
       code: 'EINVAL',
     });
   }
-  return copyLink(resolvedSrc, dest);
+  return copyLink(resolvedSrc, dest, symlinkType);
 }
 
-async function copyLink(resolvedSrc, dest) {
+async function copyLink(resolvedSrc, dest, symlinkType) {
   await unlink(dest);
-  return symlink(resolvedSrc, dest);
+  return symlink(resolvedSrc, dest, symlinkType);
 }
 
 module.exports = {
diff --git a/test/parallel/test-fs-cp-async-verbatim-dir-symlinks-with-filter.mjs b/test/parallel/test-fs-cp-async-verbatim-dir-symlinks-with-filter.mjs
new file mode 100644
index 000000000000..8e773bc6065c
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-verbatim-dir-symlinks-with-filter.mjs
@@ -0,0 +1,46 @@
+// This tests that cp with verbatimSymlinks and filter preserves
+// the directory symlink type on Windows (does not create a file symlink).
+import { mustNotMutateObjectDeep, isWindows } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import {
+  mkdirSync,
+  writeFileSync,
+  symlinkSync,
+  readlinkSync,
+  readdirSync,
+  statSync,
+} from 'node:fs';
+import { cp } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import tmpdir from '../common/tmpdir.js';
+tmpdir.refresh();
+
+// Setup source with a relative directory symlink
+const src = nextdir();
+mkdirSync(join(src, 'packages', 'my-lib'), mustNotMutateObjectDeep({ recursive: true }));
+writeFileSync(join(src, 'packages', 'my-lib', 'index.js'), 'module.exports = "hello"');
+mkdirSync(join(src, 'linked'), mustNotMutateObjectDeep({ recursive: true }));
+symlinkSync(join('..', 'packages', 'my-lib'), join(src, 'linked', 'my-lib'), 'dir');
+
+// Copy with verbatimSymlinks: true AND a filter function
+const dest = nextdir();
+await cp(src, dest, mustNotMutateObjectDeep({
+  recursive: true,
+  verbatimSymlinks: true,
+  filter: () => true,
+}));
+
+// Verify the symlink target is preserved verbatim
+const link = readlinkSync(join(dest, 'linked', 'my-lib'));
+if (isWindows) {
+  assert.strictEqual(link.toLowerCase(), join('..', 'packages', 'my-lib').toLowerCase());
+} else {
+  assert.strictEqual(link, join('..', 'packages', 'my-lib'));
+}
+
+// Verify the symlink works as a directory (not a file symlink)
+const destSymlink = join(dest, 'linked', 'my-lib');
+assert.ok(statSync(destSymlink).isDirectory(), 'symlink target should be accessible as a directory');
+assert.deepStrictEqual(readdirSync(destSymlink), ['index.js']);
diff --git a/test/parallel/test-fs-cp-sync-verbatim-dir-symlinks-with-filter.mjs b/test/parallel/test-fs-cp-sync-verbatim-dir-symlinks-with-filter.mjs
new file mode 100644
index 000000000000..7aa0d90ff2a4
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-verbatim-dir-symlinks-with-filter.mjs
@@ -0,0 +1,46 @@
+// This tests that cpSync with verbatimSymlinks and filter preserves
+// the directory symlink type on Windows (does not create a file symlink).
+import { mustNotMutateObjectDeep, isWindows } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import {
+  cpSync,
+  mkdirSync,
+  writeFileSync,
+  symlinkSync,
+  readlinkSync,
+  readdirSync,
+  statSync,
+} from 'node:fs';
+import { join } from 'node:path';
+
+import tmpdir from '../common/tmpdir.js';
+tmpdir.refresh();
+
+// Setup source with a relative directory symlink
+const src = nextdir();
+mkdirSync(join(src, 'packages', 'my-lib'), mustNotMutateObjectDeep({ recursive: true }));
+writeFileSync(join(src, 'packages', 'my-lib', 'index.js'), 'module.exports = "hello"');
+mkdirSync(join(src, 'linked'), mustNotMutateObjectDeep({ recursive: true }));
+symlinkSync(join('..', 'packages', 'my-lib'), join(src, 'linked', 'my-lib'), 'dir');
+
+// Copy with verbatimSymlinks: true AND a filter function
+const dest = nextdir();
+cpSync(src, dest, mustNotMutateObjectDeep({
+  recursive: true,
+  verbatimSymlinks: true,
+  filter: () => true,
+}));
+
+// Verify the symlink target is preserved verbatim
+const link = readlinkSync(join(dest, 'linked', 'my-lib'));
+if (isWindows) {
+  assert.strictEqual(link.toLowerCase(), join('..', 'packages', 'my-lib').toLowerCase());
+} else {
+  assert.strictEqual(link, join('..', 'packages', 'my-lib'));
+}
+
+// Verify the symlink works as a directory (not a file symlink)
+const destSymlink = join(dest, 'linked', 'my-lib');
+assert.ok(statSync(destSymlink).isDirectory(), 'symlink target should be accessible as a directory');
+assert.deepStrictEqual(readdirSync(destSymlink), ['index.js']);

From c4dbe14ec64dd3d42a5f2cd6f02a5c5c3c31be84 Mon Sep 17 00:00:00 2001
From: Yagiz Nizipli <yagiz@nizipli.com>
Date: Sat, 22 Aug 2026 14:48:28 -0400
Subject: [PATCH 296/344] url: speed up URLSearchParams
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parse query strings with indexOf instead of a per-character state
machine, skip ToString when values are already strings, cache
toString() until the list mutates, and join serialized pairs.

Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
Assisted-by: Cursor
PR-URL: https://github.com/nodejs/node/pull/65363
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/url.js                           | 258 +++++++++---------
 .../test-whatwg-url-searchparams-fast-path.js | 116 ++++++++
 2 files changed, 241 insertions(+), 133 deletions(-)
 create mode 100644 test/parallel/test-whatwg-url-searchparams-fast-path.js

diff --git a/lib/internal/url.js b/lib/internal/url.js
index 876a5d2a3618..8f7fe9f083db 100644
--- a/lib/internal/url.js
+++ b/lib/internal/url.js
@@ -74,14 +74,10 @@ const {
   },
 } = require('internal/errors');
 const {
-  CHAR_AMPERSAND,
   CHAR_BACKWARD_SLASH,
-  CHAR_EQUAL,
   CHAR_FORWARD_SLASH,
   CHAR_LOWERCASE_A,
   CHAR_LOWERCASE_Z,
-  CHAR_PERCENT,
-  CHAR_PLUS,
   CHAR_COLON,
 } = require('internal/constants');
 const path = require('path');
@@ -335,12 +331,17 @@ class URLSearchParams {
   // "associated url object"
   #context;
 
+  // Cached application/x-www-form-urlencoded serialization. Cleared on
+  // mutation so repeated toString()/URL.href reads stay cheap.
+  #serialized;
+
   static {
     setURLSearchParamsContext = (obj, ctx) => {
       obj.#context = ctx;
     };
     getURLSearchParamsList = (obj) => obj.#searchParams;
     setURLSearchParams = (obj, query) => {
+      obj.#serialized = undefined;
       if (query === undefined) {
         obj.#searchParams = [];
       } else {
@@ -349,6 +350,13 @@ class URLSearchParams {
     };
   }
 
+  #markUpdated() {
+    this.#serialized = undefined;
+    if (this.#context) {
+      setURLSearchParamsModified(this.#context);
+    }
+  }
+
   // URL Standard says the default value is '', but as undefined and '' have
   // the same result, undefined is used to prevent unnecessary parsing.
   // Default parameter is necessary to keep URLSearchParams.length === 0 in
@@ -365,6 +373,7 @@ class URLSearchParams {
         // shortcut to avoid having to go through the costly generic iterator.
         const childParams = init.#searchParams;
         this.#searchParams = childParams.slice();
+        this.#serialized = init.#serialized;
       } else if (method != null) {
         // Sequence<sequence<USVString>>
         if (typeof method !== 'function') {
@@ -392,8 +401,8 @@ class URLSearchParams {
             // Append (innerSequence[0], innerSequence[1]) to query's list.
             ArrayPrototypePush(
               this.#searchParams,
-              StringPrototypeToWellFormed(`${pair[0]}`),
-              StringPrototypeToWellFormed(`${pair[1]}`),
+              toUSVString(pair[0]),
+              toUSVString(pair[1]),
             );
           } else {
             if (((typeof pair !== 'object' && typeof pair !== 'function') ||
@@ -405,7 +414,7 @@ class URLSearchParams {
 
             for (const element of pair) {
               length++;
-              ArrayPrototypePush(this.#searchParams, StringPrototypeToWellFormed(`${element}`));
+              ArrayPrototypePush(this.#searchParams, toUSVString(element));
             }
 
             // If innerSequence's size is not 2, then throw a TypeError.
@@ -423,8 +432,8 @@ class URLSearchParams {
           const key = keys[i];
           const desc = ReflectGetOwnPropertyDescriptor(init, key);
           if (desc !== undefined && desc.enumerable) {
-            const typedKey = StringPrototypeToWellFormed(key);
-            const typedValue = StringPrototypeToWellFormed(`${init[key]}`);
+            const typedKey = toUSVString(key);
+            const typedValue = toUSVString(init[key]);
 
             // Two different keys may become the same USVString after normalization.
             // In that case, we retain the later one. Refer to WPT.
@@ -441,7 +450,7 @@ class URLSearchParams {
       }
     } else {
       // https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams
-      init = StringPrototypeToWellFormed(`${init}`);
+      init = toUSVString(init);
       this.#searchParams = init ? parseParams(init) : [];
     }
   }
@@ -495,13 +504,10 @@ class URLSearchParams {
       throw new ERR_MISSING_ARGS('name', 'value');
     }
 
-    name = StringPrototypeToWellFormed(`${name}`);
-    value = StringPrototypeToWellFormed(`${value}`);
+    name = toUSVString(name);
+    value = toUSVString(value);
     ArrayPrototypePush(this.#searchParams, name, value);
-
-    if (this.#context) {
-      setURLSearchParamsModified(this.#context);
-    }
+    this.#markUpdated();
   }
 
   delete(name, value = undefined) {
@@ -513,12 +519,12 @@ class URLSearchParams {
     }
 
     const list = this.#searchParams;
-    name = StringPrototypeToWellFormed(`${name}`);
+    name = toUSVString(name);
     const { length } = list;
     let write = 0;
 
     if (value !== undefined) {
-      value = StringPrototypeToWellFormed(`${value}`);
+      value = toUSVString(value);
       for (let i = 0; i < length; i += 2) {
         if (list[i] === name && list[i + 1] === value) {
           continue;
@@ -542,8 +548,10 @@ class URLSearchParams {
       }
     }
 
-    if (write !== length)
+    if (write !== length) {
       list.length = write;
+      this.#serialized = undefined;
+    }
 
     if (this.#context) {
       setURLSearchParamsModified(this.#context);
@@ -559,8 +567,9 @@ class URLSearchParams {
     }
 
     const list = this.#searchParams;
-    name = StringPrototypeToWellFormed(`${name}`);
-    for (let i = 0; i < list.length; i += 2) {
+    name = toUSVString(name);
+    const { length } = list;
+    for (let i = 0; i < length; i += 2) {
       if (list[i] === name) {
         return list[i + 1];
       }
@@ -578,10 +587,11 @@ class URLSearchParams {
 
     const list = this.#searchParams;
     const values = [];
-    name = StringPrototypeToWellFormed(`${name}`);
-    for (let i = 0; i < list.length; i += 2) {
+    name = toUSVString(name);
+    const { length } = list;
+    for (let i = 0; i < length; i += 2) {
       if (list[i] === name) {
-        values.push(list[i + 1]);
+        ArrayPrototypePush(values, list[i + 1]);
       }
     }
     return values;
@@ -596,13 +606,14 @@ class URLSearchParams {
     }
 
     const list = this.#searchParams;
-    name = StringPrototypeToWellFormed(`${name}`);
+    name = toUSVString(name);
 
     if (value !== undefined) {
-      value = StringPrototypeToWellFormed(`${value}`);
+      value = toUSVString(value);
     }
 
-    for (let i = 0; i < list.length; i += 2) {
+    const { length } = list;
+    for (let i = 0; i < length; i += 2) {
       if (list[i] === name) {
         if (value === undefined || list[i + 1] === value) {
           return true;
@@ -622,8 +633,8 @@ class URLSearchParams {
     }
 
     const list = this.#searchParams;
-    name = StringPrototypeToWellFormed(`${name}`);
-    value = StringPrototypeToWellFormed(`${value}`);
+    name = toUSVString(name);
+    value = toUSVString(value);
     const { length } = list;
 
     // If there are any name-value pairs whose name is `name`, in `list`, set
@@ -660,9 +671,7 @@ class URLSearchParams {
       ArrayPrototypePush(list, name, value);
     }
 
-    if (this.#context) {
-      setURLSearchParamsModified(this.#context);
-    }
+    this.#markUpdated();
   }
 
   sort() {
@@ -709,9 +718,7 @@ class URLSearchParams {
       }
     }
 
-    if (this.#context) {
-      setURLSearchParamsModified(this.#context);
-    }
+    this.#markUpdated();
   }
 
   // https://heycam.github.io/webidl/#es-iterators
@@ -764,7 +771,12 @@ class URLSearchParams {
     if (typeof this !== 'object' || this === null || !(#searchParams in this))
       throw new ERR_INVALID_THIS('URLSearchParams');
 
-    return serializeParams(this.#searchParams);
+    if (this.#serialized !== undefined) {
+      return this.#serialized;
+    }
+    const serialized = serializeParams(this.#searchParams);
+    this.#serialized = serialized;
+    return serialized;
   }
 }
 
@@ -1280,102 +1292,82 @@ function installObjectURLMethods() {
   });
 }
 
+function toUSVString(value) {
+  return typeof value === 'string' ?
+    StringPrototypeToWellFormed(value) :
+    StringPrototypeToWellFormed(`${value}`);
+}
+
+function unescapeFormComponent(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return querystring.unescapeBuffer(s).toString();
+  }
+}
+
+function hasPercentHex(s) {
+  const end = s.length - 2;
+  for (let i = 0; i < end; i++) {
+    if (StringPrototypeCharCodeAt(s, i) === 37 && // '%'
+        isHexTable[StringPrototypeCharCodeAt(s, i + 1)] === 1 &&
+        isHexTable[StringPrototypeCharCodeAt(s, i + 2)] === 1) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function decodeFormComponent(qs, start, end) {
+  if (start >= end) {
+    return '';
+  }
+  const s = qs.slice(start, end);
+  const plus = s.indexOf('+');
+  const pct = s.indexOf('%');
+  if (plus === -1 && pct === -1) {
+    return s;
+  }
+  const replaced = plus === -1 ? s : s.replaceAll('+', ' ');
+  // Only percent-decode when a complete %HH sequence exists. A lone '%' or
+  // a '%' followed by a non-hex character must be left intact so later
+  // serialization can encode the raw bytes.
+  if (pct === -1 || !hasPercentHex(replaced)) {
+    return replaced;
+  }
+  return unescapeFormComponent(replaced);
+}
+
 // application/x-www-form-urlencoded parser
 // Ref: https://url.spec.whatwg.org/#concept-urlencoded-parser
 function parseParams(qs) {
-  const out = [];
-  let seenSep = false;
-  let buf = '';
-  let encoded = false;
-  let encodeCheck = 0;
+  const len = qs.length;
   let i = qs[0] === '?' ? 1 : 0;
-  let pairStart = i;
-  let lastPos = i;
-  for (; i < qs.length; ++i) {
-    const code = StringPrototypeCharCodeAt(qs, i);
-
-    // Try matching key/value pair separator
-    if (code === CHAR_AMPERSAND) {
-      if (pairStart === i) {
-        // We saw an empty substring between pair separators
-        lastPos = pairStart = i + 1;
-        continue;
-      }
+  if (i >= len) {
+    return [];
+  }
 
-      if (lastPos < i)
-        buf += qs.slice(lastPos, i);
-      if (encoded)
-        buf = querystring.unescape(buf);
-      out.push(buf);
-
-      // If `buf` is the key, add an empty value.
-      if (!seenSep)
-        out.push('');
-
-      seenSep = false;
-      buf = '';
-      encoded = false;
-      encodeCheck = 0;
-      lastPos = pairStart = i + 1;
-      continue;
-    }
-
-    // Try matching key/value separator (e.g. '=') if we haven't already
-    if (!seenSep && code === CHAR_EQUAL) {
-      // Key/value separator match!
-      if (lastPos < i)
-        buf += qs.slice(lastPos, i);
-      if (encoded)
-        buf = querystring.unescape(buf);
-      out.push(buf);
-
-      seenSep = true;
-      buf = '';
-      encoded = false;
-      encodeCheck = 0;
-      lastPos = i + 1;
-      continue;
-    }
-
-    // Handle + and percent decoding.
-    if (code === CHAR_PLUS) {
-      if (lastPos < i)
-        buf += StringPrototypeSlice(qs, lastPos, i);
-      buf += ' ';
-      lastPos = i + 1;
-    } else if (!encoded) {
-      // Try to match an (valid) encoded byte (once) to minimize unnecessary
-      // calls to string decoding functions
-      if (code === CHAR_PERCENT) {
-        encodeCheck = 1;
-      } else if (encodeCheck > 0) {
-        if (isHexTable[code] === 1) {
-          if (++encodeCheck === 3) {
-            encoded = true;
-          }
-        } else {
-          encodeCheck = 0;
-        }
+  const out = [];
+  // Native indexOf/slice/push outperform primordials on this tight loop.
+  const encoded = qs.indexOf('+', i) !== -1 || qs.indexOf('%', i) !== -1;
+  while (i < len) {
+    let amp = qs.indexOf('&', i);
+    if (amp === -1) {
+      amp = len;
+    }
+    if (amp !== i) {
+      const eq = qs.indexOf('=', i);
+      if (eq === -1 || eq > amp) {
+        out.push(encoded ? decodeFormComponent(qs, i, amp) : qs.slice(i, amp), '');
+      } else {
+        out.push(
+          encoded ? decodeFormComponent(qs, i, eq) : qs.slice(i, eq),
+          encoded ? decodeFormComponent(qs, eq + 1, amp) : qs.slice(eq + 1, amp),
+        );
       }
     }
+    i = amp + 1;
   }
-
-  // Deal with any leftover key or value data
-
-  // There is a trailing &. No more processing is needed.
-  if (pairStart === i)
-    return out;
-
-  if (lastPos < i)
-    buf += StringPrototypeSlice(qs, lastPos, i);
-  if (encoded)
-    buf = querystring.unescape(buf);
-  ArrayPrototypePush(out, buf);
-
-  // If `buf` is the key, add an empty value.
-  if (!seenSep)
-    ArrayPrototypePush(out, '');
-
   return out;
 }
 
@@ -1406,17 +1398,17 @@ function serializeParams(array) {
   if (len === 0)
     return '';
 
-  const firstEncodedParam = encodeStr(array[0], noEscape, paramHexTable);
-  const firstEncodedValue = encodeStr(array[1], noEscape, paramHexTable);
-  let output = `${firstEncodedParam}=${firstEncodedValue}`;
-
-  for (let i = 2; i < len; i += 2) {
-    const encodedParam = encodeStr(array[i], noEscape, paramHexTable);
-    const encodedValue = encodeStr(array[i + 1], noEscape, paramHexTable);
-    output += `&${encodedParam}=${encodedValue}`;
+  if (len === 2) {
+    return encodeStr(array[0], noEscape, paramHexTable) + '=' +
+           encodeStr(array[1], noEscape, paramHexTable);
   }
 
-  return output;
+  const pairs = new Array(len / 2);
+  for (let i = 0, j = 0; i < len; i += 2, ++j) {
+    pairs[j] = encodeStr(array[i], noEscape, paramHexTable) + '=' +
+               encodeStr(array[i + 1], noEscape, paramHexTable);
+  }
+  return ArrayPrototypeJoin(pairs, '&');
 }
 
 // for merge sort
diff --git a/test/parallel/test-whatwg-url-searchparams-fast-path.js b/test/parallel/test-whatwg-url-searchparams-fast-path.js
new file mode 100644
index 000000000000..2dbb38f88aa5
--- /dev/null
+++ b/test/parallel/test-whatwg-url-searchparams-fast-path.js
@@ -0,0 +1,116 @@
+'use strict';
+
+// Tests for the URLSearchParams parse / serialize / toUSVString fast paths.
+
+require('../common');
+const assert = require('assert');
+
+{
+  const params = new URLSearchParams('?a=b');
+  assert.strictEqual(params.toString(), 'a=b');
+  assert.strictEqual(params.get('a'), 'b');
+}
+
+{
+  const params = new URLSearchParams('a=b&c');
+  assert.deepStrictEqual([...params], [['a', 'b'], ['c', '']]);
+}
+
+{
+  const params = new URLSearchParams('&a&&& &&&&&a+b=& c&m%c3%b8%c3%b8');
+  assert.ok(params.has('a'));
+  assert.ok(params.has('a b'));
+  assert.ok(params.has(' '));
+  assert.ok(params.has(' c'));
+  assert.ok(params.has('møø'));
+  assert.strictEqual(params.get('a+b'), null);
+}
+
+{
+  const params = new URLSearchParams('id=0&value=%');
+  assert.strictEqual(params.get('id'), '0');
+  assert.strictEqual(params.get('value'), '%');
+}
+
+{
+  const params = new URLSearchParams('b=%2sf%2a');
+  assert.strictEqual(params.get('b'), '%2sf*');
+}
+
+{
+  const params = new URLSearchParams('a=b=c&d=');
+  assert.strictEqual(params.get('a'), 'b=c');
+  assert.strictEqual(params.get('d'), '');
+}
+
+{
+  const params = new URLSearchParams('foo=bar&baz=quux');
+  assert.strictEqual(params.toString(), 'foo=bar&baz=quux');
+  assert.strictEqual(params.toString(), 'foo=bar&baz=quux');
+  params.append('xyzzy', 'thud');
+  assert.strictEqual(params.toString(), 'foo=bar&baz=quux&xyzzy=thud');
+  params.set('baz', 'updated');
+  assert.strictEqual(params.toString(), 'foo=bar&baz=updated&xyzzy=thud');
+  params.delete('foo');
+  assert.strictEqual(params.toString(), 'baz=updated&xyzzy=thud');
+  params.sort();
+  assert.strictEqual(params.toString(), 'baz=updated&xyzzy=thud');
+}
+
+{
+  const original = new URLSearchParams('a=1&b=2');
+  assert.strictEqual(original.toString(), 'a=1&b=2');
+  const copy = new URLSearchParams(original);
+  assert.strictEqual(copy.toString(), 'a=1&b=2');
+  original.append('c', '3');
+  assert.strictEqual(original.toString(), 'a=1&b=2&c=3');
+  assert.strictEqual(copy.toString(), 'a=1&b=2');
+}
+
+{
+  const params = new URLSearchParams({ foo: 'bar', baz: 1, xyzzy: false });
+  assert.strictEqual(params.get('foo'), 'bar');
+  assert.strictEqual(params.get('baz'), '1');
+  assert.strictEqual(params.get('xyzzy'), 'false');
+  assert.strictEqual(params.toString(), 'foo=bar&baz=1&xyzzy=false');
+}
+
+{
+  const params = new URLSearchParams([['foo', 'bar'], ['baz', 'quux']]);
+  assert.strictEqual(params.toString(), 'foo=bar&baz=quux');
+  assert.ok(params.has('foo', 'bar'));
+  assert.deepStrictEqual(params.getAll('foo'), ['bar']);
+}
+
+{
+  const params = new URLSearchParams('\uD83D');
+  assert.strictEqual(params.keys().next().value, '\uFFFD');
+  assert.strictEqual(params.toString(), '%EF%BF%BD=');
+}
+
+{
+  const params = new URLSearchParams('a=b+c&d=%20');
+  assert.strictEqual(params.get('a'), 'b c');
+  assert.strictEqual(params.get('d'), ' ');
+  assert.strictEqual(params.toString(), 'a=b+c&d=+');
+}
+
+{
+  // Fake percent-encoding must not be UTF-8-decoded into U+FFFD.
+  const params = new URLSearchParams('foo=%©ar&baz=%A©uux&xyzzy=%©ud');
+  assert.deepStrictEqual([...params], [
+    ['foo', '%©ar'],
+    ['baz', '%A©uux'],
+    ['xyzzy', '%©ud'],
+  ]);
+  assert.strictEqual(params.toString(), 'foo=%25%C2%A9ar&baz=%25A%C2%A9uux&xyzzy=%25%C2%A9ud');
+}
+
+{
+  const url = new URL('https://example.org/?foo=bar');
+  const params = url.searchParams;
+  assert.strictEqual(params.toString(), 'foo=bar');
+  params.append('baz', 'quux');
+  assert.strictEqual(url.search, '?foo=bar&baz=quux');
+  assert.strictEqual(params.toString(), 'foo=bar&baz=quux');
+}

From 79c39c217d9cae91c21047c96017eb2cf89f3306 Mon Sep 17 00:00:00 2001
From: mag123c <diehreo@gmail.com>
Date: Sun, 18 Jan 2026 14:48:44 +0900
Subject: [PATCH 297/344] test_runner: print coverage and diagnostic info with
 dot reporter

When using the dot reporter with coverage enabled, coverage threshold
failures and coverage reports were not printed, only an exit code was
returned. This made it impossible to know why the test run failed.

This change adds handling for test:diagnostic and test:coverage events
to the dot reporter, matching the behavior of the spec reporter.

Fixes: https://github.com/nodejs/node/issues/60884
Signed-off-by: mag123c <diehreo@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61423
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/test_runner/reporter/dot.js      | 25 ++++++++++++++++++-
 .../output/dot_reporter_coverage_threshold.js | 17 +++++++++++++
 .../dot_reporter_coverage_threshold.snapshot  | 18 +++++++++++++
 .../test-runner-coverage-thresholds.js        | 21 ++++++++++++++++
 ...output-dot-reporter-coverage-threshold.mjs | 15 +++++++++++
 5 files changed, 95 insertions(+), 1 deletion(-)
 create mode 100644 test/fixtures/test-runner/output/dot_reporter_coverage_threshold.js
 create mode 100644 test/fixtures/test-runner/output/dot_reporter_coverage_threshold.snapshot
 create mode 100644 test/test-runner/test-output-dot-reporter-coverage-threshold.mjs

diff --git a/lib/internal/test_runner/reporter/dot.js b/lib/internal/test_runner/reporter/dot.js
index 45ff047bc4e5..1d73523f3c3e 100644
--- a/lib/internal/test_runner/reporter/dot.js
+++ b/lib/internal/test_runner/reporter/dot.js
@@ -4,12 +4,19 @@ const {
   MathMax,
 } = primordials;
 const colors = require('internal/util/colors');
-const { formatTestReport } = require('internal/test_runner/reporter/utils');
+const { getCoverageReport } = require('internal/test_runner/utils');
+const {
+  formatTestReport,
+  reporterColorMap,
+  reporterUnicodeSymbolMap,
+} = require('internal/test_runner/reporter/utils');
 
 module.exports = async function* dot(source) {
   let count = 0;
   let columns = getLineLength();
   const failedTests = [];
+  const diagnostics = [];
+  let coverage;
   for await (const { type, data } of source) {
     if (type === 'test:pass') {
       yield `${colors.green}.${colors.reset}`;
@@ -25,8 +32,24 @@ module.exports = async function* dot(source) {
       columns = getLineLength();
       count = 0;
     }
+    if (type === 'test:diagnostic' && data.level === 'error') {
+      ArrayPrototypePush(diagnostics, data);
+    }
+    if (type === 'test:coverage') {
+      coverage = data;
+    }
   }
   yield '\n';
+  if (diagnostics.length > 0) {
+    for (const diagnostic of diagnostics) {
+      const color = reporterColorMap[diagnostic.level] || reporterColorMap['test:diagnostic'];
+      yield `${color}${reporterUnicodeSymbolMap['test:diagnostic']}${diagnostic.message}${colors.white}\n`;
+    }
+    if (coverage) {
+      yield getCoverageReport('', coverage.summary,
+                              reporterUnicodeSymbolMap['test:coverage'], colors.blue, true);
+    }
+  }
   if (failedTests.length > 0) {
     yield `\n${colors.red}Failed tests:${colors.white}\n\n`;
     for (const test of failedTests) {
diff --git a/test/fixtures/test-runner/output/dot_reporter_coverage_threshold.js b/test/fixtures/test-runner/output/dot_reporter_coverage_threshold.js
new file mode 100644
index 000000000000..b49dd1488151
--- /dev/null
+++ b/test/fixtures/test-runner/output/dot_reporter_coverage_threshold.js
@@ -0,0 +1,17 @@
+'use strict';
+require('../../../common');
+const fixtures = require('../../../common/fixtures');
+const spawn = require('node:child_process').spawn;
+
+spawn(
+  process.execPath,
+  [
+    '--no-warnings',
+    '--experimental-test-coverage',
+    '--test-coverage-exclude=!test/**',
+    '--test-coverage-lines=99',
+    '--test-reporter', 'dot',
+    fixtures.path('test-runner/coverage.js'),
+  ],
+  { stdio: 'inherit' },
+);
diff --git a/test/fixtures/test-runner/output/dot_reporter_coverage_threshold.snapshot b/test/fixtures/test-runner/output/dot_reporter_coverage_threshold.snapshot
new file mode 100644
index 000000000000..0645329f1a84
--- /dev/null
+++ b/test/fixtures/test-runner/output/dot_reporter_coverage_threshold.snapshot
@@ -0,0 +1,18 @@
+invalid tap output
+.
+ℹ Error: 78.35% line coverage does not meet threshold of 99%.
+ℹ start of coverage report
+ℹ --------------------------------------------------------------------------------------------
+ℹ file              | line % | branch % | funcs % | uncovered lines
+ℹ --------------------------------------------------------------------------------------------
+ℹ test              |        |          |         |
+ℹ  fixtures         |        |          |         |
+ℹ   test-runner     |        |          |         |
+ℹ    coverage.js    |  78.65 |    38.46 |   60.00 | 12-13 16-22 27 39 43-44 61-62 66-67 71-72
+ℹ    invalid-tap.js | 100.00 |   100.00 |  100.00 |
+ℹ   v8-coverage     |        |          |         |
+ℹ    throw.js       |  71.43 |    50.00 |  100.00 | 5-6
+ℹ --------------------------------------------------------------------------------------------
+ℹ all files         |  78.35 |    43.75 |   60.00 |
+ℹ --------------------------------------------------------------------------------------------
+ℹ end of coverage report
diff --git a/test/parallel/test-runner-coverage-thresholds.js b/test/parallel/test-runner-coverage-thresholds.js
index e45e1191299c..2742464adf64 100644
--- a/test/parallel/test-runner-coverage-thresholds.js
+++ b/test/parallel/test-runner-coverage-thresholds.js
@@ -170,4 +170,25 @@ for (const coverage of coverages) {
     assert.strictEqual(result.status, 1);
     assert(!findCoverageFileForPid(result.pid));
   });
+
+  test(`test failing ${coverage.flag} with dot reporter`, () => {
+    const result = spawnSync(process.execPath, [
+      '--test',
+      '--experimental-test-coverage',
+      '--test-coverage-exclude=!test/**',
+      `${coverage.flag}=99`,
+      '--test-reporter', 'dot',
+      fixture,
+    ]);
+
+    const stdout = result.stdout.toString();
+    assert.match(
+      stdout,
+      RegExp(`Error: ${coverage.actual.toFixed(2)}% ${coverage.name} coverage does not meet threshold of 99%`)
+    );
+    assert.match(stdout, /start of coverage report/);
+    assert.match(stdout, /end of coverage report/);
+    assert.strictEqual(result.status, 1);
+    assert(!findCoverageFileForPid(result.pid));
+  });
 }
diff --git a/test/test-runner/test-output-dot-reporter-coverage-threshold.mjs b/test/test-runner/test-output-dot-reporter-coverage-threshold.mjs
new file mode 100644
index 000000000000..e764863a6b0b
--- /dev/null
+++ b/test/test-runner/test-output-dot-reporter-coverage-threshold.mjs
@@ -0,0 +1,15 @@
+// Test that the output of test-runner/output/dot_reporter_coverage_threshold.js matches
+// test-runner/output/dot_reporter_coverage_threshold.snapshot
+import * as common from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+import { spawnAndAssert, specTransform, ensureCwdIsProjectRoot } from '../common/assertSnapshot.js';
+
+if (!process.features.inspector) {
+  common.skip('inspector support required');
+}
+
+ensureCwdIsProjectRoot();
+await spawnAndAssert(
+  fixtures.path('test-runner/output/dot_reporter_coverage_threshold.js'),
+  specTransform,
+);

From 4a1c9a7ee0d618ba346538989d49333a7eec8c5c Mon Sep 17 00:00:00 2001
From: Sumit Kumar Das <151006536+skdas20@users.noreply.github.com>
Date: Sun, 23 Aug 2026 02:07:46 +0530
Subject: [PATCH 298/344] esm: avoid super-linear data URL MIME regex

The MIME regex used for data: URLs could backtrack super-linearly on a
malformed URL lacking a ',' separator. Make the optional parameter
group anchored on ';' so it cannot overlap with the media-type group.

Adds a benchmark (esm/get-data-protocol-format) parameterized over
path length, so a backtracking regression shows up as an ops/sec
cliff instead of a wall-clock assertion in a test, per review.

Fixes: https://github.com/nodejs/node/issues/61904
Signed-off-by: skdas20 <skdas5405@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61951
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 benchmark/esm/get-data-protocol-format.js | 30 +++++++++++++++++++++++
 lib/internal/modules/esm/get_format.js    |  2 +-
 lib/internal/modules/esm/load.js          |  2 +-
 3 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 benchmark/esm/get-data-protocol-format.js

diff --git a/benchmark/esm/get-data-protocol-format.js b/benchmark/esm/get-data-protocol-format.js
new file mode 100644
index 000000000000..35e54a770035
--- /dev/null
+++ b/benchmark/esm/get-data-protocol-format.js
@@ -0,0 +1,30 @@
+// Benchmarks defaultGetFormat() on `data:` URLs. The MIME-matching regex used
+// to be susceptible to catastrophic backtracking on malformed input lacking a
+// `,` separator (https://github.com/nodejs/node/issues/61904); `pathLength`
+// scales the malformed path so a regression shows up as a sharp drop in ops/sec
+// rather than a hang.
+'use strict';
+
+const common = require('../common.js');
+
+const configs = {
+  n: [1e4],
+  pathLength: [1e2, 1e3, 1e4],
+};
+
+const options = {
+  flags: ['--expose-internals'],
+};
+
+const bench = common.createBenchmark(main, configs, options);
+
+function main({ n, pathLength }) {
+  const { defaultGetFormat } = require('internal/modules/esm/get_format');
+  const url = new URL(`data:a/${'a'.repeat(pathLength)}B`);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    defaultGetFormat(url, { parentURL: undefined });
+  }
+  bench.end(n);
+}
diff --git a/lib/internal/modules/esm/get_format.js b/lib/internal/modules/esm/get_format.js
index 7bc69b3eb5c3..b486337fac83 100644
--- a/lib/internal/modules/esm/get_format.js
+++ b/lib/internal/modules/esm/get_format.js
@@ -104,7 +104,7 @@ function detectModuleFormat(source, url) {
  */
 function getDataProtocolModuleFormat(parsed) {
   const { 1: mime } = RegExpPrototypeExec(
-    /^([^/]+\/[^;,]+)(?:[^,]*?)(;base64)?,/,
+    /^([^/]+\/[^;,]+)(?:;[^,]*)?,/,
     parsed.pathname,
   ) || [ null, null, null ];
 
diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
index 0c38ae082e32..f8487eda020d 100644
--- a/lib/internal/modules/esm/load.js
+++ b/lib/internal/modules/esm/load.js
@@ -201,7 +201,7 @@ function throwIfUnsupportedURLScheme(parsed) {
  */
 function throwUnknownModuleFormat(url, format) {
   const dataUrl = RegExpPrototypeExec(
-    /^data:([^/]+\/[^;,]+)(?:[^,]*?)(;base64)?,/,
+    /^data:([^/]+\/[^;,]+)(?:;[^,]*)?,/,
     url,
   );
 

From acaf986ad5f1b8ad1f6a63f8907ca2978cb26f04 Mon Sep 17 00:00:00 2001
From: Yagiz Nizipli <yagiz@nizipli.com>
Date: Sat, 22 Aug 2026 17:02:18 -0400
Subject: [PATCH 299/344] test: add Headers coverage and benchmark
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add WHATWG Headers unit tests and a fetch/headers benchmark so Node
can track the API after the implementation change lands in undici.

Refs: https://github.com/nodejs/undici/pull/5699
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: https://github.com/nodejs/node/pull/65365
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/fetch/headers.js             |  94 ++++++++++
 test/benchmark/test-benchmark-fetch.js |   7 +
 test/parallel/test-whatwg-headers.js   | 245 +++++++++++++++++++++++++
 3 files changed, 346 insertions(+)
 create mode 100644 benchmark/fetch/headers.js
 create mode 100644 test/benchmark/test-benchmark-fetch.js
 create mode 100644 test/parallel/test-whatwg-headers.js

diff --git a/benchmark/fetch/headers.js b/benchmark/fetch/headers.js
new file mode 100644
index 000000000000..4ff5091ebfbf
--- /dev/null
+++ b/benchmark/fetch/headers.js
@@ -0,0 +1,94 @@
+'use strict';
+const common = require('../common.js');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  method: [
+    'construct-empty',
+    'construct-object',
+    'construct-headers',
+    'get',
+    'get-common',
+    'set',
+    'append',
+    'has',
+    'delete',
+    'iterate',
+  ],
+});
+
+const objectInit = {
+  'Accept': 'application/json',
+  'Content-Type': 'text/plain',
+  'User-Agent': 'benchmark',
+  'Authorization': 'Bearer token',
+  'Cookie': 'a=1',
+  'X-Request-Id': 'abc',
+  'Cache-Control': 'no-cache',
+  'Host': 'example.com',
+};
+
+function main({ n, method }) {
+  const headers = new Headers(objectInit);
+  const copySource = new Headers(objectInit);
+  let result;
+
+  bench.start();
+  switch (method) {
+    case 'construct-empty':
+      for (let i = 0; i < n; i++)
+        new Headers();
+      break;
+    case 'construct-object':
+      for (let i = 0; i < n; i++)
+        new Headers(objectInit);
+      break;
+    case 'construct-headers':
+      for (let i = 0; i < n; i++)
+        new Headers(copySource);
+      break;
+    case 'get':
+      for (let i = 0; i < n; i++)
+        result = headers.get('x-request-id');
+      break;
+    case 'get-common':
+      for (let i = 0; i < n; i++)
+        result = headers.get('content-type');
+      break;
+    case 'set':
+      for (let i = 0; i < n; i++)
+        headers.set('x-count', i);
+      break;
+    case 'append':
+      for (let i = 0; i < n; i++) {
+        const current = new Headers();
+        current.append('Accept', 'text/html');
+        current.append('X-Custom', i);
+      }
+      break;
+    case 'has':
+      for (let i = 0; i < n; i++)
+        result = headers.has('authorization');
+      break;
+    case 'delete': {
+      for (let i = 0; i < n; i++) {
+        const current = new Headers(objectInit);
+        current.delete('content-type');
+      }
+      break;
+    }
+    case 'iterate':
+      for (let i = 0; i < n; i++) {
+        for (const entry of headers)
+          result = entry;
+      }
+      break;
+    default:
+      throw new Error(`Unexpected method "${method}"`);
+  }
+  bench.end(n);
+
+  // Keep a live use so V8 cannot DCE the loop.
+  if (result === Symbol.for('benchmark-never'))
+    throw new Error('unreachable');
+}
diff --git a/test/benchmark/test-benchmark-fetch.js b/test/benchmark/test-benchmark-fetch.js
new file mode 100644
index 000000000000..e9c686003a01
--- /dev/null
+++ b/test/benchmark/test-benchmark-fetch.js
@@ -0,0 +1,7 @@
+'use strict';
+
+require('../common');
+
+const runBenchmark = require('../common/benchmark');
+
+runBenchmark('fetch', { NODEJS_BENCHMARK_ZERO_ALLOWED: 1 });
diff --git a/test/parallel/test-whatwg-headers.js b/test/parallel/test-whatwg-headers.js
new file mode 100644
index 000000000000..94610128ce11
--- /dev/null
+++ b/test/parallel/test-whatwg-headers.js
@@ -0,0 +1,245 @@
+'use strict';
+
+// Tests below are not from WPT.
+
+require('../common');
+const assert = require('assert');
+const util = require('util');
+
+{
+  const headers = new Headers();
+  assert.strictEqual(headers.get('content-type'), null);
+  assert.strictEqual(headers.has('content-type'), false);
+  assert.deepStrictEqual([...headers], []);
+  assert.deepStrictEqual(headers.getSetCookie(), []);
+}
+
+{
+  const headers = new Headers({
+    'Content-Type': 'text/plain',
+    'Accept': 'application/json',
+    'X-Custom': '1',
+  });
+  assert.strictEqual(headers.get('content-type'), 'text/plain');
+  assert.strictEqual(headers.get('Content-Type'), 'text/plain');
+  assert.strictEqual(headers.get('ACCEPT'), 'application/json');
+  assert.ok(headers.has('accept'));
+  assert.deepStrictEqual([...headers], [
+    ['accept', 'application/json'],
+    ['content-type', 'text/plain'],
+    ['x-custom', '1'],
+  ]);
+}
+
+{
+  const headers = new Headers([
+    ['X-A', '1'],
+    ['x-b', '2'],
+    ['X-A', '3'],
+  ]);
+  assert.strictEqual(headers.get('x-a'), '1, 3');
+  assert.deepStrictEqual([...headers], [
+    ['x-a', '1, 3'],
+    ['x-b', '2'],
+  ]);
+}
+
+{
+  const source = new Headers({ 'Content-Type': 'text/html' });
+  source.append('Set-Cookie', 'a=b');
+  source.append('Set-Cookie', 'c=d');
+  const copy = new Headers(source);
+  assert.strictEqual(copy.get('content-type'), 'text/html');
+  assert.deepStrictEqual(copy.getSetCookie(), ['a=b', 'c=d']);
+  assert.deepStrictEqual([...copy], [...source]);
+  copy.append('X-Copy', 'yes');
+  assert.strictEqual(source.has('x-copy'), false);
+  source.append('Set-Cookie', 'e=f');
+  assert.deepStrictEqual(copy.getSetCookie(), ['a=b', 'c=d']);
+}
+
+{
+  const headers = new Headers();
+  headers.append('Accept', 'text/html');
+  headers.append('accept', 'application/json');
+  assert.strictEqual(headers.get('ACCEPT'), 'text/html, application/json');
+  headers.set('ACCEPT', 'image/png');
+  assert.strictEqual(headers.get('accept'), 'image/png');
+  headers.delete('Accept');
+  assert.strictEqual(headers.has('accept'), false);
+}
+
+{
+  const headers = new Headers();
+  headers.append('Cookie', 'a=1');
+  headers.append('cookie', 'b=2');
+  assert.strictEqual(headers.get('cookie'), 'a=1; b=2');
+}
+
+{
+  const headers = new Headers();
+  headers.append('set-cookie', 'a=b');
+  headers.append('Set-Cookie', 'c=d');
+  assert.deepStrictEqual(headers.getSetCookie(), ['a=b', 'c=d']);
+  const cloned = headers.getSetCookie();
+  cloned.push('e=f');
+  assert.deepStrictEqual(headers.getSetCookie(), ['a=b', 'c=d']);
+  headers.set('set-cookie', 'only=one');
+  assert.deepStrictEqual(headers.getSetCookie(), ['only=one']);
+  headers.delete('SET-COOKIE');
+  assert.deepStrictEqual(headers.getSetCookie(), []);
+}
+
+{
+  const headers = new Headers();
+  headers.set('a', '  value  ');
+  assert.strictEqual(headers.get('a'), 'value');
+  headers.set('b', '\r\n\t  trimmed\t\n');
+  assert.strictEqual(headers.get('b'), 'trimmed');
+  headers.set('c', '\r');
+  assert.strictEqual(headers.get('c'), '');
+  headers.set('d', '\n');
+  assert.strictEqual(headers.get('d'), '');
+}
+
+{
+  const headers = new Headers();
+  headers.set('a', ['b', 'c']);
+  assert.strictEqual(headers.get('a'), 'b,c');
+  headers.set('b', null);
+  assert.strictEqual(headers.get('b'), 'null');
+  headers.set('c', 1);
+  assert.strictEqual(headers.get('c'), '1');
+}
+
+{
+  const headers = new Headers({
+    c: '5',
+    b: ['3', '4'],
+    a: ['1', '2'],
+  });
+  assert.deepStrictEqual([...headers.entries()], [
+    ['a', '1,2'],
+    ['b', '3,4'],
+    ['c', '5'],
+  ]);
+}
+
+{
+  const init = [
+    ['foo', '123'],
+    ['bar', '456'],
+  ];
+  const headers = new Headers(init);
+  for (const [key, val] of headers) {
+    headers.delete(key);
+    headers.set(`x-${key}`, val);
+  }
+  assert.deepStrictEqual([...headers], [
+    ['foo', '123'],
+    ['x-x-bar', '456'],
+  ]);
+}
+
+{
+  const headers = new Headers([
+    ['b', '2'],
+    ['c', '3'],
+    ['e', '5'],
+  ]);
+  headers.append('d', '4');
+  headers.append('a', '1');
+  headers.append('f', '6');
+  headers.append('c', '7');
+  headers.append('abc', '8');
+  assert.deepStrictEqual([...headers], [
+    ['a', '1'],
+    ['abc', '8'],
+    ['b', '2'],
+    ['c', '3, 7'],
+    ['d', '4'],
+    ['e', '5'],
+    ['f', '6'],
+  ]);
+}
+
+{
+  const headers = new Headers({ 'Content-Type': 'application/json' });
+  headers.set('Authorization', 'Bearer token');
+  assert.strictEqual(
+    util.inspect(headers, { depth: 1 }),
+    "Headers { 'Content-Type': 'application/json', Authorization: 'Bearer token' }",
+  );
+}
+
+{
+  const headers = new Headers();
+  assert.throws(() => headers.get(), TypeError);
+  assert.throws(() => headers.has(), TypeError);
+  assert.throws(() => headers.delete(), TypeError);
+  assert.throws(() => headers.append('a'), TypeError);
+  assert.throws(() => headers.set('a'), TypeError);
+  assert.throws(() => headers.append('invalid @ name', 'x'), TypeError);
+  assert.throws(() => headers.set('a', 'a\nb'), TypeError);
+  assert.throws(() => headers.set('a', 'a\rb'), TypeError);
+  assert.throws(() => headers.set('a', 'a\0b'), TypeError);
+  assert.throws(() => headers.set(Symbol('x'), 'y'), TypeError);
+  assert.throws(() => headers.set('a', Symbol('y')), TypeError);
+  assert.throws(() => headers.set('', 'x'), TypeError);
+  assert.throws(() => headers.set('a', 'héllo\u0100'), TypeError);
+  assert.throws(() => new Headers(1), TypeError);
+  assert.throws(() => new Headers('1'), TypeError);
+  assert.throws(() => new Headers([['undici', 'fetch'], ['fetch']]), TypeError);
+}
+
+{
+  assert.throws(() => Headers.prototype.get.call(null, 'a'), {
+    name: 'TypeError',
+    code: 'ERR_INVALID_THIS',
+  });
+  assert.throws(() => Headers.prototype.append.call({}, 'a', 'b'), {
+    name: 'TypeError',
+    code: 'ERR_INVALID_THIS',
+  });
+}
+
+{
+  assert.strictEqual(Headers.prototype.append.length, 2);
+  assert.strictEqual(Headers.prototype.constructor.length, 0);
+  assert.strictEqual(Headers.prototype.delete.length, 1);
+  assert.strictEqual(Headers.prototype.get.length, 1);
+  assert.strictEqual(Headers.prototype.has.length, 1);
+  assert.strictEqual(Headers.prototype.set.length, 2);
+  assert.strictEqual(Headers.prototype.entries, Headers.prototype[Symbol.iterator]);
+  assert.strictEqual(Headers.prototype[Symbol.toStringTag], 'Headers');
+  assert.strictEqual(Object.prototype.toString.call(Headers.prototype), '[object Headers]');
+}
+
+{
+  const headers = new Headers();
+  headers.set('content-type', 'text/plain');
+  assert.strictEqual(headers.delete('content-type'), undefined);
+  assert.strictEqual(headers.delete('missing'), undefined);
+  assert.strictEqual(headers.set('a', 'b'), undefined);
+}
+
+{
+  const headers = new Headers();
+  for (const name of [
+    'content-type',
+    'accept',
+    'user-agent',
+    'cache-control',
+    'set-cookie',
+  ]) {
+    headers.set(name, 'value');
+    assert.strictEqual(headers.get(name), 'value');
+    assert.ok(headers.has(name));
+  }
+}
+
+{
+  const headers = new Headers();
+  headers.append('fhqwhgads', `a${'\t'.repeat(1000)}a`);
+  assert.strictEqual(headers.get('fhqwhgads'), `a${'\t'.repeat(1000)}a`);
+}

From c42fbcc0d12c1fcb99ab29d85335047d23542928 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sat, 22 Aug 2026 17:23:36 -0800
Subject: [PATCH 300/344] stream: avoid duplicated endReadableNT scheduling

Calling read() on an ended stream multiple times before the microtask
queue drains scheduled one endReadableNT tick per call, as the only
guard was endEmitted, which is set inside the tick itself. A hello-world
HTTP server was scheduling it four times per request while dumping the
unread request body.

Introduce a kEndScheduled flag armed when the tick is scheduled and
cleared when it runs. Clearing it unconditionally matters for reused
sockets: undestroy() resets endEmitted through the state descriptors
but cannot reach this flag, and a stale value would block the 'end'
event after a net.Socket reconnect.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65310
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 lib/internal/streams/readable.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/internal/streams/readable.js b/lib/internal/streams/readable.js
index 2b87b7952bf9..56b819abac4f 100644
--- a/lib/internal/streams/readable.js
+++ b/lib/internal/streams/readable.js
@@ -137,6 +137,7 @@ const kFlowing = 1 << 24;
 const kHasPaused = 1 << 25;
 const kPaused = 1 << 26;
 const kDataListening = 1 << 27;
+const kEndScheduled = 1 << 28;
 
 // TODO(benjamingr) it is likely slower to do it this way than with free functions
 function makeBitMapDescriptor(bit) {
@@ -1944,8 +1945,8 @@ function endReadable(stream) {
   const state = stream._readableState;
 
   debug('endReadable');
-  if ((state[kState] & kEndEmitted) === 0) {
-    state[kState] |= kEnded;
+  if ((state[kState] & (kEndEmitted | kEndScheduled)) === 0) {
+    state[kState] |= kEnded | kEndScheduled;
     process.nextTick(endReadableNT, state, stream);
   }
 }
@@ -1953,6 +1954,12 @@ function endReadable(stream) {
 function endReadableNT(state, stream) {
   debug('endReadableNT');
 
+  // The scheduled tick is running; allow endReadable() to schedule again.
+  // This matters both when the 'end' emission is skipped below (e.g. after
+  // an unshift()) and when the stream is later reset for reuse
+  // (see undestroy()), which clears kEndEmitted but not this flag.
+  state[kState] &= ~kEndScheduled;
+
   // Check that we didn't get one last unshift.
   if ((state[kState] & (kErrored | kCloseEmitted | kEndEmitted)) === 0 && state.length === 0) {
     state[kState] |= kEndEmitted;

From 5c9576bf50e713c275cdb40018faeac7df53a809 Mon Sep 17 00:00:00 2001
From: trivenay <trivenay@amazon.com>
Date: Sun, 23 Aug 2026 08:08:57 +0530
Subject: [PATCH 301/344] quic: reset rejected HTTP/3 request streams with
 H3_REQUEST_REJECTED

An incoming HTTP/3 request stream rejected without any application
processing (the session has no stream consumer) is now reset with
H3_REQUEST_REJECTED so the peer learns the request was not processed,
per RFC 9114 section 4.1.1. The code is surfaced per-application like
the existing no-error and internal-error codes, so non-HTTP/3
applications are unchanged.

Fixes: https://github.com/nodejs/node/issues/65441
Signed-off-by: Naman Trivedi <trivenay@amazon.com>
PR-URL: https://github.com/nodejs/node/pull/65442
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/quic/quic.js                     | 11 +++-
 lib/internal/quic/state.js                    |  9 +++
 src/quic/application.cc                       |  5 ++
 src/quic/application.h                        |  8 +++
 src/quic/http3.cc                             |  4 ++
 src/quic/session.cc                           |  2 +
 .../test-quic-h3-request-rejected.mjs         | 58 +++++++++++++++++++
 7 files changed, 96 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-quic-h3-request-rejected.mjs

diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index e6ab417ab0f6..72f8187e3f38 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -4166,7 +4166,16 @@ class QuicSession {
     // case rather than letting it hold flow control credit.
     if (!this.#hasStreamConsumer()) {
       process.emitWarning('A new stream was received but no stream consumer callback was provided');
-      stream.destroy();
+      // When the negotiated application defines a "request rejected" code
+      // (HTTP/3: H3_REQUEST_REJECTED), reset the stream with it so the peer
+      // learns the request was not processed (RFC 9114 section 4.1.1).
+      // Other applications have no such semantic and are torn down as before.
+      const rejectedCode = getQuicSessionState(this).requestRejectedCode;
+      if (getQuicSessionState(this).streamCallbacksSupported === 1) {
+        stream.destroy(undefined, { code: rejectedCode });
+      } else {
+        stream.destroy();
+      }
       return;
     }
 
diff --git a/lib/internal/quic/state.js b/lib/internal/quic/state.js
index a41790c52024..769fee687498 100644
--- a/lib/internal/quic/state.js
+++ b/lib/internal/quic/state.js
@@ -77,6 +77,7 @@ const {
   IDX_STATE_SESSION_APPLICATION_TYPE,
   IDX_STATE_SESSION_NO_ERROR_CODE,
   IDX_STATE_SESSION_INTERNAL_ERROR_CODE,
+  IDX_STATE_SESSION_REQUEST_REJECTED_CODE,
   IDX_STATE_SESSION_MAX_DATAGRAM_SIZE,
   IDX_STATE_SESSION_LAST_DATAGRAM_ID,
   IDX_STATE_SESSION_MAX_PENDING_DATAGRAMS,
@@ -125,6 +126,7 @@ assert(IDX_STATE_SESSION_WRAPPED !== undefined);
 assert(IDX_STATE_SESSION_APPLICATION_TYPE !== undefined);
 assert(IDX_STATE_SESSION_NO_ERROR_CODE !== undefined);
 assert(IDX_STATE_SESSION_INTERNAL_ERROR_CODE !== undefined);
+assert(IDX_STATE_SESSION_REQUEST_REJECTED_CODE !== undefined);
 assert(IDX_STATE_SESSION_MAX_DATAGRAM_SIZE !== undefined);
 assert(IDX_STATE_SESSION_LAST_DATAGRAM_ID !== undefined);
 assert(IDX_STATE_ENDPOINT_BOUND !== undefined);
@@ -552,6 +554,13 @@ class QuicSessionState {
       handle, this.#offset + IDX_STATE_SESSION_INTERNAL_ERROR_CODE, kIsLittleEndian);
   }
 
+  get requestRejectedCode() {
+    const handle = this.#handle;
+    if (handle === undefined) return undefined;
+    return DataViewPrototypeGetBigUint64(
+      handle, this.#offset + IDX_STATE_SESSION_REQUEST_REJECTED_CODE, kIsLittleEndian);
+  }
+
   /** @type {number} */
   get maxDatagramSize() {
     const handle = this.#handle;
diff --git a/src/quic/application.cc b/src/quic/application.cc
index 6062f9d08483..d3c5e2611f5f 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -280,6 +280,11 @@ class DefaultApplication final : public Session::Application {
     return NGTCP2_INTERNAL_ERROR;
   }
 
+  // Raw QUIC has no "request rejected" semantic; reuse the no-error code.
+  error_code GetRequestRejectedCode() const override {
+    return GetNoErrorCode();
+  }
+
   void EarlyDataRejected() override {
     // Destroy all open streams — ngtcp2 has already discarded their
     // internal state when it rejected the early data. Use the
diff --git a/src/quic/application.h b/src/quic/application.h
index dec5cffb4243..ace6035a0ab7 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -77,6 +77,14 @@ class Session::Application : public MemoryRetainer {
   // NGTCP2_INTERNAL_ERROR (0x1).
   virtual error_code GetInternalErrorCode() const = 0;
 
+  // The "request rejected" code is sent on RESET_STREAM when an incoming
+  // request stream is rejected without any application processing (e.g.
+  // the session has no consumer for it), so the peer learns the request
+  // was not processed. For HTTP/3 this is NGHTTP3_H3_REQUEST_REJECTED
+  // (0x10b); other applications have no such semantic and reuse the
+  // "no error" code.
+  virtual error_code GetRequestRejectedCode() const = 0;
+
   // Called after Session::Receive processes a packet, outside all callback
   // scopes. Applications can use this to handle deferred operations that
   // require calling into JS (e.g., HTTP/3 GOAWAY processing).
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index 08aac7cdc6c4..d789eac1af1e 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -172,6 +172,10 @@ class Http3ApplicationImpl final : public Session::Application {
     return NGHTTP3_H3_INTERNAL_ERROR;
   }
 
+  error_code GetRequestRejectedCode() const override {
+    return NGHTTP3_H3_REQUEST_REJECTED;
+  }
+
   void EarlyDataRejected() override {
     // When 0-RTT is rejected, destroy the nghttp3 connection and all
     // open streams — ngtcp2 has discarded their internal state.
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 60b27fbfa358..2266f74a1277 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -141,6 +141,7 @@ uint64_t MaxDatagramPayload(uint64_t max_frame_size) {
   V(APPLICATION_TYPE, application_type, uint8_t)                               \
   V(NO_ERROR_CODE, no_error_code, error_code)                                  \
   V(INTERNAL_ERROR_CODE, internal_error_code, error_code)                      \
+  V(REQUEST_REJECTED_CODE, request_rejected_code, error_code)                  \
   V(MAX_DATAGRAM_SIZE, max_datagram_size, uint16_t)                            \
   V(LAST_DATAGRAM_ID, last_datagram_id, datagram_id)                           \
   V(MAX_PENDING_DATAGRAMS, max_pending_datagrams, uint16_t)
@@ -2660,6 +2661,7 @@ void Session::SetApplication(std::unique_ptr<Application> app) {
   // without duplicating the per-application table.
   impl_->state()->no_error_code = app->GetNoErrorCode();
   impl_->state()->internal_error_code = app->GetInternalErrorCode();
+  impl_->state()->request_rejected_code = app->GetRequestRejectedCode();
   impl_->application_ = std::move(app);
 }
 
diff --git a/test/parallel/test-quic-h3-request-rejected.mjs b/test/parallel/test-quic-h3-request-rejected.mjs
new file mode 100644
index 000000000000..6ed987b395af
--- /dev/null
+++ b/test/parallel/test-quic-h3-request-rejected.mjs
@@ -0,0 +1,58 @@
+// Flags: --experimental-quic --no-warnings
+
+// An incoming HTTP/3 request stream that is rejected without any
+// application processing (here, the session has no stream consumer) is
+// reset with H3_REQUEST_REJECTED (0x10b) so the peer learns the request
+// was not processed. See RFC 9114 section 4.1.1.
+// Refs: https://github.com/nodejs/node/issues/65441
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+// RFC 9114 H3_REQUEST_REJECTED.
+const H3_REQUEST_REJECTED = 0x10bn;
+
+// The server registers no stream consumer, so an incoming request stream
+// is rejected on arrival.
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onerror = () => {};
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+await clientSession.opened;
+
+const reset = Promise.withResolvers();
+const stream = await clientSession.createBidirectionalStream({
+  headers: {
+    ':method': 'GET',
+    ':path': '/test',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  },
+});
+stream.onreset = mustCall((err) => {
+  assert.strictEqual(err.code, 'ERR_QUIC_APPLICATION_ERROR');
+  assert.strictEqual(err.errorCode, H3_REQUEST_REJECTED);
+  reset.resolve();
+});
+await assert.rejects(stream.closed, { code: 'ERR_QUIC_APPLICATION_ERROR' });
+
+await reset.promise;
+await clientSession.close();
+await serverEndpoint.close();

From 788976c626bc3d18bcfcc0a066bbfd1a5ca5f8a1 Mon Sep 17 00:00:00 2001
From: armanmikoyan <arman.mikoyan1@gmail.com>
Date: Sun, 23 Aug 2026 06:39:15 +0400
Subject: [PATCH 302/344] dgram: don't swallow bind errors when callback is
 provided
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: armanmikoyan <arman.mikoyan1@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62602
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 lib/dgram.js                                  |  4 ++--
 .../test-dgram-bind-error-callback.js         | 23 +++++++++++++++++++
 2 files changed, 25 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-dgram-bind-error-callback.js

diff --git a/lib/dgram.js b/lib/dgram.js
index ae1691c1265e..653cf6a26305 100644
--- a/lib/dgram.js
+++ b/lib/dgram.js
@@ -295,7 +295,7 @@ Socket.prototype.bind = function(port_, address_ /* , callback */) {
   const cb = arguments.length && arguments[arguments.length - 1];
   if (typeof cb === 'function') {
     function removeListeners() {
-      this.removeListener('error', removeListeners);
+      this.removeListener(EventEmitter.errorMonitor, removeListeners);
       this.removeListener('listening', onListening);
     }
 
@@ -304,7 +304,7 @@ Socket.prototype.bind = function(port_, address_ /* , callback */) {
       FunctionPrototypeCall(cb, this);
     }
 
-    this.on('error', removeListeners);
+    this.on(EventEmitter.errorMonitor, removeListeners);
     this.on('listening', onListening);
   }
 
diff --git a/test/parallel/test-dgram-bind-error-callback.js b/test/parallel/test-dgram-bind-error-callback.js
new file mode 100644
index 000000000000..d5009f948228
--- /dev/null
+++ b/test/parallel/test-dgram-bind-error-callback.js
@@ -0,0 +1,23 @@
+'use strict';
+const common = require('../common');
+const assert = require('node:assert');
+const dgram = require('node:dgram');
+
+// Ensure that bind errors (e.g. EADDRINUSE) are not silently swallowed
+// when socket.bind() is called with a callback but without a user
+// 'error' handler.
+
+const socket1 = dgram.createSocket('udp4');
+
+socket1.bind(0, common.mustCall(() => {
+  const { port } = socket1.address();
+  const socket2 = dgram.createSocket('udp4');
+
+  process.on('uncaughtException', common.mustCall((err) => {
+    assert.strictEqual(err.code, 'EADDRINUSE');
+    socket1.close();
+    socket2.close();
+  }));
+
+  socket2.bind({ port }, common.mustNotCall());
+}));

From b71d5de0b8f59de0ac11593d78c203670dd8c619 Mon Sep 17 00:00:00 2001
From: Taejin Kim <60560836+kimtaejin3@users.noreply.github.com>
Date: Sun, 23 Aug 2026 11:39:25 +0900
Subject: [PATCH 303/344] lib: use bracket notation instead of
 startsWith/endsWith for single char

Signed-off-by: Taejin Kim <rlaxowls1316@naver.com>
PR-URL: https://github.com/nodejs/node/pull/61500
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/socketaddress.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/internal/socketaddress.js b/lib/internal/socketaddress.js
index 724ffd90cf77..28696d6cc87f 100644
--- a/lib/internal/socketaddress.js
+++ b/lib/internal/socketaddress.js
@@ -157,7 +157,7 @@ class SocketAddress {
         hostname: address,
         port,
       } = URLParse(`http://${input}`);
-      if (address.startsWith('[') && address.endsWith(']')) {
+      if (address[0] === '[' && address[address.length - 1] === ']') {
         return new SocketAddress({
           address: address.slice(1, -1),
           port: port | 0,

From 2a64032141c469a42e62ae1eb9101bd6b7c1509b Mon Sep 17 00:00:00 2001
From: Yagiz Nizipli <yagiz@nizipli.com>
Date: Tue, 18 Aug 2026 12:49:51 +0000
Subject: [PATCH 304/344] url: speed up WHATWG URL parsing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parse one-byte ASCII inputs in place instead of copying them into a
UTF-8 buffer, and reuse the original V8 string when the serialized
href is unchanged. Delay URLContext allocation until parse finishes
and skip ToString when the input is already a string.

Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
Assisted-by: Cursor
PR-URL: https://github.com/nodejs/node/pull/65361
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 lib/internal/url.js                           | 114 +++++++++---------
 src/node_url.cc                               |  82 ++++++++++---
 .../test-whatwg-url-parse-fast-path.js        |  88 ++++++++++++++
 3 files changed, 215 insertions(+), 69 deletions(-)
 create mode 100644 test/parallel/test-whatwg-url-parse-fast-path.js

diff --git a/lib/internal/url.js b/lib/internal/url.js
index 8f7fe9f083db..be6413eee86a 100644
--- a/lib/internal/url.js
+++ b/lib/internal/url.js
@@ -167,41 +167,62 @@ function lazyCryptoRandom() {
   return cryptoRandom;
 }
 
+/**
+ * Copy href and the latest `urlComponents` snapshot into a URLContext.
+ * Property assignment order matches the historical URLContext fields so
+ * `util.inspect(..., { showHidden: true })` stays stable.
+ * @param {object} ctx
+ * @param {string} href
+ */
+function setURLContextFromBinding(ctx, href) {
+  const c = bindingUrl.urlComponents;
+  ctx.href = href;
+  ctx.protocol_end = c[0];
+  ctx.username_end = c[1];
+  ctx.host_start = c[2];
+  ctx.host_end = c[3];
+  ctx.pathname_start = c[5];
+  ctx.search_start = c[6];
+  ctx.hash_start = c[7];
+  ctx.port = c[4];
+  ctx.scheme_type = c[8];
+}
+
 // This class provides the internal state of a URL object. An instance of this
 // class is stored in every URL object and is accessed internally by setters
 // and getters. It roughly corresponds to the concept of a URL record in the
 // URL Standard, with a few differences. It is also the object transported to
 // the C++ binding.
 // Refs: https://url.spec.whatwg.org/#concept-url
+//
+// scheme_type refers to ada::scheme::type:
+//   HTTP = 0, NOT_SPECIAL = 1, HTTPS = 2, WS = 3, FTP = 4, WSS = 5, FILE = 6
 class URLContext {
   // This is the maximum value uint32_t can get.
   // Ada uses uint32_t(-1) for declaring omitted values.
   static #omitted = 4294967295;
 
-  href = '';
-  protocol_end = 0;
-  username_end = 0;
-  host_start = 0;
-  host_end = 0;
-  pathname_start = 0;
-  search_start = 0;
-  hash_start = 0;
-  port = 0;
   /**
-   * Refers to `ada::scheme::type`
-   *
-   * enum type : uint8_t {
-   *   HTTP = 0,
-   *   NOT_SPECIAL = 1,
-   *   HTTPS = 2,
-   *   WS = 3,
-   *   FTP = 4,
-   *   WSS = 5,
-   *   FILE = 6
-   * };
-   * @type {number}
+   * @param {string} [href] Parsed href. When omitted, create an empty context
+   *   (used by `URL.parse` on invalid input). When provided, `bindingUrl.parse`
+   *   / `update` has just written `urlComponents`.
    */
-  scheme_type = 1;
+  constructor(href) {
+    if (href === undefined) {
+      this.href = '';
+      this.protocol_end = 0;
+      this.username_end = 0;
+      this.host_start = 0;
+      this.host_end = 0;
+      this.pathname_start = 0;
+      this.search_start = 0;
+      this.hash_start = 0;
+      this.port = 0;
+      this.scheme_type = 1;
+      return;
+    }
+    setURLContextFromBinding(this, href);
+  }
 
   get hasPort() {
     return this.port !== URLContext.#omitted;
@@ -835,7 +856,7 @@ const kCreateURLFromPosixPathSymbol = Symbol('kCreateURLFromPosixPath');
 const kCreateURLFromWindowsPathSymbol = Symbol('kCreateURLFromWindowsPath');
 
 class URL {
-  #context = new URLContext();
+  #context;
   #searchParams;
   #searchParamsModified;
 
@@ -860,16 +881,16 @@ class URL {
   }
 
   constructor(input, base = undefined, parseSymbol = undefined) {
-    markTransferMode(this, false, false);
-
     if (arguments.length === 0) {
       throw new ERR_MISSING_ARGS('url');
     }
 
     // StringPrototypeToWellFormed is not needed.
-    input = `${input}`;
+    if (typeof input !== 'string') {
+      input = `${input}`;
+    }
 
-    if (base !== undefined) {
+    if (base !== undefined && typeof base !== 'string') {
       base = `${base}`;
     }
 
@@ -884,9 +905,12 @@ class URL {
         bindingUrl.pathToFileURL(input, interpretAsWindowsPath, base) :
         bindingUrl.parse(input, base, raiseException);
     }
-    if (href) {
-      this.#updateContext(href);
-    }
+
+    // Delay context allocation until parse finishes so invalid URLs that
+    // throw do not pay for an unused URLContext. Initialize in one shot
+    // from the binding snapshot instead of writing an empty context first.
+    this.#context = href ? new URLContext(href) : new URLContext();
+    markTransferMode(this, false, false);
   }
 
   static parse(input, base = undefined) {
@@ -955,29 +979,7 @@ class URL {
     const previousSearch = shouldUpdateSearchParams && this.#searchParams &&
       (this.#searchParamsModified ? this.#getSearchFromParams() : this.#getSearchFromContext());
 
-    this.#context.href = href;
-
-    const {
-      0: protocol_end,
-      1: username_end,
-      2: host_start,
-      3: host_end,
-      4: port,
-      5: pathname_start,
-      6: search_start,
-      7: hash_start,
-      8: scheme_type,
-    } = bindingUrl.urlComponents;
-
-    this.#context.protocol_end = protocol_end;
-    this.#context.username_end = username_end;
-    this.#context.host_start = host_start;
-    this.#context.host_end = host_end;
-    this.#context.port = port;
-    this.#context.pathname_start = pathname_start;
-    this.#context.search_start = search_start;
-    this.#context.hash_start = hash_start;
-    this.#context.scheme_type = scheme_type;
+    setURLContextFromBinding(this.#context, href);
 
     if (this.#searchParams) {
       // If the search string has updated, URL becomes the source of truth, and we update URLSearchParams.
@@ -1202,10 +1204,12 @@ class URL {
       throw new ERR_MISSING_ARGS('url');
     }
 
-    url = `${url}`;
+    if (typeof url !== 'string') {
+      url = `${url}`;
+    }
 
     if (base !== undefined) {
-      return bindingUrl.canParse(url, `${base}`);
+      return bindingUrl.canParse(url, typeof base === 'string' ? base : `${base}`);
     }
 
     // It is important to differentiate the canParse call statements
diff --git a/src/node_url.cc b/src/node_url.cc
index 38aa7fc48eb1..bb2a5d0776e3 100644
--- a/src/node_url.cc
+++ b/src/node_url.cc
@@ -8,6 +8,7 @@
 #include "node_metadata.h"
 #include "node_process-inl.h"
 #include "path.h"
+#include "simdutf.h"
 #include "util-inl.h"
 #include "v8-fast-api-calls.h"
 #include "v8-local-handle.h"
@@ -33,6 +34,38 @@ using v8::SnapshotCreator;
 using v8::String;
 using v8::Value;
 
+namespace {
+
+// Parse a V8 string as a URL. One-byte ASCII inputs are parsed in place
+// without allocating a UTF-8 copy. `reuse_input` is set when the serialized
+// href is identical to that ASCII input so the caller can return the original
+// V8 string. Non-ASCII inputs are never reused: UTF-8 conversion may replace
+// unpaired surrogates, so the original string may not match href.
+ada::result<ada::url_aggregator> ParseUrlFromV8String(
+    Isolate* isolate,
+    Local<String> input,
+    const ada::url_aggregator* base_url,
+    bool* reuse_input) {
+  {
+    String::ValueView view(isolate, input);
+    if (view.is_one_byte()) {
+      const char* data = reinterpret_cast<const char*>(view.data8());
+      const size_t length = static_cast<size_t>(view.length());
+      if (simdutf::validate_ascii(data, length)) [[likely]] {
+        const std::string_view input_view(data, length);
+        auto out = ada::parse<ada::url_aggregator>(input_view, base_url);
+        *reuse_input = out.has_value() && out->get_href() == input_view;
+        return out;
+      }
+    }
+  }
+  *reuse_input = false;
+  Utf8Value utf8(isolate, input);
+  return ada::parse<ada::url_aggregator>(utf8.ToStringView(), base_url);
+}
+
+}  // namespace
+
 void BindingData::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("url_components_buffer", url_components_buffer_);
 }
@@ -392,32 +425,51 @@ void BindingData::Parse(const FunctionCallbackInfo<Value>& args) {
   Realm* realm = Realm::GetCurrent(args);
   BindingData* binding_data = realm->GetBindingData<BindingData>();
   Isolate* isolate = realm->isolate();
-  std::optional<std::string> base_{};
+  Local<String> input_string = args[0].As<String>();
 
-  Utf8Value input(isolate, args[0]);
   ada::result<ada::url_aggregator> base;
   ada::url_aggregator* base_pointer = nullptr;
   if (args[1]->IsString()) {
-    base_ = Utf8Value(isolate, args[1]).ToString();
-    base = ada::parse<ada::url_aggregator>(*base_);
-    if (!base && raise_exception) {
-      return ThrowInvalidURL(realm->env(), input.ToStringView(), base_);
-    } else if (!base) {
+    bool unused_reuse = false;
+    base = ParseUrlFromV8String(
+        isolate, args[1].As<String>(), nullptr, &unused_reuse);
+    if (!base) {
+      if (raise_exception) {
+        Utf8Value input(isolate, input_string);
+        Utf8Value base_utf8(isolate, args[1]);
+        return ThrowInvalidURL(
+            realm->env(), input.ToStringView(), base_utf8.ToString());
+      }
       return;
     }
     base_pointer = &base.value();
   }
-  auto out =
-      ada::parse<ada::url_aggregator>(input.ToStringView(), base_pointer);
 
-  if (!out && raise_exception) {
-    return ThrowInvalidURL(realm->env(), input.ToStringView(), base_);
-  } else if (!out) {
+  bool reuse_input = false;
+  auto out =
+      ParseUrlFromV8String(isolate, input_string, base_pointer, &reuse_input);
+  if (!out) {
+    if (raise_exception) {
+      Utf8Value input(isolate, input_string);
+      std::optional<std::string> base_error;
+      if (args[1]->IsString()) {
+        base_error = Utf8Value(isolate, args[1]).ToString();
+      }
+      return ThrowInvalidURL(
+          realm->env(), input.ToStringView(), std::move(base_error));
+    }
     return;
   }
 
   binding_data->UpdateComponents(out->get_components(), out->type);
 
+  // Already-serialized ASCII URLs are the common case. Reuse the input
+  // string instead of allocating an identical V8 string from href.
+  if (reuse_input) {
+    args.GetReturnValue().Set(args[0]);
+    return;
+  }
+
   Local<Value> ret;
   if (ToV8Value(realm->context(), out->get_href(), isolate).ToLocal(&ret))
       [[likely]] {
@@ -439,13 +491,15 @@ void BindingData::Update(const FunctionCallbackInfo<Value>& args) {
     return;
   }
   enum url_update_action action = static_cast<enum url_update_action>(val);
-  Utf8Value input(isolate, args[0].As<String>());
   Utf8Value new_value(isolate, args[2].As<String>());
 
   std::string_view new_value_view = new_value.ToStringView();
   // A serialized URL is not always reparsable: the IDNA encoder can emit a
   // host label that the decoder rejects. Fail the update instead of crashing.
-  auto out = ada::parse<ada::url_aggregator>(input.ToStringView());
+  // Existing hrefs are typically already-serialized ASCII, so parse in place.
+  bool unused_reuse = false;
+  auto out = ParseUrlFromV8String(
+      isolate, args[0].As<String>(), nullptr, &unused_reuse);
   if (!out) {
     return args.GetReturnValue().Set(false);
   }
diff --git a/test/parallel/test-whatwg-url-parse-fast-path.js b/test/parallel/test-whatwg-url-parse-fast-path.js
new file mode 100644
index 000000000000..e6c295f039a3
--- /dev/null
+++ b/test/parallel/test-whatwg-url-parse-fast-path.js
@@ -0,0 +1,88 @@
+'use strict';
+
+// Covers the URL constructor parse paths that avoid a UTF-8 copy and/or
+// reuse the input string when it is already a serialized ASCII href.
+
+const { hasIntl } = require('../common');
+const assert = require('assert');
+
+const alreadySerialized = [
+  'https://nodejs.org/en/blog/',
+  'http://nodejs.org:89/docs/latest/api/foo/bar/qua/13949281/0f28b/' +
+    '/5d49/b3020/url.html#test?payload1=true&payload2=false&test=1' +
+    '&benchmark=3&foo=38.38.011.293&bar=1234834910480&test=19299&3992&' +
+    'key=f5c65e1e98fe07e648249ad41e1cfdb0',
+  'https://user:pass@example.com/path?search=1',
+  'file:///foo/bar/test/node.js',
+  'ws://localhost:9229/f46db715-70df-43ad-a359-7f9949f39868',
+];
+
+for (const href of alreadySerialized) {
+  const url = new URL(href);
+  assert.strictEqual(url.href, href);
+  assert.strictEqual(URL.parse(href).href, href);
+  assert.strictEqual(URL.canParse(href), true);
+}
+
+// Special-scheme URLs with an empty path gain a trailing slash.
+{
+  const url = new URL('https://example.com');
+  assert.strictEqual(url.href, 'https://example.com/');
+  assert.strictEqual(url.pathname, '/');
+}
+
+// Dot-segment normalization must still rewrite the path.
+{
+  const url = new URL('https://example.org/./a/../b/./c');
+  assert.strictEqual(url.href, 'https://example.org/b/c');
+  assert.strictEqual(url.pathname, '/b/c');
+}
+
+// Relative resolution against a base URL.
+{
+  const url = new URL('/path?x=1#h', 'https://example.com:8443/base');
+  assert.strictEqual(url.href, 'https://example.com:8443/path?x=1#h');
+  assert.strictEqual(url.host, 'example.com:8443');
+}
+
+// Non-string input is still stringified.
+{
+  const url = new URL({ toString: () => 'https://example.com/from-object' });
+  assert.strictEqual(url.href, 'https://example.com/from-object');
+}
+
+// Invalid input still throws from the constructor and is null from parse().
+{
+  assert.throws(() => new URL('not a url'), {
+    code: 'ERR_INVALID_URL',
+    name: 'TypeError',
+  });
+  assert.strictEqual(URL.parse('not a url'), null);
+  assert.strictEqual(URL.canParse('not a url'), false);
+}
+
+// Unpaired surrogates must not be returned as-is from href.
+{
+  const input = 'https://example.com/\uD800';
+  const url = new URL(input);
+  assert.notStrictEqual(url.href, input);
+  assert.ok(url.href.startsWith('https://example.com/'));
+}
+
+if (hasIntl) {
+  const url = new URL('http://你好你好.在线');
+  assert.ok(url.hostname.startsWith('xn--'));
+  assert.ok(url.href.startsWith('http://xn--'));
+}
+
+// Setters re-parse the existing href; keep component updates correct.
+{
+  const url = new URL('https://example.com/old');
+  url.pathname = '/new';
+  url.search = 'q=1';
+  url.hash = 'frag';
+  assert.strictEqual(url.href, 'https://example.com/new?q=1#frag');
+  assert.strictEqual(url.pathname, '/new');
+  assert.strictEqual(url.search, '?q=1');
+  assert.strictEqual(url.hash, '#frag');
+}

From f032c224309f4eb315880fc053ae2fd81fe6d59f Mon Sep 17 00:00:00 2001
From: Yagiz Nizipli <yagiz@nizipli.com>
Date: Wed, 19 Aug 2026 01:00:46 +0000
Subject: [PATCH 305/344] url: skip unused href reuse comparison
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Callers that never reuse the original V8 string (base URL parse and
setters) now omit reuse_input so ParseUrlFromV8String does not
compare href against the input.

Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
Assisted-by: Cursor
PR-URL: https://github.com/nodejs/node/pull/65361
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 src/node_url.cc | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/node_url.cc b/src/node_url.cc
index bb2a5d0776e3..0c5c9e65136a 100644
--- a/src/node_url.cc
+++ b/src/node_url.cc
@@ -37,15 +37,17 @@ using v8::Value;
 namespace {
 
 // Parse a V8 string as a URL. One-byte ASCII inputs are parsed in place
-// without allocating a UTF-8 copy. `reuse_input` is set when the serialized
-// href is identical to that ASCII input so the caller can return the original
-// V8 string. Non-ASCII inputs are never reused: UTF-8 conversion may replace
-// unpaired surrogates, so the original string may not match href.
+// without allocating a UTF-8 copy. When `reuse_input` is non-null it is set
+// if the serialized href is identical to that ASCII input so the caller can
+// return the original V8 string. Omit it when the caller will not reuse the
+// input, to skip the O(n) href comparison. Non-ASCII inputs are never reused:
+// UTF-8 conversion may replace unpaired surrogates, so the original string
+// may not match href.
 ada::result<ada::url_aggregator> ParseUrlFromV8String(
     Isolate* isolate,
     Local<String> input,
     const ada::url_aggregator* base_url,
-    bool* reuse_input) {
+    bool* reuse_input = nullptr) {
   {
     String::ValueView view(isolate, input);
     if (view.is_one_byte()) {
@@ -54,12 +56,14 @@ ada::result<ada::url_aggregator> ParseUrlFromV8String(
       if (simdutf::validate_ascii(data, length)) [[likely]] {
         const std::string_view input_view(data, length);
         auto out = ada::parse<ada::url_aggregator>(input_view, base_url);
-        *reuse_input = out.has_value() && out->get_href() == input_view;
+        if (reuse_input != nullptr) {
+          *reuse_input = out.has_value() && out->get_href() == input_view;
+        }
         return out;
       }
     }
   }
-  *reuse_input = false;
+  if (reuse_input != nullptr) *reuse_input = false;
   Utf8Value utf8(isolate, input);
   return ada::parse<ada::url_aggregator>(utf8.ToStringView(), base_url);
 }
@@ -430,9 +434,7 @@ void BindingData::Parse(const FunctionCallbackInfo<Value>& args) {
   ada::result<ada::url_aggregator> base;
   ada::url_aggregator* base_pointer = nullptr;
   if (args[1]->IsString()) {
-    bool unused_reuse = false;
-    base = ParseUrlFromV8String(
-        isolate, args[1].As<String>(), nullptr, &unused_reuse);
+    base = ParseUrlFromV8String(isolate, args[1].As<String>(), nullptr);
     if (!base) {
       if (raise_exception) {
         Utf8Value input(isolate, input_string);
@@ -497,9 +499,7 @@ void BindingData::Update(const FunctionCallbackInfo<Value>& args) {
   // A serialized URL is not always reparsable: the IDNA encoder can emit a
   // host label that the decoder rejects. Fail the update instead of crashing.
   // Existing hrefs are typically already-serialized ASCII, so parse in place.
-  bool unused_reuse = false;
-  auto out = ParseUrlFromV8String(
-      isolate, args[0].As<String>(), nullptr, &unused_reuse);
+  auto out = ParseUrlFromV8String(isolate, args[0].As<String>(), nullptr);
   if (!out) {
     return args.GetReturnValue().Set(false);
   }

From 91393898b5be9d19b8bc0c89702f436c0ef08297 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 22 Aug 2026 20:53:29 -0700
Subject: [PATCH 306/344] quic: mark drain promise handled

Fixes: https://github.com/nodejs/node/issues/64290
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus
PR-URL: https://github.com/nodejs/node/pull/65319
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 lib/internal/quic/quic.js                     |  2 +
 ...tream-writer-drain-unhandled-rejection.mjs | 78 +++++++++++++++++++
 2 files changed, 80 insertions(+)
 create mode 100644 test/parallel/test-quic-stream-writer-drain-unhandled-rejection.mjs

diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 72f8187e3f38..11152f070add 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -2184,6 +2184,7 @@ class QuicStream {
         errored = true;
         error = reason;
         if (drainWakeup != null) {
+          markPromiseAsHandled(drainWakeup.promise);
           drainWakeup.reject(error);
           drainWakeup = null;
         }
@@ -2366,6 +2367,7 @@ class QuicStream {
         getQuicSessionState(stream.#inner.session).internalErrorCode;
       handle.resetStream(code);
       if (drainWakeup != null) {
+        markPromiseAsHandled(drainWakeup.promise);
         drainWakeup.reject(error);
         drainWakeup = null;
       }
diff --git a/test/parallel/test-quic-stream-writer-drain-unhandled-rejection.mjs b/test/parallel/test-quic-stream-writer-drain-unhandled-rejection.mjs
new file mode 100644
index 000000000000..6420de02ba95
--- /dev/null
+++ b/test/parallel/test-quic-stream-writer-drain-unhandled-rejection.mjs
@@ -0,0 +1,78 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Regression test for https://github.com/nodejs/node/issues/64290
+// When a stream writer has a pending drain promise and the remote peer
+// resets the stream, the rejected drain promise must NOT surface as an
+// unhandled rejection.
+
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import { setImmediate as tick } from 'node:timers/promises';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('../common/quic.mjs');
+const { drainableProtocol } = await import('stream/iter');
+
+// The test fails if any unhandled rejection fires.
+process.on('unhandledRejection',
+           mustNotCall('unexpected unhandled rejection'));
+
+const serverStreamReady = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall((stream) => {
+    serverStreamReady.resolve({ stream, session: serverSession });
+  });
+}));
+
+const clientSession = await connect(serverEndpoint.address);
+await clientSession.opened;
+
+const stream = await clientSession.createBidirectionalStream();
+const writer = stream.writer;
+
+// Write a small initial chunk so the server materializes the stream.
+writer.writeSync(new Uint8Array([1]));
+
+const { stream: serverStream, session: serverSession } =
+  await serverStreamReady.promise;
+
+// Fill the write buffer to create backpressure. After this,
+// writeDesiredSize should be <= 0 and canWrite should be false.
+const chunk = new Uint8Array(64 * 1024);
+while (writer.canWrite) {
+  if (!writer.writeSync(chunk)) break;
+}
+
+// Create a drain wakeup via the drainable protocol. This simulates
+// what the stream/iter infrastructure does when checking for
+// backpressure. We deliberately do NOT await the returned promise —
+// that is the whole point of the test.
+const drainPromise = writer[drainableProtocol]();
+assert.ok(drainPromise instanceof Promise,
+          'expected a drain promise (buffer should be full)');
+
+// Suppress the expected rejection on both sides' closed promises so
+// they do not interfere with the unhandledRejection check.
+const clientClosed = stream.closed.catch(() => {});
+const serverClosed = serverStream.closed.catch(() => {});
+
+// Have the server send STOP_SENDING. This triggers kStopSending on
+// the client writer, which rejects the unobserved drain promise.
+// Without the fix this surfaces as an unhandled rejection.
+serverStream.stopSending(1n);
+serverStream.writer.endSync();
+
+// Give the event loop time to process the frame and fire any
+// unhandled-rejection events.
+await tick();
+await tick();
+
+// Clean up.
+await Promise.all([clientClosed, serverClosed]);
+serverSession.close();
+await clientSession.close();
+await serverEndpoint.close();

From 74dcdbb5f1d00cbe47d8ce95906bafc5e5991392 Mon Sep 17 00:00:00 2001
From: Srinu desetti <159899608+webdevelopersrinu@users.noreply.github.com>
Date: Sun, 23 Aug 2026 11:04:20 +0530
Subject: [PATCH 307/344] fs: fix glob early return skipping sibling entries

The children loop in the glob traversal returned from the whole method
when a child path had already been seen through a different pattern
context, silently dropping the remaining sibling entries. Whether this
triggered depended on directory iteration order, which also made
test-fs-glob.mjs flaky.

Remove the check: the cache.add call at the start of the traversal
already prevents reprocessing.

Fixes: https://github.com/nodejs/node/issues/62897
Co-authored-by: semimikoh <ejffjeosms@gmail.com>
Signed-off-by: webdevelopersrinu <webdeveloper.srinu9@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64895
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/fs/glob.js        |  6 ---
 test/parallel/test-fs-glob.mjs | 76 ++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 6 deletions(-)

diff --git a/lib/internal/fs/glob.js b/lib/internal/fs/glob.js
index c608016833f9..efa590a55749 100644
--- a/lib/internal/fs/glob.js
+++ b/lib/internal/fs/glob.js
@@ -576,9 +576,6 @@ class Glob {
       const nSymlinks = new SafeSet();
       for (const index of pattern.indexes) {
         // For each child, check potential patterns
-        if (this.#cache.seen(entryPath, pattern, index) || this.#cache.seen(entryPath, pattern, index + 1)) {
-          return;
-        }
         const current = pattern.at(index);
         const nextIndex = index + 1;
         const next = pattern.at(nextIndex);
@@ -793,9 +790,6 @@ class Glob {
       const nSymlinks = new SafeSet();
       for (const index of pattern.indexes) {
         // For each child, check potential patterns
-        if (this.#cache.seen(entryPath, pattern, index) || this.#cache.seen(entryPath, pattern, index + 1)) {
-          return;
-        }
         const current = pattern.at(index);
         const nextIndex = index + 1;
         const next = pattern.at(nextIndex);
diff --git a/test/parallel/test-fs-glob.mjs b/test/parallel/test-fs-glob.mjs
index bd95bce7d0e3..9226e491358d 100644
--- a/test/parallel/test-fs-glob.mjs
+++ b/test/parallel/test-fs-glob.mjs
@@ -1,5 +1,6 @@
 import * as common from '../common/index.mjs';
 import tmpdir from '../common/tmpdir.js';
+import { spawnSync } from 'node:child_process';
 import { resolve, dirname, sep, relative, join, isAbsolute } from 'node:path';
 import { mkdir, writeFile, symlink, glob as asyncGlob } from 'node:fs/promises';
 import { glob, globSync, Dirent, chmodSync, writeFileSync, rmSync } from 'node:fs';
@@ -669,3 +670,78 @@ describe('globSync - ENOTDIR', function() {
     }
   });
 });
+
+describe('glob - seen cache', function() {
+  // Refs: https://github.com/nodejs/node/issues/62897
+  test('does not skip siblings after a seen child path', () => {
+    // The glob traversal used to return early from the children loop when a
+    // child path had already been seen through a different pattern context,
+    // silently dropping the remaining siblings. Whether the bug triggered
+    // depended on directory iteration order, so the child process pins the
+    // order by patching readdir before loading the glob implementation.
+    const script = `
+      const assert = require('node:assert');
+      const fs = require('node:fs');
+      const fsPromises = require('node:fs/promises');
+      const path = require('node:path');
+
+      const cwd = process.argv[1];
+      const a = path.join(cwd, 'a');
+      fs.mkdirSync(path.join(a, 'b', 'c', 'd'), { recursive: true });
+      fs.mkdirSync(path.join(a, 'c', 'd', 'c'), { recursive: true });
+      fs.writeFileSync(path.join(a, 'x'), '');
+      fs.writeFileSync(path.join(a, 'z'), '');
+
+      const originalReaddirSync = fs.readdirSync;
+      const originalReaddir = fsPromises.readdir;
+
+      const reorder = (target, entries) => {
+        if (!Array.isArray(entries) || target !== a) return entries;
+        const names = ['c', 'b', 'x', 'z'];
+        return names.map((name) => entries.find((entry) => entry.name === name))
+          .filter(Boolean);
+      };
+
+      fs.readdirSync = function(target, options) {
+        return reorder(target, originalReaddirSync.call(this, target, options));
+      };
+      fsPromises.readdir = async function(target, options) {
+        return reorder(target, await originalReaddir.call(this, target, options));
+      };
+
+      const { Glob } = require('internal/fs/glob');
+      const expected = ['a/b', 'a/c', 'a/x', 'a/z'];
+      const normalize = (results) =>
+        results.map((item) => item.replaceAll(path.sep, '/')).sort();
+
+      (async () => {
+        const syncResults = normalize(new Glob('a/**/../*', { cwd }).globSync());
+        for (const item of expected) {
+          assert.ok(syncResults.includes(item),
+                    \`missing \${item} from sync results: \${syncResults}\`);
+        }
+
+        const asyncResults = [];
+        for await (const item of new Glob('a/**/../*', { cwd }).glob()) {
+          asyncResults.push(item);
+        }
+        const normalized = normalize(asyncResults);
+        for (const item of expected) {
+          assert.ok(normalized.includes(item),
+                    \`missing \${item} from async results: \${normalized}\`);
+        }
+      })().catch((err) => {
+        console.error(err);
+        process.exitCode = 1;
+      });
+    `;
+
+    const seenDir = tmpdir.resolve('glob-seen');
+    const child = spawnSync(
+      process.execPath,
+      ['--expose-internals', '-e', script, seenDir],
+      { encoding: 'utf8' },
+    );
+    assert.strictEqual(child.status, 0, child.stderr || child.stdout);
+  });
+});

From d0447c93f6caf05aa92e00f4ce2d935c42f94e91 Mon Sep 17 00:00:00 2001
From: Marten Richter <marten.richter@tu-berlin.de>
Date: Sat, 22 Aug 2026 23:34:30 -0600
Subject: [PATCH 308/344] quic: changes for nghttp3_conn_close_stream2

nghttp2 will introduce a version 2 callback
and function for closing streams.
This prepares node.js for the change.
Other changes may be required for
 its full potential.

Signed-off-by: Marten Richter <marten.richter@freenet.de>
PR-URL: https://github.com/nodejs/node/pull/64574
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 src/quic/http3.cc | 47 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 34 insertions(+), 13 deletions(-)

diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index d789eac1af1e..ff54bba0354f 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -510,7 +510,12 @@ class Http3ApplicationImpl final : public Session::Application {
       code = error.code();
     }
 
-    int rv = nghttp3_conn_close_stream(*this, stream->id(), code);
+    int rv = nghttp3_conn_close_stream2(
+        *this,
+        NGHTTP3_STREAM_CLOSE_FLAG_RX_APP_ERROR_CODE_SET,
+        stream->id(),
+        code,
+        0);
     // If the call is successful, Http3Application::OnStreamClose callback will
     // be invoked when the stream is ready to be closed. We'll handle destroying
     // the actual Stream object there.
@@ -804,16 +809,32 @@ class Http3ApplicationImpl final : public Session::Application {
     return Http3ConnectionPointer(conn);
   }
 
-  void OnStreamClose(Stream* stream, error_code app_error_code) {
-    if (app_error_code != NGHTTP3_H3_NO_ERROR) {
+  void OnStreamClose(Stream* stream,
+                     uint32_t flags,
+                     error_code rx_app_error_code,
+                     error_code tx_app_error_code) {
+    if (flags & NGHTTP3_STREAM_CLOSE_FLAG_RX_APP_ERROR_CODE_SET) {
       Debug(&session(),
             "HTTP/3 application received stream close for stream %" PRIi64
-            " with code %" PRIu64,
+            " with remote error code %" PRIu64,
             stream->id(),
-            app_error_code);
+            rx_app_error_code);
+    }
+    if (flags & NGHTTP3_STREAM_CLOSE_FLAG_TX_APP_ERROR_CODE_SET) {
+      Debug(&session(),
+            "HTTP/3 application send stream close for stream %" PRIi64
+            " with error code %" PRIu64,
+            stream->id(),
+            tx_app_error_code);
     }
     auto direction = stream->direction();
-    stream->Destroy(QuicError::ForApplication(app_error_code));
+    if (flags & NGHTTP3_STREAM_CLOSE_FLAG_RX_APP_ERROR_CODE_SET) {
+      stream->Destroy(QuicError::ForApplication(rx_app_error_code));
+    } else if (flags & NGHTTP3_STREAM_CLOSE_FLAG_TX_APP_ERROR_CODE_SET) {
+      stream->Destroy(QuicError::ForApplication(tx_app_error_code));
+    } else {
+      stream->Destroy();
+    }
     ExtendMaxStreams(EndpointLabel::REMOTE, direction, 1);
   }
 
@@ -1175,13 +1196,16 @@ class Http3ApplicationImpl final : public Session::Application {
   }
 
   static int on_stream_close(nghttp3_conn* conn,
+                             uint32_t flags,
                              stream_id id,
-                             error_code app_error_code,
+                             error_code rx_app_error_code,
+                             error_code tx_app_error_code,
                              void* conn_user_data,
                              void* stream_user_data) {
     NGHTTP3_CALLBACK_SCOPE(app);
     if (auto stream = app.session().FindStream(id)) {
-      app.OnStreamClose(stream.get(), app_error_code);
+      app.OnStreamClose(
+          stream.get(), flags, rx_app_error_code, tx_app_error_code);
     }
     return NGTCP2_SUCCESS;
   }
@@ -1389,7 +1413,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
   static constexpr nghttp3_callbacks kCallbacks = {
       on_acked_stream_data,
-      on_stream_close,
+      nullptr,  // nghttp3_stream_close (deprecated)
       on_receive_data,
       on_deferred_consume,
       on_begin_headers,
@@ -1407,10 +1431,7 @@ class Http3ApplicationImpl final : public Session::Application {
       on_end_origin,
       on_rand,
       on_receive_settings,
-#ifdef NGHTTP3_CALLBACKS_V4
-      nullptr,
-#endif  // NGHTTP3_CALLBACKS_V4
-  };
+      on_stream_close};
 };
 
 std::optional<PendingTicketAppData> ParseHttp3TicketData(const uv_buf_t& data) {

From 97a437e7ea98686cc6b453f79678fc0cb85226b5 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sun, 23 Aug 2026 10:14:37 +0200
Subject: [PATCH 309/344] module: add a read-only mode to the compile cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A compile cache generated ahead of time and shipped inside an
application package should only ever be read: the package may be
immutable or covered by an integrity check, and a cache directory that
appears at run time would be a surprise. Add readOnly to
module.enableCompileCache() and NODE_COMPILE_CACHE_READONLY=1: existing
entries are loaded as before, nothing is serialized or persisted,
flushCompileCache() is a no-op, and the cache directory is used as found
rather than created, so enabling against a missing directory fails
instead of making one.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65302
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 doc/api/cli.md                                |  9 +++
 doc/api/module.md                             | 18 +++++
 doc/node.1                                    |  4 ++
 lib/internal/modules/helpers.js               | 15 ++--
 src/compile_cache.cc                          | 70 ++++++++++++++-----
 src/compile_cache.h                           | 19 ++++-
 src/env.cc                                    | 10 ++-
 src/node_modules.cc                           |  5 +-
 .../test-compile-cache-api-readonly.js        | 65 +++++++++++++++++
 9 files changed, 189 insertions(+), 26 deletions(-)
 create mode 100644 test/parallel/test-compile-cache-api-readonly.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 40a61c90ac26..4b2113fae2a3 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -3708,6 +3708,15 @@ When set to 1, the [module compile cache][] can be reused across different direc
 locations as long as the module layout relative to the cache directory remains the same,
 and by any user (the cache subdirectory is not suffixed with the creating user's uid).
 
+### `NODE_COMPILE_CACHE_READONLY=1`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+When set to 1, the [module compile cache][] only reads existing entries from
+its directory: nothing is written to it and it is not created if missing.
+
 ### `NODE_DEBUG=module[,…]`
 
 <!-- YAML
diff --git a/doc/api/module.md b/doc/api/module.md
index 7d2a4c89c1c8..e0b000d95691 100644
--- a/doc/api/module.md
+++ b/doc/api/module.md
@@ -427,6 +427,15 @@ There are two ways to enable the portable mode:
 
 2. Setting the environment variable: [`NODE_COMPILE_CACHE_PORTABLE=1`][]
 
+### Read-only compile cache
+
+A cache that was generated ahead of time, for example at build time to be
+shipped inside an application package, can be enabled with `readOnly: true`
+(or [`NODE_COMPILE_CACHE_READONLY=1`][]). Node.js then loads whatever entries
+the directory holds and never writes to it: modules without a usable entry are
+compiled as usual but not persisted, [`module.flushCompileCache()`][] is a
+no-op, and the directory is not created if it is missing.
+
 ### Limitations of the compile cache
 
 Currently when using the compile cache with [V8 JavaScript code coverage][], the
@@ -498,6 +507,9 @@ The following constants are returned as the `status` field in the object returne
 <!-- YAML
 added: v22.8.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65302
+    description: Add the `readOnly` option.
   - version: v25.4.0
     pr-url: https://github.com/nodejs/node/pull/60971
     description: This feature is no longer experimental.
@@ -522,6 +534,11 @@ changes:
     the cache can be reused even if the project directory is moved. This is a best-effort
     feature. If not specified, it will depend on whether the environment variable
     [`NODE_COMPILE_CACHE_PORTABLE=1`][] is set.
+  * `readOnly` {boolean} Optional. If `true`, existing cache entries in `directory` are
+    used but nothing is ever written to it, and the directory is not created when it does
+    not exist (enabling then fails). Meant for caches generated ahead of time and shipped
+    with an application. If not specified, it will depend on whether the environment
+    variable [`NODE_COMPILE_CACHE_READONLY=1`][] is set.
 * Returns: {Object}
   * `status` {integer} One of the [`module.constants.compileCacheStatus`][]
   * `message` {string|undefined} If Node.js cannot enable the compile cache, this contains
@@ -2047,6 +2064,7 @@ returned object contains the following keys:
 [`--require`]: cli.md#-r---require-module
 [`NODE_COMPILE_CACHE=dir`]: cli.md#node_compile_cachedir
 [`NODE_COMPILE_CACHE_PORTABLE=1`]: cli.md#node_compile_cache_portable1
+[`NODE_COMPILE_CACHE_READONLY=1`]: cli.md#node_compile_cache_readonly1
 [`NODE_DISABLE_COMPILE_CACHE=1`]: cli.md#node_disable_compile_cache1
 [`NODE_V8_COVERAGE=dir`]: cli.md#node_v8_coveragedir
 [`SourceMap`]: #class-modulesourcemap
diff --git a/doc/node.1 b/doc/node.1
index 2bb02f81b819..96532ee48376 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -1862,6 +1862,10 @@ When set to 1, the module compile cache can be reused across different directory
 locations as long as the module layout relative to the cache directory remains the same,
 and by any user (the cache subdirectory is not suffixed with the creating user's uid).
 .
+.It Ev NODE_COMPILE_CACHE_READONLY Ar 1
+When set to 1, the module compile cache only reads existing entries from
+its directory: nothing is written to it and it is not created if missing.
+.
 .It Ev NODE_DEBUG Ar module[,…]
 \fB','\fR-separated list of core modules that should print debug information.
 .
diff --git a/lib/internal/modules/helpers.js b/lib/internal/modules/helpers.js
index 62b8a743942b..dec084b291bb 100644
--- a/lib/internal/modules/helpers.js
+++ b/lib/internal/modules/helpers.js
@@ -466,21 +466,25 @@ function stringify(body) {
  * after this method is called.
  * This method accepts either:
  * - A string: path to the cache directory.
- * - An options object `{directory?: string, portable?: boolean}`:
+ * - An options object `{directory?: string, portable?: boolean, readOnly?: boolean}`:
  *   - `directory`: A string path to the cache directory.
  *   - `portable`: If `portable` is true, the cache directory will be considered relative.
  *     Defaults to `NODE_COMPILE_CACHE_PORTABLE === '1'`.
+ *   - `readOnly`: If `readOnly` is true, existing cache entries are used but nothing is
+ *     written, and the cache directory is not created. Defaults to
+ *     `NODE_COMPILE_CACHE_READONLY === '1'`.
  * If cache directory is undefined, it defaults to the `NODE_COMPILE_CACHE` environment variable.
  * If `NODE_COMPILE_CACHE` isn't set, it defaults to `path.join(os.tmpdir(), 'node-compile-cache')`.
- * @param {string | { directory?: string, portable?: boolean } | undefined} options
+ * @param {string | { directory?: string, portable?: boolean, readOnly?: boolean } | undefined} options
  * @returns {{status: number, message?: string, directory?: string}}
  */
 function enableCompileCache(options) {
   let portable;
+  let readOnly;
   let directory;
 
   if (typeof options === 'object' && options !== null) {
-    ({ directory, portable } = options);
+    ({ directory, portable, readOnly } = options);
   } else {
     directory = options;
   }
@@ -490,7 +494,10 @@ function enableCompileCache(options) {
   if (portable === undefined) {
     portable = process.env.NODE_COMPILE_CACHE_PORTABLE === '1';
   }
-  const nativeResult = _enableCompileCache(directory, portable);
+  if (readOnly === undefined) {
+    readOnly = process.env.NODE_COMPILE_CACHE_READONLY === '1';
+  }
+  const nativeResult = _enableCompileCache(directory, portable, readOnly);
   const result = { status: nativeResult[0] };
   if (nativeResult[1]) {
     result.message = nativeResult[1];
diff --git a/src/compile_cache.cc b/src/compile_cache.cc
index f24a26e9bab8..8efd7b68856c 100644
--- a/src/compile_cache.cc
+++ b/src/compile_cache.cc
@@ -257,7 +257,8 @@ CompileCacheEntry* CompileCacheHandler::GetOrInsert(Local<String> code,
   // If the portable cache is enabled and it seems possible to compute the
   // relative position from an absolute path, we use the relative position
   // in the cache key.
-  if (portable_ == EnableOption::PORTABLE && IsAbsoluteFilePath(file_path)) {
+  if (HasOption(portable_, EnableOption::PORTABLE) &&
+      IsAbsoluteFilePath(file_path)) {
     // Normalize the path to ensure it is consistent.
     std::string normalized_file_path = NormalizeFileURLOrPath(env, file_path);
     if (normalized_file_path.empty()) {
@@ -332,6 +333,10 @@ void CompileCacheHandler::MaybeSaveImpl(CompileCacheEntry* entry,
     Debug("keeping the in-memory entry\n");
     return;
   }
+  if (read_only_) {
+    Debug("read-only, not serializing\n");
+    return;
+  }
   Debug("%s the in-memory entry\n",
         entry->cache == nullptr ? "initializing" : "refreshing");
 
@@ -356,6 +361,9 @@ void CompileCacheHandler::MaybeSave(CompileCacheEntry* entry,
 
 void CompileCacheHandler::MaybeSave(CompileCacheEntry* entry,
                                     std::string_view transpiled) {
+  if (read_only_) {
+    return;
+  }
   CHECK(entry->type == CachedCodeType::kStrippedTypeScript);
   Debug("[compile cache] saving transpilation cache for %s %s\n",
         entry->type_name(),
@@ -388,6 +396,10 @@ void CompileCacheHandler::MaybeSave(CompileCacheEntry* entry,
  */
 void CompileCacheHandler::Persist() {
   DCHECK(!compile_cache_dir_.empty());
+  if (read_only_) {
+    Debug("[compile cache] read-only, skipping persistence\n");
+    return;
+  }
 
   // TODO(joyeecheung): do this using a separate event loop to utilize the
   // libuv thread pool and do the file system operations concurrently.
@@ -554,10 +566,11 @@ CompileCacheEnableResult CompileCacheHandler::Enable(Environment* env,
         cache_tag,
         cache_dir_with_tag);
 
-  if (!env->permission()->is_granted(
-          env,
-          permission::PermissionScope::kFileSystemWrite,
-          cache_dir_with_tag)) [[unlikely]] {
+  const bool read_only = HasOption(option, EnableOption::READ_ONLY);
+  if (!read_only && !env->permission()->is_granted(
+                        env,
+                        permission::PermissionScope::kFileSystemWrite,
+                        cache_dir_with_tag)) [[unlikely]] {
     result.message = "Skipping compile cache because write permission for " +
                      cache_dir_with_tag + " is not granted";
     result.status = CompileCacheEnableStatus::FAILED;
@@ -574,25 +587,46 @@ CompileCacheEnableResult CompileCacheHandler::Enable(Environment* env,
     return result;
   }
 
-  fs::FSReqWrapSync req_wrap;
-  int err = fs::MKDirpSync(
-      nullptr, &(req_wrap.req), cache_dir_with_tag, 0777, nullptr);
-  if (is_debug_) {
-    Debug("[compile cache] creating cache directory %s...%s\n",
+  if (read_only) {
+    // A read-only cache is used as found and never created: without the
+    // directory there is nothing to read.
+    uv_fs_t stat_req;
+    int err =
+        uv_fs_stat(nullptr, &stat_req, cache_dir_with_tag.c_str(), nullptr);
+    // libuv normalizes st_mode across platforms; MSVC has no S_ISDIR macro.
+    bool is_dir = err == 0 && (stat_req.statbuf.st_mode & S_IFMT) == S_IFDIR;
+    uv_fs_req_cleanup(&stat_req);
+    Debug("[compile cache] read-only cache directory %s...%s\n",
           cache_dir_with_tag,
-          err < 0 ? uv_strerror(err) : "success");
-  }
-  if (err != 0 && err != UV_EEXIST) {
-    result.message =
-        "Cannot create cache directory: " + std::string(uv_strerror(err));
-    result.status = CompileCacheEnableStatus::FAILED;
-    return result;
+          is_dir ? "found" : "not found");
+    if (!is_dir) {
+      result.message =
+          "Cache directory does not exist (read-only): " + cache_dir_with_tag;
+      result.status = CompileCacheEnableStatus::FAILED;
+      return result;
+    }
+  } else {
+    fs::FSReqWrapSync req_wrap;
+    int err = fs::MKDirpSync(
+        nullptr, &(req_wrap.req), cache_dir_with_tag, 0777, nullptr);
+    if (is_debug_) {
+      Debug("[compile cache] creating cache directory %s...%s\n",
+            cache_dir_with_tag,
+            err < 0 ? uv_strerror(err) : "success");
+    }
+    if (err != 0 && err != UV_EEXIST) {
+      result.message =
+          "Cannot create cache directory: " + std::string(uv_strerror(err));
+      result.status = CompileCacheEnableStatus::FAILED;
+      return result;
+    }
   }
 
   result.cache_directory = absolute_cache_dir_base;
   compile_cache_dir_ = cache_dir_with_tag;
   portable_ = option;
-  if (option == EnableOption::PORTABLE) {
+  read_only_ = read_only;
+  if (HasOption(option, EnableOption::PORTABLE)) {
     normalized_compile_cache_dir_ =
         NormalizeFileURLOrPath(env, compile_cache_dir_);
   }
diff --git a/src/compile_cache.h b/src/compile_cache.h
index 629343321036..0fbce3624a61 100644
--- a/src/compile_cache.h
+++ b/src/compile_cache.h
@@ -60,7 +60,22 @@ struct CompileCacheEnableResult {
   std::string message;  // Set in case of failure.
 };
 
-enum class EnableOption : uint8_t { DEFAULT, PORTABLE };
+enum class EnableOption : uint8_t {
+  DEFAULT = 0,
+  PORTABLE = 1 << 0,
+  // Only read existing cache entries: nothing is compiled into the in-memory
+  // store for persisting, nothing is written to disk, and the cache directory
+  // is not created if it does not exist.
+  READ_ONLY = 1 << 1,
+};
+
+inline constexpr EnableOption operator|(EnableOption a, EnableOption b) {
+  return static_cast<EnableOption>(static_cast<uint8_t>(a) |
+                                   static_cast<uint8_t>(b));
+}
+inline constexpr bool HasOption(EnableOption value, EnableOption flag) {
+  return (static_cast<uint8_t>(value) & static_cast<uint8_t>(flag)) != 0;
+}
 
 class CompileCacheHandler {
  public:
@@ -82,6 +97,7 @@ class CompileCacheHandler {
                  bool rejected);
   void MaybeSave(CompileCacheEntry* entry, std::string_view transpiled);
   std::string_view cache_dir() { return compile_cache_dir_; }
+  bool read_only() const { return read_only_; }
 
  private:
   void ReadCacheFile(CompileCacheEntry* entry);
@@ -107,6 +123,7 @@ class CompileCacheHandler {
   std::string compile_cache_dir_;
   std::string normalized_compile_cache_dir_;
   EnableOption portable_ = EnableOption::DEFAULT;
+  bool read_only_ = false;
   std::unordered_map<uint32_t, std::unique_ptr<CompileCacheEntry>>
       compiler_cache_store_;
 };
diff --git a/src/env.cc b/src/env.cc
index 61921995cdd0..711a7f222851 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -1195,8 +1195,14 @@ void Environment::InitializeCompileCache() {
           DebugCategory::COMPILE_CACHE,
           "[compile cache] using relative path\n");
   }
-  EnableCompileCache(dir_from_env,
-                     portable ? EnableOption::PORTABLE : EnableOption::DEFAULT);
+  std::string read_only_env;
+  bool read_only = credentials::SafeGetenv(
+                       "NODE_COMPILE_CACHE_READONLY", &read_only_env, this) &&
+                   read_only_env == "1";
+  EnableOption option = EnableOption::DEFAULT;
+  if (portable) option = option | EnableOption::PORTABLE;
+  if (read_only) option = option | EnableOption::READ_ONLY;
+  EnableCompileCache(dir_from_env, option);
 }
 
 CompileCacheEnableResult Environment::EnableCompileCache(
diff --git a/src/node_modules.cc b/src/node_modules.cc
index 30780e12aed1..3a786158afea 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -524,7 +524,10 @@ void EnableCompileCache(const FunctionCallbackInfo<Value>& args) {
 
   EnableOption option = EnableOption::DEFAULT;
   if (args.Length() > 1 && args[1]->IsTrue()) {
-    option = EnableOption::PORTABLE;
+    option = option | EnableOption::PORTABLE;
+  }
+  if (args.Length() > 2 && args[2]->IsTrue()) {
+    option = option | EnableOption::READ_ONLY;
   }
 
   Utf8Value value(isolate, args[0]);
diff --git a/test/parallel/test-compile-cache-api-readonly.js b/test/parallel/test-compile-cache-api-readonly.js
new file mode 100644
index 000000000000..8ac0248a4d53
--- /dev/null
+++ b/test/parallel/test-compile-cache-api-readonly.js
@@ -0,0 +1,65 @@
+'use strict';
+
+// This tests module.enableCompileCache({ directory, readOnly: true }): existing
+// entries are read, nothing is written, and a missing directory is not created.
+
+const common = require('../common');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const wrapper = fixtures.path('compile-cache-wrapper-options.js');
+const target = path.join(tmpdir.path, 'target.js');
+fs.writeFileSync(target, 'module.exports = 1;');
+const other = path.join(tmpdir.path, 'other.js');
+fs.writeFileSync(other, 'module.exports = 2;');
+const directory = path.join(tmpdir.path, 'cache');
+const list = () => fs.readdirSync(directory, { recursive: true }).sort();
+const run = (options, extraEnv, requires, check) => spawnSyncAndAssert(
+  process.execPath,
+  [...requires.flatMap((r) => ['-r', r]), target],
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: 'COMPILE_CACHE',
+      NODE_TEST_COMPILE_CACHE_OPTIONS: JSON.stringify(options),
+      ...extraEnv,
+    },
+  },
+  check);
+
+// Read-only against a directory that does not exist: enabling fails and
+// nothing is created.
+run({ directory, readOnly: true }, {}, [wrapper], {
+  stderr: /read-only cache directory .*\.\.\.not found/,
+});
+assert(!fs.existsSync(directory));
+
+// A normal run generates the cache for target.js.
+run({ directory }, {}, [wrapper], {
+  stderr: /writing cache for .*target\.js.*success/,
+});
+const generated = list();
+assert.notStrictEqual(generated.length, 0);
+
+// Read-only against it: target.js's entry is accepted, other.js is compiled
+// but not written, and persistence is skipped.
+run({ directory, readOnly: true }, {}, [wrapper, other], {
+  stderr: common.mustCall((output) => {
+    assert.match(output, /cache for .*target\.js was accepted/);
+    assert.match(output, /read-only, skipping persistence/);
+    assert.doesNotMatch(output, /writing cache for/);
+    return true;
+  }),
+});
+assert.deepStrictEqual(list(), generated);
+
+// The environment variable form.
+run({ directory }, { NODE_COMPILE_CACHE_READONLY: '1' }, [wrapper, other], {
+  stderr: /read-only, skipping persistence/,
+});
+assert.deepStrictEqual(list(), generated);

From 30f1a19eecfaaa7863091ef0d049fcfa6e6d85df Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Sun, 23 Aug 2026 20:01:09 +0900
Subject: [PATCH 310/344] test: simplify test-timers-interval-promisified.js

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65322
Refs: https://github.com/nodejs/node/pull/57338
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/parallel/test-timers-interval-promisified.js | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/test/parallel/test-timers-interval-promisified.js b/test/parallel/test-timers-interval-promisified.js
index e22b94ae3f70..c31b5af7f271 100644
--- a/test/parallel/test-timers-interval-promisified.js
+++ b/test/parallel/test-timers-interval-promisified.js
@@ -245,12 +245,10 @@ const { setInterval } = timerPromises;
 
 (async () => {
   const signal = AbortSignal.abort('boom');
-  try {
+  await assert.rejects(async () => {
     const iterable = timerPromises.setInterval(2, undefined, { signal });
+
     // eslint-disable-next-line no-unused-vars, no-empty
     for await (const _ of iterable) { }
-    assert.fail('should have failed');
-  } catch (err) {
-    assert.strictEqual(err.cause, 'boom');
-  }
+  }, { cause: 'boom' }, 'should have failed');
 })().then(common.mustCall());

From 13f16d28d14364cd4b6657c8412f0fee44818587 Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Sun, 23 Aug 2026 21:58:43 +0900
Subject: [PATCH 311/344] doc: fix broken links in cli.md

Fix the link to the Environment variables section
and replace the semi-space link with the relevant V8 documentation.

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65412
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 doc/api/cli.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 4b2113fae2a3..912030f9b321 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -4551,7 +4551,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [debugging security implications]: https://nodejs.org/learn/getting-started/debugging#security-implications
 [deprecation warnings]: deprecations.md#list-of-deprecated-apis
 [emit_warning]: process.md#processemitwarningwarning-options
-[environment_variables]: #environment-variables_1
+[environment_variables]: #environment-variables-1
 [filtering tests by name]: test.md#filtering-tests-by-name
 [global setup and teardown]: test.md#global-setup-and-teardown
 [jitless]: https://v8.dev/blog/jitless
@@ -4563,7 +4563,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [running tests from the command line]: test.md#running-tests-from-the-command-line
 [scavenge garbage collector]: https://v8.dev/blog/orinoco-parallel-scavenger
 [security warning]: #warning-binding-inspector-to-a-public-ipport-combination-is-insecure
-[semi-space]: https://www.memorymanagement.org/glossary/s.html#semi.space
+[semi-space]: https://v8.dev/blog/trash-talk#minor-gc
 [single executable application]: single-executable-applications.md
 [snapshot testing]: test.md#snapshot-testing
 [syntax detection]: packages.md#syntax-detection

From 9304dee833ca940e8500bb0e8cc1812112e60949 Mon Sep 17 00:00:00 2001
From: Yuya Inoue <65857152+inoway46@users.noreply.github.com>
Date: Mon, 24 Aug 2026 00:40:03 +0900
Subject: [PATCH 312/344] test: remove test-debugger-run-after-quit-restart as
 flaky on macOS

Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65424
Fixes: https://github.com/nodejs/node/issues/64005
Refs: https://github.com/nodejs/node/pull/64006
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/parallel/parallel.status | 2 --
 1 file changed, 2 deletions(-)

diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
index 7b15183e2fdb..d8fba447e96e 100644
--- a/test/parallel/parallel.status
+++ b/test/parallel/parallel.status
@@ -45,8 +45,6 @@ test-http-server-headers-timeout-keepalive: PASS,FLAKY
 test-http-server-request-timeout-keepalive: PASS,FLAKY
 # https://github.com/nodejs/node/issues/60050
 test-cluster-dgram-1: SKIP
-# https://github.com/nodejs/node/issues/64005
-test-debugger-run-after-quit-restart: PASS,FLAKY
 
 [$arch==arm || $arch==arm64]
 # https://github.com/nodejs/node/pull/31178

From 359369e24e51971a0079d537c7f1232c15991e6a Mon Sep 17 00:00:00 2001
From: Junsoo Ha <35479251+ganjanggejang@users.noreply.github.com>
Date: Mon, 24 Aug 2026 00:40:14 +0900
Subject: [PATCH 313/344] test: use spawnSyncAndAssert in windowsHide test

Signed-off-by: Junsoo Ha <junsoo2018@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65351
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 test/parallel/test-child-process-windows-hide.js | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/test/parallel/test-child-process-windows-hide.js b/test/parallel/test-child-process-windows-hide.js
index c218c901a7f2..324b342a7c7b 100644
--- a/test/parallel/test-child-process-windows-hide.js
+++ b/test/parallel/test-child-process-windows-hide.js
@@ -8,6 +8,7 @@ const internalCp = require('internal/child_process');
 const cmd = process.execPath;
 const args = ['-p', '42'];
 const options = { windowsHide: true };
+const { spawnSyncAndAssert } = require('../common/child_process');
 
 // Since windowsHide isn't really observable, this test relies on monkey
 // patching spawn() and spawnSync() to verify that the flag is being passed
@@ -15,12 +16,12 @@ const options = { windowsHide: true };
 
 test('spawnSync() passes windowsHide correctly', (t) => {
   const spy = t.mock.method(internalCp, 'spawnSync');
-  const child = cp.spawnSync(cmd, args, options);
 
-  assert.strictEqual(child.status, 0);
-  assert.strictEqual(child.signal, null);
-  assert.strictEqual(child.stdout.toString().trim(), '42');
-  assert.strictEqual(child.stderr.toString().trim(), '');
+  spawnSyncAndAssert(cmd, args, options, {
+    stdout: '42',
+    stderr: '',
+    trim: true
+  });
   assert.strictEqual(spy.mock.calls.length, 1);
   assert.strictEqual(spy.mock.calls[0].arguments[0].windowsHide, true);
 });

From 01cb4f99a043bed8a8ad5df4083fb02016c9d189 Mon Sep 17 00:00:00 2001
From: Nachiketa Pathak <nachiketapathak11@gmail.com>
Date: Sun, 23 Aug 2026 11:40:24 -0400
Subject: [PATCH 314/344] test: convert forEach to for of
 test-messageevent-brandcheck file

Signed-off-by: Nachiketa Pathak <nachiketapathak11@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65279
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 test/parallel/test-messageevent-brandcheck.js | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/test/parallel/test-messageevent-brandcheck.js b/test/parallel/test-messageevent-brandcheck.js
index 17f2b708cc56..a78affb785af 100644
--- a/test/parallel/test-messageevent-brandcheck.js
+++ b/test/parallel/test-messageevent-brandcheck.js
@@ -3,12 +3,6 @@
 require('../common');
 const assert = require('assert');
 
-[
-  'data',
-  'origin',
-  'lastEventId',
-  'source',
-  'ports',
-].forEach((i) => {
+for (const i of ['data', 'origin', 'lastEventId', 'source', 'ports']) {
   assert.throws(() => Reflect.get(MessageEvent.prototype, i, {}), TypeError);
-});
+}

From a77f9f7a32593c68cf4cfe4b1d6fd5c1eb8286da Mon Sep 17 00:00:00 2001
From: GetThatCookie <NimmenKeks@gmx.de>
Date: Sun, 23 Aug 2026 17:40:34 +0200
Subject: [PATCH 315/344] stream: reuse unexposed managed read buffers

Signed-off-by: GetThatCookie <NimmenKeks@gmx.de>
PR-URL: https://github.com/nodejs/node/pull/64990
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/env.cc                      | 21 +++++++++++++++++----
 src/env.h                       |  3 +++
 src/stream_base.cc              |  2 ++
 test/cctest/test_environment.cc | 21 +++++++++++++++++++++
 4 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/src/env.cc b/src/env.cc
index 711a7f222851..b381cc341734 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -77,6 +77,8 @@ using v8::Undefined;
 using v8::Value;
 using worker::Worker;
 
+constexpr size_t kManagedBufferCacheSize = 64 * 1024;
+
 int const ContextEmbedderTag::kNodeContextTag = 0x6e6f64;
 void* const ContextEmbedderTag::kNodeContextTagPtr = const_cast<void*>(
     static_cast<const void*>(&ContextEmbedderTag::kNodeContextTag));
@@ -782,10 +784,16 @@ void Environment::add_refs(int64_t diff) {
 }
 
 uv_buf_t Environment::allocate_managed_buffer(const size_t suggested_size) {
-  std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
-      isolate(),
-      suggested_size,
-      BackingStoreInitializationMode::kUninitialized);
+  std::unique_ptr<BackingStore> bs;
+  if (suggested_size == kManagedBufferCacheSize &&
+      managed_buffer_cache_ != nullptr) {
+    bs = std::move(managed_buffer_cache_);
+  } else {
+    bs = ArrayBuffer::NewBackingStore(
+        isolate(),
+        suggested_size,
+        BackingStoreInitializationMode::kUninitialized);
+  }
   uv_buf_t buf = uv_buf_init(static_cast<char*>(bs->Data()), bs->ByteLength());
   released_allocated_buffers_.emplace(buf.base, std::move(bs));
   return buf;
@@ -803,6 +811,11 @@ std::unique_ptr<BackingStore> Environment::release_managed_buffer(
   return bs;
 }
 
+void Environment::recycle_managed_buffer(std::unique_ptr<BackingStore> bs) {
+  if (bs != nullptr && bs->ByteLength() == kManagedBufferCacheSize)
+    managed_buffer_cache_ = std::move(bs);
+}
+
 std::string Environment::GetExecPath(const std::vector<std::string>& argv) {
   char exec_path_buf[2 * PATH_MAX];
   size_t exec_path_len = sizeof(exec_path_buf);
diff --git a/src/env.h b/src/env.h
index 288084e3a589..84fad81e7b34 100644
--- a/src/env.h
+++ b/src/env.h
@@ -1063,6 +1063,8 @@ class Environment final : public MemoryRetainer {
 
   uv_buf_t allocate_managed_buffer(const size_t suggested_size);
   std::unique_ptr<v8::BackingStore> release_managed_buffer(const uv_buf_t& buf);
+  // Only buffers that were not exposed externally may be recycled.
+  void recycle_managed_buffer(std::unique_ptr<v8::BackingStore> bs);
 
   void AddUnmanagedFd(int fd);
   void RemoveUnmanagedFd(int fd);
@@ -1279,6 +1281,7 @@ class Environment final : public MemoryRetainer {
   // track of the BackingStore for a given pointer.
   std::unordered_map<char*, std::unique_ptr<v8::BackingStore>>
       released_allocated_buffers_;
+  std::unique_ptr<v8::BackingStore> managed_buffer_cache_;
 
   v8::CpuProfiler* cpu_profiler_ = nullptr;
   std::vector<v8::ProfilerId> pending_profiles_;
diff --git a/src/stream_base.cc b/src/stream_base.cc
index 370b8f682ead..0791dcf81ebb 100644
--- a/src/stream_base.cc
+++ b/src/stream_base.cc
@@ -697,6 +697,7 @@ void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
   std::unique_ptr<BackingStore> bs = env->release_managed_buffer(buf_);
 
   if (nread <= 0)  {
+    env->recycle_managed_buffer(std::move(bs));
     if (nread < 0)
       stream->CallJSOnreadMethod(nread, Local<ArrayBuffer>());
     return;
@@ -708,6 +709,7 @@ void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
     bs = ArrayBuffer::NewBackingStore(
         isolate, nread, BackingStoreInitializationMode::kUninitialized);
     memcpy(bs->Data(), old_bs->Data(), nread);
+    env->recycle_managed_buffer(std::move(old_bs));
   }
 
   stream->CallJSOnreadMethod(nread, ArrayBuffer::New(isolate, std::move(bs)));
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index fb1bcc2ef90c..109e224f788d 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -39,6 +39,27 @@ class EnvironmentTest : public EnvironmentTestFixture {
   }
 };
 
+TEST_F(EnvironmentTest, ManagedBufferCache) {
+  constexpr size_t kCacheSize = 64 * 1024;
+  constexpr size_t kOtherSize = 1024;
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  (*env)->recycle_managed_buffer(nullptr);
+
+  uv_buf_t buffer = (*env)->allocate_managed_buffer(kCacheSize);
+  char* cached_data = buffer.base;
+  (*env)->recycle_managed_buffer((*env)->release_managed_buffer(buffer));
+
+  buffer = (*env)->allocate_managed_buffer(kOtherSize);
+  (*env)->recycle_managed_buffer((*env)->release_managed_buffer(buffer));
+
+  buffer = (*env)->allocate_managed_buffer(kCacheSize);
+  EXPECT_EQ(buffer.base, cached_data);
+  (*env)->release_managed_buffer(buffer);
+}
+
 TEST_F(EnvironmentTest, EnvironmentWithoutBrowserGlobals) {
   const v8::HandleScope handle_scope(isolate_);
   Argv argv;

From 4de7e638836ba13e5b0856c5cab9097a47b5b779 Mon Sep 17 00:00:00 2001
From: semimikoh <ejffjeosms@gmail.com>
Date: Mon, 24 Aug 2026 00:40:58 +0900
Subject: [PATCH 316/344] test_runner: match dotfiles in default coverage
 exclude

The default coverage exclude globs did not match dotfiles, so test
files such as `test/.foo.test.js` were incorrectly included in coverage
reports. Apply the `dot: true` minimatch option when matching the
relative path so the default exclude patterns cover dotfiles, while
keeping plain matching for the absolute path to avoid misinterpreting
dot segments in the filesystem path (e.g. tmp dirs like `test/.tmp.0`).

Fixes: https://github.com/nodejs/node/issues/63397
Signed-off-by: semimikoh <ejffjeosms@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63401
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 lib/internal/test_runner/coverage.js          | 26 +++++++--
 .../test/.dotfile.cjs                         |  7 +++
 ...test-runner-coverage-default-exclusion.mjs | 57 ++++++++++---------
 3 files changed, 59 insertions(+), 31 deletions(-)
 create mode 100644 test/fixtures/test-runner/coverage-default-exclusion/test/.dotfile.cjs

diff --git a/lib/internal/test_runner/coverage.js b/lib/internal/test_runner/coverage.js
index 55151d64563f..1ce9578a9a0a 100644
--- a/lib/internal/test_runner/coverage.js
+++ b/lib/internal/test_runner/coverage.js
@@ -47,6 +47,9 @@ const kIgnoreRegex = /\/\* node:coverage ignore next (?<count>\d+ )?\*\//;
 const kLineEndingRegex = /\r?\n$/u;
 const kLineSplitRegex = /(?<=\r?\n)/u;
 const kStatusRegex = /\/\* node:coverage (?<status>enable|disable) \*\//;
+// Match dotfiles (e.g. `test/.foo.js`) when applying coverage globs so the
+// default exclude patterns cover them.
+const kMatchGlobPatternOptions = { __proto__: null, dot: true };
 const kTypeOnlyImportRegex = /^\s*import\s+type\b/u;
 const kTypeScriptSourceRegex = /\.(?:cts|mts|ts)$/u;
 const kSourceFileGlob = '**/*.{cjs,cts,js,mjs,mts,ts}';
@@ -63,6 +66,14 @@ function getStripTypeScriptTypesForCoverage() {
   return stripTypeScriptTypesForCoverage;
 }
 
+function createCoverageMatcher(pattern) {
+  return {
+    __proto__: null,
+    relative: createMatcher(pattern, kMatchGlobPatternOptions),
+    absolute: createMatcher(pattern),
+  };
+}
+
 class CoverageLine {
   constructor(line, startOffset, src, length = src?.length) {
     const newlineLength = src == null ? 0 :
@@ -605,23 +616,28 @@ class TestCoverage {
     // TestCoverage instance, so compile each glob to a matcher once and reuse
     // it for every file. Building a fresh Minimatch per call (the previous
     // behavior) dominated the coverage report time, scaling with
-    // files * globs.
+    // files * globs. Each glob compiles to a matcher pair: `relative` enables
+    // dot:true so globs match dotfiles within the project, while `absolute`
+    // keeps the default behavior to avoid misinterpreting dot segments in the
+    // absolute filesystem path (e.g. tmp dirs like `test/.tmp.0`).
     this.#excludeMatchers ??= ArrayPrototypeMap(
-      this.options.coverageExcludeGlobs ?? [], (pattern) => createMatcher(pattern));
+      this.options.coverageExcludeGlobs ?? [], createCoverageMatcher);
     this.#includeMatchers ??= ArrayPrototypeMap(
-      this.options.coverageIncludeGlobs ?? [], (pattern) => createMatcher(pattern));
+      this.options.coverageIncludeGlobs ?? [], createCoverageMatcher);
 
     // This check filters out files that match the exclude globs.
     for (let i = 0; i < this.#excludeMatchers.length; ++i) {
       const matcher = this.#excludeMatchers[i];
-      if (matcher.match(relativePath) || matcher.match(absolutePath)) return true;
+      if (matcher.relative.match(relativePath) ||
+          matcher.absolute.match(absolutePath)) return true;
     }
 
     // This check filters out files that do not match the include globs.
     if (this.#includeMatchers.length > 0) {
       for (let i = 0; i < this.#includeMatchers.length; ++i) {
         const matcher = this.#includeMatchers[i];
-        if (matcher.match(relativePath) || matcher.match(absolutePath)) return false;
+        if (matcher.relative.match(relativePath) ||
+            matcher.absolute.match(absolutePath)) return false;
       }
       return true;
     }
diff --git a/test/fixtures/test-runner/coverage-default-exclusion/test/.dotfile.cjs b/test/fixtures/test-runner/coverage-default-exclusion/test/.dotfile.cjs
new file mode 100644
index 000000000000..ec0a4c24fffb
--- /dev/null
+++ b/test/fixtures/test-runner/coverage-default-exclusion/test/.dotfile.cjs
@@ -0,0 +1,7 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { foo } = require('../logic-file.js');
+
+test('foo returns 1 from a dotfile test', () => {
+  assert.strictEqual(foo(), 1);
+});
diff --git a/test/parallel/test-runner-coverage-default-exclusion.mjs b/test/parallel/test-runner-coverage-default-exclusion.mjs
index 44e5f7600d32..f6080612a37c 100644
--- a/test/parallel/test-runner-coverage-default-exclusion.mjs
+++ b/test/parallel/test-runner-coverage-default-exclusion.mjs
@@ -16,6 +16,16 @@ async function setupFixtures() {
   await cp(fixtureDir, tmpdir.path, { recursive: true });
 }
 
+function assertDefaultExclusions(stdout) {
+  assert.match(stdout, /# start of coverage report/);
+  assert.doesNotMatch(stdout, /# file-test\.js\s+\|/);
+  assert.doesNotMatch(stdout, /# file\.test\.mjs\s+\|/);
+  assert.doesNotMatch(stdout, /# file\.test\.ts\s+\|/);
+  assert.doesNotMatch(stdout, /# test\.cjs\s+\|/);
+  assert.doesNotMatch(stdout, /#\s+not-matching-test-name\.js\s+\|/);
+  assert.match(stdout, /# end of coverage report/);
+}
+
 describe('test runner coverage default exclusion', skipIfNoInspector, () => {
   before(async () => {
     await setupFixtures();
@@ -58,18 +68,6 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
   });
 
   it('should exclude test files from coverage by default', async () => {
-    const report = [
-      '# start of coverage report',
-      '# --------------------------------------------------------------',
-      '# file          | line % | branch % | funcs % | uncovered lines',
-      '# --------------------------------------------------------------',
-      '# logic-file.js |  66.67 |   100.00 |   50.00 | 5-7',
-      '# --------------------------------------------------------------',
-      '# all files     |  66.67 |   100.00 |   50.00 | ',
-      '# --------------------------------------------------------------',
-      '# end of coverage report',
-    ].join('\n');
-
     const args = [
       '--no-experimental-strip-types',
       '--test',
@@ -82,23 +80,11 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
     });
 
     assert.strictEqual(result.stderr.toString(), '');
-    assert(result.stdout.toString().includes(report));
+    assertDefaultExclusions(result.stdout.toString());
     assert.strictEqual(result.status, 0);
   });
 
   it('should exclude ts test files', async () => {
-    const report = [
-      '# start of coverage report',
-      '# --------------------------------------------------------------',
-      '# file          | line % | branch % | funcs % | uncovered lines',
-      '# --------------------------------------------------------------',
-      '# logic-file.js |  66.67 |   100.00 |   50.00 | 5-7',
-      '# --------------------------------------------------------------',
-      '# all files     |  66.67 |   100.00 |   50.00 | ',
-      '# --------------------------------------------------------------',
-      '# end of coverage report',
-    ].join('\n');
-
     const args = [
       '--test',
       '--experimental-test-coverage',
@@ -111,7 +97,26 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
     });
 
     assert.strictEqual(result.stderr.toString(), '');
-    assert(result.stdout.toString().includes(report));
+    assertDefaultExclusions(result.stdout.toString());
+    assert.strictEqual(result.status, 0);
+  });
+
+  it('should exclude dotfile test files from coverage by default', async () => {
+    const args = [
+      '--no-experimental-strip-types',
+      '--test',
+      '--experimental-test-coverage',
+      '--test-reporter=tap',
+      'test/.dotfile.cjs',
+    ];
+    const result = spawnSync(process.execPath, args, {
+      env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
+      cwd: tmpdir.path
+    });
+
+    assert.strictEqual(result.stderr.toString(), '');
+    assertDefaultExclusions(result.stdout.toString());
+    assert.doesNotMatch(result.stdout.toString(), /#\s+\.dotfile\.cjs\s+\|/);
     assert.strictEqual(result.status, 0);
   });
 });

From 7e9204f4b345071cce208cedcac260aa5ed26d99 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sun, 23 Aug 2026 07:52:00 -0800
Subject: [PATCH 317/344] http: use intrusive lists in ConnectionsList

Every HTTP message was performing multiple erase and insert operations
on two std::set instances ordered by a mutating key, showing up as ~2%
of CPU cycles in a hello-world server profile due to red-black tree
rebalancing and node allocations.

Replace both sets with intrusive doubly-linked lists. Membership in the
list of all connections no longer changes per message, and updating the
active connections list is now O(1) with no allocations. Appending to
the tail keeps the active list ordered by last_message_start_ because
uv_hrtime() is monotonic.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65296
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node_http_parser.cc | 153 +++++++++++++++++++++-------------------
 1 file changed, 82 insertions(+), 71 deletions(-)

diff --git a/src/node_http_parser.cc b/src/node_http_parser.cc
index c7b4eeac88f9..5177ce74e5f3 100644
--- a/src/node_http_parser.cc
+++ b/src/node_http_parser.cc
@@ -246,55 +246,63 @@ struct StringPtr {
   size_t size_ = 0;
 };
 
-struct ParserComparator {
-  bool operator()(const Parser* lhs, const Parser* rhs) const;
+// Intrusive doubly-linked list node, linked to itself when not in a list.
+struct ParserListNode {
+  ParserListNode* prev = this;
+  ParserListNode* next = this;
+
+  ParserListNode() = default;
+  ~ParserListNode() { Remove(); }
+
+  ParserListNode(const ParserListNode&) = delete;
+  ParserListNode& operator=(const ParserListNode&) = delete;
+
+  void Remove() {
+    prev->next = next;
+    next->prev = prev;
+    prev = this;
+    next = this;
+  }
 };
 
 class ConnectionsList : public BaseObject {
  public:
-    static void New(const FunctionCallbackInfo<Value>& args);
+  static void New(const FunctionCallbackInfo<Value>& args);
 
-    static void All(const FunctionCallbackInfo<Value>& args);
+  static void All(const FunctionCallbackInfo<Value>& args);
 
-    static void Idle(const FunctionCallbackInfo<Value>& args);
+  static void Idle(const FunctionCallbackInfo<Value>& args);
 
-    static void Active(const FunctionCallbackInfo<Value>& args);
+  static void Active(const FunctionCallbackInfo<Value>& args);
 
-    static void Expired(const FunctionCallbackInfo<Value>& args);
+  static void Expired(const FunctionCallbackInfo<Value>& args);
 
-    void Push(Parser* parser) {
-      all_connections_.insert(parser);
-    }
+  inline void Push(Parser* parser);
 
-    void Pop(Parser* parser) {
-      all_connections_.erase(parser);
-    }
+  inline void Pop(Parser* parser);
 
-    void PushActive(Parser* parser) {
-      active_connections_.insert(parser);
-    }
+  inline void PushActive(Parser* parser);
 
-    void PopActive(Parser* parser) {
-      active_connections_.erase(parser);
-    }
+  inline void PopActive(Parser* parser);
 
-    SET_NO_MEMORY_INFO()
-    SET_MEMORY_INFO_NAME(ConnectionsList)
-    SET_SELF_SIZE(ConnectionsList)
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(ConnectionsList)
+  SET_SELF_SIZE(ConnectionsList)
 
  private:
-    ConnectionsList(Environment* env, Local<Object> object)
+  ConnectionsList(Environment* env, Local<Object> object)
       : BaseObject(env, object) {
-        MakeWeak();
-      }
+    MakeWeak();
+  }
 
-    std::set<Parser*, ParserComparator> all_connections_;
-    std::set<Parser*, ParserComparator> active_connections_;
+  // active_connections_ is ordered by last_message_start_, as parsers are
+  // appended right after it is assigned from the monotonic uv_hrtime().
+  ParserListNode all_connections_;
+  ParserListNode active_connections_;
 };
 
 class Parser : public AsyncWrap, public StreamListener {
   friend class ConnectionsList;
-  friend struct ParserComparator;
 
  public:
   Parser(BindingData* binding_data, Local<Object> wrap)
@@ -308,13 +316,6 @@ class Parser : public AsyncWrap, public StreamListener {
   SET_SELF_SIZE(Parser)
 
   int on_message_begin() {
-    // Important: Pop from the lists BEFORE resetting the last_message_start_
-    // otherwise std::set.erase will fail.
-    if (connectionsList_ != nullptr) {
-      connectionsList_->Pop(this);
-      connectionsList_->PopActive(this);
-    }
-
     num_fields_ = num_values_ = 0;
     headers_completed_ = false;
     chunk_extensions_nread_ = 0;
@@ -326,7 +327,6 @@ class Parser : public AsyncWrap, public StreamListener {
     max_header_pairs_ = -1;
 
     if (connectionsList_ != nullptr) {
-      connectionsList_->Push(this);
       connectionsList_->PushActive(this);
     }
 
@@ -345,7 +345,6 @@ class Parser : public AsyncWrap, public StreamListener {
     return 0;
   }
 
-
   int on_url(const char* at, size_t length) {
     int rv = TrackHeader(length);
     if (rv != 0) {
@@ -544,19 +543,12 @@ class Parser : public AsyncWrap, public StreamListener {
   int on_message_complete() {
     HandleScope scope(env()->isolate());
 
-    // Important: Pop from the lists BEFORE resetting the last_message_start_
-    // otherwise std::set.erase will fail.
     if (connectionsList_ != nullptr) {
-      connectionsList_->Pop(this);
       connectionsList_->PopActive(this);
     }
 
     last_message_start_ = 0;
 
-    if (connectionsList_ != nullptr) {
-      connectionsList_->Push(this);
-    }
-
     if (num_fields_)
       Flush();  // Flush trailing HTTP headers.
 
@@ -742,8 +734,6 @@ class Parser : public AsyncWrap, public StreamListener {
       // server.timeout is left to the default value of zero.
       parser->last_message_start_ = uv_hrtime();
 
-      // Important: Push into the lists AFTER setting the last_message_start_
-      // otherwise std::set.erase will fail later.
       parser->connectionsList_->Push(parser);
       parser->connectionsList_->PushActive(parser);
     } else {
@@ -1122,6 +1112,8 @@ class Parser : public AsyncWrap, public StreamListener {
   uint64_t max_http_header_size_;
   uint64_t last_message_start_;
   ConnectionsList* connectionsList_;
+  ParserListNode all_node_;
+  ParserListNode active_node_;
 
   BaseObjectPtr<BindingData> binding_data_;
 
@@ -1149,18 +1141,34 @@ class Parser : public AsyncWrap, public StreamListener {
   static const llhttp_settings_t settings;
 };
 
-bool ParserComparator::operator()(const Parser* lhs, const Parser* rhs) const {
-  if (lhs->last_message_start_ == 0 && rhs->last_message_start_ == 0) {
-    // When both parsers are idle, guarantee strict order by
-    // comparing pointers as ints.
-    return lhs < rhs;
-  } else if (lhs->last_message_start_ == 0) {
-    return true;
-  } else if (rhs->last_message_start_ == 0) {
-    return false;
-  }
+namespace {
+
+// Append `node` at the tail of the list headed by `head`, unlinking it from
+// any list it is currently in.
+void ListPushBack(ParserListNode* head, ParserListNode* node) {
+  node->Remove();
+  node->prev = head->prev;
+  node->next = head;
+  head->prev->next = node;
+  head->prev = node;
+}
+
+}  // anonymous namespace
 
-  return lhs->last_message_start_ < rhs->last_message_start_;
+void ConnectionsList::Push(Parser* parser) {
+  ListPushBack(&all_connections_, &parser->all_node_);
+}
+
+void ConnectionsList::Pop(Parser* parser) {
+  parser->all_node_.Remove();
+}
+
+void ConnectionsList::PushActive(Parser* parser) {
+  ListPushBack(&active_connections_, &parser->active_node_);
+}
+
+void ConnectionsList::PopActive(Parser* parser) {
+  parser->active_node_.Remove();
 }
 
 void ConnectionsList::New(const FunctionCallbackInfo<Value>& args) {
@@ -1178,8 +1186,10 @@ void ConnectionsList::All(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&list, args.This());
 
   LocalVector<Value> result(isolate);
-  result.reserve(list->all_connections_.size());
-  for (auto parser : list->all_connections_) {
+  for (ParserListNode* node = list->all_connections_.next;
+       node != &list->all_connections_;
+       node = node->next) {
+    Parser* parser = ContainerOf(&Parser::all_node_, node);
     result.emplace_back(parser->object());
   }
 
@@ -1195,8 +1205,10 @@ void ConnectionsList::Idle(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&list, args.This());
 
   LocalVector<Value> result(isolate);
-  result.reserve(list->all_connections_.size());
-  for (auto parser : list->all_connections_) {
+  for (ParserListNode* node = list->all_connections_.next;
+       node != &list->all_connections_;
+       node = node->next) {
+    Parser* parser = ContainerOf(&Parser::all_node_, node);
     if (parser->last_message_start_ == 0 || !parser->received_data_) {
       result.emplace_back(parser->object());
     }
@@ -1214,8 +1226,10 @@ void ConnectionsList::Active(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&list, args.This());
 
   LocalVector<Value> result(isolate);
-  result.reserve(list->active_connections_.size());
-  for (auto parser : list->active_connections_) {
+  for (ParserListNode* node = list->active_connections_.next;
+       node != &list->active_connections_;
+       node = node->next) {
+    Parser* parser = ContainerOf(&Parser::active_node_, node);
     result.emplace_back(parser->object());
   }
 
@@ -1259,14 +1273,11 @@ void ConnectionsList::Expired(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().Set(Array::New(isolate, 0));
   }
 
-  auto iter = list->active_connections_.begin();
-  auto end = list->active_connections_.end();
-
   LocalVector<Value> result(isolate);
-  result.reserve(list->active_connections_.size());
-  while (iter != end) {
-    Parser* parser = *iter;
-    iter++;
+  ParserListNode* node = list->active_connections_.next;
+  while (node != &list->active_connections_) {
+    Parser* parser = ContainerOf(&Parser::active_node_, node);
+    node = node->next;
 
     // Check for expiration.
     if (
@@ -1278,7 +1289,7 @@ void ConnectionsList::Expired(const FunctionCallbackInfo<Value>& args) {
     ) {
       result.emplace_back(parser->object());
 
-      list->active_connections_.erase(parser);
+      parser->active_node_.Remove();
     }
   }
 

From cf395004ed10c3cde61a56a98c0d86c227399a0b Mon Sep 17 00:00:00 2001
From: Samuel Williams <samuel.williams@shopify.com>
Date: Mon, 24 Aug 2026 03:52:12 +1200
Subject: [PATCH 318/344] tty: add raw-vt and io raw modes

Signed-off-by: Samuel Williams <samuel.williams@shopify.com>
PR-URL: https://github.com/nodejs/node/pull/64140
Refs: https://github.com/nodejs/node/issues/63059
Refs: https://github.com/libuv/libuv/issues/32
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/tty.md                              | 30 ++++++++++++--
 lib/tty.js                                  | 33 +++++++++++++---
 src/tty_wrap.cc                             | 10 +++--
 test/pseudo-tty/test-set-raw-mode-modes.js  | 43 +++++++++++++++++++++
 test/pseudo-tty/test-set-raw-mode-modes.out |  4 ++
 5 files changed, 108 insertions(+), 12 deletions(-)
 create mode 100644 test/pseudo-tty/test-set-raw-mode-modes.js
 create mode 100644 test/pseudo-tty/test-set-raw-mode-modes.out

diff --git a/doc/api/tty.md b/doc/api/tty.md
index cbfb3cc78377..f50848101e04 100644
--- a/doc/api/tty.md
+++ b/doc/api/tty.md
@@ -69,12 +69,18 @@ A `boolean` that is always `true` for `tty.ReadStream` instances.
 
 <!-- YAML
 added: v0.7.7
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64140
+    description: The `mode` argument supports `'raw'` and `'io'`.
 -->
 
-* `mode` {boolean} If `true`, configures the `tty.ReadStream` to operate as a
-  raw device. If `false`, configures the `tty.ReadStream` to operate in its
-  default mode. The `readStream.isRaw` property will be set to the resulting
-  mode.
+* `mode` {boolean|string} If `true` or `'raw'`, configures the
+  `tty.ReadStream` to operate as a raw device. If `'io'`, configures the
+  `tty.ReadStream` to operate in binary-safe I/O mode. If `false`, configures
+  the `tty.ReadStream` to operate in its default mode. The `readStream.isRaw`
+  property will be set to whether the stream is in raw mode, and the
+  `readStream.rawMode` property will be set to the resulting mode.
 * Returns: {this} The read stream instance.
 
 Allows configuration of `tty.ReadStream` so that it operates as a raw device.
@@ -91,6 +97,22 @@ buffer. When opening `"\\\\.\\CONIN$"` with the [`fs.open()`][] family of APIs
 (for passing into `new tty.ReadStream()`), be sure to use a read/write flag
 such as `'r+'`.
 
+When in binary-safe I/O mode, terminal output processing is also disabled.
+This corresponds to libuv's `UV_TTY_MODE_IO` mode and is not supported on
+Windows.
+
+### `readStream.rawMode`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {boolean|string}
+
+The current raw mode for the `tty.ReadStream`. This is `false` when the stream
+is in its default mode, `'raw'` when raw input mode is enabled, and `'io'` when
+binary-safe I/O mode is enabled.
+
 ## Class: `tty.WriteStream`
 
 <!-- YAML
diff --git a/lib/tty.js b/lib/tty.js
index b1a2d3e7a9bc..309930f67c35 100644
--- a/lib/tty.js
+++ b/lib/tty.js
@@ -27,10 +27,17 @@ const {
 } = primordials;
 
 const net = require('net');
-const { TTY, isTTY } = internalBinding('tty_wrap');
+const {
+  TTY,
+  UV_TTY_MODE_IO,
+  UV_TTY_MODE_NORMAL,
+  UV_TTY_MODE_RAW_VT,
+  isTTY,
+} = internalBinding('tty_wrap');
 const {
   ErrnoException,
   codes: {
+    ERR_INVALID_ARG_VALUE,
     ERR_INVALID_FD,
     ERR_TTY_INIT_FAILED,
   },
@@ -68,20 +75,36 @@ function ReadStream(fd, options) {
   });
 
   this.isRaw = false;
+  this.rawMode = false;
   this.isTTY = true;
 }
 
 ObjectSetPrototypeOf(ReadStream.prototype, net.Socket.prototype);
 ObjectSetPrototypeOf(ReadStream, net.Socket);
 
-ReadStream.prototype.setRawMode = function(flag) {
-  flag = !!flag;
-  const err = this._handle?.setRawMode(flag);
+ReadStream.prototype.setRawMode = function(mode) {
+  let rawMode;
+  if (mode === 'io' || mode === 'raw') {
+    rawMode = mode;
+  } else if (typeof mode === 'string') {
+    throw new ERR_INVALID_ARG_VALUE(
+      'mode', mode, "must be true, false, 'raw', or 'io'");
+  } else {
+    rawMode = mode ? 'raw' : false;
+  }
+  let ttyMode = UV_TTY_MODE_NORMAL;
+  if (rawMode === 'io') {
+    ttyMode = UV_TTY_MODE_IO;
+  } else if (rawMode === 'raw') {
+    ttyMode = UV_TTY_MODE_RAW_VT;
+  }
+  const err = this._handle?.setRawMode(ttyMode);
   if (err) {
     this.emit('error', new ErrnoException(err, 'setRawMode'));
     return this;
   }
-  this.isRaw = flag;
+  this.isRaw = rawMode !== false;
+  this.rawMode = rawMode;
   return this;
 };
 
diff --git a/src/tty_wrap.cc b/src/tty_wrap.cc
index 3086e859a54e..c605ab2fcc11 100644
--- a/src/tty_wrap.cc
+++ b/src/tty_wrap.cc
@@ -68,6 +68,9 @@ void TTYWrap::Initialize(Local<Object> target,
   SetProtoMethod(isolate, t, "setRawMode", SetRawMode);
 
   SetMethodNoSideEffect(context, target, "isTTY", IsTTY);
+  NODE_DEFINE_CONSTANT(target, UV_TTY_MODE_NORMAL);
+  NODE_DEFINE_CONSTANT(target, UV_TTY_MODE_IO);
+  NODE_DEFINE_CONSTANT(target, UV_TTY_MODE_RAW_VT);
 
   Local<Value> func;
   if (t->GetFunction(context).ToLocal(&func) &&
@@ -124,9 +127,10 @@ void TTYWrap::SetRawMode(const FunctionCallbackInfo<Value>& args) {
   // sequences at all on Windows, such as bracketed paste mode.
   // The Node.js readline implementation handles differences between
   // these modes.
-  int err = uv_tty_set_mode(
-      &wrap->handle_,
-      args[0]->IsTrue() ? UV_TTY_MODE_RAW_VT : UV_TTY_MODE_NORMAL);
+  Environment* env = Environment::GetCurrent(args);
+  int mode;
+  if (!args[0]->Int32Value(env->context()).To(&mode)) return;
+  int err = uv_tty_set_mode(&wrap->handle_, static_cast<uv_tty_mode_t>(mode));
   args.GetReturnValue().Set(err);
 }
 
diff --git a/test/pseudo-tty/test-set-raw-mode-modes.js b/test/pseudo-tty/test-set-raw-mode-modes.js
new file mode 100644
index 000000000000..8280aacb0a85
--- /dev/null
+++ b/test/pseudo-tty/test-set-raw-mode-modes.js
@@ -0,0 +1,43 @@
+'use strict';
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+
+function isOnlcrEnabled() {
+  const { stdout, stderr, status } = spawnSync('stty', ['-a'], {
+    encoding: 'utf8',
+    stdio: ['inherit', 'pipe', 'pipe'],
+  });
+
+  assert.strictEqual(status, 0, stderr);
+  return /(?:^|[\s;])onlcr(?:[\s;]|$)/.test(stdout);
+}
+
+process.stdin.setRawMode(true);
+console.log(`raw=${isOnlcrEnabled()}`);
+assert.strictEqual(process.stdin.isRaw, true);
+assert.strictEqual(process.stdin.rawMode, 'raw');
+
+process.stdin.setRawMode(false);
+console.log(`normal=${process.stdin.isRaw}`);
+assert.strictEqual(process.stdin.rawMode, false);
+assert.throws(
+  () => process.stdin.setRawMode('raw-vt'),
+  {
+    code: 'ERR_INVALID_ARG_VALUE',
+    name: 'TypeError',
+  });
+assert.strictEqual(process.stdin.rawMode, false);
+
+process.stdin.setRawMode('raw');
+console.log(`raw-string=${isOnlcrEnabled()}`);
+assert.strictEqual(process.stdin.isRaw, true);
+assert.strictEqual(process.stdin.rawMode, 'raw');
+
+process.stdin.setRawMode(false);
+process.stdin.setRawMode('io');
+console.log(`io=${isOnlcrEnabled()}`);
+assert.strictEqual(process.stdin.isRaw, true);
+assert.strictEqual(process.stdin.rawMode, 'io');
+
+process.stdin.setRawMode(false);
diff --git a/test/pseudo-tty/test-set-raw-mode-modes.out b/test/pseudo-tty/test-set-raw-mode-modes.out
new file mode 100644
index 000000000000..e449081d60cb
--- /dev/null
+++ b/test/pseudo-tty/test-set-raw-mode-modes.out
@@ -0,0 +1,4 @@
+raw=true
+normal=false
+raw-string=true
+io=false

From bb499c312ea335bf63f162a4fb546ad4da465922 Mon Sep 17 00:00:00 2001
From: Mhayk Whandson <hi@mhayk.com>
Date: Sun, 23 Aug 2026 18:29:01 +0100
Subject: [PATCH 319/344] repl: keep entries added while history file is
 loading

Lines can be evaluated while the history file is still being read
asynchronously by setupHistory(), e.g. when the input stream does not
support pausing. The entries added to the in-memory history in the
meantime were discarded once the file load completed, because the
loaded entries overwrote the in-memory history. Merge the persisted
entries with the in-memory ones instead.

Refs: https://github.com/nodejs/node/issues/64508
Signed-off-by: Mhayk Whandson <hi@mhayk.com>
PR-URL: https://github.com/nodejs/node/pull/64513
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/repl/history.js                  | 18 +++++-
 ...-history-load-preserves-pending-entries.js | 64 +++++++++++++++++++
 2 files changed, 79 insertions(+), 3 deletions(-)
 create mode 100644 test/parallel/test-repl-history-load-preserves-pending-entries.js

diff --git a/lib/internal/repl/history.js b/lib/internal/repl/history.js
index b197c7049cc0..505c900f2cd6 100644
--- a/lib/internal/repl/history.js
+++ b/lib/internal/repl/history.js
@@ -4,6 +4,7 @@ const {
   ArrayPrototypeIndexOf,
   ArrayPrototypeJoin,
   ArrayPrototypePop,
+  ArrayPrototypePushApply,
   ArrayPrototypeShift,
   ArrayPrototypeSplice,
   ArrayPrototypeUnshift,
@@ -302,10 +303,21 @@ class ReplHistory {
         return this[kHandleHistoryInitError](err, onReadyCallback);
       }
 
-      if (data) {
-        this[kHistory] = RegExpPrototypeSymbolSplit(/\r?\n+/, data, this[kSize]);
+      const loadedHistory = data ?
+        RegExpPrototypeSymbolSplit(/\r?\n+/, data, this[kSize]) :
+        [];
+
+      // Lines can be evaluated while the history file is still being read,
+      // e.g. when the input stream does not support pausing. Such entries
+      // are already in the in-memory history (newest first), so append the
+      // persisted entries to them instead of discarding them.
+      if (this[kHistory].length > 0) {
+        ArrayPrototypePushApply(this[kHistory], loadedHistory);
+        if (this[kHistory].length > this[kSize]) {
+          ArrayPrototypeSplice(this[kHistory], this[kSize]);
+        }
       } else {
-        this[kHistory] = [];
+        this[kHistory] = loadedHistory;
       }
 
       validateArray(this[kHistory], 'history');
diff --git a/test/parallel/test-repl-history-load-preserves-pending-entries.js b/test/parallel/test-repl-history-load-preserves-pending-entries.js
new file mode 100644
index 000000000000..01e025f4267e
--- /dev/null
+++ b/test/parallel/test-repl-history-load-preserves-pending-entries.js
@@ -0,0 +1,64 @@
+'use strict';
+
+// Lines can be evaluated while the history file is still being loaded
+// asynchronously by `setupHistory()`, e.g. when the input stream does not
+// support pausing. Entries added to the in-memory history in the meantime
+// must not be discarded once the file load completes.
+// Refs: https://github.com/nodejs/node/issues/64508
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const stream = require('stream');
+const repl = require('repl');
+
+if (process.env.TERM === 'dumb') {
+  common.skip('skipping - dumb terminal');
+}
+
+common.skipIfInspectorDisabled();
+
+const tmpdir = require('../common/tmpdir');
+tmpdir.refresh();
+
+const historyPath = tmpdir.resolve('.repl_history');
+fs.writeFileSync(historyPath, 'persisted entry');
+
+// An input stream that, unlike a TTY, does not buffer data while paused.
+class FakeInput extends stream.Stream {
+  resume() {}
+  pause() {}
+}
+FakeInput.prototype.readable = true;
+
+const input = new FakeInput();
+const output = new stream.Writable({
+  write(chunk, encoding, callback) {
+    callback();
+  },
+});
+
+const r = repl.start({
+  input,
+  output,
+  prompt: '',
+  terminal: true,
+  useColors: false,
+});
+
+r.setupHistory(historyPath, common.mustSucceed(() => {
+  // The lines evaluated while the history file was being read must be kept,
+  // newest first, followed by the persisted entries.
+  assert.deepStrictEqual(
+    r.history,
+    ['const b = 2', 'const a = 1', 'persisted entry'],
+  );
+  assert.strictEqual(
+    fs.readFileSync(historyPath, 'utf8'),
+    'const b = 2\nconst a = 1\npersisted entry',
+  );
+  r.close();
+}));
+
+// Evaluated synchronously, before the history file has been read.
+input.emit('data', 'const a = 1\nconst b = 2\n');

From 5fbf6c57af4b1370fc183d9efc74620ab9e8b41d Mon Sep 17 00:00:00 2001
From: Jihwan <hanityx@gmail.com>
Date: Mon, 24 Aug 2026 04:11:17 +0900
Subject: [PATCH 320/344] doc: fix property names in os.networkInterfaces()
 example

Signed-off-by: hanityx <hanityx@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65469
Refs: https://github.com/nodejs/node/pull/63200
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
---
 doc/api/os.md | 56 +++++++++++++++++++++++++--------------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/doc/api/os.md b/doc/api/os.md
index 6b3bb1ddfa55..a2592a2f20cc 100644
--- a/doc/api/os.md
+++ b/doc/api/os.md
@@ -298,42 +298,42 @@ The properties available on the assigned network address object include:
 
 ```json
 {
-  "lo:": [
+  "lo": [
     {
-      "address:": "127.0.0.1",
-      "netmask:": "255.0.0.0",
-      "family:": "IPv4",
-      "mac:": "00:00:00:00:00:00",
-      "internal:": true,
-      "cidr:": "127.0.0.1/8"
+      "address": "127.0.0.1",
+      "netmask": "255.0.0.0",
+      "family": "IPv4",
+      "mac": "00:00:00:00:00:00",
+      "internal": true,
+      "cidr": "127.0.0.1/8"
     },
     {
-      "address:": "::1",
-      "netmask:": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
-      "family:": "IPv6",
-      "mac:": "00:00:00:00:00:00",
-      "scopeid:": 0,
-      "internal:": true,
-      "cidr:": "::1/128"
+      "address": "::1",
+      "netmask": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+      "family": "IPv6",
+      "mac": "00:00:00:00:00:00",
+      "scopeid": 0,
+      "internal": true,
+      "cidr": "::1/128"
     }
   ],
-  "eth0:": [
+  "eth0": [
     {
-      "address:": "192.168.1.108",
-      "netmask:": "255.255.255.0",
-      "family:": "IPv4",
-      "mac:": "01:02:03:0a:0b:0c",
-      "internal:": false,
-      "cidr:": "192.168.1.108/24"
+      "address": "192.168.1.108",
+      "netmask": "255.255.255.0",
+      "family": "IPv4",
+      "mac": "01:02:03:0a:0b:0c",
+      "internal": false,
+      "cidr": "192.168.1.108/24"
     },
     {
-      "address:": "fe80::a00:27ff:fe4e:66a1",
-      "netmask:": "ffff:ffff:ffff:ffff::",
-      "family:": "IPv6",
-      "mac:": "01:02:03:0a:0b:0c",
-      "scopeid:": 1,
-      "internal:": false,
-      "cidr:": "fe80::a00:27ff:fe4e:66a1/64"
+      "address": "fe80::a00:27ff:fe4e:66a1",
+      "netmask": "ffff:ffff:ffff:ffff::",
+      "family": "IPv6",
+      "mac": "01:02:03:0a:0b:0c",
+      "scopeid": 1,
+      "internal": false,
+      "cidr": "fe80::a00:27ff:fe4e:66a1/64"
     }
   ]
 }

From dc51c7926e4f712b4c6e3cfd0d95468ecd570eb8 Mon Sep 17 00:00:00 2001
From: "Kamat, Trivikram" <16024985+trivikr@users.noreply.github.com>
Date: Sun, 16 Aug 2026 12:10:21 -0700
Subject: [PATCH 321/344] stream: drain pending writes before broadcast end

Keep processing writes that were queued before end(). Signal the
broadcast end only after those writes enter the shared buffer.

Resolve end() after all consumers reach end-of-stream. This prevents
backpressured writes from remaining pending forever.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65334
Fixes: https://github.com/nodejs/node/issues/65333
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/stream_iter.md                        |  10 +-
 lib/internal/streams/iter/broadcast.js        | 126 +++++++++++++-----
 ...test-stream-iter-broadcast-backpressure.js | 101 +++++++++++++-
 .../test-stream-iter-broadcast-basic.js       |  71 +++++++++-
 4 files changed, 258 insertions(+), 50 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index ad62c8c8b47b..899f19b38672 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -431,14 +431,16 @@ the write. Use [`ondrain()`][] to wait for capacity rather than polling.
     the pending `end()` call; it does not fail the writer itself.
 * Returns: {Promise} Fulfills with the total number of bytes written.
 
-Signal that no more data will be written.
+Signals that no more data will be written and waits for buffered data to drain.
 
 #### `writer.endSync()`
 
-* Returns: {number} Total bytes written, or `-1` if the writer is not open.
+* Returns: {number} Total bytes written, or `-1` if ending cannot complete
+  synchronously.
 
-Synchronous variant of `writer.end()`. Returns `-1` if the writer is already
-closed or errored. Can be used as a try-fallback pattern:
+Synchronous variant of `writer.end()`. A return value of `-1` means closing has
+started but requires asynchronous draining. Use the try-fallback pattern to
+await completion:
 
 ```cjs
 const result = writer.endSync();
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 4c63774bbb32..0674d4d57037 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -14,6 +14,8 @@ const {
   PromiseReject,
   PromiseResolve,
   PromiseWithResolvers,
+  SafePromisePrototypeFinally,
+  SafePromiseRace,
   SafeSet,
   Symbol,
   SymbolAsyncDispose,
@@ -77,6 +79,22 @@ const kEnd = Symbol('kEnd');
 const kAbort = Symbol('kAbort');
 const kCanWrite = Symbol('kCanWrite');
 const kOnBufferDrained = Symbol('kOnBufferDrained');
+const kOnEndDrained = Symbol('kOnEndDrained');
+const kPendingWriteRemoved = Symbol('kPendingWriteRemoved');
+
+function raceEndWithSignal(promise, signal) {
+  if (!signal) return promise;
+
+  const { promise: aborted, reject } = PromiseWithResolvers();
+  const onAbort = () => reject(signal.reason);
+  signal.addEventListener('abort', onAbort, { __proto__: null, once: true });
+  if (signal.aborted) onAbort();
+
+  return SafePromisePrototypeFinally(
+    SafePromiseRace([promise, aborted]),
+    () => signal.removeEventListener('abort', onAbort),
+  );
+}
 
 // =============================================================================
 // Broadcast Implementation
@@ -100,6 +118,7 @@ class BroadcastImpl {
   constructor(options) {
     this.#options = options;
     this[kOnBufferDrained] = null;
+    this[kOnEndDrained] = null;
   }
 
   setWriter(writer) {
@@ -183,6 +202,7 @@ class BroadcastImpl {
       if (self.#deleteConsumer(state)) {
         self.#tryTrimBuffer();
       }
+      self.#notifyEndDrained();
     }
 
     return {
@@ -358,10 +378,11 @@ class BroadcastImpl {
         }
       }
     }
+    this.#notifyEndDrained();
   }
 
   [kAbort](reason) {
-    if (this.#ended || this.#error !== undefined) return;
+    if (this.#error !== undefined) return;
     this.#error = reason;
     this.#ended = true;
 
@@ -396,6 +417,12 @@ class BroadcastImpl {
 
   // Private methods
 
+  #notifyEndDrained() {
+    if (this.#ended && this.#consumers.size === 0) {
+      this[kOnEndDrained]?.();
+    }
+  }
+
   #recomputeMinCursor() {
     const { minCursor, minCursorConsumers } = getMinCursor(
       this.#consumers, this.#bufferStart + this.#buffer.length);
@@ -516,8 +543,9 @@ let getBroadcastPendingWrites;
 class BroadcastWriter {
   #broadcast;
   #totalBytes = 0;
-  #closed;
-  #aborted = false;
+  #state = 'open';
+  #error;
+  #pendingEnd;
   #pendingWrites = new RingBuffer();
   #pendingDrains = [];
 
@@ -532,8 +560,11 @@ class BroadcastWriter {
 
     this.#broadcast[kOnBufferDrained] = () => {
       this.#resolvePendingWrites();
-      this.#resolvePendingDrains(true);
+      if (this.#state === 'open') {
+        this.#resolvePendingDrains(true);
+      }
     };
+    this.#broadcast[kOnEndDrained] = () => this.#endDrained();
   }
 
   // The drainable protocol works with Stream.ondrain to provide a notification
@@ -547,20 +578,12 @@ class BroadcastWriter {
     return promise;
   }
 
-  #isClosed() {
-    return this.#closed !== undefined;
-  }
-
-  #isClosedOrAborted() {
-    return this.#isClosed() || this.#aborted;
-  }
-
   get canWrite() {
-    return this.#isClosedOrAborted() ? null : this.#broadcast[kCanWrite]();
+    return this.#state === 'open' ? this.#broadcast[kCanWrite]() : null;
   }
 
   #canUseWriteFastPath(signal) {
-    return !signal && !this.#isClosed() && !this.#aborted &&
+    return !signal && this.#state === 'open' &&
         this.#broadcast[kCanWrite]();
   }
 
@@ -592,13 +615,15 @@ class BroadcastWriter {
   }
 
   async #writevSlow(chunks, signal) {
-    // Check for pre-aborted
-    signal?.throwIfAborted();
-
-    if (this.#isClosedOrAborted()) {
+    if (this.#state === 'errored') {
+      throw this.#error;
+    }
+    if (this.#state !== 'open') {
       throw new ERR_INVALID_STATE.TypeError('Writer is closed');
     }
 
+    signal?.throwIfAborted();
+
     const converted = convertChunks(chunks);
 
     if (this.#broadcast[kWrite](converted)) {
@@ -624,7 +649,7 @@ class BroadcastWriter {
   }
 
   writeSync(chunk) {
-    if (this.#isClosedOrAborted()) return false;
+    if (this.#state !== 'open') return false;
     if (!this.#broadcast[kCanWrite]()) return false;
     const converted =
       toUint8Array(chunk);
@@ -637,7 +662,7 @@ class BroadcastWriter {
 
   writevSync(chunks) {
     validateArray(chunks, 'chunks');
-    if (this.#isClosedOrAborted()) return false;
+    if (this.#state !== 'open') return false;
     if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
     if (this.#broadcast[kWrite](converted)) {
@@ -651,34 +676,43 @@ class BroadcastWriter {
 
   end(options) {
     const signal = getWriterSignal(options);
+    if (this.#state === 'errored') return PromiseReject(this.#error);
+    if (this.#state === 'closed') return PromiseResolve(this.#totalBytes);
     if (signal?.aborted) return PromiseReject(signal.reason);
 
-    if (this.#isClosed()) return this.#closed;
-    this.#closed = PromiseResolve(this.#totalBytes);
-    this.#broadcast[kEnd]();
-    this.#resolvePendingDrains(false);
-    return this.#closed;
+    const endPromise = this.#getEndPromise();
+    if (this.#state === 'open') {
+      this.#state = 'closing';
+      this.#resolvePendingDrains(false);
+      this.#finishEndIfReady();
+    }
+
+    return raceEndWithSignal(endPromise, signal);
   }
 
   endSync() {
-    if (this.#closed) return this.#totalBytes;
-    this.#closed = PromiseResolve(this.#totalBytes);
-    this.#broadcast[kEnd]();
+    if (this.#state === 'closed') return this.#totalBytes;
+    if (this.#state === 'errored' || this.#state === 'closing') return -1;
+
+    this.#state = 'closing';
     this.#resolvePendingDrains(false);
-    return this.#totalBytes;
+    this.#finishEndIfReady();
+    return this.#state === 'closed' ? this.#totalBytes : -1;
   }
 
   fail(reason) {
-    if (this.#isClosedOrAborted()) return;
-    this.#aborted = true;
-    this.#closed = PromiseResolve(this.#totalBytes);
+    if (this.#state === 'errored' || this.#state === 'closed') return;
+    this.#state = 'errored';
     const error = reason ?? new ERR_INVALID_STATE.TypeError('Failed');
+    this.#error = error;
     this.#rejectPendingWrites(error);
     this.#rejectPendingDrains(error);
+    this.#pendingEnd?.reject(error);
     this.#broadcast[kAbort](error);
   }
 
   [SymbolAsyncDispose]() {
+    if (this.#state === 'closing') return this.#getEndPromise();
     this.fail();
     return PromiseResolve();
   }
@@ -688,11 +722,33 @@ class BroadcastWriter {
   }
 
   [kCancelWriter]() {
-    if (this.#isClosed()) return;
-    this.#closed = PromiseResolve(this.#totalBytes);
+    if (this.#state === 'closed' || this.#state === 'errored') return;
+    this.#state = 'closed';
     this.#rejectPendingWrites(
       lazyDOMException('Broadcast cancelled', 'AbortError'));
     this.#resolvePendingDrains(false);
+    this.#pendingEnd?.resolve(this.#totalBytes);
+  }
+
+  #getEndPromise() {
+    this.#pendingEnd ??= PromiseWithResolvers();
+    return this.#pendingEnd.promise;
+  }
+
+  #finishEndIfReady() {
+    if (this.#state === 'closing' && this.#pendingWrites.length === 0) {
+      this.#broadcast[kEnd]();
+    }
+  }
+
+  #endDrained() {
+    if (this.#state !== 'closing') return;
+    this.#state = 'closed';
+    this.#pendingEnd?.resolve(this.#totalBytes);
+  }
+
+  [kPendingWriteRemoved]() {
+    this.#finishEndIfReady();
   }
 
   /**
@@ -724,6 +780,7 @@ class BroadcastWriter {
         break;
       }
     }
+    this.#finishEndIfReady();
   }
 
   #rejectPendingWrites(error) {
@@ -756,6 +813,7 @@ function wireBroadcastWriteSignal(entry, signal, resolve, reject, self) {
     if (idx !== -1) pendingWrites.removeAt(idx);
     entry.chunk = null;
     reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
+    if (idx !== -1) self[kPendingWriteRemoved]();
   };
   entry.resolve = function() {
     signal.removeEventListener('abort', onAbort);
diff --git a/test/parallel/test-stream-iter-broadcast-backpressure.js b/test/parallel/test-stream-iter-broadcast-backpressure.js
index 35a0cf0e238c..698f1821aeea 100644
--- a/test/parallel/test-stream-iter-broadcast-backpressure.js
+++ b/test/parallel/test-stream-iter-broadcast-backpressure.js
@@ -135,15 +135,99 @@ async function testStrictBackpressureOverflow() {
   });
 }
 
+async function testEndDrainsPendingWrite() {
+  const chunk1 = new Uint8Array(16384).fill(65); // 'A'
+  const chunk2 = Uint8Array.of(66); // 'B'
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'unbounded',
+  });
+  const iter = bc.push()[Symbol.asyncIterator]();
+
+  await writer.write(chunk1);
+  const pendingWrite = writer.write(chunk2);
+  const endPromise = writer.end();
+
+  assert.strictEqual(writer.canWrite, null);
+  assert.strictEqual(writer.writeSync('late'), false);
+  await assert.rejects(writer.write('late'), {
+    code: 'ERR_INVALID_STATE',
+  });
+
+  const first = await iter.next();
+  assert.strictEqual(first.done, false);
+  assert.strictEqual(first.value[0][0], 65);
+  await pendingWrite;
+
+  const second = await iter.next();
+  assert.strictEqual(second.done, false);
+  assert.strictEqual(second.value[0][0], 66);
+
+  let endResolved = false;
+  endPromise.then(common.mustCall(() => { endResolved = true; }));
+  await new Promise(setImmediate);
+  assert.strictEqual(endResolved, false);
+
+  assert.strictEqual((await iter.next()).done, true);
+  assert.strictEqual(await endPromise, 16385);
+}
+
+async function testEndSyncDrainsPendingWrite() {
+  const chunk1 = new Uint8Array(16384).fill(65); // 'A'
+  const chunk2 = Uint8Array.of(66); // 'B'
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'unbounded',
+  });
+  const iter = bc.push()[Symbol.asyncIterator]();
+
+  await writer.write(chunk1);
+  const pendingWrite = writer.write(chunk2);
+  assert.strictEqual(writer.endSync(), -1);
+  const endPromise = writer.end();
+
+  assert.strictEqual((await iter.next()).value[0][0], 65);
+  await pendingWrite;
+  assert.strictEqual((await iter.next()).value[0][0], 66);
+  assert.strictEqual((await iter.next()).done, true);
+  assert.strictEqual(await endPromise, 16385);
+  assert.strictEqual(writer.endSync(), 16385);
+}
+
+async function testAbortedPendingWriteAllowsEnd() {
+  const ac = new AbortController();
+  const reason = new Error('write aborted');
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'unbounded',
+  });
+  const iter = bc.push()[Symbol.asyncIterator]();
+
+  await writer.write(new Uint8Array(16384));
+  const pendingWrite = writer.write('blocked', { signal: ac.signal });
+  const writeRejected = assert.rejects(
+    pendingWrite,
+    (error) => error === reason,
+  );
+  const endPromise = writer.end();
+
+  ac.abort(reason);
+  await writeRejected;
+  assert.strictEqual((await iter.next()).done, false);
+  assert.strictEqual((await iter.next()).done, true);
+  assert.strictEqual(await endPromise, 16384);
+}
+
 // Writev async path
 async function testWritevAsync() {
   const { writer, broadcast: bc } = broadcast({ budget: 16384 });
   const consumer = bc.push();
 
   await writer.writev(['hello', ' ', 'world']);
+  const dataPromise = text(consumer);
   await writer.end();
 
-  const data = await text(consumer);
+  const data = await dataPromise;
   assert.strictEqual(data, 'hello world');
 }
 
@@ -167,15 +251,19 @@ async function testZeroByteWrites() {
   assert.strictEqual(entries, 0);
 }
 
-// endSync returns the total byte count
+// endSync falls back to end() when consumers still need to drain.
 async function testEndSyncReturnValue() {
   const { writer, broadcast: bc } = broadcast({ budget: 16384 });
-  bc.push(); // Need a consumer to write to
+  const consumer = bc.push();
 
   writer.writeSync('hello'); // 5 bytes
   writer.writeSync(' world'); // 6 bytes
-  const total = writer.endSync();
-  assert.strictEqual(total, 11);
+  assert.strictEqual(writer.endSync(), -1);
+
+  const dataPromise = text(consumer);
+  assert.strictEqual(await writer.end(), 11);
+  assert.strictEqual(await dataPromise, 'hello world');
+  assert.strictEqual(writer.endSync(), 11);
 }
 
 Promise.all([
@@ -184,6 +272,9 @@ Promise.all([
   testBlockBackpressure(),
   testBlockBackpressureContent(),
   testStrictBackpressureOverflow(),
+  testEndDrainsPendingWrite(),
+  testEndSyncDrainsPendingWrite(),
+  testAbortedPendingWriteAllowsEnd(),
   testWritevAsync(),
   testZeroByteWrites(),
   testEndSyncReturnValue(),
diff --git a/test/parallel/test-stream-iter-broadcast-basic.js b/test/parallel/test-stream-iter-broadcast-basic.js
index 4438e82a7817..3dbd3ce97512 100644
--- a/test/parallel/test-stream-iter-broadcast-basic.js
+++ b/test/parallel/test-stream-iter-broadcast-basic.js
@@ -19,13 +19,14 @@ async function testBasicBroadcast() {
 
   assert.strictEqual(bc.consumerCount, 2);
 
-  await writer.write('hello');
-  await writer.end();
-
-  const [data1, data2] = await Promise.all([
+  const dataPromise = Promise.all([
     text(consumer1),
     text(consumer2),
   ]);
+  await writer.write('hello');
+  await writer.end();
+
+  const [data1, data2] = await dataPromise;
 
   assert.strictEqual(data1, 'hello');
   assert.strictEqual(data2, 'hello');
@@ -39,9 +40,10 @@ async function testMultipleWrites() {
   await writer.write('a');
   await writer.write('b');
   await writer.write('c');
+  const dataPromise = text(consumer);
   await writer.end();
 
-  const data = await text(consumer);
+  const data = await dataPromise;
   assert.strictEqual(data, 'abc');
 }
 
@@ -104,10 +106,11 @@ async function testWriterEnd() {
   const consumer = bc.push();
 
   await writer.write('data');
+  const dataPromise = text(consumer);
   const totalBytes = await writer.end();
   assert.strictEqual(totalBytes, 4); // 'data' = 4 UTF-8 bytes
 
-  const data = await text(consumer);
+  const data = await dataPromise;
   assert.strictEqual(data, 'data');
 }
 
@@ -123,8 +126,59 @@ async function testWriterEndWithPreAbortedSignal() {
 
   // A rejected end must leave the writer open.
   await writer.write('data');
+  const dataPromise = text(consumer);
   assert.strictEqual(await writer.end(), 4);
-  assert.strictEqual(await text(consumer), 'data');
+  assert.strictEqual(await dataPromise, 'data');
+}
+
+async function testWriterEndWaitsForAllConsumers() {
+  const { writer, broadcast: bc } = broadcast();
+  const iter1 = bc.push()[Symbol.asyncIterator]();
+  const iter2 = bc.push()[Symbol.asyncIterator]();
+
+  await writer.write('data');
+  const endPromise = writer.end();
+  let endResolved = false;
+  endPromise.then(common.mustCall(() => { endResolved = true; }));
+
+  assert.strictEqual((await iter1.next()).done, false);
+  assert.strictEqual((await iter2.next()).done, false);
+  assert.strictEqual((await iter1.next()).done, true);
+  assert.strictEqual(endResolved, false);
+
+  assert.strictEqual((await iter2.next()).done, true);
+  assert.strictEqual(await endPromise, 4);
+}
+
+async function testWriterEndSignalDoesNotFailWriter() {
+  const { writer, broadcast: bc } = broadcast();
+  const consumer = bc.push();
+  const ac = new AbortController();
+  const reason = new Error('end aborted');
+
+  await writer.write('data');
+  const signaledEnd = writer.end({ signal: ac.signal });
+  const rejected = assert.rejects(signaledEnd, (error) => error === reason);
+  ac.abort(reason);
+  await rejected;
+
+  const dataPromise = text(consumer);
+  assert.strictEqual(await writer.end(), 4);
+  assert.strictEqual(await dataPromise, 'data');
+}
+
+async function testWriterFailWhileClosing() {
+  const { writer, broadcast: bc } = broadcast();
+  const iter = bc.push()[Symbol.asyncIterator]();
+  const reason = new Error('writer failed while closing');
+
+  await writer.write('data');
+  const endPromise = writer.end();
+  const endRejected = assert.rejects(endPromise, (error) => error === reason);
+  writer.fail(reason);
+
+  await endRejected;
+  await assert.rejects(iter.next(), (error) => error === reason);
 }
 
 async function testWriterFail() {
@@ -336,6 +390,9 @@ Promise.all([
   testWritevSync(),
   testWriterEnd(),
   testWriterEndWithPreAbortedSignal(),
+  testWriterEndWaitsForAllConsumers(),
+  testWriterEndSignalDoesNotFailWriter(),
+  testWriterFailWhileClosing(),
   testWriterFail(),
   testCancelWithoutReason(),
   testCancelWithReason(),

From 9e8e9080fdb47bb15873b980b91fe163d2576533 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Wed, 19 Aug 2026 21:17:41 -0700
Subject: [PATCH 322/344] perf_hooks: add statistical hypothesis testing to
 histogram

Welch's t-test, Mann-Whitney U test, Cohen's d, and Cliff's delta,
and and handful of others

These methods enable in-process benchmark comparison and regression
detection without external dependencies.

No new dependencies.

Tests and docs created by the AI agent.

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus
PR-URL: https://github.com/nodejs/node/pull/65416
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 doc/api/perf_hooks.md                         | 255 ++++++++
 lib/internal/histogram.js                     | 201 ++++++-
 src/histogram-inl.h                           |  58 +-
 src/histogram.cc                              | 518 +++++++++++++++-
 src/histogram.h                               |  64 ++
 .../test-perf-hooks-histogram-stats.js        | 561 ++++++++++++++++++
 6 files changed, 1647 insertions(+), 10 deletions(-)
 create mode 100644 test/parallel/test-perf-hooks-histogram-stats.js

diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 544c25e9fdc9..e5f95fe67d43 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1625,6 +1625,16 @@ added:
     **Default:** `Number.MAX_SAFE_INTEGER`.
   * `figures` {number} The number of accuracy digits. Must be a number between
     `1` and `5`. **Default:** `3`.
+  * `halfLife` {number} The EWMA half-life in number of samples. When set to
+    a value greater than 0, the histogram tracks an exponentially weighted
+    moving average and standard deviation, accessible via
+    `histogram.ewmaMean` and `histogram.ewmaStddev`. After `halfLife`
+    recordings, a value's influence has decayed to 50%. **Default:** `0`
+    (disabled).
+  * `threshold` {number} An SLO threshold value. When set together with
+    `halfLife`, the histogram tracks a smoothed error rate for values
+    exceeding this threshold, accessible via `histogram.ewmaErrorRate` and
+    `histogram.burnRate()`. **Default:** `0` (disabled).
 * Returns: {RecordableHistogram}
 
 Returns a {RecordableHistogram}.
@@ -1893,6 +1903,36 @@ value, representing the probability that a recorded value will be less
 than or equal to `value`. This is the inverse operation of
 `histogram.percentile()`.
 
+### `histogram.cliffsD(other)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `other` {Histogram} The histogram to compare against.
+* Returns: {number} A value between -1.0 and 1.0.
+
+Computes [Cliff's delta][], a non-parametric effect size measure. Returns
+the probability that a random value from this histogram exceeds a random
+value from `other`, minus the reverse probability. A value of 1 means every
+value in this histogram exceeds every value in `other`; -1 means the
+opposite; 0 means no tendency in either direction.
+
+### `histogram.cohensD(other)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `other` {Histogram} The histogram to compare against.
+* Returns: {number} The effect size.
+
+Computes [Cohen's d][] effect size, the standardized difference between the
+means of this histogram and `other`, using the pooled standard deviation.
+Positive values indicate this histogram has a higher mean. By convention,
+|d| < 0.2 is a small effect, 0.5 is medium, and 0.8 or greater is large.
+Both histograms must have at least 2 recorded values; otherwise returns 0.
+
 ### `histogram.countAt(value)`
 
 <!-- YAML
@@ -1929,6 +1969,74 @@ added:
 The number of times the event loop delay exceeded the maximum 1 hour event
 loop delay threshold.
 
+### `histogram.ewmaMean`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The exponentially weighted moving average of recorded values. Only active
+when the histogram was created with a `halfLife` option greater than 0.
+Returns `0` when EWMA is disabled or no values have been recorded.
+
+### `histogram.ewmaStddev`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The exponentially weighted moving standard deviation. Only active when the
+histogram was created with a `halfLife` option greater than 0. Returns `0`
+when EWMA is disabled or no values have been recorded.
+
+### `histogram.ewmaErrorRate`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The EWMA-smoothed probability of a recorded value exceeding the configured
+`threshold`. Only active when the histogram was created with both `halfLife`
+and `threshold` options. Returns `0` when not enabled or no values have been
+recorded.
+
+### `histogram.burnRate(sloTarget)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `sloTarget` {number} The SLO target as a fraction between 0 and 1
+  (exclusive). For example, `0.999` for a 99.9% SLO.
+* Returns: {number}
+
+Returns the SLO burn rate: `ewmaErrorRate / (1 - sloTarget)`. A burn rate
+of 1 means the error budget will be exactly exhausted over the SLO window.
+A burn rate greater than 1 means it is being consumed faster than allowed.
+Requires the histogram to have been created with both `halfLife` and
+`threshold` options.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+// Track latency with a 200ms SLO threshold, half-life of 100 samples
+const h = createHistogram({ halfLife: 100, threshold: 200_000_000 });
+
+// ... record latency values ...
+
+// Check burn rate against a 99.9% SLO
+const rate = h.burnRate(0.999);
+if (rate > 1) {
+  console.log(`SLO burn rate: ${rate.toFixed(2)}x — error budget depleting`);
+}
+```
+
 ### `histogram.ksTest(other)`
 
 <!-- YAML
@@ -1982,6 +2090,24 @@ Returns the histogram data rebucketed into logarithmically-spaced
 intervals, where each bucket's width is multiplied by `base`.
 Useful for visualization and export.
 
+### `histogram.mannWhitneyTest(other)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `other` {Histogram} The histogram to compare against.
+* Returns: {Object}
+  * `uStatistic` {number} The Mann-Whitney U statistic.
+  * `zScore` {number} The z-score (normal approximation).
+  * `pValue` {number} Two-tailed p-value.
+
+Performs a [Mann-Whitney U test][] comparing whether this histogram tends to
+produce larger or smaller values than `other`. Unlike `welchTest()`, this is a
+non-parametric test that makes no assumptions about the shape of the
+distributions. Uses the normal approximation with tie correction for the
+p-value.
+
 ### `histogram.max`
 
 <!-- YAML
@@ -2060,6 +2186,40 @@ added:
 
 Returns the value at the given percentile.
 
+### `histogram.percentileCI(percentile[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `percentile` {number} A percentile value in the range (0, 100].
+* `options` {Object}
+  * `confidence` {number} The confidence level for the interval, between
+    0 and 1 (exclusive). **Default:** `0.95`.
+* Returns: {Object}
+  * `value` {number} The point estimate (same as `histogram.percentile()`).
+  * `lower` {number} The lower bound of the confidence interval.
+  * `upper` {number} The upper bound of the confidence interval.
+
+Returns a confidence interval for the given percentile using the exact
+binomial method. With fewer samples, the interval will be wider, reflecting
+the greater uncertainty in the percentile estimate. Requires at least 2
+recorded values; with fewer than 2, `lower` and `upper` will equal `value`.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 0; i < 1000; i++) {
+  h.record(Math.floor(Math.random() * 100));
+}
+
+const ci = h.percentileCI(99);
+console.log(ci.value);  // The p99 point estimate
+console.log(ci.lower);  // The lower bound (95% confidence)
+console.log(ci.upper);  // The upper bound (95% confidence)
+```
+
 ### `histogram.percentiles`
 
 <!-- YAML
@@ -2127,6 +2287,31 @@ added: v11.10.0
 
 The standard deviation of the recorded event loop delays.
 
+### `histogram.welchTest(other[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `other` {Histogram} The histogram to compare against.
+* `options` {Object}
+  * `confidence` {number} Confidence level for the interval, between 0 and 1.
+    **Default:** `0.95`.
+* Returns: {Object}
+  * `tStatistic` {number} The Welch t-statistic.
+  * `degreesOfFreedom` {number} Welch-Satterthwaite degrees of freedom.
+  * `pValue` {number} Two-tailed p-value.
+  * `confidenceInterval` {Object}
+    * `lower` {number} Lower bound of the confidence interval on the
+      difference of means.
+    * `upper` {number} Upper bound.
+
+Performs [Welch's t-test][] comparing the means of this histogram and `other`.
+The p-value indicates the probability of observing a difference at least this
+extreme under the null hypothesis that the two distributions have the same
+mean. Both histograms must have at least 2 recorded values; otherwise the
+result has `pValue` 1 and `tStatistic` 0.
+
 ## Class: `ELDHistogram extends Histogram`
 
 A `Histogram` that records event loop delay, returned by
@@ -2288,6 +2473,32 @@ const violating = latency.ccdf(500_000_000);
 console.log(`${(violating * 100).toFixed(1)}% of requests violating SLO`);
 ```
 
+### SLO burn rate monitoring
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+// Track latency with EWMA (half-life 100 samples) and a 200ms SLO threshold
+const latency = createHistogram({
+  halfLife: 100,
+  threshold: 200_000_000,  // 200ms in nanoseconds
+});
+
+// Record request latencies...
+
+// Smoothed error rate: probability of exceeding the threshold
+console.log(`Error rate: ${(latency.ewmaErrorRate * 100).toFixed(2)}%`);
+
+// Burn rate against a 99.9% SLO
+// >1 means the error budget is depleting faster than allowed
+const rate = latency.burnRate(0.999);
+console.log(`Burn rate: ${rate.toFixed(2)}x`);
+
+// EWMA mean and stddev track the smoothed latency
+console.log(`EWMA latency: ${latency.ewmaMean.toFixed(0)}ns`);
+console.log(`EWMA stddev:  ${latency.ewmaStddev.toFixed(0)}ns`);
+```
+
 ### Regression detection with KS test
 
 ```js
@@ -2339,6 +2550,46 @@ newSnapshot.subtract(snapshot);
 console.log('Recent p99:', newSnapshot.percentile(99));
 ```
 
+### Benchmark comparison with Welch's t-test
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const baseline = createHistogram();
+const candidate = createHistogram();
+
+// Record operation rates from the old and new builds...
+
+const result = baseline.welchTest(candidate);
+const improvement = ((candidate.mean - baseline.mean) / baseline.mean * 100);
+
+console.log(`Improvement: ${improvement.toFixed(2)}%`);
+console.log(`p-value: ${result.pValue.toFixed(6)}`);
+console.log(`95% CI: [${result.confidenceInterval.lower.toFixed(2)}, ` +
+            `${result.confidenceInterval.upper.toFixed(2)}]`);
+
+if (result.pValue < 0.05) {
+  const d = baseline.cohensD(candidate);
+  console.log(`Statistically significant (Cohen's d = ${d.toFixed(4)})`);
+}
+```
+
+### Effect size with Cliff's delta
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const before = createHistogram();
+const after = createHistogram();
+
+// Record latencies before and after a change...
+
+const delta = before.cliffsD(after);
+// A delta > 0: before tends to produce larger values (improvement)
+// A delta < 0: after tends to produce larger values (regression)
+console.log(`Cliff's delta: ${delta.toFixed(4)}`);
+```
+
 ## Examples
 
 ### Measuring the duration of async operations
@@ -2593,13 +2844,17 @@ dns.promises.resolve('localhost');
 ```
 
 [Async Hooks]: async_hooks.md
+[Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Cliff's_delta
+[Cohen's d]: https://en.wikipedia.org/wiki/Effect_size#Cohen's_d
 [Fetch Response Body Info]: https://fetch.spec.whatwg.org/#response-body-info
 [Fetch Timing Info]: https://fetch.spec.whatwg.org/#fetch-timing-info
 [High Resolution Time]: https://www.w3.org/TR/hr-time-2
+[Mann-Whitney U test]: https://en.wikipedia.org/wiki/Mann%E2%80%93Whitney_U_test
 [Performance Timeline]: https://w3c.github.io/performance-timeline/
 [Resource Timing]: https://www.w3.org/TR/resource-timing-2/
 [User Timing]: https://www.w3.org/TR/user-timing/
 [Web Performance APIs]: https://w3c.github.io/perf-timing-primer/
+[Welch's t-test]: https://en.wikipedia.org/wiki/Welch%27s_t-test
 [Worker threads]: worker_threads.md#worker-threads
 [`'exit'`]: process.md#event-exit
 [`child_process.spawnSync()`]: child_process.md#child_processspawnsynccommand-args-options
diff --git a/lib/internal/histogram.js b/lib/internal/histogram.js
index c16c894dd147..952f6058019f 100644
--- a/lib/internal/histogram.js
+++ b/lib/internal/histogram.js
@@ -213,6 +213,67 @@ class Histogram {
     return this[kHandle]?.exceedsBigInt();
   }
 
+  /**
+   * Returns the exponentially weighted moving average of recorded values.
+   * Only active when the histogram was created with a `halfLife` option.
+   * Returns 0 when EWMA is not enabled or no values have been recorded.
+   * @readonly
+   * @type {number}
+   */
+  get ewmaMean() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.ewmaMean();
+  }
+
+  /**
+   * Returns the exponentially weighted moving standard deviation.
+   * Only active when the histogram was created with a `halfLife` option.
+   * Returns 0 when EWMA is not enabled or no values have been recorded.
+   * @readonly
+   * @type {number}
+   */
+  get ewmaStddev() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.ewmaStddev();
+  }
+
+  /**
+   * Returns the EWMA-smoothed error rate: the probability of a recorded
+   * value exceeding the configured `threshold`. Only active when the
+   * histogram was created with both `halfLife` and `threshold` options.
+   * Returns 0 when not enabled or no values have been recorded.
+   * @readonly
+   * @type {number}
+   */
+  get ewmaErrorRate() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.ewmaErrorRate();
+  }
+
+  /**
+   * Returns the SLO burn rate: how fast the error budget is being consumed.
+   * A burn rate of 1 means the budget will be exactly exhausted over the
+   * SLO window. A burn rate of 10 means it is being consumed 10x faster.
+   * Requires `halfLife` and `threshold` to be configured.
+   * @param {number} sloTarget - The SLO target as a fraction (e.g. 0.999
+   *   for 99.9%).
+   * @returns {number}
+   */
+  burnRate(sloTarget) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateNumber(sloTarget, 'sloTarget');
+    if (NumberIsNaN(sloTarget) || sloTarget <= 0 || sloTarget >= 1)
+      throw new ERR_OUT_OF_RANGE('sloTarget', '> 0 && < 1', sloTarget);
+    const errorRate = this[kHandle]?.ewmaErrorRate();
+    if (errorRate === undefined) return undefined;
+    const errorBudget = 1 - sloTarget;
+    return errorRate / errorBudget;
+  }
+
   /**
    * Returns the Kolmogorov-Smirnov test statistic comparing this
    * histogram's distribution to another's. Returns a value between
@@ -228,6 +289,95 @@ class Histogram {
     return this[kHandle]?.ksTest(other[kHandle]);
   }
 
+  /**
+   * Performs Welch's t-test comparing this histogram to another.
+   * Returns an object with the t-statistic, degrees of freedom,
+   * two-tailed p-value, and confidence interval on the difference
+   * of means.
+   * @param {Histogram} other
+   * @param {{ confidence?: number }} [options]
+   * @returns {{ tStatistic: number, degreesOfFreedom: number,
+   *             pValue: number,
+   *             confidenceInterval: { lower: number, upper: number } }}
+   */
+  welchTest(other, options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    if (!isHistogram(other))
+      throw new ERR_INVALID_ARG_TYPE('other', 'Histogram', other);
+    validateObject(options, 'options');
+    const { confidence = 0.95 } = options;
+    validateNumber(confidence, 'options.confidence');
+    if (NumberIsNaN(confidence) || confidence <= 0 || confidence >= 1)
+      throw new ERR_OUT_OF_RANGE('options.confidence',
+                                 '> 0 && < 1', confidence);
+    const result = this[kHandle]?.welchTest(other[kHandle], confidence);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      tStatistic: result[0],
+      degreesOfFreedom: result[1],
+      pValue: result[2],
+      confidenceInterval: {
+        __proto__: null,
+        lower: result[3],
+        upper: result[4],
+      },
+    };
+  }
+
+  /**
+   * Performs a Mann-Whitney U test comparing this histogram to
+   * another. Returns an object with the U statistic, z-score,
+   * and two-tailed p-value (normal approximation).
+   * @param {Histogram} other
+   * @returns {{ uStatistic: number, zScore: number, pValue: number }}
+   */
+  mannWhitneyTest(other) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    if (!isHistogram(other))
+      throw new ERR_INVALID_ARG_TYPE('other', 'Histogram', other);
+    const result = this[kHandle]?.mannWhitneyTest(other[kHandle]);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      uStatistic: result[0],
+      zScore: result[1],
+      pValue: result[2],
+    };
+  }
+
+  /**
+   * Computes Cohen's d effect size comparing this histogram to
+   * another. Uses the pooled standard deviation. Positive values
+   * indicate this histogram has a higher mean.
+   * @param {Histogram} other
+   * @returns {number}
+   */
+  cohensD(other) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    if (!isHistogram(other))
+      throw new ERR_INVALID_ARG_TYPE('other', 'Histogram', other);
+    return this[kHandle]?.cohensD(other[kHandle]);
+  }
+
+  /**
+   * Computes Cliff's delta comparing this histogram to another.
+   * Returns a value between -1 and 1. Positive values indicate
+   * this histogram tends to produce larger values.
+   * @param {Histogram} other
+   * @returns {number}
+   */
+  cliffsD(other) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    if (!isHistogram(other))
+      throw new ERR_INVALID_ARG_TYPE('other', 'Histogram', other);
+    return this[kHandle]?.cliffsD(other[kHandle]);
+  }
+
   /**
    * Returns the excess kurtosis of the recorded values, a measure of
    * the heaviness of the distribution's tails. A positive value indicates
@@ -326,6 +476,36 @@ class Histogram {
     return this[kHandle]?.percentileBigInt(percentile);
   }
 
+  /**
+   * Returns a confidence interval for the given percentile using the
+   * exact binomial method. The result contains the point estimate and
+   * the lower/upper bounds of the interval.
+   * @param {number} percentile
+   * @param {{ confidence?: number }} [options]
+   * @returns {{ value: number, lower: number, upper: number }}
+   */
+  percentileCI(percentile, options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateNumber(percentile, 'percentile');
+    if (NumberIsNaN(percentile) || percentile <= 0 || percentile > 100)
+      throw new ERR_OUT_OF_RANGE('percentile', '> 0 && <= 100', percentile);
+    validateObject(options, 'options');
+    const { confidence = 0.95 } = options;
+    validateNumber(confidence, 'options.confidence');
+    if (NumberIsNaN(confidence) || confidence <= 0 || confidence >= 1)
+      throw new ERR_OUT_OF_RANGE('options.confidence',
+                                 '> 0 && < 1', confidence);
+    const result = this[kHandle]?.percentileCI(percentile, confidence);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      value: result[0],
+      lower: result[1],
+      upper: result[2],
+    };
+  }
+
   /**
    * @readonly
    * @type {Map<number,number>}
@@ -397,7 +577,7 @@ class Histogram {
   }
 
   toJSON() {
-    return {
+    const json = {
       count: this.count,
       min: this.min,
       max: this.max,
@@ -406,8 +586,12 @@ class Histogram {
       stddev: this.stddev,
       skewness: this.skewness,
       kurtosis: this.kurtosis,
+      ewmaMean: this.ewmaMean,
+      ewmaStddev: this.ewmaStddev,
+      ewmaErrorRate: this.ewmaErrorRate,
       percentiles: ObjectFromEntries(MapPrototypeEntries(this.percentiles)),
     };
+    return json;
   }
 }
 
@@ -538,7 +722,9 @@ function createRecordableHistogram(handle) {
  * @param {{
  *   lowest? : number,
  *   highest? : number,
- *   figures? : number
+ *   figures? : number,
+ *   halfLife? : number,
+ *   threshold? : number
  * }} [options]
  * @returns {RecordableHistogram}
  */
@@ -548,6 +734,8 @@ function createHistogram(options = kEmptyObject) {
     lowest = 1,
     highest = NumberMAX_SAFE_INTEGER,
     figures = 3,
+    halfLife = 0,
+    threshold = 0,
   } = options;
   if (typeof lowest !== 'bigint')
     validateInteger(lowest, 'options.lowest', 1, NumberMAX_SAFE_INTEGER);
@@ -558,7 +746,14 @@ function createHistogram(options = kEmptyObject) {
     throw new ERR_INVALID_ARG_VALUE.RangeError('options.highest', highest);
   }
   validateInteger(figures, 'options.figures', 1, 5);
-  return createRecordableHistogram(new _Histogram(lowest, highest, figures));
+  validateNumber(halfLife, 'options.halfLife');
+  if (halfLife < 0)
+    throw new ERR_OUT_OF_RANGE('options.halfLife', '>= 0', halfLife);
+  validateNumber(threshold, 'options.threshold');
+  if (threshold < 0)
+    throw new ERR_OUT_OF_RANGE('options.threshold', '>= 0', threshold);
+  return createRecordableHistogram(
+    new _Histogram(lowest, highest, figures, halfLife, threshold));
 }
 
 module.exports = {
diff --git a/src/histogram-inl.h b/src/histogram-inl.h
index 7c3545f53aad..eea0e89bef11 100644
--- a/src/histogram-inl.h
+++ b/src/histogram-inl.h
@@ -9,11 +9,39 @@
 
 namespace node {
 
+void Histogram::UpdateEwma(double value) {
+  // Called inside a write lock. No-op when EWMA is disabled.
+  if (ewma_alpha_ <= 0) return;
+  if (!ewma_initialized_) {
+    ewma_mean_ = value;
+    ewma_variance_ = 0;
+    ewma_initialized_ = true;
+    if (threshold_ > 0) {
+      ewma_error_rate_ = (value > static_cast<double>(threshold_)) ? 1.0 : 0.0;
+    }
+    return;
+  }
+  double diff = value - ewma_mean_;
+  ewma_mean_ += ewma_alpha_ * diff;
+  ewma_variance_ =
+      (1.0 - ewma_alpha_) * (ewma_variance_ + ewma_alpha_ * diff * diff);
+
+  // Binary EWMA for SLO error rate: feed 1 if over threshold, 0 otherwise.
+  if (threshold_ > 0) {
+    double exceeded = (value > static_cast<double>(threshold_)) ? 1.0 : 0.0;
+    ewma_error_rate_ += ewma_alpha_ * (exceeded - ewma_error_rate_);
+  }
+}
+
 void Histogram::Reset() {
   RwLock::ScopedWriteLock lock(mutex_);
   hdr_reset(histogram_.get());
   exceeds_ = 0;
   prev_ = 0;
+  ewma_mean_ = 0;
+  ewma_variance_ = 0;
+  ewma_error_rate_ = 0;
+  ewma_initialized_ = false;
 }
 
 double Histogram::Add(const Histogram& other) {
@@ -74,6 +102,21 @@ double Histogram::Stddev() const {
   return hdr_stddev(histogram_.get());
 }
 
+double Histogram::EwmaMean() const {
+  RwLock::ScopedReadLock lock(mutex_);
+  return ewma_initialized_ ? ewma_mean_ : 0;
+}
+
+double Histogram::EwmaStddev() const {
+  RwLock::ScopedReadLock lock(mutex_);
+  return ewma_initialized_ ? std::sqrt(ewma_variance_) : 0;
+}
+
+double Histogram::EwmaErrorRate() const {
+  RwLock::ScopedReadLock lock(mutex_);
+  return ewma_initialized_ ? ewma_error_rate_ : 0;
+}
+
 int64_t Histogram::Percentile(double percentile) const {
   RwLock::ScopedReadLock lock(mutex_);
   CHECK_GT(percentile, 0);
@@ -101,14 +144,20 @@ bool Histogram::RecordCorrected(int64_t value, int64_t expected_interval) {
   RwLock::ScopedWriteLock lock(mutex_);
   bool recorded =
       hdr_record_corrected_value(histogram_.get(), value, expected_interval);
-  if (!recorded) exceeds_++;
+  if (!recorded)
+    exceeds_++;
+  else
+    UpdateEwma(static_cast<double>(value));
   return recorded;
 }
 
 bool Histogram::Record(int64_t value) {
   RwLock::ScopedWriteLock lock(mutex_);
   bool recorded = hdr_record_value(histogram_.get(), value);
-  if (!recorded) exceeds_++;
+  if (!recorded)
+    exceeds_++;
+  else
+    UpdateEwma(static_cast<double>(value));
   return recorded;
 }
 
@@ -119,7 +168,10 @@ uint64_t Histogram::RecordDelta() {
   if (prev_ > 0) {
     CHECK_GE(time, prev_);
     delta = time - prev_;
-    if (!hdr_record_value(histogram_.get(), delta)) exceeds_++;
+    if (!hdr_record_value(histogram_.get(), delta))
+      exceeds_++;
+    else
+      UpdateEwma(static_cast<double>(delta));
   }
   prev_ = time;
   return delta;
diff --git a/src/histogram.cc b/src/histogram.cc
index 3aa451685e86..0997d3cb481c 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -6,14 +6,19 @@
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "util.h"
+#include "v8-typed-array.h"
 
+#include <cmath>
+#include <numbers>
 #include <vector>
 
 namespace node {
 
+using v8::Array;
 using v8::BigInt;
 using v8::CFunction;
 using v8::Context;
+using v8::Float64Array;
 using v8::FunctionCallbackInfo;
 using v8::FunctionTemplate;
 using v8::Integer;
@@ -48,6 +53,12 @@ Histogram::Histogram(const Options& options) {
                        options.figures,
                        &histogram));
   histogram_.reset(histogram);
+
+  // alpha = 1 - 2^(-1/halfLife). With halfLife <= 0, EWMA is disabled.
+  if (options.half_life > 0) {
+    ewma_alpha_ = 1.0 - std::exp(-std::log(2.0) / options.half_life);
+  }
+  threshold_ = options.threshold;
 }
 
 void Histogram::MemoryInfo(MemoryTracker* tracker) const {
@@ -217,6 +228,368 @@ void Histogram::PercentilesAt(const double* percentiles,
   hdr_value_at_percentiles(histogram_.get(), percentiles, values, length);
 }
 
+namespace {
+// Continued fraction evaluation for the regularized incomplete beta
+// function using Lentz's modified method. Reference: Numerical Recipes
+// in C, 2nd edition, section 6.4.
+static double BetaContinuedFraction(double a, double b, double x) {
+  constexpr double FPMIN = 1e-30;
+  constexpr int MAXIT = 200;
+  constexpr double EPS = 3e-12;
+
+  double qab = a + b;
+  double qap = a + 1.0;
+  double qam = a - 1.0;
+  double c = 1.0;
+  double d = 1.0 - qab * x / qap;
+  if (std::fabs(d) < FPMIN) d = FPMIN;
+  d = 1.0 / d;
+  double h = d;
+
+  for (int m = 1; m <= MAXIT; m++) {
+    int m2 = 2 * m;
+    // Even step.
+    double aa = m * (b - m) * x / ((qam + m2) * (a + m2));
+    d = 1.0 + aa * d;
+    if (std::fabs(d) < FPMIN) d = FPMIN;
+    c = 1.0 + aa / c;
+    if (std::fabs(c) < FPMIN) c = FPMIN;
+    d = 1.0 / d;
+    h *= d * c;
+    // Odd step.
+    aa = -(a + m) * (qab + m) * x / ((a + m2) * (qap + m2));
+    d = 1.0 + aa * d;
+    if (std::fabs(d) < FPMIN) d = FPMIN;
+    c = 1.0 + aa / c;
+    if (std::fabs(c) < FPMIN) c = FPMIN;
+    d = 1.0 / d;
+    double del = d * c;
+    h *= del;
+    if (std::fabs(del - 1.0) <= EPS) break;
+  }
+  return h;
+}
+
+// Regularized incomplete beta function I_x(a, b).
+// Returns the probability that a Beta(a,b) random variable is <= x.
+static double RegularizedIncompleteBeta(double a, double b, double x) {
+  if (x <= 0.0) return 0.0;
+  if (x >= 1.0) return 1.0;
+
+  double ln_front = std::lgamma(a + b) - std::lgamma(a) - std::lgamma(b) +
+                    a * std::log(x) + b * std::log(1.0 - x);
+  double bt = std::exp(ln_front);
+
+  // Use the symmetry relation to ensure the continued fraction
+  // converges in the region where it is most accurate.
+  if (x < (a + 1.0) / (a + b + 2.0)) {
+    return bt * BetaContinuedFraction(a, b, x) / a;
+  }
+  return 1.0 - bt * BetaContinuedFraction(b, a, 1.0 - x) / b;
+}
+
+// Standard normal CDF: Phi(x) = P(Z <= x).
+static double NormalCdf(double x) {
+  return 0.5 * std::erfc(-x * std::numbers::sqrt2 / 2.0);
+}
+
+// Student's t-distribution CDF: P(T <= t) for df degrees of freedom.
+static double StudentTCdf(double t, double df) {
+  double x = df / (df + t * t);
+  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
+  if (t >= 0.0) {
+    return 1.0 - 0.5 * ibeta;
+  }
+  return 0.5 * ibeta;
+}
+
+// Student's t-distribution quantile (inverse CDF) using bisection.
+// Returns the value t such that P(T <= t) = p.
+static double StudentTQuantile(double p, double df) {
+  if (p <= 0.0) return -std::numeric_limits<double>::infinity();
+  if (p >= 1.0) return std::numeric_limits<double>::infinity();
+  if (p == 0.5) return 0.0;
+
+  // Bisection search. The range [-1e6, 1e6] is sufficient for any
+  // practical confidence level and degrees of freedom.
+  double lo = -1e6;
+  double hi = 1e6;
+  for (int i = 0; i < 100; i++) {
+    double mid = (lo + hi) / 2.0;
+    if (StudentTCdf(mid, df) < p) {
+      lo = mid;
+    } else {
+      hi = mid;
+    }
+  }
+  return (lo + hi) / 2.0;
+}
+
+// Binomial CDF: P(X <= k) for X ~ Binomial(n, p).
+// Uses the identity P(X <= k) = I_{1-p}(n-k, k+1).
+static double BinomialCdf(int64_t k, int64_t n, double p) {
+  if (k < 0) return 0.0;
+  if (k >= n) return 1.0;
+  return RegularizedIncompleteBeta(
+      static_cast<double>(n - k), static_cast<double>(k + 1), 1.0 - p);
+}
+}  // namespace
+
+Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
+                                                double confidence) const {
+  auto do_welch = [&]() -> WelchTestResult {
+    int64_t n1 = histogram_->total_count;
+    int64_t n2 = other.histogram_->total_count;
+    if (n1 < 2 || n2 < 2) return {0, 0, 1, 0, 0};
+
+    double mean1 = hdr_mean(histogram_.get());
+    double mean2 = hdr_mean(other.histogram_.get());
+    double sd1 = hdr_stddev(histogram_.get());
+    double sd2 = hdr_stddev(other.histogram_.get());
+
+    // HdrHistogram computes population stddev (divides by N).
+    // Welch's t-test requires sample variance (divides by N-1).
+    double var1 =
+        sd1 * sd1 * static_cast<double>(n1) / static_cast<double>(n1 - 1);
+    double var2 =
+        sd2 * sd2 * static_cast<double>(n2) / static_cast<double>(n2 - 1);
+
+    double se1 = var1 / static_cast<double>(n1);
+    double se2 = var2 / static_cast<double>(n2);
+    double se_sum = se1 + se2;
+    if (se_sum == 0.0) return {0, 0, 1, 0, 0};
+
+    double t = (mean1 - mean2) / std::sqrt(se_sum);
+
+    // Welch-Satterthwaite degrees of freedom.
+    double df = (se_sum * se_sum) / (se1 * se1 / static_cast<double>(n1 - 1) +
+                                     se2 * se2 / static_cast<double>(n2 - 1));
+
+    // Two-tailed p-value.
+    double p = 2.0 * StudentTCdf(-std::fabs(t), df);
+
+    // Confidence interval on the difference of means.
+    double alpha = 1.0 - confidence;
+    double t_crit = StudentTQuantile(1.0 - alpha / 2.0, df);
+    double margin = t_crit * std::sqrt(se_sum);
+    double diff = mean1 - mean2;
+
+    return {t, df, p, diff - margin, diff + margin};
+  };
+
+  if (this == &other) return {0, 0, 1, 0, 0};
+
+  if (this < &other) {
+    RwLock::ScopedReadLock lock1(mutex_);
+    RwLock::ScopedReadLock lock2(other.mutex_);
+    return do_welch();
+  }
+
+  RwLock::ScopedReadLock lock1(other.mutex_);
+  RwLock::ScopedReadLock lock2(mutex_);
+  return do_welch();
+}
+
+Histogram::MannWhitneyResult Histogram::MannWhitneyTest(
+    const Histogram& other) const {
+  auto do_mw = [&]() -> MannWhitneyResult {
+    int64_t n1 = histogram_->total_count;
+    int64_t n2 = other.histogram_->total_count;
+    if (n1 == 0 || n2 == 0) return {0, 0, 1};
+
+    // Walk the counts arrays to compute the U statistic.
+    // At each bucket index, values from histogram 1 at index i "beat"
+    // all values from histogram 2 at indices < i (concordant pairs).
+    int32_t len =
+        std::max(histogram_->counts_len, other.histogram_->counts_len);
+
+    // Forward pass: count concordant pairs (h1 values > h2 values).
+    int64_t cum2 = 0;
+    double concordant = 0.0;
+    double tied = 0.0;
+    for (int32_t i = 0; i < len; i++) {
+      int64_t c1 = (i < histogram_->counts_len) ? histogram_->counts[i] : 0;
+      int64_t c2 =
+          (i < other.histogram_->counts_len) ? other.histogram_->counts[i] : 0;
+      concordant += static_cast<double>(c1) * static_cast<double>(cum2);
+      tied += static_cast<double>(c1) * static_cast<double>(c2);
+      cum2 += c2;
+    }
+
+    // U statistic for sample 1: concordant + half of ties.
+    double u = concordant + 0.5 * tied;
+    double dn1 = static_cast<double>(n1);
+    double dn2 = static_cast<double>(n2);
+    double mu = dn1 * dn2 / 2.0;
+
+    // Tie correction for the variance.
+    // sigma^2 = n1*n2/12 * (N+1 - sum(t_k^3 - t_k) / (N*(N-1)))
+    // where t_k is the number of observations tied at rank k.
+    double n_total = dn1 + dn2;
+    double tie_correction = 0.0;
+    for (int32_t i = 0; i < len; i++) {
+      int64_t c1 = (i < histogram_->counts_len) ? histogram_->counts[i] : 0;
+      int64_t c2 =
+          (i < other.histogram_->counts_len) ? other.histogram_->counts[i] : 0;
+      double tk = static_cast<double>(c1 + c2);
+      if (tk > 1) {
+        tie_correction += tk * tk * tk - tk;
+      }
+    }
+
+    double sigma_sq =
+        (dn1 * dn2 / 12.0) *
+        (n_total + 1.0 - tie_correction / (n_total * (n_total - 1.0)));
+    if (sigma_sq <= 0.0) return {u, 0, 1};
+
+    // Continuity-corrected z-score.
+    double z = (u - mu) / std::sqrt(sigma_sq);
+    // Two-tailed p-value using normal approximation.
+    double p = 2.0 * NormalCdf(-std::fabs(z));
+
+    return {u, z, p};
+  };
+
+  if (this == &other) return {0, 0, 1};
+
+  if (this < &other) {
+    RwLock::ScopedReadLock lock1(mutex_);
+    RwLock::ScopedReadLock lock2(other.mutex_);
+    return do_mw();
+  }
+
+  RwLock::ScopedReadLock lock1(other.mutex_);
+  RwLock::ScopedReadLock lock2(mutex_);
+  return do_mw();
+}
+
+double Histogram::CohensD(const Histogram& other) const {
+  auto do_cohens = [&]() -> double {
+    int64_t n1 = histogram_->total_count;
+    int64_t n2 = other.histogram_->total_count;
+    if (n1 < 2 || n2 < 2) return 0.0;
+
+    double mean1 = hdr_mean(histogram_.get());
+    double mean2 = hdr_mean(other.histogram_.get());
+    double sd1 = hdr_stddev(histogram_.get());
+    double sd2 = hdr_stddev(other.histogram_.get());
+
+    // Convert population variance to sample variance (Bessel's correction).
+    double var1 =
+        sd1 * sd1 * static_cast<double>(n1) / static_cast<double>(n1 - 1);
+    double var2 =
+        sd2 * sd2 * static_cast<double>(n2) / static_cast<double>(n2 - 1);
+
+    double pooled_sd = std::sqrt((static_cast<double>(n1 - 1) * var1 +
+                                  static_cast<double>(n2 - 1) * var2) /
+                                 static_cast<double>(n1 + n2 - 2));
+    if (pooled_sd == 0.0) return 0.0;
+
+    return (mean1 - mean2) / pooled_sd;
+  };
+
+  if (this == &other) return 0.0;
+
+  if (this < &other) {
+    RwLock::ScopedReadLock lock1(mutex_);
+    RwLock::ScopedReadLock lock2(other.mutex_);
+    return do_cohens();
+  }
+
+  RwLock::ScopedReadLock lock1(other.mutex_);
+  RwLock::ScopedReadLock lock2(mutex_);
+  return do_cohens();
+}
+
+double Histogram::CliffsD(const Histogram& other) const {
+  auto do_cliffs = [&]() -> double {
+    int64_t n1 = histogram_->total_count;
+    int64_t n2 = other.histogram_->total_count;
+    if (n1 == 0 || n2 == 0) return 0.0;
+
+    int32_t len =
+        std::max(histogram_->counts_len, other.histogram_->counts_len);
+
+    // Forward pass: count pairs where h1 value > h2 value (concordant).
+    int64_t cum2 = 0;
+    double concordant = 0.0;
+    double tied = 0.0;
+    for (int32_t i = 0; i < len; i++) {
+      int64_t c1 = (i < histogram_->counts_len) ? histogram_->counts[i] : 0;
+      int64_t c2 =
+          (i < other.histogram_->counts_len) ? other.histogram_->counts[i] : 0;
+      concordant += static_cast<double>(c1) * static_cast<double>(cum2);
+      tied += static_cast<double>(c1) * static_cast<double>(c2);
+      cum2 += c2;
+    }
+
+    double discordant =
+        static_cast<double>(n1) * static_cast<double>(n2) - concordant - tied;
+
+    return (concordant - discordant) /
+           (static_cast<double>(n1) * static_cast<double>(n2));
+  };
+
+  if (this == &other) return 0.0;
+
+  if (this < &other) {
+    RwLock::ScopedReadLock lock1(mutex_);
+    RwLock::ScopedReadLock lock2(other.mutex_);
+    return do_cliffs();
+  }
+
+  RwLock::ScopedReadLock lock1(other.mutex_);
+  RwLock::ScopedReadLock lock2(mutex_);
+  return do_cliffs();
+}
+
+Histogram::PercentileCIResult Histogram::PercentileCI(double percentile,
+                                                      double confidence) const {
+  RwLock::ScopedReadLock lock(mutex_);
+
+  int64_t value = hdr_value_at_percentile(histogram_.get(), percentile);
+  int64_t n = histogram_->total_count;
+
+  if (n < 2) {
+    return {value, value, value};
+  }
+
+  double p = percentile / 100.0;
+  double alpha = 1.0 - confidence;
+
+  // Lower rank: largest j such that BinomialCdf(j-1, n, p) <= alpha/2.
+  // Binary search over [0, n].
+  int64_t lo = 0;
+  int64_t hi = n;
+  while (lo < hi) {
+    int64_t mid = lo + (hi - lo + 1) / 2;
+    if (BinomialCdf(mid - 1, n, p) <= alpha / 2.0) {
+      lo = mid;
+    } else {
+      hi = mid - 1;
+    }
+  }
+  double lower_pct = static_cast<double>(lo) / static_cast<double>(n) * 100.0;
+
+  // Upper rank: smallest k such that BinomialCdf(k-1, n, p) >= 1 - alpha/2.
+  lo = 0;
+  hi = n;
+  while (lo < hi) {
+    int64_t mid = lo + (hi - lo) / 2;
+    if (BinomialCdf(mid - 1, n, p) >= 1.0 - alpha / 2.0) {
+      hi = mid;
+    } else {
+      lo = mid + 1;
+    }
+  }
+  double upper_pct = static_cast<double>(lo) / static_cast<double>(n) * 100.0;
+
+  int64_t lower_val = hdr_value_at_percentile(histogram_.get(), lower_pct);
+  int64_t upper_val = hdr_value_at_percentile(histogram_.get(), upper_pct);
+
+  return {value, lower_val, upper_val};
+}
+
 HistogramImpl::HistogramImpl(const Histogram::Options& options)
     : histogram_(new Histogram(options)) {}
 
@@ -247,6 +620,12 @@ CFunction HistogramImpl::fast_get_cdf_(
     CFunction::Make(&HistogramImpl::FastGetCdf));
 CFunction HistogramImpl::fast_get_count_at_(
     CFunction::Make(&HistogramImpl::FastGetCountAt));
+CFunction HistogramImpl::fast_get_ewma_mean_(
+    CFunction::Make(&HistogramImpl::FastGetEwmaMean));
+CFunction HistogramImpl::fast_get_ewma_stddev_(
+    CFunction::Make(&HistogramImpl::FastGetEwmaStddev));
+CFunction HistogramImpl::fast_get_ewma_error_rate_(
+    CFunction::Make(&HistogramImpl::FastGetEwmaErrorRate));
 CFunction HistogramBase::fast_record_(
     CFunction::Make(&HistogramBase::FastRecord));
 CFunction HistogramBase::fast_record_delta_(
@@ -296,6 +675,21 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
   SetProtoMethodNoSideEffect(isolate, tmpl, "percentilesAt", GetPercentilesAt);
   SetProtoMethodNoSideEffect(isolate, tmpl, "linearBuckets", GetLinearBuckets);
   SetProtoMethodNoSideEffect(isolate, tmpl, "logBuckets", GetLogBuckets);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "welchTest", GetWelchTest);
+  SetProtoMethodNoSideEffect(
+      isolate, tmpl, "mannWhitneyTest", GetMannWhitneyTest);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "cohensD", GetCohensD);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "cliffsD", GetCliffsD);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "percentileCI", GetPercentileCI);
+  SetFastMethodNoSideEffect(
+      isolate, instance, "ewmaMean", GetEwmaMean, &fast_get_ewma_mean_);
+  SetFastMethodNoSideEffect(
+      isolate, instance, "ewmaStddev", GetEwmaStddev, &fast_get_ewma_stddev_);
+  SetFastMethodNoSideEffect(isolate,
+                            instance,
+                            "ewmaErrorRate",
+                            GetEwmaErrorRate,
+                            &fast_get_ewma_error_rate_);
   SetFastMethod(isolate, instance, "reset", DoReset, &fast_reset_);
 }
 
@@ -334,6 +728,17 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetPercentilesAt);
   registry->Register(GetLinearBuckets);
   registry->Register(GetLogBuckets);
+  registry->Register(GetWelchTest);
+  registry->Register(GetMannWhitneyTest);
+  registry->Register(GetCohensD);
+  registry->Register(GetCliffsD);
+  registry->Register(GetPercentileCI);
+  registry->Register(GetEwmaMean);
+  registry->Register(GetEwmaStddev);
+  registry->Register(GetEwmaErrorRate);
+  registry->Register(fast_get_ewma_mean_);
+  registry->Register(fast_get_ewma_stddev_);
+  registry->Register(fast_get_ewma_error_rate_);
   registry->Register(fast_get_skewness_);
   registry->Register(fast_get_kurtosis_);
   registry->Register(fast_get_cdf_);
@@ -509,9 +914,18 @@ void HistogramBase::New(const FunctionCallbackInfo<Value>& args) {
   }
 
   int32_t figures = args[2].As<Uint32>()->Value();
-  new HistogramBase(env, args.This(), Histogram::Options {
-    lowest, highest, figures
-  });
+  double half_life = 0;
+  if (args.Length() > 3 && args[3]->IsNumber()) {
+    half_life = args[3].As<Number>()->Value();
+  }
+  int64_t threshold = 0;
+  if (args.Length() > 4 && args[4]->IsNumber()) {
+    threshold = static_cast<int64_t>(args[4].As<Number>()->Value());
+  }
+  new HistogramBase(
+      env,
+      args.This(),
+      Histogram::Options{lowest, highest, figures, half_life, threshold});
 }
 
 Local<FunctionTemplate> HistogramBase::GetConstructorTemplate(
@@ -1018,13 +1432,109 @@ void HistogramImpl::GetKsTest(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set((*histogram)->KsTest(*(other->histogram())));
 }
 
+void HistogramImpl::GetWelchTest(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  HistogramImpl* other = HistogramImpl::FromJSObject(args[0]);
+  CHECK(args[1]->IsNumber());
+  double confidence = args[1].As<Number>()->Value();
+
+  auto result = (*histogram)->WelchTest(*(other->histogram()), confidence);
+
+  Local<Value> values[] = {Number::New(isolate, result.t_statistic),
+                           Number::New(isolate, result.degrees_of_freedom),
+                           Number::New(isolate, result.p_value),
+                           Number::New(isolate, result.ci_lower),
+                           Number::New(isolate, result.ci_upper)};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
+void HistogramImpl::GetMannWhitneyTest(
+    const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  HistogramImpl* other = HistogramImpl::FromJSObject(args[0]);
+
+  auto result = (*histogram)->MannWhitneyTest(*(other->histogram()));
+
+  Local<Value> values[] = {Number::New(isolate, result.u_statistic),
+                           Number::New(isolate, result.z_score),
+                           Number::New(isolate, result.p_value)};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
+void HistogramImpl::GetCohensD(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  HistogramImpl* other = HistogramImpl::FromJSObject(args[0]);
+  args.GetReturnValue().Set((*histogram)->CohensD(*(other->histogram())));
+}
+
+void HistogramImpl::GetCliffsD(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  HistogramImpl* other = HistogramImpl::FromJSObject(args[0]);
+  args.GetReturnValue().Set((*histogram)->CliffsD(*(other->histogram())));
+}
+
+void HistogramImpl::GetPercentileCI(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  CHECK(args[1]->IsNumber());
+  double percentile = args[0].As<Number>()->Value();
+  double confidence = args[1].As<Number>()->Value();
+
+  auto result = (*histogram)->PercentileCI(percentile, confidence);
+
+  Local<Value> values[] = {
+      Number::New(isolate, static_cast<double>(result.value)),
+      Number::New(isolate, static_cast<double>(result.lower)),
+      Number::New(isolate, static_cast<double>(result.upper))};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
+void HistogramImpl::GetEwmaMean(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  args.GetReturnValue().Set((*histogram)->EwmaMean());
+}
+
+double HistogramImpl::FastGetEwmaMean(Local<Value> receiver) {
+  TRACK_V8_FAST_API_CALL("histogram.ewmaMean");
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(receiver);
+  return (*histogram)->EwmaMean();
+}
+
+void HistogramImpl::GetEwmaStddev(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  args.GetReturnValue().Set((*histogram)->EwmaStddev());
+}
+
+double HistogramImpl::FastGetEwmaStddev(Local<Value> receiver) {
+  TRACK_V8_FAST_API_CALL("histogram.ewmaStddev");
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(receiver);
+  return (*histogram)->EwmaStddev();
+}
+
+void HistogramImpl::GetEwmaErrorRate(const FunctionCallbackInfo<Value>& args) {
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  args.GetReturnValue().Set((*histogram)->EwmaErrorRate());
+}
+
+double HistogramImpl::FastGetEwmaErrorRate(Local<Value> receiver) {
+  TRACK_V8_FAST_API_CALL("histogram.ewmaErrorRate");
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(receiver);
+  return (*histogram)->EwmaErrorRate();
+}
+
 void HistogramImpl::GetPercentilesAt(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
   CHECK(args[0]->IsMap());
   Local<Map> map = args[0].As<Map>();
   CHECK(args[1]->IsFloat64Array());
-  Local<v8::Float64Array> input = args[1].As<v8::Float64Array>();
+  Local<Float64Array> input = args[1].As<Float64Array>();
   size_t length = input->Length();
   auto backing = input->Buffer()->GetBackingStore();
   double* percentiles = reinterpret_cast<double*>(
diff --git a/src/histogram.h b/src/histogram.h
index 5fbffa2a4879..31a2e9833d3e 100644
--- a/src/histogram.h
+++ b/src/histogram.h
@@ -30,6 +30,10 @@ class Histogram : public MemoryRetainer {
     int64_t lowest = 1;
     int64_t highest = std::numeric_limits<int64_t>::max();
     int figures = kDefaultHistogramFigures;
+    double half_life = 0;   // EWMA half-life in number of samples (0 = off)
+    int64_t threshold = 0;  // SLO threshold (0 = off). When set with
+                            // half_life, tracks EWMA error rate for values
+                            // exceeding this threshold.
   };
 
   explicit Histogram(const Options& options);
@@ -41,6 +45,9 @@ class Histogram : public MemoryRetainer {
   inline int64_t Max() const;
   inline double Mean() const;
   inline double Stddev() const;
+  inline double EwmaMean() const;
+  inline double EwmaStddev() const;
+  inline double EwmaErrorRate() const;
   inline int64_t Percentile(double percentile) const;
   inline size_t Exceeds() const;
   inline size_t Count() const;
@@ -67,6 +74,35 @@ class Histogram : public MemoryRetainer {
                      int64_t* values,
                      size_t length) const;
 
+  // Statistical hypothesis testing
+  struct WelchTestResult {
+    double t_statistic;
+    double degrees_of_freedom;
+    double p_value;
+    double ci_lower;
+    double ci_upper;
+  };
+
+  struct MannWhitneyResult {
+    double u_statistic;
+    double z_score;
+    double p_value;
+  };
+
+  struct PercentileCIResult {
+    int64_t value;
+    int64_t lower;
+    int64_t upper;
+  };
+
+  WelchTestResult WelchTest(const Histogram& other,
+                            double confidence = 0.95) const;
+  MannWhitneyResult MannWhitneyTest(const Histogram& other) const;
+  double CohensD(const Histogram& other) const;
+  double CliffsD(const Histogram& other) const;
+  PercentileCIResult PercentileCI(double percentile,
+                                  double confidence = 0.95) const;
+
   inline bool RecordCorrected(int64_t value, int64_t expected_interval);
 
   template <typename Iterator>
@@ -82,10 +118,23 @@ class Histogram : public MemoryRetainer {
   SET_SELF_SIZE(Histogram)
 
  private:
+  inline void UpdateEwma(double value);
+
   using HistogramPointer = DeleteFnPtr<hdr_histogram, hdr_close>;
   HistogramPointer histogram_;
   uint64_t prev_ = 0;
   size_t exceeds_ = 0;
+
+  // EWMA state (active when ewma_alpha_ > 0)
+  double ewma_alpha_ = 0;
+  double ewma_mean_ = 0;
+  double ewma_variance_ = 0;
+  bool ewma_initialized_ = false;
+
+  // SLO error rate EWMA (active when threshold_ > 0 and ewma_alpha_ > 0)
+  int64_t threshold_ = 0;
+  double ewma_error_rate_ = 0;
+
   RwLock mutex_;
 };
 
@@ -131,6 +180,15 @@ class HistogramImpl {
   static void GetPercentilesAt(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLinearBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLogBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetWelchTest(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMannWhitneyTest(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCohensD(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCliffsD(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetPercentileCI(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetEwmaMean(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetEwmaStddev(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetEwmaErrorRate(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void FastReset(v8::Local<v8::Value> receiver);
   static double FastGetCount(v8::Local<v8::Value> receiver);
@@ -146,6 +204,9 @@ class HistogramImpl {
   static double FastGetCdf(v8::Local<v8::Value> receiver, const int64_t value);
   static double FastGetCountAt(v8::Local<v8::Value> receiver,
                                const int64_t value);
+  static double FastGetEwmaMean(v8::Local<v8::Value> receiver);
+  static double FastGetEwmaStddev(v8::Local<v8::Value> receiver);
+  static double FastGetEwmaErrorRate(v8::Local<v8::Value> receiver);
 
   static void AddMethods(v8::Isolate* isolate,
                          v8::Local<v8::FunctionTemplate> tmpl);
@@ -169,6 +230,9 @@ class HistogramImpl {
   static v8::CFunction fast_get_kurtosis_;
   static v8::CFunction fast_get_cdf_;
   static v8::CFunction fast_get_count_at_;
+  static v8::CFunction fast_get_ewma_mean_;
+  static v8::CFunction fast_get_ewma_stddev_;
+  static v8::CFunction fast_get_ewma_error_rate_;
 };
 
 class HistogramBase final : public BaseObject, public HistogramImpl {
diff --git a/test/parallel/test-perf-hooks-histogram-stats.js b/test/parallel/test-perf-hooks-histogram-stats.js
new file mode 100644
index 000000000000..9b05a1061682
--- /dev/null
+++ b/test/parallel/test-perf-hooks-histogram-stats.js
@@ -0,0 +1,561 @@
+// Flags: --expose-internals --no-warnings
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { createHistogram } = require('perf_hooks');
+
+// ---------------------------------------------------------------------------
+// welchTest(other) — Welch's t-test
+// ---------------------------------------------------------------------------
+{
+  const h1 = createHistogram();
+  const h2 = createHistogram();
+
+  // Both empty → p-value 1 (no evidence of difference)
+  const empty = h1.welchTest(h2);
+  assert.strictEqual(empty.pValue, 1);
+  assert.strictEqual(empty.tStatistic, 0);
+
+  // Identical distributions → high p-value (not significant)
+  for (let i = 0; i < 100; i++) {
+    h1.record(50 + Math.ceil(Math.random() * 10));
+    h2.record(50 + Math.ceil(Math.random() * 10));
+  }
+  const identical = h1.welchTest(h2);
+  assert.strictEqual(typeof identical.tStatistic, 'number');
+  assert.strictEqual(typeof identical.degreesOfFreedom, 'number');
+  assert.strictEqual(typeof identical.pValue, 'number');
+  assert.ok(identical.pValue >= 0 && identical.pValue <= 1);
+  assert.ok(identical.degreesOfFreedom > 0);
+  assert.strictEqual(typeof identical.confidenceInterval.lower, 'number');
+  assert.strictEqual(typeof identical.confidenceInterval.upper, 'number');
+  assert.ok(identical.confidenceInterval.lower <=
+            identical.confidenceInterval.upper);
+
+  // Very different distributions → low p-value (significant)
+  const hLow = createHistogram();
+  const hHigh = createHistogram();
+  for (let i = 0; i < 200; i++) hLow.record(10 + Math.ceil(Math.random() * 5));
+  for (let i = 0; i < 200; i++) {
+    hHigh.record(1000 + Math.ceil(Math.random() * 5));
+  }
+  const different = hLow.welchTest(hHigh);
+  assert.ok(different.pValue < 0.001,
+            `Expected p < 0.001, got ${different.pValue}`);
+  assert.ok(different.tStatistic < 0, 'hLow mean < hHigh mean → negative t');
+
+  // Confidence interval should not contain 0 when significant
+  assert.ok(different.confidenceInterval.upper < 0 ||
+            different.confidenceInterval.lower > 0);
+
+  // Same histogram → p-value 1
+  const self = hLow.welchTest(hLow);
+  assert.strictEqual(self.pValue, 1);
+
+  // Custom confidence level
+  const ci90 = hLow.welchTest(hHigh, { confidence: 0.90 });
+  const ci99 = hLow.welchTest(hHigh, { confidence: 0.99 });
+  // 99% CI should be wider than 90% CI
+  const width90 = ci90.confidenceInterval.upper -
+                  ci90.confidenceInterval.lower;
+  const width99 = ci99.confidenceInterval.upper -
+                  ci99.confidenceInterval.lower;
+  assert.ok(width99 > width90);
+
+  // Validation
+  assert.throws(() => h1.welchTest('not a histogram'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h1.welchTest(h2, { confidence: 0 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h1.welchTest(h2, { confidence: 1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h1.welchTest(h2, { confidence: 'high' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// mannWhitneyTest(other) — Mann-Whitney U test
+// ---------------------------------------------------------------------------
+{
+  const h1 = createHistogram();
+  const h2 = createHistogram();
+
+  // Both empty → p-value 1
+  const empty = h1.mannWhitneyTest(h2);
+  assert.strictEqual(empty.pValue, 1);
+  assert.strictEqual(empty.uStatistic, 0);
+  assert.strictEqual(empty.zScore, 0);
+
+  // Very different distributions → significant
+  const hLow = createHistogram();
+  const hHigh = createHistogram();
+  for (let i = 0; i < 100; i++) hLow.record(1 + Math.ceil(Math.random() * 5));
+  for (let i = 0; i < 100; i++) {
+    hHigh.record(1000 + Math.ceil(Math.random() * 5));
+  }
+  const result = hLow.mannWhitneyTest(hHigh);
+  assert.strictEqual(typeof result.uStatistic, 'number');
+  assert.strictEqual(typeof result.zScore, 'number');
+  assert.strictEqual(typeof result.pValue, 'number');
+  assert.ok(result.pValue < 0.001,
+            `Expected p < 0.001, got ${result.pValue}`);
+
+  // Same histogram → p-value 1
+  const self = hLow.mannWhitneyTest(hLow);
+  assert.strictEqual(self.pValue, 1);
+
+  // Identical data → high p-value
+  const a = createHistogram();
+  const b = createHistogram();
+  for (let i = 1; i <= 50; i++) { a.record(i); b.record(i); }
+  const same = a.mannWhitneyTest(b);
+  assert.ok(same.pValue > 0.05,
+            `Expected p > 0.05, got ${same.pValue}`);
+
+  // Validation
+  assert.throws(() => h1.mannWhitneyTest('not a histogram'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// cohensD(other) — Cohen's d effect size
+// ---------------------------------------------------------------------------
+{
+  const h1 = createHistogram();
+  const h2 = createHistogram();
+
+  // Both empty → 0
+  assert.strictEqual(h1.cohensD(h2), 0);
+
+  // Same histogram → 0
+  for (let i = 1; i <= 100; i++) h1.record(i);
+  assert.strictEqual(h1.cohensD(h1), 0);
+
+  // Identical distributions → near 0
+  const a = createHistogram();
+  const b = createHistogram();
+  for (let i = 0; i < 100; i++) {
+    const v = 50 + Math.ceil(Math.random() * 10);
+    a.record(v);
+    b.record(v);
+  }
+  assert.ok(Math.abs(a.cohensD(b)) < 0.5);
+
+  // Very different distributions → large |d|
+  const hLow = createHistogram();
+  const hHigh = createHistogram();
+  for (let i = 0; i < 200; i++) hLow.record(8 + Math.ceil(Math.random() * 5));
+  for (let i = 0; i < 200; i++) {
+    hHigh.record(998 + Math.ceil(Math.random() * 5));
+  }
+  const d = hLow.cohensD(hHigh);
+  assert.ok(Math.abs(d) > 1.0,
+            `Expected |d| > 1, got ${d}`);
+  // hLow has lower mean → d should be negative
+  assert.ok(d < 0);
+
+  // Antisymmetry: d(a,b) = -d(b,a)
+  const dReverse = hHigh.cohensD(hLow);
+  assert.ok(Math.abs(d + dReverse) < 1e-10);
+
+  // Uniform variance → 0
+  const u1 = createHistogram();
+  const u2 = createHistogram();
+  for (let i = 0; i < 100; i++) u1.record(5);
+  for (let i = 0; i < 100; i++) u2.record(5);
+  assert.strictEqual(u1.cohensD(u2), 0);
+
+  // Validation
+  assert.throws(() => h1.cohensD('not a histogram'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// cliffsD(other) — Cliff's delta
+// ---------------------------------------------------------------------------
+{
+  const h1 = createHistogram();
+  const h2 = createHistogram();
+
+  // Both empty → 0
+  assert.strictEqual(h1.cliffsD(h2), 0);
+
+  // Same histogram → 0
+  for (let i = 1; i <= 100; i++) h1.record(i);
+  assert.strictEqual(h1.cliffsD(h1), 0);
+
+  // All values in h1 > all values in h2 → delta = 1
+  const hHigh = createHistogram();
+  const hLow = createHistogram();
+  for (let i = 0; i < 100; i++) hHigh.record(1000);
+  for (let i = 0; i < 100; i++) hLow.record(1);
+  assert.strictEqual(hHigh.cliffsD(hLow), 1);
+
+  // All values in h1 < all values in h2 → delta = -1
+  assert.strictEqual(hLow.cliffsD(hHigh), -1);
+
+  // Antisymmetry: d(a,b) = -d(b,a)
+  const a = createHistogram();
+  const b = createHistogram();
+  for (let i = 0; i < 50; i++) a.record(1 + Math.ceil(Math.random() * 100));
+  for (let i = 0; i < 50; i++) {
+    b.record(50 + Math.ceil(Math.random() * 100));
+  }
+  const dAB = a.cliffsD(b);
+  const dBA = b.cliffsD(a);
+  assert.ok(Math.abs(dAB + dBA) < 1e-10);
+
+  // Range check: -1 <= delta <= 1
+  assert.ok(dAB >= -1 && dAB <= 1);
+
+  // Identical data → 0
+  const x = createHistogram();
+  const y = createHistogram();
+  for (let i = 1; i <= 50; i++) { x.record(i); y.record(i); }
+  assert.strictEqual(x.cliffsD(y), 0);
+
+  // Validation
+  assert.throws(() => h1.cliffsD('not a histogram'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// percentileCI(percentile[, options]) — percentile confidence intervals
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram();
+
+  // With < 2 samples, lower/upper equal value
+  h.record(50);
+  const one = h.percentileCI(99);
+  assert.strictEqual(one.lower, one.value);
+  assert.strictEqual(one.upper, one.value);
+
+  // Fill with enough data for a meaningful CI
+  for (let i = 1; i <= 1000; i++) h.record(i);
+  const ci = h.percentileCI(50);
+  assert.strictEqual(typeof ci.value, 'number');
+  assert.strictEqual(typeof ci.lower, 'number');
+  assert.strictEqual(typeof ci.upper, 'number');
+  assert.ok(ci.lower <= ci.value, `lower ${ci.lower} <= value ${ci.value}`);
+  assert.ok(ci.upper >= ci.value, `upper ${ci.upper} >= value ${ci.value}`);
+
+  // 99% CI should be wider than 90% CI
+  const ci90 = h.percentileCI(50, { confidence: 0.90 });
+  const ci99 = h.percentileCI(50, { confidence: 0.99 });
+  assert.ok((ci99.upper - ci99.lower) >= (ci90.upper - ci90.lower),
+            '99% CI should be at least as wide as 90% CI');
+
+  // Extreme percentile: p99 CI
+  const ci99p = h.percentileCI(99);
+  assert.ok(ci99p.lower <= ci99p.value);
+  assert.ok(ci99p.upper >= ci99p.value);
+
+  // Constant values → CI collapses to a single value
+  const constant = createHistogram();
+  for (let i = 0; i < 100; i++) constant.record(42);
+  const constCI = constant.percentileCI(50);
+  assert.strictEqual(constCI.lower, constCI.value);
+  assert.strictEqual(constCI.upper, constCI.value);
+
+  // More samples → narrower CI
+  const small = createHistogram();
+  const large = createHistogram();
+  for (let i = 1; i <= 50; i++) { small.record(i); large.record(i); }
+  for (let i = 1; i <= 950; i++) large.record(i % 50 + 1);
+  const ciSmall = small.percentileCI(50);
+  const ciLarge = large.percentileCI(50);
+  assert.ok((ciSmall.upper - ciSmall.lower) >= (ciLarge.upper - ciLarge.lower),
+            'CI should narrow with more samples');
+
+  // Validation
+  assert.throws(() => h.percentileCI(0),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.percentileCI(101),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.percentileCI('fifty'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.percentileCI(50, { confidence: 0 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.percentileCI(50, { confidence: 1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+}
+
+// ---------------------------------------------------------------------------
+// EWMA — exponentially weighted moving average
+// ---------------------------------------------------------------------------
+{
+  // Without halfLife, EWMA is disabled (returns 0)
+  const noEwma = createHistogram();
+  for (let i = 1; i <= 100; i++) noEwma.record(i);
+  assert.strictEqual(noEwma.ewmaMean, 0);
+  assert.strictEqual(noEwma.ewmaStddev, 0);
+
+  // With halfLife, EWMA tracks the smoothed mean
+  const h = createHistogram({ halfLife: 10 });
+  assert.strictEqual(h.ewmaMean, 0);
+  assert.strictEqual(h.ewmaStddev, 0);
+
+  // First record initializes the mean
+  h.record(100);
+  assert.strictEqual(h.ewmaMean, 100);
+  assert.strictEqual(h.ewmaStddev, 0);
+
+  // Record the same value repeatedly — mean should stay stable
+  for (let i = 0; i < 50; i++) h.record(100);
+  assert.ok(Math.abs(h.ewmaMean - 100) < 1,
+            `Expected ewmaMean near 100, got ${h.ewmaMean}`);
+  assert.ok(h.ewmaStddev < 1,
+            `Expected near-zero stddev for constant input, got ${h.ewmaStddev}`);
+
+  // Shift to a new value — mean should move towards it
+  const meanBefore = h.ewmaMean;
+  for (let i = 0; i < 100; i++) h.record(200);
+  assert.ok(h.ewmaMean > meanBefore,
+            'EWMA mean should increase when recording larger values');
+  assert.ok(Math.abs(h.ewmaMean - 200) < 5,
+            `Expected ewmaMean near 200, got ${h.ewmaMean}`);
+
+  // Stddev should be small after converging
+  for (let i = 0; i < 100; i++) h.record(200);
+  assert.ok(h.ewmaStddev < 5,
+            `Expected small stddev after convergence, got ${h.ewmaStddev}`);
+
+  // Reset clears EWMA state
+  h.reset();
+  assert.strictEqual(h.ewmaMean, 0);
+  assert.strictEqual(h.ewmaStddev, 0);
+
+  // Shorter halfLife reacts faster
+  const fast = createHistogram({ halfLife: 2 });
+  const slow = createHistogram({ halfLife: 100 });
+  for (let i = 0; i < 20; i++) { fast.record(100); slow.record(100); }
+  for (let i = 0; i < 20; i++) { fast.record(200); slow.record(200); }
+  // Fast should be closer to 200 than slow
+  assert.ok(fast.ewmaMean > slow.ewmaMean,
+            `fast.ewmaMean (${fast.ewmaMean}) should be > ` +
+            `slow.ewmaMean (${slow.ewmaMean})`);
+
+  // toJSON includes separate EWMA fields
+  const j = createHistogram({ halfLife: 10, threshold: 50 });
+  j.record(50);
+  j.record(60);
+  const json = j.toJSON();
+  // mean/stddev are always the histogram (non-EWMA) values
+  assert.strictEqual(json.mean, j.mean);
+  assert.strictEqual(json.stddev, j.stddev);
+  // EWMA fields are present and match getter values
+  assert.strictEqual(json.ewmaMean, j.ewmaMean);
+  assert.strictEqual(json.ewmaStddev, j.ewmaStddev);
+  assert.strictEqual(json.ewmaErrorRate, j.ewmaErrorRate);
+  assert.ok(json.ewmaMean > 0);
+  assert.ok(json.ewmaErrorRate > 0);
+
+  // toJSON still includes EWMA fields when EWMA is not enabled (all zero)
+  const noEwmaJson = createHistogram();
+  noEwmaJson.record(50);
+  noEwmaJson.record(60);
+  const json2 = noEwmaJson.toJSON();
+  assert.strictEqual(json2.mean, noEwmaJson.mean);
+  assert.strictEqual(json2.stddev, noEwmaJson.stddev);
+  assert.strictEqual(json2.ewmaMean, 0);
+  assert.strictEqual(json2.ewmaStddev, 0);
+  assert.strictEqual(json2.ewmaErrorRate, 0);
+
+  // Validation
+  assert.throws(() => createHistogram({ halfLife: -1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => createHistogram({ halfLife: 'ten' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// ewmaErrorRate / burnRate — SLO error rate tracking
+// ---------------------------------------------------------------------------
+{
+  // Without threshold, error rate is 0
+  const noThreshold = createHistogram({ halfLife: 10 });
+  for (let i = 0; i < 50; i++) noThreshold.record(100);
+  assert.strictEqual(noThreshold.ewmaErrorRate, 0);
+
+  // Without halfLife, error rate is 0 even with threshold
+  const noHalfLife = createHistogram({ threshold: 50 });
+  for (let i = 0; i < 50; i++) noHalfLife.record(100);
+  assert.strictEqual(noHalfLife.ewmaErrorRate, 0);
+
+  // All values below threshold → error rate converges to 0
+  const allGood = createHistogram({ halfLife: 10, threshold: 200 });
+  for (let i = 0; i < 100; i++) allGood.record(100);
+  assert.ok(allGood.ewmaErrorRate < 0.01,
+            `Expected near-zero error rate, got ${allGood.ewmaErrorRate}`);
+
+  // All values above threshold → error rate converges to 1
+  const allBad = createHistogram({ halfLife: 10, threshold: 50 });
+  for (let i = 0; i < 100; i++) allBad.record(100);
+  assert.ok(allBad.ewmaErrorRate > 0.99,
+            `Expected near-1 error rate, got ${allBad.ewmaErrorRate}`);
+
+  // Mixed: ~50% above threshold
+  const mixed = createHistogram({ halfLife: 50, threshold: 50 });
+  for (let i = 0; i < 500; i++) {
+    mixed.record(i % 2 === 0 ? 100 : 10);  // Alternating above/below
+  }
+  assert.ok(mixed.ewmaErrorRate > 0.3 && mixed.ewmaErrorRate < 0.7,
+            `Expected ~0.5 error rate, got ${mixed.ewmaErrorRate}`);
+
+  // burnRate calculation
+  const h = createHistogram({ halfLife: 10, threshold: 50 });
+  for (let i = 0; i < 100; i++) h.record(100);  // All exceed
+  // Error rate ~1.0, SLO target 0.999 → budget 0.001 → burn rate ~1000
+  const rate = h.burnRate(0.999);
+  assert.ok(rate > 500,
+            `Expected high burn rate, got ${rate}`);
+
+  // When error rate is 0, burn rate is 0
+  const perfect = createHistogram({ halfLife: 10, threshold: 200 });
+  for (let i = 0; i < 100; i++) perfect.record(100);
+  assert.ok(perfect.burnRate(0.999) < 1,
+            `Expected low burn rate, got ${perfect.burnRate(0.999)}`);
+
+  // Reset clears error rate
+  h.reset();
+  assert.strictEqual(h.ewmaErrorRate, 0);
+  assert.strictEqual(h.burnRate(0.999), 0);
+
+  // burnRate validation
+  assert.throws(() => h.burnRate(0),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.burnRate(1),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.burnRate(NaN),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.burnRate('high'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+
+  // createHistogram threshold validation
+  assert.throws(() => createHistogram({ threshold: -1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => createHistogram({ threshold: 'high' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// ---------------------------------------------------------------------------
+// ERR_INVALID_THIS for all new methods on wrong receiver
+// ---------------------------------------------------------------------------
+{
+  const { Histogram } = require('internal/histogram');
+  const h = createHistogram();
+  for (let i = 1; i <= 10; i++) h.record(i);
+  const wrongThis = {};
+
+  const methods = [
+    ['welchTest', [h]],
+    ['mannWhitneyTest', [h]],
+    ['cohensD', [h]],
+    ['cliffsD', [h]],
+    ['percentileCI', [50]],
+    ['burnRate', [0.999]],
+  ];
+
+  for (const [method, args] of methods) {
+    assert.throws(
+      () => Histogram.prototype[method].call(wrongThis, ...args),
+      { code: 'ERR_INVALID_THIS' },
+      `${method} should throw ERR_INVALID_THIS`,
+    );
+  }
+
+  // Getter properties
+  const getters = ['ewmaMean', 'ewmaStddev', 'ewmaErrorRate'];
+  for (const getter of getters) {
+    const desc = Object.getOwnPropertyDescriptor(Histogram.prototype, getter);
+    assert.throws(
+      () => desc.get.call(wrongThis),
+      { code: 'ERR_INVALID_THIS' },
+      `${getter} should throw ERR_INVALID_THIS`,
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Undefined return when kHandle is missing native methods
+// ---------------------------------------------------------------------------
+{
+  const {
+    Histogram,
+    kHandle,
+    kSkipThrow,
+  } = require('internal/histogram');
+  const h = createHistogram();
+  for (let i = 1; i <= 10; i++) h.record(i);
+
+  // Create a histogram instance with a null handle. This passes
+  // isHistogram() (null !== undefined) but the optional chaining
+  // (this[kHandle]?.method()) short-circuits to undefined.
+  const stub = new Histogram(kSkipThrow);
+  stub[kHandle] = null;
+
+  assert.strictEqual(stub.welchTest(h), undefined);
+  assert.strictEqual(stub.mannWhitneyTest(h), undefined);
+  assert.strictEqual(stub.percentileCI(50), undefined);
+  assert.strictEqual(stub.burnRate(0.999), undefined);
+}
+
+// ---------------------------------------------------------------------------
+// Fast API path coverage for EWMA getters
+// ---------------------------------------------------------------------------
+{
+  const h = createHistogram({ halfLife: 10, threshold: 50 });
+  for (let i = 1; i <= 100; i++) h.record(i);
+
+  // Call in a tight loop to trigger V8 fast-path optimization.
+  function readEwma(histogram, iterations) {
+    let mean = 0;
+    let stddev = 0;
+    let errorRate = 0;
+    for (let i = 0; i < iterations; i++) {
+      mean = histogram.ewmaMean;
+      stddev = histogram.ewmaStddev;
+      errorRate = histogram.ewmaErrorRate;
+    }
+    return { mean, stddev, errorRate };
+  }
+
+  const result = readEwma(h, 1e4);
+  assert.strictEqual(typeof result.mean, 'number');
+  assert.ok(result.mean > 0);
+  assert.strictEqual(typeof result.stddev, 'number');
+  assert.ok(result.stddev > 0);
+  assert.strictEqual(typeof result.errorRate, 'number');
+  assert.ok(result.errorRate > 0);
+}
+
+// ---------------------------------------------------------------------------
+// Cross-consistency: when welchTest is significant, cohensD should
+// indicate a non-trivial effect, and cliffsD should agree on direction.
+// ---------------------------------------------------------------------------
+{
+  const baseline = createHistogram();
+  const regressed = createHistogram();
+  for (let i = 0; i < 500; i++) {
+    baseline.record(10 + Math.ceil(Math.random() * 20));
+  }
+  for (let i = 0; i < 500; i++) {
+    regressed.record(50 + Math.ceil(Math.random() * 20));
+  }
+
+  const welch = baseline.welchTest(regressed);
+  const d = baseline.cohensD(regressed);
+  const cliff = baseline.cliffsD(regressed);
+
+  // Should be highly significant
+  assert.ok(welch.pValue < 0.001);
+  // Cohen's d should indicate a large effect (|d| > 0.8)
+  assert.ok(Math.abs(d) > 0.8);
+  // Cliff's delta should indicate baseline < regressed
+  assert.ok(cliff < -0.5);
+  // All three agree on the direction
+  assert.ok(d < 0);  // Baseline mean < regressed mean
+  assert.ok(welch.tStatistic < 0);
+}

From 74234ee30e841a5ff1a857821b94310ebca12c49 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Wed, 19 Aug 2026 21:44:10 -0700
Subject: [PATCH 323/344] benchmark: add --analyze mode to compare.js

Add an --analyze flag that performs statistical analysis directly
after benchmarks complete, eliminating the need for R and compare.R.

When --analyze is specified, compare.js collects the rate data during
the run and prints a statistical summary table instead of CSV output.
The table matches the format of compare.R: improvement percentage,
significance stars (* p<0.05, ** p<0.01, *** p<0.001), and confidence
intervals at three risk levels.

Also adds a --max-regression N option that causes the compare.js to
exit with 1 (error) when the `--new` is N% slower. Useful for CI
use to detect regressions.

Uses the histogram API's welchTest() and cohensD() methods introduced
in the previous commit. Benchmark rates are scaled to integers for
HdrHistogram recording; the --scale option (default 1000) controls
the multiplier for precision.

Usage:
  node benchmark/compare.js --old ./node-old --new ./node-new \
    --analyze url

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus
PR-URL: https://github.com/nodejs/node/pull/65416
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 benchmark/_benchmark_progress.js              |   8 +-
 benchmark/compare.js                          | 239 +++++++++++++++++-
 .../writing-and-running-benchmarks.md         |  67 +++--
 3 files changed, 288 insertions(+), 26 deletions(-)

diff --git a/benchmark/_benchmark_progress.js b/benchmark/_benchmark_progress.js
index 6c925f34e682..117e86609028 100644
--- a/benchmark/_benchmark_progress.js
+++ b/benchmark/_benchmark_progress.js
@@ -25,9 +25,10 @@ function getTime(diff) {
 // A run is an item in the job queue: { binary, filename, iter }
 // A config is an item in the subqueue: { binary, filename, iter, configs }
 class BenchmarkProgress {
-  constructor(queue, benchmarks) {
+  constructor(queue, benchmarks, options = {}) {
     this.queue = queue;  // Scheduled runs.
     this.benchmarks = benchmarks;  // Filenames of scheduled benchmarks.
+    this.analyze = !!options.analyze;  // stdout is not piped, but unused.
     this.completedRuns = 0;  // Number of completed runs.
     this.scheduledRuns = queue.length;  // Number of scheduled runs.
     // Time when starting to run benchmarks.
@@ -107,7 +108,10 @@ class BenchmarkProgress {
   }
 
   updateProgress() {
-    if (!process.stderr.isTTY || process.stdout.isTTY) {
+    // Progress renders on stderr when stdout is piped (not a TTY).
+    // In --analyze mode, stdout is the terminal but is unused during
+    // the run, so treat it the same as piped.
+    if (!process.stderr.isTTY || (process.stdout.isTTY && !this.analyze)) {
       return;
     }
     readline.clearLine(process.stderr);
diff --git a/benchmark/compare.js b/benchmark/compare.js
index ad3084db3904..6aaaee7a9190 100644
--- a/benchmark/compare.js
+++ b/benchmark/compare.js
@@ -13,7 +13,8 @@ const cli = new CLI(`usage: ./node compare.js [options] [--] <category> ...
   Run each benchmark in the <category> directory many times using two different
   node versions. More than one <category> directory can be specified.
   The output is formatted as csv, which can be processed using for
-  example 'compare.R'.
+  example 'compare.R'. Use --analyze to perform statistical analysis
+  directly without R.
 
   --new      ./new-node-binary  new node binary (required)
   --old      ./old-node-binary  old node binary (required)
@@ -24,13 +25,21 @@ const cli = new CLI(`usage: ./node compare.js [options] [--] <category> ...
                                 repeated)
   --set      variable=value     set benchmark variable (can be repeated)
   --no-progress                 don't show benchmark progress indicator
+  --analyze                     perform statistical analysis after benchmarks
+                                complete (Welch's t-test, effect size) instead
+                                of printing csv output
+  --scale    1000               rate-to-integer multiplier for histogram
+                                 precision when using --analyze (default: 1000)
+  --max-regression  N           exit with code 1 if any statistically
+                                 significant regression exceeds N% (implies
+                                 --analyze)
 
   Examples:
     --set CPUSET=0            Runs benchmarks on CPU core 0.
     --set CPUSET=0-2          Specifies that benchmarks should run on CPU cores 0 to 2.
 
   Note: The CPUSET format should match the specifications of the 'taskset' command
-`, { arrayArgs: ['set', 'filter', 'exclude'], boolArgs: ['no-progress'] });
+`, { arrayArgs: ['set', 'filter', 'exclude'], boolArgs: ['no-progress', 'analyze'] });
 
 if (!cli.optional.new || !cli.optional.old) {
   cli.abort(cli.usage);
@@ -38,6 +47,11 @@ if (!cli.optional.new || !cli.optional.old) {
 
 const binaries = ['old', 'new'];
 const runs = cli.optional.runs ? parseInt(cli.optional.runs, 10) : 30;
+const maxRegression = cli.optional['max-regression'] ?
+  parseFloat(cli.optional['max-regression']) :
+  0;
+const analyze = !!cli.optional.analyze || maxRegression > 0;
+const scale = cli.optional.scale ? parseInt(cli.optional.scale, 10) : 1000;
 const benchmarks = cli.benchmarks();
 
 if (benchmarks.length === 0) {
@@ -46,6 +60,9 @@ if (benchmarks.length === 0) {
   return;
 }
 
+// When --analyze is set, collect results for statistical analysis.
+const results = analyze ? new Map() : null;
+
 // Create queue from the benchmarks list such both node versions are tested
 // `runs` amount of times each.
 // Note: BenchmarkProgress relies on this order to estimate
@@ -61,15 +78,17 @@ for (const filename of benchmarks) {
 }
 // queue.length = binary.length * runs * benchmarks.length
 
-// Print csv header
-console.log('"binary","filename","configuration","rate","time"');
+// Print csv header (unless analyzing inline).
+if (!analyze) {
+  console.log('"binary","filename","configuration","rate","time"');
+}
 
 const kStartOfQueue = 0;
 
 const showProgress = !cli.optional['no-progress'];
 let progress;
 if (showProgress) {
-  progress = new BenchmarkProgress(queue, benchmarks);
+  progress = new BenchmarkProgress(queue, benchmarks, { analyze });
   progress.startQueue(kStartOfQueue);
 }
 
@@ -99,11 +118,20 @@ if (showProgress) {
         conf += ` ${key}=${inspect(data.conf[key])}`;
       }
       conf = conf.slice(1);
-      // Escape quotes (") for correct csv formatting
-      conf = conf.replace(/"/g, '""');
 
-      console.log(`"${job.binary}","${job.filename}","${conf}",` +
-                  `${data.rate},${data.time}`);
+      if (analyze) {
+        // Collect results for post-run analysis.
+        const name = `${job.filename} ${conf}`;
+        if (!results.has(name)) {
+          results.set(name, { old: [], new: [] });
+        }
+        results.get(name)[job.binary].push(data.rate);
+      } else {
+        // Escape quotes (") for correct csv formatting
+        conf = conf.replace(/"/g, '""');
+        console.log(`"${job.binary}","${job.filename}","${conf}",` +
+                    `${data.rate},${data.time}`);
+      }
       if (showProgress) {
         // One item in the subqueue has been completed.
         progress.completeConfig(data);
@@ -125,6 +153,199 @@ if (showProgress) {
     // If there are more benchmarks execute the next
     if (i + 1 < queue.length) {
       recursive(i + 1);
+    } else if (analyze) {
+      printAnalysis(results, scale, maxRegression);
     }
   });
 })(kStartOfQueue);
+
+function printAnalysis(results, scale, maxRegression) {
+  const { createHistogram } = require('node:perf_hooks');
+
+  // Build per-benchmark histograms and run statistical tests.
+  const rows = [];
+  let maxNameLen = 0;
+
+  let skipped = 0;
+
+  for (const [name, { old: oldRates, new: newRates }] of results) {
+    if (oldRates.length < 2 || newRates.length < 2) {
+      skipped++;
+      continue;
+    }
+
+    const hOld = createHistogram({ figures: 3 });
+    const hNew = createHistogram({ figures: 3 });
+
+    for (const r of oldRates) hOld.record(Math.max(1, Math.round(r * scale)));
+    for (const r of newRates) hNew.record(Math.max(1, Math.round(r * scale)));
+
+    const oldMean = oldRates.reduce((a, b) => a + b, 0) / oldRates.length;
+    const newMean = newRates.reduce((a, b) => a + b, 0) / newRates.length;
+    const improvement = ((newMean - oldMean) / oldMean) * 100;
+
+    // Query the three confidence levels. The p-value and t-statistic
+    // are the same regardless of the confidence level, so we extract
+    // them from the first result.
+    const w95 = hOld.welchTest(hNew, { confidence: 0.95 });
+    const w99 = hOld.welchTest(hNew, { confidence: 0.99 });
+    const w999 = hOld.welchTest(hNew, { confidence: 0.999 });
+
+    // Significance stars matching compare.R convention.
+    let stars = '';
+    if (w95.pValue < 0.001) stars = '***';
+    else if (w95.pValue < 0.01) stars = ' **';
+    else if (w95.pValue < 0.05) stars = '  *';
+
+    // Confidence intervals expressed as percentage of the old mean.
+    const ciPct = (w) => {
+      const half =
+        (w.confidenceInterval.upper - w.confidenceInterval.lower) / 2;
+      return (half / (oldMean * scale)) * 100;
+    };
+
+    rows.push({
+      name,
+      stars,
+      improvement,
+      ci95: ciPct(w95),
+      ci99: ciPct(w99),
+      ci999: ciPct(w999),
+      pValue: w95.pValue,
+    });
+
+    if (name.length > maxNameLen) maxNameLen = name.length;
+  }
+
+  // Print header.
+  const pad = (s, n) => s + ' '.repeat(Math.max(0, n - s.length));
+  const rpad = (s, n) => ' '.repeat(Math.max(0, n - s.length)) + s;
+
+  console.log(`${pad('', maxNameLen)}  confidence` +
+              `   improvement   accuracy (*)    (**)   (***)`);
+
+  for (const row of rows) {
+    const imp = `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)} %`;
+    console.log(
+      `${pad(row.name, maxNameLen)}  ${pad(row.stars, 10)}` +
+      `  ${rpad(imp, 11)}` +
+      `   ±${row.ci95.toFixed(2)}%` +
+      `  ±${row.ci99.toFixed(2)}%` +
+      `  ±${row.ci999.toFixed(2)}%`,
+    );
+  }
+
+  if (skipped > 0) {
+    console.log('');
+    console.log(
+      `Note: ${skipped} configuration${skipped === 1 ? ' was' : 's were'}` +
+      ` skipped because Welch's t-test requires at least 2 samples per` +
+      ` binary. Use --runs 2 or higher.`,
+    );
+  }
+
+  // --- Bar chart visualization ---
+  printChart(rows, maxNameLen);
+
+  console.log('');
+  console.log(
+    `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).\n` +
+    `Use --scale to adjust precision if needed.\n`,
+  );
+  console.log(
+    `Be aware that when doing many comparisons the risk of a false-positive\n` +
+    `result increases. In this case, there are ${rows.length} comparisons, ` +
+    `you can thus\nexpect the following amount of false-positive results:\n` +
+    `  ${(rows.length * 0.05).toFixed(2)} false positives, when considering ` +
+    `a   5% risk acceptance (*, **, ***),\n` +
+    `  ${(rows.length * 0.01).toFixed(2)} false positives, when considering ` +
+    `a   1% risk acceptance (**, ***),\n` +
+    `  ${(rows.length * 0.001).toFixed(2)} false positives, when considering ` +
+    `a 0.1% risk acceptance (***)`,
+  );
+
+  // Gate: exit with error if any significant regression exceeds the limit.
+  if (maxRegression > 0) {
+    const failures = rows.filter(
+      (r) => r.stars.trim() !== '' && r.improvement < -maxRegression,
+    );
+    if (failures.length > 0) {
+      console.log('');
+      console.log(
+        `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
+        ` showed a statistically significant regression exceeding` +
+        ` ${maxRegression}%:`,
+      );
+      for (const f of failures) {
+        console.log(`  ${f.name}  ${f.improvement.toFixed(2)}%`);
+      }
+      process.exitCode = 1;
+    }
+  }
+}
+
+function printChart(rows, maxNameLen) {
+  if (rows.length === 0) return;
+
+  // Determine the chart scale from the data. The bar region covers
+  // the range [-maxAbs, +maxAbs] so the zero line sits in the center.
+  const barWidth = 40;
+  const halfWidth = barWidth / 2;
+  let maxAbs = 0;
+  for (const row of rows) {
+    const extent = Math.abs(row.improvement) + row.ci95;
+    if (extent > maxAbs) maxAbs = extent;
+  }
+  if (maxAbs === 0) maxAbs = 1;
+
+  const pad = (s, n) => s + ' '.repeat(Math.max(0, n - s.length));
+
+  // Scale axis labels.
+  const axisLeft = `-${maxAbs.toFixed(1)}%`;
+  const axisRight = `+${maxAbs.toFixed(1)}%`;
+  const axisCenter = '0%';
+
+  // Print axis header.
+  const labelPad = maxNameLen + 5;
+  const leftLabel = ' '.repeat(labelPad) +
+    axisLeft +
+    ' '.repeat(Math.max(0, halfWidth - axisLeft.length - Math.floor(axisCenter.length / 2))) +
+    axisCenter +
+    ' '.repeat(Math.max(0, halfWidth - Math.ceil(axisCenter.length / 2) - axisRight.length)) +
+    axisRight;
+  console.log('');
+  console.log(leftLabel);
+
+  for (const row of rows) {
+    const imp = row.improvement;
+    const ci = row.ci95;
+
+    // Position of the improvement value in the bar region [0, barWidth].
+    const center = halfWidth;
+    const impPos = center + (imp / maxAbs) * halfWidth;
+
+    // CI extent in bar positions.
+    const ciLeft = center + ((imp - ci) / maxAbs) * halfWidth;
+    const ciRight = center + ((imp + ci) / maxAbs) * halfWidth;
+
+    // Build the bar character by character.
+    const chars = [];
+    for (let x = 0; x < barWidth; x++) {
+      const pos = x + 0.5; // Center of this character cell.
+      if (x === Math.floor(center)) {
+        chars.push('|');
+      } else if ((imp >= 0 && pos > center && pos <= impPos) ||
+                 (imp < 0 && pos < center && pos >= impPos)) {
+        chars.push(row.stars ? '\u2588' : '\u2593'); // solid or dark shade
+      } else if (pos >= ciLeft && pos <= ciRight) {
+        chars.push('\u2591'); // Light shade for CI region
+      } else {
+        chars.push(' ');
+      }
+    }
+
+    const label = `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)}%`;
+    const sig = row.stars.trim();
+    console.log(`${pad(row.name, maxNameLen)}  ${chars.join('')}  ${label} ${sig}`);
+  }
+}
diff --git a/doc/contributing/writing-and-running-benchmarks.md b/doc/contributing/writing-and-running-benchmarks.md
index 23132d9eb0f7..a31e0e82aabc 100644
--- a/doc/contributing/writing-and-running-benchmarks.md
+++ b/doc/contributing/writing-and-running-benchmarks.md
@@ -14,6 +14,8 @@
   * [Specifying CPU Cores for Benchmarks with run.js](#specifying-cpu-cores-for-benchmarks-with-runjs)
   * [Filtering benchmarks](#filtering-benchmarks)
   * [Comparing Node.js versions](#comparing-nodejs-versions)
+    * [Using `--analyze` (no external tools needed)](#using---analyze-no-external-tools-needed)
+    * [Using R scripts or node-benchmark-compare](#using-r-scripts-or-node-benchmark-compare)
   * [Comparing parameters](#comparing-parameters)
   * [Running benchmarks on the CI](#running-benchmarks-on-the-ci)
 * [Creating a benchmark](#creating-a-benchmark)
@@ -73,18 +75,27 @@ node benchmark/http2/simple.js benchmarker=h2load
 
 ### Benchmark analysis requirements
 
-To analyze the results statistically, you can use either the
-[node-benchmark-compare][] tool or the R script `benchmark/compare.R`.
+To analyze the results statistically, there are three options:
 
-[node-benchmark-compare][] is a Node.js script that can be installed with
-`npm install -g node-benchmark-compare`.
+* **`--analyze` flag** (built-in, no dependencies): Pass `--analyze` to
+  `benchmark/compare.js` to perform Welch's t-test directly after the
+  benchmarks complete. This uses the histogram API's statistical testing
+  methods and requires no external tools.
+* **R scripts** (`benchmark/compare.R`, `benchmark/bar.R`): Perform the same
+  Welch's t-test analysis as `--analyze`, with the additional ability to
+  generate plots. Requires R with the `ggplot2` and `plyr` packages.
+* **[node-benchmark-compare][]** (legacy): A Node.js script that can be
+  installed with `npm install -g node-benchmark-compare`. It reads the CSV
+  output of `benchmark/compare.js`. Predates the built-in `--analyze` flag
+  and is no longer necessary for most workflows.
 
-To draw comparison plots when analyzing the results, `R` must be installed.
-Use one of the available package managers or download it from
-<https://www.r-project.org/>.
+For most use cases, `--analyze` is the simplest option since it requires
+nothing beyond Node.js itself.
 
-The R packages `ggplot2` and `plyr` are also used and can be installed using
-the R REPL.
+To install R for plot generation, use one of the available package managers or
+download it from <https://www.r-project.org/>.
+
+The R packages `ggplot2` and `plyr` can be installed using the R REPL.
 
 ```console
 $ R
@@ -403,16 +414,38 @@ module, you can use the `--filter` option:_
                                 repeated)
   --set      variable=value     set benchmark variable (can be repeated)
   --no-progress                 don't show benchmark progress indicator
+  --analyze                     perform statistical analysis inline (no R needed)
+  --scale    1000               rate multiplier for --analyze precision
+  --max-regression  N           exit with code 1 if any significant regression
+                                exceeds N% (implies --analyze)
+```
+
+#### Using `--analyze` (no external tools needed)
+
+The simplest way to get statistical results is to pass `--analyze`:
+
+```bash
+node benchmark/compare.js --old ./node-main --new ./node-pr-5134 --analyze string_decoder
+```
 
-    Examples:
-    --set CPUSET=0            Runs benchmarks on CPU core 0.
-    --set CPUSET=0-2          Specifies that benchmarks should run on CPU cores 0 to 2.
+This runs the benchmarks and prints the analysis directly:
 
-  Note: The CPUSET format should match the specifications of the 'taskset' command
+```console
+                                                                                             confidence   improvement   accuracy (*)    (**)   (***)
+string_decoder/string-decoder.js n=2500000 chunkLen=16 inLen=128 encoding='ascii'            ***            -3.76 %   ±1.36%  ±1.82%  ±2.40%
+string_decoder/string-decoder.js n=2500000 chunkLen=16 inLen=128 encoding='utf8'              **            -0.81 %   ±0.53%  ±0.71%  ±0.93%
+...
 ```
 
-For analyzing the benchmark results, use [node-benchmark-compare][] or the R
-scripts:
+The `--analyze` mode uses the histogram API's `welchTest()` method to perform
+the same Welch's t-test that the R script uses. Benchmark rates are scaled to
+integers for the histogram (controlled by `--scale`, default 1000). With the
+default settings, results are identical to the R script at two decimal places.
+
+#### Using R scripts or node-benchmark-compare
+
+Alternatively, save the CSV output and analyze it separately using
+[node-benchmark-compare][] or the R scripts:
 
 * `benchmark/compare.R`
 * `benchmark/bar.R`
@@ -428,6 +461,10 @@ $ node-benchmark-compare compare-pr-5134.csv # or cat compare-pr-5134.csv | Rscr
 ...
 ```
 
+The R approach is still useful when you need to generate plots (box plots via
+`compare.R --plot`, scatter plots via `scatter.R --plot`) or when you want to
+analyze previously saved CSV files.
+
 In the output, _improvement_ is the relative improvement of the new version,
 hopefully this is positive. _confidence_ tells if there is enough
 statistical evidence to validate the _improvement_. If there is enough evidence

From 6673ebadf28936c1c39f734a97650e5b98ef99d7 Mon Sep 17 00:00:00 2001
From: Mert Can Altin <mertgold60@gmail.com>
Date: Sun, 23 Aug 2026 23:29:59 +0300
Subject: [PATCH 324/344] fs: abort in-flight stat operations

Signed-off-by: Mert Can Altin <mertgold60@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63143
Refs: https://github.com/nodejs/node/pull/57775
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/fs.md                            |  24 ++++++
 lib/fs.js                                |  45 ++++++++--
 lib/internal/fs/promises.js              |  62 +++++++++++---
 test/parallel/test-fs-stat-abort-test.js | 103 +++++++++++++++++++----
 4 files changed, 200 insertions(+), 34 deletions(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index 43a0f4b89a4f..1fa2fe621b58 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1542,6 +1542,10 @@ link(2) documentation for more detail.
 <!-- YAML
 added: v10.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63143
+    description: Accepts an additional `signal` option to allow aborting the
+                 operation.
   - version: v10.5.0
     pr-url: https://github.com/nodejs/node/pull/20220
     description: Accepts an additional `options` object to specify whether
@@ -1552,6 +1556,8 @@ changes:
 * `options` {Object}
   * `bigint` {boolean} Whether the numeric values in the returned
     {fs.Stats} object should be `bigint`. **Default:** `false`.
+  * `signal` {AbortSignal} An AbortSignal to cancel the operation.
+    **Default:** `undefined`.
 * Returns: {Promise}  Fulfills with the {fs.Stats} object for the given
   symbolic link `path`.
 
@@ -2080,6 +2086,10 @@ Removes files and directories (modeled on the standard POSIX `rm` utility).
 <!-- YAML
 added: v10.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63143
+    description: Accepts an additional `signal` option to allow aborting the
+                 operation.
   - version: v25.7.0
     pr-url: https://github.com/nodejs/node/pull/61178
     description: Accepts a `throwIfNoEntry` option to specify whether
@@ -2097,6 +2107,8 @@ changes:
   * `throwIfNoEntry` {boolean} Whether an exception will be thrown
     if no file system entry exists, rather than returning `undefined`.
     **Default:** `true`.
+  * `signal` {AbortSignal} An AbortSignal to cancel the operation.
+    **Default:** `undefined`.
 * Returns: {Promise}  Fulfills with the {fs.Stats} object for the
   given `path`.
 
@@ -3437,6 +3449,10 @@ exception are given to the completion callback.
 <!-- YAML
 added: v0.1.95
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63143
+    description: Accepts an additional `signal` option to allow aborting the
+                 operation.
   - version: v18.0.0
     pr-url: https://github.com/nodejs/node/pull/41678
     description: Passing an invalid callback to the `callback` argument
@@ -3460,6 +3476,8 @@ changes:
 * `options` {Object}
   * `bigint` {boolean} Whether the numeric values in the returned
     {fs.Stats} object should be `bigint`. **Default:** `false`.
+  * `signal` {AbortSignal} An AbortSignal to cancel the operation.
+    **Default:** `undefined`.
 * `callback` {Function}
   * `err` {Error}
   * `stats` {fs.Stats}
@@ -3802,6 +3820,10 @@ exception are given to the completion callback.
 <!-- YAML
 added: v0.1.30
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/63143
+    description: Accepts an additional `signal` option to allow aborting the
+                 operation.
   - version: v18.0.0
     pr-url: https://github.com/nodejs/node/pull/41678
     description: Passing an invalid callback to the `callback` argument
@@ -3829,6 +3851,8 @@ changes:
 * `options` {Object}
   * `bigint` {boolean} Whether the numeric values in the returned
     {fs.Stats} object should be `bigint`. **Default:** `false`.
+  * `signal` {AbortSignal} An AbortSignal to cancel the operation.
+    **Default:** `undefined`.
 * `callback` {Function}
   * `err` {Error}
   * `stats` {fs.Stats}
diff --git a/lib/fs.js b/lib/fs.js
index 96da9b762dc3..ed6f0c6c86e0 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -139,6 +139,7 @@ const {
 const {
   isInt32,
   parseFileMode,
+  validateAbortSignal,
   validateBoolean,
   validateBuffer,
   validateEncoding,
@@ -383,6 +384,25 @@ function checkAborted(signal, callback) {
   return false;
 }
 
+function bindSignalToReq(req, signal, callback) {
+  if (!signal) {
+    req.oncomplete = callback;
+    return;
+  }
+  let aborted = false;
+  const onAbort = () => {
+    aborted = true;
+    callback(new AbortError(undefined, { cause: signal.reason }));
+  };
+  kResistStopPropagation ??= require('internal/event_target').kResistStopPropagation;
+  signal.addEventListener('abort', onAbort, { __proto__: null, [kResistStopPropagation]: true });
+  req.oncomplete = function(err, result) {
+    signal.removeEventListener('abort', onAbort);
+    if (aborted) return;
+    callback(err, result);
+  };
+}
+
 /**
  * Asynchronously reads the entire contents of a file.
  * @param {string | Buffer | URL | number} path
@@ -1954,7 +1974,7 @@ function readdirSync(path, options) {
  * Invokes the callback with the `fs.Stats`
  * for the file descriptor.
  * @param {number} fd
- * @param {{ bigint?: boolean; }} [options]
+ * @param {{ bigint?: boolean, signal?: AbortSignal }} [options]
  * @param {(
  *   err?: Error,
  *   stats?: Stats
@@ -1965,6 +1985,8 @@ function fstat(fd, options = { __proto__: null, bigint: false }, callback) {
   if (typeof options === 'function') {
     callback = options;
     options = kEmptyObject;
+  } else if (options === null || typeof options !== 'object') {
+    options = kEmptyObject;
   }
 
   const h = vfsState.handlers;
@@ -1972,8 +1994,11 @@ function fstat(fd, options = { __proto__: null, bigint: false }, callback) {
 
   callback = makeStatsCallback(callback);
 
+  if (options.signal !== undefined) validateAbortSignal(options.signal, 'options.signal');
+  if (checkAborted(options.signal, callback)) return;
+
   const req = new FSReqCallback(options.bigint);
-  req.oncomplete = callback;
+  bindSignalToReq(req, options.signal, callback);
   binding.fstat(fd, options.bigint, req);
 }
 
@@ -1981,7 +2006,7 @@ function fstat(fd, options = { __proto__: null, bigint: false }, callback) {
  * Retrieves the `fs.Stats` for the symbolic link
  * referred to by the `path`.
  * @param {string | Buffer | URL} path
- * @param {{ bigint?: boolean; }} [options]
+ * @param {{ bigint?: boolean, signal?: AbortSignal }} [options]
  * @param {(
  *   err?: Error,
  *   stats?: Stats
@@ -1992,6 +2017,10 @@ function lstat(path, options = { __proto__: null, bigint: false }, callback) {
   if (typeof options === 'function') {
     callback = options;
     options = kEmptyObject;
+  } else if (options === null || typeof options !== 'object') {
+    options = kEmptyObject;
+  } else {
+    options = getOptions(options, { bigint: false });
   }
 
   const h = vfsState.handlers;
@@ -2005,8 +2034,11 @@ function lstat(path, options = { __proto__: null, bigint: false }, callback) {
     return;
   }
 
+  if (options.signal !== undefined) validateAbortSignal(options.signal, 'options.signal');
+  if (checkAborted(options.signal, callback)) return;
+
   const req = new FSReqCallback(options.bigint);
-  req.oncomplete = callback;
+  bindSignalToReq(req, options.signal, callback);
   binding.lstat(path, options.bigint, req);
 }
 
@@ -2036,11 +2068,12 @@ function stat(path, options = { __proto__: null, bigint: false, throwIfNoEntry:
   callback = makeStatsCallback(callback);
   path = getValidatedPath(path);
 
+  if (options.signal !== undefined) validateAbortSignal(options.signal, 'options.signal');
   if (checkAborted(options.signal, callback)) return;
 
   const req = new FSReqCallback(options.bigint);
-  req.oncomplete = callback;
-  binding.stat(getValidatedPath(path), options.bigint, req, options.throwIfNoEntry);
+  bindSignalToReq(req, options.signal, callback);
+  binding.stat(path, options.bigint, req, options.throwIfNoEntry);
 }
 
 function statfs(path, options = { __proto__: null, bigint: false }, callback) {
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index d571de820ced..5a61f58aae27 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -12,8 +12,10 @@ const {
   PromisePrototypeThen,
   PromiseReject,
   PromiseResolve,
+  PromiseWithResolvers,
   SafeArrayIterator,
   SafePromisePrototypeFinally,
+  SafePromiseRace,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
@@ -1126,6 +1128,21 @@ function checkAborted(signal) {
     throw new AbortError(undefined, { cause: signal.reason });
 }
 
+function rejectWithReason(signal, reject) {
+  return () => {
+    reject(new AbortError(undefined, { cause: signal.reason }));
+  };
+}
+
+async function raceWithSignal(opPromise, signal) {
+  if (!signal) return opPromise;
+  const { promise: abortPromise, reject } = PromiseWithResolvers();
+  // eslint-disable-next-line no-unused-vars
+  using _ = EventEmitter.addAbortListener(signal,
+                                          rejectWithReason(signal, reject));
+  return await SafePromiseRace([opPromise, abortPromise]);
+}
+
 async function writeFileHandle(filehandle, data, signal, encoding) {
   checkAborted(signal);
   if (isCustomIterable(data)) {
@@ -1779,15 +1796,26 @@ async function symlink(target, path, type) {
 }
 
 async function fstat(handle, options = { __proto__: null, bigint: false }) {
-  const result = await PromisePrototypeThen(
-    binding.fstat(handle.fd, options.bigint, kUsePromises),
-    undefined,
-    handleErrorFromBinding,
+  validateObject(options, 'options');
+  const { signal } = options;
+  if (signal !== undefined) validateAbortSignal(signal, 'options.signal');
+  checkAborted(signal);
+  const result = await raceWithSignal(
+    PromisePrototypeThen(
+      binding.fstat(handle.fd, options.bigint, kUsePromises),
+      undefined,
+      handleErrorFromBinding,
+    ),
+    signal,
   );
   return getStatsFromBinding(result);
 }
 
 async function lstat(path, options = { __proto__: null, bigint: false }) {
+  validateObject(options, 'options');
+  const { signal } = options;
+  if (signal !== undefined) validateAbortSignal(signal, 'options.signal');
+  checkAborted(signal);
   const h = vfsState.handlers;
   if (h !== null) {
     const promise = h.lstat(path, options);
@@ -1798,24 +1826,34 @@ async function lstat(path, options = { __proto__: null, bigint: false }) {
     const resource = pathModule.toNamespacedPath(BufferIsBuffer(path) ? BufferToString(path) : path);
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
-  const result = await PromisePrototypeThen(
-    binding.lstat(path, options.bigint, kUsePromises),
-    undefined,
-    handleErrorFromBinding,
+  const result = await raceWithSignal(
+    PromisePrototypeThen(
+      binding.lstat(path, options.bigint, kUsePromises),
+      undefined,
+      handleErrorFromBinding,
+    ),
+    signal,
   );
   return getStatsFromBinding(result);
 }
 
 async function stat(path, options = { __proto__: null, bigint: false, throwIfNoEntry: true }) {
+  validateObject(options, 'options');
+  const { signal } = options;
+  if (signal !== undefined) validateAbortSignal(signal, 'options.signal');
+  checkAborted(signal);
   const h = vfsState.handlers;
   if (h !== null) {
     const promise = h.stat(path, options);
     if (promise !== undefined) return await promise;
   }
-  const result = await PromisePrototypeThen(
-    binding.stat(getValidatedPath(path), options.bigint, kUsePromises, options.throwIfNoEntry),
-    undefined,
-    handleErrorFromBinding,
+  const result = await raceWithSignal(
+    PromisePrototypeThen(
+      binding.stat(getValidatedPath(path), options.bigint, kUsePromises, options.throwIfNoEntry),
+      undefined,
+      handleErrorFromBinding,
+    ),
+    signal,
   );
 
   // Binding will resolve undefined if UV_ENOENT or UV_ENOTDIR and throwIfNoEntry is false
diff --git a/test/parallel/test-fs-stat-abort-test.js b/test/parallel/test-fs-stat-abort-test.js
index 2a2b35f8030d..e820aaf55655 100644
--- a/test/parallel/test-fs-stat-abort-test.js
+++ b/test/parallel/test-fs-stat-abort-test.js
@@ -4,31 +4,102 @@ require('../common');
 const test = require('node:test');
 const assert = require('node:assert');
 const fs = require('node:fs');
+const fsPromises = require('node:fs/promises');
 const tmpdir = require('../common/tmpdir');
 
-test('fs.stat should throw AbortError when called with an already aborted AbortSignal', async () => {
-  // This test verifies that fs.stat immediately throws an AbortError if the provided AbortSignal
-  // has already been canceled. This approach is used because trying to abort an fs.stat call in flight
-  // is unreliable given that file system operations tend to complete very quickly on many platforms.
-  tmpdir.refresh();
+tmpdir.refresh();
+const filePath = tmpdir.resolve('temp.txt');
+fs.writeFileSync(filePath, 'Test');
 
-  const filePath = tmpdir.resolve('temp.txt');
-  fs.writeFileSync(filePath, 'Test');
-
-  // Create an already aborted AbortSignal.
+test('fs.stat aborts when signal is already aborted', async () => {
   const signal = AbortSignal.abort();
-
   const { promise, resolve, reject } = Promise.withResolvers();
   fs.stat(filePath, { signal }, (err, stats) => {
-    if (err) {
-      return reject(err);
-    }
+    if (err) return reject(err);
     resolve(stats);
   });
+  await assert.rejects(promise, { name: 'AbortError' });
+});
 
-  // Assert that the promise is rejected with an AbortError.
+test('fs.stat aborts in-flight when signal aborts after the call', async () => {
+  const controller = new AbortController();
+  const { promise, resolve, reject } = Promise.withResolvers();
+  fs.stat(filePath, { signal: controller.signal }, (err, stats) => {
+    if (err) return reject(err);
+    resolve(stats);
+  });
+  controller.abort();
   await assert.rejects(promise, { name: 'AbortError' });
+});
+
+test('fs.stat throws ERR_INVALID_ARG_TYPE for invalid signal', () => {
+  assert.throws(
+    () => fs.stat(filePath, { signal: 'not-a-signal' }, () => {}),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+});
+
+test('fs.lstat aborts in-flight when signal aborts after the call', async () => {
+  const controller = new AbortController();
+  const { promise, resolve, reject } = Promise.withResolvers();
+  fs.lstat(filePath, { signal: controller.signal }, (err, stats) => {
+    if (err) return reject(err);
+    resolve(stats);
+  });
+  controller.abort();
+  await assert.rejects(promise, { name: 'AbortError' });
+});
+
+test('fs.fstat aborts in-flight when signal aborts after the call', async () => {
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const controller = new AbortController();
+    const { promise, resolve, reject } = Promise.withResolvers();
+    fs.fstat(fd, { signal: controller.signal }, (err, stats) => {
+      if (err) return reject(err);
+      resolve(stats);
+    });
+    controller.abort();
+    await assert.rejects(promise, { name: 'AbortError' });
+  } finally {
+    fs.closeSync(fd);
+  }
+});
+
+test('fsPromises.stat rejects when signal is already aborted', async () => {
+  const signal = AbortSignal.abort();
+  await assert.rejects(fsPromises.stat(filePath, { signal }), { name: 'AbortError' });
+});
+
+test('fsPromises.stat rejects in-flight when signal aborts after the call', async () => {
+  const controller = new AbortController();
+  const p = fsPromises.stat(filePath, { signal: controller.signal });
+  controller.abort();
+  await assert.rejects(p, { name: 'AbortError' });
+});
+
+test('fsPromises.stat rejects with ERR_INVALID_ARG_TYPE for invalid signal', async () => {
+  await assert.rejects(
+    fsPromises.stat(filePath, { signal: 'not-a-signal' }),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+});
+
+test('fsPromises.lstat rejects in-flight when signal aborts after the call', async () => {
+  const controller = new AbortController();
+  const p = fsPromises.lstat(filePath, { signal: controller.signal });
+  controller.abort();
+  await assert.rejects(p, { name: 'AbortError' });
+});
 
-  fs.unlinkSync(filePath);
-  tmpdir.refresh();
+test('filehandle.stat rejects in-flight when signal aborts after the call', async () => {
+  const fh = await fsPromises.open(filePath, 'r');
+  try {
+    const controller = new AbortController();
+    const p = fh.stat({ signal: controller.signal });
+    controller.abort();
+    await assert.rejects(p, { name: 'AbortError' });
+  } finally {
+    await fh.close();
+  }
 });

From 29d794bc843114c18b2a89d16b2093c10b3d62fc Mon Sep 17 00:00:00 2001
From: Ilyas Shabi <ilyasshabi94@gmail.com>
Date: Sun, 23 Aug 2026 22:44:40 +0200
Subject: [PATCH 325/344] src: fix heap value deduplication in embedder graph

Signed-off-by: ishabi <ilyasshabi94@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64801
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 src/heap_utils.cc                         | 40 ++++++++++++-----------
 test/parallel/test-heap-embedder-graph.js | 23 +++++++++++++
 2 files changed, 44 insertions(+), 19 deletions(-)
 create mode 100644 test/parallel/test-heap-embedder-graph.js

diff --git a/src/heap_utils.cc b/src/heap_utils.cc
index e52685546a7a..72c1a73aa6c0 100644
--- a/src/heap_utils.cc
+++ b/src/heap_utils.cc
@@ -57,19 +57,13 @@ class JSGraphJSNode : public EmbedderGraph::Node {
     CHECK(!val.IsEmpty());
   }
 
-  struct Equal {
-    inline bool operator()(JSGraphJSNode* a, JSGraphJSNode* b) const {
-      Local<Data> data_a = a->V8Value();
-      Local<Data> data_b = a->V8Value();
-      if (data_a->IsValue()) {
-        if (!data_b->IsValue()) {
-          return false;
-        }
-        return data_a.As<Value>()->SameValue(data_b.As<Value>());
-      }
-      return data_a == data_b;
+  bool IsSame(Local<Data> other) {
+    Local<Data> value = V8Value();
+    if (value->IsValue() && other->IsValue()) {
+      return value.As<Value>()->SameValue(other.As<Value>());
     }
-  };
+    return value == other;
+  }
 
  private:
   Global<Data> persistent_;
@@ -80,12 +74,15 @@ class JSGraph : public EmbedderGraph {
   explicit JSGraph(Isolate* isolate) : isolate_(isolate) {}
 
   Node* V8Node(const Local<v8::Data>& value) override {
-    std::unique_ptr<JSGraphJSNode> n { new JSGraphJSNode(isolate_, value) };
-    auto it = engine_nodes_.find(n.get());
-    if (it != engine_nodes_.end())
-      return *it;
-    engine_nodes_.insert(n.get());
-    return AddNode(std::unique_ptr<Node>(n.release()));
+    for (JSGraphJSNode* node : engine_nodes_) {
+      if (node->IsSame(value)) {
+        return node;
+      }
+    }
+
+    auto node = std::make_unique<JSGraphJSNode>(isolate_, value);
+    engine_nodes_.push_back(node.get());
+    return AddNode(std::move(node));
   }
 
   Node* V8Node(const Local<v8::Value>& value) override {
@@ -207,7 +204,7 @@ class JSGraph : public EmbedderGraph {
  private:
   Isolate* isolate_;
   std::unordered_set<std::unique_ptr<Node>> nodes_;
-  std::set<JSGraphJSNode*, JSGraphJSNode::Equal> engine_nodes_;
+  std::vector<JSGraphJSNode*> engine_nodes_;
   std::unordered_map<Node*, std::set<std::pair<const char*, Node*>>> edges_;
 };
 
@@ -215,6 +212,11 @@ void BuildEmbedderGraph(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   JSGraph graph(env->isolate());
   Environment::BuildEmbedderGraph(env->isolate(), &graph, env);
+  // This binding is used only by tests. Include supplied values so tests can
+  // verify that JSGraph returns one graph node for each distinct V8 value.
+  for (int i = 0; i < args.Length(); i++) {
+    graph.V8Node(args[i]);
+  }
   Local<Array> ret;
   if (graph.CreateObject().ToLocal(&ret))
     args.GetReturnValue().Set(ret);
diff --git a/test/parallel/test-heap-embedder-graph.js b/test/parallel/test-heap-embedder-graph.js
new file mode 100644
index 000000000000..1873fd1a49ca
--- /dev/null
+++ b/test/parallel/test-heap-embedder-graph.js
@@ -0,0 +1,23 @@
+// Flags: --expose-internals
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { internalBinding } = require('internal/test/binding');
+
+const { buildEmbedderGraph } = internalBinding('heap_utils');
+
+const first = {};
+const second = {};
+const bigint = BigInt('123456789012345678901234567890');
+const sameBigint = BigInt('123456789012345678901234567890');
+const graph = buildEmbedderGraph(first, first, second, bigint, sameBigint);
+
+function findNodes(value) {
+  return graph.filter((node) => Object.hasOwn(node, 'value') &&
+                                Object.is(node.value, value));
+}
+
+assert.strictEqual(findNodes(first).length, 1);
+assert.strictEqual(findNodes(second).length, 1);
+assert.strictEqual(findNodes(bigint).length, 1);

From 0afda47ca4ec03aa35044f3f4ce899d10b55fbc3 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Sun, 23 Aug 2026 14:43:31 -0700
Subject: [PATCH 326/344] stream: prevent share from eagerly draining source

Wait for buffer space after drop-newest discards an upstream result.
This keeps one consumer pull from draining the source or looping
indefinitely while a slower consumer keeps the buffer full.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65338
Fixes: https://github.com/nodejs/node/issues/65337
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/streams/iter/share.js           | 14 +++++
 test/parallel/test-stream-iter-share-from.js | 62 ++++++++++++--------
 2 files changed, 50 insertions(+), 26 deletions(-)

diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 662e57a7df55..711abeb21b9a 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -199,6 +199,9 @@ class ShareImpl {
             }
 
             await self.#pullFromSource(!shouldBuffer);
+            if (!shouldBuffer) {
+              await self.#waitForBufferSpaceAfterDrop();
+            }
           }
         };
 
@@ -317,6 +320,17 @@ class ShareImpl {
     return true;
   }
 
+  async #waitForBufferSpaceAfterDrop() {
+    while (this.#bufferedBytes >= this.#options.budget &&
+           !this.#cancelled &&
+           this.#sourceError === undefined &&
+           !this.#sourceExhausted) {
+      const { promise, resolve } = PromiseWithResolvers();
+      ArrayPrototypePush(this.#pullWaiters, resolve);
+      await promise;
+    }
+  }
+
   #pullFromSource(discard = false) {
     if (this.#sourceExhausted || this.#cancelled) {
       return PromiseResolve();
diff --git a/test/parallel/test-stream-iter-share-from.js b/test/parallel/test-stream-iter-share-from.js
index 0b7e22ee5cee..806e30876302 100644
--- a/test/parallel/test-stream-iter-share-from.js
+++ b/test/parallel/test-stream-iter-share-from.js
@@ -170,40 +170,50 @@ async function testShareDropOldest() {
 }
 
 async function testShareDropNewest() {
-  // With drop-newest and a stalled consumer, the async path allows the
-  // buffer to grow beyond budget (the "drop" applies to the
-  // backpressure signal, not the buffer contents). Both consumers
-  // ultimately see all items.
+  let pulls = 0;
+  let secondPull;
+  const secondPullStarted = new Promise((resolve) => {
+    secondPull = resolve;
+  });
+
   async function* source() {
-    for (let i = 0; i < 4; i++) {
+    for (let i = 0; i < 7; i++) {
+      pulls++;
+      if (pulls === 2) secondPull();
       const chunk = new Uint8Array(16384);
       chunk[0] = i;
       yield [chunk];
     }
   }
-  const shared = share(source(), { budget: 32768, backpressure: 'drop-newest' });
-  const fast = shared.pull();
-  const slow = shared.pull();
+  const shared = share(source(), {
+    budget: 16384,
+    backpressure: 'drop-newest',
+  });
+  const fast = shared.pull()[Symbol.asyncIterator]();
+  const slow = shared.pull()[Symbol.asyncIterator]();
 
-  // Fast consumer reads all items
-  const fastIndices = [];
-  for await (const batch of fast) {
-    for (const chunk of batch) {
-      fastIndices.push(chunk[0]);
-    }
-  }
-  assert.strictEqual(fastIndices.length, 2);
+  const first = await fast.next();
+  assert.strictEqual(first.value[0][0], 0);
 
-  // Slow consumer also sees all items (buffer grew past budget)
-  const slowIndices = [];
-  for await (const batch of slow) {
-    for (const chunk of batch) {
-      slowIndices.push(chunk[0]);
-    }
-  }
-  assert.strictEqual(slowIndices.length, 2);
-  assert.strictEqual(slowIndices[0], 0);
-  assert.strictEqual(slowIndices[1], 1);
+  let nextSettled = false;
+  const next = fast.next().then((result) => {
+    nextSettled = true;
+    return result;
+  });
+
+  await secondPullStarted;
+  await new Promise(setImmediate);
+  assert.strictEqual(pulls, 2);
+  assert.strictEqual(nextSettled, false);
+
+  const slowResult = await slow.next();
+  assert.strictEqual(slowResult.value[0][0], 0);
+
+  const nextResult = await next;
+  assert.strictEqual(nextResult.value[0][0], 2);
+  assert.strictEqual(pulls, 3);
+
+  shared.cancel();
 }
 
 // =============================================================================

From f6448536809991c4c4f06555742c00bf5cac5706 Mon Sep 17 00:00:00 2001
From: Dushyant Singh Hada <dushyanthada90@gmail.com>
Date: Mon, 24 Aug 2026 03:14:23 +0000
Subject: [PATCH 327/344] util: fix OSC 8 hyperlink stripping in
 stripVTControlCharacters

The bundled ansi-regex OSC pattern used a restrictive URI
character class that failed when URIs contained RFC 3986-valid
characters such as parentheses.

Match OSC sequences generically as ESC ] ... ST, aligned with
ansi-regex v6.2.0.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: dushyant <dushyanthada90@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64319
Fixes: https://github.com/nodejs/node/issues/64313
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/util/inspect.js                  | 12 +++++-----
 .../test-util-stripvtcontrolcharacters.js     | 22 +++++++++++++++++++
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index a9e49a65b628..a343e09a0a3b 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -282,16 +282,14 @@ const meta = [
 ];
 
 // Regex used for ansi escape code splitting
-// Ref: https://github.com/chalk/ansi-regex/blob/f338e1814144efb950276aac84135ff86b72dc8e/index.js
+// Ref: https://github.com/chalk/ansi-regex/blob/72bc570aaf25fca25541b49c6a8564f3ec63e835/index.js
 // License: MIT by Sindre Sorhus <sindresorhus@gmail.com>
 // Matches all ansi escape code sequences in a string
 const ansi = new RegExp(
-  '[\\u001B\\u009B][[\\]()#;?]*' +
-  '(?:(?:(?:(?:;[-a-zA-Z\\d\\/\\#&.:=?%@~_]+)*' +
-  '|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/\\#&.:=?%@~_]*)*)?' +
-  '(?:\\u0007|\\u001B\\u005C|\\u009C))' +
-  '|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?' +
-  '[\\dA-PR-TZcf-nq-uy=><~]))', 'g',
+  '(?:\\u001B\\][\\s\\S]*?(?:\\u0007|\\u001B\\u005C|\\u009C))' +
+  '|[\\u001B\\u009B][[\\]()#;?]*' +
+  '(?:\\d{1,4}(?:[;:]\\d{0,4})*)?' +
+  '[\\dA-PR-TZcf-nq-uy=><~]', 'g',
 );
 
 let getStringWidth;
diff --git a/test/parallel/test-util-stripvtcontrolcharacters.js b/test/parallel/test-util-stripvtcontrolcharacters.js
index a33d18d26dbc..efda16687821 100644
--- a/test/parallel/test-util-stripvtcontrolcharacters.js
+++ b/test/parallel/test-util-stripvtcontrolcharacters.js
@@ -18,9 +18,31 @@ for (const ST of ['\u0007', '\u001B\u005C', '\u009C']) {
   tests.push(
     [`\u001B]8;;mailto:no-replay@mail.com${ST}mail\u001B]8;;${ST}`, 'mail'],
     [`\u001B]8;k=v;https://example-a.com/?a_b=1&c=2#tit%20le${ST}click\u001B]8;;${ST}`, 'click'],
+    [`\u001B]8;;https://example.com/(foo${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/foo)bar${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/!foo${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/foo+bar${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/[foo]${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/foo$bar${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/foo'bar${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/foo*bar${ST}label\u001B]8;;${ST}`, 'label'],
+    [`\u001B]8;;https://example.com/foo,bar${ST}label\u001B]8;;${ST}`, 'label'],
   );
 }
 
+// Colon-delimited CSI sub-parameters (SGR) should be stripped like the
+// semicolon-delimited form.
+tests.push(
+  ['\u001B[38:2:255:0:0mHello\u001B[0m', 'Hello'],
+  ['\u001B[4:3mUnderline\u001B[4:0m', 'Underline'],
+);
+
+// Unterminated OSC does not match the OSC alternative; the CSI alternative may
+// still consume a short prefix (here ESC ] 8 ;; h), leaving the remainder.
+tests.push(
+  ['\u001B]8;;https://example.com/no-terminator', 'ttps://example.com/no-terminator'],
+);
+
 test('util.stripVTControlCharacters', (t) => {
   for (const [before, expected] of tests) {
     t.assert.strictEqual(util.stripVTControlCharacters(before), expected);

From bc1e19b4b7892ac1cd7604ce4a8da6655ad891f1 Mon Sep 17 00:00:00 2001
From: Jason Zhang <xzha4350@gmail.com>
Date: Mon, 24 Aug 2026 13:56:04 +0930
Subject: [PATCH 328/344] fs: fix realpath of namespaced drive paths

The JavaScript realpath implementation probes a namespaced drive root
through the fs binding. Windows path resolution drops the trailing
separator from that probe, so lstat receives C: and reports EISDIR.

Use the regular drive-root spelling only for the probe. Preserve the
namespaced spelling for traversal and returned paths.

Signed-off-by: Jason Zhang <xzha4350@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65378
Fixes: https://github.com/nodejs/node/issues/62446
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 lib/fs.js                                     | 20 ++++--
 test/es-module/test-esm-long-path-win.js      | 18 ++++++
 .../test-fs-realpath-namespaced-drive-win.js  | 63 +++++++++++++++++++
 3 files changed, 97 insertions(+), 4 deletions(-)
 create mode 100644 test/parallel/test-fs-realpath-namespaced-drive-win.js

diff --git a/lib/fs.js b/lib/fs.js
index ed6f0c6c86e0..3c0bef6cf506 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -3272,13 +3272,22 @@ function unwatchFile(filename, listener) {
 
 
 let splitRoot;
+let getRealpathRootLstatPath;
 if (isWindows) {
   // Regex to find the device root on Windows (e.g. 'c:\\'), including trailing
   // slash.
   const splitRootRe = /^(?:[a-zA-Z]:|[\\/]{2}[^\\/]+[\\/][^\\/]+)?[\\/]*/;
+  const namespacedDriveRootRe = /^\\\\\?\\([a-zA-Z]:\\)$/;
   splitRoot = function splitRoot(str) {
     return SideEffectFreeRegExpPrototypeExec(splitRootRe, str)[0];
   };
+
+  // The root probe is the only use of this path. Passing a namespaced drive
+  // root to the binding would lose its trailing separator during resolution.
+  getRealpathRootLstatPath = function getRealpathRootLstatPath(path) {
+    const match = SideEffectFreeRegExpPrototypeExec(namespacedDriveRootRe, path);
+    return match === null ? path : match[1];
+  };
 } else {
   splitRoot = function splitRoot(str) {
     for (let i = 0; i < str.length; ++i) {
@@ -3287,6 +3296,7 @@ if (isWindows) {
     }
     return str;
   };
+
 }
 
 function encodeRealpathResult(result, options) {
@@ -3368,7 +3378,8 @@ function realpathSync(p, options) {
 
   // On windows, check that the root exists. On unix there is no need.
   if (isWindows) {
-    const out = binding.lstat(base, false, undefined, true /* throwIfNoEntry */);
+    const out = binding.lstat(
+      getRealpathRootLstatPath(base), false, undefined, true /* throwIfNoEntry */);
     if (out === undefined) {
       return;
     }
@@ -3453,7 +3464,8 @@ function realpathSync(p, options) {
 
     // On windows, check that the root exists. On unix there is no need.
     if (isWindows && !knownHard.has(base)) {
-      const out = binding.lstat(base, false, undefined, true /* throwIfNoEntry */);
+      const out = binding.lstat(
+        getRealpathRootLstatPath(base), false, undefined, true /* throwIfNoEntry */);
       if (out === undefined) {
         return;
       }
@@ -3537,7 +3549,7 @@ function realpath(p, options, callback) {
 
   // On windows, check that the root exists. On unix there is no need.
   if (isWindows && !knownHard.has(base)) {
-    fs.lstat(base, (err) => {
+    fs.lstat(getRealpathRootLstatPath(base), (err) => {
       if (err) return callback(err);
       knownHard.add(base);
       LOOP();
@@ -3626,7 +3638,7 @@ function realpath(p, options, callback) {
 
     // On windows, check that the root exists. On unix there is no need.
     if (isWindows && !knownHard.has(base)) {
-      fs.lstat(base, (err) => {
+      fs.lstat(getRealpathRootLstatPath(base), (err) => {
         if (err) return callback(err);
         knownHard.add(base);
         LOOP();
diff --git a/test/es-module/test-esm-long-path-win.js b/test/es-module/test-esm-long-path-win.js
index d125d341f092..d8aaabcca857 100644
--- a/test/es-module/test-esm-long-path-win.js
+++ b/test/es-module/test-esm-long-path-win.js
@@ -47,6 +47,24 @@ describe('long path on Windows', () => {
     tmpdir.refresh();
   });
 
+  it('runs an extended-length path as the entry point', async () => {
+    // The module loader resolves argv[1] through the JavaScript realpath
+    // implementation before executing it.
+    tmpdir.refresh();
+    const entry = tmpdir.resolve('extended-entry.js');
+    fs.writeFileSync(entry, 'console.log("hello world");');
+
+    const { code, signal, stderr, stdout } = await spawnPromisified(
+      execPath,
+      [path.toNamespacedPath(entry)],
+    );
+
+    assert.strictEqual(stderr, '');
+    assert.strictEqual(stdout.trim(), 'hello world');
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+  });
+
   it('check long path in LegacyMainResolve - 1', () => {
     // Module layout will be the following:
     //  package.json
diff --git a/test/parallel/test-fs-realpath-namespaced-drive-win.js b/test/parallel/test-fs-realpath-namespaced-drive-win.js
new file mode 100644
index 000000000000..eac72eb8dfa2
--- /dev/null
+++ b/test/parallel/test-fs-realpath-namespaced-drive-win.js
@@ -0,0 +1,63 @@
+'use strict';
+
+const common = require('../common');
+if (!common.isWindows) {
+  common.skip('This test is Windows-specific.');
+}
+
+// Verify that the JavaScript realpath implementation accepts namespaced drive
+// paths, including when a junction switches the walk back to a regular drive
+// path, and reports a missing entry instead of treating the drive as a file.
+
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const entry = tmpdir.resolve('entry.js');
+const namespacedEntry = path.toNamespacedPath(entry);
+const namespacedMissing = path.toNamespacedPath(tmpdir.resolve('missing.js'));
+const targetDir = tmpdir.resolve('target');
+const targetEntry = path.join(targetDir, 'entry.js');
+const junctionDir = tmpdir.resolve('junction');
+const namespacedJunctionEntry = path.toNamespacedPath(
+  path.join(junctionDir, 'entry.js'),
+);
+
+fs.writeFileSync(entry, '');
+fs.mkdirSync(targetDir);
+fs.writeFileSync(targetEntry, '');
+fs.symlinkSync(targetDir, junctionDir, 'junction');
+
+function assertNamespacedRealpath(result) {
+  assert.strictEqual(path.toNamespacedPath(result), namespacedEntry);
+}
+
+test('fs.realpathSync resolves a namespaced drive path', () => {
+  assertNamespacedRealpath(fs.realpathSync(namespacedEntry));
+});
+
+test('fs.realpathSync reports ENOENT for a missing namespaced drive path', () => {
+  assert.throws(() => fs.realpathSync(namespacedMissing), { code: 'ENOENT' });
+});
+
+test('fs.realpathSync resolves a namespaced path through a junction', () => {
+  assert.strictEqual(fs.realpathSync(namespacedJunctionEntry), targetEntry);
+});
+
+test('fs.realpath resolves a namespaced drive path', (t, done) => {
+  fs.realpath(namespacedEntry, common.mustSucceed((result) => {
+    assertNamespacedRealpath(result);
+    done();
+  }));
+});
+
+test('fs.realpath resolves a namespaced path through a junction', (t, done) => {
+  fs.realpath(namespacedJunctionEntry, common.mustSucceed((result) => {
+    assert.strictEqual(result, targetEntry);
+    done();
+  }));
+});

From e3ae912e9a085d526d533af5e638ffdcf9e54891 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Mon, 24 Aug 2026 09:43:57 +0200
Subject: [PATCH 329/344] fs: use sized reads for large files in readFileUtf8

fs.readFileSync(path, 'utf8') read the whole file in 8 KiB read() calls
appended to a std::string, i.e. one syscall and a potential
reallocation per 8 KiB (an 8 MiB file took ~1400 read() calls).

Keep the exact old sequence for small files (one read into the 8 KiB
stack buffer, one read reporting EOF). Once a read fills the stack
buffer, read the rest directly into one heap buffer sized from fstat()
(plus one byte so that the EOF read does not force growth), growing
geometrically only when the size is unavailable or wrong. The size is
only an allocation hint: reading continues until read() reports EOF,
so procfs/sysfs files, FIFOs, files that change while being read and
file descriptors positioned mid-file behave as before, and the bytes
handed to StringBytes::Encode() are exactly the ones read.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65328
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 src/node_file.cc                              | 64 +++++++++++-
 .../test-fs-readfilesync-utf8-sizes.js        | 98 +++++++++++++++++++
 2 files changed, 160 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-fs-readfilesync-utf8-sizes.js

diff --git a/src/node_file.cc b/src/node_file.cc
index 871d8f16bd34..b2e765346cf1 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -2931,10 +2931,20 @@ static void ReadFileUtf8(const FunctionCallbackInfo<Value>& args) {
     uv_fs_req_cleanup(&req);
   });
 
+  // Past the first 8 KiB, read into one heap buffer sized from fstat(); the
+  // size is only a hint, reading continues until read() reports EOF.
   std::string result{};
   char buffer[8192];
   uv_buf_t buf = uv_buf_init(buffer, sizeof(buffer));
 
+  char* big = nullptr;
+  size_t big_len = 0;
+  size_t big_cap = 0;
+  bool sized = false;
+  auto free_big = OnScopeLeave([&big]() { free(big); });
+  constexpr size_t kMinChunk = 64 * 1024;
+  constexpr size_t kMaxChunk = 8 * 1024 * 1024;
+
   FS_SYNC_TRACE_BEGIN(read);
   while (true) {
     auto r = uv_fs_read(nullptr, &req, file, &buf, 1, -1, nullptr);
@@ -2947,12 +2957,62 @@ static void ReadFileUtf8(const FunctionCallbackInfo<Value>& args) {
     if (r <= 0) {
       break;
     }
-    result.append(buf.base, r);
+    if (big == nullptr) {
+      result.append(buf.base, r);
+      if (static_cast<size_t>(r) < sizeof(buffer)) {
+        continue;
+      }
+      // Switch to the heap buffer.
+      uv_fs_req_cleanup(&req);
+      big_cap = kMinChunk;
+      big = UncheckedMalloc<char>(big_cap);
+      if (big == nullptr) {
+        FS_SYNC_TRACE_END(read);
+        return THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+      }
+      memcpy(big, result.data(), result.size());
+      big_len = result.size();
+      result = std::string();
+    } else {
+      big_len += static_cast<size_t>(r);
+    }
+    if (big_len == big_cap) {
+      // +1 leaves room for the read() that reports EOF.
+      size_t new_cap =
+          big_cap + std::min(kMaxChunk, std::max(kMinChunk, big_cap));
+      if (!sized) {
+        sized = true;
+        uv_fs_req_cleanup(&req);
+        uv_fs_t stat_req;
+        if (uv_fs_fstat(nullptr, &stat_req, file, nullptr) == 0) {
+          const uv_stat_t* const st =
+              static_cast<const uv_stat_t*>(stat_req.ptr);
+          if ((st->st_mode & S_IFMT) == S_IFREG &&
+              static_cast<uint64_t>(st->st_size) > big_len &&
+              static_cast<uint64_t>(st->st_size) <
+                  static_cast<uint64_t>(v8::String::kMaxLength)) {
+            new_cap = static_cast<size_t>(st->st_size) + 1;
+          }
+        }
+        uv_fs_req_cleanup(&stat_req);
+      }
+      char* const grown = UncheckedRealloc<char>(big, new_cap);
+      if (grown == nullptr) {
+        FS_SYNC_TRACE_END(read);
+        return THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+      }
+      big = grown;
+      big_cap = new_cap;
+    }
+    buf = uv_buf_init(big + big_len, std::min(kMaxChunk, big_cap - big_len));
   }
   FS_SYNC_TRACE_END(read);
 
   Local<Value> val;
-  if (!ToV8Value(env->context(), result, isolate).ToLocal(&val)) {
+  const std::string_view content = big != nullptr
+                                       ? std::string_view(big, big_len)
+                                       : std::string_view(result);
+  if (!ToV8Value(env->context(), content, isolate).ToLocal(&val)) {
     return;
   }
 
diff --git a/test/parallel/test-fs-readfilesync-utf8-sizes.js b/test/parallel/test-fs-readfilesync-utf8-sizes.js
new file mode 100644
index 000000000000..ac8670836d44
--- /dev/null
+++ b/test/parallel/test-fs-readfilesync-utf8-sizes.js
@@ -0,0 +1,98 @@
+'use strict';
+// fs.readFileSync(path, 'utf8') takes a dedicated native path. Its result must
+// equal fs.readFileSync(path).toString('utf8') for every file size (in
+// particular around its internal 8 KiB stack buffer and for multi-megabyte
+// files), for file descriptors positioned mid-file, and for files whose
+// reported size is wrong (procfs reports 0, sysfs reports a page).
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+
+tmpdir.refresh();
+
+function content(size) {
+  // Multi-byte characters straddling every possible chunk boundary.
+  const unit = 'abcdé€\u{1F600}\n';
+  let s = unit.repeat(Math.ceil(size / unit.length));
+  s = s.slice(0, size);
+  // Avoid ending on a lone surrogate produced by slice().
+  if (/[\ud800-\udbff]$/.test(s)) s = s.slice(0, -1) + 'x';
+  return s;
+}
+
+const sizes = [0, 1, 8190, 8191, 8192, 8193, 8194, 16383, 16384, 16385,
+               65535, 65536, 65537, 100000, (1 << 20) - 1, 1 << 20, (1 << 20) + 1,
+               (8 << 20) + 5];
+for (const size of sizes) {
+  const file = tmpdir.resolve(`f-${size}.txt`);
+  const str = content(size);
+  fs.writeFileSync(file, str);
+  const expected = fs.readFileSync(file).toString('utf8');
+  assert.strictEqual(fs.readFileSync(file, 'utf8'), expected, `size ${size} by path`);
+  assert.strictEqual(fs.readFileSync(file, { encoding: 'utf-8' }), expected, `size ${size} utf-8 alias`);
+  // By fd: from the start (leaves the fd at EOF), then at EOF, then from a
+  // mid-file position on a fresh fd.
+  let fd = fs.openSync(file, 'r');
+  try {
+    assert.strictEqual(fs.readFileSync(fd, 'utf8'), expected, `size ${size} by fd`);
+    assert.strictEqual(fs.readFileSync(fd, 'utf8'), '', `size ${size} by fd at EOF`);
+  } finally {
+    fs.closeSync(fd);
+  }
+  if (size > 10) {
+    fd = fs.openSync(file, 'r');
+    try {
+      // Advance the fd 3 bytes (inside the ASCII prefix, so still valid UTF-8).
+      assert.strictEqual(fs.readSync(fd, Buffer.alloc(3), 0, 3, null), 3);
+      assert.strictEqual(fs.readFileSync(fd, 'utf8'), Buffer.from(expected).subarray(3).toString('utf8'),
+                         `size ${size} by fd at offset 3`);
+    } finally {
+      fs.closeSync(fd);
+    }
+  }
+}
+
+// Binary garbage is decoded with replacement characters identically.
+{
+  const file = tmpdir.resolve('binary.bin');
+  const buf = Buffer.alloc(20000);
+  for (let i = 0; i < buf.length; i++) buf[i] = (i * 7919) & 0xff;
+  fs.writeFileSync(file, buf);
+  assert.strictEqual(fs.readFileSync(file, 'utf8'), buf.toString('utf8'));
+}
+
+// Files whose st_size does not describe their content.
+if (common.isLinux) {
+  for (const file of ['/proc/self/status', '/proc/self/smaps', '/proc/cpuinfo',
+                      '/proc/version', '/sys/kernel/mm/transparent_hugepage/enabled']) {
+    let viaBuffer;
+    try {
+      viaBuffer = fs.readFileSync(file);
+    } catch {
+      continue;  // Not available in this environment.
+    }
+    const viaUtf8 = fs.readFileSync(file, 'utf8');
+    if (file !== '/proc/version' && file.startsWith('/proc/')) {
+      // Content legitimately differs between two reads; compare shape instead.
+      assert.ok(viaUtf8.length > 0);
+      assert.strictEqual(viaUtf8.split('\n').length > 5, true, file);
+      // Of these, smaps reliably exceeds the 8 KiB stack buffer.
+      if (file === '/proc/self/smaps') assert.ok(viaUtf8.length > 8192, `smaps is only ${viaUtf8.length} chars`);
+    } else {
+      assert.strictEqual(viaUtf8, viaBuffer.toString('utf8'), file);
+    }
+  }
+}
+
+// Directory: same outcome either way (EISDIR, except on platforms where
+// read() accepts directories, e.g. AIX).
+function outcome(read) {
+  try {
+    return read();
+  } catch (err) {
+    return err.code;
+  }
+}
+assert.strictEqual(outcome(() => fs.readFileSync(tmpdir.path, 'utf8')),
+                   outcome(() => fs.readFileSync(tmpdir.path).toString('utf8')));

From 6409983a6c153a4aba420bfc877aab88c0ee410c Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 24 Aug 2026 05:54:03 -0400
Subject: [PATCH 330/344] test: update WPT for WebCryptoAPI to e235e089b4

PR-URL: https://github.com/nodejs/node/pull/65478
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 .../WebCryptoAPI/derive_bits_keys/derive.js   |   2 +-
 .../derive_bits_keys/derived_bits_length.js   |   8 +-
 .../derived_bits_length_testcases.js          |  35 ++-
 .../wpt/WebCryptoAPI/derive_bits_keys/ecdh.js |   1 +
 .../wpt/WebCryptoAPI/generateKey/failures.js  |  11 +-
 .../supports-modern.tentative.https.any.js    |  64 +++++
 .../supports.tentative.https.any.js           | 233 +++++++++++++++++-
 .../wpt/WebCryptoAPI/util/supports.js         |   7 +-
 test/fixtures/wpt/versions.json               |   2 +-
 test/wpt/status/WebCryptoAPI.cjs              |   7 +-
 test/wpt/test-webcrypto.js                    |  31 +--
 11 files changed, 338 insertions(+), 63 deletions(-)

diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
index 16c9ec6407bb..ce2010771aac 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
@@ -102,7 +102,7 @@ function registerDeriveTests(options) {
         failureTest(
             test.name,
             "InvalidAccessError",
-            () => derive(algorithmName, test.key, privateKey)
+            () => derive(algorithmName, test.key, privateKey, test.length)
         );
     });
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js
index 5a7ed7eb50a0..39b4ddce7fa8 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js
@@ -17,16 +17,16 @@ function define_tests() {
                         derivedBits = await subtle.deriveBits(testData.deriveAlg, privateKey);
                     else
                         derivedBits = await subtle.deriveBits(testData.deriveAlg, privateKey, testParam.length);
-                    if (testParam.expected === undefined) {
-                        assert_unreached("deriveBits should have thrown an OperationError exception.");
+                    if (testParam.expected === "TypeError" || testParam.expected === "OperationError") {
+                        assert_unreached("deriveBits should have thrown an " + testParam.expected + " exception.");
                     }
                     assert_array_equals(new Uint8Array(derivedBits), testParam.expected, "Derived bits do not match the expected result.");
                 } catch (err) {
-                    if (err instanceof AssertionError || testParam.expected !== undefined) {
+                    if (err instanceof AssertionError || !(testParam.expected === "TypeError" || testParam.expected === "OperationError")) {
                         throw err;
                     }
                     assert_true(privateKey !== undefined, "Key should be valid.");
-                    assert_equals(err.name, "OperationError", "deriveBits correctly threw OperationError: " + err.message);
+                    assert_equals(err.name, testParam.expected, "deriveBits correctly threw " + testParam.expected + ": " + err.message);
                 }
             }, algorithm + " derivation with " + testParam.length + " as 'length' parameter");
         });
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js
index 2679fa79e2a0..e368ac86697a 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js
@@ -1,38 +1,49 @@
+var enforceRangeTestCases = [
+    // These cases should throw an error in all algorithms due to [EnforceRange]
+    {length: NaN, expected: "TypeError"},
+    {length: Infinity, expected: "TypeError"},
+    {length: -8, expected: "TypeError"},
+    {length: 2**32 + 8, expected: "TypeError"},
+];
 var testCases = {
     "HKDF": [
         {length: 256, expected: algorithms["HKDF"].derivation},
         {length: 384, expected: algorithms["HKDF"].derivation384},
-        {length: 230, expected: undefined}, // should throw an exception, not multiple of 8
+        {length: 230, expected: "OperationError"}, // should throw an exception, not multiple of 8
         {length: 0, expected: emptyArray},
-        {length: null, expected: undefined }, // should throw an exception
-        {length: undefined, expected: undefined }, // should throw an exception
-        {length: "omitted", expected: undefined }, // default value is null, so should throw
+        {length: null, expected: "OperationError"}, // should throw an exception
+        {length: undefined, expected: "OperationError"}, // should throw an exception
+        {length: "omitted", expected: "OperationError"}, // default value is null, so should throw
+        ...enforceRangeTestCases,
     ],
     "PBKDF2": [
         {length: 256, expected: algorithms["PBKDF2"].derivation},
         {length: 384, expected: algorithms["PBKDF2"].derivation384},
-        {length: 230, expected: undefined}, // should throw an exception, not multiple of 8
+        {length: 230, expected: "OperationError"}, // should throw an exception, not multiple of 8
         {length: 0, expected: emptyArray},
-        {length: null, expected: undefined }, // should throw an exception
-        {length: undefined, expected: undefined }, // should throw an exception
-        {length: "omitted", expected: undefined }, // default value is null, so should throw
+        {length: null, expected: "OperationError"}, // should throw an exception
+        {length: undefined, expected: "OperationError"}, // should throw an exception
+        {length: "omitted", expected: "OperationError"}, // default value is null, so should throw
+        ...enforceRangeTestCases,
     ],
     "ECDH": [
         {length: 256, expected: algorithms["ECDH"].derivation},
-        {length: 384, expected: undefined}, // should throw an exception, bigger than the output size
+        {length: 384, expected: "OperationError"}, // should throw an exception, bigger than the output size
         {length: 230, expected: algorithms["ECDH"].derivation230},
         {length: 0, expected: emptyArray},
         {length: null, expected: algorithms["ECDH"].derivation},
         {length: undefined, expected: algorithms["ECDH"].derivation},
-        {length: "omitted", expected: algorithms["ECDH"].derivation }, // default value is null
+        {length: "omitted", expected: algorithms["ECDH"].derivation}, // default value is null
+        ...enforceRangeTestCases,
     ],
     "X25519": [
         {length: 256, expected: algorithms["X25519"].derivation},
-        {length: 384, expected: undefined}, // should throw an exception, bigger than the output size
+        {length: 384, expected: "OperationError"}, // should throw an exception, bigger than the output size
         {length: 230, expected: algorithms["X25519"].derivation230},
         {length: 0, expected: emptyArray},
         {length: null, expected: algorithms["X25519"].derivation},
         {length: undefined, expected: algorithms["X25519"].derivation},
-        {length: "omitted", expected: algorithms["X25519"].derivation }, // default value is null
+        {length: "omitted", expected: algorithms["X25519"].derivation}, // default value is null
+        ...enforceRangeTestCases,
     ],
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
index 99039f250c2c..cfb5b8701115 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
@@ -66,6 +66,7 @@ async function defineEcdhTests(operation) {
                 {
                     name: namedCurve + " mismatched curves",
                     key: keys[otherCurve].publicKey,
+                    length: 256,
                 },
                 {
                     name: namedCurve +
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
index e4a75c065152..8aa47b66d1a6 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
@@ -101,13 +101,19 @@ function run_test(algorithmNames) {
 
         if (algorithmName.toUpperCase().substring(0, 3) === "AES") {
             // Specifier properties are name and length
-            [64, 127, 129, 255, 257, 512].forEach(function(length) {
+            [64, 127, 129, 255, 257, 512, 128 + 2**32, 128 - 2**32].forEach(function(length) {
                 results.push({name: algorithmName, length: length});
             });
+        } else if (algorithmName.toUpperCase() === "HMAC") {
+            [128 + 2**32, 128 - 2**32].forEach(function(length) {
+                results.push({name: algorithmName, hash: "SHA-256", length: length});
+            });
         } else if (algorithmName.toUpperCase().substring(0, 3) === "RSA") {
             [new Uint8Array([1]), new Uint8Array([1,0,0])].forEach(function(publicExponent) {
                 results.push({name: algorithmName, hash: "SHA-256", modulusLength: 1024, publicExponent: publicExponent});
             });
+            results.push({name: algorithmName, hash: "SHA-256", modulusLength: 1024 + 2 ** 32, publicExponent: new Uint8Array([1,0,1])});
+            results.push({name: algorithmName, hash: "SHA-256", modulusLength: 1024 - 2 ** 32, publicExponent: new Uint8Array([1,0,1])});
         } else if (algorithmName.toUpperCase().substring(0, 2) === "EC") {
             ["P-512", "Curve25519"].forEach(function(curveName) {
                 results.push({name: algorithmName, namedCurve: curveName});
@@ -177,6 +183,9 @@ function run_test(algorithmNames) {
                 [false, true].forEach(function(extractable) {
                     if (name.substring(0,2) === "EC") {
                         testError(algorithm, extractable, usages, "NotSupportedError", "Bad algorithm property");
+                    } else if (name.substring(0,3) === "RSA" && (algorithm.modulusLength < 0 || algorithm.modulusLength > 2**32) ||
+                        (name.substring(0,3) === "AES" || name === "HMAC") && (algorithm.length < 0 || algorithm.length > 2**32)) {
+                        testError(algorithm, extractable, usages, "TypeError", "Bad algorithm property");
                     } else {
                         testError(algorithm, extractable, usages, "OperationError", "Bad algorithm property");
                     }
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
index 97cf9dff48ae..a8f730e9bfc4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
@@ -65,6 +65,70 @@ testSupportsMethod();
 // Test standard WebCrypto algorithms for requested operations
 runSupportsTests(modernAlgorithms, operations);
 
+['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87'].forEach(name => {
+  ['sign', 'verify'].forEach(operation => {
+    test(() => {
+      assert_true(
+        SubtleCrypto.supports(operation, {
+          name,
+          context: new Uint8Array(255),
+        }),
+        `${name} ${operation} supports a 255-byte context`
+      );
+      assert_false(
+        SubtleCrypto.supports(operation, {
+          name,
+          context: new Uint8Array(256),
+        }),
+        `${name} ${operation} rejects a 256-byte context`
+      );
+    }, `supports validates ${name} ${operation} context length`);
+  });
+});
+
+const mlKemImportedKeyCases = [
+  {
+    description: 'a matching HMAC length',
+    additionalAlgorithm: {name: 'HMAC', hash: 'SHA-256', length: 256},
+    expected: true,
+  },
+  {
+    description: 'an algorithm without raw-secret import',
+    additionalAlgorithm: 'Ed25519',
+    expected: false,
+  },
+  {
+    description: 'an HMAC length shorter than the shared secret',
+    additionalAlgorithm: {name: 'HMAC', hash: 'SHA-256', length: 128},
+    expected: false,
+  },
+  {
+    description: 'an HMAC length longer than the shared secret',
+    additionalAlgorithm: {name: 'HMAC', hash: 'SHA-256', length: 512},
+    expected: false,
+  },
+];
+
+['encapsulateKey', 'decapsulateKey'].forEach(operation => {
+  mlKemImportedKeyCases.forEach(({
+    description,
+    additionalAlgorithm,
+    expected,
+  }) => {
+    test(() => {
+      assert_equals(
+        SubtleCrypto.supports(
+          operation,
+          'ML-KEM-768',
+          additionalAlgorithm
+        ),
+        expected,
+        `ML-KEM-768 ${operation} with ${description}`
+      );
+    }, `supports ${operation} with ${description}`);
+  });
+});
+
 // Test some algorithm objects with valid parameters
 test(() => {
   assert_true(
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
index fcccbecd6916..294c961a7f02 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
@@ -49,13 +49,10 @@ const standardAlgorithms = {
     operations: ['generateKey', 'importKey', 'deriveBits', 'getPublicKey'],
     keyGenParams: { name: 'ECDH', namedCurve: 'P-256' },
     importParams: { name: 'ECDH', namedCurve: 'P-256' },
-    deriveBitsParams: {
-      name: 'ECDH',
-      public: crypto.subtle.generateKey(
-        { name: 'ECDH', namedCurve: 'P-256' },
-        false,
-        ['deriveBits']
-      ),
+    deriveBitsParamsFactory: async () => {
+      const {publicKey} = await crypto.subtle.generateKey(
+        {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']);
+      return {name: 'ECDH', public: publicKey};
     },
   },
   Ed25519: {
@@ -66,9 +63,10 @@ const standardAlgorithms = {
   X25519: {
     operations: ['generateKey', 'importKey', 'deriveBits', 'getPublicKey'],
     keyGenParams: null,
-    deriveBitsParams: {
-      name: 'X25519',
-      public: crypto.subtle.generateKey('X25519', false, ['deriveBits']),
+    deriveBitsParamsFactory: async () => {
+      const {publicKey} = await crypto.subtle.generateKey(
+        'X25519', false, ['deriveBits']);
+      return {name: 'X25519', public: publicKey};
     },
   },
 
@@ -247,6 +245,13 @@ test(() => {
         tagLength: 100,
       }),
       'Invalid tag length for AES-GCM should return false');
+  assert_false(
+      SubtleCrypto.supports('decrypt', {
+        name: 'AES-GCM',
+        iv: new Uint8Array(16),
+        tagLength: 100,
+      }),
+      'Invalid tag length for AES-GCM should return false');
   assert_false(
       SubtleCrypto.supports('generateKey', {name: 'ECDH', namedCurve: 'P-51'}),
       'Invalid curve for ECDH should return false');
@@ -348,6 +353,214 @@ test(() => {
 
 }, 'supports returns false for algorithm objects with invalid parameters');
 
+[
+  ['SHA-1', 160],
+  ['SHA-256', 256],
+  ['SHA-384', 384],
+  ['SHA-512', 512],
+].forEach(([hash, hashLength]) => {
+  test(() => {
+    const algorithm = {
+      name: 'HKDF',
+      hash,
+      salt: new Uint8Array(),
+      info: new Uint8Array(),
+    };
+    const maximumLength = 255 * hashLength;
+
+    assert_true(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength),
+      `HKDF with ${hash} supports its maximum output length`
+    );
+    assert_false(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength + 8),
+      `HKDF with ${hash} rejects output longer than its maximum`
+    );
+  }, `supports validates HKDF ${hash} output length`);
+});
+
+test(() => {
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveKey',
+      {
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: new Uint8Array(),
+        info: new Uint8Array(),
+      },
+      {name: 'HMAC', hash: 'SHA-256', length: 65288}
+    ),
+    'HKDF rejects a derived key longer than 255 hash blocks'
+  );
+}, 'supports validates HKDF output length for deriveKey');
+
+test(() => {
+  assert_false(
+    SubtleCrypto.supports('importKey', {
+      name: 'HMAC',
+      hash: 'SHA-256',
+      length: 0,
+    }),
+    'HMAC rejects an explicitly zero-length imported key'
+  );
+}, 'supports validates HMAC import length');
+
+const invalidRsaKeyGenParameters = [
+  {
+    description: 'a modulus shorter than 4 bits',
+    modulusLength: 3,
+    publicExponent: Uint8Array.of(3),
+  },
+  {
+    description: 'a public exponent less than 3',
+    modulusLength: 2048,
+    publicExponent: Uint8Array.of(1),
+  },
+  {
+    description: 'an even public exponent',
+    modulusLength: 2048,
+    publicExponent: Uint8Array.of(4),
+  },
+  {
+    description: 'a public exponent equal to 2^modulusLength - 1',
+    modulusLength: 2048,
+    publicExponent: new Uint8Array(256).fill(0xff),
+  },
+];
+
+[
+  'RSASSA-PKCS1-v1_5',
+  'RSA-PSS',
+  'RSA-OAEP',
+].forEach(name => {
+  invalidRsaKeyGenParameters.forEach(({description, ...parameters}) => {
+    test(() => {
+      assert_false(
+        SubtleCrypto.supports('generateKey', {
+          name,
+          ...parameters,
+          hash: 'SHA-256',
+        }),
+        `${name} rejects ${description}`
+      );
+    }, `supports rejects ${name} generateKey with ${description}`);
+  });
+});
+
+['ECDSA', 'ECDH'].forEach(name => {
+  test(() => {
+    assert_false(
+      SubtleCrypto.supports('importKey', {
+        name,
+        namedCurve: 'not-a-curve',
+      }),
+      `${name} rejects an unknown named curve`
+    );
+  }, `supports validates ${name} import namedCurve`);
+});
+
+[
+  ['P-256', 256],
+  ['P-384', 384],
+  ['P-521', 528],
+].forEach(([namedCurve, maximumLength]) => {
+  promise_test(async () => {
+    const {publicKey} = await crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve}, false, ['deriveBits']);
+    const algorithm = {name: 'ECDH', public: publicKey};
+
+    assert_true(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength),
+      `ECDH ${namedCurve} supports its maximum output length`
+    );
+    assert_false(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength + 1),
+      `ECDH ${namedCurve} rejects output longer than its maximum`
+    );
+  }, `supports validates ECDH ${namedCurve} deriveBits length`);
+});
+
+promise_test(async () => {
+  const {publicKey} = await crypto.subtle.generateKey(
+    'X25519', false, ['deriveBits']);
+  const algorithm = {name: 'X25519', public: publicKey};
+
+  assert_true(
+    SubtleCrypto.supports('deriveBits', algorithm, 256),
+    'X25519 supports its maximum output length'
+  );
+  assert_false(
+    SubtleCrypto.supports('deriveBits', algorithm, 257),
+    'X25519 rejects output longer than its maximum'
+  );
+}, 'supports validates X25519 deriveBits length');
+
+promise_test(async () => {
+  const [ecdhKeyPair, x25519KeyPair] = await Promise.all([
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']),
+    crypto.subtle.generateKey('X25519', false, ['deriveBits']),
+  ]);
+
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'ECDH', public: ecdhKeyPair.privateKey}, 256),
+    'ECDH rejects a private public property'
+  );
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'ECDH', public: x25519KeyPair.publicKey}, 256),
+    'ECDH rejects a public property for another algorithm'
+  );
+}, 'supports validates the ECDH public key');
+
+promise_test(async () => {
+  const [x25519KeyPair, ecdhKeyPair] = await Promise.all([
+    crypto.subtle.generateKey('X25519', false, ['deriveBits']),
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']),
+  ]);
+
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'X25519', public: x25519KeyPair.privateKey}, 256),
+    'X25519 rejects a private public property'
+  );
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'X25519', public: ecdhKeyPair.publicKey}, 256),
+    'X25519 rejects a public property for another algorithm'
+  );
+}, 'supports validates the X25519 public key');
+
+promise_test(async () => {
+  const [p256KeyPair, p521KeyPair] = await Promise.all([
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']),
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-521'}, false, ['deriveBits']),
+  ]);
+  const derivedKeyAlgorithm = {name: 'HMAC', hash: 'SHA-256'};
+
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveKey',
+      {name: 'ECDH', public: p256KeyPair.publicKey},
+      derivedKeyAlgorithm
+    ),
+    'ECDH P-256 cannot derive a 512-bit HMAC key'
+  );
+  assert_true(
+    SubtleCrypto.supports(
+      'deriveKey',
+      {name: 'ECDH', public: p521KeyPair.publicKey},
+      derivedKeyAlgorithm
+    ),
+    'ECDH P-521 can derive a 512-bit HMAC key'
+  );
+}, 'supports derives the ECDH output limit from the public curve');
+
 // Test some specific combinations that should work
 test(() => {
   // RSA algorithms
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/supports.js b/test/fixtures/wpt/WebCryptoAPI/util/supports.js
index 18442424f4a2..d41e38e96f94 100644
--- a/test/fixtures/wpt/WebCryptoAPI/util/supports.js
+++ b/test/fixtures/wpt/WebCryptoAPI/util/supports.js
@@ -33,10 +33,9 @@ function runSupportsTests(algorithms, operations) {
             algorithm = algorithmInfo.encryptParams || algorithmName;
             break;
           case 'deriveBits':
-            algorithm = algorithmInfo.deriveBitsParams || algorithmName;
-            if (algorithm?.public instanceof Promise) {
-              algorithm.public = (await algorithm.public).publicKey;
-            }
+            algorithm = algorithmInfo.deriveBitsParamsFactory ?
+              await algorithmInfo.deriveBitsParamsFactory() :
+              algorithmInfo.deriveBitsParams || algorithmName;
             if (algorithmName === 'PBKDF2' || algorithmName === 'HKDF') {
               lengthOrAdditionalAlgorithm = 256;
             }
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index b659c868d498..e04c397be444 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -96,7 +96,7 @@
     "path": "web-locks"
   },
   "WebCryptoAPI": {
-    "commit": "4c2fd05ed5d0b90a9e1fcdcb35f6671bd461de0d",
+    "commit": "e235e089b4e44a598f2d61e93732e0c4d9f03e04",
     "path": "WebCryptoAPI"
   },
   "webidl": {
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index ae73e17f5bb9..095be39151ef 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -65,7 +65,10 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
 
   skipSubtests(
     ['getPublicKey.tentative.https.any.js', /ml-(?:kem|dsa)/i],
-    ['supports-modern.tentative.https.any.js', /ml-(?:kem|dsa)/i]);
+    [
+      'supports-modern.tentative.https.any.js',
+      /(?:ml-(?:kem|dsa)|(?:en|de)capsulateKey)/i,
+    ]);
 }
 
 if (process.features.openssl_is_boringssl) {
@@ -161,7 +164,7 @@ if (hasFIPS(3, 5)) {
     ],
     [
       'supports.tentative.https.any.js',
-      /(?:X25519|^deriveKey promise tests$)/,
+      /(?:X25519|^deriveKey promise tests|^supports validates the ECDH public key$)/,
     ],
     [
       'wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js',
diff --git a/test/wpt/test-webcrypto.js b/test/wpt/test-webcrypto.js
index 0828047b3799..409b94451ba1 100644
--- a/test/wpt/test-webcrypto.js
+++ b/test/wpt/test-webcrypto.js
@@ -4,38 +4,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { join } = require('node:path');
-const { hasFIPS } = require('../common/crypto');
 const { WPTRunner } = require('../common/wpt');
 
 const runner = new WPTRunner('WebCryptoAPI');
 
-runner.pretendGlobalThisAs('Window');
-
-if (hasFIPS(3, 5)) {
-  const supportsFile = join(
-    'WebCryptoAPI',
-    'supports.tentative.https.any.js');
-  const eagerX25519Key = `    deriveBitsParams: {
-      name: 'X25519',
-      public: crypto.subtle.generateKey('X25519', false, ['deriveBits']),
-    },`;
-  const unavailableX25519Key = `    deriveBitsParams: {
-      name: 'X25519',
-      public: undefined,
-    },`;
-  runner.setScriptModifier((script) => {
-    if (!script.filename.endsWith(supportsFile))
-      return;
+// Experimental warnings drown out the actual test output.
+runner.setFlags(['--disable-warning=ExperimentalWarning']);
 
-    const fragments = script.code.split(eagerX25519Key);
-    if (fragments.length !== 2) {
-      throw new Error(
-        `Expected exactly one eager X25519 key in ${script.filename}; ` +
-        `found ${fragments.length - 1}`);
-    }
-    script.code = fragments.join(unavailableX25519Key);
-  });
-}
+runner.pretendGlobalThisAs('Window');
 
 runner.runJsTests();

From c2c31d69fd14549bb9dd7300a66b4d76307c39ac Mon Sep 17 00:00:00 2001
From: Tim Perry <1526883+pimterry@users.noreply.github.com>
Date: Mon, 24 Aug 2026 10:54:15 +0100
Subject: [PATCH 331/344] http: improve performance with known-length calls to
 end()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This boosts RPS performance for the common API case where you call
`res.end(data)` with the entire response by up to 9%.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65466
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/http/end-string.js                  | 35 +++++++++++++
 lib/_http_outgoing.js                         | 51 ++++++++++++++++---
 .../test-http-server-response-standalone.js   | 11 +---
 3 files changed, 80 insertions(+), 17 deletions(-)
 create mode 100644 benchmark/http/end-string.js

diff --git a/benchmark/http/end-string.js b/benchmark/http/end-string.js
new file mode 100644
index 000000000000..9c5c6afc5869
--- /dev/null
+++ b/benchmark/http/end-string.js
@@ -0,0 +1,35 @@
+// Responses sent as a single res.end(string) with a known Content-Length -
+// the shape a JSON or HTML endpoint produces.
+'use strict';
+
+const common = require('../common.js');
+
+const bench = common.createBenchmark(main, {
+  len: [4, 64, 1024, 16384, 102400],
+  c: [50],
+  duration: 5,
+});
+
+function main({ len, c, duration }) {
+  const http = require('http');
+  const body = 'a'.repeat(len);
+  const headers = {
+    'Content-Type': 'text/plain',
+    'Content-Length': `${len}`,
+  };
+
+  const server = http.createServer((req, res) => {
+    res.writeHead(200, headers);
+    res.end(body);
+  });
+
+  server.listen(0, () => {
+    bench.http({
+      connections: c,
+      duration,
+      port: server.address().port,
+    }, () => {
+      server.close();
+    });
+  });
+}
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index b266cf49971e..23e2856e0b99 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -1026,6 +1026,25 @@ function write_(msg, chunk, encoding, callback, fromEnd) {
 }
 
 
+// If this last write can be delivered immediately as the final chunk, this
+// prepares to do so, and then returns true. If not, it returns false and
+// a separate _send call and tick will be required to finish up.
+function maybePrepareFinalChunk(msg, chunk, encoding) {
+  if (typeof chunk !== 'string' && !isUint8Array(chunk))
+    return false;
+
+  if (msg.destroyed || msg.strictContentLength)
+    return false;
+
+  if (!msg._header) {
+    msg._contentLength = typeof chunk === 'string' ?
+      Buffer.byteLength(chunk, encoding) : chunk.byteLength;
+    msg._implicitHeader();
+  }
+
+  return !!msg._header && msg._hasBody && !msg.chunkedEncoding;
+}
+
 function connectionCorkNT(conn) {
   conn.uncork();
 }
@@ -1131,6 +1150,8 @@ OutgoingMessage.prototype.end = function end(chunk, encoding, callback) {
     encoding = null;
   }
 
+  let finishCallback = null;
+
   if (chunk) {
     if (this.finished) {
       onError(this,
@@ -1143,7 +1164,18 @@ OutgoingMessage.prototype.end = function end(chunk, encoding, callback) {
       this[kSocket].cork();
     }
 
-    write_(this, chunk, encoding, null, true);
+    if (maybePrepareFinalChunk(this, chunk, encoding)) {
+      // If just one final write is required, with nothing to follow, we
+      // attach finish to the write to avoid a separate send() & tick step
+      // later on - this is purely a performance optimization.
+      if (typeof callback === 'function') {
+        queueEndCallback(this, callback);
+        callback = undefined;
+      }
+      finishCallback = onFinish.bind(undefined, this);
+    }
+
+    write_(this, chunk, encoding, finishCallback, true);
   } else if (this.finished) {
     if (typeof callback === 'function') {
       queueEndCallback(this, callback);
@@ -1165,14 +1197,17 @@ OutgoingMessage.prototype.end = function end(chunk, encoding, callback) {
     throw new ERR_HTTP_CONTENT_LENGTH_MISMATCH(this[kBytesWritten], this._contentLength);
   }
 
-  const finish = onFinish.bind(undefined, this);
+  if (finishCallback === null) {
+    // If we didn't early finish, send the last data and schedule 'finish' now:
+    finishCallback = onFinish.bind(undefined, this);
 
-  if (this._hasBody && this.chunkedEncoding) {
-    this._send('0\r\n' + this._trailer + '\r\n', 'latin1', finish);
-  } else if (!this._headerSent || this.writableLength || chunk) {
-    this._send('', 'latin1', finish);
-  } else {
-    process.nextTick(finish);
+    if (this._hasBody && this.chunkedEncoding) {
+      this._send('0\r\n' + this._trailer + '\r\n', 'latin1', finishCallback);
+    } else if (!this._headerSent || this.writableLength || chunk) {
+      this._send('', 'latin1', finishCallback);
+    } else {
+      process.nextTick(finishCallback);
+    }
   }
 
   if (this[kSocket]) {
diff --git a/test/parallel/test-http-server-response-standalone.js b/test/parallel/test-http-server-response-standalone.js
index bc7ca56f894b..00ca7c0a96d6 100644
--- a/test/parallel/test-http-server-response-standalone.js
+++ b/test/parallel/test-http-server-response-standalone.js
@@ -15,18 +15,11 @@ const res = new ServerResponse({
   httpVersionMinor: 1
 });
 
-let firstChunk = true;
-
 const ws = new Writable({
   write: common.mustCall((chunk, encoding, callback) => {
-    if (firstChunk) {
-      assert(chunk.toString().endsWith('hello world'));
-      firstChunk = false;
-    } else {
-      assert.strictEqual(chunk.length, 0);
-    }
+    assert(chunk.toString().endsWith('hello world'));
     setImmediate(callback);
-  }, 2)
+  }, 1)
 });
 
 res.assignSocket(ws);

From ac3c412aafdc37e49dd6da1c0e6edb2c59b363e5 Mon Sep 17 00:00:00 2001
From: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date: Mon, 24 Aug 2026 09:43:36 -0300
Subject: [PATCH 332/344] permission: enforce addon permission in
 GetLinkedBinding

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/65432
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node_binding.cc                           |  3 +++
 .../test-permission-linked-binding-drop.js    | 19 +++++++++++++++++++
 .../test-permission-linked-binding.js         | 15 +++++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 test/parallel/test-permission-linked-binding-drop.js
 create mode 100644 test/parallel/test-permission-linked-binding.js

diff --git a/src/node_binding.cc b/src/node_binding.cc
index 2286af2e3c42..2dde536dc229 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -671,6 +671,9 @@ void GetLinkedBinding(const FunctionCallbackInfo<Value>& args) {
 
   node::Utf8Value module_name_v(env->isolate(), module_name);
   const char* name = *module_name_v;
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kAddon, module_name_v.ToStringView());
+
   node_module* mod = nullptr;
 
   // Iterate from here to the nearest non-Worker Environment to see if there's
diff --git a/test/parallel/test-permission-linked-binding-drop.js b/test/parallel/test-permission-linked-binding-drop.js
new file mode 100644
index 000000000000..865761a2bd7e
--- /dev/null
+++ b/test/parallel/test-permission-linked-binding-drop.js
@@ -0,0 +1,19 @@
+// Flags: --permission --allow-addons --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+
+assert.strictEqual(process.permission.has('addon'), true);
+
+process.permission.drop('addon');
+
+assert.strictEqual(process.permission.has('addon'), false);
+
+assert.throws(() => {
+  process._linkedBinding('missing');
+}, common.expectsError({
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'Addon',
+  resource: 'missing',
+}));
diff --git a/test/parallel/test-permission-linked-binding.js b/test/parallel/test-permission-linked-binding.js
new file mode 100644
index 000000000000..b30ea9aaa24b
--- /dev/null
+++ b/test/parallel/test-permission-linked-binding.js
@@ -0,0 +1,15 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+
+assert.strictEqual(process.permission.has('addon'), false);
+
+assert.throws(() => {
+  process._linkedBinding('missing');
+}, common.expectsError({
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'Addon',
+  resource: 'missing',
+}));

From 2a0b1ec4cca9740828b2b34cbc4497ac2ee0fc2f Mon Sep 17 00:00:00 2001
From: Sankalp Thakur <31366524+sankalpsthakur@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:01:20 +0530
Subject: [PATCH 333/344] tls: throw on invalid ALPNProtocols instead of
 aborting

tls.connect() with malformed ALPNProtocols hit
CHECK_EQ(0, SSL_set_alpn_protos(...)) in the C++ layer and aborted
the process with SIGABRT.

Validate in JS instead, in convertALPNProtocols, so both client and
server fail early with a recoverable ERR_INVALID_ARG_VALUE:

- zero-length string protocols now throw from convertProtocols
- wire-format buffers are checked for zero-length and truncated
  entries
- an empty buffer or array is still accepted and means skip ALPN,
  matching the historical behavior for []

The C++ CHECK_EQ is left unchanged: once JS has validated the input,
a non-zero SSL_set_alpn_protos return is an internal invariant
failure rather than user-facing input.

Fixes: https://github.com/nodejs/node/issues/65069

Signed-off-by: Sankalp Thakur <sankalphimself@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65076
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/tls.js                                    | 31 ++++++-
 .../test-tls-alpn-protocols-validation.js     | 85 +++++++++++++++++++
 test/parallel/test-tls-basic-validations.js   | 14 +--
 3 files changed, 122 insertions(+), 8 deletions(-)
 create mode 100644 test/parallel/test-tls-alpn-protocols-validation.js

diff --git a/lib/tls.js b/lib/tls.js
index d2ecc7f0a583..a1d978c50f27 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
   const lens = new Array(protocols.length);
   const buff = Buffer.allocUnsafe(protocols.reduce((p, c, i) => {
     const len = Buffer.byteLength(c);
+    if (len === 0) {
+      throw new ERR_INVALID_ARG_VALUE(`protocols[${i}]`, c,
+                                      'must be a non-empty string');
+    }
     if (len > 255) {
       throw new ERR_OUT_OF_RANGE('The byte length of the protocol at index ' +
         `${i} exceeds the maximum length.`, '<= 255', len, true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
   return buff;
 }
 
+function validateALPNBuffer(buffer) {
+  // Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+  // exactly len bytes follow, no trailing bytes, no zero-length entries.
+  // Empty buffer is allowed and means skip ALPN (same as []).
+  let offset = 0;
+  while (offset < buffer.length) {
+    const len = buffer[offset];
+    if (len === 0) {
+      throw new ERR_INVALID_ARG_VALUE('ALPNProtocols', buffer,
+                                      'must not contain zero-length protocol');
+    }
+    if (offset + 1 + len > buffer.length) {
+      throw new ERR_INVALID_ARG_VALUE('ALPNProtocols', buffer,
+                                      'contains truncated protocol');
+    }
+    offset += 1 + len;
+  }
+}
+
 exports.convertALPNProtocols = function convertALPNProtocols(protocols, out) {
   // If protocols is Array - translate it into buffer
   if (ArrayIsArray(protocols)) {
     out.ALPNProtocols = convertProtocols(protocols);
   } else if (isUint8Array(protocols)) {
     // Copy new buffer not to be modified by user.
-    out.ALPNProtocols = Buffer.from(protocols);
+    const buf = Buffer.from(protocols);
+    validateALPNBuffer(buf);
+    out.ALPNProtocols = buf;
   } else if (isArrayBufferView(protocols)) {
-    out.ALPNProtocols = Buffer.from(protocols.buffer.slice(
+    const buf = Buffer.from(protocols.buffer.slice(
       protocols.byteOffset,
       protocols.byteOffset + protocols.byteLength,
     ));
+    validateALPNBuffer(buf);
+    out.ALPNProtocols = buf;
   }
 };
 
diff --git a/test/parallel/test-tls-alpn-protocols-validation.js b/test/parallel/test-tls-alpn-protocols-validation.js
new file mode 100644
index 000000000000..2a93cca891ce
--- /dev/null
+++ b/test/parallel/test-tls-alpn-protocols-validation.js
@@ -0,0 +1,85 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const tls = require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(() => {
+  const out = {};
+  tls.convertALPNProtocols([''], out);
+}, {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(() => {
+  const out = {};
+  tls.convertALPNProtocols(['h2', ''], out);
+}, {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(() => {
+  const out = {};
+  tls.convertALPNProtocols(Buffer.from([0]), out);
+}, {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(() => {
+  const out = {};
+  tls.convertALPNProtocols(Buffer.from([2, 0x61]), out);
+}, {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(() => {
+  const out = {};
+  tls.convertALPNProtocols(Buffer.from([1, 0x61, 0x62, 0x62]), out);
+}, {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+  const out = {};
+  tls.convertALPNProtocols([], out);
+  assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+  assert.strictEqual(out.ALPNProtocols.length, 0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+  const out = {};
+  tls.convertALPNProtocols(Buffer.alloc(0), out);
+  assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+  assert.strictEqual(out.ALPNProtocols.length, 0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+  const out = {};
+  tls.convertALPNProtocols(new Uint8Array(0), out);
+  assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+  assert.strictEqual(out.ALPNProtocols.length, 0);
+}
+
+// Valid inputs should not throw
+{
+  const out = {};
+  tls.convertALPNProtocols(['h2', 'http/1.1'], out);
+  assert.ok(out.ALPNProtocols.length > 0);
+}
+{
+  const out = {};
+  tls.convertALPNProtocols(Buffer.from([
+    2, 0x61, 0x62, 8, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31,
+  ]), out);
+  assert.strictEqual(out.ALPNProtocols.length, 12);
+}
diff --git a/test/parallel/test-tls-basic-validations.js b/test/parallel/test-tls-basic-validations.js
index 0446b6aef219..d2bbc26b003a 100644
--- a/test/parallel/test-tls-basic-validations.js
+++ b/test/parallel/test-tls-basic-validations.js
@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-  const buffer = Buffer.from('abcd');
+  const buffer = Buffer.from([3, 0x61, 0x62, 0x63]);
   const out = {};
   tls.convertALPNProtocols(buffer, out);
-  out.ALPNProtocols.write('efgh');
-  assert(buffer.equals(Buffer.from('abcd')));
-  assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+  out.ALPNProtocols.write('def', 1);
+  assert(buffer.equals(Buffer.from([3, 0x61, 0x62, 0x63])));
+  assert(out.ALPNProtocols.equals(Buffer.from([3, 0x64, 0x65, 0x66])));
 }
 
 {
-  const arrayBufferViewStr = 'abcd';
-  const inputBuffer = Buffer.from(arrayBufferViewStr.repeat(8), 'utf8');
+  const inputBuffer = Buffer.concat([
+    Buffer.from([31]),
+    Buffer.alloc(31, 0x61),
+  ]);
   for (const expectView of common.getArrayBufferViews(inputBuffer)) {
     const out = {};
     const expected = Buffer.from(expectView.buffer.slice(),

From cb4b89c01855bb59e882f47bd83528086ea756e9 Mon Sep 17 00:00:00 2001
From: Hamid Reza Ghavami <hamidr.ghavami@gmail.com>
Date: Mon, 24 Aug 2026 17:31:34 +0300
Subject: [PATCH 334/344] util: allow single-line format when break length is
 infinite
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Hamid Reza Ghavami <hamidr.ghavami@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64238
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
---
 lib/internal/util/inspect.js       | 8 ++++++++
 test/parallel/test-util-inspect.js | 6 ++++++
 2 files changed, 14 insertions(+)

diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index a343e09a0a3b..1a029c7cf761 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -2622,6 +2622,14 @@ function isBelowBreakLength(ctx, output, start, base) {
   // TODO(BridgeAR): Add unicode support. Use the readline getStringWidth
   // function. Check the performance overhead and make it an opt-in in case it's
   // significant.
+  // allow the single-line format if the length limit is infinite and no items have newlines
+  if (ctx.breakLength === Infinity) {
+    if (base !== '' && StringPrototypeIncludes(base, '\n')) return false;
+    for (let i = 0; i < output.length; i++) {
+      if (typeof output[i] === 'string' && StringPrototypeIncludes(output[i], '\n')) return false;
+    }
+    return true;
+  }
   let totalLength = output.length + start;
   if (totalLength + output.length > ctx.breakLength)
     return false;
diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
index 5d55240f03f3..989f6907da69 100644
--- a/test/parallel/test-util-inspect.js
+++ b/test/parallel/test-util-inspect.js
@@ -4064,3 +4064,9 @@ ${error.stack.split('\n').slice(1).join('\n')}`,
   assert.match(inspect(DOMException.prototype), /^\[object DOMException\] \{/);
   delete Error[Symbol.hasInstance];
 }
+
+{
+  const obj = { a: 'short string', b: [1, 2], c: { d: true } };
+  const expected = "{ a: 'short string', b: [ 1, 2 ], c: { d: true } }";
+  assert.strictEqual(util.inspect(obj, { breakLength: Infinity }), expected);
+}

From 9e227ef20d15d55c8f8e9de95a0ecb96e9ef85df Mon Sep 17 00:00:00 2001
From: Taeuk Ha <102611556+ChocoChip0519@users.noreply.github.com>
Date: Tue, 25 Aug 2026 02:30:12 +0900
Subject: [PATCH 335/344] doc: update AHAFS reference link

Signed-off-by: Taeuk Ha <tomcat0519@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65481
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
---
 doc/api/fs.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index 1fa2fe621b58..b088c1ff0e0c 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -9380,7 +9380,7 @@ the file contents.
 [MSDN-Rel-Path]: https://docs.microsoft.com/en-us/windows/desktop/FileIO/naming-a-file#fully-qualified-vs-relative-paths
 [MSDN-Using-Streams]: https://docs.microsoft.com/en-us/windows/desktop/FileIO/using-streams
 [Naming Files, Paths, and Namespaces]: https://docs.microsoft.com/en-us/windows/desktop/FileIO/naming-a-file
-[`AHAFS`]: https://developer.ibm.com/articles/au-aix_event_infrastructure/
+[`AHAFS`]: https://www.ibm.com/docs/en/aix/7.3.0?topic=management-aix-event-infrastructure-aix-aix-clusters-ahafs
 [`Buffer.byteLength`]: buffer.md#static-method-bufferbytelengthstring-encoding
 [`FSEvents`]: https://developer.apple.com/documentation/coreservices/file_system_events
 [`Number.MAX_SAFE_INTEGER`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/MAX_SAFE_INTEGER

From 1d6ec2ddc5f06869820476aaae0c42fdca5ec238 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Mon, 24 Aug 2026 11:17:10 -0700
Subject: [PATCH 336/344] stream: encode whole chunks in TextEncoderStream
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The encode-and-enqueue transform walked the chunk code unit by code
unit, materializing a single-character string per index and building
the output with string concatenation. The only state that crosses
chunks is a trailing high (leading) surrogate, and TextEncoder.encode's
USVString conversion already replaces every interior lone surrogate
with U+FFFD, which is exactly what the spec loop produces. Join a
pending high surrogate with the incoming chunk, hold back a new
trailing high surrogate, and encode the rest in a single native call.

The streaming decode path also reuses a single options object instead
of allocating { stream: true } per chunk.

An encoding-streams benchmark is added since the suite had no
TextEncoderStream/TextDecoderStream row. Encoding improves by ~546%
with 1KB string chunks and ~20% with 16-character chunks; decode is
unchanged.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65414
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
---
 benchmark/webstreams/encoding-streams.js  | 39 +++++++++++
 benchmark/webstreams/from.js              | 29 ++++++++
 lib/internal/webstreams/encoding.js       | 48 ++++++-------
 lib/internal/webstreams/readablestream.js | 83 ++++++++++++++++++++---
 lib/internal/webstreams/util.js           |  2 +-
 5 files changed, 166 insertions(+), 35 deletions(-)
 create mode 100644 benchmark/webstreams/encoding-streams.js
 create mode 100644 benchmark/webstreams/from.js

diff --git a/benchmark/webstreams/encoding-streams.js b/benchmark/webstreams/encoding-streams.js
new file mode 100644
index 000000000000..00759bc09eb7
--- /dev/null
+++ b/benchmark/webstreams/encoding-streams.js
@@ -0,0 +1,39 @@
+'use strict';
+const common = require('../common.js');
+const {
+  ReadableStream,
+  TextEncoderStream,
+  TextDecoderStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  kind: ['encode', 'decode'],
+  len: [16, 1024],
+});
+
+async function main({ n, kind, len }) {
+  const encoded = new TextEncoder().encode('a'.repeat(len));
+  const decoded = 'a'.repeat(len);
+  let i = 0;
+  const rs = new ReadableStream({
+    pull(controller) {
+      if (i++ < n) {
+        controller.enqueue(kind === 'encode' ? decoded : encoded);
+      } else {
+        controller.close();
+      }
+    },
+  });
+  const ts = kind === 'encode' ?
+    new TextEncoderStream() :
+    new TextDecoderStream();
+
+  const reader = rs.pipeThrough(ts).getReader();
+  bench.start();
+  for (;;) {
+    const { done } = await reader.read();
+    if (done) break;
+  }
+  bench.end(n);
+}
diff --git a/benchmark/webstreams/from.js b/benchmark/webstreams/from.js
new file mode 100644
index 000000000000..05eca4079f1d
--- /dev/null
+++ b/benchmark/webstreams/from.js
@@ -0,0 +1,29 @@
+'use strict';
+const common = require('../common.js');
+const {
+  ReadableStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [1e6],
+  kind: ['sync', 'async'],
+});
+
+async function main({ n, kind }) {
+  function* syncGen() {
+    for (let i = 0; i < n; i++) yield i;
+  }
+
+  async function* asyncGen() {
+    for (let i = 0; i < n; i++) yield i;
+  }
+
+  const reader = ReadableStream.from(
+    kind === 'sync' ? syncGen() : asyncGen()).getReader();
+  bench.start();
+  for (;;) {
+    const { done } = await reader.read();
+    if (done) break;
+  }
+  bench.end(n);
+}
diff --git a/lib/internal/webstreams/encoding.js b/lib/internal/webstreams/encoding.js
index f316222ccbf0..038b64030a7a 100644
--- a/lib/internal/webstreams/encoding.js
+++ b/lib/internal/webstreams/encoding.js
@@ -4,6 +4,7 @@ const {
   ObjectDefineProperties,
   String,
   StringPrototypeCharCodeAt,
+  StringPrototypeSlice,
   Uint8Array,
 } = primordials;
 
@@ -31,6 +32,9 @@ const {
   kEnumerableProperty,
 } = require('internal/util');
 
+// Shared per-chunk decode options; decode() only reads the flag.
+const kDecodeStreamingOptions = { __proto__: null, stream: true };
+
 /**
  * @typedef {import('./readablestream').ReadableStream} ReadableStream
  * @typedef {import('./writablestream').WritableStream} WritableStream
@@ -46,34 +50,26 @@ class TextEncoderStream {
     this.#transform = new TransformStream({
       transform: (chunk, controller) => {
         // https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
+        // The only cross-chunk state is a trailing high surrogate;
+        // encode() replaces interior lone surrogates with U+FFFD exactly
+        // like the spec's per-code-unit walk.
         chunk = String(chunk);
-        let finalChunk = '';
-        for (let i = 0; i < chunk.length; i++) {
-          const item = chunk[i];
-          const codeUnit = StringPrototypeCharCodeAt(item, 0);
-          if (this.#pendingHighSurrogate !== null) {
-            const highSurrogate = this.#pendingHighSurrogate;
-            this.#pendingHighSurrogate = null;
-            if (0xDC00 <= codeUnit && codeUnit <= 0xDFFF) {
-              finalChunk += highSurrogate + item;
-              continue;
-            }
-            finalChunk += '\uFFFD';
-          }
-          if (0xD800 <= codeUnit && codeUnit <= 0xDBFF) {
-            this.#pendingHighSurrogate = item;
-            continue;
-          }
-          if (0xDC00 <= codeUnit && codeUnit <= 0xDFFF) {
-            finalChunk += '\uFFFD';
-            continue;
-          }
-          finalChunk += item;
+        if (chunk.length === 0)
+          return;
+        if (this.#pendingHighSurrogate !== null) {
+          chunk = this.#pendingHighSurrogate + chunk;
+          this.#pendingHighSurrogate = null;
         }
-        if (finalChunk) {
-          const value = this.#handle.encode(finalChunk);
-          controller.enqueue(value);
+        const lastCodeUnit =
+          StringPrototypeCharCodeAt(chunk, chunk.length - 1);
+        if (0xD800 <= lastCodeUnit && lastCodeUnit <= 0xDBFF) {
+          this.#pendingHighSurrogate =
+            StringPrototypeSlice(chunk, -1);
+          chunk = StringPrototypeSlice(chunk, 0, -1);
+          if (chunk.length === 0)
+            return;
         }
+        controller.enqueue(this.#handle.encode(chunk));
       },
       flush: (controller) => {
         // https://encoding.spec.whatwg.org/#encode-and-flush
@@ -137,7 +133,7 @@ class TextDecoderStream {
         if (chunk === undefined) {
           throw new ERR_INVALID_ARG_TYPE('chunk', 'string', chunk);
         }
-        const value = this.#handle.decode(chunk, { stream: true });
+        const value = this.#handle.decode(chunk, kDecodeStreamingOptions);
         if (value)
           controller.enqueue(value);
       },
diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index 84f16dc7b4a1..78313bd03c1a 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -112,6 +112,7 @@ const {
   getNonWritablePropertyDescriptor,
   isBrandCheck,
   kEmptyQueue,
+  kParkedAlgorithmResult,
   kResolvedPromise,
   kState,
   kType,
@@ -1446,19 +1447,85 @@ function readableStreamFromIterable(iterable) {
   if (iterator === null || (typeof iterator !== 'object' && typeof iterator !== 'function')) {
     throw new ERR_INVALID_STATE.TypeError('The iterator method must return an object');
   }
+  // Per GetIteratorDirect, the next method is looked up once.
+  const nextMethod = iterator.next;
   const startAlgorithm = nonOpCallback;
 
-  async function pullAlgorithm() {
-    const iterResult = await iterator.next();
+  // Callback-style pull: the reaction steps are reused across chunks and
+  // completion is delivered to the controller's cached pull reactions
+  // (the kParkedAlgorithmResult contract). One pull runs at a time, so a
+  // single slot carries a non-thenable next() result between steps.
+  let pendingIterResult;
+
+  function rejectPull(error) {
+    readableStreamDefaultControllerError(stream[kState].controller, error);
+  }
+
+  function processIterResult(iterResult) {
+    const controller = stream[kState].controller;
     if (typeof iterResult !== 'object' || iterResult === null) {
-      throw new ERR_INVALID_STATE.TypeError(
-        'The promise returned by the iterator.next() method must fulfill with an object');
+      rejectPull(new ERR_INVALID_STATE.TypeError(
+        'The promise returned by the iterator.next() method must fulfill with an object'));
+      return;
     }
-    if (iterResult.done) {
-      readableStreamDefaultControllerClose(stream[kState].controller);
-    } else {
-      readableStreamDefaultControllerEnqueue(stream[kState].controller, await iterResult.value);
+    try {
+      if (iterResult.done) {
+        readableStreamDefaultControllerClose(controller);
+      } else {
+        const value = iterResult.value;
+        if (value !== null &&
+            (typeof value === 'object' || typeof value === 'function')) {
+          // Adopted like `await iterResult.value`, keeping the observable
+          // .then lookup on plain objects.
+          PromisePrototypeThen(PromiseResolve(value), enqueueValue, rejectPull);
+          return;
+        }
+        readableStreamDefaultControllerEnqueue(controller, value);
+      }
+    } catch (error) {
+      rejectPull(error);
+      return;
+    }
+    // pullFulfilled exists: the controller creates it before the pull.
+    controller[kState].pullFulfilled();
+  }
+
+  function enqueueValue(value) {
+    const controller = stream[kState].controller;
+    try {
+      readableStreamDefaultControllerEnqueue(controller, value);
+    } catch (error) {
+      rejectPull(error);
+      return;
+    }
+    controller[kState].pullFulfilled();
+  }
+
+  function processPendingIterResult() {
+    const iterResult = pendingIterResult;
+    pendingIterResult = undefined;
+    processIterResult(iterResult);
+  }
+
+  function pullAlgorithm() {
+    let nextResult;
+    try {
+      nextResult = FunctionPrototypeCall(nextMethod, iterator);
+    } catch (error) {
+      return PromiseReject(error);
+    }
+    if (nextResult !== null &&
+        (typeof nextResult === 'object' || typeof nextResult === 'function')) {
+      // Mirrors `await iterator.next()`: processIterResult runs at the
+      // microtask position the await resumed.
+      PromisePrototypeThen(
+        PromiseResolve(nextResult), processIterResult, rejectPull);
+      return kParkedAlgorithmResult;
     }
+    // A non-thenable next() result fails validation a microtask later.
+    pendingIterResult = nextResult;
+    PromisePrototypeThen(kResolvedPromise, processPendingIterResult);
+    return kParkedAlgorithmResult;
   }
 
   async function cancelAlgorithm(reason) {
diff --git a/lib/internal/webstreams/util.js b/lib/internal/webstreams/util.js
index 9598796f35c8..9a93a2b17d41 100644
--- a/lib/internal/webstreams/util.js
+++ b/lib/internal/webstreams/util.js
@@ -359,7 +359,7 @@ const kResolvedPromise = PromiseResolve();
 // operation and takes responsibility for delivering the fulfilled (or
 // rejected) continuation itself later, instead of settling a promise
 // (see the transform stream source pull algorithm).
-const kParkedAlgorithmResult = { __proto__: null };
+const kParkedAlgorithmResult = Symbol('kParkedAlgorithmResult');
 
 // Wires the (possibly non-thenable) result of an underlying algorithm
 // callback to its fulfilled/rejected continuations. A non-thenable result

From 01a8ae0ce6366f0fa49a861f73dbcba72d928417 Mon Sep 17 00:00:00 2001
From: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date: Mon, 24 Aug 2026 18:37:56 -0300
Subject: [PATCH 337/344] permission: guard UDP handle adoption

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/65358
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/udp_wrap.cc                               |  14 ++
 src/udp_wrap.h                                |   1 +
 .../test-permission-net-udp-handle.js         | 135 ++++++++++++++++++
 3 files changed, 150 insertions(+)
 create mode 100644 test/parallel/test-permission-net-udp-handle.js

diff --git a/src/udp_wrap.cc b/src/udp_wrap.cc
index b5e732dd6f1c..e75f2694e708 100644
--- a/src/udp_wrap.cc
+++ b/src/udp_wrap.cc
@@ -325,6 +325,7 @@ void UDPWrap::DoBind(const FunctionCallbackInfo<Value>& args, int family) {
     err = uv_udp_bind(&wrap->handle_,
                       reinterpret_cast<const sockaddr*>(&addr_storage),
                       flags);
+    if (err == 0) wrap->net_permission_granted_ = true;
   }
 
   if (err == 0)
@@ -358,6 +359,7 @@ void UDPWrap::DoConnect(const FunctionCallbackInfo<Value>& args, int family) {
   if (err == 0) {
     err = uv_udp_connect(&wrap->handle_,
                          reinterpret_cast<const sockaddr*>(&addr_storage));
+    if (err == 0) wrap->net_permission_granted_ = true;
   }
 
   args.GetReturnValue().Set(err);
@@ -368,9 +370,14 @@ void UDPWrap::Open(const FunctionCallbackInfo<Value>& args) {
   UDPWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(
       &wrap, args.This(), args.GetReturnValue().Set(UV_EBADF));
+  Environment* env = wrap->env();
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(env, permission::PermissionScope::kNet, "");
+
   CHECK(args[0]->IsNumber());
   int fd = FromV8Value<int>(args[0]);
   int err = uv_udp_open(&wrap->handle_, fd);
+  if (err == 0) wrap->net_permission_granted_ = true;
 
   args.GetReturnValue().Set(err);
 }
@@ -697,6 +704,13 @@ void UDPWrapBase::RecvStart(const FunctionCallbackInfo<Value>& args) {
 
 int UDPWrap::RecvStart() {
   if (IsHandleClosing()) return UV_EBADF;
+
+  if (!net_permission_granted_) {
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        env(), permission::PermissionScope::kNet, "", UV_EACCES);
+    net_permission_granted_ = true;
+  }
+
   int err = uv_udp_recv_start(&handle_, OnAlloc, OnRecv);
   // UV_EALREADY means that the socket is already bound but that's okay
   if (err == UV_EALREADY)
diff --git a/src/udp_wrap.h b/src/udp_wrap.h
index c0914dbf3a7f..5a26cace2e15 100644
--- a/src/udp_wrap.h
+++ b/src/udp_wrap.h
@@ -214,6 +214,7 @@ class UDPWrap final : public HandleWrap,
 
   uv_udp_t handle_;
 
+  bool net_permission_granted_ = false;
   bool current_send_has_callback_;
   v8::Local<v8::Object> current_send_req_wrap_;
 };
diff --git a/test/parallel/test-permission-net-udp-handle.js b/test/parallel/test-permission-net-udp-handle.js
new file mode 100644
index 000000000000..b6925421f829
--- /dev/null
+++ b/test/parallel/test-permission-net-udp-handle.js
@@ -0,0 +1,135 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (common.isWindows) {
+  common.skip('Sending dgram sockets to child processes is not supported');
+}
+
+const assert = require('assert');
+const dgram = require('dgram');
+const { fork, spawn } = require('child_process');
+
+const mode = process.argv[2];
+const kStateSymbol = mode === undefined ?
+  require('internal/dgram').kStateSymbol : undefined;
+
+if (mode === 'ipc-denied') {
+  process.on('message', common.mustNotCall());
+  process.send('ready');
+} else if (mode === 'ipc-drop') {
+  process.once('message', common.mustCall((message, handle) => {
+    assert.strictEqual(message, 'socket');
+    assert(process.permission.has('net'));
+
+    process.permission.drop('net');
+    assert(!process.permission.has('net'));
+
+    handle.once('message', common.mustCall((data) => {
+      assert.strictEqual(data.toString(), 'after-drop');
+      handle.close();
+      process.send('received');
+    }));
+    process.send('receiving');
+  }));
+  process.send('ready');
+} else {
+  const deniedSocket = dgram.createSocket('udp4');
+  deniedSocket.bind(0, '127.0.0.1', common.mustCall(() => {
+    const child = fork(__filename, ['ipc-denied'], {
+      execArgv: ['--permission', '--allow-fs-read=*'],
+      silent: true,
+    });
+    let stderr = '';
+
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk) => { stderr += chunk; });
+    child.once('message', common.mustCall((message) => {
+      assert.strictEqual(message, 'ready');
+      child.send('socket', deniedSocket);
+    }));
+    child.once('exit', common.mustCall((code, signal) => {
+      assert.strictEqual(code, 1);
+      assert.strictEqual(signal, null);
+      assert.match(stderr, /ERR_ACCESS_DENIED/);
+      assert.match(stderr, /permission: 'Net'/);
+      deniedSocket.close();
+    }));
+  }));
+
+  const droppedSocket = dgram.createSocket('udp4');
+  const sender = dgram.createSocket('udp4');
+  droppedSocket.bind(0, '127.0.0.1', common.mustCall(() => {
+    const child = fork(__filename, ['ipc-drop'], {
+      execArgv: [
+        '--permission',
+        '--allow-net',
+        '--allow-fs-read=*',
+      ],
+    });
+    let timer;
+
+    child.on('message', common.mustCall((message) => {
+      if (message === 'ready') {
+        child.send('socket', droppedSocket);
+      } else if (message === 'receiving') {
+        const { port } = droppedSocket.address();
+        timer = setInterval(() => {
+          sender.send('after-drop', port, '127.0.0.1');
+        }, 10);
+      } else {
+        assert.strictEqual(message, 'received');
+        clearInterval(timer);
+        sender.close();
+        droppedSocket.close();
+        child.disconnect();
+      }
+    }, 3));
+    child.once('exit', common.mustCall((code, signal) => {
+      assert.strictEqual(code, 0);
+      assert.strictEqual(signal, null);
+    }));
+  }));
+
+  const fdSocket = dgram.createSocket('udp4');
+  fdSocket.bind(0, '127.0.0.1', common.mustCall(() => {
+    const source = `
+      const assert = require('node:assert');
+      const dgram = require('node:dgram');
+      const socket = dgram.createSocket('udp4');
+      let error;
+      try {
+        socket.bind({ fd: 3 });
+      } catch (err) {
+        error = err;
+      }
+      if (error) {
+        assert.strictEqual(error.code, 'ERR_ACCESS_DENIED');
+        assert.strictEqual(error.permission, 'Net');
+        process.exit(0);
+      }
+      process.exit(1);
+    `;
+    const child = spawn(
+      process.execPath,
+      ['--permission', '--eval', source],
+      {
+        stdio: [
+          'ignore',
+          'ignore',
+          'pipe',
+          fdSocket[kStateSymbol].handle.fd,
+        ],
+      },
+    );
+    let stderr = '';
+
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk) => { stderr += chunk; });
+    child.once('exit', common.mustCall((code, signal) => {
+      assert.strictEqual(code, 0, stderr);
+      assert.strictEqual(signal, null);
+      fdSocket.close();
+    }));
+  }));
+}

From 4232997fa27472b95ba810faae0655a26a657cee Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 24 Aug 2026 20:49:15 -0400
Subject: [PATCH 338/344] crypto: update root certificates to NSS 3.126
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the certdata.txt[0] from NSS 3.126.

This is the version of NSS that shipped in Firefox 154.0 on 2026-08-18.

Certificates added:
- SECOM TLS RSA Root CA 2024
- SECOM TLS ECC Root CA 2024
- Telia EC TLS Root CA v3
- Telia RSA TLS Root CA v3

Certificates removed:
- ePKI Root Certification Authority
- Atos TrustedRoot 2011

[0] https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_126_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: https://github.com/nodejs/node/pull/65495
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 src/node_root_certs.h |  145 +++--
 tools/certdata.txt    | 1187 +++++++++++++++++++++++++++++++++++------
 2 files changed, 1103 insertions(+), 229 deletions(-)

diff --git a/src/node_root_certs.h b/src/node_root_certs.h
index 517dc8814c6d..1d3af4841611 100644
--- a/src/node_root_certs.h
+++ b/src/node_root_certs.h
@@ -17,38 +17,6 @@
 "V9mSOdY=\n"
 "-----END CERTIFICATE-----",
 
-/* ePKI Root Certification Authority */
-"-----BEGIN CERTIFICATE-----\n"
-"MIIFsDCCA5igAwIBAgIQFci9ZUdcr7iXAF7kBtK8nTANBgkqhkiG9w0BAQUFADBeMQswCQYD\n"
-"VQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0ZC4xKjAoBgNVBAsM\n"
-"IWVQS0kgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNDEyMjAwMjMxMjdaFw0z\n"
-"NDEyMjAwMjMxMjdaMF4xCzAJBgNVBAYTAlRXMSMwIQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29t\n"
-"IENvLiwgTHRkLjEqMCgGA1UECwwhZVBLSSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5\n"
-"MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U\n"
-"82N0ywEhajfqhFAHSyZbCUNsIZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrB\n"
-"p0xtInAhijHyl3SJCRImHJ7K2RKilTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2YWEtgvM3X\n"
-"DZoTM1PRYfl61dd4s5oz9wCGzh1NlDivqOx4UXCKXBCDUSH3ET00hl7lSM2XgYI1TBnsZfZr\n"
-"xQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX12ruOzjjK9SXDrkb5wdJfzcq+Xd4z1TtW0ad\n"
-"o4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0OWQqraffAsgRFelQArr5T9rXn4fg8ozHS\n"
-"qf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fqcde+S/uUWH1+ETOxQvdibBjWzwloPn9s9h6PYq2l\n"
-"Y9sJpx8iQkEeb5mKPtf5P0B6ebClAZLSnT0IFaUQAS2zMnaolQ2zepr7BxB4EW/hj8e6DyUa\n"
-"dCrlHJhBmd8hh+iVBmoKs2pHdmX2Os+PYhcZewoozRrSgx4hxyy/vv9haLdnG7t4TY3OZ+Xk\n"
-"wY63I2binZB1NJipNiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXiZo1jDiVN1Rmy5nk3\n"
-"pyKdVDECAwEAAaNqMGgwHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/QkqiMAwGA1UdEwQF\n"
-"MAMBAf8wOQYEZyoHAAQxMC8wLQIBADAJBgUrDgMCGgUAMAcGBWcqAwAABBRFsMLHClZ87lt4\n"
-"DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGBuvl2ICO1J2B01GqZ\n"
-"NF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6YlPwZpVnPDimZI+ymBV3QGypzq\n"
-"KOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkPJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnV\n"
-"vwdVxrsStZf0X4OFunHB2WyBEXYKCrC/gpf36j36+uwtqSiUO1bd0lEursC9CBWMd1I0ltab\n"
-"rNMdjmEPNXubrjlpC2JgQCA2j6/7Nu4tCEoduL+bXPjqpRugc6bY+G7gMwRfaKonh+3ZwZCc\n"
-"7b3jajWvY9+rGNm65ulK6lCKD2GTHuItGeIwlDWSXQ62B68ZgI9HkFFLLk3dheLSClIKF5r8\n"
-"GrBQAuUBo2M3IUxExJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS\n"
-"/jQ6fbjpKdx2qcgw+BRxgMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2zGp1iro2C\n"
-"6pSe3VkQw63d4k3jMdXH7OjysP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTEW9c3rkIO3aQab3yI\n"
-"VMUWbuF6aC74Or8NpDyJO3inTmODBCEIZ43ygknQW/2xzQ+DhNQ+IIX3Sj0rnP0qCglN6oH4\n"
-"EZw=\n"
-"-----END CERTIFICATE-----",
-
 /* NetLock Arany (Class Gold) Főtanúsítvány */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIEFTCCAv2gAwIBAgIGSUEs5AAQMA0GCSqGSIb3DQEBCwUAMIGnMQswCQYDVQQGEwJIVTER\n"
@@ -569,27 +537,6 @@
 "gwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlPBSeOE6Fuwg==\n"
 "-----END CERTIFICATE-----",
 
-/* Atos TrustedRoot 2011 */
-"-----BEGIN CERTIFICATE-----\n"
-"MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UEAwwVQXRv\n"
-"cyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQGEwJERTAeFw0xMTA3\n"
-"MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMMFUF0b3MgVHJ1c3RlZFJvb3Qg\n"
-"MjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMCREUwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
-"DwAwggEKAoIBAQCVhTuXbyo7LjvPpvMpNb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI41\n"
-"9KkM/IL9bcFyYie96mvr54rMVD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+\n"
-"yj5vdHLqqjAqc2K+SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFs\n"
-"Q/H3NYkQ4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L\n"
-"cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQieowHAgMB\n"
-"AAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNVHRMBAf8EBTADAQH/\n"
-"MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgGA1UdIAQRMA8wDQYLKwYBBAGw\n"
-"LQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4G\n"
-"kGDEjKwLVLgfuXvTBznk+j57sj1O7Z8jvZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0\n"
-"BAGmuhWawyfc2E8PzBhj/5kPDpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQP\n"
-"OLXiZNwlz6bb65pcmaHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYV\n"
-"qL2Gns2Dlmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv\n"
-"KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed\n"
-"-----END CERTIFICATE-----",
-
 /* QuoVadis Root CA 1 G3 */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIFYDCCA0igAwIBAgIUeFhfLq0sGUvjNwc1NBMotZbUZZMwDQYJKoZIhvcNAQELBQAwSDEL\n"
@@ -2895,4 +2842,96 @@
 "hBC9xdIoaDQCQTV2WnXzkoYI9bIeCvZlC9p2x1L/Cx6AcCIwwzPbGO2E14vs7dOoY4G1VnxH\n"
 "x1YwlGhza9IuqbnZLBwpvQy6uWWL\n"
 "-----END CERTIFICATE-----",
+
+/* SECOM TLS RSA Root CA 2024 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIFmjCCA4KgAwIBAgIJAO6JNNDLgOCyMA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNVBAYTAkpQ\n"
+"MSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VD\n"
+"T00gVExTIFJTQSBSb290IENBIDIwMjQwHhcNMjQwMTMxMDUxMTU1WhcNNDkwMTE0MDUxMTU1\n"
+"WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VDT00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0\n"
+"ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBSU0EgUm9vdCBDQSAyMDI0MIICIjANBgkqhkiG9w0B\n"
+"AQEFAAOCAg8AMIICCgKCAgEA4TjizUwzxbInq8Tx11gaFYNk5fO+34y7TyM4neh0UgL5JIZb\n"
+"JNLTz2x//L/B71+5m6X6nGIr7d4lFJBGtjO677hXOz93zkcWaUTm3VbOAjBlt4YWxlcccBHX\n"
+"uZ7o3Q+4R+ormrBdHeJ1CTUEG8ttQbKIl3G7OZYbnH8/pP8cjPub/0kDVNuMzp7xsVRROOis\n"
+"Qt53fMoJLlYgoebbuMphOqMCtjkJ7R6efEMfLp8UAVi9ZaLRn76ET/CJkk925nduuufC4Bat\n"
+"S4mnXFmxN0vUXb0ij9B8O/D8gixQEsVSD4GK8FWRPh3bVd/6bzdkHGJjy21XI0yejVomZUbR\n"
+"rOfNuz0boPGV1pt18fFC39IHQEth3OFqb5NDO3L+A9bNqTgAyUgRmIn4ucgDc/Ri/Km3V51u\n"
+"eZjy1/yk0qwJVadAVVrCt56iNeXOyEvzJADGgDQ8E1Pdaqct8Cynz/47ReQM62vFYO08wcQk\n"
+"rjmX/tesiko1V1yyaf6EfPzUFzmaGy9xvkCwdbm15EdTolOjE0H2Vb5/APDOyCFEokiYGmXT\n"
+"LdAUl0wKZ4IyjkHGzy0jhpaXEXE/GJcEvI6VzEchjaBL03EJ0h9pG4OqeIOycKvAo3A+Tbet\n"
+"yfsrgYyHzU0a7/qUjGat1AAq1nVljMpKqpinPTsf/d9H39FTUeJL7TpzzjUCAwEAAaNjMGEw\n"
+"HQYDVR0OBBYEFCzrchKOWHdkNRVWNQFXB6l9DTbmMB8GA1UdIwQYMBaAFCzrchKOWHdkNRVW\n"
+"NQFXB6l9DTbmMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB\n"
+"DAUAA4ICAQAVwsvluSafaez5tFPR/hRTBzRxEyMMQF3XJXCVi3yegZyKoec7hmE6jx2ZM8Kg\n"
+"M1kn2yJRwFXHX8zUW9nBLEDWc4wuE8LrlZqhGZM9pJQXGmGzResDJV6JgRBna+j4sA1M7yId\n"
+"lvL0sAfFXFCTRaWTD4E1V99RLrFzWfTcC+e180hDuNMpqOEo46+lMeW/Wvh7ifOQs+kiK0O2\n"
+"gHxQDNxslSavnCs4V7l8HRDJ2La10o70Bo7VLzf1W8MBvv0VTnxB+NjT5qTAbhGFh9Gvp4Ba\n"
+"JpmdUf0C5CEP6dbQlfgxWfzYr69yVT6dPQB+GFEaY03IMY+AcBCs+om1fNxrQXt9zoofMBNF\n"
+"bLhvpNH/JsXWdGUzfNbO12uswTa5wah8LB18FTQN2/zPHYmvBEoLuyUgZ09VNLJo5YA0kXIt\n"
+"VYkLjMe2SixzK4scUHv81IK99I91DWx7FwMVKw2xgFp+ZLYB2dnpQQrqwlW64glHUcK2N9BD\n"
+"snjLSxeZ+UPECh9RxH4WAcKiZW+cqaKMmhP2WBfR4IcR7NOL32ml11ds87hhV1CZWWFCJAcC\n"
+"idYZz6CZa8exzHojP9SB5RH0/v1KdHAisqhSjtJl/UIAHIQ48elOn8wrTdFap4Yb5aHglmMe\n"
+"Nx+fAIhDluWVfxTO7H4dTPU+SFVRMLAh+wwKZfqb94nMeQ==\n"
+"-----END CERTIFICATE-----",
+
+/* SECOM TLS ECC Root CA 2024 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIICTDCCAdGgAwIBAgIJAIF6LO+PI3pEMAoGCCqGSM49BAMDMFoxCzAJBgNVBAYTAkpQMSYw\n"
+"JAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VDT00g\n"
+"VExTIEVDQyBSb290IENBIDIwMjQwHhcNMjQwMTMxMDU1MjM0WhcNNDkwMTE0MDU1MjM0WjBa\n"
+"MQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VDT00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4x\n"
+"IzAhBgNVBAMTGlNFQ09NIFRMUyBFQ0MgUm9vdCBDQSAyMDI0MHYwEAYHKoZIzj0CAQYFK4EE\n"
+"ACIDYgAE7NzFMtu9dzQXSNC12fabk0+GlC5finB3R7XaZonRUd20aFiWObtuNBCLUZSfk6QX\n"
+"AE55BjEXsXQ/NG8yUqicXjsu9ksDK3JZBgCwLOVh6+nwJXTvso/dEj/GUYH5mBdoo2MwYTAd\n"
+"BgNVHQ4EFgQUO3YReyl04k4GTFaCQNAhL3qzydUwHwYDVR0jBBgwFoAUO3YReyl04k4GTFaC\n"
+"QNAhL3qzydUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwMD\n"
+"aQAwZgIxAN3ib8fi1pMYtAPjMilB5e5/H+t5CL0xPL+cZ5oTTZuSCjpAn1v7F/VAr8bFxQXA\n"
+"owIxAKsBVO1ACFp7skwzPvdv1EUY5a897WGLT4lb+bjxFAWyl8wDcZJdwGZ/pAHxt1AJ1g==\n"
+"-----END CERTIFICATE-----",
+
+/* Telia EC TLS Root CA v3 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIICMjCCAbegAwIBAgIPAYvSIlRjTQSLbOVHH9K1MAoGCCqGSM49BAMDMEoxCzAJBgNVBAYT\n"
+"AlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMg\n"
+"Um9vdCBDQSB2MzAeFw0yMzExMTUwODU1MjZaFw00ODA1MjMxMTAwMDBaMEoxCzAJBgNVBAYT\n"
+"AlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMg\n"
+"Um9vdCBDQSB2MzB2MBAGByqGSM49AgEGBSuBBAAiA2IABMHIlhVDLbmFKUpW0iK4dpryT6em\n"
+"YOeS31JPwWnWPmkWRrAkTbPX40sQfHI9mpR7Rbktu3ngg6W+BBSXSechtMCnBmWXj/EaVlmV\n"
+"5cY1jD2HoTfhBQ3AacpCNMLJK4NpZaNjMGEwHwYDVR0jBBgwFoAU1GToQ4g6cy/QGnGCNgte\n"
+"hd7H3kMwHQYDVR0OBBYEFNRk6EOIOnMv0BpxgjYLXoXex95DMA4GA1UdDwEB/wQEAwIBBjAP\n"
+"BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA2kAMGYCMQCXAUdS/9bbJ8A1JYaGf/bWt/s7\n"
+"Ta0ot5Ulno8OjSNYRWQIlS4tVWldvTAVA7heOFgCMQCvKr8+Z2Rn+OBr5UHzlgBObpad1Luw\n"
+"NTRcdNgUJxIWadcki+UBLEi1/AURKV5md2M=\n"
+"-----END CERTIFICATE-----",
+
+/* Telia RSA TLS Root CA v3 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIFgjCCA2qgAwIBAgIPAYvSUKtCVSxHWr2h3BrFMA0GCSqGSIb3DQEBDAUAMEsxCzAJBgNV\n"
+"BAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSEwHwYDVQQDDBhUZWxpYSBSU0Eg\n"
+"VExTIFJvb3QgQ0EgdjMwHhcNMjMxMTE1MDk0NzQyWhcNNDgwNTIzMTEwMDAwWjBLMQswCQYD\n"
+"VQQGEwJTRTEZMBcGA1UECgwQVGVsaWEgQ29tcGFueSBBQjEhMB8GA1UEAwwYVGVsaWEgUlNB\n"
+"IFRMUyBSb290IENBIHYzMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsV89KG19\n"
+"hCf4S1Fvk8D3TyDERhmcvx8F7Kmb4WATx3ije1id3KHxRE0TKmcNCbAQ57bvHFEYa4hR2l20\n"
+"VjVadExqOW+2ld99MbEiO+jRVOz+BbxLxJnmGwCqI+BfuTjjVReDxsxjQvjgBsClaO/sm5i7\n"
+"0nlZcWGRtIkvWDK3NNkT5RtwXc/O8NTFVpbUqT6cRjIj3olAblR+lRf4Ffy5o+Q9fabjYn9Z\n"
+"9S4itruElcEFf9Ljk7fwdTycT/rvJW9w/B3G2a3r0f/zXNOVruIBcqE6pkSospACU2bG42fY\n"
+"KrbM/GWnp7u+p9Frz4jaNwpb4YHuEeS8BratNcP8X62jXIvvKHxlsMDJCnb4U8JzFOLsU6mo\n"
+"hVY58BdZrvi0Gk9UOuqmgoG6dskHoksjZTlK61D/InzmEoA1yAYJFDVysjRxDUOu9cAwANbq\n"
+"mq77WIFL6BpnZgVqPtMfG6wN8BrTKdapvilVsYR59BFgIsAVBMxrGh+W+QcvmJafUpASvlAr\n"
+"KvVG2FI4i6PiLjSBT0+6F6EQLrYqefOQF/fBNEXb+njUQ0SUVrAqtH4Y+OjCI/a4/JJQppxe\n"
+"emZcQ0SUShgiI5AM5xHO5iyaUrTjYH4zxUz9j+1FEbDH/xpstr1gXBykspup+hRTaJcbA+Ub\n"
+"pJqtWZndAPddJmt6YJQ+dU3pDu8CAwEAAaNjMGEwHwYDVR0jBBgwFoAUsMep0t2yKFZzBJSM\n"
+"FFxIbzdSkqgwHQYDVR0OBBYEFLDHqdLdsihWcwSUjBRcSG83UpKoMA4GA1UdDwEB/wQEAwIB\n"
+"BjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQBdYzFsNGDRk7bR/AgRKq+5\n"
+"637YuOW+w6uhpoS0VnKMUpyHCwku86hEvqivakPtfmlm4bFwt++sb/8OXsWBqtfbXMaBNDTZ\n"
+"l8XRMJuLWOW2JrbKkRzgG0eBUcvsadG1rrhbmZqYvFXaAZO7o4TdOZzxhBB5GOAWWXB3Iera\n"
+"NP4J63zyo9n8Gqw3sJBG44em5hoYjBffP+npibyslnslRi4L6xHsCYj/Pab+OlqbMCB6v+sT\n"
+"CLeEIukRVzoR9aQ45pEK7Z1QBnSsbAKQtss0JKD9d/mX143H1xePjPhTXlv5JCkhrcj+SShz\n"
+"0P9+EHoWe6m9lyUEOIVn0rp+yVJWNbmyDv3VkwFxHC1ApSQsgSimjGQ4wtr6cSmordYxkV+R\n"
+"o8lOIIhRksXPyDk27gW6IjUXCkZKpxFjkL3jiBSc8SkxnwCWtXg8xwNwdFVNBGLCCuJnsneY\n"
+"XjJNqzRqUcoGwzsvF3Qi/ZnHUNvISdevlgIAXL4Wvrxaqvoa01wB+GCfs57RTGE4TvAGhKNK\n"
+"us8K3hRT1BSpigzMIRzSxtAOrqPN6j//QSmW9f8Jcncri4j2ihSpVrFU0NdNkMhZeAKidTFP\n"
+"sxCVFuW4Aniz7jqiw5sWtjbQrlW035izIEU4sYwQoC1Nx0Svy+mMTRai50LqFQ+A1/Hq6xHH\n"
+"DNx7CI83d23Erw==\n"
+"-----END CERTIFICATE-----",
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/tools/certdata.txt b/tools/certdata.txt
index fafc33ddeea5..f2f8edc685ad 100644
--- a/tools/certdata.txt
+++ b/tools/certdata.txt
@@ -2453,181 +2453,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "ePKI Root Certification Authority"
-#
-# Issuer: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW
-# Serial Number:15:c8:bd:65:47:5c:af:b8:97:00:5e:e4:06:d2:bc:9d
-# Subject: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW
-# Not Valid Before: Mon Dec 20 02:31:27 2004
-# Not Valid After : Wed Dec 20 02:31:27 2034
-# Fingerprint (SHA-256): C0:A6:F4:DC:63:A2:4B:FD:CF:54:EF:2A:6A:08:2A:0A:72:DE:35:80:3E:2F:F5:FF:52:7A:E5:D8:72:06:DF:D5
-# Fingerprint (SHA1): 67:65:0D:F1:7E:8E:7E:5B:82:40:A4:F4:56:4B:CF:E2:3D:69:C6:F0
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "ePKI Root Certification Authority"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\136\061\013\060\011\006\003\125\004\006\023\002\124\127\061
-\043\060\041\006\003\125\004\012\014\032\103\150\165\156\147\150
-\167\141\040\124\145\154\145\143\157\155\040\103\157\056\054\040
-\114\164\144\056\061\052\060\050\006\003\125\004\013\014\041\145
-\120\113\111\040\122\157\157\164\040\103\145\162\164\151\146\151
-\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164\171
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\136\061\013\060\011\006\003\125\004\006\023\002\124\127\061
-\043\060\041\006\003\125\004\012\014\032\103\150\165\156\147\150
-\167\141\040\124\145\154\145\143\157\155\040\103\157\056\054\040
-\114\164\144\056\061\052\060\050\006\003\125\004\013\014\041\145
-\120\113\111\040\122\157\157\164\040\103\145\162\164\151\146\151
-\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164\171
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\025\310\275\145\107\134\257\270\227\000\136\344\006\322
-\274\235
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\005\260\060\202\003\230\240\003\002\001\002\002\020\025
-\310\275\145\107\134\257\270\227\000\136\344\006\322\274\235\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\136
-\061\013\060\011\006\003\125\004\006\023\002\124\127\061\043\060
-\041\006\003\125\004\012\014\032\103\150\165\156\147\150\167\141
-\040\124\145\154\145\143\157\155\040\103\157\056\054\040\114\164
-\144\056\061\052\060\050\006\003\125\004\013\014\041\145\120\113
-\111\040\122\157\157\164\040\103\145\162\164\151\146\151\143\141
-\164\151\157\156\040\101\165\164\150\157\162\151\164\171\060\036
-\027\015\060\064\061\062\062\060\060\062\063\061\062\067\132\027
-\015\063\064\061\062\062\060\060\062\063\061\062\067\132\060\136
-\061\013\060\011\006\003\125\004\006\023\002\124\127\061\043\060
-\041\006\003\125\004\012\014\032\103\150\165\156\147\150\167\141
-\040\124\145\154\145\143\157\155\040\103\157\056\054\040\114\164
-\144\056\061\052\060\050\006\003\125\004\013\014\041\145\120\113
-\111\040\122\157\157\164\040\103\145\162\164\151\146\151\143\141
-\164\151\157\156\040\101\165\164\150\157\162\151\164\171\060\202
-\002\042\060\015\006\011\052\206\110\206\367\015\001\001\001\005
-\000\003\202\002\017\000\060\202\002\012\002\202\002\001\000\341
-\045\017\356\215\333\210\063\165\147\315\255\037\175\072\116\155
-\235\323\057\024\363\143\164\313\001\041\152\067\352\204\120\007
-\113\046\133\011\103\154\041\236\152\310\325\003\365\140\151\217
-\314\360\042\344\037\347\367\152\042\061\267\054\025\362\340\376
-\000\152\103\377\207\145\306\265\032\301\247\114\155\042\160\041
-\212\061\362\227\164\211\011\022\046\034\236\312\331\022\242\225
-\074\332\351\147\277\010\240\144\343\326\102\267\105\357\227\364
-\366\365\327\265\112\025\002\130\175\230\130\113\140\274\315\327
-\015\232\023\063\123\321\141\371\172\325\327\170\263\232\063\367
-\000\206\316\035\115\224\070\257\250\354\170\121\160\212\134\020
-\203\121\041\367\021\075\064\206\136\345\110\315\227\201\202\065
-\114\031\354\145\366\153\305\005\241\356\107\023\326\263\041\047
-\224\020\012\331\044\073\272\276\104\023\106\060\077\227\074\330
-\327\327\152\356\073\070\343\053\324\227\016\271\033\347\007\111
-\177\067\052\371\167\170\317\124\355\133\106\235\243\200\016\221
-\103\301\326\133\137\024\272\237\246\215\044\107\100\131\277\162
-\070\262\066\154\067\377\231\321\135\016\131\012\253\151\367\300
-\262\004\105\172\124\000\256\276\123\366\265\347\341\370\074\243
-\061\322\251\376\041\122\144\305\246\147\360\165\007\006\224\024
-\201\125\306\047\344\001\217\027\301\152\161\327\276\113\373\224
-\130\175\176\021\063\261\102\367\142\154\030\326\317\011\150\076
-\177\154\366\036\217\142\255\245\143\333\011\247\037\042\102\101
-\036\157\231\212\076\327\371\077\100\172\171\260\245\001\222\322
-\235\075\010\025\245\020\001\055\263\062\166\250\225\015\263\172
-\232\373\007\020\170\021\157\341\217\307\272\017\045\032\164\052
-\345\034\230\101\231\337\041\207\350\225\006\152\012\263\152\107
-\166\145\366\072\317\217\142\027\031\173\012\050\315\032\322\203
-\036\041\307\054\277\276\377\141\150\267\147\033\273\170\115\215
-\316\147\345\344\301\216\267\043\146\342\235\220\165\064\230\251
-\066\053\212\232\224\271\235\354\314\212\261\370\045\211\134\132
-\266\057\214\037\155\171\044\247\122\150\303\204\065\342\146\215
-\143\016\045\115\325\031\262\346\171\067\247\042\235\124\061\002
-\003\001\000\001\243\152\060\150\060\035\006\003\125\035\016\004
-\026\004\024\036\014\367\266\147\362\341\222\046\011\105\300\125
-\071\056\167\077\102\112\242\060\014\006\003\125\035\023\004\005
-\060\003\001\001\377\060\071\006\004\147\052\007\000\004\061\060
-\057\060\055\002\001\000\060\011\006\005\053\016\003\002\032\005
-\000\060\007\006\005\147\052\003\000\000\004\024\105\260\302\307
-\012\126\174\356\133\170\014\225\371\030\123\301\246\034\330\020
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\003
-\202\002\001\000\011\263\203\123\131\001\076\225\111\271\361\201
-\272\371\166\040\043\265\047\140\164\324\152\231\064\136\154\000
-\123\331\237\362\246\261\044\007\104\152\052\306\245\216\170\022
-\350\107\331\130\033\023\052\136\171\233\237\012\052\147\246\045
-\077\006\151\126\163\303\212\146\110\373\051\201\127\164\006\312
-\234\352\050\350\070\147\046\053\361\325\265\077\145\223\370\066
-\135\216\215\215\100\040\207\031\352\357\047\300\075\264\071\017
-\045\173\150\120\164\125\234\014\131\175\132\075\101\224\045\122
-\010\340\107\054\025\061\031\325\277\007\125\306\273\022\265\227
-\364\137\203\205\272\161\301\331\154\201\021\166\012\012\260\277
-\202\227\367\352\075\372\372\354\055\251\050\224\073\126\335\322
-\121\056\256\300\275\010\025\214\167\122\064\226\326\233\254\323
-\035\216\141\017\065\173\233\256\071\151\013\142\140\100\040\066
-\217\257\373\066\356\055\010\112\035\270\277\233\134\370\352\245
-\033\240\163\246\330\370\156\340\063\004\137\150\252\047\207\355
-\331\301\220\234\355\275\343\152\065\257\143\337\253\030\331\272
-\346\351\112\352\120\212\017\141\223\036\342\055\031\342\060\224
-\065\222\135\016\266\007\257\031\200\217\107\220\121\113\056\115
-\335\205\342\322\012\122\012\027\232\374\032\260\120\002\345\001
-\243\143\067\041\114\104\304\233\121\231\021\016\163\234\006\217
-\124\056\247\050\136\104\071\207\126\055\067\275\205\104\224\341
-\014\113\054\234\303\222\205\064\141\313\017\270\233\112\103\122
-\376\064\072\175\270\351\051\334\166\251\310\060\370\024\161\200
-\306\036\066\110\164\042\101\134\207\202\350\030\161\213\101\211
-\104\347\176\130\133\250\270\215\023\351\247\154\303\107\355\263
-\032\235\142\256\215\202\352\224\236\335\131\020\303\255\335\342
-\115\343\061\325\307\354\350\362\260\376\222\036\026\012\032\374
-\331\363\370\047\266\311\276\035\264\154\144\220\177\364\344\304
-\133\327\067\256\102\016\335\244\032\157\174\210\124\305\026\156
-\341\172\150\056\370\072\277\015\244\074\211\073\170\247\116\143
-\203\004\041\010\147\215\362\202\111\320\133\375\261\315\017\203
-\204\324\076\040\205\367\112\075\053\234\375\052\012\011\115\352
-\201\370\021\234
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-# For Server Distrust After: Tue Apr 15 23:59:59 2025
-CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
-\062\065\060\064\061\065\062\063\065\071\065\071\132
-END
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
-
-# Trust for "ePKI Root Certification Authority"
-# Issuer: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW
-# Serial Number:15:c8:bd:65:47:5c:af:b8:97:00:5e:e4:06:d2:bc:9d
-# Subject: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW
-# Not Valid Before: Mon Dec 20 02:31:27 2004
-# Not Valid After : Wed Dec 20 02:31:27 2034
-# Fingerprint (SHA-256): C0:A6:F4:DC:63:A2:4B:FD:CF:54:EF:2A:6A:08:2A:0A:72:DE:35:80:3E:2F:F5:FF:52:7A:E5:D8:72:06:DF:D5
-# Fingerprint (SHA1): 67:65:0D:F1:7E:8E:7E:5B:82:40:A4:F4:56:4B:CF:E2:3D:69:C6:F0
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "ePKI Root Certification Authority"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\147\145\015\361\176\216\176\133\202\100\244\364\126\113\317\342
-\075\151\306\360
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\033\056\000\312\046\006\220\075\255\376\157\025\150\323\153\263
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\136\061\013\060\011\006\003\125\004\006\023\002\124\127\061
-\043\060\041\006\003\125\004\012\014\032\103\150\165\156\147\150
-\167\141\040\124\145\154\145\143\157\155\040\103\157\056\054\040
-\114\164\144\056\061\052\060\050\006\003\125\004\013\014\041\145
-\120\113\111\040\122\157\157\164\040\103\145\162\164\151\146\151
-\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164\171
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\025\310\275\145\107\134\257\270\227\000\136\344\006\322
-\274\235
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "NetLock Arany (Class Gold) Főtanúsítvány"
 #
@@ -5846,7 +5671,7 @@ END
 CKA_SERIAL_NUMBER MULTILINE_OCTAL
 \002\010\134\063\313\142\054\137\263\062
 END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
@@ -24763,3 +24588,1013 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "SECOM TLS RSA Root CA 2024"
+#
+# Issuer: CN=SECOM TLS RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Serial Number:00:ee:89:34:d0:cb:80:e0:b2
+# Subject: CN=SECOM TLS RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Not Valid Before: Wed Jan 31 05:11:55 2024
+# Not Valid After : Thu Jan 14 05:11:55 2049
+# Fingerprint (SHA-256): 14:35:F2:25:C5:D2:52:D7:A2:19:48:CC:3C:E6:2A:EC:FA:88:00:1E:3D:D7:2D:1C:C3:55:51:00:EB:37:2F:93
+# Fingerprint (SHA1): FB:97:96:7C:EF:8D:98:63:06:C0:3B:B6:11:F8:E0:13:97:A2:98:D3
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "SECOM TLS RSA Root CA 2024"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\132\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\043\060\041\006\003\125\004\003
+\023\032\123\105\103\117\115\040\124\114\123\040\122\123\101\040
+\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\132\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\043\060\041\006\003\125\004\003
+\023\032\123\105\103\117\115\040\124\114\123\040\122\123\101\040
+\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\011\000\356\211\064\320\313\200\340\262
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\005\232\060\202\003\202\240\003\002\001\002\002\011\000
+\356\211\064\320\313\200\340\262\060\015\006\011\052\206\110\206
+\367\015\001\001\014\005\000\060\132\061\013\060\011\006\003\125
+\004\006\023\002\112\120\061\046\060\044\006\003\125\004\012\023
+\035\123\105\103\117\115\040\124\162\165\163\164\040\123\171\163
+\164\145\155\163\040\103\157\056\054\040\114\164\144\056\061\043
+\060\041\006\003\125\004\003\023\032\123\105\103\117\115\040\124
+\114\123\040\122\123\101\040\122\157\157\164\040\103\101\040\062
+\060\062\064\060\036\027\015\062\064\060\061\063\061\060\065\061
+\061\065\065\132\027\015\064\071\060\061\061\064\060\065\061\061
+\065\065\132\060\132\061\013\060\011\006\003\125\004\006\023\002
+\112\120\061\046\060\044\006\003\125\004\012\023\035\123\105\103
+\117\115\040\124\162\165\163\164\040\123\171\163\164\145\155\163
+\040\103\157\056\054\040\114\164\144\056\061\043\060\041\006\003
+\125\004\003\023\032\123\105\103\117\115\040\124\114\123\040\122
+\123\101\040\122\157\157\164\040\103\101\040\062\060\062\064\060
+\202\002\042\060\015\006\011\052\206\110\206\367\015\001\001\001
+\005\000\003\202\002\017\000\060\202\002\012\002\202\002\001\000
+\341\070\342\315\114\063\305\262\047\253\304\361\327\130\032\025
+\203\144\345\363\276\337\214\273\117\043\070\235\350\164\122\002
+\371\044\206\133\044\322\323\317\154\177\374\277\301\357\137\271
+\233\245\372\234\142\053\355\336\045\024\220\106\266\063\272\357
+\270\127\073\077\167\316\107\026\151\104\346\335\126\316\002\060
+\145\267\206\026\306\127\034\160\021\327\271\236\350\335\017\270
+\107\352\053\232\260\135\035\342\165\011\065\004\033\313\155\101
+\262\210\227\161\273\071\226\033\234\177\077\244\377\034\214\373
+\233\377\111\003\124\333\214\316\236\361\261\124\121\070\350\254
+\102\336\167\174\312\011\056\126\040\241\346\333\270\312\141\072
+\243\002\266\071\011\355\036\236\174\103\037\056\237\024\001\130
+\275\145\242\321\237\276\204\117\360\211\222\117\166\346\167\156
+\272\347\302\340\026\255\113\211\247\134\131\261\067\113\324\135
+\275\042\217\320\174\073\360\374\202\054\120\022\305\122\017\201
+\212\360\125\221\076\035\333\125\337\372\157\067\144\034\142\143
+\313\155\127\043\114\236\215\132\046\145\106\321\254\347\315\273
+\075\033\240\361\225\326\233\165\361\361\102\337\322\007\100\113
+\141\334\341\152\157\223\103\073\162\376\003\326\315\251\070\000
+\311\110\021\230\211\370\271\310\003\163\364\142\374\251\267\127
+\235\156\171\230\362\327\374\244\322\254\011\125\247\100\125\132
+\302\267\236\242\065\345\316\310\113\363\044\000\306\200\064\074
+\023\123\335\152\247\055\360\054\247\317\376\073\105\344\014\353
+\153\305\140\355\074\301\304\044\256\071\227\376\327\254\212\112
+\065\127\134\262\151\376\204\174\374\324\027\071\232\033\057\161
+\276\100\260\165\271\265\344\107\123\242\123\243\023\101\366\125
+\276\177\000\360\316\310\041\104\242\110\230\032\145\323\055\320
+\024\227\114\012\147\202\062\216\101\306\317\055\043\206\226\227
+\021\161\077\030\227\004\274\216\225\314\107\041\215\240\113\323
+\161\011\322\037\151\033\203\252\170\203\262\160\253\300\243\160
+\076\115\267\255\311\373\053\201\214\207\315\115\032\357\372\224
+\214\146\255\324\000\052\326\165\145\214\312\112\252\230\247\075
+\073\037\375\337\107\337\321\123\121\342\113\355\072\163\316\065
+\002\003\001\000\001\243\143\060\141\060\035\006\003\125\035\016
+\004\026\004\024\054\353\162\022\216\130\167\144\065\025\126\065
+\001\127\007\251\175\015\066\346\060\037\006\003\125\035\043\004
+\030\060\026\200\024\054\353\162\022\216\130\167\144\065\025\126
+\065\001\127\007\251\175\015\066\346\060\016\006\003\125\035\017
+\001\001\377\004\004\003\002\001\006\060\017\006\003\125\035\023
+\001\001\377\004\005\060\003\001\001\377\060\015\006\011\052\206
+\110\206\367\015\001\001\014\005\000\003\202\002\001\000\025\302
+\313\345\271\046\237\151\354\371\264\123\321\376\024\123\007\064
+\161\023\043\014\100\135\327\045\160\225\213\174\236\201\234\212
+\241\347\073\206\141\072\217\035\231\063\302\240\063\131\047\333
+\042\121\300\125\307\137\314\324\133\331\301\054\100\326\163\214
+\056\023\302\353\225\232\241\031\223\075\244\224\027\032\141\263
+\105\353\003\045\136\211\201\020\147\153\350\370\260\015\114\357
+\042\035\226\362\364\260\007\305\134\120\223\105\245\223\017\201
+\065\127\337\121\056\261\163\131\364\334\013\347\265\363\110\103
+\270\323\051\250\341\050\343\257\245\061\345\277\132\370\173\211
+\363\220\263\351\042\053\103\266\200\174\120\014\334\154\225\046
+\257\234\053\070\127\271\174\035\020\311\330\266\265\322\216\364
+\006\216\325\057\067\365\133\303\001\276\375\025\116\174\101\370
+\330\323\346\244\300\156\021\205\207\321\257\247\200\132\046\231
+\235\121\375\002\344\041\017\351\326\320\225\370\061\131\374\330
+\257\257\162\125\076\235\075\000\176\030\121\032\143\115\310\061
+\217\200\160\020\254\372\211\265\174\334\153\101\173\175\316\212
+\037\060\023\105\154\270\157\244\321\377\046\305\326\164\145\063
+\174\326\316\327\153\254\301\066\271\301\250\174\054\035\174\025
+\064\015\333\374\317\035\211\257\004\112\013\273\045\040\147\117
+\125\064\262\150\345\200\064\221\162\055\125\211\013\214\307\266
+\112\054\163\053\213\034\120\173\374\324\202\275\364\217\165\015
+\154\173\027\003\025\053\015\261\200\132\176\144\266\001\331\331
+\351\101\012\352\302\125\272\342\011\107\121\302\266\067\320\103
+\262\170\313\113\027\231\371\103\304\012\037\121\304\176\026\001
+\302\242\145\157\234\251\242\214\232\023\366\130\027\321\340\207
+\021\354\323\213\337\151\245\327\127\154\363\270\141\127\120\231
+\131\141\102\044\007\002\211\326\031\317\240\231\153\307\261\314
+\172\043\077\324\201\345\021\364\376\375\112\164\160\042\262\250
+\122\216\322\145\375\102\000\034\204\070\361\351\116\237\314\053
+\115\321\132\247\206\033\345\241\340\226\143\036\067\037\237\000
+\210\103\226\345\225\177\024\316\354\176\035\114\365\076\110\125
+\121\060\260\041\373\014\012\145\372\233\367\211\314\171
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "SECOM TLS RSA Root CA 2024"
+# Issuer: CN=SECOM TLS RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Serial Number:00:ee:89:34:d0:cb:80:e0:b2
+# Subject: CN=SECOM TLS RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Not Valid Before: Wed Jan 31 05:11:55 2024
+# Not Valid After : Thu Jan 14 05:11:55 2049
+# Fingerprint (SHA-256): 14:35:F2:25:C5:D2:52:D7:A2:19:48:CC:3C:E6:2A:EC:FA:88:00:1E:3D:D7:2D:1C:C3:55:51:00:EB:37:2F:93
+# Fingerprint (SHA1): FB:97:96:7C:EF:8D:98:63:06:C0:3B:B6:11:F8:E0:13:97:A2:98:D3
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "SECOM TLS RSA Root CA 2024"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\373\227\226\174\357\215\230\143\006\300\073\266\021\370\340\023
+\227\242\230\323
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\320\244\333\062\353\104\230\322\142\013\076\274\115\174\134\351
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\132\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\043\060\041\006\003\125\004\003
+\023\032\123\105\103\117\115\040\124\114\123\040\122\123\101\040
+\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\011\000\356\211\064\320\313\200\340\262
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "SECOM TLS ECC Root CA 2024"
+#
+# Issuer: CN=SECOM TLS ECC Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Serial Number:00:81:7a:2c:ef:8f:23:7a:44
+# Subject: CN=SECOM TLS ECC Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Not Valid Before: Wed Jan 31 05:52:34 2024
+# Not Valid After : Thu Jan 14 05:52:34 2049
+# Fingerprint (SHA-256): 6A:B2:AB:75:F5:1C:B4:F4:F0:15:62:03:FB:F6:F6:46:23:2F:51:4B:E0:59:F6:28:33:30:8B:82:B4:D7:2D:B1
+# Fingerprint (SHA1): 7A:1F:22:2D:72:B2:C3:19:87:44:DB:61:69:E8:A6:4B:D7:0D:44:0E
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "SECOM TLS ECC Root CA 2024"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\132\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\043\060\041\006\003\125\004\003
+\023\032\123\105\103\117\115\040\124\114\123\040\105\103\103\040
+\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\132\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\043\060\041\006\003\125\004\003
+\023\032\123\105\103\117\115\040\124\114\123\040\105\103\103\040
+\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\011\000\201\172\054\357\217\043\172\104
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\002\114\060\202\001\321\240\003\002\001\002\002\011\000
+\201\172\054\357\217\043\172\104\060\012\006\010\052\206\110\316
+\075\004\003\003\060\132\061\013\060\011\006\003\125\004\006\023
+\002\112\120\061\046\060\044\006\003\125\004\012\023\035\123\105
+\103\117\115\040\124\162\165\163\164\040\123\171\163\164\145\155
+\163\040\103\157\056\054\040\114\164\144\056\061\043\060\041\006
+\003\125\004\003\023\032\123\105\103\117\115\040\124\114\123\040
+\105\103\103\040\122\157\157\164\040\103\101\040\062\060\062\064
+\060\036\027\015\062\064\060\061\063\061\060\065\065\062\063\064
+\132\027\015\064\071\060\061\061\064\060\065\065\062\063\064\132
+\060\132\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\043\060\041\006\003\125\004\003
+\023\032\123\105\103\117\115\040\124\114\123\040\105\103\103\040
+\122\157\157\164\040\103\101\040\062\060\062\064\060\166\060\020
+\006\007\052\206\110\316\075\002\001\006\005\053\201\004\000\042
+\003\142\000\004\354\334\305\062\333\275\167\064\027\110\320\265
+\331\366\233\223\117\206\224\056\137\212\160\167\107\265\332\146
+\211\321\121\335\264\150\130\226\071\273\156\064\020\213\121\224
+\237\223\244\027\000\116\171\006\061\027\261\164\077\064\157\062
+\122\250\234\136\073\056\366\113\003\053\162\131\006\000\260\054
+\345\141\353\351\360\045\164\357\262\217\335\022\077\306\121\201
+\371\230\027\150\243\143\060\141\060\035\006\003\125\035\016\004
+\026\004\024\073\166\021\173\051\164\342\116\006\114\126\202\100
+\320\041\057\172\263\311\325\060\037\006\003\125\035\043\004\030
+\060\026\200\024\073\166\021\173\051\164\342\116\006\114\126\202
+\100\320\041\057\172\263\311\325\060\016\006\003\125\035\017\001
+\001\377\004\004\003\002\001\006\060\017\006\003\125\035\023\001
+\001\377\004\005\060\003\001\001\377\060\012\006\010\052\206\110
+\316\075\004\003\003\003\151\000\060\146\002\061\000\335\342\157
+\307\342\326\223\030\264\003\343\062\051\101\345\356\177\037\353
+\171\010\275\061\074\277\234\147\232\023\115\233\222\012\072\100
+\237\133\373\027\365\100\257\306\305\305\005\300\243\002\061\000
+\253\001\124\355\100\010\132\173\262\114\063\076\367\157\324\105
+\030\345\257\075\355\141\213\117\211\133\371\270\361\024\005\262
+\227\314\003\161\222\135\300\146\177\244\001\361\267\120\011\326
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "SECOM TLS ECC Root CA 2024"
+# Issuer: CN=SECOM TLS ECC Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Serial Number:00:81:7a:2c:ef:8f:23:7a:44
+# Subject: CN=SECOM TLS ECC Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Not Valid Before: Wed Jan 31 05:52:34 2024
+# Not Valid After : Thu Jan 14 05:52:34 2049
+# Fingerprint (SHA-256): 6A:B2:AB:75:F5:1C:B4:F4:F0:15:62:03:FB:F6:F6:46:23:2F:51:4B:E0:59:F6:28:33:30:8B:82:B4:D7:2D:B1
+# Fingerprint (SHA1): 7A:1F:22:2D:72:B2:C3:19:87:44:DB:61:69:E8:A6:4B:D7:0D:44:0E
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "SECOM TLS ECC Root CA 2024"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\172\037\042\055\162\262\303\031\207\104\333\141\151\350\246\113
+\327\015\104\016
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\231\323\235\344\322\261\055\360\052\004\147\205\363\337\106\326
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\132\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\043\060\041\006\003\125\004\003
+\023\032\123\105\103\117\115\040\124\114\123\040\105\103\103\040
+\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\011\000\201\172\054\357\217\043\172\104
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "SECOM SMIME RSA Root CA 2024"
+#
+# Issuer: CN=SECOM SMIME RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Serial Number:00:dd:a9:db:9e:7e:bc:d4:6d
+# Subject: CN=SECOM SMIME RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Not Valid Before: Wed Jan 31 06:23:06 2024
+# Not Valid After : Thu Jan 14 06:23:06 2049
+# Fingerprint (SHA-256): 36:29:E7:18:8E:00:A7:CB:32:32:C4:42:6B:C8:49:12:F1:21:8B:1A:9A:E6:76:C0:B0:AB:E1:DB:FE:21:82:B5
+# Fingerprint (SHA1): 90:A5:E1:BD:C5:3F:69:08:C2:E3:73:9F:E7:55:E3:7F:75:F3:84:47
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "SECOM SMIME RSA Root CA 2024"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\134\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\045\060\043\006\003\125\004\003
+\023\034\123\105\103\117\115\040\123\115\111\115\105\040\122\123
+\101\040\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\134\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\045\060\043\006\003\125\004\003
+\023\034\123\105\103\117\115\040\123\115\111\115\105\040\122\123
+\101\040\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\011\000\335\251\333\236\176\274\324\155
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\005\236\060\202\003\206\240\003\002\001\002\002\011\000
+\335\251\333\236\176\274\324\155\060\015\006\011\052\206\110\206
+\367\015\001\001\014\005\000\060\134\061\013\060\011\006\003\125
+\004\006\023\002\112\120\061\046\060\044\006\003\125\004\012\023
+\035\123\105\103\117\115\040\124\162\165\163\164\040\123\171\163
+\164\145\155\163\040\103\157\056\054\040\114\164\144\056\061\045
+\060\043\006\003\125\004\003\023\034\123\105\103\117\115\040\123
+\115\111\115\105\040\122\123\101\040\122\157\157\164\040\103\101
+\040\062\060\062\064\060\036\027\015\062\064\060\061\063\061\060
+\066\062\063\060\066\132\027\015\064\071\060\061\061\064\060\066
+\062\063\060\066\132\060\134\061\013\060\011\006\003\125\004\006
+\023\002\112\120\061\046\060\044\006\003\125\004\012\023\035\123
+\105\103\117\115\040\124\162\165\163\164\040\123\171\163\164\145
+\155\163\040\103\157\056\054\040\114\164\144\056\061\045\060\043
+\006\003\125\004\003\023\034\123\105\103\117\115\040\123\115\111
+\115\105\040\122\123\101\040\122\157\157\164\040\103\101\040\062
+\060\062\064\060\202\002\042\060\015\006\011\052\206\110\206\367
+\015\001\001\001\005\000\003\202\002\017\000\060\202\002\012\002
+\202\002\001\000\301\312\336\306\344\326\154\327\326\170\031\114
+\105\145\246\144\314\126\243\202\175\214\212\325\211\332\015\345
+\357\140\077\143\221\372\360\007\033\147\266\077\301\300\356\202
+\031\226\121\311\053\102\156\376\123\107\212\242\346\206\027\325
+\312\247\266\077\111\010\320\310\375\175\052\072\056\305\013\152
+\226\204\104\114\213\335\010\124\033\263\002\247\103\024\104\135
+\157\062\074\061\202\121\304\342\301\206\375\334\170\172\270\345
+\070\160\233\324\116\037\024\262\057\352\013\032\166\144\050\211
+\047\253\162\171\310\341\135\017\274\026\255\126\312\243\232\040
+\122\120\252\037\062\270\124\133\171\350\374\165\070\240\300\357
+\106\362\313\007\203\121\057\271\172\105\273\221\345\367\034\074
+\302\315\174\307\005\150\324\322\210\306\310\226\231\055\014\005
+\163\314\060\007\220\166\341\003\060\025\165\001\136\320\163\150
+\172\251\020\213\322\106\353\176\057\112\126\145\003\050\213\117
+\031\360\211\175\131\371\370\034\155\177\331\341\331\231\212\304
+\104\226\274\043\044\103\311\161\373\115\151\232\101\045\250\362
+\142\264\235\356\274\020\063\070\067\277\043\013\164\314\276\063
+\060\207\054\032\263\054\200\277\236\264\104\375\316\351\040\130
+\233\031\204\347\150\270\161\177\131\242\322\012\017\252\007\310
+\143\026\334\300\363\014\216\223\321\124\355\201\006\056\115\203
+\015\104\254\115\061\105\356\165\273\114\106\056\255\245\305\037
+\211\242\044\142\223\333\206\072\262\164\242\330\072\103\354\146
+\344\024\221\030\274\014\063\017\214\107\225\011\006\371\320\376
+\227\156\066\062\013\342\140\361\306\163\135\040\367\206\251\033
+\150\361\165\045\131\242\253\276\147\060\247\262\263\303\156\370
+\242\110\163\207\161\216\015\312\134\043\265\221\165\353\257\013
+\263\114\170\360\227\164\351\124\056\336\100\227\252\246\343\173
+\130\366\244\355\016\120\240\371\176\240\056\064\014\127\001\370
+\376\302\370\301\267\254\301\343\363\254\151\305\144\126\262\255
+\320\100\271\333\233\165\046\061\050\367\152\160\123\270\165\022
+\275\025\142\160\036\337\020\107\242\165\147\140\325\137\162\154
+\201\315\344\111\275\156\365\020\013\301\301\135\220\317\323\023
+\155\342\312\103\002\003\001\000\001\243\143\060\141\060\035\006
+\003\125\035\016\004\026\004\024\173\341\234\250\066\034\107\244
+\004\373\001\202\157\272\161\101\065\034\060\260\060\037\006\003
+\125\035\043\004\030\060\026\200\024\173\341\234\250\066\034\107
+\244\004\373\001\202\157\272\161\101\065\034\060\260\060\016\006
+\003\125\035\017\001\001\377\004\004\003\002\001\006\060\017\006
+\003\125\035\023\001\001\377\004\005\060\003\001\001\377\060\015
+\006\011\052\206\110\206\367\015\001\001\014\005\000\003\202\002
+\001\000\264\266\325\373\106\055\356\273\274\174\332\064\357\344
+\260\131\050\312\106\144\274\042\345\010\226\341\032\033\366\044
+\316\331\131\140\142\315\033\252\132\014\174\270\174\164\133\342
+\204\074\044\270\147\167\230\034\156\150\341\152\244\265\265\063
+\222\230\005\171\036\011\272\130\321\352\202\127\124\165\034\144
+\313\101\240\216\241\174\002\104\173\271\250\147\072\172\122\116
+\072\273\201\177\305\145\364\323\032\145\357\120\375\200\237\115
+\011\222\132\001\133\251\247\060\120\200\152\226\177\122\114\034
+\077\146\345\044\224\302\031\252\004\050\237\303\026\060\316\364
+\163\327\264\316\076\317\027\033\072\141\240\166\040\076\012\113
+\063\335\271\330\101\173\224\243\174\266\014\121\244\122\206\233
+\131\116\173\340\332\366\121\304\042\376\045\271\071\152\275\146
+\323\125\236\122\246\141\175\113\054\314\037\256\061\152\364\075
+\230\017\100\003\073\254\146\141\067\337\373\041\223\201\332\324
+\041\027\035\227\021\373\250\216\262\175\202\174\136\326\173\102
+\241\251\033\223\355\042\072\355\224\220\173\367\136\131\073\376
+\165\034\126\205\367\210\113\100\155\251\070\126\041\256\345\025
+\033\102\131\237\377\314\006\073\066\233\121\067\177\130\062\303
+\136\153\230\001\035\301\273\114\022\164\017\152\100\015\117\102
+\062\212\356\072\175\223\250\344\370\041\106\254\140\161\361\115
+\151\046\072\175\365\342\070\102\207\113\372\273\202\124\336\353
+\116\170\310\246\153\332\236\241\254\200\233\111\375\046\276\302
+\027\270\115\250\010\150\031\102\372\305\101\017\030\343\356\010
+\330\037\043\207\020\316\325\361\010\071\103\247\367\353\143\010
+\067\141\077\173\336\203\045\265\134\162\125\357\333\060\072\023
+\325\231\113\107\261\200\276\317\177\200\331\024\014\273\340\234
+\372\011\213\015\001\042\071\154\354\135\304\226\260\055\044\065
+\021\340\005\175\102\151\167\052\101\036\241\305\154\371\275\321
+\046\240\360\255\103\170\213\326\240\134\322\226\001\345\335\354
+\356\310\117\346\140\124\113\014\020\207\207\345\313\167\147\132
+\002\326\221\126\213\356\032\235\346\034\016\366\344\033\000\101
+\240\124\034\056\217\336\322\247\166\147\341\343\237\350\157\007
+\044\244
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "SECOM SMIME RSA Root CA 2024"
+# Issuer: CN=SECOM SMIME RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Serial Number:00:dd:a9:db:9e:7e:bc:d4:6d
+# Subject: CN=SECOM SMIME RSA Root CA 2024,O="SECOM Trust Systems Co., Ltd.",C=JP
+# Not Valid Before: Wed Jan 31 06:23:06 2024
+# Not Valid After : Thu Jan 14 06:23:06 2049
+# Fingerprint (SHA-256): 36:29:E7:18:8E:00:A7:CB:32:32:C4:42:6B:C8:49:12:F1:21:8B:1A:9A:E6:76:C0:B0:AB:E1:DB:FE:21:82:B5
+# Fingerprint (SHA1): 90:A5:E1:BD:C5:3F:69:08:C2:E3:73:9F:E7:55:E3:7F:75:F3:84:47
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "SECOM SMIME RSA Root CA 2024"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\220\245\341\275\305\077\151\010\302\343\163\237\347\125\343\177
+\165\363\204\107
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\241\313\205\021\231\325\204\012\342\151\245\257\066\061\142\220
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\134\061\013\060\011\006\003\125\004\006\023\002\112\120\061
+\046\060\044\006\003\125\004\012\023\035\123\105\103\117\115\040
+\124\162\165\163\164\040\123\171\163\164\145\155\163\040\103\157
+\056\054\040\114\164\144\056\061\045\060\043\006\003\125\004\003
+\023\034\123\105\103\117\115\040\123\115\111\115\105\040\122\123
+\101\040\122\157\157\164\040\103\101\040\062\060\062\064
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\011\000\335\251\333\236\176\274\324\155
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "Telia EC Email Root CA v3"
+#
+# Issuer: CN=Telia EC Email Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:e1:0c:1e:d8:0d:94:03:87:05:11:00:a6
+# Subject: CN=Telia EC Email Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 12:14:14 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): 36:82:22:8D:7D:67:8B:57:14:40:CF:1C:B3:4E:69:FB:41:35:FD:6C:2A:1B:E3:8E:14:16:3B:71:1E:02:AE:01
+# Fingerprint (SHA1): 33:EA:1C:7E:79:CF:31:66:FD:B9:FA:32:47:73:FB:B7:89:01:00:4F
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia EC Email Root CA v3"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\114\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\042\060\040\006\003
+\125\004\003\014\031\124\145\154\151\141\040\105\103\040\105\155
+\141\151\154\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\114\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\042\060\040\006\003
+\125\004\003\014\031\124\145\154\151\141\040\105\103\040\105\155
+\141\151\154\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\341\014\036\330\015\224\003\207\005\021\000
+\246
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\002\065\060\202\001\273\240\003\002\001\002\002\017\001
+\213\322\341\014\036\330\015\224\003\207\005\021\000\246\060\012
+\006\010\052\206\110\316\075\004\003\003\060\114\061\013\060\011
+\006\003\125\004\006\023\002\123\105\061\031\060\027\006\003\125
+\004\012\014\020\124\145\154\151\141\040\103\157\155\160\141\156
+\171\040\101\102\061\042\060\040\006\003\125\004\003\014\031\124
+\145\154\151\141\040\105\103\040\105\155\141\151\154\040\122\157
+\157\164\040\103\101\040\166\063\060\036\027\015\062\063\061\061
+\061\065\061\062\061\064\061\064\132\027\015\064\070\060\065\062
+\063\061\061\060\060\060\060\132\060\114\061\013\060\011\006\003
+\125\004\006\023\002\123\105\061\031\060\027\006\003\125\004\012
+\014\020\124\145\154\151\141\040\103\157\155\160\141\156\171\040
+\101\102\061\042\060\040\006\003\125\004\003\014\031\124\145\154
+\151\141\040\105\103\040\105\155\141\151\154\040\122\157\157\164
+\040\103\101\040\166\063\060\166\060\020\006\007\052\206\110\316
+\075\002\001\006\005\053\201\004\000\042\003\142\000\004\224\000
+\346\143\237\026\057\244\370\272\105\045\315\107\053\127\234\131
+\056\207\302\136\363\043\105\231\305\224\256\133\152\302\066\063
+\336\154\267\322\310\274\020\202\351\106\247\016\253\144\015\114
+\056\245\005\347\315\273\064\142\130\251\307\272\334\101\140\052
+\107\031\266\257\036\373\221\221\260\265\234\345\232\127\174\030
+\230\037\222\153\110\262\262\014\011\137\235\341\201\030\243\143
+\060\141\060\037\006\003\125\035\043\004\030\060\026\200\024\056
+\321\321\037\117\251\046\255\246\255\041\230\105\373\023\034\123
+\002\257\346\060\035\006\003\125\035\016\004\026\004\024\056\321
+\321\037\117\251\046\255\246\255\041\230\105\373\023\034\123\002
+\257\346\060\016\006\003\125\035\017\001\001\377\004\004\003\002
+\001\006\060\017\006\003\125\035\023\001\001\377\004\005\060\003
+\001\001\377\060\012\006\010\052\206\110\316\075\004\003\003\003
+\150\000\060\145\002\061\000\353\252\152\365\014\257\201\003\016
+\252\222\077\357\053\033\013\263\264\324\230\330\367\225\244\035
+\252\274\266\277\346\122\230\013\170\134\017\017\243\306\243\151
+\302\275\120\326\157\172\177\002\060\074\035\354\172\365\211\203
+\077\041\351\260\325\170\372\333\120\363\164\007\314\171\247\045
+\362\366\214\070\207\331\266\154\102\364\162\111\114\326\273\135
+\114\256\036\366\372\221\132\052\113
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "Telia EC Email Root CA v3"
+# Issuer: CN=Telia EC Email Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:e1:0c:1e:d8:0d:94:03:87:05:11:00:a6
+# Subject: CN=Telia EC Email Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 12:14:14 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): 36:82:22:8D:7D:67:8B:57:14:40:CF:1C:B3:4E:69:FB:41:35:FD:6C:2A:1B:E3:8E:14:16:3B:71:1E:02:AE:01
+# Fingerprint (SHA1): 33:EA:1C:7E:79:CF:31:66:FD:B9:FA:32:47:73:FB:B7:89:01:00:4F
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia EC Email Root CA v3"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\063\352\034\176\171\317\061\146\375\271\372\062\107\163\373\267
+\211\001\000\117
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\327\203\306\202\162\144\010\353\243\270\127\205\010\236\106\231
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\114\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\042\060\040\006\003
+\125\004\003\014\031\124\145\154\151\141\040\105\103\040\105\155
+\141\151\154\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\341\014\036\330\015\224\003\207\005\021\000
+\246
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "Telia EC TLS Root CA v3"
+#
+# Issuer: CN=Telia EC TLS Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:22:54:63:4d:04:8b:6c:e5:47:1f:d2:b5
+# Subject: CN=Telia EC TLS Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 08:55:26 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): 09:8E:08:A9:1D:BB:F7:74:78:B9:6C:CE:B8:9B:14:13:A5:DA:37:B7:C8:62:60:6A:95:5D:EB:07:17:9F:43:26
+# Fingerprint (SHA1): B4:D6:07:C2:A5:95:BC:5B:F4:67:4D:C9:DC:6F:6F:0A:00:7A:A5:35
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia EC TLS Root CA v3"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\112\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\040\060\036\006\003
+\125\004\003\014\027\124\145\154\151\141\040\105\103\040\124\114
+\123\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\112\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\040\060\036\006\003
+\125\004\003\014\027\124\145\154\151\141\040\105\103\040\124\114
+\123\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\042\124\143\115\004\213\154\345\107\037\322
+\265
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\002\062\060\202\001\267\240\003\002\001\002\002\017\001
+\213\322\042\124\143\115\004\213\154\345\107\037\322\265\060\012
+\006\010\052\206\110\316\075\004\003\003\060\112\061\013\060\011
+\006\003\125\004\006\023\002\123\105\061\031\060\027\006\003\125
+\004\012\014\020\124\145\154\151\141\040\103\157\155\160\141\156
+\171\040\101\102\061\040\060\036\006\003\125\004\003\014\027\124
+\145\154\151\141\040\105\103\040\124\114\123\040\122\157\157\164
+\040\103\101\040\166\063\060\036\027\015\062\063\061\061\061\065
+\060\070\065\065\062\066\132\027\015\064\070\060\065\062\063\061
+\061\060\060\060\060\132\060\112\061\013\060\011\006\003\125\004
+\006\023\002\123\105\061\031\060\027\006\003\125\004\012\014\020
+\124\145\154\151\141\040\103\157\155\160\141\156\171\040\101\102
+\061\040\060\036\006\003\125\004\003\014\027\124\145\154\151\141
+\040\105\103\040\124\114\123\040\122\157\157\164\040\103\101\040
+\166\063\060\166\060\020\006\007\052\206\110\316\075\002\001\006
+\005\053\201\004\000\042\003\142\000\004\301\310\226\025\103\055
+\271\205\051\112\126\322\042\270\166\232\362\117\247\246\140\347
+\222\337\122\117\301\151\326\076\151\026\106\260\044\115\263\327
+\343\113\020\174\162\075\232\224\173\105\271\055\273\171\340\203
+\245\276\004\024\227\111\347\041\264\300\247\006\145\227\217\361
+\032\126\131\225\345\306\065\214\075\207\241\067\341\005\015\300
+\151\312\102\064\302\311\053\203\151\145\243\143\060\141\060\037
+\006\003\125\035\043\004\030\060\026\200\024\324\144\350\103\210
+\072\163\057\320\032\161\202\066\013\136\205\336\307\336\103\060
+\035\006\003\125\035\016\004\026\004\024\324\144\350\103\210\072
+\163\057\320\032\161\202\066\013\136\205\336\307\336\103\060\016
+\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060\017
+\006\003\125\035\023\001\001\377\004\005\060\003\001\001\377\060
+\012\006\010\052\206\110\316\075\004\003\003\003\151\000\060\146
+\002\061\000\227\001\107\122\377\326\333\047\300\065\045\206\206
+\177\366\326\267\373\073\115\255\050\267\225\045\236\217\016\215
+\043\130\105\144\010\225\056\055\125\151\135\275\060\025\003\270
+\136\070\130\002\061\000\257\052\277\076\147\144\147\370\340\153
+\345\101\363\226\000\116\156\226\235\324\273\260\065\064\134\164
+\330\024\047\022\026\151\327\044\213\345\001\054\110\265\374\005
+\021\051\136\146\167\143
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "Telia EC TLS Root CA v3"
+# Issuer: CN=Telia EC TLS Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:22:54:63:4d:04:8b:6c:e5:47:1f:d2:b5
+# Subject: CN=Telia EC TLS Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 08:55:26 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): 09:8E:08:A9:1D:BB:F7:74:78:B9:6C:CE:B8:9B:14:13:A5:DA:37:B7:C8:62:60:6A:95:5D:EB:07:17:9F:43:26
+# Fingerprint (SHA1): B4:D6:07:C2:A5:95:BC:5B:F4:67:4D:C9:DC:6F:6F:0A:00:7A:A5:35
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia EC TLS Root CA v3"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\264\326\007\302\245\225\274\133\364\147\115\311\334\157\157\012
+\000\172\245\065
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\266\372\152\134\102\373\305\147\162\300\340\057\162\373\132\104
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\112\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\040\060\036\006\003
+\125\004\003\014\027\124\145\154\151\141\040\105\103\040\124\114
+\123\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\042\124\143\115\004\213\154\345\107\037\322
+\265
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "Telia RSA Email Root CA v3"
+#
+# Issuer: CN=Telia RSA Email Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:ce:f4:c1:15:78:29:62:4d:79:b2:75:5b
+# Subject: CN=Telia RSA Email Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 11:55:02 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): 5B:0C:50:2A:7D:96:3B:A5:52:17:39:6F:DA:9B:3D:C7:81:71:00:0A:EE:FF:42:CE:CC:3A:20:A7:93:81:63:E8
+# Fingerprint (SHA1): AA:6C:3C:AF:F0:96:C6:4D:C3:27:84:BE:9D:8A:3E:3A:7B:B4:4E:C2
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia RSA Email Root CA v3"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\115\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\043\060\041\006\003
+\125\004\003\014\032\124\145\154\151\141\040\122\123\101\040\105
+\155\141\151\154\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\115\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\043\060\041\006\003
+\125\004\003\014\032\124\145\154\151\141\040\122\123\101\040\105
+\155\141\151\154\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\316\364\301\025\170\051\142\115\171\262\165
+\133
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\005\206\060\202\003\156\240\003\002\001\002\002\017\001
+\213\322\316\364\301\025\170\051\142\115\171\262\165\133\060\015
+\006\011\052\206\110\206\367\015\001\001\014\005\000\060\115\061
+\013\060\011\006\003\125\004\006\023\002\123\105\061\031\060\027
+\006\003\125\004\012\014\020\124\145\154\151\141\040\103\157\155
+\160\141\156\171\040\101\102\061\043\060\041\006\003\125\004\003
+\014\032\124\145\154\151\141\040\122\123\101\040\105\155\141\151
+\154\040\122\157\157\164\040\103\101\040\166\063\060\036\027\015
+\062\063\061\061\061\065\061\061\065\065\060\062\132\027\015\064
+\070\060\065\062\063\061\061\060\060\060\060\132\060\115\061\013
+\060\011\006\003\125\004\006\023\002\123\105\061\031\060\027\006
+\003\125\004\012\014\020\124\145\154\151\141\040\103\157\155\160
+\141\156\171\040\101\102\061\043\060\041\006\003\125\004\003\014
+\032\124\145\154\151\141\040\122\123\101\040\105\155\141\151\154
+\040\122\157\157\164\040\103\101\040\166\063\060\202\002\042\060
+\015\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202
+\002\017\000\060\202\002\012\002\202\002\001\000\271\111\073\057
+\133\122\030\311\317\144\254\250\333\366\172\236\076\255\327\201
+\243\354\272\352\201\056\365\275\257\225\321\113\136\210\356\224
+\142\012\313\206\047\011\250\047\321\303\062\243\012\352\356\027
+\145\014\074\023\026\372\337\004\323\153\317\140\212\066\133\367
+\047\226\061\334\333\367\307\156\025\021\272\143\051\273\320\211
+\160\154\343\110\242\064\231\310\372\112\222\217\260\176\222\056
+\354\246\164\371\321\052\234\163\302\162\053\124\217\011\170\173
+\357\046\014\076\362\174\072\021\135\041\007\325\317\276\136\043
+\210\240\053\005\302\214\277\051\277\130\105\074\361\152\310\253
+\364\376\071\376\262\156\025\132\017\247\113\076\151\304\273\073
+\321\222\240\330\137\050\201\302\275\112\226\245\241\106\161\370
+\015\261\021\143\152\246\001\137\305\163\172\330\111\112\056\301
+\064\276\077\145\336\302\152\306\217\040\330\276\046\002\272\307
+\162\042\026\230\231\227\346\144\155\111\070\220\312\324\161\006
+\264\204\042\264\236\063\064\126\312\035\166\251\232\110\335\314
+\365\217\056\211\111\306\172\006\003\217\257\216\354\200\162\025
+\361\331\011\200\130\122\251\302\034\255\076\137\067\061\146\227
+\020\241\330\163\264\335\056\302\063\245\176\247\130\233\201\021
+\153\210\325\374\113\265\055\272\176\374\121\255\347\076\115\256
+\363\316\121\236\345\123\213\257\036\250\102\344\145\271\362\346
+\052\103\347\117\074\365\333\321\334\273\240\337\027\330\341\276
+\122\131\147\076\041\024\072\203\131\176\157\203\331\225\153\061
+\171\143\216\311\135\324\064\215\370\344\332\056\256\331\010\353
+\333\263\034\351\335\225\030\256\142\233\065\200\105\357\322\224
+\240\326\013\340\242\311\040\100\063\265\113\173\230\066\144\064
+\227\324\213\003\267\172\212\233\147\052\225\223\143\263\362\362
+\037\024\054\021\250\321\146\014\332\106\346\014\336\125\272\107
+\043\306\352\017\262\103\135\216\376\017\127\324\257\347\312\070
+\313\326\333\231\273\112\130\266\150\241\324\212\045\162\252\233
+\015\100\072\246\241\243\036\267\132\055\241\347\240\071\217\306
+\104\324\240\166\137\210\074\377\345\045\120\214\356\074\176\022
+\066\075\262\136\045\107\066\151\231\024\041\137\002\003\001\000
+\001\243\143\060\141\060\037\006\003\125\035\043\004\030\060\026
+\200\024\207\271\006\077\106\305\051\024\315\024\136\305\236\043
+\220\266\044\256\146\231\060\035\006\003\125\035\016\004\026\004
+\024\207\271\006\077\106\305\051\024\315\024\136\305\236\043\220
+\266\044\256\146\231\060\016\006\003\125\035\017\001\001\377\004
+\004\003\002\001\006\060\017\006\003\125\035\023\001\001\377\004
+\005\060\003\001\001\377\060\015\006\011\052\206\110\206\367\015
+\001\001\014\005\000\003\202\002\001\000\215\123\131\331\377\073
+\062\217\327\061\076\355\166\235\015\206\215\342\060\120\160\270
+\235\331\237\022\071\313\235\257\265\256\303\207\341\153\304\355
+\203\020\274\105\172\266\231\360\264\171\174\155\065\243\223\220
+\054\060\206\261\377\205\327\214\145\127\130\222\007\110\354\107
+\230\267\347\166\306\167\140\377\107\354\167\100\255\034\055\352
+\337\122\314\222\176\245\333\053\107\365\033\247\107\100\135\161
+\163\110\304\323\375\247\260\043\100\261\043\273\353\332\201\100
+\305\062\007\331\051\311\023\006\266\030\226\127\131\213\140\001
+\257\357\014\230\112\113\246\026\242\241\043\103\254\125\151\114
+\061\137\373\141\274\053\263\305\002\061\265\124\077\165\031\253
+\135\074\076\144\305\343\353\360\177\262\212\272\057\004\062\073
+\362\003\336\052\273\302\011\342\243\045\363\115\056\206\170\126
+\330\074\107\055\144\255\372\001\171\260\330\210\116\353\262\301
+\132\345\113\272\066\304\031\102\353\233\056\014\015\244\370\273
+\332\044\036\000\234\356\112\043\321\241\264\242\317\135\047\252
+\102\123\203\042\204\024\227\050\134\227\171\246\140\274\207\066
+\231\370\303\027\150\342\272\145\363\016\312\066\327\323\044\074
+\301\011\211\356\373\023\271\103\250\051\024\305\273\101\107\264
+\366\112\275\333\107\042\317\367\243\332\060\126\306\175\230\145
+\045\151\120\140\152\365\372\265\277\214\170\033\167\255\271\135
+\316\327\227\151\156\356\011\346\337\226\167\273\006\223\252\123
+\241\234\331\053\273\336\073\231\042\004\251\274\024\366\075\003
+\242\363\065\224\074\116\037\142\276\360\262\347\130\271\323\027
+\051\305\253\016\325\113\145\106\031\133\044\072\142\111\044\005
+\212\300\170\367\024\224\321\257\013\037\067\154\064\005\316\147
+\361\166\300\367\254\144\110\326\127\232\050\363\027\117\232\367
+\003\264\040\021\142\237\377\032\252\151\063\141\050\176\075\366
+\304\150\027\314\063\071\303\316\122\341\366\262\273\125\134\146
+\155\237\341\074\256\246\016\025\115\106\361\326\004\015\205\226
+\263\137\050\024\117\316\326\233\341\372\015\163\154\157\247\375
+\271\351\052\244\267\100\114\160\016\070\117\033\254\307\165\050
+\170\251\167\066\232\150\164\240\327\267
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "Telia RSA Email Root CA v3"
+# Issuer: CN=Telia RSA Email Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:ce:f4:c1:15:78:29:62:4d:79:b2:75:5b
+# Subject: CN=Telia RSA Email Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 11:55:02 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): 5B:0C:50:2A:7D:96:3B:A5:52:17:39:6F:DA:9B:3D:C7:81:71:00:0A:EE:FF:42:CE:CC:3A:20:A7:93:81:63:E8
+# Fingerprint (SHA1): AA:6C:3C:AF:F0:96:C6:4D:C3:27:84:BE:9D:8A:3E:3A:7B:B4:4E:C2
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia RSA Email Root CA v3"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\252\154\074\257\360\226\306\115\303\047\204\276\235\212\076\072
+\173\264\116\302
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\173\170\307\204\252\212\256\263\377\237\272\146\072\007\164\361
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\115\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\043\060\041\006\003
+\125\004\003\014\032\124\145\154\151\141\040\122\123\101\040\105
+\155\141\151\154\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\316\364\301\025\170\051\142\115\171\262\165
+\133
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "Telia RSA TLS Root CA v3"
+#
+# Issuer: CN=Telia RSA TLS Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:50:ab:42:55:2c:47:5a:bd:a1:dc:1a:c5
+# Subject: CN=Telia RSA TLS Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 09:47:42 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): D1:3D:B1:29:4C:45:EB:C6:FC:86:C6:BB:F6:9F:A2:9B:DF:E6:92:DF:F7:C7:13:C2:43:C7:A9:56:C6:A2:28:4C
+# Fingerprint (SHA1): B5:2E:88:4E:40:C1:11:FB:50:C7:E2:4F:AC:18:2B:BD:68:15:D2:34
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia RSA TLS Root CA v3"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\113\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\041\060\037\006\003
+\125\004\003\014\030\124\145\154\151\141\040\122\123\101\040\124
+\114\123\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\113\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\041\060\037\006\003
+\125\004\003\014\030\124\145\154\151\141\040\122\123\101\040\124
+\114\123\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\120\253\102\125\054\107\132\275\241\334\032
+\305
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\005\202\060\202\003\152\240\003\002\001\002\002\017\001
+\213\322\120\253\102\125\054\107\132\275\241\334\032\305\060\015
+\006\011\052\206\110\206\367\015\001\001\014\005\000\060\113\061
+\013\060\011\006\003\125\004\006\023\002\123\105\061\031\060\027
+\006\003\125\004\012\014\020\124\145\154\151\141\040\103\157\155
+\160\141\156\171\040\101\102\061\041\060\037\006\003\125\004\003
+\014\030\124\145\154\151\141\040\122\123\101\040\124\114\123\040
+\122\157\157\164\040\103\101\040\166\063\060\036\027\015\062\063
+\061\061\061\065\060\071\064\067\064\062\132\027\015\064\070\060
+\065\062\063\061\061\060\060\060\060\132\060\113\061\013\060\011
+\006\003\125\004\006\023\002\123\105\061\031\060\027\006\003\125
+\004\012\014\020\124\145\154\151\141\040\103\157\155\160\141\156
+\171\040\101\102\061\041\060\037\006\003\125\004\003\014\030\124
+\145\154\151\141\040\122\123\101\040\124\114\123\040\122\157\157
+\164\040\103\101\040\166\063\060\202\002\042\060\015\006\011\052
+\206\110\206\367\015\001\001\001\005\000\003\202\002\017\000\060
+\202\002\012\002\202\002\001\000\261\137\075\050\155\175\204\047
+\370\113\121\157\223\300\367\117\040\304\106\031\234\277\037\005
+\354\251\233\341\140\023\307\170\243\173\130\235\334\241\361\104
+\115\023\052\147\015\011\260\020\347\266\357\034\121\030\153\210
+\121\332\135\264\126\065\132\164\114\152\071\157\266\225\337\175
+\061\261\042\073\350\321\124\354\376\005\274\113\304\231\346\033
+\000\252\043\340\137\271\070\343\125\027\203\306\314\143\102\370
+\340\006\300\245\150\357\354\233\230\273\322\171\131\161\141\221
+\264\211\057\130\062\267\064\331\023\345\033\160\135\317\316\360
+\324\305\126\226\324\251\076\234\106\062\043\336\211\100\156\124
+\176\225\027\370\025\374\271\243\344\075\175\246\343\142\177\131
+\365\056\042\266\273\204\225\301\005\177\322\343\223\267\360\165
+\074\234\117\372\357\045\157\160\374\035\306\331\255\353\321\377
+\363\134\323\225\256\342\001\162\241\072\246\104\250\262\220\002
+\123\146\306\343\147\330\052\266\314\374\145\247\247\273\276\247
+\321\153\317\210\332\067\012\133\341\201\356\021\344\274\006\266
+\255\065\303\374\137\255\243\134\213\357\050\174\145\260\300\311
+\012\166\370\123\302\163\024\342\354\123\251\250\205\126\071\360
+\027\131\256\370\264\032\117\124\072\352\246\202\201\272\166\311
+\007\242\113\043\145\071\112\353\120\377\042\174\346\022\200\065
+\310\006\011\024\065\162\262\064\161\015\103\256\365\300\060\000
+\326\352\232\256\373\130\201\113\350\032\147\146\005\152\076\323
+\037\033\254\015\360\032\323\051\326\251\276\051\125\261\204\171
+\364\021\140\042\300\025\004\314\153\032\037\226\371\007\057\230
+\226\237\122\220\022\276\120\053\052\365\106\330\122\070\213\243
+\342\056\064\201\117\117\272\027\241\020\056\266\052\171\363\220
+\027\367\301\064\105\333\372\170\324\103\104\224\126\260\052\264
+\176\030\370\350\302\043\366\270\374\222\120\246\234\136\172\146
+\134\103\104\224\112\030\042\043\220\014\347\021\316\346\054\232
+\122\264\343\140\176\063\305\114\375\217\355\105\021\260\307\377
+\032\154\266\275\140\134\034\244\262\233\251\372\024\123\150\227
+\033\003\345\033\244\232\255\131\231\335\000\367\135\046\153\172
+\140\224\076\165\115\351\016\357\002\003\001\000\001\243\143\060
+\141\060\037\006\003\125\035\043\004\030\060\026\200\024\260\307
+\251\322\335\262\050\126\163\004\224\214\024\134\110\157\067\122
+\222\250\060\035\006\003\125\035\016\004\026\004\024\260\307\251
+\322\335\262\050\126\163\004\224\214\024\134\110\157\067\122\222
+\250\060\016\006\003\125\035\017\001\001\377\004\004\003\002\001
+\006\060\017\006\003\125\035\023\001\001\377\004\005\060\003\001
+\001\377\060\015\006\011\052\206\110\206\367\015\001\001\014\005
+\000\003\202\002\001\000\135\143\061\154\064\140\321\223\266\321
+\374\010\021\052\257\271\353\176\330\270\345\276\303\253\241\246
+\204\264\126\162\214\122\234\207\013\011\056\363\250\104\276\250
+\257\152\103\355\176\151\146\341\261\160\267\357\254\157\377\016
+\136\305\201\252\327\333\134\306\201\064\064\331\227\305\321\060
+\233\213\130\345\266\046\266\312\221\034\340\033\107\201\121\313
+\354\151\321\265\256\270\133\231\232\230\274\125\332\001\223\273
+\243\204\335\071\234\361\204\020\171\030\340\026\131\160\167\041
+\352\332\064\376\011\353\174\362\243\331\374\032\254\067\260\220
+\106\343\207\246\346\032\030\214\027\337\077\351\351\211\274\254
+\226\173\045\106\056\013\353\021\354\011\210\377\075\246\376\072
+\132\233\060\040\172\277\353\023\010\267\204\042\351\021\127\072
+\021\365\244\070\346\221\012\355\235\120\006\164\254\154\002\220
+\266\313\064\044\240\375\167\371\227\327\215\307\327\027\217\214
+\370\123\136\133\371\044\051\041\255\310\376\111\050\163\320\377
+\176\020\172\026\173\251\275\227\045\004\070\205\147\322\272\176
+\311\122\126\065\271\262\016\375\325\223\001\161\034\055\100\245
+\044\054\201\050\246\214\144\070\302\332\372\161\051\250\255\326
+\061\221\137\221\243\311\116\040\210\121\222\305\317\310\071\066
+\356\005\272\042\065\027\012\106\112\247\021\143\220\275\343\210
+\024\234\361\051\061\237\000\226\265\170\074\307\003\160\164\125
+\115\004\142\302\012\342\147\262\167\230\136\062\115\253\064\152
+\121\312\006\303\073\057\027\164\042\375\231\307\120\333\310\111
+\327\257\226\002\000\134\276\026\276\274\132\252\372\032\323\134
+\001\370\140\237\263\236\321\114\141\070\116\360\006\204\243\112
+\272\317\012\336\024\123\324\024\251\212\014\314\041\034\322\306
+\320\016\256\243\315\352\077\377\101\051\226\365\377\011\162\167
+\053\213\210\366\212\024\251\126\261\124\320\327\115\220\310\131
+\170\002\242\165\061\117\263\020\225\026\345\270\002\170\263\356
+\072\242\303\233\026\266\066\320\256\125\264\337\230\263\040\105
+\070\261\214\020\240\055\115\307\104\257\313\351\214\115\026\242
+\347\102\352\025\017\200\327\361\352\353\021\307\014\334\173\010
+\217\067\167\155\304\257
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "Telia RSA TLS Root CA v3"
+# Issuer: CN=Telia RSA TLS Root CA v3,O=Telia Company AB,C=SE
+# Serial Number:01:8b:d2:50:ab:42:55:2c:47:5a:bd:a1:dc:1a:c5
+# Subject: CN=Telia RSA TLS Root CA v3,O=Telia Company AB,C=SE
+# Not Valid Before: Wed Nov 15 09:47:42 2023
+# Not Valid After : Sat May 23 11:00:00 2048
+# Fingerprint (SHA-256): D1:3D:B1:29:4C:45:EB:C6:FC:86:C6:BB:F6:9F:A2:9B:DF:E6:92:DF:F7:C7:13:C2:43:C7:A9:56:C6:A2:28:4C
+# Fingerprint (SHA1): B5:2E:88:4E:40:C1:11:FB:50:C7:E2:4F:AC:18:2B:BD:68:15:D2:34
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Telia RSA TLS Root CA v3"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\265\056\210\116\100\301\021\373\120\307\342\117\254\030\053\275
+\150\025\322\064
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\364\213\234\363\370\143\317\334\045\217\264\273\242\351\235\342
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\113\061\013\060\011\006\003\125\004\006\023\002\123\105\061
+\031\060\027\006\003\125\004\012\014\020\124\145\154\151\141\040
+\103\157\155\160\141\156\171\040\101\102\061\041\060\037\006\003
+\125\004\003\014\030\124\145\154\151\141\040\122\123\101\040\124
+\114\123\040\122\157\157\164\040\103\101\040\166\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\017\001\213\322\120\253\102\125\054\107\132\275\241\334\032
+\305
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

From 8d39d0d66070f80a076e52dab5e2f514f0d9e93c Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 22 Aug 2026 23:01:29 +0000
Subject: [PATCH 339/344] meta: add a root-level AGENTS.md

We're seeing a number of repeated mistakes in AI-generated
contributions, including agents using `Signed-off-by`, creating
what appear to be unsupervised PRs, appearing to respond to
comments without human oversight, etc. Having an AGENTS.md
file with specific instructions to the agent on what to avoid
should help.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65493
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
---
 .gitignore        |  1 -
 AGENTS.md         | 64 +++++++++++++++++++++++++++++++++++++++++++++++
 Makefile          |  4 +--
 eslint.config.mjs |  2 +-
 4 files changed, 67 insertions(+), 4 deletions(-)
 create mode 100644 AGENTS.md

diff --git a/.gitignore b/.gitignore
index 69c1dd205316..2a7ce3337021 100644
--- a/.gitignore
+++ b/.gitignore
@@ -163,7 +163,6 @@ install_manifest.txt
 
 # === Rules for AI assistants ===
 CLAUDE.md
-AGENTS.md
 
 # === Global Rules ===
 # Keep last to avoid being excluded
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000000..79e1d1b688b8
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,64 @@
+# Agents and Automated Tools
+
+This document outlines rules and requirements for AI automation agents and automated
+tooling that interact with the Node.js project.
+
+Existing Node.js collaborators (as listed in the README.md) may use AI agents to
+contribute but must do so responsibly.
+
+New Node.js contributors should avoid using AI agents to interact with the project.
+
+## Code Contributions
+
+* **No unreviewed automation**: Automated pull requests must not be created without
+  ongoing human oversight. The pull request must be actively maintained by a human
+  contributor who responds to feedback. The AI agent is not permitted to create pull
+  requests, open issues, post comments, respond to reviews, or push commits without
+  ongoing human oversight.
+
+* **Commit responsibility**: Commits created with agent assistance must follow all
+  Node.js [commit message guidelines](./doc/contributing/pull-requests.md#commit-message-guidelines).
+  The human contributor opening the PR takes full responsibility for the changes.
+
+* **Testing and verification**: All changes must pass the Node.js continuous integration.
+  Human judgment must verify that existing tests are not removed or modified inappropriately,
+  and that new tests correctly validate the intended behavior.
+
+### Requirements
+
+* All commits must be signed off by the human user using `Signed-off-by: <your name> (<your email>)`
+  as an attestation to the [Developer Certificate of Origin](https://developercertificate.org/).
+* AI-assistance must be acknowledged using the `Assisted-by: <agent name>` annotation.
+* AI-authored code contributions must be compatible with the project's licensing and
+  contribution guidelines.
+
+## Prohibited Activities
+
+AI agents **must not**:
+
+* Push to any branch or tag in nodejs/node.
+* Create unsupervised pull requests or issues without active human engagement.
+* Make claims about code without human verification against actual source code.
+* Remove or modify existing tests without human judgment.
+* Interact with the repository through means other than those explicitly authorized.
+* Use commit messages to promote for-profit AI tools or commercial brands. A single
+  `Assisted-by: <agent-name>` annotation is required disclosure, not promotion, and is
+  permitted.
+* Post AI-generated messages directly into pull requests, issues, or project communication
+  channels without direct human review and editing to ensure clarity, accuracy, and respect
+  for collaborator time.
+* Sign off commits using `Signed-off-by: <agent name>` or `Co-authored-by: <agent name>`.
+
+## Violations
+
+Automated interactions that violate these rules may result in:
+
+* Immediate closure of pull requests without review.
+* Blocking of the automation tool from further interaction with the project.
+* Blocking of the tool's account or its owner from contributing.
+* Reports to relevant platforms or organizations operating the automation.
+
+***
+
+For more information on AI use in general contributions (not specific to agents),
+see [AI use policy and guidelines](./doc/contributing/ai-guidelines.md).
diff --git a/Makefile b/Makefile
index 10292db04e8c..4da0900c6fca 100644
--- a/Makefile
+++ b/Makefile
@@ -1288,7 +1288,7 @@ ifneq ($(SKIP_SHARED_DEPS), 1)
 	cp doc/node.1 $(TARNAME)/doc/node.1
 	cp -r out/doc/api/* $(TARNAME)/doc/api/
 endif
-	sed 's/fileset = fileset.intersection (fileset.gitTracked root)/fileset =/' tools/nix/v8.nix > $(TARNAME)/tools/nix/v8.nix 
+	sed 's/fileset = fileset.intersection (fileset.gitTracked root)/fileset =/' tools/nix/v8.nix > $(TARNAME)/tools/nix/v8.nix
 	$(RM) -r $(TARNAME)/.editorconfig
 	$(RM) -r $(TARNAME)/.git*
 	$(RM) -r $(TARNAME)/.mailmap
@@ -1480,7 +1480,7 @@ else
 LINT_MD_NEWER = -newer tools/.mdlintstamp
 endif
 
-LINT_MD_TARGETS = doc src lib benchmark test tools/doc tools/icu $(filter-out CLAUDE.md AGENTS.md,$(wildcard *.md))
+LINT_MD_TARGETS = doc src lib benchmark test tools/doc tools/icu $(filter-out CLAUDE.md,$(wildcard *.md))
 LINT_MD_FILES = $(shell $(FIND) $(LINT_MD_TARGETS) -type f \
 	! -path '*node_modules*' ! -path 'test/fixtures/*' -name '*.md' \
 	$(LINT_MD_NEWER))
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 6dd026b88ff2..5248a5fbb616 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -397,7 +397,7 @@ export default [
   // #region markdown config
   {
     files: ['**/*.md'],
-    ignores: ['CLAUDE.md', 'AGENTS.md'],
+    ignores: ['CLAUDE.md'],
     plugins: {
       markdown,
     },

From 5b7d02e401794f6123b68e7f4453635f44aa5566 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Mon, 24 Aug 2026 19:52:18 -0700
Subject: [PATCH 340/344] stream: normalize fused stateless transform results

Normalize each stateless transform result before passing it to
the next transform in a fused run. This ensures that subsequent
transforms always receive Uint8Array[] batches in both synchronous
and asynchronous pipelines.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65367
Fixes: https://github.com/nodejs/node/issues/65366
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/streams/iter/pull.js             | 43 ++++++++++++++-----
 .../test-stream-iter-transform-output.js      | 32 ++++++++++++++
 2 files changed, 65 insertions(+), 10 deletions(-)

diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index d75a175443d3..b6c2d9849c42 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -434,6 +434,16 @@ async function appendTransformResultAsyncSlow(target, result) {
   }
 }
 
+function normalizeTransformResultFast(result) {
+  if (isUint8ArrayBatch(result)) {
+    return result.length === 0 ? null : result;
+  }
+  if (isUint8Array(result)) return [result];
+  if (typeof result === 'string') return [toUint8Array(result)];
+  if (isAnyArrayBuffer(result)) return [new Uint8Array(result)];
+  if (ArrayBufferIsView(result)) return [arrayBufferViewToUint8Array(result)];
+}
+
 // =============================================================================
 // Sync Pipeline Implementation
 // =============================================================================
@@ -457,7 +467,17 @@ function* applyFusedStatelessSyncTransforms(source, run) {
         current = null;
         break;
       }
-      current = result;
+      if (i === run.length - 1) {
+        current = result;
+        continue;
+      }
+      current = normalizeTransformResultFast(result);
+      if (current === undefined) {
+        const normalized = [];
+        appendTransformResultSync(normalized, result);
+        current = normalized.length === 0 ? null : normalized[0];
+      }
+      if (current === null) break;
     }
     if (current === null) continue;
     // Inline normalization with Uint8Array[] batch as the fast path,
@@ -570,21 +590,24 @@ async function* applyFusedStatelessAsyncTransforms(source, run, signal) {
   for await (const chunks of source) {
     let current = chunks;
     for (let i = 0; i < run.length; i++) {
-      const result = run[i](current, { __proto__: null, signal });
+      let result = run[i](current, { __proto__: null, signal });
+      if (isPromise(result)) result = await result;
       if (result === null) {
         current = null;
         break;
       }
-      if (isPromise(result)) {
-        const resolved = await result;
-        if (resolved === null) {
-          current = null;
-          break;
-        }
-        current = resolved;
-      } else {
+      if (i === run.length - 1) {
         current = result;
+        continue;
+      }
+      current = normalizeTransformResultFast(result);
+      if (current === undefined) {
+        const normalized = [];
+        const pendingResult = appendTransformResultAsync(normalized, result);
+        if (pendingResult !== undefined) await pendingResult;
+        current = normalized.length === 0 ? null : normalized[0];
       }
+      if (current === null) break;
     }
     if (current === null) continue;
     // Normalize the final output
diff --git a/test/parallel/test-stream-iter-transform-output.js b/test/parallel/test-stream-iter-transform-output.js
index d66a20f6e164..90261a33785a 100644
--- a/test/parallel/test-stream-iter-transform-output.js
+++ b/test/parallel/test-stream-iter-transform-output.js
@@ -59,6 +59,36 @@ async function testSyncTransformReturnsFloat32Array() {
   assert.strictEqual(data.byteLength, 4);
 }
 
+// Consecutive stateless transforms normalize intermediate output (async)
+async function testConsecutiveTransformsNormalizeIntermediateOutput() {
+  const first = (chunks) => {
+    return chunks === null ? null : new Uint8Array([65]);
+  };
+  let receivedBatch = false;
+  const second = (chunks) => {
+    if (chunks !== null) receivedBatch = Array.isArray(chunks);
+    return chunks;
+  };
+  const data = await bytes(pull(from('x'), first, second));
+  assert.ok(receivedBatch);
+  assert.deepStrictEqual(data, new Uint8Array([65]));
+}
+
+// Consecutive stateless transforms normalize intermediate output (sync)
+async function testConsecutiveSyncTransformsNormalizeIntermediateOutput() {
+  const first = (chunks) => {
+    return chunks === null ? null : new Uint8Array([65]);
+  };
+  let receivedBatch = false;
+  const second = (chunks) => {
+    if (chunks !== null) receivedBatch = Array.isArray(chunks);
+    return chunks;
+  };
+  const data = bytesSync(pullSync(fromSync('x'), first, second));
+  assert.ok(receivedBatch);
+  assert.deepStrictEqual(data, new Uint8Array([65]));
+}
+
 // Stateless transform returns a sync generator (iterable)
 async function testTransformReturnsGenerator() {
   const tx = (chunks) => {
@@ -233,6 +263,8 @@ Promise.all([
   testSyncTransformReturnsArrayBuffer(),
   testTransformReturnsFloat32Array(),
   testSyncTransformReturnsFloat32Array(),
+  testConsecutiveTransformsNormalizeIntermediateOutput(),
+  testConsecutiveSyncTransformsNormalizeIntermediateOutput(),
   testTransformReturnsGenerator(),
   testSyncTransformReturnsGenerator(),
   testTransformReturnsAsyncGenerator(),

From 262f0ec82ab281829d56d9bbf25659a063071273 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Tue, 25 Aug 2026 09:53:37 +0200
Subject: [PATCH 341/344] fs: stop stat()ing every entry in recursive readdir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

readdir({ recursive: true }) asked the binding for names only and then
called internalModuleStat() on every entry to find the directories to
descend into; with withFileTypes it built the Dirents and still stat()ed
every entry that was not already a directory. Both variants also ran
path.join() and path.relative() per entry to build the relative result.

Ask the binding for file types in all cases, descend into directories
directly, and only stat() symbolic links and entries of unknown type
(which is what could point to a directory). The relative name is the
parent's prefix plus the entry name. Results, their order and the
symlink-following behavior are unchanged for fs.readdirSync, fs.readdir
and fs.promises.readdir.

The known_issues test for Buffer paths (#58892) called back without
checking the error; the error now reaches the callback instead of being
thrown from the completion handler, so the test asserts success to keep
expressing the issue.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65487
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/fs/bench-readdir.js                 |   6 +-
 benchmark/fs/bench-readdirSync.js             |   6 +-
 lib/fs.js                                     | 152 ++++++++----------
 lib/internal/fs/promises.js                   |  96 ++++-------
 .../test-fs-readdir-recursive-with-buffer.js  |   2 +-
 5 files changed, 112 insertions(+), 150 deletions(-)

diff --git a/benchmark/fs/bench-readdir.js b/benchmark/fs/bench-readdir.js
index 8fa0e7a3cbdc..e276653f4584 100644
--- a/benchmark/fs/bench-readdir.js
+++ b/benchmark/fs/bench-readdir.js
@@ -8,16 +8,18 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
+  recursive: ['true', 'false'],
 });
 
-function main({ n, dir, withFileTypes }) {
+function main({ n, dir, withFileTypes, recursive }) {
   withFileTypes = withFileTypes === 'true';
+  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   (function r(cntr) {
     if (cntr-- <= 0)
       return bench.end(n);
-    fs.readdir(fullPath, { withFileTypes }, () => {
+    fs.readdir(fullPath, { withFileTypes, recursive }, () => {
       r(cntr);
     });
   }(n));
diff --git a/benchmark/fs/bench-readdirSync.js b/benchmark/fs/bench-readdirSync.js
index 8ae1d061d1f1..ce34e083cb53 100644
--- a/benchmark/fs/bench-readdirSync.js
+++ b/benchmark/fs/bench-readdirSync.js
@@ -8,15 +8,17 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
+  recursive: ['true', 'false'],
 });
 
 
-function main({ n, dir, withFileTypes }) {
+function main({ n, dir, withFileTypes, recursive }) {
   withFileTypes = withFileTypes === 'true';
+  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   for (let i = 0; i < n; i++) {
-    fs.readdirSync(fullPath, { withFileTypes });
+    fs.readdirSync(fullPath, { withFileTypes, recursive });
   }
   bench.end(n);
 }
diff --git a/lib/fs.js b/lib/fs.js
index 3c0bef6cf506..d1823ce97298 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -57,6 +57,9 @@ const {
   F_OK,
   O_WRONLY,
   O_SYMLINK,
+  UV_DIRENT_DIR,
+  UV_DIRENT_LINK,
+  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const pathModule = require('path');
@@ -1739,6 +1742,43 @@ function mkdirSync(path, options) {
   }
 }
 
+/**
+ * Appends one directory's entries to `context.results` and the subdirectories
+ * still to visit to `context.dirs` (with the prefix their entries get in
+ * string results in `context.prefixes`). `result` is a `binding.readdir()`
+ * result with file types, so only symbolic links and entries of unknown type
+ * need a stat() to find out whether they lead to a directory.
+ * @param {string} dir
+ * @param {string} prefix
+ * @param {[string[], number[]]} result
+ * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
+ */
+function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
+  const { length } = names;
+  for (let i = 0; i < length; i++) {
+    const name = names[i];
+    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
+    let isDirectory;
+    if (context.withFileTypes) {
+      const dirent = getDirent(dir, name, types[i]);
+      ArrayPrototypePush(context.results, dirent);
+      // Follow symbolic links to directories, see https://github.com/nodejs/node/issues/52663
+      isDirectory = dirent.isDirectory() ||
+        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    } else {
+      ArrayPrototypePush(context.results, relative);
+      const type = types[i];
+      isDirectory = type === UV_DIRENT_DIR ||
+        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
+         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    }
+    if (isDirectory) {
+      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
+      ArrayPrototypePush(context.prefixes, relative);
+    }
+  }
+}
+
 /*
  * An recursive algorithm for reading the entire contents of the `basePath` directory.
  * This function does not validate `basePath` as a directory. It is passed directly to
@@ -1754,15 +1794,20 @@ function mkdirSync(path, options) {
 function readdirRecursive(basePath, options, callback) {
   const context = {
     withFileTypes: Boolean(options.withFileTypes),
-    encoding: options.encoding,
-    basePath,
-    readdirResults: [],
-    pathsQueue: [basePath],
+    results: [],
+    dirs: [basePath],
+    prefixes: [''],
   };
 
   let i = 0;
 
-  function read(path) {
+  /**
+   * Reads one directory from `context.dirs` and then moves on to the next
+   * one, or calls back once none are left.
+   * @param {string} path
+   * @param {string} prefix path of this directory relative to `basePath`
+   */
+  function read(path, prefix) {
     const req = new FSReqCallback();
     req.oncomplete = (err, result) => {
       if (err) {
@@ -1771,68 +1816,28 @@ function readdirRecursive(basePath, options, callback) {
       }
 
       if (result === undefined) {
-        callback(null, context.readdirResults);
+        callback(null, context.results);
         return;
       }
 
-      processReaddirResult({
-        result,
-        currentPath: path,
-        context,
-      });
+      try {
+        collectRecursiveReaddirResult(path, prefix, result, context);
+      } catch (err) {
+        callback(err);
+        return;
+      }
 
-      if (i < context.pathsQueue.length) {
-        read(context.pathsQueue[i++]);
+      if (i < context.dirs.length) {
+        read(context.dirs[i], context.prefixes[i++]);
       } else {
-        callback(null, context.readdirResults);
+        callback(null, context.results);
       }
     };
 
-    binding.readdir(
-      path,
-      context.encoding,
-      context.withFileTypes,
-      req,
-    );
-  }
-
-  read(context.pathsQueue[i++]);
-}
-
-// Calling `readdir` with `withFileTypes=true`, the result is an array of arrays.
-// The first array is the names, and the second array is the types.
-// They are guaranteed to be the same length; hence, setting `length` to the length
-// of the first array within the result.
-const processReaddirResult = (args) => (args.context.withFileTypes ? handleDirents(args) : handleFilePaths(args));
-
-function handleDirents({ result, currentPath, context }) {
-  const { 0: names, 1: types } = result;
-  const { length } = names;
-
-  for (let i = 0; i < length; i++) {
-    // Avoid excluding symlinks, as they are not directories.
-    // Refs: https://github.com/nodejs/node/issues/52663
-    const fullPath = pathModule.join(currentPath, names[i]);
-    const dirent = getDirent(currentPath, names[i], types[i]);
-    ArrayPrototypePush(context.readdirResults, dirent);
-
-    if (dirent.isDirectory() || binding.internalModuleStat(fullPath) === 1) {
-      ArrayPrototypePush(context.pathsQueue, fullPath);
-    }
+    binding.readdir(path, options.encoding, true, req);
   }
-}
-
-function handleFilePaths({ result, currentPath, context }) {
-  for (let i = 0; i < result.length; i++) {
-    const resultPath = pathModule.join(currentPath, result[i]);
-    const relativeResultPath = pathModule.relative(context.basePath, resultPath);
-    const stat = binding.internalModuleStat(resultPath);
-    ArrayPrototypePush(context.readdirResults, relativeResultPath);
 
-    if (stat === 1) {
-      ArrayPrototypePush(context.pathsQueue, resultPath);
-    }
-  }
+  read(context.dirs[i], context.prefixes[i++]);
 }
 
 /**
@@ -1846,35 +1851,20 @@ function handleFilePaths({ result, currentPath, context }) {
 function readdirSyncRecursive(basePath, options) {
   const context = {
     withFileTypes: Boolean(options.withFileTypes),
-    encoding: options.encoding,
-    basePath,
-    readdirResults: [],
-    pathsQueue: [basePath],
+    results: [],
+    dirs: [basePath],
+    prefixes: [''],
   };
 
-  function read(path) {
-    const readdirResult = binding.readdir(
-      path,
-      context.encoding,
-      context.withFileTypes,
-    );
-
-    if (readdirResult === undefined) {
-      return;
+  for (let i = 0; i < context.dirs.length; i++) {
+    const dir = context.dirs[i];
+    const result = binding.readdir(dir, options.encoding, true);
+    if (result !== undefined) {
+      collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
     }
-
-    processReaddirResult({
-      result: readdirResult,
-      currentPath: path,
-      context,
-    });
-  }
-
-  for (let i = 0; i < context.pathsQueue.length; i++) {
-    read(context.pathsQueue[i]);
   }
 
-  return context.readdirResults;
+  return context.results;
 }
 
 /**
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index 5a61f58aae27..ce69512fa5c9 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -32,6 +32,9 @@ const {
   O_WRONLY,
   S_IFMT,
   S_IFREG,
+  UV_DIRENT_DIR,
+  UV_DIRENT_LINK,
+  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const binding = internalBinding('fs');
@@ -63,6 +66,7 @@ const {
     kWriteFileMaxChunkSize,
   },
   copyObject,
+  getDirent,
   getDirents,
   getOptions,
   getStatFsFromBinding,
@@ -1638,73 +1642,37 @@ async function mkdir(path, options) {
 }
 
 async function readdirRecursive(originalPath, options) {
+  const withFileTypes = !!options.withFileTypes;
+  const readdirWithTypes = (path) => PromisePrototypeThen(
+    binding.readdir(path, options.encoding, true, kUsePromises),
+    undefined,
+    handleErrorFromBinding,
+  );
   const result = [];
-  const queue = [
-    [
-      originalPath,
-      await PromisePrototypeThen(
-        binding.readdir(
-          originalPath,
-          options.encoding,
-          !!options.withFileTypes,
-          kUsePromises,
-        ),
-        undefined,
-        handleErrorFromBinding,
-      ),
-    ],
-  ];
-
-
-  if (options.withFileTypes) {
-    while (queue.length > 0) {
-      // If we want to implement BFS make this a `shift` call instead of `pop`
-      const { 0: path, 1: readdir } = ArrayPrototypePop(queue);
-      for (const dirent of getDirents(path, readdir)) {
+  const queue = [[originalPath, '', await readdirWithTypes(originalPath)]];
+
+  while (queue.length > 0) {
+    // If we want to implement BFS make this a `shift` call instead of `pop`
+    const { 0: path, 1: prefix, 2: { 0: names, 1: types } } = ArrayPrototypePop(queue);
+    for (let i = 0; i < names.length; i++) {
+      const name = names[i];
+      const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
+      let isDirectory;
+      if (withFileTypes) {
+        const dirent = getDirent(path, name, types[i]);
         ArrayPrototypePush(result, dirent);
-        if (dirent.isDirectory()) {
-          const direntPath = pathModule.join(path, dirent.name);
-          ArrayPrototypePush(queue, [
-            direntPath,
-            await PromisePrototypeThen(
-              binding.readdir(
-                direntPath,
-                options.encoding,
-                true,
-                kUsePromises,
-              ),
-              undefined,
-              handleErrorFromBinding,
-            ),
-          ]);
-        }
+        isDirectory = dirent.isDirectory();
+      } else {
+        ArrayPrototypePush(result, relative);
+        // Entries that are, or may be, symbolic links to directories are followed.
+        const type = types[i];
+        isDirectory = type === UV_DIRENT_DIR ||
+          ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
+           binding.internalModuleStat(pathModule.join(path, name)) === 1);
       }
-    }
-  } else {
-    while (queue.length > 0) {
-      const { 0: path, 1: readdir } = ArrayPrototypePop(queue);
-      for (const ent of readdir) {
-        const direntPath = pathModule.join(path, ent);
-        const stat = binding.internalModuleStat(direntPath);
-        ArrayPrototypePush(
-          result,
-          pathModule.relative(originalPath, direntPath),
-        );
-        if (stat === 1) {
-          ArrayPrototypePush(queue, [
-            direntPath,
-            await PromisePrototypeThen(
-              binding.readdir(
-                direntPath,
-                options.encoding,
-                false,
-                kUsePromises,
-              ),
-              undefined,
-              handleErrorFromBinding,
-            ),
-          ]);
-        }
+      if (isDirectory) {
+        const direntPath = pathModule.join(path, name);
+        ArrayPrototypePush(queue, [direntPath, relative, await readdirWithTypes(direntPath)]);
       }
     }
   }
diff --git a/test/known_issues/test-fs-readdir-recursive-with-buffer.js b/test/known_issues/test-fs-readdir-recursive-with-buffer.js
index 4938d36ffa84..c2eae8f428fe 100644
--- a/test/known_issues/test-fs-readdir-recursive-with-buffer.js
+++ b/test/known_issues/test-fs-readdir-recursive-with-buffer.js
@@ -12,4 +12,4 @@ const { readdir } = require('node:fs');
 const { join } = require('node:path');
 
 const testDirPath = join(__dirname, '..', '..');
-readdir(Buffer.from(testDirPath), { recursive: true }, common.mustCall());
+readdir(Buffer.from(testDirPath), { recursive: true }, common.mustSucceed());

From b827c0047e088ad62e737842756543864046f02e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Szymon=20=C5=81=C4=85giewka?=
 <slagiewka@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:34:40 +0200
Subject: [PATCH 342/344] events: inline createEvent hybrid dispatch closure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Originally added in 16b11cd2adaa5f60382a7f205f893f38a5061fff, it first
had three callers. Now there's only one branch requireing it.

Signed-off-by: Szymon Łągiewka <slagiewka@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64473
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
---
 lib/internal/event_target.js | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/lib/internal/event_target.js b/lib/internal/event_target.js
index 5a4f7c029094..3280bfbc0d2f 100644
--- a/lib/internal/event_target.js
+++ b/lib/internal/event_target.js
@@ -791,14 +791,6 @@ class EventTarget {
   }
 
   [kHybridDispatch](nodeValue, type, event) {
-    const createEvent = () => {
-      if (event === undefined) {
-        event = this[kCreateEvent](nodeValue, type);
-        event[kTarget] = this;
-        event[kIsBeingDispatched] = true;
-      }
-      return event;
-    };
     if (event !== undefined) {
       event[kTarget] = this;
       event[kIsBeingDispatched] = true;
@@ -844,7 +836,12 @@ class EventTarget {
         if (handler.isNodeStyleListener) {
           arg = nodeValue;
         } else {
-          arg = createEvent();
+          if (event === undefined) {
+            event = this[kCreateEvent](nodeValue, type);
+            event[kTarget] = this;
+            event[kIsBeingDispatched] = true;
+          }
+          arg = event;
         }
         const callback = handler.weak ?
           handler.callback.deref() : handler.callback;

From 8d48adf688d5e879a16557188f6f2880470b4f86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Szymon=20=C5=81=C4=85giewka?=
 <slagiewka@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:37:33 +0200
Subject: [PATCH 343/344] events: inline iterationCondition hybrid dispatch
 closure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While more readable, the removed closure overhead unlocks 10-20% in
eventtarget.js benchmark.

Signed-off-by: Szymon Łągiewka <slagiewka@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64473
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
---
 lib/internal/event_target.js | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/lib/internal/event_target.js b/lib/internal/event_target.js
index 3280bfbc0d2f..bfb948bb1ced 100644
--- a/lib/internal/event_target.js
+++ b/lib/internal/event_target.js
@@ -806,13 +806,8 @@ class EventTarget {
     let handler = root.next;
     let next;
 
-    const iterationCondition = () => {
-      if (handler === undefined) {
-        return false;
-      }
-      return root.resistStopPropagation || handler.passive || event?.[kStop] !== true;
-    };
-    while (iterationCondition()) {
+    while (handler !== undefined &&
+           (root.resistStopPropagation || handler.passive || event?.[kStop] !== true)) {
       // Cache the next item in case this iteration removes the current one
       next = handler.next;
 

From 2161c944dc174f8b8960fd633b36a1f0c881d283 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Tue, 25 Aug 2026 19:01:55 -0400
Subject: [PATCH 344/344] 2026-08-26, Version 26.8.0 (Current)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Notable changes:

benchmark:
  * (SEMVER-MINOR) add --analyze mode to compare.js (James M Snell) https://github.com/nodejs/node/pull/65416
crypto:
  * update root certificates to NSS 3.126 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/65495
  * (SEMVER-MINOR) enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) https://github.com/nodejs/node/pull/63411
diagnostics_channel:
  * mark TracingChannel as stable (Abdelrahman Awad) https://github.com/nodejs/node/pull/64525
lib,src:
  * (SEMVER-MINOR) improve histogram implementation (James M Snell) https://github.com/nodejs/node/pull/65024
net:
  * (SEMVER-MINOR) improve performance of net.BlockList (James M Snell) https://github.com/nodejs/node/pull/64974
perf_hooks:
  * (SEMVER-MINOR) add statistical hypothesis testing to histogram (James M Snell) https://github.com/nodejs/node/pull/65416
repl:
  * add basic syntax highlighting (Aviv Keller) https://github.com/nodejs/node/pull/64591
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.close() (Guilherme Araújo) https://github.com/nodejs/node/pull/64232
  * (SEMVER-MINOR) add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) https://github.com/nodejs/node/pull/64232
util:
  * (SEMVER-MINOR) add non-throwing MIMEType.parse (James M Snell) https://github.com/nodejs/node/pull/64965
zlib:
  * (SEMVER-MINOR) add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) https://github.com/nodejs/node/pull/64339

PR-URL: https://github.com/nodejs/node/pull/65551
---
 CHANGELOG.md                    |   3 +-
 doc/api/buffer.md               |   8 +-
 doc/api/cli.md                  |   2 +-
 doc/api/crypto.md               |   8 +-
 doc/api/diagnostics_channel.md  |   6 +-
 doc/api/fs.md                   |  12 +-
 doc/api/module.md               |   2 +-
 doc/api/net.md                  |  20 +-
 doc/api/perf_hooks.md           |  40 ++--
 doc/api/sqlite.md               |  46 ++--
 doc/api/tty.md                  |   4 +-
 doc/api/util.md                 |   2 +-
 doc/api/zlib.md                 | 148 ++++++-------
 doc/changelogs/CHANGELOG_V26.md | 366 ++++++++++++++++++++++++++++++++
 src/node_version.h              |   6 +-
 15 files changed, 520 insertions(+), 153 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64f8ca5bcc02..3574f2231b45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.7.0">26.7.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.7.0">26.7.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.6.0">26.6.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.5.1">26.5.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.5.0">26.5.0</a><br/>
diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 5ead75a414dd..b89a91cee78e 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -799,7 +799,7 @@ A `TypeError` will be thrown if `size` is not a number.
 <!-- YAML
 added: v5.10.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/65003
     description: Added the `alignment` argument.
   - version: v20.0.0
@@ -879,7 +879,7 @@ additional performance that [`Buffer.allocUnsafe()`][] provides.
 <!-- YAML
 added: v5.12.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/65003
     description: Added the `alignment` argument.
   - version: v20.0.0
@@ -5335,7 +5335,7 @@ added:
   - v19.6.0
   - v18.15.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/64504
     description: Detached `ArrayBuffer`s and views backed by them are treated
                  as empty.
@@ -5356,7 +5356,7 @@ added:
   - v19.4.0
   - v18.14.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/64504
     description: Detached `ArrayBuffer`s and views backed by them are treated
                  as empty.
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 912030f9b321..642d4256852d 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -3711,7 +3711,7 @@ and by any user (the cache subdirectory is not suffixed with the creating user's
 ### `NODE_COMPILE_CACHE_READONLY=1`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 When set to 1, the [module compile cache][] only reads existing entries from
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index de0b9c986d7c..66f596cd212a 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -3554,7 +3554,7 @@ operations. The specific constants currently defined are described in
 <!-- YAML
 added: v0.1.94
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63411
     description: Ciphers in SIV and GCM-SIV modes are now supported.
   - version: v26.0.0
@@ -3636,7 +3636,7 @@ given IV will be.
 <!-- YAML
 added: v0.1.94
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63411
     description: Ciphers in SIV and GCM-SIV modes are now supported.
   - version: v26.0.0
@@ -5312,7 +5312,7 @@ An array of supported digest functions can be retrieved using
 <!-- YAML
 added: v0.11.14
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/65073
     description: The `mgf1Hash` option was added.
   - version:
@@ -5460,7 +5460,7 @@ be passed instead of a public key.
 <!-- YAML
 added: v0.11.14
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/65073
     description: The `mgf1Hash` option was added.
   - version: v15.0.0
diff --git a/doc/api/diagnostics_channel.md b/doc/api/diagnostics_channel.md
index 9f9fb53d4636..0971e04609b5 100644
--- a/doc/api/diagnostics_channel.md
+++ b/doc/api/diagnostics_channel.md
@@ -238,7 +238,7 @@ added:
  - v19.9.0
  - v18.19.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/64525
     description: Marked as stable.
 -->
@@ -749,7 +749,7 @@ added:
  - v19.9.0
  - v18.19.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/64525
     description: Marked as stable.
 -->
@@ -1925,7 +1925,7 @@ Emitted when a new thread is created.
 #### SQLite
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1 - Experimental
diff --git a/doc/api/fs.md b/doc/api/fs.md
index b088c1ff0e0c..589ac1a5e939 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1542,7 +1542,7 @@ link(2) documentation for more detail.
 <!-- YAML
 added: v10.0.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63143
     description: Accepts an additional `signal` option to allow aborting the
                  operation.
@@ -2086,7 +2086,7 @@ Removes files and directories (modeled on the standard POSIX `rm` utility).
 <!-- YAML
 added: v10.0.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63143
     description: Accepts an additional `signal` option to allow aborting the
                  operation.
@@ -2956,7 +2956,7 @@ behavior is similar to `cp dir1/ dir2/`.
 <!-- YAML
 added: v0.1.31
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63851
     description: Add the `windowsHandle` option.
   - version: v16.10.0
@@ -3093,7 +3093,7 @@ If `options` is a string, then it specifies the encoding.
 <!-- YAML
 added: v0.1.31
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63851
     description: Add the `windowsHandle` option.
   - version: v22.0.0
@@ -3449,7 +3449,7 @@ exception are given to the completion callback.
 <!-- YAML
 added: v0.1.95
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63143
     description: Accepts an additional `signal` option to allow aborting the
                  operation.
@@ -3820,7 +3820,7 @@ exception are given to the completion callback.
 <!-- YAML
 added: v0.1.30
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63143
     description: Accepts an additional `signal` option to allow aborting the
                  operation.
diff --git a/doc/api/module.md b/doc/api/module.md
index e0b000d95691..8272042cb1a6 100644
--- a/doc/api/module.md
+++ b/doc/api/module.md
@@ -507,7 +507,7 @@ The following constants are returned as the `status` field in the object returne
 <!-- YAML
 added: v22.8.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/65302
     description: Add the `readOnly` option.
   - version: v25.4.0
diff --git a/doc/api/net.md b/doc/api/net.md
index d91fed769907..686e1b11658a 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -99,7 +99,7 @@ Adds a rule to block the given IP address.
 ### `blockList.addAddresses(addresses[, type])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `addresses` {string\[]|net.SocketAddress\[]} An array of IPv4 or IPv6
@@ -114,7 +114,7 @@ are inserted under a single internal lock acquisition.
 ### `blockList.addCIDR(cidr)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
@@ -128,7 +128,7 @@ the parsed network address, prefix length, and family.
 ### `blockList.addCIDRs(cidrs)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `cidrs` {string\[]} An array of IPv4 or IPv6 subnets in CIDR notation.
@@ -202,7 +202,7 @@ console.log(blockList.check('::ffff:123.123.123.123', 'ipv6')); // Prints: true
 ### `blockList.clear()`
 
 <!--
-added: REPLACEME
+added: v26.8.0
 -->
 
 Clears all rules from the `BlockList`.
@@ -245,7 +245,7 @@ added:
 ### `BlockList.PRIVATE_RANGES`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {string\[]}
@@ -277,7 +277,7 @@ console.log(blockList.check('8.8.8.8'));       // Prints: false
 ### `blockList.removeAddress(address[, type])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `address` {string|net.SocketAddress} An IPv4 or IPv6 address.
@@ -290,7 +290,7 @@ specified address does not exist, this is a no-op.
 ### `blockList.removeCIDR(cidr)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
@@ -304,7 +304,7 @@ and family. If the specified subnet does not exist, this is a no-op.
 ### `blockList.removeRange(start, end[, type])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `start` {string|net.SocketAddress} The starting IPv4 or IPv6 address in the
@@ -319,7 +319,7 @@ If the specified range does not exist, this is a no-op.
 ### `blockList.removeSubnet(net, prefix[, type])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `net` {string|net.SocketAddress} The network IPv4 or IPv6 address.
@@ -347,7 +347,7 @@ The list of rules added to the blocklist.
 ### `blockList.size`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index e5f95fe67d43..2d409517010f 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1879,7 +1879,7 @@ The number of samples recorded by the histogram.
 ### `histogram.ccdf(value)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `value` {number} The value to query.
@@ -1892,7 +1892,7 @@ will exceed `value`. Equivalent to `1 - histogram.cdf(value)`.
 ### `histogram.cdf(value)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `value` {number} The value to query.
@@ -1906,7 +1906,7 @@ than or equal to `value`. This is the inverse operation of
 ### `histogram.cliffsD(other)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -1921,7 +1921,7 @@ opposite; 0 means no tendency in either direction.
 ### `histogram.cohensD(other)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -1936,7 +1936,7 @@ Both histograms must have at least 2 recorded values; otherwise returns 0.
 ### `histogram.countAt(value)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `value` {number} The value to query.
@@ -1972,7 +1972,7 @@ loop delay threshold.
 ### `histogram.ewmaMean`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1984,7 +1984,7 @@ Returns `0` when EWMA is disabled or no values have been recorded.
 ### `histogram.ewmaStddev`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1996,7 +1996,7 @@ when EWMA is disabled or no values have been recorded.
 ### `histogram.ewmaErrorRate`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -2009,7 +2009,7 @@ recorded.
 ### `histogram.burnRate(sloTarget)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `sloTarget` {number} The SLO target as a fraction between 0 and 1
@@ -2040,7 +2040,7 @@ if (rate > 1) {
 ### `histogram.ksTest(other)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2054,7 +2054,7 @@ detecting performance regressions by comparing before/after histograms.
 ### `histogram.kurtosis`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -2067,7 +2067,7 @@ lighter tails.
 ### `histogram.linearBuckets(stepSize)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `stepSize` {number} The width of each linear bucket.
@@ -2079,7 +2079,7 @@ of `stepSize`. Useful for visualization and export.
 ### `histogram.logBuckets(firstBucket, base)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `firstBucket` {number} The value of the first bucket boundary.
@@ -2093,7 +2093,7 @@ Useful for visualization and export.
 ### `histogram.mannWhitneyTest(other)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2189,7 +2189,7 @@ Returns the value at the given percentile.
 ### `histogram.percentileCI(percentile[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `percentile` {number} A percentile value in the range (0, 100].
@@ -2245,7 +2245,7 @@ Returns a `Map` object detailing the accumulated percentile distribution.
 ### `histogram.percentilesAt(percentiles)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `percentiles` {number\[]} An array of percentile values in the range (0, 100].
@@ -2267,7 +2267,7 @@ Resets the collected histogram data.
 ### `histogram.skewness`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -2290,7 +2290,7 @@ The standard deviation of the recorded event loop delays.
 ### `histogram.welchTest(other[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2406,7 +2406,7 @@ previous call to `recordDelta()` and records that amount in the histogram.
 ### `histogram.recordCorrected(val, expectedInterval)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `val` {number|bigint} The value to record.
@@ -2421,7 +2421,7 @@ latency.
 ### `histogram.subtract(other)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `other` {RecordableHistogram}
diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 59d3fdbba112..bc41da391d4c 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -443,7 +443,7 @@ wrapper around [`sqlite3_create_function_v2()`][].
 <!-- YAML
 added: v24.10.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/65156
     description: Accessing the invoking database connection from the authorizer
                  callback now throws.
@@ -698,10 +698,10 @@ console.log(query.get());
 <!-- YAML
 added: v22.5.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62757
     description: Add the `persistent` option.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/65157
     description: Throw `ERR_INVALID_ARG_VALUE` if `sql` contains no statements.
 -->
@@ -1083,10 +1083,10 @@ bound. Binding any other value throws an `ERR_INVALID_ARG_TYPE` error.
 <!-- YAML
 added: v22.5.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1113,7 +1113,7 @@ the values in `namedParameters` and `anonymousParameters`. See
 ### `statement.close()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 Finalizes the prepared statement. An exception is thrown if the statement is
@@ -1171,10 +1171,10 @@ execution of this prepared statement. This property is a wrapper around
 <!-- YAML
 added: v22.5.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1206,10 +1206,10 @@ added:
   - v23.4.0
   - v22.13.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1236,7 +1236,7 @@ the values in `namedParameters` and `anonymousParameters`. See
 ### `statement.resetStats()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 Resets every counter reported by [`statement.stat()`][] back to zero, except
@@ -1250,10 +1250,10 @@ executions of the same prepared statement.
 <!-- YAML
 added: v22.5.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1365,7 +1365,7 @@ wrapper around [`sqlite3_sql()`][].
 ### `statement[Symbol.dispose]()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 Finalizes the prepared statement. If the prepared statement is already
@@ -1376,7 +1376,7 @@ this statement is currently executing, under the same conditions as
 ### `statement.stat(counter)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `counter` {string} The name of the counter to read. One of:
@@ -1434,10 +1434,10 @@ class execute synchronously.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
@@ -1459,10 +1459,10 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
@@ -1484,10 +1484,10 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
@@ -1508,10 +1508,10 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
diff --git a/doc/api/tty.md b/doc/api/tty.md
index f50848101e04..5af3c454fe2f 100644
--- a/doc/api/tty.md
+++ b/doc/api/tty.md
@@ -70,7 +70,7 @@ A `boolean` that is always `true` for `tty.ReadStream` instances.
 <!-- YAML
 added: v0.7.7
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/64140
     description: The `mode` argument supports `'raw'` and `'io'`.
 -->
@@ -104,7 +104,7 @@ Windows.
 ### `readStream.rawMode`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * {boolean|string}
diff --git a/doc/api/util.md b/doc/api/util.md
index e35e78982bb0..19df9381564b 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -1899,7 +1899,7 @@ console.log(JSON.stringify(myMIMES));
 ### `MIMEType.parse(string)`
 
 <!--
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `string` {string} The input MIME to parse
diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index 909992e07a4f..3daa12b4f78e 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -1010,7 +1010,7 @@ the header.
 ## Class: `zlib.ZipBuffer`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
@@ -1079,7 +1079,7 @@ main();
 ### `new zlib.ZipBuffer(buffer)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `buffer` {Buffer|TypedArray|DataView|ArrayBuffer} A complete ZIP archive.
@@ -1097,7 +1097,7 @@ copy if it might change.
 ### `zipBuffer.add(filename, data[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive. A trailing `/`
@@ -1113,7 +1113,7 @@ options))`.
 ### `zipBuffer.addSync(filename, data[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive. A trailing `/`
@@ -1129,7 +1129,7 @@ The synchronous version of [`zipBuffer.add()`][]. Equivalent to
 ### `zipBuffer.addEntry(entry)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `entry` {ZipEntry}
@@ -1141,7 +1141,7 @@ any existing entry of that name.
 ### `zipBuffer.clear()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 Removes every entry.
@@ -1149,7 +1149,7 @@ Removes every entry.
 ### `zipBuffer.comment`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {string}
@@ -1162,7 +1162,7 @@ encoding flag of its own).
 ### `zipBuffer.delete(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -1171,7 +1171,7 @@ added: REPLACEME
 ### `zipBuffer.entries()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of `[name, entry]` pairs, where `entry` is a
@@ -1180,7 +1180,7 @@ added: REPLACEME
 ### `zipBuffer.forEach(callback[, thisArg])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `callback` {Function}
@@ -1191,7 +1191,7 @@ Calls `callback` once for each entry, in the order the archive lists them.
 ### `zipBuffer.get(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -1202,7 +1202,7 @@ Throws [`ERR_ZIP_ENTRY_NOT_FOUND`][] if the archive has no entry named `name`.
 ### `zipBuffer.has(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -1211,7 +1211,7 @@ added: REPLACEME
 ### `zipBuffer.keys()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of entry names.
@@ -1219,7 +1219,7 @@ added: REPLACEME
 ### `zipBuffer.size`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1229,7 +1229,7 @@ The number of entries in the archive.
 ### `zipBuffer.toBuffer([options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `options` {string|Object} An archive comment, as a shorthand for
@@ -1250,7 +1250,7 @@ needed (see [`zlib.createZipArchive()`][]).
 ### `zipBuffer.toBufferSync([options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `options` {string|Object} See [`zipBuffer.toBuffer()`][].
@@ -1262,7 +1262,7 @@ The synchronous version of [`zipBuffer.toBuffer()`][] (see
 ### `zipBuffer.values()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of [`ZipEntry`][].
@@ -1270,7 +1270,7 @@ added: REPLACEME
 ### `zipBuffer.writable`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {boolean}
@@ -1280,7 +1280,7 @@ Always `true`.
 ## Class: `zlib.ZipEntry`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
@@ -1304,7 +1304,7 @@ startup code), not in code that must stay responsive.
 ### Static method: `zlib.ZipEntry.create(filename, data[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive. A trailing `/`
@@ -1340,7 +1340,7 @@ recording the whole (UTC) second so the time round-trips more precisely (see
 ### Static method: `zlib.ZipEntry.createStream(filename, source[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive. Must not end
@@ -1385,7 +1385,7 @@ borrows.
 ### Static method: `zlib.ZipEntry.createSymlink(filename, target[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive.
@@ -1406,7 +1406,7 @@ path safety).
 ### Static method: `zlib.ZipEntry.createSync(filename, data[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive. A trailing `/`
@@ -1421,7 +1421,7 @@ The synchronous version of [`zlib.ZipEntry.create()`][].
 ### Static method: `zlib.ZipEntry.read(buffer)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `buffer` {Buffer|TypedArray|DataView|ArrayBuffer} A complete ZIP archive.
@@ -1435,7 +1435,7 @@ not mutate or reuse `buffer` while any of them is still in use.
 ### `zipEntry.comment`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {string}
@@ -1443,7 +1443,7 @@ added: REPLACEME
 ### `zipEntry.compressed`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {boolean}
@@ -1455,7 +1455,7 @@ uncompressed.
 ### `zipEntry.compressedSize`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1463,7 +1463,7 @@ added: REPLACEME
 ### `zipEntry.content([options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `options` {Object}
@@ -1485,7 +1485,7 @@ that method for when a streaming entry becomes readable).
 ### `zipEntry.contentSync([options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `options` {Object} See [`zipEntry.content()`][].
@@ -1496,7 +1496,7 @@ The synchronous version of [`zipEntry.content()`][].
 ### `zipEntry.contentIterator([options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `options` {Object}
@@ -1533,7 +1533,7 @@ processing chunks as they arrive.
 ### `zipEntry.crc32`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1541,7 +1541,7 @@ added: REPLACEME
 ### `zipEntry.flags`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1551,7 +1551,7 @@ The entry's raw general-purpose bit flag.
 ### `zipEntry.isDirectory`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {boolean}
@@ -1561,7 +1561,7 @@ added: REPLACEME
 ### `zipEntry.isFile`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {boolean}
@@ -1572,7 +1572,7 @@ symbolic link.
 ### `zipEntry.isSymlink`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {boolean}
@@ -1585,7 +1585,7 @@ untrusted — see [`zipEntry.name`][] on path safety.
 ### `zipEntry.mode`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1598,7 +1598,7 @@ on a Unix-like system. The file-type bits are not included here; use
 ### `zipEntry.modified`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {Date}
@@ -1618,7 +1618,7 @@ central-directory data.
 ### `zipEntry.method`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1629,7 +1629,7 @@ for Zstandard.
 ### `zipEntry.name`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {string}
@@ -1653,7 +1653,7 @@ responsibility.
 ### `zipEntry.nameBuffer`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {Buffer}
@@ -1665,7 +1665,7 @@ wants to decode them itself.
 ### `zipEntry.rawContent`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {Buffer|null}
@@ -1680,7 +1680,7 @@ rather than retained. Use [`zipEntry.content()`][] or
 ### `zipEntry.size`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -1690,7 +1690,7 @@ The entry's uncompressed size, in bytes.
 ## Class: `zlib.ZipFile`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
@@ -1770,7 +1770,7 @@ main();
 ### Static method: `zlib.ZipFile.open(filename[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string}
@@ -1786,7 +1786,7 @@ directory is too large to buffer in memory.
 ### Static method: `zlib.ZipFile.openSync(filename[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string}
@@ -1798,7 +1798,7 @@ The synchronous version of [`zlib.ZipFile.open()`][].
 ### `zipFile.add(filename, data[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive. A trailing `/`
@@ -1814,7 +1814,7 @@ options))`.
 ### `zipFile.addEntry(entry)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `entry` {ZipEntry}
@@ -1834,7 +1834,7 @@ own buffer unchanged.
 ### `zipFile.addEntrySync(entry)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `entry` {ZipEntry}
@@ -1848,7 +1848,7 @@ its asynchronous source.
 ### `zipFile.addSync(filename, data[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `filename` {string} The entry's name within the archive. A trailing `/`
@@ -1864,7 +1864,7 @@ The synchronous version of [`zipFile.add()`][]. Equivalent to
 ### `zipFile.close()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Promise}
@@ -1879,7 +1879,7 @@ dedicated Node.js error code. The same applies to [`zipFile.closeSync()`][].
 ### `zipFile.closeSync()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 The synchronous version of [`zipFile.close()`][].
@@ -1887,7 +1887,7 @@ The synchronous version of [`zipFile.close()`][].
 ### `zipFile.comment`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {string}
@@ -1900,7 +1900,7 @@ no encoding flag of its own).
 ### `zipFile.compact([comment])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `comment` {string} An archive comment. **Default:** [`zipFile.comment`][].
@@ -1918,7 +1918,7 @@ zip.compact().pipe(createWriteStream('compacted.zip'));
 ### `zipFile.compactSync([comment])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `comment` {string} An archive comment. **Default:** [`zipFile.comment`][].
@@ -1932,7 +1932,7 @@ open file.
 ### `zipFile.delete(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -1946,7 +1946,7 @@ not opened with `{ writable: true }`.
 ### `zipFile.deleteSync(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -1958,7 +1958,7 @@ The synchronous version of [`zipFile.delete()`][].
 ### `zipFile.entries()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of `[name, entry]` pairs, where `entry` is a
@@ -1967,7 +1967,7 @@ added: REPLACEME
 ### `zipFile.entriesSync()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of `[name, entry]` pairs, where `entry` is a resolved
@@ -1978,7 +1978,7 @@ The synchronous version of [`zipFile.entries()`][].
 ### `zipFile.forEach(callback[, thisArg])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `callback` {Function}
@@ -1987,7 +1987,7 @@ added: REPLACEME
 ### `zipFile.forEachSync(callback[, thisArg])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `callback` {Function}
@@ -1999,7 +1999,7 @@ with a resolved [`ZipEntry`][] instead of a `Promise`.
 ### `zipFile.get(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -2018,7 +2018,7 @@ named `name`.
 ### `zipFile.getSync(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -2032,7 +2032,7 @@ on I/O - but reads performed later through the returned entry (such as
 ### `zipFile.has(name)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -2041,7 +2041,7 @@ added: REPLACEME
 ### `zipFile.keys()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of entry names.
@@ -2049,7 +2049,7 @@ added: REPLACEME
 ### `zipFile.size`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {number}
@@ -2059,7 +2059,7 @@ The number of entries in the archive.
 ### `zipFile.stream(name[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * `name` {string}
@@ -2079,7 +2079,7 @@ named `name`.
 ### `zipFile.values()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of {Promise} objects, each fulfilled with a
@@ -2088,7 +2088,7 @@ added: REPLACEME
 ### `zipFile.valuesSync()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Returns: {Iterator} of resolved [`ZipEntry`][] values (not `Promise`s).
@@ -2098,7 +2098,7 @@ The synchronous version of [`zipFile.values()`][].
 ### `zipFile.writable`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 * Type: {boolean}
@@ -2436,7 +2436,7 @@ Creates and returns a new [`Unzip`][] object.
 ## `zlib.createZipArchive(entries[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
@@ -2535,7 +2535,7 @@ createZipArchive(entries, { baseOffset: prefix.byteLength }).pipe(out);
 ## `zlib.createZipArchiveSync(entries[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
@@ -2565,7 +2565,7 @@ queued behind it are disposed, releasing any sources they hold.
 ## `zlib.zipFiles(files[, options])`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
@@ -2642,7 +2642,7 @@ Creates and returns a new [`ZstdDecompress`][] object.
 ## `zlib.getMaxZipContentSize()`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
@@ -2659,7 +2659,7 @@ when no explicit `maxSize` is given. **Default:** `268435456` (256 MiB).
 ## `zlib.setMaxZipContentSize(size)`
 
 <!-- YAML
-added: REPLACEME
+added: v26.8.0
 -->
 
 > Stability: 1.0 - Early development
diff --git a/doc/changelogs/CHANGELOG_V26.md b/doc/changelogs/CHANGELOG_V26.md
index 56a10fa9442c..b9c2ac3c2a72 100644
--- a/doc/changelogs/CHANGELOG_V26.md
+++ b/doc/changelogs/CHANGELOG_V26.md
@@ -8,6 +8,7 @@
 </tr>
 <tr>
 <td>
+<a href="#26.8.0">26.8.0</a><br/>
 <a href="#26.7.0">26.7.0</a><br/>
 <a href="#26.6.0">26.6.0</a><br/>
 <a href="#26.5.1">26.5.1</a><br/>
@@ -50,6 +51,371 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="26.8.0"></a>
+
+## 2026-08-26, Version 26.8.0 (Current), @aduh95
+
+### Notable Changes
+
+* \[[`74234ee30e`](https://github.com/nodejs/node/commit/74234ee30e)] - **(SEMVER-MINOR)** **benchmark**: add --analyze mode to compare.js (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`4232997fa2`](https://github.com/nodejs/node/commit/4232997fa2)] - **crypto**: update root certificates to NSS 3.126 (Node.js GitHub Bot) [#65495](https://github.com/nodejs/node/pull/65495)
+* \[[`f0531f1c87`](https://github.com/nodejs/node/commit/f0531f1c87)] - **(SEMVER-MINOR)** **crypto**: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) [#63411](https://github.com/nodejs/node/pull/63411)
+* \[[`3f4b80ebb5`](https://github.com/nodejs/node/commit/3f4b80ebb5)] - **diagnostics\_channel**: mark TracingChannel as stable (Abdelrahman Awad) [#64525](https://github.com/nodejs/node/pull/64525)
+* \[[`753033c110`](https://github.com/nodejs/node/commit/753033c110)] - **(SEMVER-MINOR)** **lib,src**: improve histogram implementation (James M Snell) [#65024](https://github.com/nodejs/node/pull/65024)
+* \[[`3d7d277493`](https://github.com/nodejs/node/commit/3d7d277493)] - **(SEMVER-MINOR)** **net**: improve performance of net.BlockList (James M Snell) [#64974](https://github.com/nodejs/node/pull/64974)
+* \[[`9e8e9080fd`](https://github.com/nodejs/node/commit/9e8e9080fd)] - **(SEMVER-MINOR)** **perf\_hooks**: add statistical hypothesis testing to histogram (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`c18b0aa54e`](https://github.com/nodejs/node/commit/c18b0aa54e)] - **repl**: add basic syntax highlighting (Aviv Keller) [#64591](https://github.com/nodejs/node/pull/64591)
+* \[[`58ea88e1d3`](https://github.com/nodejs/node/commit/58ea88e1d3)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype.close() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`7c61b08aed`](https://github.com/nodejs/node/commit/7c61b08aed)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype\[Symbol.dispose]\() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`4299cd5897`](https://github.com/nodejs/node/commit/4299cd5897)] - **(SEMVER-MINOR)** **util**: add non-throwing MIMEType.parse (James M Snell) [#64965](https://github.com/nodejs/node/pull/64965)
+* \[[`df48191061`](https://github.com/nodejs/node/commit/df48191061)] - **(SEMVER-MINOR)** **zlib**: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) [#64339](https://github.com/nodejs/node/pull/64339)
+
+### Commits
+
+* \[[`162257b403`](https://github.com/nodejs/node/commit/162257b403)] - **assert**: improve documentation wording (Kamal Rawal) [#64953](https://github.com/nodejs/node/pull/64953)
+* \[[`74234ee30e`](https://github.com/nodejs/node/commit/74234ee30e)] - **(SEMVER-MINOR)** **benchmark**: add --analyze mode to compare.js (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`2cb96dd462`](https://github.com/nodejs/node/commit/2cb96dd462)] - **benchmark**: add test-only and mock timers cases (Luan Muniz) [#64097](https://github.com/nodejs/node/pull/64097)
+* \[[`562168f93f`](https://github.com/nodejs/node/commit/562168f93f)] - **benchmark**: apply `highWaterMark` in webstreams `pipe-to` (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`fbec4eb386`](https://github.com/nodejs/node/commit/fbec4eb386)] - **benchmark**: complete the sqlite is-transaction fix (Edy Silva) [#65218](https://github.com/nodejs/node/pull/65218)
+* \[[`d8acfc45f1`](https://github.com/nodejs/node/commit/d8acfc45f1)] - **benchmark**: add test runner hooks and options (Luan Muniz) [#63754](https://github.com/nodejs/node/pull/63754)
+* \[[`13e7d54f67`](https://github.com/nodejs/node/commit/13e7d54f67)] - **buffer**: prevent string write offset overflow (Matteo Collina) [#65043](https://github.com/nodejs/node/pull/65043)
+* \[[`615273deac`](https://github.com/nodejs/node/commit/615273deac)] - **buffer**: support aligned allocations (Robert Nagy) [#65003](https://github.com/nodejs/node/pull/65003)
+* \[[`bc6b630e21`](https://github.com/nodejs/node/commit/bc6b630e21)] - **buffer**: treat detached ArrayBuffers as empty (Archkon) [#64504](https://github.com/nodejs/node/pull/64504)
+* \[[`ddf9f9d265`](https://github.com/nodejs/node/commit/ddf9f9d265)] - **build**: target Power 9 and z14 (Richard Lau) [#65439](https://github.com/nodejs/node/pull/65439)
+* \[[`fda8ee894e`](https://github.com/nodejs/node/commit/fda8ee894e)] - **build**: use build-ci for benchmark merge-commit rebuild (Yagiz Nizipli) [#65362](https://github.com/nodejs/node/pull/65362)
+* \[[`03692786ef`](https://github.com/nodejs/node/commit/03692786ef)] - **build**: add simdutf dir to include path in GN build (Shelley Vohr) [#65382](https://github.com/nodejs/node/pull/65382)
+* \[[`3da555a3ed`](https://github.com/nodejs/node/commit/3da555a3ed)] - **build**: pass target architecture to small-icu genccode (ulofiai) [#65095](https://github.com/nodejs/node/pull/65095)
+* \[[`ffe1e7cbea`](https://github.com/nodejs/node/commit/ffe1e7cbea)] - **build**: update binary-upload to use correct tarball name (Stewart X Addison) [#65282](https://github.com/nodejs/node/pull/65282)
+* \[[`50174cb94a`](https://github.com/nodejs/node/commit/50174cb94a)] - **build**: deprecate always enabled `--enable-static` (Chengzhong Wu) [#65103](https://github.com/nodejs/node/pull/65103)
+* \[[`28f662b424`](https://github.com/nodejs/node/commit/28f662b424)] - **build**: check FIPS option value in node.gyp (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`29a2ecefeb`](https://github.com/nodejs/node/commit/29a2ecefeb)] - **build**: handle malformed OpenSSL macros (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`6deeef1801`](https://github.com/nodejs/node/commit/6deeef1801)] - **build**: enable perfetto updater (Chengzhong Wu) [#64966](https://github.com/nodejs/node/pull/64966)
+* \[[`312f0c6a7e`](https://github.com/nodejs/node/commit/312f0c6a7e)] - **build**: add host toolset to perfetto\_sdk (Ryuhei Shima) [#64751](https://github.com/nodejs/node/pull/64751)
+* \[[`1a4f5e537b`](https://github.com/nodejs/node/commit/1a4f5e537b)] - **build,win**: add PGO workload scripts (Stefan Stojanovic) [#63696](https://github.com/nodejs/node/pull/63696)
+* \[[`21655dccbc`](https://github.com/nodejs/node/commit/21655dccbc)] - **child\_process**: keep SIGWINCH from killing on Win (Kirill Saied) [#64510](https://github.com/nodejs/node/pull/64510)
+* \[[`4232997fa2`](https://github.com/nodejs/node/commit/4232997fa2)] - **crypto**: update root certificates to NSS 3.126 (Node.js GitHub Bot) [#65495](https://github.com/nodejs/node/pull/65495)
+* \[[`f0531f1c87`](https://github.com/nodejs/node/commit/f0531f1c87)] - **(SEMVER-MINOR)** **crypto**: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) [#63411](https://github.com/nodejs/node/pull/63411)
+* \[[`109566a2f7`](https://github.com/nodejs/node/commit/109566a2f7)] - **crypto**: fix missing error checks on ASN1\_STRING\_to\_UTF8() (Nora Dossche) [#65200](https://github.com/nodejs/node/pull/65200)
+* \[[`501f81612d`](https://github.com/nodejs/node/commit/501f81612d)] - **crypto**: improve SubtleCrypto.supports() accuracy (Filip Skokan) [#65222](https://github.com/nodejs/node/pull/65222)
+* \[[`137ff67fd3`](https://github.com/nodejs/node/commit/137ff67fd3)] - **crypto**: use available BoringSSL APIs (Filip Skokan) [#65423](https://github.com/nodejs/node/pull/65423)
+* \[[`0e87576ed4`](https://github.com/nodejs/node/commit/0e87576ed4)] - **crypto**: remove obsolete BoringSSL shims (Filip Skokan) [#65423](https://github.com/nodejs/node/pull/65423)
+* \[[`af867ce3e4`](https://github.com/nodejs/node/commit/af867ce3e4)] - **crypto**: add mgf1Hash for RSA-OAEP (Adam Mcgrath) [#65073](https://github.com/nodejs/node/pull/65073)
+* \[[`66ee4792bf`](https://github.com/nodejs/node/commit/66ee4792bf)] - **crypto**: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) [#65172](https://github.com/nodejs/node/pull/65172)
+* \[[`6a142c03e9`](https://github.com/nodejs/node/commit/6a142c03e9)] - **crypto**: read WebCrypto inputs through primordials (Filip Skokan) [#65115](https://github.com/nodejs/node/pull/65115)
+* \[[`92e3110462`](https://github.com/nodejs/node/commit/92e3110462)] - **crypto**: fix disabling FIPS mode (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`d69bed2f49`](https://github.com/nodejs/node/commit/d69bed2f49)] - **debugger**: wait for target startup (Filip Skokan) [#65194](https://github.com/nodejs/node/pull/65194)
+* \[[`5c7c0b8b15`](https://github.com/nodejs/node/commit/5c7c0b8b15)] - **deps**: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) [#65316](https://github.com/nodejs/node/pull/65316)
+* \[[`4cb6b1335e`](https://github.com/nodejs/node/commit/4cb6b1335e)] - **deps**: update simdjson to 4.6.7 (Node.js GitHub Bot) [#65318](https://github.com/nodejs/node/pull/65318)
+* \[[`a39ad67482`](https://github.com/nodejs/node/commit/a39ad67482)] - **deps**: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) [#65317](https://github.com/nodejs/node/pull/65317)
+* \[[`46762dad57`](https://github.com/nodejs/node/commit/46762dad57)] - **deps**: cherry-pick libuv/libuv\@e640dc9 (ulofiai) [#65118](https://github.com/nodejs/node/pull/65118)
+* \[[`abb7a15a8d`](https://github.com/nodejs/node/commit/abb7a15a8d)] - **deps**: update perfetto to 57.2 (Node.js GitHub Bot) [#65114](https://github.com/nodejs/node/pull/65114)
+* \[[`ebd8c6ba52`](https://github.com/nodejs/node/commit/ebd8c6ba52)] - **deps**: float ICU-23262 patch for icu78 (René) [#64678](https://github.com/nodejs/node/pull/64678)
+* \[[`f2cc681109`](https://github.com/nodejs/node/commit/f2cc681109)] - **deps**: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) [#65136](https://github.com/nodejs/node/pull/65136)
+* \[[`f45dc92913`](https://github.com/nodejs/node/commit/f45dc92913)] - **deps**: update undici to 8.10.0 (Node.js GitHub Bot) [#65155](https://github.com/nodejs/node/pull/65155)
+* \[[`4160dfdf81`](https://github.com/nodejs/node/commit/4160dfdf81)] - **deps**: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) [#65153](https://github.com/nodejs/node/pull/65153)
+* \[[`631d3aa37b`](https://github.com/nodejs/node/commit/631d3aa37b)] - **deps**: update libffi to 3.8.0 (Node.js GitHub Bot) [#65154](https://github.com/nodejs/node/pull/65154)
+* \[[`788976c626`](https://github.com/nodejs/node/commit/788976c626)] - **dgram**: don't swallow bind errors when callback is provided (armanmikoyan) [#62602](https://github.com/nodejs/node/pull/62602)
+* \[[`d286423043`](https://github.com/nodejs/node/commit/d286423043)] - **diagnostics\_channel**: validate before channel activation (Trivikram Kamat) [#65313](https://github.com/nodejs/node/pull/65313)
+* \[[`3f4b80ebb5`](https://github.com/nodejs/node/commit/3f4b80ebb5)] - **diagnostics\_channel**: mark TracingChannel as stable (Abdelrahman Awad) [#64525](https://github.com/nodejs/node/pull/64525)
+* \[[`152a326f92`](https://github.com/nodejs/node/commit/152a326f92)] - **dns**: validate address type in lookupService (Lazizbek Ergashev) [#64878](https://github.com/nodejs/node/pull/64878)
+* \[[`00c71fec93`](https://github.com/nodejs/node/commit/00c71fec93)] - **dns**: validate port range in `setServers()` (René) [#65021](https://github.com/nodejs/node/pull/65021)
+* \[[`e9327d1422`](https://github.com/nodejs/node/commit/e9327d1422)] - **dns**: fix crash on setServers with port 0 (Lazizbek Ergashev) [#65009](https://github.com/nodejs/node/pull/65009)
+* \[[`9e227ef20d`](https://github.com/nodejs/node/commit/9e227ef20d)] - **doc**: update AHAFS reference link (Taeuk Ha) [#65481](https://github.com/nodejs/node/pull/65481)
+* \[[`5fbf6c57af`](https://github.com/nodejs/node/commit/5fbf6c57af)] - **doc**: fix property names in os.networkInterfaces() example (Jihwan) [#65469](https://github.com/nodejs/node/pull/65469)
+* \[[`13f16d28d1`](https://github.com/nodejs/node/commit/13f16d28d1)] - **doc**: fix broken links in cli.md (Donghoon Kang) [#65412](https://github.com/nodejs/node/pull/65412)
+* \[[`0f36ee3755`](https://github.com/nodejs/node/commit/0f36ee3755)] - **doc**: remove outdated WASI version fallback (이혜미) [#65303](https://github.com/nodejs/node/pull/65303)
+* \[[`1ad09f712a`](https://github.com/nodejs/node/commit/1ad09f712a)] - **doc**: fix broken GYP link in n-api.md (Donghoon Kang) [#65413](https://github.com/nodejs/node/pull/65413)
+* \[[`24cd694237`](https://github.com/nodejs/node/commit/24cd694237)] - **doc**: document that an empty OPENSSL\_CONF skips config loading (Orgad Shaneh) [#64949](https://github.com/nodejs/node/pull/64949)
+* \[[`dae434132e`](https://github.com/nodejs/node/commit/dae434132e)] - **doc**: fix broken TLS security level example (soreavis) [#65391](https://github.com/nodejs/node/pull/65391)
+* \[[`96b91dc987`](https://github.com/nodejs/node/commit/96b91dc987)] - **doc**: clarify socket destroyed behavior (Dayun) [#65395](https://github.com/nodejs/node/pull/65395)
+* \[[`9d8d27d444`](https://github.com/nodejs/node/commit/9d8d27d444)] - **doc**: update outdated nodejs.org guide links (Donghoon Kang) [#65394](https://github.com/nodejs/node/pull/65394)
+* \[[`65f675086e`](https://github.com/nodejs/node/commit/65f675086e)] - **doc**: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) [#62117](https://github.com/nodejs/node/pull/62117)
+* \[[`89aba0c311`](https://github.com/nodejs/node/commit/89aba0c311)] - **doc**: clarify how fs.Dirent file types are determined (soreavis) [#64532](https://github.com/nodejs/node/pull/64532)
+* \[[`3ed0492f52`](https://github.com/nodejs/node/commit/3ed0492f52)] - **doc**: update security release prepare command (Rafael Gonzaga) [#64699](https://github.com/nodejs/node/pull/64699)
+* \[[`63583c4e75`](https://github.com/nodejs/node/commit/63583c4e75)] - **doc**: clarify copyFile symlink behavior (T) [#62941](https://github.com/nodejs/node/pull/62941)
+* \[[`abfc51f757`](https://github.com/nodejs/node/commit/abfc51f757)] - **doc**: document setRawMode write access on Windows (Erik Demaine) [#63856](https://github.com/nodejs/node/pull/63856)
+* \[[`4a784cb3e6`](https://github.com/nodejs/node/commit/4a784cb3e6)] - **doc**: document per-architecture fast FFI argument limits (Seongeun Lee) [#65207](https://github.com/nodejs/node/pull/65207)
+* \[[`262f966155`](https://github.com/nodejs/node/commit/262f966155)] - **doc**: add missing return types in fs.md (Chaseton Collins) [#65307](https://github.com/nodejs/node/pull/65307)
+* \[[`695cd896a7`](https://github.com/nodejs/node/commit/695cd896a7)] - **doc**: add missing return types in buffer.md (Yuya Inoue) [#65308](https://github.com/nodejs/node/pull/65308)
+* \[[`676a1228cd`](https://github.com/nodejs/node/commit/676a1228cd)] - **doc**: fix lint clean command (greenhead) [#65274](https://github.com/nodejs/node/pull/65274)
+* \[[`9ea318d4e3`](https://github.com/nodejs/node/commit/9ea318d4e3)] - **doc**: fix typo in onboarding.md (서울민트초코) [#65295](https://github.com/nodejs/node/pull/65295)
+* \[[`3b6a918ab4`](https://github.com/nodejs/node/commit/3b6a918ab4)] - **doc**: add missing `added:` tags to `fs.lchmod` (Lazizbek Ergashev) [#65283](https://github.com/nodejs/node/pull/65283)
+* \[[`a77b1e61df`](https://github.com/nodejs/node/commit/a77b1e61df)] - **doc**: fix SQLite changeset constant descriptions (greenhead) [#65265](https://github.com/nodejs/node/pull/65265)
+* \[[`ab50ae60e4`](https://github.com/nodejs/node/commit/ab50ae60e4)] - **doc**: document open pull request limit (Matteo Collina) [#65250](https://github.com/nodejs/node/pull/65250)
+* \[[`e2f4ea03a3`](https://github.com/nodejs/node/commit/e2f4ea03a3)] - **doc**: document http2 header constants (Harjoth Khara) [#64548](https://github.com/nodejs/node/pull/64548)
+* \[[`5b5509d0d3`](https://github.com/nodejs/node/commit/5b5509d0d3)] - **doc**: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) [#62105](https://github.com/nodejs/node/pull/62105)
+* \[[`c63e873073`](https://github.com/nodejs/node/commit/c63e873073)] - **doc**: fix broken fs.BigIntStats link in vfs.md (greenhead) [#65045](https://github.com/nodejs/node/pull/65045)
+* \[[`d6059e84c0`](https://github.com/nodejs/node/commit/d6059e84c0)] - **doc**: update synopsis (Augustin Mauroy) [#65171](https://github.com/nodejs/node/pull/65171)
+* \[[`43f1dc03e7`](https://github.com/nodejs/node/commit/43f1dc03e7)] - **doc**: document close() error when in a sqlite callback (Trivikram Kamat) [#65090](https://github.com/nodejs/node/pull/65090)
+* \[[`8f5f48ad96`](https://github.com/nodejs/node/commit/8f5f48ad96)] - **doc**: fix broken internal links (greenhead) [#64901](https://github.com/nodejs/node/pull/64901)
+* \[[`5b64b37739`](https://github.com/nodejs/node/commit/5b64b37739)] - **doc**: report proper return type on urlPattern.test (Brian Muenzenmeyer) [#64831](https://github.com/nodejs/node/pull/64831)
+* \[[`9633bb0f29`](https://github.com/nodejs/node/commit/9633bb0f29)] - **doc**: fix permission documentation examples (greenhead) [#64897](https://github.com/nodejs/node/pull/64897)
+* \[[`e52e573fd7`](https://github.com/nodejs/node/commit/e52e573fd7)] - **doc**: document sqlite parameter binding (Guilherme Araújo) [#65089](https://github.com/nodejs/node/pull/65089)
+* \[[`fa52f11d3b`](https://github.com/nodejs/node/commit/fa52f11d3b)] - **doc**: finalize statements in sqlite examples (Guilherme Araújo) [#65088](https://github.com/nodejs/node/pull/65088)
+* \[[`0157c45012`](https://github.com/nodejs/node/commit/0157c45012)] - **doc**: document quic stopSending() and resetStream() (Issac) [#64888](https://github.com/nodejs/node/pull/64888)
+* \[[`003a913799`](https://github.com/nodejs/node/commit/003a913799)] - **doc**: clarify sqlite bare parameter default (Sumit Kumar Das) [#62009](https://github.com/nodejs/node/pull/62009)
+* \[[`c5588d71ad`](https://github.com/nodejs/node/commit/c5588d71ad)] - **doc**: remove usage of `util.inherits` (Augustin Mauroy) [#60817](https://github.com/nodejs/node/pull/60817)
+* \[[`673db40fbf`](https://github.com/nodejs/node/commit/673db40fbf)] - **doc**: fix grammar in worker\_threads.md (이혜미) [#64913](https://github.com/nodejs/node/pull/64913)
+* \[[`ee5f72cf16`](https://github.com/nodejs/node/commit/ee5f72cf16)] - **doc**: fix broken link (Antoine du Hamel) [#65078](https://github.com/nodejs/node/pull/65078)
+* \[[`0450ab6c6a`](https://github.com/nodejs/node/commit/0450ab6c6a)] - **doc**: update `node.1` to fix linter (Antoine du Hamel) [#65053](https://github.com/nodejs/node/pull/65053)
+* \[[`9a256b0693`](https://github.com/nodejs/node/commit/9a256b0693)] - **doc**: clarify OpenSSL FIPS configuration (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`c321752dcb`](https://github.com/nodejs/node/commit/c321752dcb)] - **doc**: remove `--expose-gc` flag from CLI documentation (Dario Piotrowicz) [#58909](https://github.com/nodejs/node/pull/58909)
+* \[[`0cf79931bb`](https://github.com/nodejs/node/commit/0cf79931bb)] - **doc**: document ArrayBuffer support in pbkd2Sync (kyungrae2002) [#64976](https://github.com/nodejs/node/pull/64976)
+* \[[`3b8a0bacaa`](https://github.com/nodejs/node/commit/3b8a0bacaa)] - **doc**: correct default highWaterMark values (Yilong Li) [#64617](https://github.com/nodejs/node/pull/64617)
+* \[[`be313012e4`](https://github.com/nodejs/node/commit/be313012e4)] - **doc**: use ffi.suffix in permission example (agape1225) [#64914](https://github.com/nodejs/node/pull/64914)
+* \[[`4a1c9a7ee0`](https://github.com/nodejs/node/commit/4a1c9a7ee0)] - **esm**: avoid super-linear data URL MIME regex (Sumit Kumar Das) [#61951](https://github.com/nodejs/node/pull/61951)
+* \[[`b1770bc196`](https://github.com/nodejs/node/commit/b1770bc196)] - **esm**: only register text format when enabled (Efe Karasakal) [#64992](https://github.com/nodejs/node/pull/64992)
+* \[[`f48927fe5b`](https://github.com/nodejs/node/commit/f48927fe5b)] - **esm**: fix wasm import name in error message (이혜미) [#64950](https://github.com/nodejs/node/pull/64950)
+* \[[`8d48adf688`](https://github.com/nodejs/node/commit/8d48adf688)] - **events**: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) [#64473](https://github.com/nodejs/node/pull/64473)
+* \[[`b827c0047e`](https://github.com/nodejs/node/commit/b827c0047e)] - **events**: inline createEvent hybrid dispatch closure (Szymon Łągiewka) [#64473](https://github.com/nodejs/node/pull/64473)
+* \[[`7670c81d99`](https://github.com/nodejs/node/commit/7670c81d99)] - **ffi**: prefer canonical type names (Trivikram Kamat) [#65417](https://github.com/nodejs/node/pull/65417)
+* \[[`1fe7a1c33d`](https://github.com/nodejs/node/commit/1fe7a1c33d)] - **ffi**: validate the value passed to the float setters (Soul Lee) [#65342](https://github.com/nodejs/node/pull/65342)
+* \[[`537feecd0b`](https://github.com/nodejs/node/commit/537feecd0b)] - **ffi**: reject direct SharedArrayBuffer pointers (Trivikram Kamat) [#65233](https://github.com/nodejs/node/pull/65233)
+* \[[`0002f0a718`](https://github.com/nodejs/node/commit/0002f0a718)] - **ffi**: remove dead null check in callback arguments (Trivikram Kamat) [#64998](https://github.com/nodejs/node/pull/64998)
+* \[[`9024ec27b6`](https://github.com/nodejs/node/commit/9024ec27b6)] - **ffi**: keep FFI functions non-constructible (Trivikram Kamat) [#65184](https://github.com/nodejs/node/pull/65184)
+* \[[`9b4f349b01`](https://github.com/nodejs/node/commit/9b4f349b01)] - **ffi**: refresh cached string buffers on every call (Trivikram Kamat) [#65051](https://github.com/nodejs/node/pull/65051)
+* \[[`eacd65e9c2`](https://github.com/nodejs/node/commit/eacd65e9c2)] - **ffi**: reject detached ArrayBufferViews (Trivikram Kamat) [#65086](https://github.com/nodejs/node/pull/65086)
+* \[[`be2ab89730`](https://github.com/nodejs/node/commit/be2ab89730)] - **ffi**: reject detached ArrayBuffers as pointers (Trivikram Kamat) [#65083](https://github.com/nodejs/node/pull/65083)
+* \[[`6f9e0846ea`](https://github.com/nodejs/node/commit/6f9e0846ea)] - **ffi**: validate fast pointer BigInt argument ranges (Trivikram Kamat) [#65032](https://github.com/nodejs/node/pull/65032)
+* \[[`3e6688c5e3`](https://github.com/nodejs/node/commit/3e6688c5e3)] - **ffi**: reuse the callable created per symbol (Trivikram Kamat) [#64971](https://github.com/nodejs/node/pull/64971)
+* \[[`8b0bdd931c`](https://github.com/nodejs/node/commit/8b0bdd931c)] - **ffi**: shrink trampoline placement probe window (Trivikram Kamat) [#64969](https://github.com/nodejs/node/pull/64969)
+* \[[`9c282c4532`](https://github.com/nodejs/node/commit/9c282c4532)] - **ffi**: accept pointer BigInts in multi-argument fast calls (Trivikram Kamat) [#64964](https://github.com/nodejs/node/pull/64964)
+* \[[`b98294b57d`](https://github.com/nodejs/node/commit/b98294b57d)] - **ffi**: support SharedArrayBuffer in getRawPointer (Junsoo Ha) [#64864](https://github.com/nodejs/node/pull/64864)
+* \[[`5cac7c2c55`](https://github.com/nodejs/node/commit/5cac7c2c55)] - **ffi**: reuse libffi call plans (Yilong Li) [#64958](https://github.com/nodejs/node/pull/64958)
+* \[[`262f0ec82a`](https://github.com/nodejs/node/commit/262f0ec82a)] - **fs**: stop stat()ing every entry in recursive readdir (Shelley Vohr) [#65487](https://github.com/nodejs/node/pull/65487)
+* \[[`e3ae912e9a`](https://github.com/nodejs/node/commit/e3ae912e9a)] - **fs**: use sized reads for large files in readFileUtf8 (Shelley Vohr) [#65328](https://github.com/nodejs/node/pull/65328)
+* \[[`bc1e19b4b7`](https://github.com/nodejs/node/commit/bc1e19b4b7)] - **fs**: fix realpath of namespaced drive paths (Jason Zhang) [#65378](https://github.com/nodejs/node/pull/65378)
+* \[[`6673ebadf2`](https://github.com/nodejs/node/commit/6673ebadf2)] - **fs**: abort in-flight stat operations (Mert Can Altin) [#63143](https://github.com/nodejs/node/pull/63143)
+* \[[`74dcdbb5f1`](https://github.com/nodejs/node/commit/74dcdbb5f1)] - **fs**: fix glob early return skipping sibling entries (Srinu desetti) [#64895](https://github.com/nodejs/node/pull/64895)
+* \[[`6305a744df`](https://github.com/nodejs/node/commit/6305a744df)] - **fs**: pass symlink type in cp when filter is provided (Jerry Zhao) [#62654](https://github.com/nodejs/node/pull/62654)
+* \[[`c5cb6bc7e2`](https://github.com/nodejs/node/commit/c5cb6bc7e2)] - **fs**: allocate FSReqPromise stat arrays lazily (Samuel Attard) [#63886](https://github.com/nodejs/node/pull/63886)
+* \[[`992af05719`](https://github.com/nodejs/node/commit/992af05719)] - **fs**: fix out-of-bounds write in mkdtemp for long prefixes (Hierax\_Umbra) [#64770](https://github.com/nodejs/node/pull/64770)
+* \[[`2de845b2dd`](https://github.com/nodejs/node/commit/2de845b2dd)] - **fs**: treat `std::errc::permission_denied` as `EPERM` error (Kirill Saied) [#64698](https://github.com/nodejs/node/pull/64698)
+* \[[`77fedbd350`](https://github.com/nodejs/node/commit/77fedbd350)] - **fs**: read small files in one thread pool round trip (Shelley Vohr) [#65327](https://github.com/nodejs/node/pull/65327)
+* \[[`810929b6dd`](https://github.com/nodejs/node/commit/810929b6dd)] - _**Revert**_ "**fs**: fix close listener leak in FileHandle streams" (Mike McCready) [#65387](https://github.com/nodejs/node/pull/65387)
+* \[[`8873b91fce`](https://github.com/nodejs/node/commit/8873b91fce)] - **fs**: fix close listener leak in FileHandle streams (Y1D7NG) [#64227](https://github.com/nodejs/node/pull/64227)
+* \[[`656cfaeb2d`](https://github.com/nodejs/node/commit/656cfaeb2d)] - **fs**: add windowsHandle option to file streams (Kirill Saied) [#63851](https://github.com/nodejs/node/pull/63851)
+* \[[`c2c31d69fd`](https://github.com/nodejs/node/commit/c2c31d69fd)] - **http**: improve performance with known-length calls to end() (Tim Perry) [#65466](https://github.com/nodejs/node/pull/65466)
+* \[[`7e9204f4b3`](https://github.com/nodejs/node/commit/7e9204f4b3)] - **http**: use intrusive lists in ConnectionsList (Matteo Collina) [#65296](https://github.com/nodejs/node/pull/65296)
+* \[[`98e6272c70`](https://github.com/nodejs/node/commit/98e6272c70)] - **http**: cache maxHeaderPairs per header section (GetThatCookie) [#64988](https://github.com/nodejs/node/pull/64988)
+* \[[`6c3516f179`](https://github.com/nodejs/node/commit/6c3516f179)] - **http**: fix keylog listener setup on existing agent sockets (Shani Singh) [#65066](https://github.com/nodejs/node/pull/65066)
+* \[[`dad9548fbc`](https://github.com/nodejs/node/commit/dad9548fbc)] - **http**: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) [#64991](https://github.com/nodejs/node/pull/64991)
+* \[[`563cab119b`](https://github.com/nodejs/node/commit/563cab119b)] - **http2**: avoid uaf while receiving and sending rst\_stream (esgor) [#64166](https://github.com/nodejs/node/pull/64166)
+* \[[`099801641b`](https://github.com/nodejs/node/commit/099801641b)] - **inspector**: avoid calling into JS from V8 interrupts (Joyee Cheung) [#65028](https://github.com/nodejs/node/pull/65028)
+* \[[`b71d5de0b8`](https://github.com/nodejs/node/commit/b71d5de0b8)] - **lib**: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) [#61500](https://github.com/nodejs/node/pull/61500)
+* \[[`e8e2abcc8d`](https://github.com/nodejs/node/commit/e8e2abcc8d)] - **lib**: load fewer builtins when bootstrapping without a snapshot (Shelley Vohr) [#65329](https://github.com/nodejs/node/pull/65329)
+* \[[`3619dc0601`](https://github.com/nodejs/node/commit/3619dc0601)] - **lib**: fix ERR\_INVALID\_ARG\_TYPE with --enable-source-maps (June) [#63215](https://github.com/nodejs/node/pull/63215)
+* \[[`ad7c67026b`](https://github.com/nodejs/node/commit/ad7c67026b)] - **lib**: harden webidl dictionary member reads (Filip Skokan) [#65115](https://github.com/nodejs/node/pull/65115)
+* \[[`b5182f0a1c`](https://github.com/nodejs/node/commit/b5182f0a1c)] - **lib**: use validateArray for array arguments (greenhead) [#64959](https://github.com/nodejs/node/pull/64959)
+* \[[`7f7df06821`](https://github.com/nodejs/node/commit/7f7df06821)] - **lib**: add and test \[EnforceRange] in webcrypto dictionaries (Filip Skokan) [#65091](https://github.com/nodejs/node/pull/65091)
+* \[[`753033c110`](https://github.com/nodejs/node/commit/753033c110)] - **(SEMVER-MINOR)** **lib,src**: improve histogram implementation (James M Snell) [#65024](https://github.com/nodejs/node/pull/65024)
+* \[[`8d39d0d660`](https://github.com/nodejs/node/commit/8d39d0d660)] - **meta**: add a root-level AGENTS.md (James M Snell) [#65493](https://github.com/nodejs/node/pull/65493)
+* \[[`3770f9baea`](https://github.com/nodejs/node/commit/3770f9baea)] - **meta**: move targos to emeritus (Michaël Zasso) [#65393](https://github.com/nodejs/node/pull/65393)
+* \[[`a9b31dfe30`](https://github.com/nodejs/node/commit/a9b31dfe30)] - **meta**: add unified http api initiative (James M Snell) [#65139](https://github.com/nodejs/node/pull/65139)
+* \[[`6bffc306aa`](https://github.com/nodejs/node/commit/6bffc306aa)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#65182](https://github.com/nodejs/node/pull/65182)
+* \[[`4abd1c8100`](https://github.com/nodejs/node/commit/4abd1c8100)] - **meta**: add support for alpha prerelease tag (Antoine du Hamel) [#63135](https://github.com/nodejs/node/pull/63135)
+* \[[`132c578e97`](https://github.com/nodejs/node/commit/132c578e97)] - **meta**: add Aviv Keller to `.mailmap` (Aviv Keller) [#65048](https://github.com/nodejs/node/pull/65048)
+* \[[`7aff78d231`](https://github.com/nodejs/node/commit/7aff78d231)] - **meta**: update sccache to 0.17.0 (René) [#64985](https://github.com/nodejs/node/pull/64985)
+* \[[`97a437e7ea`](https://github.com/nodejs/node/commit/97a437e7ea)] - **module**: add a read-only mode to the compile cache (Shelley Vohr) [#65302](https://github.com/nodejs/node/pull/65302)
+* \[[`5821362819`](https://github.com/nodejs/node/commit/5821362819)] - **module**: do not split a portable compile cache by uid (Shelley Vohr) [#65293](https://github.com/nodejs/node/pull/65293)
+* \[[`eb5d66e856`](https://github.com/nodejs/node/commit/eb5d66e856)] - **module**: report unreadable package.json (Paul Bouchon) [#65223](https://github.com/nodejs/node/pull/65223)
+* \[[`43757d07c1`](https://github.com/nodejs/node/commit/43757d07c1)] - **module**: cache nearest parent package.json per directory (Shelley Vohr) [#65326](https://github.com/nodejs/node/pull/65326)
+* \[[`d7805e00dc`](https://github.com/nodejs/node/commit/d7805e00dc)] - **module**: fix --check on ambiguous ESM files (Paul Bouchon) [#65203](https://github.com/nodejs/node/pull/65203)
+* \[[`646221a495`](https://github.com/nodejs/node/commit/646221a495)] - **net**: handle undefined parent in \_unrefTimer and \_destroy (Shivay-98) [#64644](https://github.com/nodejs/node/pull/64644)
+* \[[`3d7d277493`](https://github.com/nodejs/node/commit/3d7d277493)] - **(SEMVER-MINOR)** **net**: improve performance of net.BlockList (James M Snell) [#64974](https://github.com/nodejs/node/pull/64974)
+* \[[`9e8e9080fd`](https://github.com/nodejs/node/commit/9e8e9080fd)] - **(SEMVER-MINOR)** **perf\_hooks**: add statistical hypothesis testing to histogram (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`01a8ae0ce6`](https://github.com/nodejs/node/commit/01a8ae0ce6)] - **permission**: guard UDP handle adoption (Rafael Gonzaga) [#65358](https://github.com/nodejs/node/pull/65358)
+* \[[`ac3c412aaf`](https://github.com/nodejs/node/commit/ac3c412aaf)] - **permission**: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) [#65432](https://github.com/nodejs/node/pull/65432)
+* \[[`8765afd4c2`](https://github.com/nodejs/node/commit/8765afd4c2)] - **process**: validate resource stats array offsets (Archkon) [#65098](https://github.com/nodejs/node/pull/65098)
+* \[[`d0447c93f6`](https://github.com/nodejs/node/commit/d0447c93f6)] - **quic**: changes for nghttp3\_conn\_close\_stream2 (Marten Richter) [#64574](https://github.com/nodejs/node/pull/64574)
+* \[[`91393898b5`](https://github.com/nodejs/node/commit/91393898b5)] - **quic**: mark drain promise handled (James M Snell) [#65319](https://github.com/nodejs/node/pull/65319)
+* \[[`5c9576bf50`](https://github.com/nodejs/node/commit/5c9576bf50)] - **quic**: reset rejected HTTP/3 request streams with H3\_REQUEST\_REJECTED (trivenay) [#65442](https://github.com/nodejs/node/pull/65442)
+* \[[`ec956f2abc`](https://github.com/nodejs/node/commit/ec956f2abc)] - **quic**: write desired size needs update on maxstream (Marten Richter) [#64768](https://github.com/nodejs/node/pull/64768)
+* \[[`41c510803d`](https://github.com/nodejs/node/commit/41c510803d)] - **quic**: do not destroy incoming streams that have a consumer (trivenay) [#65335](https://github.com/nodejs/node/pull/65335)
+* \[[`009e376581`](https://github.com/nodejs/node/commit/009e376581)] - **quic**: fix wake up blob (Marten Richter) [#64044](https://github.com/nodejs/node/pull/64044)
+* \[[`4674a10368`](https://github.com/nodejs/node/commit/4674a10368)] - **quic**: convert incoming :status header to number (Hallison Pereira Melo) [#63589](https://github.com/nodejs/node/pull/63589)
+* \[[`5953165f53`](https://github.com/nodejs/node/commit/5953165f53)] - **quic**: fix infinite loop if STOP\_SENDING received on a buffering stream (Tim Perry) [#64715](https://github.com/nodejs/node/pull/64715)
+* \[[`bb499c312e`](https://github.com/nodejs/node/commit/bb499c312e)] - **repl**: keep entries added while history file is loading (Mhayk Whandson) [#64513](https://github.com/nodejs/node/pull/64513)
+* \[[`825fcfe4d5`](https://github.com/nodejs/node/commit/825fcfe4d5)] - **repl**: add benchmarks (Aviv Keller) [#64590](https://github.com/nodejs/node/pull/64590)
+* \[[`c18b0aa54e`](https://github.com/nodejs/node/commit/c18b0aa54e)] - **repl**: add basic syntax highlighting (Aviv Keller) [#64591](https://github.com/nodejs/node/pull/64591)
+* \[[`f32a8631ad`](https://github.com/nodejs/node/commit/f32a8631ad)] - **sea**: avoid dangling CLI option pointers (Archkon) [#64755](https://github.com/nodejs/node/pull/64755)
+* \[[`3126ce5779`](https://github.com/nodejs/node/commit/3126ce5779)] - **sea**: handle NUL bytes in asset keys (Archkon) [#64773](https://github.com/nodejs/node/pull/64773)
+* \[[`64a8843ff2`](https://github.com/nodejs/node/commit/64a8843ff2)] - **sea**: reject trailing content in config JSON (Archkon) [#64774](https://github.com/nodejs/node/pull/64774)
+* \[[`1d9dd252f1`](https://github.com/nodejs/node/commit/1d9dd252f1)] - **sea**: reject malformed --node-options values (Archkon) [#64803](https://github.com/nodejs/node/pull/64803)
+* \[[`6ec735c910`](https://github.com/nodejs/node/commit/6ec735c910)] - **sqlite**: reject reentry while binding parameters (Trevor Burnham) [#65294](https://github.com/nodejs/node/pull/65294)
+* \[[`60cb384c15`](https://github.com/nodejs/node/commit/60cb384c15)] - **sqlite**: remove unused column name helper (Trivikram Kamat) [#65401](https://github.com/nodejs/node/pull/65401)
+* \[[`fce6754a83`](https://github.com/nodejs/node/commit/fce6754a83)] - **sqlite**: reject busy statement finalization in authorizer (Trivikram Kamat) [#65369](https://github.com/nodejs/node/pull/65369)
+* \[[`e2f952f2ff`](https://github.com/nodejs/node/commit/e2f952f2ff)] - **sqlite**: prevent reentrant session.close() (Trivikram Kamat) [#65349](https://github.com/nodejs/node/pull/65349)
+* \[[`0e8af3378a`](https://github.com/nodejs/node/commit/0e8af3378a)] - **sqlite**: reuse cached column names in statement all() and get() (Edy Silva) [#65276](https://github.com/nodejs/node/pull/65276)
+* \[[`e6bfec91be`](https://github.com/nodejs/node/commit/e6bfec91be)] - **sqlite**: validate StatementSync.run() integers (Trivikram Kamat) [#65178](https://github.com/nodejs/node/pull/65178)
+* \[[`bbb1226dbe`](https://github.com/nodejs/node/commit/bbb1226dbe)] - **sqlite**: add diagnostic channel (Guilherme Araújo) [#62241](https://github.com/nodejs/node/pull/62241)
+* \[[`6302168de8`](https://github.com/nodejs/node/commit/6302168de8)] - **sqlite**: add stmt persistent flag (Guilherme Araújo) [#62757](https://github.com/nodejs/node/pull/62757)
+* \[[`2989311d81`](https://github.com/nodejs/node/commit/2989311d81)] - **sqlite**: reject connection access from authorizer callbacks (Trevor Burnham) [#65156](https://github.com/nodejs/node/pull/65156)
+* \[[`72c37b133e`](https://github.com/nodejs/node/commit/72c37b133e)] - **sqlite**: expose prepared statement statistics (Edy Silva) [#64541](https://github.com/nodejs/node/pull/64541)
+* \[[`3e50a2f1e9`](https://github.com/nodejs/node/commit/3e50a2f1e9)] - **sqlite**: manage sqlite3\_stmt lifetime with RAII (Guilherme Araújo) [#62419](https://github.com/nodejs/node/pull/62419)
+* \[[`3ab7e72555`](https://github.com/nodejs/node/commit/3ab7e72555)] - **sqlite**: check sqlite3\_step() and sqlite3\_reset() results (semimikoh) [#63319](https://github.com/nodejs/node/pull/63319)
+* \[[`5e387ce979`](https://github.com/nodejs/node/commit/5e387ce979)] - **sqlite**: reject statement-less SQL in prepare() (Trevor Burnham) [#65157](https://github.com/nodejs/node/pull/65157)
+* \[[`83169e58f3`](https://github.com/nodejs/node/commit/83169e58f3)] - **sqlite**: reject statement-less SQL in SQLTagStore (Trevor Burnham) [#65157](https://github.com/nodejs/node/pull/65157)
+* \[[`7f31f6226e`](https://github.com/nodejs/node/commit/7f31f6226e)] - **sqlite**: isolate applyChangeset filter errors (Trivikram Kamat) [#64823](https://github.com/nodejs/node/pull/64823)
+* \[[`c89878c3c8`](https://github.com/nodejs/node/commit/c89878c3c8)] - **sqlite**: reject deserialize() while in a callback (Trivikram Kamat) [#64796](https://github.com/nodejs/node/pull/64796)
+* \[[`5a852b22d4`](https://github.com/nodejs/node/commit/5a852b22d4)] - **sqlite**: check null returns from sqlite value functions (Nora Dossche) [#63288](https://github.com/nodejs/node/pull/63288)
+* \[[`5cb78ed300`](https://github.com/nodejs/node/commit/5cb78ed300)] - **sqlite**: validate maxSize argument in createTagStore() (Anshika Jain) [#63792](https://github.com/nodejs/node/pull/63792)
+* \[[`ca885876f6`](https://github.com/nodejs/node/commit/ca885876f6)] - **sqlite**: refactor error helpers and user function pointers (Ali Hassan) [#62794](https://github.com/nodejs/node/pull/62794)
+* \[[`06b1758dcd`](https://github.com/nodejs/node/commit/06b1758dcd)] - **sqlite**: reject non-positive backup rates (Trivikram Kamat) [#64893](https://github.com/nodejs/node/pull/64893)
+* \[[`ce0ca47023`](https://github.com/nodejs/node/commit/ce0ca47023)] - **sqlite**: clear SQLTagStore bindings (Matteo Collina) [#65041](https://github.com/nodejs/node/pull/65041)
+* \[[`49fb028714`](https://github.com/nodejs/node/commit/49fb028714)] - **sqlite**: bind Boolean (mike-git374) [#62001](https://github.com/nodejs/node/pull/62001)
+* \[[`09d0da99e9`](https://github.com/nodejs/node/commit/09d0da99e9)] - **sqlite**: fix undefined behaviour in `Session::Changeset()` (Nora Dossche) [#63637](https://github.com/nodejs/node/pull/63637)
+* \[[`58ea88e1d3`](https://github.com/nodejs/node/commit/58ea88e1d3)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype.close() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`7c61b08aed`](https://github.com/nodejs/node/commit/7c61b08aed)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype\[Symbol.dispose]\() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`9167ebd32b`](https://github.com/nodejs/node/commit/9167ebd32b)] - **sqlite**: bind ArrayBuffer (mike-git374) [#62061](https://github.com/nodejs/node/pull/62061)
+* \[[`5da6eaa8af`](https://github.com/nodejs/node/commit/5da6eaa8af)] - **sqlite**: prevent database close during callbacks (Matteo Collina) [#64743](https://github.com/nodejs/node/pull/64743)
+* \[[`29d794bc84`](https://github.com/nodejs/node/commit/29d794bc84)] - **src**: fix heap value deduplication in embedder graph (Ilyas Shabi) [#64801](https://github.com/nodejs/node/pull/64801)
+* \[[`b405e9b039`](https://github.com/nodejs/node/commit/b405e9b039)] - **src**: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) [#64512](https://github.com/nodejs/node/pull/64512)
+* \[[`101a215472`](https://github.com/nodejs/node/commit/101a215472)] - **src**: use simdutf for two-byte utf8 conversion (Mert Can Altin) [#62248](https://github.com/nodejs/node/pull/62248)
+* \[[`340b98346f`](https://github.com/nodejs/node/commit/340b98346f)] - **src**: run same-priority platform tasks in posting order (Shelley Vohr) [#65353](https://github.com/nodejs/node/pull/65353)
+* \[[`83a7949c18`](https://github.com/nodejs/node/commit/83a7949c18)] - **src**: define O\_SYNC, O\_DSYNC and O\_DIRECT on Windows (Kirill Saied) [#64707](https://github.com/nodejs/node/pull/64707)
+* \[[`32bb197f2a`](https://github.com/nodejs/node/commit/32bb197f2a)] - **src**: use simdutf for two-byte strings in UTF-8 writes (Shelley Vohr) [#65324](https://github.com/nodejs/node/pull/65324)
+* \[[`613be79cf4`](https://github.com/nodejs/node/commit/613be79cf4)] - **src**: add v8::Local specialization for MaybeStackBuffer (James M Snell) [#65159](https://github.com/nodejs/node/pull/65159)
+* \[[`922d47cbd7`](https://github.com/nodejs/node/commit/922d47cbd7)] - **src**: escape Windows environment variables in task runner (Antoine du Hamel) [#65217](https://github.com/nodejs/node/pull/65217)
+* \[[`3a47f1f282`](https://github.com/nodejs/node/commit/3a47f1f282)] - **src**: apply minor namespace format tweak in permissions (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`981cfa537d`](https://github.com/nodejs/node/commit/981cfa537d)] - **src**: simplify permissions with BooleanPermissions (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`5954b13f88`](https://github.com/nodejs/node/commit/5954b13f88)] - **src**: simplify includes in permissions (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`d4ced88c09`](https://github.com/nodejs/node/commit/d4ced88c09)] - **src**: apply a modest performance perf to permissions (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`efb649ec26`](https://github.com/nodejs/node/commit/efb649ec26)] - **src**: make permission storage a bit more efficient (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`521aaf10fc`](https://github.com/nodejs/node/commit/521aaf10fc)] - **src**: apply multiple general cleanups to permissions (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`ac920e0d2b`](https://github.com/nodejs/node/commit/ac920e0d2b)] - **src**: simplify c++ diagnostics channel API (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`ec8fe275a1`](https://github.com/nodejs/node/commit/ec8fe275a1)] - **src**: make minor cleanup to permission checks (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`968bdd0135`](https://github.com/nodejs/node/commit/968bdd0135)] - **src**: use DictionaryTemplate for permission diag channel message (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`f77aa2f703`](https://github.com/nodejs/node/commit/f77aa2f703)] - **src**: cache permission strings (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`4018f3a776`](https://github.com/nodejs/node/commit/4018f3a776)] - **src**: shave about 20 bytes off each TLSWrap instance (James M Snell) [#65144](https://github.com/nodejs/node/pull/65144)
+* \[[`b7a23426d9`](https://github.com/nodejs/node/commit/b7a23426d9)] - **src**: add SetAbortHandler (Max H Fisher) [#64684](https://github.com/nodejs/node/pull/64684)
+* \[[`3cfe19489c`](https://github.com/nodejs/node/commit/3cfe19489c)] - **src**: use concepts where appropriate (James M Snell) [#65148](https://github.com/nodejs/node/pull/65148)
+* \[[`d8a0f288ab`](https://github.com/nodejs/node/commit/d8a0f288ab)] - **src**: match cmd.exe case-insensitively in task runner (Archkon) [#64907](https://github.com/nodejs/node/pull/64907)
+* \[[`262d88e6c2`](https://github.com/nodejs/node/commit/262d88e6c2)] - **src**: reuse cached env strings in remaining files (Seongeun Lee) [#65039](https://github.com/nodejs/node/pull/65039)
+* \[[`ad35fe97f0`](https://github.com/nodejs/node/commit/ad35fe97f0)] - **src**: expose Windows-only fs open flags (Kirill Saied) [#64775](https://github.com/nodejs/node/pull/64775)
+* \[[`8c4531bbc9`](https://github.com/nodejs/node/commit/8c4531bbc9)] - **src**: report why --enable-fips failed (Filip Skokan) [#64979](https://github.com/nodejs/node/pull/64979)
+* \[[`a293dbf0e1`](https://github.com/nodejs/node/commit/a293dbf0e1)] - **src**: update repeated use strings to env (James M Snell) [#64760](https://github.com/nodejs/node/pull/64760)
+* \[[`044402cf0e`](https://github.com/nodejs/node/commit/044402cf0e)] - **src**: use UTF-8 for task runner filesystem paths (Archkon) [#64868](https://github.com/nodejs/node/pull/64868)
+* \[[`5b7d02e401`](https://github.com/nodejs/node/commit/5b7d02e401)] - **stream**: normalize fused stateless transform results (Trivikram Kamat) [#65367](https://github.com/nodejs/node/pull/65367)
+* \[[`1d6ec2ddc5`](https://github.com/nodejs/node/commit/1d6ec2ddc5)] - **stream**: encode whole chunks in TextEncoderStream (Matteo Collina) [#65414](https://github.com/nodejs/node/pull/65414)
+* \[[`0afda47ca4`](https://github.com/nodejs/node/commit/0afda47ca4)] - **stream**: prevent share from eagerly draining source (Trivikram Kamat) [#65338](https://github.com/nodejs/node/pull/65338)
+* \[[`dc51c7926e`](https://github.com/nodejs/node/commit/dc51c7926e)] - **stream**: drain pending writes before broadcast end (Trivikram Kamat) [#65334](https://github.com/nodejs/node/pull/65334)
+* \[[`a77f9f7a32`](https://github.com/nodejs/node/commit/a77f9f7a32)] - **stream**: reuse unexposed managed read buffers (GetThatCookie) [#64990](https://github.com/nodejs/node/pull/64990)
+* \[[`c42fbcc0d1`](https://github.com/nodejs/node/commit/c42fbcc0d1)] - **stream**: avoid duplicated endReadableNT scheduling (Matteo Collina) [#65310](https://github.com/nodejs/node/pull/65310)
+* \[[`9ec9383d1d`](https://github.com/nodejs/node/commit/9ec9383d1d)] - **stream**: decouple transform backpressure changes (Matteo Collina) [#65143](https://github.com/nodejs/node/pull/65143)
+* \[[`a9dc50d275`](https://github.com/nodejs/node/commit/a9dc50d275)] - **stream**: reject pull on signal abort during flush (Trivikram Kamat) [#65346](https://github.com/nodejs/node/pull/65346)
+* \[[`815424db74`](https://github.com/nodejs/node/commit/815424db74)] - **stream**: avoid leaking consumers on signal failure (Trivikram Kamat) [#65299](https://github.com/nodejs/node/pull/65299)
+* \[[`6a2e0561e8`](https://github.com/nodejs/node/commit/6a2e0561e8)] - **stream**: use validateObject for zlib/iter params (greenhead) [#65015](https://github.com/nodejs/node/pull/65015)
+* \[[`4f6f2cfffa`](https://github.com/nodejs/node/commit/4f6f2cfffa)] - **stream**: use validateNumber for BYOB reader options.min (greenhead) [#65014](https://github.com/nodejs/node/pull/65014)
+* \[[`4d297428e6`](https://github.com/nodejs/node/commit/4d297428e6)] - **stream**: consolidate non-op algorithm callbacks (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`f7e0c81be4`](https://github.com/nodejs/node/commit/f7e0c81be4)] - **stream**: cut promise churn in webstreams hot paths (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`5edffb544f`](https://github.com/nodejs/node/commit/5edffb544f)] - **stream**: speed up async iteration of Readable (Matteo Collina) [#64447](https://github.com/nodejs/node/pull/64447)
+* \[[`0876a29bb6`](https://github.com/nodejs/node/commit/0876a29bb6)] - **stream**: preserve falsy cancellation reasons (Trivikram Kamat) [#64705](https://github.com/nodejs/node/pull/64705)
+* \[[`374f7e214d`](https://github.com/nodejs/node/commit/374f7e214d)] - **stream**: use validateBuffer for BYOB reader view (greenhead) [#65046](https://github.com/nodejs/node/pull/65046)
+* \[[`6bd15b2ac9`](https://github.com/nodejs/node/commit/6bd15b2ac9)] - **stream**: fix recursive WritableStream abort (Jeong SeokChan) [#64825](https://github.com/nodejs/node/pull/64825)
+* \[[`f33dba704d`](https://github.com/nodejs/node/commit/f33dba704d)] - **string\_decoder**: decode UTF-8 via StringBytes::Encode (Shelley Vohr) [#65324](https://github.com/nodejs/node/pull/65324)
+* \[[`6409983a6c`](https://github.com/nodejs/node/commit/6409983a6c)] - **test**: update WPT for WebCryptoAPI to e235e089b4 (Node.js GitHub Bot) [#65478](https://github.com/nodejs/node/pull/65478)
+* \[[`01cb4f99a0`](https://github.com/nodejs/node/commit/01cb4f99a0)] - **test**: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) [#65279](https://github.com/nodejs/node/pull/65279)
+* \[[`359369e24e`](https://github.com/nodejs/node/commit/359369e24e)] - **test**: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) [#65351](https://github.com/nodejs/node/pull/65351)
+* \[[`9304dee833`](https://github.com/nodejs/node/commit/9304dee833)] - **test**: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) [#65424](https://github.com/nodejs/node/pull/65424)
+* \[[`30f1a19eec`](https://github.com/nodejs/node/commit/30f1a19eec)] - **test**: simplify test-timers-interval-promisified.js (Donghoon Kang) [#65322](https://github.com/nodejs/node/pull/65322)
+* \[[`acaf986ad5`](https://github.com/nodejs/node/commit/acaf986ad5)] - **test**: add Headers coverage and benchmark (Yagiz Nizipli) [#65365](https://github.com/nodejs/node/pull/65365)
+* \[[`b6852e2b96`](https://github.com/nodejs/node/commit/b6852e2b96)] - **test**: deflake test-net-listen-ipv6only (sangwook) [#64173](https://github.com/nodejs/node/pull/64173)
+* \[[`235a0baf8b`](https://github.com/nodejs/node/commit/235a0baf8b)] - **test**: use common/child\_process spawnSync helpers (Junsoo Ha) [#65377](https://github.com/nodejs/node/pull/65377)
+* \[[`29f010fbb0`](https://github.com/nodejs/node/commit/29f010fbb0)] - **test**: fix Linux debug skip in SEA test guard (구현우) [#63751](https://github.com/nodejs/node/pull/63751)
+* \[[`33d7b4c6b3`](https://github.com/nodejs/node/commit/33d7b4c6b3)] - **test**: add closed-library assertions for getFunctions and getSymbols (Anshika Jain) [#63769](https://github.com/nodejs/node/pull/63769)
+* \[[`24a76e18ec`](https://github.com/nodejs/node/commit/24a76e18ec)] - **test**: avoid timer race in event loop delay test (Trivikram Kamat) [#64728](https://github.com/nodejs/node/pull/64728)
+* \[[`fdc1e78595`](https://github.com/nodejs/node/commit/fdc1e78595)] - **test**: enforce exit code in `test-http-server-stale-close` (Antoine du Hamel) [#65198](https://github.com/nodejs/node/pull/65198)
+* \[[`c644f2e07c`](https://github.com/nodejs/node/commit/c644f2e07c)] - **test**: convert test-async-local-storage-bind to async loop (freida-code) [#65270](https://github.com/nodejs/node/pull/65270)
+* \[[`1d5e5e8f43`](https://github.com/nodejs/node/commit/1d5e5e8f43)] - **test**: replace `forEach()` with `for...of` in parallel tests (Phillip Markert) [#65272](https://github.com/nodejs/node/pull/65272)
+* \[[`9346570fed`](https://github.com/nodejs/node/commit/9346570fed)] - **test**: convert forEach to for in test-constant.js file (NIxxy25) [#65271](https://github.com/nodejs/node/pull/65271)
+* \[[`7af0a96090`](https://github.com/nodejs/node/commit/7af0a96090)] - **test**: use for-of instead of forEach (Felix P.) [#65268](https://github.com/nodejs/node/pull/65268)
+* \[[`63e6f2edc3`](https://github.com/nodejs/node/commit/63e6f2edc3)] - **test**: wait for FFI background optimization (Trivikram Kamat) [#65300](https://github.com/nodejs/node/pull/65300)
+* \[[`bca3367583`](https://github.com/nodejs/node/commit/bca3367583)] - **test**: add a simple test for `import defer` of a CJS module (Maya Lekova) [#64694](https://github.com/nodejs/node/pull/64694)
+* \[[`00b687bc4a`](https://github.com/nodejs/node/commit/00b687bc4a)] - **test**: cover ZIP fd lifecycle and add rollback (Philipp Dunkel) [#65016](https://github.com/nodejs/node/pull/65016)
+* \[[`31742f2f42`](https://github.com/nodejs/node/commit/31742f2f42)] - **test**: cover ZIP header-confusion and DoS guards (Philipp Dunkel) [#65016](https://github.com/nodejs/node/pull/65016)
+* \[[`87ee7bff38`](https://github.com/nodejs/node/commit/87ee7bff38)] - **test**: cover `realpathSync` resolving symlinks after a FIFO stat (Hendrik Liebau) [#65113](https://github.com/nodejs/node/pull/65113)
+* \[[`fd7e904433`](https://github.com/nodejs/node/commit/fd7e904433)] - **test**: update tests to run with OpenSSL >= 3.0 FIPS mode (Filip Skokan) [#64960](https://github.com/nodejs/node/pull/64960)
+* \[[`219495fe2c`](https://github.com/nodejs/node/commit/219495fe2c)] - **test**: account for \[EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) [#65173](https://github.com/nodejs/node/pull/65173)
+* \[[`bf86fab458`](https://github.com/nodejs/node/commit/bf86fab458)] - **test**: add permission fast api test (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`cc19107e5d`](https://github.com/nodejs/node/commit/cc19107e5d)] - **test**: update WPT for WebCryptoAPI to 4c2fd05ed5 (Node.js GitHub Bot) [#65150](https://github.com/nodejs/node/pull/65150)
+* \[[`69e4fabb29`](https://github.com/nodejs/node/commit/69e4fabb29)] - **test**: update WPT for urlpattern to 4832db4761 (Node.js GitHub Bot) [#65151](https://github.com/nodejs/node/pull/65151)
+* \[[`b1aa78a57e`](https://github.com/nodejs/node/commit/b1aa78a57e)] - **test**: fix hidden error in test-http-server-stale-close.js (Meghan Denny) [#59357](https://github.com/nodejs/node/pull/59357)
+* \[[`59d7e22a12`](https://github.com/nodejs/node/commit/59d7e22a12)] - **test**: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) [#65079](https://github.com/nodejs/node/pull/65079)
+* \[[`7074ae30fa`](https://github.com/nodejs/node/commit/7074ae30fa)] - **test**: allow half-open CONNECT tunnel sockets (Trivikram Kamat) [#64973](https://github.com/nodejs/node/pull/64973)
+* \[[`82b2d9c08d`](https://github.com/nodejs/node/commit/82b2d9c08d)] - **test**: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) [#65077](https://github.com/nodejs/node/pull/65077)
+* \[[`7f3a42035c`](https://github.com/nodejs/node/commit/7f3a42035c)] - **test**: use libuv clock for immediate queue test (Trivikram Kamat) [#64889](https://github.com/nodejs/node/pull/64889)
+* \[[`7ddd853d8c`](https://github.com/nodejs/node/commit/7ddd853d8c)] - **test**: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) [#64719](https://github.com/nodejs/node/pull/64719)
+* \[[`28cad47cef`](https://github.com/nodejs/node/commit/28cad47cef)] - **test**: update WPT for WebCryptoAPI to 82c3d9069c (Node.js GitHub Bot) [#64977](https://github.com/nodejs/node/pull/64977)
+* \[[`74a3e91bb7`](https://github.com/nodejs/node/commit/74a3e91bb7)] - **test**: prefer in-memory databases in sqlite tests (Paul Bouchon) [#64701](https://github.com/nodejs/node/pull/64701)
+* \[[`7fc8a3ad8c`](https://github.com/nodejs/node/commit/7fc8a3ad8c)] - **test,doc**: cover and document multi-byte offset/size in randomFill (kyungrae2002) [#64834](https://github.com/nodejs/node/pull/64834)
+* \[[`4de7e63883`](https://github.com/nodejs/node/commit/4de7e63883)] - **test\_runner**: match dotfiles in default coverage exclude (semimikoh) [#63401](https://github.com/nodejs/node/pull/63401)
+* \[[`79c39c217d`](https://github.com/nodejs/node/commit/79c39c217d)] - **test\_runner**: print coverage and diagnostic info with dot reporter (mag123c) [#61423](https://github.com/nodejs/node/pull/61423)
+* \[[`cce803b174`](https://github.com/nodejs/node/commit/cce803b174)] - **test\_runner**: use run options with isolation="none" (Sylvester Keil) [#62269](https://github.com/nodejs/node/pull/62269)
+* \[[`797ef40d23`](https://github.com/nodejs/node/commit/797ef40d23)] - **test\_runner**: mock dual-package with conditional exports (Maruthan G) [#62943](https://github.com/nodejs/node/pull/62943)
+* \[[`1ad7ca310a`](https://github.com/nodejs/node/commit/1ad7ca310a)] - **test\_runner**: restore directory search for --test (Paul Bouchon) [#64637](https://github.com/nodejs/node/pull/64637)
+* \[[`400d598b3c`](https://github.com/nodejs/node/commit/400d598b3c)] - **test\_runner**: add classname hierarchy for JUnit reporter (mag123c) [#60220](https://github.com/nodejs/node/pull/60220)
+* \[[`9572a0b15f`](https://github.com/nodejs/node/commit/9572a0b15f)] - **test\_runner**: fix junit report on empty diagnostic (Lazizbek Ergashev) [#65357](https://github.com/nodejs/node/pull/65357)
+* \[[`e3fda695fe`](https://github.com/nodejs/node/commit/e3fda695fe)] - **test\_runner**: extend tag filter with boolean expression DSL (Chemi Atlow) [#63054](https://github.com/nodejs/node/pull/63054)
+* \[[`4e06739c7b`](https://github.com/nodejs/node/commit/4e06739c7b)] - **test\_runner**: do not tag-filter test file wrappers (Chemi Atlow) [#65170](https://github.com/nodejs/node/pull/65170)
+* \[[`e73f74738d`](https://github.com/nodejs/node/commit/e73f74738d)] - **test\_runner**: fix env option validation (Jihwan) [#64865](https://github.com/nodejs/node/pull/64865)
+* \[[`2a0b1ec4cc`](https://github.com/nodejs/node/commit/2a0b1ec4cc)] - **tls**: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) [#65076](https://github.com/nodejs/node/pull/65076)
+* \[[`15da4a190b`](https://github.com/nodejs/node/commit/15da4a190b)] - **tls**: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) [#64677](https://github.com/nodejs/node/pull/64677)
+* \[[`1864175435`](https://github.com/nodejs/node/commit/1864175435)] - **tls**: don't trigger SNICallback or OCSPRequest from the TLS lib stack (Tim Perry) [#64827](https://github.com/nodejs/node/pull/64827)
+* \[[`8f4ee7eda5`](https://github.com/nodejs/node/commit/8f4ee7eda5)] - **tls**: drop hand-rolled TLS client hello parser (Tim Perry) [#64827](https://github.com/nodejs/node/pull/64827)
+* \[[`a457631496`](https://github.com/nodejs/node/commit/a457631496)] - **tools**: improve commit queue failure comment (Filip Skokan) [#65433](https://github.com/nodejs/node/pull/65433)
+* \[[`78175c68f8`](https://github.com/nodejs/node/commit/78175c68f8)] - **tools**: improve nix-changes coverage (Antoine du Hamel) [#65403](https://github.com/nodejs/node/pull/65403)
+* \[[`6f0c08bf80`](https://github.com/nodejs/node/commit/6f0c08bf80)] - **tools**: refactor `shell.nix` pkcs11 integration to its own section (Antoine du Hamel) [#65404](https://github.com/nodejs/node/pull/65404)
+* \[[`35b18b4455`](https://github.com/nodejs/node/commit/35b18b4455)] - **tools**: fix max body length handler in `create-release-proposal.sh` (Antoine du Hamel) [#65455](https://github.com/nodejs/node/pull/65455)
+* \[[`88d5f644a2`](https://github.com/nodejs/node/commit/88d5f644a2)] - **tools**: bump brace-expansion in `/tools/clang-format` (dependabot\[bot]) [#64984](https://github.com/nodejs/node/pull/64984)
+* \[[`41edd2f214`](https://github.com/nodejs/node/commit/41edd2f214)] - **tools**: make env variables consistent in cron jobs (Antoine du Hamel) [#65168](https://github.com/nodejs/node/pull/65168)
+* \[[`7c09bd5ece`](https://github.com/nodejs/node/commit/7c09bd5ece)] - **tools**: fix man-page generation on Windows (James Ross) [#64886](https://github.com/nodejs/node/pull/64886)
+* \[[`1a20d27118`](https://github.com/nodejs/node/commit/1a20d27118)] - **tools**: bump undici from 6.27.0 to 6.28.0 in /tools/doc (dependabot\[bot]) [#65011](https://github.com/nodejs/node/pull/65011)
+* \[[`ebbe4af869`](https://github.com/nodejs/node/commit/ebbe4af869)] - **tools**: fix linter when `permittedInsecurePackages` is empty (Antoine du Hamel) [#65226](https://github.com/nodejs/node/pull/65226)
+* \[[`17d2b067bf`](https://github.com/nodejs/node/commit/17d2b067bf)] - **tools**: update BoringSSL pin on v26.x (Filip Skokan) [#65483](https://github.com/nodejs/node/pull/65483)
+* \[[`be4e7de04c`](https://github.com/nodejs/node/commit/be4e7de04c)] - **tools**: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) [#65197](https://github.com/nodejs/node/pull/65197)
+* \[[`53d52731c9`](https://github.com/nodejs/node/commit/53d52731c9)] - **tools**: fix quote escaping in `update-nixpkgs-pin.sh` (Antoine du Hamel) [#65166](https://github.com/nodejs/node/pull/65166)
+* \[[`40b1b18839`](https://github.com/nodejs/node/commit/40b1b18839)] - **tools**: remove skip logic in `commit-queue.sh` (Antoine du Hamel) [#65162](https://github.com/nodejs/node/pull/65162)
+* \[[`5506f77924`](https://github.com/nodejs/node/commit/5506f77924)] - **tools**: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot\[bot]) [#65129](https://github.com/nodejs/node/pull/65129)
+* \[[`fc038a0ef5`](https://github.com/nodejs/node/commit/fc038a0ef5)] - **tools**: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot\[bot]) [#65130](https://github.com/nodejs/node/pull/65130)
+* \[[`10b2c8a873`](https://github.com/nodejs/node/commit/10b2c8a873)] - **tools**: fix GITHUB\_TOKEN permissions for CQ workflow (Antoine du Hamel) [#65192](https://github.com/nodejs/node/pull/65192)
+* \[[`73de450845`](https://github.com/nodejs/node/commit/73de450845)] - **tools**: use the read-only token when filtering PRs in CQ (Antoine du Hamel) [#65169](https://github.com/nodejs/node/pull/65169)
+* \[[`31c1bcb627`](https://github.com/nodejs/node/commit/31c1bcb627)] - **tools**: delay removal of `commit-queue` label (Antoine du Hamel) [#65101](https://github.com/nodejs/node/pull/65101)
+* \[[`89d3905595`](https://github.com/nodejs/node/commit/89d3905595)] - **tools**: move ncu config to global for commit queue (Filip Skokan) [#65132](https://github.com/nodejs/node/pull/65132)
+* \[[`aa3b598e2e`](https://github.com/nodejs/node/commit/aa3b598e2e)] - **tools**: prefilter commit queue metadata (Filip Skokan) [#64343](https://github.com/nodejs/node/pull/64343)
+* \[[`4f2c634258`](https://github.com/nodejs/node/commit/4f2c634258)] - **tools**: lazy-abort failed PR merges in CQ (Antoine du Hamel) [#65004](https://github.com/nodejs/node/pull/65004)
+* \[[`8657497521`](https://github.com/nodejs/node/commit/8657497521)] - **tools**: fix `pkcs11-store-test` check (Antoine du Hamel) [#65023](https://github.com/nodejs/node/pull/65023)
+* \[[`0e1a99ac24`](https://github.com/nodejs/node/commit/0e1a99ac24)] - **tools**: add an OpenSSL FIPS build to test-shared.yml (Filip Skokan) [#64960](https://github.com/nodejs/node/pull/64960)
+* \[[`b6fa9c1819`](https://github.com/nodejs/node/commit/b6fa9c1819)] - **tools**: sync mk-ca-bundle.pl with curl (Archkon) [#64753](https://github.com/nodejs/node/pull/64753)
+* \[[`f0140d7ebd`](https://github.com/nodejs/node/commit/f0140d7ebd)] - **tools**: store "default" OpenSSL version in `openssl-matrix.nix` (Antoine du Hamel) [#64962](https://github.com/nodejs/node/pull/64962)
+* \[[`4c8d8afa99`](https://github.com/nodejs/node/commit/4c8d8afa99)] - **tools**: remove `true` from branch name for auto-update automation (Antoine du Hamel) [#64961](https://github.com/nodejs/node/pull/64961)
+* \[[`2dd7d4c56f`](https://github.com/nodejs/node/commit/2dd7d4c56f)] - **tools**: add ./tools/nix/pkcs11.nix to nix-changes.yml (Filip Skokan) [#64967](https://github.com/nodejs/node/pull/64967)
+* \[[`cf395004ed`](https://github.com/nodejs/node/commit/cf395004ed)] - **tty**: add raw-vt and io raw modes (Samuel Williams) [#64140](https://github.com/nodejs/node/pull/64140)
+* \[[`a5e5c7f756`](https://github.com/nodejs/node/commit/a5e5c7f756)] - **typings**: add signal\_wrap internal binding types (Seongeun Lee) [#65229](https://github.com/nodejs/node/pull/65229)
+* \[[`5219e53dd6`](https://github.com/nodejs/node/commit/5219e53dd6)] - **typings**: add diagnostics\_channel typings (Seongeun Lee) [#65227](https://github.com/nodejs/node/pull/65227)
+* \[[`215223dff1`](https://github.com/nodejs/node/commit/215223dff1)] - **typings**: add watchdog internal binding types (Seongeun Lee) [#65228](https://github.com/nodejs/node/pull/65228)
+* \[[`eb095a94bd`](https://github.com/nodejs/node/commit/eb095a94bd)] - **typings**: add internal\_only\_v8 binding typeis (Donghoon Kang) [#65071](https://github.com/nodejs/node/pull/65071)
+* \[[`9fc811a0f2`](https://github.com/nodejs/node/commit/9fc811a0f2)] - **typings**: add credentials internal binding types (Donghoon Kang) [#65036](https://github.com/nodejs/node/pull/65036)
+* \[[`f032c22430`](https://github.com/nodejs/node/commit/f032c22430)] - **url**: skip unused href reuse comparison (Yagiz Nizipli) [#65361](https://github.com/nodejs/node/pull/65361)
+* \[[`2a64032141`](https://github.com/nodejs/node/commit/2a64032141)] - **url**: speed up WHATWG URL parsing (Yagiz Nizipli) [#65361](https://github.com/nodejs/node/pull/65361)
+* \[[`c4dbe14ec6`](https://github.com/nodejs/node/commit/c4dbe14ec6)] - **url**: speed up URLSearchParams (Yagiz Nizipli) [#65363](https://github.com/nodejs/node/pull/65363)
+* \[[`001c37c0a2`](https://github.com/nodejs/node/commit/001c37c0a2)] - **url**: bounds-check short Windows file URL paths (Archkon) [#64788](https://github.com/nodejs/node/pull/64788)
+* \[[`1a63416b1a`](https://github.com/nodejs/node/commit/1a63416b1a)] - **url**: handle unparsable serialized URLs in setters (Matteo Collina) [#64651](https://github.com/nodejs/node/pull/64651)
+* \[[`cb4b89c018`](https://github.com/nodejs/node/commit/cb4b89c018)] - **util**: allow single-line format when break length is infinite (Hamid Reza Ghavami) [#64238](https://github.com/nodejs/node/pull/64238)
+* \[[`f644853680`](https://github.com/nodejs/node/commit/f644853680)] - **util**: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) [#64319](https://github.com/nodejs/node/pull/64319)
+* \[[`eb1ebbb39d`](https://github.com/nodejs/node/commit/eb1ebbb39d)] - **util**: fix formatting of functions returned from getters (Richard Gibson) [#64839](https://github.com/nodejs/node/pull/64839)
+* \[[`f373dab724`](https://github.com/nodejs/node/commit/f373dab724)] - **util**: use more primordials in `comparisons.js` (Ayoub Mabrouk) [#61198](https://github.com/nodejs/node/pull/61198)
+* \[[`6ca9c1e078`](https://github.com/nodejs/node/commit/6ca9c1e078)] - **util**: preserve function names without source map names (Hiroki Osame) [#65108](https://github.com/nodejs/node/pull/65108)
+* \[[`4299cd5897`](https://github.com/nodejs/node/commit/4299cd5897)] - **(SEMVER-MINOR)** **util**: add non-throwing MIMEType.parse (James M Snell) [#64965](https://github.com/nodejs/node/pull/64965)
+* \[[`1aafd19813`](https://github.com/nodejs/node/commit/1aafd19813)] - **zlib**: roll back a failed add() directory rewrite (Philipp Dunkel) [#65016](https://github.com/nodejs/node/pull/65016)
+* \[[`d29cc0926a`](https://github.com/nodejs/node/commit/d29cc0926a)] - **zlib**: let a ZipFile read finish before close() (Philipp Dunkel) [#65016](https://github.com/nodejs/node/pull/65016)
+* \[[`2bda6db916`](https://github.com/nodejs/node/commit/2bda6db916)] - **zlib**: do not hang archiving a FIFO or device (Philipp Dunkel) [#65016](https://github.com/nodejs/node/pull/65016)
+* \[[`55b04957c9`](https://github.com/nodejs/node/commit/55b04957c9)] - **zlib**: reject local/central ZIP header mismatch (Philipp Dunkel) [#65016](https://github.com/nodejs/node/pull/65016)
+* \[[`575260d3b4`](https://github.com/nodejs/node/commit/575260d3b4)] - **zlib**: validate central directory record count (Matteo Collina) [#65002](https://github.com/nodejs/node/pull/65002)
+* \[[`8e848d9be3`](https://github.com/nodejs/node/commit/8e848d9be3)] - **zlib**: reject ambiguous ZIP archive ends (Matteo Collina) [#65007](https://github.com/nodejs/node/pull/65007)
+* \[[`df48191061`](https://github.com/nodejs/node/commit/df48191061)] - **(SEMVER-MINOR)** **zlib**: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) [#64339](https://github.com/nodejs/node/pull/64339)
+* \[[`ee7bf09090`](https://github.com/nodejs/node/commit/ee7bf09090)] - **zlib**: validate pledgedSrcSize for sync zstd (Archkon) [#64601](https://github.com/nodejs/node/pull/64601)
+
 <a id="26.7.0"></a>
 
 ## 2026-08-05, Version 26.7.0 (Current), @aduh95
diff --git a/src/node_version.h b/src/node_version.h
index 95d6aa79439c..9f0b2c879aa4 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -23,13 +23,13 @@
 #define SRC_NODE_VERSION_H_
 
 #define NODE_MAJOR_VERSION 26
-#define NODE_MINOR_VERSION 7
-#define NODE_PATCH_VERSION 1
+#define NODE_MINOR_VERSION 8
+#define NODE_PATCH_VERSION 0
 
 #define NODE_VERSION_IS_LTS 0
 #define NODE_VERSION_LTS_CODENAME ""
 
-#define NODE_VERSION_IS_RELEASE 0
+#define NODE_VERSION_IS_RELEASE 1
 
 #define NODE_ALPHA_MAJOR_VERSION 0
 #define NODE_ALPHA_MINOR_VERSION 0